Draft PWS_Web Development Services.pdf

Performance Work Statement (PWS) for

Defense Civilian Personnel Advisory Service (DCPAS) Web Sustainment/Content Management/Cloud Hosting

1.0 INTRODUCTION:

The Defense Civilian Personnel Advisory Service (DCPAS), requires contract support to provide full lifecycle website sustainment support services to include hosting in the cloud, design, development, content management, testing, operations and maintenance for two websites, https://www.dcpas.osd.mil and https://dodciviliancareers.com.

2.0 BACKGROUND:

The Defense Personnel Advisory Service (DCPAS) develops and oversees civilian human resource (HR) plans, policies, and programs for more than 900,000 Department of Defense employees worldwide. As an advisory service, DCPAS’s communication to its stakeholders stands as our core mission. It is imperative that the delivery of key HR messages is consistent and relevant for not only the HR Functional Community but also for external audiences. Currently, DCPAS’ communication continues to be archaic in nature as all policy memos or numbered messages are transmitted through email methods that may or may not reach its intended audiences. This web development effort will transform our communications efforts, allowing DCPAS to leverage technological advancements such as Twitter to efficiently communicate with DCPAS stakeholders.

3.0 SCOPE:

The Contractor shall provide the personnel, management, and materials necessary to provide complete secure web development support services to include status reporting, mock-ups, development, migration hosting in the cloud, design, testing, content management, testing, deployment and post-deployment operations and maintenance for two websites.

4.0 REQUIREMENTS: The Contractor shall:

4.1 Serves as the Technical Webmaster for both DCPAS websites (https://www.dcpas.osd.mil and https://dodciviliancareers.com), supporting any current website content updates with required technical needs in coordination with or in lieu of current work stream owners. The contractor shall provide full Webmaster services on the new DCPAS and DOD Civilian Careers websites.

4.2 Maintain and sustain newly deployed DCPAS websites, dcpas.osd.mil and dodciviliancareers.com, within an established FedRAMP approved cloud environment.

Contractor will be proactive with maintenance and respond to all maintenance requests by

DCPAS.

4.3 Ensure website is compatible with and accessible from various electronic/online media platforms to include computer, mobile devices, tablets, smartphones, etc.

4.4 Be responsible for providing technical support for all content changes, implementation of new designs/concepts at the government’s request and fielding new requirements as necessary. Implement a content management tool that gives the DCPAS the ability to make minor modifications to the content of the website and post routine updates without requiring the Contractor’s assistance, if requested by government lead.

4.5 Build technical foundation for new landing pages for various DCPAS events (i.e., disasters, World Wide Training Event) – with full-service event capability. Each event or training would have individual pages.

4.6 Manage all associated accounts such as Google API to ensure updates are made timely and functionality remain current.

4.7 If required, develop new custom modules within either or both of the maintained websites.

4.8 Maintain relationship with ProjectHost, which is the current cloud hosting provider and also ensure FedRAMP compliance.

4.9 Perform server maintenance and compliance sustainment, as necessary.

4.10 Perform required Drupal Core updates and module updates for both websites.

4.11 Perform required backups and website restores as required.

4.12 Perform for server account management as necessary.

4.13 Create a Book of Knowledge (BoK) detailing all sustainment activities in the event of a transition.

4.14 Ensure website is within 508 compliance and provide Government with bi-annual compliance reports.

4.15 All coding developed for DCPAS sites will remain property of DoD and will be given to DoD including all updates.

4.16 DoD will hold the copyrights to all imagery, videos, and music created under this contract.

4.17 Develop and create retrievable current and historical reports and analytics for all pages.

4.18 Provide monthly reports monitoring each projects’ deadlines/milestones and status of actions. The report shall be accessible to the Contracting Officer’s Representative (COR), DCPAS leadership and Communications Lead.

4.19 Ensure both websites remain secure and that redirects are in place to ensure important information from the old site can be found.

4.20 Monitor web pages to ensure pages are functional and operational.

4.21 Monitor operating links and widgets; ensure websites are aligned to FedRAMP and other security protocols; implement updates to content in a timely manner; and implement new designs to keep websites modernized.

4.22 Participate in a Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements, and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

5.0 DELIVERABLES:

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last workday prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the

COR.

Deliverable PWS Ref. Delivery Date Post award conference 4.22 Not Later than (NLT) 10 days after contract award Collateral Materials 4.14/4.16 Within 30 days of request Monthly Status Report 4.18 Third Business Day of Each

Month Project Management Plan 4.19 Within 60 Days of Contract

Start Date New Landing Pages 4.5 Within 10 days of request Create Book of Knowledge 4.13 Within 60 days of Contract Book of Knowledge updates 4.13 Every 30 days Website Coding 4.15 Within 30 days of deployment of an update

Deliverable PWS Ref. Delivery Date Web Site Updates 4.1/4.6 Within 10 days of request Historical Reports and Analytics 4.17 Within 30 days upon request and for each ending PoP

6.0 Service Contract Reporting (SCR) (Formerly eCMRA)

6.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, unless the Office of the Under Secretary of Defense (Personnel and Readiness) otherwise authorizes a later date. SCR will be accomplished in the System for Award Management www.sam.gov for fiscal year 20 reports.

7.0 CONTRACTOR TRAVEL: Travel is not anticipated for this requirement. Should travel become necessary, a proposal will be requested and the contract may be modified to reflect travel.

8.0 SECURITY

NOTE: Security Clearances are not required for access to unclassified data.

8.1 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.2 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.2.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC). Be responsible for obtaining CAC or PIV ready status and submit completed Tier 3 vetting package for processing.

8.2.1.1 All Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

8.2.1.2 Provide two forms of identification (I-9 document).

8.2.1.3 Personnel must be citizens of the United States.

http://www.sam.gov/

8.2.1.4 Obtaining CAC or PIV ready status is the responsibility of the contractor. If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated Tier 3 investigation, the contractor will immediately notify the DHRA Enterprise Operations Center (DEOC) Security Office and remove such person from performing work under this contract.

8.3 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

8.4 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all DHRA installations.

8.5 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials :

8.5.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it properly safeguarded and disseminated and is not released to the public without government authorization.

8.5.2 MARKING: Mark unclassified documents containing CUI: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48. In a classified document:

8.5.2.1 Mark individual paragraph containing only CUI, but not classified material by placing “(CUI)" at the beginning of the portion.

8.5.2.2 If the document or material contains CUI under the category of Controlled Technical Information (CTI), use of distribution statements is required. See DoDI 5200.48.

8.5.2.3 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows the it contains CUI material.

8.5.2.4 Mark a message containing material in accordance with DoDI 5200.48.

Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.5.2.5 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.5.2.6 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

“THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A

GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48,

DODI 5230.09, and DODI 5230.29.”

8.5.3 STORAGE: During normal duty hours, place CUI material in an out-of-sight location if your work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of CUI material is prohibited.

8.5.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or for bulky shipments-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.5.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.5.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.6 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

8.7 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.7.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.8 Lock Combinations. The Contractor shall control access to all government provided lock combinations to preclude unauthorized entry. The Contractor is not authorized to record lock combinations without written approval by the COR. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

8.9 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

8.10 Conduct while on Government Installation. The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct. Where the reasons for the removal request is due solely for security or misconduct by the employee(s), the replacement shall be at the contractor’s expense and not chargeable to the government.

8.11 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

8.12 Risk Management Framework. All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 rev 5, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

8.12.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

8.13 Information Security Continuous Monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

8.14 Cybersecurity Service Provider (CSSP). The Contractor shall perform CSSP services in accordance with DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017.

8.15 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident the Contractor shall notify the DMDC Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to

DMDC/IR.

8.16 Compliance with Cybersecurity and Privacy DoD Instructions and Directives.

The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall be in compliance with the latest versions of:

DoD Instruction (DoDI) 8500.01, Cybersecurity DoD Instruction (DoDI) 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT) The Privacy Act (5 U.S.C. 552a) DoD Instruction 5400.11 DoD Privacy and Civil Liberties Programs, January 2019 DoD Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 2019 DODI 5200.02 DoD Personnel Security Program (PSP) (Incorporating Change 2, Effective May 11, 2018) HSPD-12, Homeland Security Presidential Directive National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations Information Systems and Organizations NIST SP 800-137, Information Security Continuous Monitoring

DODI 8140, Cybersecurity Workforce DOD 8570.01-M, Information Assurance Workforce Improvement Program

8.17 Cloud Computing. Any commercial cloud computing services used for this requirement must comply with the DoD Cloud Computing Security Requirements Guide and DoD Cloud Computing Supplemental Guidance and Information as published by the Defense Information Systems Agency (DISA).

8.17.1 The Contractor shall have been issued an Authority to Operate (ATO) or Provisional-ATO (P-ATO) by Defense Information Systems Agency at the impact level appropriate to DHRA requirements to provide the relevant cloud computing services in accordance with DoD Cloud Computing SRG. Evidence of DISA authorization must be presented to the government.

8.17.2 The Contractor shall provide CSSP services that align with DoD Cloud Computing SRG requirements and will have a separate Service Level Agreement (SLA) initiated by the government.

8.18 Cyberspace Workforce Management Requirements. The Cybersecurity Workforce includes, but is not limited to, all individuals performing any of the cybersecurity functions described in DOD 8570.01-M. The cybersecurity workforce must be identified and managed, and personnel performing cybersecurity functions will be appropriately screened in accordance with DOD 8140.01 and supporting issuances. It is imperative to the DHRA mission that the cybersecurity workforce establish baseline technical and management cybersecurity skills among personnel performing cybersecurity functions across the DHRA enterprise.

8.18.1 Cybersecurity functions are focused on the development, operation, management, and enforcement of security capabilities for systems and networks.

Personnel performing cybersecurity functions establish cybersecurity policies and implement security measures and procedures for DHRA and affiliated information systems and networks.

8.18.1.1 Cybersecurity measures to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for their restoration by incorporating protection, detection, and reaction capabilities.

8.18.1.2 Job functions that require privilege access to DHRA assets.

8.18.1.3 Cybersecurity duties may be performed as primary or additional/embedded duties, by a DHRA employee (civilian, military or contractor). The table below outlines the job functions within the Cybersecurity Workforce categories and levels.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

(GFP/GFE/GFI):

The government will provide domain names and licenses.

10.0 PLACE OF PERFORMANCE.

The contractor will be working at the contractor’s facility. In-frequent meetings may occur in government facilities as required.

11.0 QUALITY CONTROL.

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

12.0 QUALITY ASSURANCE.

12.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

12.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

13.0 ORGANIZATIONAL CONFLICTS OF INTEREST

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS requirements, which requires it to supply technical support regarding such systems until the notice, is given, and written consent to proceed is issued by the Contracting Officer.

14.0 PERFORMANCE REQUIREMENT SUMMARY (PRS)

14.1 Purpose. The PRS lists performance objectives for the required services the Government will surveil. The absence of any contract requirement from the PRS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract including the clauses entitled “Inspection of Services” or “Inspection” or “Default” in the contract.

14.2 Components. The PRS states the performance objective (required service), and threshold (performance standard, accept and reject points (if applicable)) in either a qualitative or quantitative fashion for each critical success factor.

Performance

Objective

PWS

paragraph

Performance Standard/Acceptable Quality Level

Provide qualified people at TO start

1 Performance is acceptable when qualified personnel are on the job at TO start, unless previously negotiated by the CO

Maintain stable workforce

1 Less than 5% Lapse Rate across all contracted positions

Effectively replaces/ substitutes personnel

1 Performance is acceptable when:

a) Vacancies are filled with qualified personnel within 14 days of vacancy, unless approved in writing or otherwise directed in advance by the CO

AND

b) there is no mission impact due to position vacancies or unqualified personnel

Develop and submit all required deliverables

Section 5 Performance is acceptable when:

a) 100% of deliverable requirements are met and received on time

AND

b) critical information is accurate

Ensure both websites remain secure and that redirects are in place to ensure important information from the old site can be found.

Section 4.8.2 Performance is acceptable when:

a) All DoD Cybersecurity protocols are met

AND

b) Missing or improperly functioning redirects are corrected and put in place within 10 days of being notified by the COR.

Monitor web pages to ensure pages are functional and operational

Section 4.9.1 Performance is acceptable when:

a) No more than 3 incidents per month are reported by the COR on web pages not functioning or operating properly

AND

b) Improperly functioning or operating web pages are fixed within 10 days of being notified by the COR.

Monitor operating links and widgets;

ensure websites are aligned to FedRAMP and other security protocols; implement updates to content in a timely manner; and implement new designs to keep websites modernized.

Section 4.9.2 Performance is acceptable when:

a) Content updates are implemented within 14 days of being notified by the COR

AND

b) No deviations and/or incidents which violate FedRAMP and other security protocols are reported by the COR.

15.0 Mandatory Training Requirement for Contractor:

Contractor employees performing under this contract shall complete the following mandatory trainings within 30 days of contract award and date of any option exercised. If additional mandatory training is required, amendment or modification will be issued to incorporate the changes.

1. OPSEC Awareness for Military Members, DoD Employees and Contractors IAW DoDM 5205.02, “DoD Operations Security (OPSEC) Program Manual,” dated October 29,2020 is currently available at:

https://securityawareness.usalearning.gov/opsec/index.htm

2. Unauthorized Disclosure of Classified Information and Controlled Unclassified Information IAW DoDI 5200.48, “Controlled Unclassified Information (CUI),” dated https://securityawareness.usalearning.gov/opsec/index.htm

March 6, 2020 is currently available at:

https://securityawareness.usalearning.gov/disclosure/index.html

3. Insider Threat Awareness IAW DoDD 5205.16, “The DoD Insider Threat Program,” dated August 28, 2017 is currently available at:

https://securityawareness.usalearning.gov/itawareness/index.htm

4. DoD Initial orientation and Awareness Training IAW DoDM 5200.01 Volume 3, Enclosure 5, is available at:

https://securityawareness.usalearning.gov/initialorientation/index.htm

5. Privacy Act and Personally Identifiable Information IAW DoDI 5400.11, “DoD Privacy and Civil Liberties Programs,” dated January 29, 2019 and the training is currently available at: https://securityawareness.usalearning.gov/piiv2/index.htm

6. IT Security Awareness IAW title 5, Code of Federal Regulations, section 930.301 and the training is currently available at: https://dl.dod.cyber.mil/wp-content/uploads/trn/online/cyber-awareness-challenge-2021/launchPage.htm

7. Counterintelligence Awareness and Reporting Training IAW DoD Directive 5240.06, “Counterintelligence Awareness and Reporting (CIAR),” dated July 21, 2017 and the training is currently available at:

https://securityawareness.usalearning.gov/cidod/index.html

8. Annual OSD Records and Information Management Training (J3OP-US1639) IAW Administrative Instruction 15, “OSD Records and Information Management Program,” dated November 17, 2020 and the training is currently available at:

https://jkodirect.jten.mil/

The Contractor program manager shall provide a copy of its employee(s)’ training certificate to the COR to meet the mandatory training requirements.

https://securityawareness.usalearning.gov/disclosure/index.html https://securityawareness.usalearning.gov/itawareness/index.htm https://securityawareness.usalearning.gov/initialorientation/index.htm https://securityawareness.usalearning.gov/piiv2/index.htm https://dl.dod.cyber.mil/wp-content/uploads/trn/online/cyber-awareness-challenge-2021/launchPage.htm https://dl.dod.cyber.mil/wp-content/uploads/trn/online/cyber-awareness-challenge-2021/launchPage.htm https://securityawareness.usalearning.gov/cidod/index.html https://jkodirect.jten.mil/