_RFI_PWS.pdf

PERFORMANCE WORK STATEMENT

1.0 BACKGROUND

The Navy Cyber Defense Operations Command (NCDOC) Cybersecurity Workforce Program Manager (CSWF-PM) and the N7 Training Department are responsible for administering, managing and facilitating the NCDOC Cybersecurity Workforce Qualification Program (CSWF-QP). The CWSF-QP is NCDOC’s development program designed to develop a highly skilled Department of the Navy Cybersecurity Workforce (CSWF) program. A common understanding of the cyber security concepts, principles and application for each Department of Defense (DOD) category, level and functions to enhance protection and availability of NCDOC information, information systems and networks. The CWSF-QP establishes baseline skills among personnel performing Cyberspace IT or Cybersecurity Workforce (Cyber IT/CSWF), Certification and Accreditation (C&A) and other Information Assurance (IA) related functions within the NCDOC domain.

The NCDOC requires that all NCDOC personnel meet or exceed the DOD Information Assurance Workforce (IAWF) requirements outlined in the DoD 8140.01m. All commercial certification under the DoD 8140.01M require attaining and reporting Continuing Professional Education (CPE) credits; this is accomplished by attending a minimum of 20 hours of CPEs annually in the Cyber field according to the mandate of the SECNAV M-5239.2.

The Cyber Network Defense (CND) is defined as the actions taken to protect, monitor, analyze, detect and respond to unauthorized activity within DOD information systems and computer networks. Under the DOD 8140.01m, there are five CND Incident Responder certifications, the Global Information Assurance Certification (GIAC) Systems and Network Auditor (GSNA), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Forensic Examiner (GCFE), and Certified Ethical Hacker (CEH). The GSNA, the GCIH, the GCIA and certification courses are to be offered and available through a training account for on-line and classroom training. In addition, the GCFA, GIAC Certified Enterprise Defender (GCED) and GCFE are the additional certifications with preparation courses to be offered that also qualify personnel as Incident Handlers to receive, operate, and maintain the NCDOC’s digital forensics kits for obtaining evidence-quality digital forensics images in the field.

2.0 OBJECTIVE

The objective of this requirement is to provide high quality training services in support of NCDOC’s CND CLP program that will maintain personnel CND proficiency, and provide the necessary technical CPEs for advanced certification maintenance.

3.0 SCOPE

As a part of the Cyber Workplace Improvement Program CWIP and CND CLP requirements, the courses required are a vital component to the program curriculum as it hones significant IA &CND competency skills and qualifies personnel as effective members of the NCDOC CND-SP Team. The training program should provide the adult training mode and scheduling flexibility best suited to the adult training needs of the participating personnel, with course work to be taken online with instructor, online on-demand, or in a standard classroom setting when travel can be accommodated by the command. As learning is an essential attribute of high-performing individuals and organizations, it is therefore, a critical concept in performance excellence. The course curriculum should all be ANSI and DoD 8140.01m certified courses and built on the Office of Personnel Management (OPM)’s National Initiative for Cybersecurity Education (NICE) Cyber Core Competencies (CCCs): (1) Computer Network Defense, (2 Technology Awareness, (3) Vulnerabilities Assessment, (4) Infrastructure Design, (5) Information Assurance, and (6) Information Systems/Network Security.

4.0 DEFINITIONS

ANSI – American National Standards Institute CCC- Cyber Core Competency CND – Cyber Network Defense CPE – Continuing Professional Education Credit GIG – Global Information Grid ISSM – Information Systems Security Manager CSWFPM – Cybersecurity Workforce Program Manager CWIP - Cyber Workforce Improvement Program NCDOC – Navy Cyber Defense Operations Command NICE – National Initiative on Cyber Education

5.0 SPECIFIC PERFORMANCE REQUIREMENTS AND TASKS

5.1 – Training Account. The training Account for NCDOC should be continuously updated to reflect the training funds invested and be managed by the NCDOC N7 Training Department.

5.1.1 Program Core Curriculum

Core Curriculum should at the minimum consist of the following courses of interest:

A. DoD 8140.01m Advanced CND ISSM Certification Courses

a. SEC 504 Hacking Techniques and Incident Handling to obtain a GCIH

b. SEC 503 Intrusion Detection In-Depth to obtain a GCIA certification

Additional courses shall be available as validated via the N7 Training Department based on individual requirement and the operational necessity.

6.0 DELIVERABLES

1) Training Account

a) The Contractor shall provide on-line secure account registrations for NCDOC Training Department to access and request class vouchers from the training account.

b) The Contractor shall inform NCDOC Training Department of courses available and any changes or updates to the curriculums of courses available.

c) The Contractor shall provide the courses to approved participants in the training modality selected: Online Virtual Classroom, Online On-Demand, or traditional scheduled classroom at a conference setting.

2) Command and Control – The contractor shall provide an automated means for controlling courses offered, and limiting the approval of course vouchers requested by NCDOC to the designated Training Department person and his/her designated Alternate.

3) The Contractor shall inform the Training Department of Courses Requested, Completed, and Exam Status.

7.0 TRAVEL

There will be no travel requirements for this PWS.

8.0 SECURITY

Performance of this task is UNCLASSIFIED. An interaction with the training account is limited to accessing a secure commercial website through a User account based on the NCDOC Training Department e-mail account.