Revised Performance Work Statement.pdf

AMENDMENT 0002 to N0018926QD213

ATTACHMENT 1: REVISED PERFORMANCE WORK STATEMENT

Commercial Cybersecurity Training and Certification Platform

This revised Performance Work Statement incorporates the Government responses in the Cyber Platform RFQ Questions and Responses document. It supersedes inconsistent language in the original PWS.

1. TITLE.

2. OBJECTIVE.

The purpose of this requirement is to procure a commercial off-the-shelf (COTS), web-based cybersecurity training and certification platform to support the educational, cyber workforce development, and operational readiness mission of the National Defense University (NDU), College of Information and Cyberspace (CIC). The Government seeks a commercially available Software-as-a-Service (SaaS) cybersecurity training platform that provides immersive, hands-on cyber learning, realistic cyber laboratory environments, structured learning pathways, cyber range exercises, and cybersecurity certification preparation capabilities that enhance cyber workforce readiness, operational problem-solving, critical thinking, and cyber mission effectiveness. The platform shall support JPME, cyber upskilling, and cyber readiness activities for authorized faculty, staff, and students through Internet-based access to interactive cybersecurity exercises, practical laboratories, and modular cybersecurity training content.

3. BACKGROUND.

The College of Information and Cyberspace prepares military and civilian leaders to operate effectively within the information environment and cyberspace domain through rigorous academic instruction, research, and practical application of information technology and cybersecurity principles. NDU requires a scalable, commercially available, web-based cybersecurity training platform capable of delivering practical, hands-on cyber exercises aligned with modern cybersecurity operations and workforce development frameworks. The platform shall support individual and team-based learning while enabling users to build technical proficiency through realistic cyber ranges, guided learning paths, attack-and-defense scenarios, and structured cybersecurity modules.

The platform will support students enrolled in CIC educational programs, including JPME, Leadership Development Programs, graduate certificate programs, Master of Science degree programs, and distance learning programs. These programs educate senior military officers, DoD civilians, federal government personnel, and other national security professionals in cybersecurity, cyber leadership, cyber strategy, information technology management, information security, risk management, data analytics, emerging technologies, and cyberspace operations.

Commercial cybersecurity training platform providers offer COTS SaaS cybersecurity training environments that deliver immersive cyber learning experiences through browser-based laboratories, gamified learning, and enterprise-grade cyber simulation environments. These platforms support structured cyber learning and operational readiness through cybersecurity pathways focused on penetration testing, defensive security, digital forensics, incident response, malware analysis, web exploitation, Active Directory exploitation, reverse engineering, and related cybersecurity disciplines.

3.1. SALIENT CHARACTERISTICS

To be considered, the platform shall provide, at a minimum:

(1) A contractor-hosted, browser-accessible SaaS platform that does not require Government-hosted infrastructure or integration with NDU operational networks.

(2) A twelve (12) month subscription providing a pool of twenty (20) simultaneously available seats for authorized Government users, with unrestricted reassignment among an estimated student body pool of up to fifty-five (55) individuals. The maximum expected concurrent active users is twenty (20).

(3) Hands-on cybersecurity laboratories, realistic cyber range exercises, structured learning pathways, modular content, and scenario-based cyber problem-solving exercises.

(4) Training capabilities covering the cybersecurity disciplines identified in Section 5.b., including offensive and defensive operations, penetration testing, digital forensics, incident response, malware analysis, web exploitation, Active Directory environments, reverse engineering, and related disciplines.

(5) Individual and team-based learning activities and browser-based laboratory environments.

(6) A continuously available, administrator-accessible dashboard providing visibility into user access, activity, usage, progress, completion, and skill-development indicators. Session start time with a last-activity timestamp and computed session duration is acceptable. Dashboard data shall refresh and be available within five (5) minutes of a user activity event. Native reporting supplemented by CSV or XLSX export is acceptable when the presentation is visually and logically intuitive.

(7) Cybersecurity certification preparation and certification assessment opportunities as required by Section 5.c. The requirement is focused on basic cybersecurity knowledge and skills, certificates, and assessments available through the platform; it is not intended to directly satisfy DoD 8140 cyber workforce qualification requirements.

(8) Contractor-provided hosting, maintenance, updates, technical support, administrative support, onboarding assistance, and requested orientation sessions throughout the applicable period of performance.

4. SCOPE.

The contractor shall provide a commercial web-based cybersecurity training and certification platform subscription service, including all licensing, hosting, maintenance, technical support, administrative support, onboarding, and related services necessary to support the NDU-CIC cyber education and workforce development mission.

The cyber platform shall be contractor-hosted and accessible through commercially available web browsers utilizing an Internet-based SaaS delivery model without requiring Government-hosted infrastructure, Government-managed virtualization environments, or integration into NDU operational networks.

The contractor shall furnish all personnel, software subscriptions, licensing, hosting infrastructure, maintenance, updates, technical support, and related commercial services necessary to meet the requirements of this PWS.

The Contractor shall meet or exceed every salient characteristic and mandatory performance requirement stated in this PWS.

5. PERFORMANCE REQUIREMENTS.

The contractor shall provide:

a. Platform Access and Licensing.

(1) Provide a web-based cybersecurity training and certification platform subscription service consisting of a pool of twenty (20) seats. The twenty (20) seats may be assigned to, unassigned from, and reassigned among authorized Government users as students rotate through CIC courses and programs.

(2) Provide access to the platform for a twelve (12) month subscription period. The subscription shall include a pool of twenty (20) seats available for reassignment among authorized Government users throughout that period.

(3) Provide individual user accounts with user management and administrative capabilities.

(4) Provide Internet-accessible SaaS platform availability through current supported versions of Chromium-based browsers, Mozilla Firefox, and Apple Safari. The platform shall operate through standard HTTPS web access and shall not require browser plugins, locally installed agents, or administrative privileges beyond settings approved for Government endpoints.

(5) Provide access to cybersecurity learning modules, cyber laboratories, cyber ranges, and gamified cybersecurity exercises.

(6) The Government requires a pool of twenty (20) seats, not twenty (20) permanently named users. The anticipated student body pool is approximately fifty-five (55) individuals. The Government does not know how many of those individuals will use the platform or how many rotations will occur. Concurrent active users are expected to be no more than twenty (20).

(7) The Government requires a pooled, reassignable seat model consisting of twenty (20) seats. The seats shall be available for unrestricted reassignment among authorized Government users as student populations and course requirements change. The platform shall provide the capability to identify active use and swap active users as an inherent subscription feature. The subscription shall not limit the total number of authorized users or rotations during the subscription period.

(8) The twenty (20) seats shall be fully transferable and reassignable among authorized Government users throughout the period of performance. The contractor shall permit an unlimited number of reassignments, transfers, account substitutions, and user swaps at no additional charge and without approval, waiting periods, reassignment caps, or other administrative barriers. The Government shall be able to manage reassignment through the contractor administrative portal or, if contractor assistance is required, the contractor shall complete each reassignment request within one (1) business day.

b. Cybersecurity Training Capabilities.

The platform shall support foundational, intermediate, and advanced cybersecurity skill development for students with varying levels of technical experience. Training content shall include networking fundamentals, operating systems, vulnerability identification and assessment, cyber defense, cybersecurity operations, and related technical disciplines. The platform shall provide hands-on learning opportunities involving network mapping, network fingerprinting, vulnerability discovery, Windows and Linux operating systems, network defense concepts, and practical cybersecurity exercises designed to build technical proficiency across multiple skill levels.

(1) Hands-on cybersecurity laboratories and realistic cyber range exercises.

(2) Structured cybersecurity learning pathways and modular training content.

(3) Interactive cybersecurity exercises supporting offensive and defensive cyber operations training.

(4) Scenario-based cyber problem-solving activities.

(5) Training environments supporting penetration testing, defensive security operations, digital forensics, malware analysis, web exploitation, Active Directory exploitation, reverse engineering, and related cybersecurity disciplines.

(6) Browser-based laboratory environments accessible without requiring Government-hosted virtualization infrastructure.

(7) Training content aligned with recognized cybersecurity frameworks and modern cyber operational practices.

(8) Continuously updated cybersecurity training content reflecting current vulnerabilities, threats, cyber techniques, and cybersecurity trends.

(9) A continuously available usage and learning analytics dashboard for authorized instructors and administrators. The dashboard shall provide, at a minimum, current user presence or active-session status;

session start time, last activity, and computed session duration; courses, learning paths, laboratories, challenges, and modules accessed; attempts, completions, scores, and performance results; progress and completion status; and individual, course, cohort, and group-level skill-development indicators. Dashboard data shall be refreshed and available within five (5) minutes of a user activity event. Native platform reporting supplemented by CSV or XLSX export satisfies the requirement when visually and logically intuitive. The dashboard shall support filtering by user, course, cohort, date, learning path, and activity type, and shall be available twenty-four (24) hours per day, seven (7) days per week, except for approved scheduled maintenance and temporary outages. The dashboard shall provide on-demand export in CSV or XLSX format without additional charge.

(10) The ability to support both individual and team-based cybersecurity learning activities.

c. Certifications and Learning Support.

(1) The contractor shall procure and provide the certification preparation content and associated exam vouchers included in the quotation. The Government is requesting the native certification pathways currently available within the vendor's existing commercial offering; the Government is not furnishing curriculum or content for integration.

(2) Provide access to cybersecurity certification preparation content, certificates, and assessment opportunities available within the platform. The primary purpose is to help users develop basic cybersecurity knowledge and skills; the requirement is not intended to directly support DoD 8140 cyber workforce qualification or to require specific DoD 8140 work roles, qualification areas, proficiency levels, or legacy DoD 8570 certifications.

(3) Provide integrated learning pathways supporting cybersecurity workforce development and technical skill progression.

(4) For contractor-issued certifications or assessments, provide unlimited vouchers and assessment attempts for each unique authorized Government user provisioned during the applicable twelve-month subscription period, without an overall limit on the number of unique users who may receive that benefit.

The benefit is not limited to the twenty concurrent seats collectively.

(5) For third-party certification examinations, the quoter shall identify the certification, preparation pathway, voucher or attempt quantity, expiration date, retake rules, scheduling requirements, and all third-party testing or proctoring fees in the quotation. Any limitation or difference from the PWS shall be identified as an exception in the Crosswalk for Quote and may be evaluated as noncompliance.

(6) Provide onboarding guidance, administrative support, and implementation assistance necessary to support platform adoption and user access.

d. Technical Support and Maintenance.

(1) Provide platform maintenance, software updates, and technical support throughout the period of performance.

(2) Provide customer support through a web-based support portal and email during 0800-1700 Eastern Time, Monday through Friday, excluding Federal holidays. The contractor shall provide a 24-hour escalation method for Severity 1 incidents affecting all or substantially all Government users or the platform dashboard.

(3) Maintain platform availability and operational functionality throughout the subscription period. The contractor shall maintain a monthly service availability of at least 99.5 percent, excluding approved scheduled maintenance. Scheduled maintenance shall be announced at least seventy-two (72) hours in advance. The availability requirement includes the Government administrator usage and learning analytics dashboard.

(4) Support severity levels and service targets shall be: Severity 1 - platform unavailable, dashboard unavailable to all or substantially all Government users, or suspected compromise affecting Government Data: acknowledge within one (1) hour, provide updates at least every four (4) hours, and restore service or provide a workaround within four (4) hours when technically feasible; Severity 2 - major function unavailable or materially degraded: acknowledge within four (4) business hours and provide daily updates until resolved;

Severity 3 - individual user issue or general support request: acknowledge within one (1) business day.

(5) Commercial service-level agreements may be submitted with the quotation. Any difference between a published SLA and the PWS targets shall be identified as an exception in the Crosswalk for Quote and may be evaluated as noncompliance.

e. Training and Administrative Support.

(1) Provide one (1) initial administrative orientation and/or train-the-trainer onboarding session within ten

(10) business days after award. The session shall last at least one (1) hour and is expected to support approximately five (5) attendees. Provide one (1) additional session during the option period if requested by the Government. The cost of all required sessions and onboarding support shall be included in the applicable firm fixed subscription price.

(2) Provide user documentation, online help resources, knowledge base access, and administrative support materials associated with the platform. Documentation shall explain dashboard metrics, activity definitions, skill-level indicators, data-refresh behavior, filtering, and report/export functions.

(3) Provide authorized Government administrators and instructors with dashboard access credentials and role-based permissions at service activation and throughout the period of performance.

(4) Identify the activity rules used to calculate session duration, active time, last activity, progress, completion, and skill-level indicators. Session start time with a last-activity timestamp and computed session duration is acceptable.

(5) Provide export capability for the Government to download usage, participation, progress, completion, performance, and skill-development data in a commonly used machine-readable format, such as CSV or XLSX, without additional charge.

(6) Do not restrict dashboard access, impose a separate reporting fee, or require a contractor-generated service request for the Government to view current user and service-usage information required by this

PWS.

6. SECURITY REQUIREMENTS.

A FedRAMP authorization at any impact level is not required during performance. A current SOC 2 Type II report is sufficient in the absence of FedRAMP authorization. No information categorization or impact level is required for platform processing under this requirement. An Authority to Operate, DoD Cloud Computing SRG alignment, or NDU-specific security review is not a condition of award or platform activation.

The contractor shall maintain a documented information-security program appropriate to the hosted SaaS environment and the type of information processed. At a minimum, the contractor shall maintain and describe administrative multi-factor authentication; encryption of Government Data in transit and at rest; role-based access control; vulnerability and patch management; logging and monitoring; backup and recovery; personnel access controls; and security controls applicable to subcontractors, cloud providers, and other service providers.

The contractor shall disclose all subcontractors, cloud providers, hosting locations, and other third parties that may access Government Data or provide material services supporting the platform. The contractor shall maintain equivalent security and data-protection obligations for those entities and shall notify the Government before any material change to the hosting arrangement, security controls, privacy policy, or subcontractor structure that could affect Government Data.

7. GOVERNMENT DATA AND PRIVACY REQUIREMENTS.

Government Data means information provided by or on behalf of the Government or created by authorized Government users in connection with the subscription, including account and contact information, user identifiers, login and activity records, usage data, progress and completion records, performance metrics, dashboard data, reports, course assignments, user-created notes or submissions, and other Government-generated content. Government Data does not include the contractor's pre-existing platform, software, proprietary courseware, or tools.

The Government retains all rights, title, and interest in Government Data. The contractor may access and use Government Data only as necessary to provide, secure, maintain, and support the contracted service. The contractor shall not sell, advertise against, disclose, commercialize, or use Government Data to train a commercial artificial-intelligence model, develop unrelated products, or for any other unrelated purpose without the Government's prior written authorization.

The Government will accept the platform publisher standard commercial terms of service or end user license agreement as an attachment to the quotation. Any conflict between those terms and Section 7 shall be identified by the quoter as an exception in the Crosswalk for Quote. The Government may accept a commercial difference when the applicable standard term provides protection equal to or greater than the corresponding PWS requirement; otherwise, the difference may be evaluated as noncompliance.

The contractor shall provide on-demand access to and export of Government Data in a commonly used, machine-readable format, including CSV or XLSX for usage, progress, completion, performance, and dashboard data. At expiration or termination, the contractor shall return or make available all Government Data designated by the Government within thirty (30) calendar days. Within sixty (60) calendar days after return or availability, the contractor shall securely delete Government Data from active systems, except data required to be retained by law, and provide a written deletion certification. Backup data shall be deleted according to the documented backup-retention cycle and protected from access or use during that cycle.

The contractor shall not disclose Government Data to subcontractors, cloud providers, or other third parties except as necessary to perform the service and only under written obligations consistent with this PWS. The contractor remains responsible for the acts and omissions of those entities concerning Government Data.

7.1. SECURITY INCIDENT NOTIFICATION.

The contractor shall notify the Contracting Officer and the Government technical point of contact within twenty-four (24) hours after discovering a security incident that may affect Government Data, Government user accounts, platform availability, or the confidentiality, integrity, or availability of the service. The initial notification may be preliminary but shall include the known facts, systems or data affected or potentially affected, time discovered, containment actions, and contractor point of contact. The contractor shall cooperate with Government inquiries; preserve relevant logs, records, and evidence; support credential resets, containment, investigation, and recovery; provide status updates at least every twenty-four (24) hours during active response;

and submit a written incident report and corrective-action plan within ten (10) business days after containment or another period approved by the Contracting Officer. The contractor shall not notify affected individuals, the media, or other third parties on behalf of the Government without the Government's prior written authorization, except as required by law, and shall promptly notify the Government of any legally required disclosure.

8. DELIVERABLES.

Deliverable Description Due Date

Platform Access Activation of subscription accounts for authorized users Within 10 business days after award

User Accounts Provisioning and administration of a pool of twenty (20) reassignable seats supporting an estimated user pool of fifty-five (55) individuals and no more than twenty (20) concurrent active users

Within 10 business days after award

Technical Support Ongoing technical support and maintenance Throughout the period of performance

Platform Updates Software updates and maintenance releases Throughout the period of performance

Administrative Support

Initial administrator orientation/train-the-trainer onboarding session within 10 business days after award; one option-period session if requested; user documentation and onboarding support

Initial session: within 10 business days after award; option-period session: as requested by the Government

Administrator dashboard access, role-based permissions, dashboard documentation, real-time usage and learning analytics, and machine-readable export capability shall be available at activation and throughout the period of performance.

9. PERIOD OF PERFORMANCE.

The period of performance shall consist of one (1) twelve-month base period and one (1) twelve-month option period. Quoters shall price a full twelve-month subscription for each CLIN 0001 and Option Line Item 0002. All requirements of this PWS apply in full to the option period.

10. PLACE OF PERFORMANCE.

Government users shall access the platform remotely through Internet connectivity from authorized Government or approved remote locations.

11. GOVERNMENT FURNISHED PROPERTY/INFORMATION.

None.

12. CONTRACTOR FURNISHED ITEMS.

The contractor shall furnish all items, services, access, licensing, hosting, support, documentation, vouchers, assessment attempts, and other resources required by this PWS. No separate line item may be added to Section B for these costs.

13. ACCEPTANCE CRITERIA.

The Government shall conduct an acceptance test within five (5) business days after delivery or activation and before acceptance of the subscription. Both the following acceptance-test criteria and the additional operational criteria apply:

(1) Activation of the pool of twenty (20) seats and administrator access.

(2) Unlimited seat reassignment among authorized Government users without additional charge or administrative barrier.

(3) Access to representative foundational, intermediate, and advanced training paths.

(4) Availability and operation of representative laboratories, cyber ranges, scenario-based exercises, and individual and team functionality.

(5) Dashboard visibility into current users, active sessions, session start, last activity, computed session duration, activity, progress, completion, performance, and skill-development indicators.

(6) Dashboard baseline refresh behavior, filtering, and on-demand CSV or XLSX data export. The five-minute refresh requirement is a mandatory performance requirement.

(7) Submission of a support ticket through the required support channel and receipt of the required acknowledgement.

(8) Availability of the required cybersecurity certification preparation, certificates, and assessment benefits for authorized users as specified in Section 5.c.

(9) Delivery of administrator documentation, security documentation, support contacts, and required onboarding materials.

(10) Compliance with the stated browser, endpoint, accessibility, and network requirements.

Additional operational acceptance criteria:

(1) Authorized users are able to successfully access the platform.

(2) Required cybersecurity training modules and laboratory environments are available and operational.

(3) User management and the usage and learning analytics dashboard function as required, including current user visibility, session and activity information, progress, completion, performance, skill-level indicators, filtering, and data updates without material delay.

(4) Technical support, availability, escalation, and restoration services meet the mandatory requirements of Section 5.d.

(5) Deliverables are completed within required timelines.

The Government may reject incomplete, unavailable, or nonconforming activation or deliverables. The contractor shall correct rejected items at no additional cost within the period specified by the Contracting Officer.

Acceptance does not waive the Government right to require correction of latent defects or nonconforming services discovered during the period of performance.

14. POINTS OF CONTACT.

Role Name Organization / Contact

Project Manager (Department Chair)

Captain Victor Lima NDU College of Information and Cyberspace | victor.a.lima.mil@ndu.edu | 202-685-4010

Contracting Officer Technical Representative

Donna Powers NDU College of Information and Cyberspace | PowersD3@ndu.edu | 202-685-2070

Resource Manager Gabriela Armstrong- Santos

NDU College of Information and Cyberspace | gabriela.armstrongs.civ@ndu.edu | 202-685-3757