Attachment A - Statement of Work.pdf

Attachment A – Statement of Work

Attachment A– Statement of Work Version 2.4 Page 1

FEDERAL BUREAU OF INVESTIGATION

FINANCE DIVISION | PROCUREMENT SECTION

Cyber Education and Training Courses and Certifications

For the

Cyber Division

Statement of Work

8/27/2024

Attachment A – Statement of Work

Attachment A– Statement of Work Version 2.4 Page 2

1 Scope This is a contract to provide Cyber education, training courses, and certifications to the Federal Bureau of Investigation (FBI) Cyber Division (CyD) and Field Office Cyber Squads.

This is a non-personal services contract. The Government shall not exercise any supervision or control over contractor employees performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction

FBI CyD requires external formal training classes to supplement internal training courses to ensure that Cyber investigators (FBI Employees and Federally deputized Task Force Officers) obtain the necessary skills to investigate complex cyber matters. These courses shall be available in multiple delivery methods including, but not limited to, In Person, On Demand, and Live Online content delivery. Upon completion of training classes, the contractor shall offer industry-recognized certifications to provide additional credibility to FBI personnel conducting investigations and testifying in court.

1.2 Background

The CyD, Cyber Education and Training Unit (CETU) is tasked with providing training to law enforcement personnel who conduct computer intrusion investigations involving the use of computers, cellular telephones, tablets, networks, and the Internet. CETU’s priority is to identify and deliver core cyber training and continuing education offerings for these Cyber Investigators. CETU provides a combination of internal FBI courses in conjunction with external contractor classes to ensure that Cyber investigators (FBI Employees and Federally deputized Task Force Officers) obtain the necessary skills to investigate complex cyber matters.

1.3 Contract Type

This contract will be a Firm Fixed Price, single-award Indefinite Delivery Indefinite Quantity (IDIQ) type contract.

2 Applicable Documents None

Attachment A – Statement of Work Guide and Template to Procurement Standard Operating Procedure (SOP) – Requirements Generation

3 Requirements

3.1 Task 1: Formal Training Courses

The contractor shall deliver formal training courses that develop cyber skills and provide exposure to technical tools that meet the FBI’s identified needs. The courses must provide both theoretical training and hands-on experience. All courses shall provide a method of aptitude following the course. The courses offered must cover multiple cyber disciplines, including but not limited to:

• Cyber Security o Courses shall cover a broad spectrum of security topics, alongside real-life examples. Lectures on the topic shall explain terms and concepts in detail and shall include hands-on labs that drive these concepts home. Courses shall consist of a balanced mix of technical topics explained in easy-to-understand ways.

• Intrusion Detection o Courses shall cover network monitoring and threat detection in-depth while delivering technical knowledge, insight, and hands-on training that is needed to confidently defend traditional and cloud-based networks.

Students shall learn the underlying theory of Transmission Control Protocol (TCP/IP) and the most used application protocols so that students can intelligently examine network traffic to identify emerging threats, perform large-scale correlation for threat hunting, and reconstruct network attacks.

• Perimeter Protection o Course shall assess the current state of security architecture and continuous monitoring and provide a new approach to security architecture that can be easily understood and defended. Students shall be able to assess deficiencies in security architectures and affect meaningful changes that are continuously monitored for deviations from their expected security posture.

• Securing Windows and Linux/Unix o Courses shall teach the skills needed to identify, analyze, and respond to attacks on Linux platforms and how to use threat-hunting techniques to find stealthy attackers who can bypass existing controls. The course shall

Clark, Tammy Jo (FFD) (FBI) Are all the classes open to the different instruction locations such as in person, online, on demand? Or are some mandated to be a specific way?

Shifflet, Robert Thomas (FFD) (FBI) There is no mandate for location use hands-on incident response and threat-hunting tactics and techniques that elite responders and hunters are successfully using to combat real-world breach cases.

• Open-Source Intelligence (OSINT) o This topic shall provide practical, real-world tools and techniques to help individuals perform OSINT research safely and effectively. One of the most dynamic aspects of working with professionals from different industries worldwide is getting to see their problems and working with them to help solve those problems. Courses shall not only cover critical OSINT tools and techniques, it also provide real-world examples of how they have been used to solve a problem or further an investigation.

• Cyber Threat Intelligence o Courses shall train in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.

• Incident Response o Course shall teach how to apply a dynamic incident response process to evolving cyber threats, and how to develop threat intelligence to mount effective defense strategies for cloud and on-premises platforms. Students shall examine the latest threats to organizations, from watering hole attacks to cloud application service MFA bypass, enabling you to get into the mindset of attackers and anticipate their moves.

• Cloud Technologies/Security o Cloud security courses shall help students successfully navigate both the security challenges and opportunities presented by cloud services.

• Digital Forensics o The digital forensic acquisition training course shall provide the necessary skills to identify the varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It shall cover digital acquisition from computers, portable devices, networks, and the cloud.

• Threat Hunting o Threat hunting courses shall teach advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and ransomware operators.

• Log Analysis o This course shall provide training, methods, and processes for enhancing existing logging solutions. This course shall also provide an understanding of the when, what, and why behind the logs.

• Network Traffic Analysis o Courses shall teach about the underlying theory of Transmission Control

Protocol (TCP/IP) and the most used application protocols so that you can intelligently examine network traffic to identify emerging threats, perform large-scale correlation for threat hunting, and reconstruct network attacks.

• Cryptocurrency o Courses shall be continually developed to address a basic knowledge of

Cryptocurrency, as well as the evolving field of Cryptocurrency.

• Relevant programming languages o Course shall help students discover how to organize their code and use advanced programming concepts to make their code faster, more efficient, and easier to develop and maintain.

• Network Penetration Testing and Ethical Hacking o Course shall prepare students to conduct successful penetration testing for a modern enterprise, including on-premise systems, Azure, and Azure AD. Students shall learn the methodology and techniques used by real-world penetration testers in large organizations to identify and exploit vulnerabilities at scale and show real business risk to your organization.

• Active Defense, Offensive Countermeasures and Cyber Deception o This course shall focus on combining strategic concepts of infrastructure and tool placement while also diving into their technical application. The course shall develop and improve Red Team operations for security controls, through adversary emulation, cyber threat intelligence, Red Team tradecraft, and engagement planning. Students shall learn how to execute consistent and repeatable Red Team engagements that are focused on the effectiveness of the people, processes, and technology used to defend environments.

• Mobile Device Security and Ethical Hacking o This course shall provide examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices. The course shall be continuously updated to keep up with the latest file formats, malware, smartphone operating systems, third-party applications, acquisition shortfalls, extraction techniques (how to get full file system or physical access), and encryption.

o In addition, a course shall be offered specifically for Mac and iOS devices course that focuses students on the raw data, in-depth detailed analysis, and how to get the most out of their Mac and iOS cases. Hands-on forensic analysis and incident response skills taught in the course shall enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device.

• Wireless Ethical Hacking, Penetration Testing and Defenses o In this course, students shall learn how to evaluate the ever-present cacophony of Wi-Fi networks and identify the Wi-Fi access points and client devices that threaten your organization; assess, attack, and exploit deficiencies in modern Wi-Fi deployments using WPA2 technology, including sophisticated WPA2-Enterprise networks; use your understanding of the many weaknesses in Wi-Fi protocols and apply it to modern wireless systems; and identify and attack Wi-Fi access points and exploit the behavioral differences in how client devices scan for, identify, and select access points.

• ICS/SCADA Security o This course shall provide a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course shall be designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

• Security Leadership o This course shall teach leaders about the key elements of any modern security program. Learn to quickly grasp critical cybersecurity issues and terminology, with a focus on security frameworks, security architecture, security engineering, computer/network security, vulnerability management, cryptography, data protection, security awareness, cloud security, application security, DevSecOps, generative AI (GenAI) security, and security operations.

• IT Security Strategic Planning, Policy and Leadership o This course shall provide students with the tools to build a cybersecurity strategic plan, and an entire IT security policy, and lead your teams in the execution of your plan and policy.

• Data Security and Investigations Law o Courses shall be taught regarding data security and investigation law that applies to the current and future work of students. Specific topics may be established upon request by the COR/CO.

• CISSP Preparation o This course shall be an accelerated review course to prepare students for the Certified Information Systems Security Professional (CISSP) Certification Exam.

• AI/Machine Learning o This course shall provide students with a crash-course introduction to practical data science, statistics, probability, machine learning, and Artificial Intelligence (AI).

• Web Applications o Courses shall be offered regarding varying web applications as requested by the COR/CO.

CETU may add additional required topics as deemed necessary and relevant by the CETU Unit Chief to meet the needs and mission of the FBI and increase the credibility of FBI personnel in conducting investigations and testifying in court. In addition, the FBI may request updates to current courses to add additional topics or knowledge to already developed courses. The contractor shall offer existing training for additional topics or develop training for topics upon request from CETU. Official requests will only be made by the Contracting Officer (CO) and Contracting Officer Representative (COR). Upon Government request, the contractor shall provide a pricing and technical proposal for any additional courses developed. The proposal shall be provided within the allotted time specified upon request. The contractor shall work with the Government on specifications for any newly developed training. All newly developed courses shall be priced Firm Fixed Price per course, as the predeveloped courses.

Additionally, in-person classes shall take place at the contractor’s choice of location unless otherwise specified. It is acceptable and expected that these courses be open to the public and already planned for public offering outside of this agreement.

3.2 Task 2: Certifications

The contractor shall offer industry-recognized certifications upon individual course completion that provide additional credibility to FBI personnel who successfully complete the training curriculum in conducting investigations and testifying in court. A certification is industry recognized as establishing that the individual has both theoretical and practical knowledge of a topic. The standard shall be that the certification has been recognized in federal court as qualifying an individual as an expert witness.

These certifications shall include but are not limited to the following:

• Certification that an individual is qualified for hands-on IT systems roles with respect to security tasks.

• Certification of an individual's knowledge of network and host monitoring, traffic analysis, and intrusion detection.

• Certification of an individual's ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills.

• Certification of an individual’s knowledge of the law of fraud, crime, policy, contracts, privacy, compliance, cybersecurity, and investigations.

• Certification of an individual’s knowledge of how to collect, analyze, and tactically use modern network and endpoint data sources to detect malicious or unauthorized activity.

• Certification of an individual’s knowledge of industrial control systems (ICS), incorporating IT, engineering, and cyber security, to achieve security throughout the ICS lifecycle.

• Certification of an individual’s knowledge of asset security, communications, and network security, identity and access management, security and risk management, security assessment and testing, security engineering, security operation, and software development security.

• Certification of an individual’s understanding of the regulatory requirements of NERC CIP as well as practical implementation strategies.

• Certification of an individual's ability to implement preventive, detective, and reactionary techniques to defend valuable cloud-based workloads.

• Certification that individuals have a strong foundation in OSINT methodologies and frameworks and are well-versed in data collection, reporting, and analyzing targets.

• Certification that an individual is trained and qualified in the proper collection, acquisition, and rapid triage analysis of many forms of data storage.

• Certification of an individual’s knowledge of computer forensic analysis, with an emphasis on core skills required to collect and analyze data from Windows computer systems.

• Certification of an individual’s knowledge and abilities in the areas of defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware removal

• Certification of an individual's ability to secure Microsoft Windows clients and servers.

• Certification of an individual’s knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases.

• Certification of an individual’s ability to track and respond to incidents across the three major cloud providers.

• Certification of an individual’s ability perform Active Defense strategies specific to and appropriate for an Industrial Control System (ICS) network and systems.

• Certification of an individual's knowledge of Mac and iOS computer forensic analysis and incident response skills.

• Certification of an individual's ability to detect and investigate suspicious activity in cloud infrastructure.

• Certification of an individual’s ability to perform advanced analysis of network forensic artifacts.

• Certification of an individual's understanding of core programming concepts, and the ability to write and analyze working code using the Python programming language.

• Certification that an individual has demonstrated requisite fundamental strategic, operational, and tactical cyber threat intelligence knowledge and skills.

• Certification that an individual is qualified to solve real-world cyber security problems using Machine Learning.

• Certification that individuals have the knowledge and skills to reverse-engineer malicious software (malware) that targets common platforms, such as Microsoft Windows and web browsers.

• Certification of an individual’s knowledge of data, network, host, application, and user controls along with key management topics that address the overall security lifecycle.

• Certification that an individual is familiar with the nuances of AWS, Azure, GCP and has the skills needed to defend each of these platforms.

• Certification of an individual’s knowledge of defensible security architecture, network security monitoring, continuous diagnostics and mitigation, and continuous security monitoring.

• Certification of an individual’s mastery of the security knowledge and skills needed to deal with common web application errors that lead to most security problems.

• Certification of an individual’s ability to design and implement a strategic combination of network-centric and data-centric controls to balance prevention, detection, and response capabilities.

• Certification of an individual’s understanding of the DevSecOps methodology and toolchains, and skill in implementing security controls throughout automated secure DevOps pipelines.

• Certification of an individual’s knowledge of web application exploits and penetration testing methodology.

• Certification of an individual’s knowledge and skills to conduct exploits, engage in detailed environmental reconnaissance, and utilize a process-oriented approach to penetration testing projects.

• Certification of an individual’s knowledge and skills to implement and execute the CIS Critical Controls recommended by the Center for Internet Security, and perform audits based on the standard.

• Certification of an individual’s knowledge about assessing and managing mobile device and application security, as well as mitigating against malware and stolen devices.

• Certification that individuals have demonstrated that they are qualified to perform forensic examinations on devices such as mobile phones and tablets.

• Certification of an individual’s ability to conduct cloud-focused penetration testing and assess the security of systems, networks, architecture, and cloud technologies.

• Certification of an individual’s understanding of how advanced cyber adversaries operate and how the IT environment can be improved to better prevent, detect, and respond to incidents.

• Certification of an individual’s knowledge of the different security mechanisms for wireless networks; the tools and techniques used to evaluate and exploit weaknesses;

and the techniques used to analyze wireless networks.

• Certification that an individual has the skills to conduct advanced penetration tests and model the behavior of attackers to improve system security, and the knowledge to demonstrate the business risk associated with these behaviors.

• Certification that an individual is well-versed in the technical knowledge and key concepts needed to run a security operations center (SOC).

• Certification of an individual’s knowledge of building and managing cyber security programs with an eye towards meeting the needs of the business, board members, and executives.

• Certification that an individual has the critical skill sets associated with making projects successful, including effective communication and time, cost, quality, procurement and risk management of IT projects and application development.

Certification of an individual’s ability to effectively manage a technical team and strategically operate a Security Operations Center (SOC) to align with an organization's business goals and security requirements.

A single certification may address several of the above areas at once, or each area may be a single certification. CETU may add additional certifications as deemed necessary and relevant by the CETU Unit Chief to meet the needs and mission of the FBI and increase the credibility of FBI personnel in conducting investigations and testifying in court. Official requests will only be made by the Contracting Officer Representative (COR) and Contracting Officer (CO).

3.3 Task 3 – Student Ordering Procedures

Contractor shall provide each student with access to a student portal account which allows students to register for courses, attend courses, and view complete courses and certifications. For On Demand courses, students shall receive 120 days of access and must complete the course and certification exam associated with their course in that timeframe. For Live Online, students will log in on the portal at specific dates/times, ranging from 2 days to 6 days depending on the course, and then are held to the same standard of 120 days of access & course completion/certification requirements. For In- Person courses, students shall have the ability to register for courses through the student portal account, in order to register for a seat.

4 Key Personnel Not Applicable

5 Security All classes shall be taught at the open-to-the-public level and labeled as unclassified.

Courses taught at the Huntsville location will require students and/or instructors to pass the National Crime Information System (NCIS) and other background and installation checks needed to gain access to the Huntsville, Alabama Campus, located on Redstone Arsenal.

6 Place of Performance Training venues shall be decided by the contractor as these classes are open to the public throughout the world. The FBI requires a minimum of two In-person courses to be taught in Huntsville, AL at the FBI training facility on Redstone Arsenal on an annual basis. Any additional courses shall be conducted online.

7 Deliverables The Contractor shall provide monthly status reports to the Contracting Officer (CO) and the Contracting Office Representative (COR). The format will be agreed to by the Contractor and COR at the start of performance, but the contents shall contain the following, at a minimum:

• Courses Taught, including name of the course, number and names of FBI personnel enrolled and completed, location, and dates

• Current Management and Administrative problems

• Action items

The Contractor shall be responsible for providing the following deliverables:

Deliverable Title Deliverable Date SOW Reference Monthly Status Reports 2nd Wednesday of Every

Month 6.0

Industry Recognized Certificates Completion of Course 6.0

8 Electronic Invoicing Requirements The Federal Bureau of Investigation (FBI) requires contractors to submit invoices and supporting documentation electronically through the Invoice Processing Platform (IPP).

IPP is a secure, web-based electronic invoicing system provided by the U.S. Department of the Treasury’s Bureau of the Fiscal Service (Treasury) in partnership with the Federal Reserve Bank of St. Louis (FRSTL). IPP is available at no cost to any commercial contractor or independent contractor doing business with a participating government agency. To learn more about IPP, please visit IPP.gov.

Invoice Submission

Contractors are required to create and submit electronic invoices using the IPP system.

Invoices submitted by email will not be accepted. This requirement applies immediately upon contract award. For contract-specific questions, please contact the designated contracting officer for your contract.

Obtaining IPP Access

If your company has already enrolled in IPP:

You will not be required to re-register. Please contact your company's IPP account administrator so that he/she may add you as an additional user to your company’s IPP Collector account.

If your company has NOT enrolled in IPP:

Your company will be auto-enrolled for IPP using information from your SAM.gov account. Your company's Primary Electronic Business Point of Contact (POC) will be designated as an IPP administrator. This POC will be contacted by email to register when the FBI initiates the enrollment process through IPP. To prevent enrollment delays, please ensure your designated Electronic Business POC in SAM.gov is up to date.

Your company’s IPP administrator will be responsible for initial account registration as well as creating and managing your company’s IPP users and permissions. Please note that due to U.S. Department of the Treasury guidelines, IPP cannot set up User IDs using a shared email address.

How to register for IPP:

1. Once the FBI initiates the enrollment process, your company’s designated Electronic Business POC in SAM.gov will receive two emails from IPP Customer Support (ipp.noreply@mail.eroc.twai.gov):

• The first email contains the initial administrative IPP User ID

• The second email, sent within 24 hours of receipt of the first email, contains a temporary password.

• You must log in with the temporary password within 30 days.

2. Registration is complete when the initial administrative user logs into the IPP website with the User ID and password provided and accepts the IPP rules of behavior. Additional user accounts, including administrators, can be created after initial login.

Training

Contractor training materials, including a first-time login tutorial, are available on the IPP.gov website. Once you have logged in to the IPP application, you will have access to user guides that provide step-by-step instructions for all IPP capabilities ranging from creating and submitting an invoice to setting up email notifications.

Additional Support

IPP Customer Support Team is available Monday through Friday from 8:00 am to 6:00 pm EST

•Phone: (866) 973-3131 or Email: IPPCustomerSupport@fiscal.treasury.gov

•For answers to frequently asked questions, visit the Contractor FAQ page on the IPP.gov website.

8 Government Furnished Equipment or Information The Government shall not provide contractor personnel assigned to this contract with a typical working environment, including office furniture and furnishings, secure and unclassified telephone service, storage for classified and unclassified materials, use of the Government's mail and courier services, and access to copiers, fax machines, personal computers (PCs) and related software.

9 Personnel Availability The Government shall not provide any oversight to the availability of contractors. The Contractor’s availability shall be dependent upon the scheduled courses offered by the contractor. Any issues regarding the Contractor’s availability shall be coordinated with the COR.

11 Government Representatives The functions inherent to this contract shall be performed by the designated Contracting Officer. The duly assigned COR shall ensure all actions about this contract are requested via the Contracting Officer.

11.1 Contracting Officer Representative

The COR will be identified via a letter of COR delegation authority for this contract. The COR is responsible, as applicable, for receiving all deliverables, inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract; providing direction to the Contractor which clarifies the contract effort, fills in details or otherwise serves to accomplish the contractual Scope of Work; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

The COR does not have the authority to alter or modify the Contractor's obligations, contract terms, conditions, specifications, or cost. If as a result of technical discussions, it is in the Government’s best interest to alter/change contractual obligations or the Scope of Work, the CO shall issue such changes.

11.2 Contracting Officer

This contract will be administered by:

Robert Shifflet Contracting Officer Rtshifflet@fbi.gov

Ashley Johnson Contract Specialist Aljohnson5@fbi.gov mailto:Rtshifflet@fbi.gov