Attachment 1 Statement of Work Learning Platform_RFQ.pdf

RFQ No: 70Z02321QMWC00600

STATEMENT OF WORK

PAGE 1/8

STATEMENT OF WORK (SOW)

FOR

LICENSE BASED LEARNING PLATFORM

1.0 GENERAL

1.1 BACKGROUND

Continued education is paramount to professional development and integral to understanding the fast developing needs of C5I systems. This professional development equips Coast Guard (CG) cyber professionals with an in-depth knowledge of security governance, risk management, and security program development and management. It also provides necessary skills and best practices to effectively create and execute enterprise-wide information security strategies.

Continuing professional development for cyber professionals is geared towards attaining certifications in accordance with the Department of Defense’s (DoD’s) Directive 8570, the DoD 8570 manual (8570.01m), and DoD Directive 8140 within the National Initiative for Cyberspace Education (NICE) framework.

The DoD Cyber Workforce Framework (DCWF) describes the work performed by the full spectrum of the cyber workforce. The DCWF leverages the NICE Cybersecurity Workforce Framework and the DoD Joint Cyberspace Training and Certification Standards. It has a hierarchical structure with seven broad categories, 33 specialty areas, and 54 work roles, each aligned to one of the Cyberspace Workforce Skill Categories or an overarching, enabling category.

In accordance with the Commandant’s priority to cultivate a mission ready total workforce, the CG, Office of Cyberspace Forces (CG-791) has been working to professionalize the Cyberspace workforce by providing access to an online learning platform since June 2019. CG- 791 requires licenses for an online tool to prepare members of the Cyberspace workforce to pass industry certification exams, to meet mandated continuing education requirements, and for professional development.

Members of the Cyberspace workforce lacking certifications do not meet DoD, Department of Homeland Security (DHS), and CG policy standards. Certifications are earned through combined professional experience and examinations administered by various governing bodies.

DOD policy recognizes 30 different industry certifications to meet Cyberspace workforce standards.

1.2 SCOPE

The CG is looking to purchase the following: Licenses for individual CG users to access an online, on demand learning platform. The platform must increase individual proficiency and help users attain certifications aligned with the Department of Defense’s Information Assurance Workforce Qualifications, commonly referred to ‘8570 Certifications’. The platform will be a content producing platform that takes an academic approach toward educating learners.

CG cyber professionals operate in similar cyber arenas as DoD personnel. Therefore, they need the same types of training as DoD and other Federal agencies have provided to their cyber workforces. The time frame for members taking these courses will be self-paced, allowing for file://hqnas/SHARED/G-A/G-ACS/CAAT%20Team/TOOLBOX/SCOPE%20PARAGRAPHS.doc

PAGE 2/8

maximum flexibility. Personnel will be able to work toward certifications and increased proficiency without impact to their other work obligations.

1.3 OBJECTIVE

CG-791 will provide licenses for an online tool to prepare members of the Cyberspace workforce to pass industry certification exams, to meet mandated continuing education requirements, and for professional development. Licenses will be issued, transferred, or revoked by CG-791.

1.3.1 COMPLIANCE/REFERENCE DOCUMENTS

The following document provides detailed explanations of Cyber 8570 Certifications associated with this learning platform:

Information Assurance Workforce Improvement Program https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 CONTENT PRODUCING LEARNING PLATFORM DEFINED

• A content producing learning platform is an online, web based training portal that displays trainings provided by industry subject matter experts that also have experience in Academia. The content producing platform creates, curates, and disseminates trainings for people looking to hone Cyber and IT skills. In addition to simple trainings, the content producing platform has in-browser/hands-on labs that allow Cyber/IT developers to practice their skills.

• A content producing learning platform offers “boot camps,” or targeted trainings aimed to educate an individual to attain 8570 certification. The training is usually greater than 1 week long. Purchase of a boot camp implies that an individual attending the boot camp will be available for full time training for the given period of time. When purchased, the price of a boot camp includes the cost of taking a certification test and scheduling assistance.

2.2 FEATURES OF CONTENT PRODUCING LEARNING PLATFORM

• 24 x 7 on-demand, online training; unlimited access to extensive training library (no in person courses).

• The training library will identify the courses that the member needs to take to prepare themselves for the 8570 certification examinations.

• Content is specifically organized and geared IAW 8570 certifications:

• Certification preparation for all DoD 8570 certifications that comprise DoD

Information Assurance Workforce Qualifications;

• For detailed explanations of DoD 8570 certifications please see the reference document from section 1.3.1;

• For further information see: https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/;

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/ https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/

PAGE 3/8

• Provided instructors shall have Academic backgrounds, i.e. they have taught at accredited universities/colleges and are subject matter experts in their field;

• Completely transferrable licenses;

• In-browser hands on labs where learners can test their skills;

• Demonstrated ability to cater to Other Government Agency (OGA) cyber space work force needs;

• Ability to assign an individual a license through the platform;

• Appropriate Personally Identifiable Information (PII) protections for learners accessing platform. The only PII required for access to the platform is an individual’s name and email address.

• Boot camp offerings targeted at certifications within the DoD 8570 approved certification matrix. Boot camps can be taken as needed up to the quantity in the schedule.

2.3 DASHBOARD REQUIREMENT

• The learning platform must have dashboards that allow an administrator from CG-7911 to view which learners have accessed the platform. The dashboard shall show which students have started, completed, or is in the process of completing a given course. The dashboard shall show how much time the student has invested on the learning platform.

The dashboard shall also show the most recent date the learning platform was accessed. These features will allow the administrator to transfer the license in the event it is unused and provide reports of license usage to decision makers within CG-7911.

2.4 TRANSFER REQUIREMENTS

• The content creating learning platform must have licenses for access that are completely transferable.

• The content host learning platform must have licenses that are transferable in the event the assigned license was unused, a member separates from service, or is deployed for greater than 90 days.

• Boot camps are non-transferrable after a student has begun learning.

2.5 ACCESS

• The learning platform will manage access to members who have met requirements set by CG-791 and filled appropriate paperwork.

• CG-791 will communicate the access requirements to the vendor who will then coordinate logistics for enabling access and troubleshooting associated issues if they arise.

• The contractor shall provide access within two business days of receiving a completed access request. Access shall be communicated, in writing, or through the platform to the assigned Contracting Officer’s Representative (COR).

PAGE 4/8

2.6 LEARNING PLATFORM CATALOG

CLIN DESCRIPTION QUANTITY

0001 A+/Network+ Boot Camp 1 0002 A+/Network+ Live Online 1 0003 A+ Boot Camp 1 0004 A+ Boot Camp Live Online 1 0005 CAP Boot Camp 1 0006 CAP Boot Camp Live Online 1 0007 CASP+ Boot Camp 1 0008 CASP+ Boot Camp Live Online 1 0009 CCNA: Security Boot Camp 2 0010 CCNA: Security Boot Camp Flex Pro 2 0011 CCNA/CCENT/CCDA/CCNA: Security Boot Camp 2 0012 CCNA/CCENT/CCDA/CCNA: Security Boot Camp Flex Pro 2 0013 CCNA Cyber Operations Boot Camp 1 0014 CCNA Cyber Operations Live Online 1 0015 CCNA Dual Cert Associate & Cyber Ops Boot Camp 1 0016 CCNA Dual Cert Associate & Cyber Ops Live Online 1 0017 CCNP Boot Camp 1 0018 CCNP Boot Camp Live Online 1 0019 CCNP Enterprise Boot Camp 1 0020 CCNP Enterprise Boot Camp Live Online 1 0021 CISA Boot Camp 1 0022 CISA Boot Camp Flex Pro 1 0023 CISM Boot Camp 3 0024 CISM Boot Camp Flex Pro 3 0025 CISSP Boot Camp 3 0026 CISSP Boot Camp Live Online 3 0027 CSSLP Boot Camp 1 0028 CSSLP Boot Camp Live Online 1 0029 CySA+ Boot Camp 1 0030 CySA+ Boot Camp Live Online 1 0031 Ethical Hacking Dual Cert Boot Camp 2 0032 Ethical Hacking Dual Cert Boot Camp Live Online 2 0033 GCIH Boot Camp 1 0034 GCIH Boot Camp Flex Pro 1 0035 GSEC Boot Camp 1 0036 GSEC Boot Camp Flex Pro 1 0037 ISSAP Boot Camp 1 0038 ISSAP Boot Camp Live Online 1

PAGE 5/8

0039 ISSEP Boot Camp 1 0040 ISSEP Boot Camp Flex Pro 1 0041 ITIL v4 Boot Camp 3 0042 ITIL v4 Live Online 2 0043 Network+ Boot Camp 2 0044 Network+ Boot Camp Flex Pro 2 0045 Security+ Boot Camp 2 0046 Security+ Boot Camp Live Online 2

3.0 CONTINUITY OF SUPPORT

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that contract support personnel respond to any issues within an appropriate time frame. Within normal working hours between 8am-8pm, responses shall be within an hour. After normal business hours, responses shall be within 3 hours. These hours are inclusive with weekends and holidays as the Learning Platform is a 24x7 platform. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the COR prior to employee absence.

4.0 PERIOD OF PERFORMANCE

The period of performance for this contract is one year from the date of award.

4.1 POST AWARD CONFERENCE

After the contract is awarded, a Post Award Conference shall be held, within 5 business days, by the Contractor, the Contracting Office, the COR and CG Subject Matter Expert(s). The conference can be by phone or other virtual source.

4.2 PROGRESS REPORTS

Progress Reports shall be in the form of a visual dashboard that the COR can gain access to ensure CG personnel are using the platform. The COR shall be able to gain access within 1 week of contract award. The dashboard shall be IAW Section 2.0 of this SOW.

4.3 PROTECTION INFORMATION

The Contractor shall safeguard and protect from disclosure at all times, and shall cause its employees, officers, agents, contractors, subcontractors and other representatives to safeguard and protect from disclosure at all times, all information about applicants, to include usage information, that could be used to determine or trace the identity of such applicants and/or CG usage statistics. The Contractor will take commercially reasonable measures (including implementing and monitoring compliance with adequate measures with respect to technical and physical security) to ensure that Personally Identifiable Information (PII) is protected against loss and against unauthorized access, use, modification, disclosure or other misuse. The execution, delivery and performance of this Agreement complies in all material respects with all applicable Laws, privacy policies and other legal obligations regarding the collection, PAGE 6/8 transmission, use, storage, access and disclosure of Personally Identifiable Information.

Disclosure of any aforementioned information shall only be made with written consent of the Contracting Officer by way of contract/purchase order modification. There will not be any CG PII provided to the Contractor.

5.0 SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 . In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05- 001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

5.1 SECTION 508 REQUIREMENTS FOR TECHNOLOGY PRODUCTS

Section 508 applicability to Information and Communications Technology (ICT):

License Based Learning Platform

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including but not limited to Internet or Intranet website; Electronic documents; Electronic training materials; Multimedia (video/audio)): Does not apply

Applicable 508 requirements for software features and components (including but not limited to Other) https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

PAGE 7/8

Applicable 508 requirements for hardware features and components: Does not apply

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

5.2 SECTION 508 DELIVERABLES

Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

6.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

6.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

6.2 The COR will have 5 business days to review deliverables and make comments. The Contractor shall have 5 business days to make corrections and redeliver.

6.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review.

The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

PAGE 8/8

7.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates.

ITEM

SOW

REFERENCE DELIVERABLE / EVENT DUE BY

DISTRIBUTION

1 4.1 Post Award Conference Within 5 days after contract awarded

N/A

2 2.3/4.2 Progress Reports Within 1 week after contract awarded

COR,

Contracting

Officer

3 2.5 Learning Platform Access

Within 2 days of contract/purchase order award

COR

4 2.6 Learning Platform Catalog

Complete by the end of the contract

N/A