Attachment 1 - CyOSST IV Statement of Work (SOW) 25 Sep 24.pdf

STATEMENT OF WORK (SOW)

FOR

CYBER OPERATIONS SUPPLEMENTAL SKILLS TRAINING IV

(CYOSST IV)

39TH INFORMATION OPERATIONS SQUADRON (39 IOS)

HURLBURT FIELD, FLORIDA 32544

25 September 2024

CYOSST IV

1. DESCRIPTION

The requirement is to purchase vouchers for the VENDOR’s comprehensive portfolio of commercially available off-the-shelf (COTS) assessments, training courses and certification.

Vouchers are redeemable for a minimum of fifteen (15) students with the option to add students at a per-seat cost. Classes are taught:

on-site at the 39 IOS, Hurlburt Field FL, 39 IOS Detachment 1 (Det 1), JBSA, TX, 39 IOS Detachment 2 (Det 2), Keesler AFB, MS, Government facilities acquired for the purposes of Cyber student instruction, VENDOR facilities, and/or Live online or On-Demand delivery.

Multiple classes may be in session at the same time at multiple locations.

2. BACKGROUND INFORMATION

2.1. The cyberspace domain is a contested domain. Unlike the other domains of Air, Land, Sea, and Space, the cyber domain is required to create and maintain the domain in order to produce battlespace effects for commanders within the domain.

2.2. The Cyber domain is also used to create cross-domain effects by providing the conduit for battlespace effects between Air, Land, Sea, Space, and including Cyberspace (kinetic and non-kinetic effects). The Cyberspace domain will remain correlated and interconnected with other Air Force (AF) domains. Within the cyber domain, multiple functional network types exist. As technology improves and functional networks converge to automate more and more of our military and civilian processes, our nation’s networks and critical infrastructure are vulnerable to attack and must be aggressively defended. The increasing complexity of the AF domain is much more dependent on civilian industry than on military development. The ability to integrate civilian cyber security technology with military rigor, tactics, techniques and discipline is paramount to the nation’s defense.

2.3. Air Force Cyber Command (AFCYBER) Forces provides direct support to the United States Cyber Command (USCYBERCOM) as part of the Cyber Mission Forces (CMF), Cyber Security Service Providers (CSSP), and the 16th Air Force (16AF) Cyber Weapon System (WPS) crew members positions; In Accordance With (IAW) USCYBERCOM Joint Cyberspace Training and Certification Standards (JCT&CS), AF and Air Combat Command (ACC) 17 series publications, ACC/A326K (Warfare division) tasking, USCYBERCOM Course Design Document (CDD), ACC approved course syllabi, and ACC approved Master Task Training List (MTTL). The 39 Information Operations Squadron (39 IOS), as the Cyber Operations Formal Training Unit (FTU), is to provide military and commercial Cyber security training courses for the AFCYBER and USCYBERCOM teams.

2.4. The primary Cyber Operations training audience is 16AF, AFCYBER, and ACC. They, in turn, support ACC, United States Air Force (USAF), and United States Cyber Command (USCC), and Department of Defense (DoD) Chief Information Operations DCWF work roles supporting CMF, the United States Government and Allies in support of USCC.

2.5. The DCWF describes the work performed by the full spectrum of the cyber workforce as defined in DoD Directive (DoDD) 8140.01. The DCWF leverages the original National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NCWF) and the DoD JCT&CS. It has a hierarchical structure with seven (7) broad categories, 33 specialty areas, and 54 work roles. Each work role contains a definition, as well as a representative list of tasks and knowledge, skills and abilities (KSAs) describing what is needed to execute key functions. Work roles vary in terms of breadth (requirements spanning multiple sets of functions) and depth (requirements focused on a related set of functions.

2.6. The four (4) CMF team supported are Cyber Protection Teams (CPT), Cyber Mission Teams (CMT), Cyber Support Teams (CST), National Mission Teams (NMT), and cyber weapons systems crew member positions. The training supports cyber operation crew members who must satisfactorily complete Initial Qualification Training (IQT), Mission Qualification Training (MQT), and require Upgrade Training to maintain certification and proficiency in their job role.

3. SPECIFIC REQUIREMENTS

3.1. Training Vouchers: Each Private training voucher is good for one (1) student to attend one

(1) class and includes two (2) practice tests and one (1) certification test attempt. Each Public and/or Online training voucher is good for one (1) student to attend one (1) class.

3.2. Class Size: Each Private class will consist of a minimum of 15 students; all with the option to add students to the class at a per-seat cost.

3.3. The 39 IOS staff will proctor the on-line vendor tests at the 39 IOS facilities; eliminating the need to arrange a commercial testing facility and provide travel for all 39 IOS students to that facility. In addition, any retake GIAC exams for 39 IOS students and faculty are also coordinated by the 39 IOS. However, with other DoD/USCYBERCOM/AF Cyber units, training outside of the 39 IOS, test proctoring arrangements will be made IAW SANS/GIAC direction.

3.4. Courses: Training vouchers shall be redeemable for all courses within the VENDOR’s course portfolio. (See Appendix B for portfolio example). Vendor shall work with customers to determine the best training task coverage for future training requirements.

3.5. Certifications: Where applicable, the certification shall be American National Standard Institute (ANSI) certified and Community College of the Air Force recognized for undergraduate semester credit. Each course offering prepares a student for an Industry Standard Certification that satisfies the FTU course evaluation requirement. All scores shall be reported to the 39 IOS registrar.

3.6. Ethics Statement: Due to the potential for misuse and insider threat, all students and instructors are expected to sign a statement of ethics before being exposed to the course material.

3.7. Class Schedules: All classes shall be coordinated, aligned, and finalized between the FTU and VENDOR at least 30 days prior to the VENDOR course dates. Coordination is critical due to possible class date changes because of Government needs. The Government will provide the Private training class schedule at least six (6) months ahead of time to SANS for instructor scheduling.

3.8. The VENDOR courses that are one (1) to six (6) days are to be offered as part of the Cyber Operations IQT courses offered by the 39 IOS or organizations that access this Blanket Purchase Order (BPA). The courses may also be offered stand-alone to meet specific training requirements across the customer base for this BPA.

3.9. VENDOR provided course materials shall arrive at the FTU five (5) business days prior to the start of each Private course. The VENDOR is responsible for the publication, preparation, and delivery of all course materials.

3.10. For all Private classes at the 39 IOS, the VENDOR shall coordinate with a 39 IOS Government representative in order to enroll students into their respective classes in order to utilize any online study materials offered as part of this agreement. Students shall be enrolled with the corresponding certification body as well in order to utilize practice tests and online certification attempt.

3.11. The 39 IOS will sponsor and coordinate entry credentials on to the installation for all VENDOR instructors traveling to support training conducted at the 39 IOS. In coordination of the 39 IOS for entry credentials, the VENDOR instructors shall contact a 39 IOS Government representative prior to arrival at the installation at least ten (10) business days prior to arrival.

3.12. The VENDOR shall establish and monitor a customer feedback system for correction of validated complaints and notification of corrective action to customer. The VENDOR shall retain Quality Control documentation on site in an orderly manner and make it available for Government review, if requested.

When a student attends cyber training, that student will be assigned a voucher for the six

(6) day led by SANS Bootcamp but hosted by the Government in Government provided facilities. This contractor training voucher is expected to include the following:

a. Six (6) days of classroom instruction/course tuition

b. course books

c. course software

d. two GIAC practice certification tests

e. one GIAC certification attempt

4. GOVERNMENT FURNISHED PROPERTY AND SERVICES

4.1. For all Private classes, the Government will furnish the classroom space, unless otherwise approved by the Contracting Officer and for the benefit of the Government.

4.2. The Government will furnish an instructor computer, with access to the Internet for the instructor. The instructor is not authorized to bring any company owned or personally owned portable electronic devices into the facility while teaching the course.

5. GENERAL INFORMATION

5.1. SECURITY REQUIREMENTS

The 39 IOS facilities are secure, controlled entry facilities, therefore, all civilian instructors that do not possess a valid, current, Top Secret/Special Compartmented Information (TS/SCI) must be escorted at all times. Due to the short duration of each course (1-6 days) and the rotation of instructors, no permanent entry or security credentials are required. All temporary entry or security credentials will be coordinated by the 39 IOS Government representatives.

5.2. PHYSICAL SECURITY

The VENDOR shall be responsible for safeguarding all government property provided for VENDOR use. At the close of each work period, government facilities, property, and materials shall be secured by government employees. The VENDOR is not responsible for opening or closing the facilities.

APPENDIX A: ACRONYMS AND ABBREVIATIONS LIST

Acronym Abbreviation Definition

16 AF 16th Air Force

39 IOS 39th Information Operations Squadron

ACC Air Combat Command

AF Air Force

AFB Air Force Base

AFCYBER Air Force Cyber Command

ANSI American National Standard Institute

CDD Course Design Document

CMF Cyber Mission Forces

CO Contracting Officer

CMT Cyber Mission Teams

CPT Cyber Protection Teams

CSSP Cyber Security Service Providers

CST Cyber Support Teams

CyOSST Cyber Operations Supplemental Civilian Courses

DCWF Defensive Cyber Workforce Framework

DOD Department of Defense

DoDD Department of Defense Directive

FTU Formal Training Unit

GIAC Global Information Assurance Certification

GR Government Representative

IQT Initial Qualification Training

JCT&CS Joint Cyberspace Training and Certification Standards

KSA knowledge, skills and abilities

MQT Mission Qualification Training

MTTL Master Task Training List

NCWF Cybersecurity Workforce Framework

NICE National Initiative for Cybersecurity Education

NMT National Mission Teams

TS/SCI Top Secret / Special Compartmented Information

USAF United States Air Force

USCC United States Cyber Command

USCYBERCOM United States Cyber Command

WPS Cyber Weapon System

Appendix B – Current List of SANS Courses Course

Designation Course #

Days Course Name GIAC GIAC Name

AUD507 6 Auditing Systems, Applications, and the Cloud GSNA GIAC Systems and Network Auditor Certification

FOR498 6 Digital Acquisition and Rapid Triage GBFA GIAC Battlefield Forensics and Acquisition

FOR500 6 Windows Forensic Analysis GCFE GIAC Certified Forensic Examiner

FOR508 6 Advanced Incident Response, Threat Hunting, and Digital Forensics GCFA GIAC Certified Forensic Analyst

FOR509 6 Enterprise Cloud Forensics and Incident Response GCFR GIAC Cloud Forensics Responder

FOR518 6 Mac & iOS Forensic Analysis and Incident Response GIME GIAC iOS and macOS Examiner

FOR572 6 Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response GNFA GIAC Network Forensic Analyst

FOR577 6 LINUX Incident Response and Threat Hunting

FOR578 6 Cyber Threat Intelligence GCTI GIAC Cyber Threat Intelligence

FOR585 6 Smartphone Forensic Analysis In-Depth GASF GIAC Advanced Smartphone Forensics Certification

FOR608 6 Enterprise-Class Incident Response & Threat Hunting

FOR610 6 Reverse-Engineering Malware: Malware Analysis Tools and Techniques GREM GIAC Reverse Engineering Malware Certification

FOR710 5 Reverse-Engineering Malware: Advanced Code Analysis

FOR528 4 Ransomware for Incident Responders

SEC275 6 SANS Foundations: Computers, Technology, & Security GFACT GIAC Foundational Cybersecurity Technologies

ICS410 6 ICS/SCADA Security Essentials GICSP Global Industrial Cyber Security Professional Certification

ICS515 6 ICS Visibility, Detection, and Response GRID GIAC Response and Industrial Defense

ICS456 5 Essentials for NERC Crit ical Infrastructure Protection GCIP GIAC Critical Infrastructure Protection Certification

ICS612 5 ICS Cybersecurity In-Depth

LDR414 6 SANS Training Program for the CISSP® Certification GISP GIAC Information Security Professional Certification

LDR512 5 Security Leadership Essentials For Managers GSLC GIAC Security Leadership

LDR514 5 Security Strategic Planning, Policy and Leadership GSTRT GIAC Strategic Planning, Policy, and Leadership

LDR516 5 Building and Leading Vulnerability Management Programs

LDR520 5 Cloud Security for Leaders

LDR521 5 Security Culture for Leaders

LDR525 5 Managing Cybersecurity Init iatives and Effective Communication GCPM GIAC Certified Project Manager

LDR551 5 Building and Leading Security Operations Centers GSOM GIAC Security Operations Manager Certification

MGT553 5 Cyber Incident Management

SEC401 6 Security Essentials - Network, Endpoint, and Cloud GSEC GIAC Security Essentials

SEC450 6 Blue Team Fundamentals: Security Operations and Analysis GSOC GIAC Security Operations Certified

SEC488 6 Cloud Security Essentials GCLD GIAC Cloud Security Essentials Certification

SEC497 6 Practical Open-Source Intelligence (OSINT) GOSI GIAC Open Source Intelligence Certification

SEC501 6 Advanced Security Essentials - Enterprise Defender GCED GIAC Certified Enterprise Defender

SEC503 6 Network Monitoring and Threat Detection In-Depth GCIA GIAC Certified Intrusion Analyst

SEC504 6 Hacker Tools, Techniques, and Incident Handling GCIH GIAC Certified Incident Handler Certification

SEC505 6 Securing Windows and Powershell Automation GCWN GIAC Certified Windows Security Administrator

SEC511 6 Continuous Monitoring and Security Operations GMON GIAC Continuous Monitoring Certification

SEC522 6 Application Security: Securing Web Apps, APIs, and Microservices GWEB GIAC Certified Web Application Defender

SEC530 6

Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

GDSA GIAC Defensible Security Architect Certification

SEC542 6 Web App Penetration Testing and Ethical Hacking GWAPT GIAC Web Application Penetration Tester

SEC555 6 SIEM with Tactical Analytics GCDA GIAC Certified Detection Analyst

SEC560 6 Enterprise Penetration Testing GPEN GIAC Penetration Tester Certification

SEC565 6 Red Team Operations and Adversary Emulation GRTP GIAC Red Team Professional

SEC573 6 Automating Information Security with Python GPYC GIAC Python Coder

SEC575 6 iOS and Android Application Security Analysis and Pentration Testing GMOB GIAC Mobile Device Security Analyst

SEC586 6 Security Automation with PowerShell

SEC587 6 Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

SEC588 6 Cloud Penetration Testing GCPN GIAC Cloud Penetration Tester

SEC595 6 Applied Data Science and Machine Learning for Cybersecurity Professionals GMLE GIAC Machine Learning Engineer

SEC598 6 Security Automation for Offense, Defense, and Cloud

SEC599 6 Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses GDAT GIAC Defending Advanced Threats

SEC617 6 Wireless Penetration Testing and Ethical Hacking GAWN GIAC Assessing and Auditing Wireless Networks

SEC660 6 Advanced Penetration Testing, Exploit Writing, and Ethical Hacking GXPN GIAC Exploit Researcher and Advanced Penetration Tester

SEC670 6

Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control

SEC673 6 Advanced Information Security Automation with Python

SEC699 6

Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection

SEC760 6 Advanced Exploit Development for Penetration Testers

SEC301 5 Introduction to Cyber Security GISF GIAC Information Security Fundamentals

SEC406 5 Linux Security for InfoSec Professionals

SEC510 5 Public Cloud Security: AWS, Azure, and GCP GPCS GIAC Public Cloud Security

SEC540 5 Cloud Security and DevSecOps Automation GCSA GIAC Cloud Security Automation

SEC541 5 Cloud Security Attacker Techniques, Monitoring, and Threat Detection GCTD GIAC Cloud Threat Detection

SEC549 5 Enterprise Cloud Security Architecture

SEC554 5 Blockchain and Smart Contract Security

SEC566 5 Implementing and Auditing Security Frameworks and Controls GCCC GIAC Critical Controls Certification

SEC568 5 Combating Supply Chain Attacks with Product Security Testing

LDR433 3 Managing Human Risk SSAP SANS Security Awareness Professional

SEC388 3 Introduction to Cloud Computing and Security

SEC547 3 Defending Product Supply Chains

SEC556 3 IoT Penetration Testing

ICS418 2 ICS Security Essentials for Managers

LDR419 2 Performing A Cybersecurity Risk Assessment

SEC402 2 Cybersecurity Writing: Hack the Reader

SEC467 2 Social Engineering for Security Professionals

SEC580 2 Metasploit for Enterprise Pen Testing

SEC403 1 Secrets to Successful Cybersecurity Presentation

SEC405 1 Business Finance Essentials