SOW_V3.0_ET_8-8-19.pdf

DJF-19-1800-PR-0001075 Version 1.0 Page 1

FEDERAL BUREAU OF INVESTIGATION

FINANCE DIVISION | PROCUREMENT SECTION

Digital Evidence Staffing Education and Development

(DESED) Unit

Digital Evidence Laboratory (DEL) Training Program

Services

For the

Operational Technology Division

Statement of Work

8/13/2019

DJF-19-1800-PR-0001075 Version 1.0 Page 2

FEDERAL BUREAU OF INVESTIGATION

STATEMENT OF WORK

1 Introduction

1.1 Background

Operational Technology Division (OTD) and Digital Evidence Staffing, Education and

Development (DESED) unit are responsible for the program management of both for Digital

Forensic Examiners (DFE) on the Computer Analysis Response Team (CART) and sponsored

Digital Evidence Extraction Technician (DExT). One of the critical items DESED provides as program management is the training of participants in digital forensics. The hands-on courses provide students with the knowledge and skills necessary to effectively use AccessData’s (AD) forensic software tools; AccessData Forensic ToolKit (FTK) Imager, AD Lab, Registry Viewer and Password Recovery Toolkit, as well as other customized tools tested and validated by OTD.

The forensic tools are vetted and placed on an “approved use” list for digital forensic examiners to use throughout the field. New DFEs and other FBI personnel in the DExT sponsor program must be trained in the use of these tools. CART Digital Forensic Examiners consists of professional support, Special Agents, as well as Task Force Officers from State/Local Law

Enforcement.

1.2 Scope

This is a contract to provide Specialized Digital Forensic Examiner Training to CART Digital

Forensic Examiners (without software) to the Federal Bureau of Investigation (FBI), (OTD)

Division (DESED).

1.3 Objectives

DESED requires three (3) customized training courses, held three (3) times each fiscal year during the period of performance, 20 students, with the possibility of up to an additional 5 students as needed. The courses will be held at OTD Annex Training Site, Stafford, VA, BWI Training

Center, Linthicum, MD and/or Huntsville, AL. Course curriculum will be provided for each student.

2 Requirements/Specifications This is a non-personal services contract. The Government shall not exercise any supervision or control over contractor employees performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the

Government. The Contractor is solely responsible for providing all software required to execute the training described. The Government will not provide any software licenses required for the

DJF-19-1800-PR-0001075 Version 1.0 Page 3 contract beyond the Windows based operating system running on the Government provided student workstation machine.

Custom Training – for CART DFE II course; Basic Tools, Intermediate OS Artifacts, and

Intermediate Web Artifacts

1. Experienced instructors:

a. All instructors must have an understanding of the FBI and RCFL system for

CART Examiners and be proficient in CART forensic tools used in the development and instruction of the course.

b. All instructors will have experience in the concepts of Digital Forensic Examiners methodologies, processes and technologies, to shape the curricula specifically to the FBI needs.

2. Rosters are required for student’s attendance.

3. A skills/test assessment must be designed based on the course material and meets the

CART training programs required passing score of 85%. Upon the successful passing of the course, Certificates of Completion must be provided to each student.

4. A summary of the completion of each course will be provided to the designated training manager subsequent to class. Assessments requested by the Training Program

Coordinator will detail strengths and weaknesses of each student.

5. Instructors will be required to provide guidance in the form of written or oral communication to students via a customer service process based on the learning material for up to one (1) year after the completion of the course.

6. Class learning material will be provided for 20 students, up to an additional 5 students if requested, to include but not limited to a Student Manual and supplemental documentation necessary for course completion. Class material will be shipped to the FBI in advance to setup the classroom, along with any electronic access to images and profiles for training use in class.

7. One “dry run” quality review of the course prior to implementation into the student curriculum will be required for any new vendors. Dry run will occur in one of the FBI training facilities and should be executed as near to student-delivery as possible. The dry run will afford government review of content and delivery to ensure training meets all requirements. As a result of the dry run, the government will provide feedback on necessary updates prior to first student delivery of DFE II course.

8. A File Transfer Protocol (FTP) site will be setup and provided to the FBI to allow access to the files applied in training as a continuous review of the material used in iteration of each class.

9. All instructor travel and related instructor expenses will not be incurred by the government, but by the company awarded the contract. At least one instructor must obtain and maintain a Top Secret Clearance.

2.1 Task Descriptions

DJF-19-1800-PR-0001075 Version 1.0 Page 4

CART Basic Tools (3 days, Week 1, Mon – Wed)

This course will provide a three (3) day hands-on foundation for intelligent use of

AccessData Lab (AD Lab) within the FBI CART Program. The course will include in-depth instruction of the AccessData products to include: AccessData Lab, Registry Viewer, FTK Imager and Password Recovery Toolkit (PRTK), which all relate to the CART Digital

Forensic Examiner training program requirements. The class will provide CART Digital

Forensic Examiners with an understanding of how AD Lab software interacts and processes the parsing of data for API Integration, PhotoDNA, Explicit Image Detection, Volatile data processing, Foreign Language translation, Cassandra Database, and Known

File Filter (KFF) Server to be used to address the needs of the FBI Special Agent or RCFL task force participants while conducting investigations. Students will create cases using

AD Lab, by understanding the network license service management, license manager and

WiBu Codemeter configurations for the application to maximize its utilization within the network, learn evidence acquisition concepts and how to validate the data collected. The course will cover techniques such as keyword or index searching, hash analysis; data export; and creation of reports relating to examination findings. The course will conclude with instruction on archiving, data validation, and testing.

CART Intermediate OS Artifacts (3 days, Week 1, Thu – Sat)

This course will utilize FTK Imager, AD Lab, Registry Viewer, TZWorks, Sanderson

Tools, EseDatabaseViewer, LinkAlyzer and Eric Zimmerman tools, along with other relevant industry-standard tools to compare to the AccessData products. Focus will be the integration into the FBI CART infrastructure along with the CART-specific tools for case creation and examination.

The OS Artifacts class will focus on relevant course material to identify evidence items in the Windows 7 through 10 file systems and what is available from artifacts. This course will use a live running system for analysis in several modules, which will give students useful repetition in creating cases, examining evidence, exporting data and creating reports

The course will provide CART Digital Forensic Examiners with an understanding of how

AD Lab and other tools are used to address the needs of the FBI Special Agent or RCFL task force participants while conducting investigations. The course will cover techniques such as Regular Expressions for the Windows Registry and advanced Registry Scripting

Reporting, Link file and Jumpfile analysis, USB tracking, Event log timelines and the examination of the Volume Shadow Copy files.

CART Intermediate Web Artifacts (3 days, Week 2, Mon – Wed)

This course will utilize AD Lab, Internet Evidence Finder, SkypeAlyzer, DB Browser for

SQLite, Sanderson Tools, Forensic Browser for SQLite and PRTK to focus on internet web browsers, cloud-based storage such as Google Drive, SQLite databases, and recovering stored logon credentials.

The class will provide CART Digital Forensic Examiners with an understanding of how

AD Lab and other tools are used to address the needs of the FBI Special Agent or RCFL task force participants while conducting investigations. The course will cover the current

DJF-19-1800-PR-0001075 Version 1.0 Page 5

Windows browsers, cloud-based storage and the examination of the Volume Shadow Copy files and what is left behind by the end user.

3 Place of Performance The primary place of performance will be at FBI and DOJ facilities; OTD Annex Training Site, Stafford, VA, BWI Training Center, Linthicum, MD and/or Training Site in Huntsville, AL.

4 Period of Performance The period of performance for this effort will be as follows:

PERIOD BEGIN END

Base Period 09/23/19 09/22/20

Option Period 1 09/23/20 09/22/21

Option Period 2 09/23/21 09/22/22

Option Period 3 09/23/22 09/22/23

Option Period 4 09/23/23 09/22/24

5 Hours of Operation The Contractor’s instructional day will typically be eight work hours plus a mandatory 30-minute lunch. Typical course start/end times are 8:30am and 5:00pm respectively, Monday –

Friday. This contract requires one Saturday training day following the same start/end times.

Flexibility within the normal work day shall be coordinated with the Contracting Officer’s

Representative (COR).

6 Deliverables The Contractor shall provide monthly status reports to the Contracting Officer (CO) and the

COR. The format will be agreed to by the Contractor and COR at the start of performance, but the contents shall contain the following, at a minimum: Staffing Summary, Hours and Labor performed, Current Management and Administrative problems, and Action items. The

Contractor shall also provide a bi-weekly status report that describes the activities that were completed (highlights), areas of risk, and personnel and their responsibilities for that time period.

The Contractor shall be responsible for providing the following deliverables:

DJF-19-1800-PR-0001075 Version 1.0 Page 6

DELIVERABLE TITLE DELIVERABLE DATE METHOD OF

DELIVERY

Class materials (to include, but not limited to Student Manual and supplemental handouts)

At least 5 business days prior to class (progress to be reported as noted above)

Product: Shipment/Delivery

Progress: Email reporting

Dry Run Course At least 45 days prior to first student DFE II course

In person

Student Courses Dates TBD In person

Attendance rosters and skills test assessment results

Within 5 business days upon class completion

Email

Certificates of Completion provided based on testing results

Last day of each class In person

Detailed strengths and weaknesses of each student

Within 3 business days upon class completion

Email

7 Government Furnished Equipment or Information The Government will provide Contractor personnel assigned to this contract with a typical working environment, including office furniture and furnishings, unclassified telephone service, storage for unclassified materials, and access to copiers, and fax machines.

8 Security Requirements Training will occur in our stand-alone classroom. The classroom was configured so as it does not touch any Bureau’s enclaves. Vendor will bring a business laptop that will be inspected by local Information Security Officer (ISO) for compliance with requirements, such as WiFi, Cameras, location, Bluetooth (etc.) in a disabled state. Laptop is connected to a podium and presented through a projector only.

9 Government Representatives

9.1 Contracting Officer Representative

The COR will be identified via letter of COR delegation authority issued by the Contracting

Officer (CO) for this contract. The COR is responsible, as applicable, for: receiving all deliverables; inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract; providing direction to the Contractor which clarifies the contract effort, filling in details or otherwise furnishing information necessary to accomplish the SOW; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

The COR does not have the authority to alter or modify the Contractor's obligations, contract terms, conditions, specifications, or cost. If as a result of technical discussions, it is in the

Government’s best interest to alter/change contractual obligations or the SOW, the CO will issue such changes.

DJF-19-1800-PR-0001075 Version 1.0 Page 7

9.2 Contracting Officer

The CO is the appointed authority to bind the Government to the extent of the authority delegated. Direction that will modify the scope, schedule, terms and conditions, funding, or any other action that may modify the agreement as originally entered into with the Government must be given only by the CO.

This contract will be administered by:

Name: Katelyn R Haus

Title: Contracting Officer

Unit: PSAU

Email: krhaus@fbi.gov

10 Travel

When required and authorized by the Contracting Officer, travel must be conducted in accordance with Federal Travel Regulations (FTR). If the FBI requires a contractor to travel to an FBI site, or another government site, the contractor shall plan, schedule, and procure the airfare, lodging accommodations, and ground transportation for all approved travel by contractor personnel, ensuring that invoiced travel costs are itemized in accordance with the FTR. Upon completion of travel, the contractor shall make all documentation associated with the respective travel available to the COR at his or her request.

No travel outside of CONUS will occur.

11 Invoices

The Contractor shall submit invoices at the conclusion of each training session to

Central_Invoices@fbi.gov.

A proper invoice shall include the following information:

Name and address of the Contractor;

Invoice date and invoice number. The Contractor should date invoices as close as possible to the date of mailing or transmission;

Contract / Task Order number, contract line item number and, if applicable, an order number;

Description, quantity, unit of measure, unit price and extended price of the items delivered;

Terms of any discount for prompt payment offered;

Name and address of official to whom payment is to be sent;

Name, title, and phone number of person to notify in the event of a defective invoice;

Electronic Funds Transfer (EFT) banking information;

Contractor’s First / Last Name, Number of Hours, Labor Category, Total number of hours (items can be in any order), Cumulative Number of Hours; and

Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this Contract. The Contractor shall include this

DJF-19-1800-PR-0001075 Version 1.0 Page 8 information on each and every invoice when invoicing for full or partial supplies/services delivered/performed. If an invoice does not contain the above information, the Bureau reserves the right to reject the invoice(s) as IMPROPER and notify the Contractor within seven (7) calendar days after receipt of the invoice at the designated billing office pursuant. (Resubmission of a PROPER invoice(s) will be required.) Payment will be made by the FBI’s Commercial Payment Unit in accordance with the Prompt Payment

Act, FAR clause 52.232-25 (JUL 2013) upon the COR’s (or designee) certification of receipt of services and the CO final authorization for payment.

12 Rating Methodology The Government will evaluate all “Non-Cost” and “PASS/FAIL” Factors based on a color coded and narrative rating system. The rating system will allow the evaluation board to identify strengths, weaknesses, and risks associated with each proposal. The following standard color scheme will be used and illustrates to what degree the Offeror’s proposal meets the evaluation standards.

Blue: Is equivalent to a “Superior” adjectival rating. The proposed approach clearly exceeds requirements and clearly demonstrates the Offeror’s superior capability to deliver exceptional performance. The probability of success in attaining the goals and objectives is extremely high. No clarification is needed and there are no significant ambiguities.

Green: Is equivalent to a “Good” adjectival rating. The Offeror’s proposed approach has a good probability of meeting the requirements. Some weaknesses or ambiguities exist in the approach, but they are outweighed by strengths and correctable with minimal Government oversight or direction.

Yellow: Is equivalent to a “Marginal” adjectival rating. The Offeror’s proposed approach contains significant weaknesses. The approach has a low probability of meeting the requirements.

Red: Is equivalent to an “Unacceptable” adjectival rating. The proposed approach fails to exhibit a basic understanding of the requirements. The approach contains ambiguities to the extent that criteria requirements can only be met with major revisions to the proposal.

13 Evaluation Factors Technical: The Offeror shall clearly demonstrate their technical capabilities in meeting the requirement identified in this Statement of Work. The Offeror shall provide resumes of the proposed personnel to be used on this task indicating background, experience, clearance level, and education as it relates to this effort.

Past Performance: This Factor assesses the Offeror’s experience providing training services of a similar size and scope as compared to the SOW. The Government shall consider

DJF-19-1800-PR-0001075 Version 1.0 Page 9 the Offeror’s record of providing services to commercial and government customers. Experience with government customers, however, shall be considered more significant.

Cost: The Government will evaluate the total proposed cost of the base year and any option years. In addition, this evaluation will include an assessment of the Offeror’s proposal for completeness, reasonableness, and risk. The Offeror’s proposal shall be evaluated based on fair and adequate price competition to determine its’ fair and reasonableness.

14 Special requirements The capability of the awardee to perform a “dry run” of the course before it’s delivered to ensure it meets all of the Government’s needs. Given these courses are part of a larger curriculum, the Government needs to ensure all required topics are covered and to the depth required.