CyberRange_RFI_Required Capabilities.pdf

Required Capabilities document Cyber Range for Training

BACKGROUND

The Administrative Office, hereby referred to as AO), which includes Department of Technology Services (DTS), Systems Development and Support Office (SDSO), Training Division (TD) that supports the Federal Court community and AO Program Offices to identify, design, deploy, deliver and maintain the Information Technology (IT) training necessary to further the Judiciary's mission.

The SDSO-TD mission is to develop and deliver IT training, both in-person and online, for nationally supported technologies and applications to meet the operational needs of judges, court staff, and AO employees. In addition, the SDSO-TD delivers cybersecurity training to the approximately 2000 IT professionals within the Federal Court community.

SCOPE

This RFI solicits responses from qualified vendors (“Respondents”) to provide virtual cyber range services to the SDSO-TD. The cyber range should allow for SDSO-TD trainers to conduct live, virtual training events with congruent operating models supporting custom hands-on training on cybersecurity tools. The operating models need to include accurate, simulated court network environments for realistic training events.

Requirements

The Training Division is seeking a cloud-based, hosted cyber range environment that meets the following requirements:

Ability to provide an environment which can be customized on demand to match intel-driven requirements

Ability to incorporate independent cyber tools into the cyber environment for cyber professionals to respond to/engage with various threat scenarios, including but not limited to:

• Patch and Asset Management – KACE K1000 or Qualys

• Vulnerability Scanning – Tenable’s Security Center - Nessus

• Endpoint Protection Service – Trend Micro Apex One

• National Logging Service – Splunk – 9.x

• Firewall Service – Palo Alto

• Web Base Threat Protection - Forcepoint

Capability to have concurrent range scenarios and/or labs running at any given time.

Allows participants on-premises and remote to access any given scenario and labs simultaneously.

Ability for blue and red cyber teams to simultaneously engage in scenarios.

Ability to represent blue and red representations at various levels of fidelity from hardware-in-the-loop to network models of systems, to include representations of components and systems.

Ability to generate multiple environments to support different scenarios and different users.

Ability for mission planners/white teams to design and execute missions with an intuitive graphical user interface, record/playback scenarios, and export time-sequenced scenario data for further analysis.

Ability to replicate and employ threats at scale either pre-planned or in real-time.

Ability to support congruent operating models supporting blue and red representations simultaneously for large-scale and team/mission-focused scenarios.

Ability to purchase or subscribe to pre-packaged content ready to be integrated into curriculum for key cybersecurity topics including, but not limited to, cryptography, network security, computer security, software security, offensive security, defensive security, digital forensics on network traffic and digital devices, and incident response.

Training events should support up to 25 students at the same time, with the ability to rotate to a different group of students each month.

Provides training and support for range administrators.