CyOSST IV JA Redacted.pdf

Justification and Approval (J&A) for Other Than Full and Open Competition

CONTROLLED UNCLASSIFIED INFORMATION

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 2 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 2 of 11

I. Agency and Contracting Activity.

a. Contracting Agency: U.S. Air Force

b. Procuring Activity: AMIC Det-2 OL/C (Tinker AFB, OK) PKA 4012 Hilltop Drive Tinker Air Force Base, Oklahoma 73145

c. Requiring Activity: 39 IOS Det 1 3515 S. General McMullen, Bldg 4 San Antonio TX, 78226-1710

II. Nature and/or description of the action being approved.

This action is to establish a new (5) year Blanket Purchase Agreement (BPA) to purchase course training vouchers from Escal Institute of Advanced Technologies, Doing Business As (DBA), System Administration, Audit, Network and Security (SANS).

The current contract (FA8773-20-A-0001) is a five (5) year sole source award to SANS and will expire 28 February 2025.

Air Force Cyber Command (AFCYBER) Forces provides direct support to the United States Cyber Command (USCYBERCOM) as part of the Cyber Mission Forces (CMF), Cyber Security Service Providers (CSSP), and the 16th Air Force (16AF) Cyber Weapon System (WPS) crew members positions. This support is in accordance with (IAW) USCYBERCOM Joint Cyberspace Training and Certification Standards (JCT&CS), Air Force (AF) and Air Combat Command (ACC) 17 series publications, ACC/A326K tasking, USCYBERCOM Course Design Document (CDD), ACC approved course syllabi, and ACC approved Master Task Training List (MTTL). The 39 Information Operations Squadron (39 IOS), as the Cyber Operations Formal Training Unit (FTU), is tasked to provide military and commercial Cyber security training courses for the AFCYBER and USCYBERCOM teams.

The commercial Cyber security training that SANS provides integrates into the AFCYBER Forces Initial Qualifications Training (IQT), 2000-Level work role training, Mission Qualification Training (MQT), and Continuation Training (CT) programs to fill gaps in training identified by USCYBEROM JCT&CS, CDD, or AF Syllabi and MTTL.

The proposed contract is a firm fixed price (FFP) BPA IAW Federal Acquisitions Regulations (FAR) 13.303. A BPA is the desired vehicle as the customer(s) require vouchers for training courses and training event; however, the exact amounts and delivery requirements throughout the period of performance are unknown. The requirement for the CMF and CSSP teams has grown exponentially since FY18. The Air Force Cyber Training Pipeline (AFCTP) Requirement has doubled to over 2500 students per year since FY18.

This BPA is for the purchase of very specific mandated cyber security course training vouchers from a wide commercial cyber security training portfolio, including advanced commercial Cyber training environments. AFCYBER and USCYBERCOM Operations are dynamic and must adapt quickly to the maturing domain and adversary actions. The wide variety and relevancy of courses at the SANS Institute allows the 39 IOS the maximum flexibility to quickly provide required training as directed by field Commanders, keeping pace with our adversaries. The SANS Institute training courses are part of formal training courses, individual and operational crew continuation training, or upgrade training. The commercial training courses must meet American National Standards Institute (ANSI) standards. The SANS Institute courses meet ANSI standards are accredited by the Global Information Assurance Certification (GIAC) organization. For clarification: SANS and GIAC, while corporately separate companies, both are tied to the Escal Institute of Advanced Technologies and symbiotic in nature. The SANS company conducts the training, and the GIAC company provides the independent ANSI certification testing for the training courses taught by

SANS.

All SANS courseware and GIAC Certification exams are copyright protected. SANS updates its curriculum multiple times per year to address the latest industry trends and in conjunction with GIAC exams. It has come to SANS' attention that various businesses may claim the ability to resell SANS courses or GIAC certification exams.

However, no other entity is authorized to produce SANS training or issue GIAC Certifications. If courses or certifications are obtained through resale, or if registration is attempted on behalf of another individual, students will be refused attendance to SANS courses and the opportunity to sit for GIAC Certification exams. Furthermore, certain

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 11 companies may assert that their employed instructors are qualified to teach SANS courses. However, SANS has not authorized any such agreements with external entities. The GIAC Disclaimer states, "The GIAC certification program only offers certification attempts to individual candidates, including verification of individual identity at multiple steps. SANS is the sole source for GIAC certification exams and exam vouchers.

GIAC does not permit the resale or transfer of any certification registration or GIAC exam voucher. Each certification attempt purchased is non-transferable and any certification application / registration instance is intrinsically tied to one and only one individual account."

The Department of Defense (DoD) 8140 Cyber Workforce Qualification Program (CWQP) provides structure for standardizing work across the full spectrum of Cyber operations, leverages DoD 8140 proficiency levels for performing Cyber work roles, shapes training and qualifications to grow Cyber workforce capabilities. It also addresses the scope of expertise needed for all Cyber disciplines, using a comprehensive approach for Cyber workforce talent management. The DoD 8140 CWQP is designed for individual flexibility by allowing options to obtain knowledge and capability to perform skills-based work roles, while empowering organizations to levy additional requirements based on operational needs. DoD 8140 policy governs all cyber/ cybersecurity positions and personnel across DoD, regardless of personnel/pay system (e.g., General Schedule (GS), Cyber Excepted Service (CES), Defense Civilian Intelligence Personnel System (DCIPS), Acquisition Demonstration (AcqDemo)).

DoD Directive (DoDD) 8140.01 Cyberspace Workforce Management establishes a definition for the Cyber workforce, introduces the DoD Cyber Workforce Framework (DCWF) as an authoritative reference, and outlines component roles and responsibilities for the management of the DoD Cyber workforce. The DCWF has a hierarchical structure with categories, specialty areas, and work roles. Each work role has a definition; a list of core and additional tasks; and knowledge, skills, and abilities (KSAs) that describe what is needed to execute critical functions. The DCWF provides the DoD standard naming and numbering conventions and provides descriptions of individual DoD cyberspace work roles, tasks, and KSAs.

Under DoD 8140, DCWF work roles comprise core and additional Knowledge, Skills, Abilities, and Tasks (KSATs) that are continually evolving to combat dynamic Cyber threats.

The SANS courses provide the most commercial training variety of KSAT work role coverage. The training courses, along with the GIAC certification, are intended to bridge the gap of the identified KSATs for the work role and AFCYBER weapon system training courses, as well as provide additional work role or mission specific training not yet covered by AFCYBER training courses.

The AF Cyber training program is designed to develop a cyberspace workforce within a common understanding of cyberspace concepts, principles, and applications. Cybersecurity KSATs must be integrated into the qualification requirements of all cyberspace work roles regardless of workforce element alignment. SANS courses are requested when the AF or Joint courseware does not meet the KSAT standard, or where commercial training courses may be reasonable and timely.

This will be the third sole source BPA to SANS. The first BPA (FA8773-18-A-0001) was for two (2) years. The second BPA (FA8773-20-A-0001) was for Five (5) years with an approved amount of . This third BPA will allow the for the continual growth in meeting the AF Cyber Curriculum and USCC training requirements by supporting the 39 IOS and AF mission.

This effort will be in accordance with FAR 6.302-1, Only one responsible source and no other supplies or service will satisfy agency requirements. This justification for Other than Full and Open Competition covers all the purchases (calls) issued under this BPA. The BPA will be a five (5) year agreement; base year plus four (4) one (1) year ordering periods. The proposed ordering period is 28 February 2025 - 27 February 2030. The total estimated value of this requirement for the entire ordering period is .

III. Description of supplies/services required to meet agency needs.

The Government requirement is for the contractor to provide a portfolio of commercially available Cyber security courses taught on-site at a Government provided secure facility, on Government provided equipment. All courses covered under this BPA will be no longer than six (6) consecutive training days and will integrate into existing Government course instruction requiring

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 11 commercial Cyber training to cover USCYBERCOM KSATs and AF Training Task List items. All hands-on-practical lab environments must be installed on Government provided network equipment and infrastructure. The contractor must also provide commercial certification testing for the courses, as needed. All testing must be accomplished at Government provided facility sites using Government provided equipment and networks. In addition to the course hands-on network labs, the contractor must provide and integrate an advanced Cyber training environment with challenging scenarios for the students within their Government provided learning environment.

The commercial courses, hands-on network labs, certification tests, and Cyber training environment must be installed on Government owned and operated equipment. These courses must integrate with existing Government owned and operated course of instruction. Due to the AFCTP limitations, the contractor has one (1) week (up to six (6) consecutive training days) to integrate the commercial courseware material.

The number and content of the required courses is subject to change as the Cyber curriculum is constantly evolving based on the USCYBERCOM and AF mission requirements. Currently, the Formal Training Unit (FTU) is placing the applicable commercial training courses inside the Joint Cyber Defense Analysts-Basic (CDA-B) course, Cyber Vulnerability Analysis / Hunt (CVAH) course, the Air Force Cyber Defense (ACD) course, and the Advanced Operations Course (AOC). Within each of these courses, the FTU integrates one commercial Cyber training course lasting up to six (6) consecutive training days. All testing occurs at the FTU or at the student's assigned unit. The cyber training environment is installed on FTU equipment, networks, and infrastructure.

The AFCTP responds to Cyber Operator training needs from the AF, Joint Forces, Combatant Command, and various Governmental Departments and Agencies with advanced accredited training. The Cyberspace Domain is based on commercially developed technology; therefore, CyOSST IV will continue to provide highly specialized Cyber Weapon Systems Operators and trainers specifically designed to meet the need of the 16 AF/AFCYBER, USCYBERCOM, and CMF. Students receive unique and innovative commercially based advanced cyber security training offering the latest cyber offensive and defensive tactics, techniques, and procedures necessary to defend the United States Cyber organizations from Cyber threats. Since the commencement of CyOSST in FY18, the BPA has allowed the support and flexibility to provide very specific vital training, to aid in combating and protecting the USCYBERCOM and AF missions.

The Government has performed extensive market research to determine if any other contractor can provide the level of required specialized Cyber training, with the multitude of classes and expertise, for a cost that SANS offers the Government. To date, there is no other contractor that is able to meet the Government's AFCYBER Cyber Curricula needs. For the past seven (7) years the AFCYBER training needs have been met with purchasing the SANS vouchers that have been aligned with the AF Cyberspace operations FTU IQT for training classes. All SANS on-site training courses are scheduled through the 39 IOS Contract Officer Representative and registrar. Also, SANS provides appropriately cleared instructors.

Based on seven (7) years of historical data, the Government currently estimates 3080 vouchers and 308 re-test vouchers (plan for a 10% failure rate requiring additional tests for student retesting), and access to the licensed continuous SANS Cyber Simulation Training Environment to be utilized over the next five (5) years.

No additional travel costs are required by the students due to students already TDY to the FTU or other AF Cyber course locations.

28 February 2025 - 27 February 2026 (Base Year)

560 SANS vouchers/initial testing 56 Re-Take Vouchers (10% of 560)

28 February 2026 - 27 February 2027 (1st year cost)

560 SANS vouchers/initial testing 56 Re-Take Vouchers (10% of 560)

28 February 2027 - 27 February 2028 (2nd year cost)

560 SANS vouchers/initial testing 56 Re-Take Vouchers (10% of 560)

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 11

28 February 2028 - 27 February 2029 (3rd year cost)

560 SANS vouchers/initial testing 56 Re-Take Vouchers (10% of 560)

28 February 2029 - 27 February 2030 (4th year cost)

560 SANS vouchers/initial testing 56 Re-Take Vouchers (10% of 560)

The total projected student throughput for FY25-FY30 for the 39 IOS FTU and other AF Cyber training is approximately 4480 Students. Current course plans will require approximately 3080 vouchers and 308 re-tests to meet demand at ordering period 4 prices of , respectively for SANS total of with any annual price cost increases. The projected contract will provide an additional growth potential of for the 39 IOS and allow other AF and Joint Cyber organizations to exercise voucher purchases for mission requirement.

The CyOSST IV requirement will utilize Operations and Maintenance (O&M) 3400 funding. Funding will be at the call level;

the Wing or Major Command (MAJCOM) will demonstrate the funds are available by providing a certified Form 9 to the contracting office. O&M 3400 funding will be used from one year to the next based on availability of funds IAW 52.232-18.

IV. Demonstration that the contractor's unique qualifications or the nature of the acquisition requires use of the authority cited above.

In order for the Government to meet the AFCYBER's IQT, 2000-Level Training, MQT, and CT requirements, six (6) training days are dedicated to commercial training and certification programs into the AFCYBER IQT, 2000-Level Training, MQT and CT courses in which SANS is the only vendor who can provide this highly specialized and compressed advanced Cyber security training curriculum to meet ACC Task Training List (TTL), Joint Requirement KSAT, and syllabus advanced commercial Cyber technology requirements. AFCYBER currently requires advanced courses that train commercial Cyber technology, Cyber penetration testing, Cyber forensics, and Cyber defensive security training programs.

Since 2007, the Government has conducted market research comparing the Government requirements for advanced civilian Cyber technology training with commercially available course material. Based on responses from competing vendors, their Cyber training is focused on DoD 8570 certification while AF Cyber Training DoDI 8570.01 is cancelled and superseded by DoD 8140. DoD 8570 certifications are still considered `baseline' certifications'; however, DoD 8570 Information Technology (IT) certifications do not cover the breadth and depth of the DCWF work role KSATs. The AF has a funded program for DoD 8570 training courses, test vouchers and annual maintenance tokens, but this BPA is focused on DoD 8140 DCWF KSAT training for AFCYBER and USCYBERCOM Cyber Operations Force CMF and CSSP work roles, not the IT Cyber Workforce Improvement Program (DoD 8570) certifications.

According to the DoD Cyber Workforce Qualifications Matrices Management Spreadsheet for Cybersecurity, it captures and organizes commercial certification and training options, DoD-owned training options, and educational options aligned to DCWF.

The matrix and repository provide a central location to review existing cyber qualification options that meet the requirements of the DoD Cyberspace Workforce Qualification and Management Program (DoDM 8140.03) and supports the continued professional development of the DoD cyber workforce. The effective date of this document is 16 February 2024. Each foundational qualification option is mapped to a DCWF work role and the appropriate DoD 8140 proficiency level (i.e., Basic, Intermediate, and Advanced). Out of the 512 listed commercial training and certification offerings to meet DCWF work roles SANS/GIAC covers 215 or 42%.

Cyberspace, as a domain, is more dependent on commercial civilian technology than other war fighting domains with an established defense industrial base infrastructure. Currently, civilian Cyber training programs are robust and updated more frequently which provide a less expensive foundation of Cyber security knowledge than what military programs provide. Current SANS training and instruction meets between 87% - 94% of DCWF USCC Work Roles which is required by the KSAT required by USCYBERCOM. After careful analysis by SANS Subject Matter Experts and leveraging Artificial Intelligence (AI) mapping

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 8 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 8 of 11

H98230-12-D-0036 / 21 February 2012 - 31 January 2017 Total Contract Value:

United States Secret Service (USSS) BPA Number/Period of Performance:

HSSS01-14-A-0027 / 29 September 2014 - 28 September 2019 Total BPA Value:

Finally, searches were conducted via the World Wide Web for alternative solutions, and none were found.

The USCYBERCOM, AFCYBER, and AF Cyber FTU course requirements are subject to change, and often do change based on maturing requirements, during the life of the contract. The embedded advanced commercial Cyber technology courses provided by SANS and GIAC continue to provide a solid foundation on which the Cyber FTU builds on military rigor, discipline, and operational process.

V. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable, including whether a notice was or will be publicized as required by subpart 5.2 and, if not, which exception under

FAR 5.202 applies.

This proposed contract action is ; therefore, it will be synopsized IAW FAR 5.201. Due to the commerciality of this requirement and IAW FAR 12.603 a combined synopsis/solicitation will be posted on GPE SAM.gov.

VI. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The anticipated BPA will be sole source to SANS. The anticipated price will be considered fair and reasonable IAW FAR 13.106-3(a)(2)(ii) & (vi) comparison of proposed price with prices found reasonable on previous purchase as well as the program office's technical analysis of the offeror's Basis of Estimates (BOE).

VII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

Market research has been conducted for a long-term competitive solution via SAM.Gov by issuing two (2) Sources Sought (SS) to search for other interested or qualified vendors.

SS, FA877323R0023, was posted to SAM.GOV on 26 September 2023 for 41 days closing on 6 November 2023. The SS included a Market Research Questionnaire (MRQ). Prospective contractors had to meet the SS prerequisite, by submitting a completed MRQ along with a description on how their company meets that specific requirement. The MRQ had 400-line items capturing all requirements the 39 IOS needs for trainees to meet the mission. The MRQ requested information on resources, capabilities, course capabilities requirements, familiarization with AF certifications, accreditation, data, tools, technology, vendor product, and course feedback.

As a result of the SS, nine (9) vendors responded; seven (7) small businesses; one (1) large business; one (1) business located in Israel (not registered in SAM). Of the nine (9) responses, three (3) did not submit the required questionnaire. Of the five (5) remaining responses, only one (1) large business vendor answered the questionnaire completely.

To promote competition, a second SS was posted to SAM.GOV on 4 March 2024 for 21 days closing on 25 March. This SS consisted of a shortened MRQ and a Statement of Work. The second SS also generated nine (9) vendor responses; eight (8) small businesses; one (1) large business. Of the nine (9) responses, four (4) did not submit the questionnaire as required by the SS instruction. A follow up email was sent to all four (4) vendors and no responses was received.

Between the two (2) SS, four (4) vendors responded to both; three (3) small businesses, and one (1) large business, . Of the three (3) repeat (3) small business responses, they did not submit the questionnaire either time.

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 9 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 9 of 11

Currently, there is no expectation that two (2) or more small businesses can satisfy the 39 IOS requirement.

VIII. Any other facts supporting the use of Other Than Full and Open Competition.

The continued performance of this specialized Cyber training by SANS allows the Government to seamlessly meet the training mission. The SANS course vouchers, GIAC tests, hands-on Cyber simulation exercises and licensing to the war-fighter ensures the best value to the Government.

IX. List of any sources that expressed, in writing, an interest in the acquisition.

THE ESCAL INSTITUTE OF ADVANCED TECHNOLOGIES DBA - The SANS Institute submitted a completed MRQ along with a paragraph of relevant information explaining how their company meets or exceeds the MRQ element.

SANS response to the instructor possessing the course cert they instruct was a full explanation how they certify their instructors beginning with the candidate score 85% on the cert. Candidates progress through multiple levels then are considered Certified instructors. SANS training has been mapped and is updated per customer request to US Air Force specific training requirements to support commands which operates cyber weapon systems who provide operational training for cybercrews. A list of Training ranges was provided and described in detail that could be used to assess training and provide more experience to the student SANS Institute was the only vendor to respond to topical information, as requested, with specific answers and references from their course curriculum within their course library.

is an IT solutions and service provider specializing in the Planning, Engineering, Installation, Operation, Maintenance, and Protection of the Department of Defense Information Network (DoDIN) and the DISA Global Command and Control Joint architecture, extending from the Tactical through the Strategic level. response to the questionnaire capability statement provided “Y/N" answers with one answer (i.e. "Y" As part of our offerings, our company would ensure that these CEUs are part of the benefit of the course.") from Capability question 14 to 369. Very little in-depth narrative to describe expertise for Cyber Training, other than instructing at Ft Eisenhower, in delivering cyber training with no past performance within the MRQ to ascertain their ability to meet Air Force requirements for 39 IOS specialized & delivered curriculum focused toward 16 AF/AFCYBER Operators and trainers.

responded with "Yes" to all the questions in the MRQ. Their narrative description consisted of " features this component in all our standard training modules"; "We understand this technology". is unable to meet the 39 IOS specialized & delivered curriculum.

submitted an incomplete MRQ with vague responses.

submitted a fully completed MRQ by providing “Y/N" answers with one specific answer for Capability question 14 to 22 (i.e. "Y" “We can provide the certification document signed by the director and/or instructor to indicate the learning hours.

States/Schools may have their own credit acceptance. If student requires additional verification or help we provide that on the best effort basis."). Very little in-depth narrative to describe expertise for Cyber Training other than acquiring vouchers from IT/ Cyber vendors such as CompTIA, CEH and SANS and deliver to the customer. However, SANS doesn't contract out their courses; therefore, would be unable to provide the training that the 39 IOS requires. Also, was unsure if they are registered for the appropriate NAICS code of 541519.

submitted very little or unclear narrative response information. They did not submit a completed questionnaire addressing all the required areas of need. Their Cyber Ops Academy would deliver courses either on-line or in-person. It was stated that it would be an additional cost to provided fully trained and certified instructors to the costumer site if required. For those cases where there is a requirement for the instructor to be certified by the course material, they are certified by the course curriculum developer. course developers have developed specialized courses in the past for clients, based on their specific training requirements, melding of current offerings, and merging of courses to produce a cohesive program.

Denamita did not return the MRQ. Therefore, their ability to meet the 39 IOS needs was not established.

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 10 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 10 of 11 stated they offer GIAC. However, based on 39 IOS knowledge of SANS training, SANS does not distribute vouchers or GIAC as a third party to another vendor. Therefore, Logic Finders response to their capability is inaccurate. Also, did not submit a completed MRQ allowing for an accurate analysis.

focus is customer Information Technology (IT) support and is not engineered to provide all aspect of Cyber training. The MRQ (second version) was not returned to ascertain if they are capable of meeting the Air Force requirement for 39

IOS.

responded to both SS with a capabilities statement, however, they did not return the MRQ. Follow up emails were sent but vendor did not respond.

Inc returned the completed MRQ with each question answered in narrative format as requested.

provides a plethora of training courses. Some courses are focused primarily toward training Intel specific personnel which wouldn't be compatible with the Cyber operators training pipeline. Other courses are specifically tailored courses that would be compatible within the 39 IOS courses. However, these courses are very "niche" focused and if task requirements morphed over time, these courses would become quickly out dated. provided details for course ordering dependent of length of class which included the 1 and 5 day tailored training events. The other three timeframes (etc. 2-4 hrs training, 10 day tailored training and 1 Week Curriculum) would not synchronize well with the Cyber training pipeline.

Furthermore, course training sessions can only support a minimum of 10 and a maximum of 20 students whereas the 39 IOS current classrooms throughput are 30 students. has only seven instructors to deliver their curriculum and would be overwhelmed with the Cyber Operations Training pipeline requirements for multiple concurrent courses at different locations. After reviewing the MQR, capabilities would be helpful in certain training regimes, but overall cannot meet Air Force requirements for 39 IOS specialized & delivered curriculum.

returned the MRQ completed with each question answered in narrative format as requested.

stated they could deliver courses Instructor-Led On-site, Live On-Line, and On Demand through

SANS. However, SANS doesn't distribute sub-contractors. would access data, tool, vendor training and certifications through ISC2, ISACA, PMI, Cisco, CompTIA and Universities. These courses have been previously vetted by the 39 IOS curriculum leads and have been found to lack the task coverage required to meet Joint & Air Force training requirements. provided course pricing for CISSP, CEH, Sec +, CCSP, CISM, CISA, which were comparable to the current BPA pricing; not to include certification pricing. MRQ provided enough information to determine their inability to meet Air Force course load requirements for 39 IOS specialized & delivered curriculum and instructors.

Security did not return the MRQ. Therefore, their ability to meet the 39 IOS needs was not established.

X. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisitions for the supplies or services required.

Through market research of the two (2) sources sought posted on SAM.gov, the Government determined that only one vendor, SANS/GIAC is capable of providing the required AFCYBER IQT,MQT and CT training, certification and training environment to meet the agency's need. The SS results indicated that other commercial companies do not offer all the required courses to the appropriate level of learning or capabilities to meet the AFSPC TTL and Joint Requirements indicated in the course syllabi. After further discussions with potential vendors, these companies are not able or willing to change courses to meet the Government mission; as the change to the courses would cause significant cost increase.

The Government will continue researching other sources for the curriculum, assessment/certification and student exercise/ mission training requirements. The Government will also pursue additional market research efforts throughout the life of CyOSST IV. This will consist of a SS for the required curriculum descriptions, assessment/certification requirements, delivery methods, student exercise/mission training environments, multiple location requirements, proposed schedule, and number of students estimated to attend. The Government will discuss the requirement with interested contractors to determine what curriculum might be created to meet the Government training needs.

August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 11 of 11August 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 11 of 11

Not only can no other vendor meet the 39 IOS mission of offering specialized Cyber training, but they also cannot provide the training at such a substantial discount and price such as SANS.

XI. Certification by the Contracting Officer.

As evidenced by my signature above, I certify that this justification is accurate and complete to the best of my knowledge and belief.

XII. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.