Attachment 1 - Salient Characteristics THM.docx

Salient Characteristics/PWS/SOW TryHackMe Business Subscription License for Cyber-Formal Training Unit

1.0 Scope

The Cyber-Formal Training Unit (C-FTU) requires a commercial SaaS cybersecurity training platform. The solution shall be TryHackMe Business Subscription License, hereafter referred to as the License. The vendor shall provide 100 user seats and 40 certification attempts that cover Security Analyst Level 1 (SAL1) and Pentester Level 1 (PT1) examinations. The period of performance is one base year with four one-year options.

2.0 Applicable References

2.1 FAR Part 12 Commercial Item Acquisition

2.2 DoD Instruction 8140 Cyberspace Workforce Qualification

2.3 NIST NICE Framework SP 800-181

2.4 MITRE ATT&CK Knowledge Base

3.0 Salient Characteristics

3.1 Browser-based access. All labs, virtual machines (VMs), and learning paths must launch from a modern web browser with no local software installation.

3.2 Integrated VM attack box. Each user must have access to a disposable Linux or Windows attack box with root or administrator privileges.

3.3 Unlimited content library. Users shall receive full access to all current and future rooms, paths, challenges, and hacktivities released during the contract period.

3.4 Custom room and capture the flag (CTF) builder. The platform must allow C-FTU instructors to duplicate or author new rooms without additional cost or professional service.

3.5 Integrated certification attempts. The License shall include 40 total exam vouchers that cover SAL1 and PT1. The system must schedule, proctor, and deliver results in-platform.

3.6 Skills reporting. The platform shall provide dashboards that map each room to NIST NICE tasks and export data in CSV and PNG formats.

3.7 SAML or OIDC single sign on. Integration must support Guardian credentials and multifactor authentication (MFA).

3.8 Flexible license transfer. Seats must be re-assignable among users without additional fees while preserving learner history.

3.9 REST API. Progress data must be retrievable by the Guardian Learning Management Ecosystem.

3.10 Content refresh cadence. The vendor must release at least two new labs or challenges weekly.

3.11 Conformance. The solution must align with ISO 27001 and SOC 2 Type II controls and store data in CONUS cloud regions.

4.0 Implementation Tasks

4.1 Account provisioning. The Vendor shall create 100 user accounts and one administrator group within five business days of award.

4.2 Identity integration. The Vendor shall provide metadata and support for SAML single sign-on testing within 10 business days.

4.3 Baseline assessment. Within 15 business days the Vendor shall enable an initial closed room that measures user skill gaps and populates the skills matrix.

4.4 Learning path configuration. C-FTU instructors, assisted by the Vendor customer success manager, will create three role-based paths: Space Mission Defender, Cloud Defender, and Red Blue Fusion Analyst.

4.5 Certification scheduling. The Vendor shall make 40 examination attempts available in the system and provide instructions for voucher assignment.

4.6 Monthly review. The Vendor customer success manager shall meet with the government project officer once per month to review metrics, license usage, and new content.

4.7 Help desk support. The Vendor shall supply email and chat support weekdays 0700 to 1900 Mountain Time with a two-business-hour response target.

5.0 Deliverables

5.1 Initial license activation confirmation, due five business days after award.

5.2 Identity integration completion memo, due 10 business days after award.

5.3 Skills matrix baseline report, due 20 business days after award.

5.4 Monthly metrics and usage report, due on the first business day of each month.

5.5 Annual content summary, due 30 days before contract end.

6.0 Value to Cohorts

The 40 included certification attempts allow Guardians to obtain job-ready SAL1 or PT1 credentials without additional funding. Certifications validate hands-on skills, shorten upgrade timelines under DoD 8140, and provide measurable outcomes for Training Readiness Reviews.

7.0 Performance Metrics

7.1 Platform availability greater than 99.5 percent uptime per calendar quarter.

7.2 New content release frequency of two labs or greater per week.

7.3 Help desk response within two business hours for P1 (priority 1) issues.

8.0 Government Furnished Information

The government will provide SAML identity provider metadata and reference course objectives. No other government-furnished equipment or information is required.

9.0 Security Requirements

The Vendor shall process all government data in data centers located within the continental United States. All data at rest must be encrypted using AES-256. All data in transit must use TLS 1.2 or higher.

10.0 Travel

No travel is anticipated under this contract.

End of document.

pabilitie