Attachment_2_Statement of Work CSWF.pdf

STATEMENT OF WORK

CSWF COURSES FY 20

N66604-21-P-0020

1.0 BACKGROUND

The Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) Cybersecurity Program Manager (CSWF PM) and Information Systems Security Manager (ISSM) are responsible for ensuring that the Government civilian Cybersecurity Workforce (CSWF) practitioners are qualified to an industry baseline knowledge level, and specialization for operating systems (OS), with certifications in accordance SECNAV M-5239.2. These baseline and OS certifications are achieved via industry training courses, which provide a minimum qualification standard for the work roles and specialty areas within the Command’s Information Systems (IS) portfolio.

1.1 Places of Performance: Performance of this contract will

take place remotely or at Contractor provided facility within Sixty (60) miles of NUWCDIVNPT (as calculated via Google Maps).

1.2 Authorized Users: NUWCDIVNPT Code 1016 is the sole user of this contract.

1.3 Sponsors: NUWCDIVNPT Code 10 is the sole sponsor of this

contract.

1.4 Types of Funding: It is anticipated that this contract will be funded using Overhead funding.

2.0 SCOPE

This requirement is for industry baseline and OS certification-training courses to provide the Government civilian CSWF practitioners with a means to achieve a certificate of completion, as outlined by the certifying authority, to document their mastery of the knowledge area. This certificate of completion provides the Objective Quality Evidence (OQE) to document the qualifications for CSWF baseline certification.

The industry provided training courses include Computing Technology Industry Association (CompTIA) Security+, CompTIA Advanced Security Practitioner (CASP+) and Linux+, as well as the International Information System Security Certification Consortium (ISC2) Certified Information Systems Security Professional (CISSP).

The contractor shall conduct the following courses for up to twenty (20) students per class in a virtual environment with options for additional virtual and face-to-face offerings:

CompTIA Linux +

CompTIA Security + CompTIA Advanced Security Practitioner (CASP+) International Information System Security

Certification Consortium (ISC2) Certified Information Systems Security Professional (CISSP)

The contractor shall provide trainers qualified to facilitate the trainings.

For training conducted virtually, the contractor must verify that whatever virtual platform is used to deliver the training is compatible with NMCI machines.

For training conducted in a face-to-face environment, the contractor shall provide an offsite location within Sixty (60) miles of NUWCDIVNPT (as calculated via Google Maps) equipped to facilitate the training and provide necessary computer equipment, software, and other materials including workbooks, handouts, and instructional materials required to teach the courses in a face-to-face environment.

3.0 REQUIREMENTS

The contractor shall conduct the following trainings in the quantities specified in Section B: CompTIA Linux+; CompTIA Security +; CompTIA CASP+; ISC2 CISSP. The contractor shall deliver a training certificate for each individual upon class completion.

3.1 Instruct Course “CompTIA Linux +”

The contractor Shall conduct the five-day course entitled “CompTIA Linux +”. The course shall cover (but is not limited to):

Perform basic Linux tasks.

Manage users and groups.

Manage permissions and ownership.

Manage storage.

Manage files and directories.

Manage kernel modules.

Manage the Linux boot process.

Manage system components.

Manage devices.

Manage networking.

Manage packages and software.

Secure Linux systems.

Write and execute Bash shell scripts.

Automate tasks.

Plan and perform a Linux installation.

3.2 Instruct “CompTIA Security +”

The contractor shall conduct the five-day course entitled “CompTIA Security +”. This course shall cover (but is not limited to:

Threats, Attacks and Vulnerabilities Technologies and Tools Architecture and Design Identity and Access Management Risk Management Cryptography and PK1

3.3 Instruct “CompTIA Advanced Security Practitioner (CASP+)

The contractor shall conduct the five-day course entitled “CompTIA Advanced Security Practitioner (CASP+)”. This course shall cover (but is not limited to:

Supporting IT Governance and Risk Management Leveraging Collaboration to Support Security Using Research and Analysis to Secure the Enterprise Integrating Advanced Authentication and Authorization

Techniques Implementing Cryptographic Techniques Implementing Security Controls for Hosts Implementing Security Controls for Mobile Devices Implementing Network Security Implementing Security in the Systems and Software

Development Lifecycle

Integrating Assets in a Secure Enterprise Architecture Conduction Security Assessments Responding to and Recovering from Incidents

3.4 Instruct “CISSP”:

The contractor shall conduct the five-day course entitled “International Information System Security Certification Consortium (ISC2) Certified Information Systems Security Professional (CISSP).” This test preparation course covers the 8 domains of the CISSP CBK relevant to the corresponding professional certification exam:

Security and Risk Management Asset Security Security Engineering Communications and Network Security Identity and Access Management Security Assessment and Testing Security Operations Software Development Security

4.0 Quality Surveillance and Performance Standards

The Government will conduct quality surveillance via various methods including review of student course surveys. Contractor performance will be evaluated in the areas of technical quality, schedule/timeliness, management, and regulatory compliance as follows:

• Technical Quality: The Government will evaluate technical quality in accordance with the commercial standard course objectives for each training listed in 3.1 – 3.4.

• Schedule/Timeliness: The Government will evaluate the contractor’s ability to meet negotiated schedules;

• Management: The Government will evaluate the contractor’s ability to integrate and coordinate all activities needed to execute the contract;

• Regulatory Compliance: The government will evaluate the contractor’s compliance with the terms and conditions of the contract/task order relating to applicable regulations and codes.