DRAFT PWS.docx

Performance Based Statement of Work Virtual Environment for Teaching NATO Classes Energy Academic Group Naval Postgraduate School

1.0 Background/Introduction:

The Naval Postgraduate School’s (NPS) collaboration with the Academics Directorate (ACAD) of the NATO School Oberammergau (NSO) focuses on delivering advanced Cyber Security education and training to NATO personnel. NPS teaches multiple Cyber Security courses for NATO, combining academic rigor with operational relevance. Currently, the theoretical components of each course are supported by laboratory exercises designed to reinforce and apply the concepts taught in class. However, as agreed upon by faculty, NATO staff, and students, the existing laboratory exercises are inefficient and insufficient in providing a robust and interactive learning environment. The current infrastructure limits students’ ability to use analytical skills to assess diverse cyber scenarios and engage in hands-on problem solving.

To address these challenges, the program seeks the services of a qualified contractor to design and deploy a hands-on training environment supported by virtual machines (VMs). These VMs will host customized training modules for the following cyber security courses—Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, Machine Learning & Artificial Intelligence (ML&AI) for Cyber Applications, and Introduction to Machine Learning & Artificial Intelligence. This capability will provide NATO students with a solid understanding of the fundamentals of cyber security and how these concepts apply to real-world Department of Defense (DoD) and NATO mission challenges.

2.0 Scope:

The contractor’s service is needed for course content compilation and customization, based on existing teaching material by building virtual machines, one for each student and faculty member. Access to the VM will be completely browser based for both students and instructors, focusing on the workflows that instructors and students need with an option to gather metrics to allow faculty to determine the progress of the students as they learn the material. The contractor will also deliver instructional guides for the following courses taught at the NATO School Oberammergau (NSO) in Oberammergau, Germany: Network Security, Cyber Security Incident Response and Recovery (CSIRR), Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for Cyber Applications, and Introduction to ML & AI.

3.0 Tasks:

The contractor shall perform the following task(s) as follows:

3.1 Develop a VM environment that can be replicated and remotely accessed for instruction in the Network Traffic Analysis NATO course based on the requirements set by NPS. At a minimum the VM should integrate the following software tools: Elastic stack with netflow module, Elastiflow, mininet, Wireshark SiLK netflow, Splunk, ChefSpecial and Argus. This VM needs to be made available to students at the time the class is offered.

3.2 Develop a VM environment that can be replicated and remotely accessed for instruction in the Software Reverse Engineering NATO course based on the requirements set by NPS. At a minimum the VM should integrate the following software tools: Ghidra, commercial IDA Pro, and DRAKVUF sandbox. This VM needs to be made available to students at the time the class is offered.

3.3 Develop a VM environment as well as laboratory exercises that can be replicated and remotely accessed for instruction in the Mobile Applications NATO course based on the requirements set by NPS. Remote access to MacOS and Linux environments should be accommodated with a minimum of the following software tools supported: Xcode, MobSF, docker, Android SDK, Android Studio, apktool, dex2jar, and drozer. This VM environment needs to be made available to students at the time the class is offered.

3.4 Deploy instructional and student guides for Network, Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for Cyber Applications, and Introduction to ML & AI courses taught at the NATO School Oberammergau (NSO).

3.5 Export all VMs associated with the exercises in OVA format, to allow the government to instantiate the lab environment on different virtualization platforms, if necessary, to support the associated classes.

3.6 Provide qualified subject matter experts (SME) in the areas of Network Security, CSIRR, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for cyber applications, and Introduction to ML & AI, to provide live technical support and troubleshooting during in-class resident weeks. 18 in-class resident weeks occur each year.

3.7 Provide eight-hour email SME response in support of the VM infrastructure during non-in-class weeks.

3.8 Make the VM environments available for students taking the Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for Cyber Applications, and Introduction to ML & AI courses. This will include any update or revisions of the course material that will be needed following student or faculty feedback. The Contractor shall also develop laboratory exercises along with instructor guides and deploy the VM environment for students taking the Artificial Intelligence courses (Fundamentals to Artificial Intelligence, Machine Learning, and Machine Reasoning).

3.9 The Contractor shall maintain and update all laboratory environments and associated instructional materials developed under this contract to ensure they remain compatible with current course requirements, software versions, and NATO School instructional needs. Updates shall incorporate faculty and student feedback and shall be completed prior to the start of each course cycle.

3.10 The Contractor shall also provide the option to deploy qualified subject matter experts (SMEs) to travel and instruct in-person, if required by NPS or the NATO School, to ensure effective course delivery and technical support.

4.0 Deliverables:

The contractor shall be responsible for providing the following deliverables:

4.1 An environment and set of exercise material tailored to the course outline based on feedback and review of NPS faculty ready for deployment to NATO school students during scheduled classes.

4.2 Instructional and student guides for Network vulnerability, Big Data Analytics, CSIRR, Traffic Analysis, Reverse Engineering, and Mobile Apps courses taught for the NATO school.

4.3 Export of VMs associated with all NATO courses developed by the contractor in OVA format for archiving purposes.

4.4 Delivery of each of the following:

4.4.1 A virtual machine for each student in the class, plus one for each course instructor for demonstration purposes.

4.4.2 Delivery of a web-based user interface to allow each of the students to access their copy of the virtual environment.

4.4.3 Delivery of a web-based user interface to allow the instructor to access every copy of the virtual environment associated with the class.

4.5 Updated and validated laboratory environments for all NATO courses covered under this PWS, reflecting software, exercise, and instructional revisions made following each course cycle. Documentation of updates and version control shall be delivered to NPS along with confirmation of operational functionality.

4.6 Services of Subject Matter Experts (SMEs) to provide live technical support during in-class resident weeks, as well as technical support during non-in-class weeks.

4.7 The Contractor shall include, as a deliverable option, the provision of on-site instruction or technical support during NATO School classes if requested by NPS.

Performance Measurement - Quality Assurance Plan

3.1

3.2

4.1: Environment and VM structure to teach the Reverse Engineering class

VM environment needs to support a total of 40 students, it needs to be available 96% of the time and the material needs to be directly relevant to the course content

NPS will test the VM environment three weeks prior to the beginning of each class to ensure that it aligns with the course content and objectives

Continuously throughout the period of performance

VM environment needs to support a total of 40 students, it needs to be available 96% of the time and the material needs to be directly relevant to the course content

NPS will test the VM environment three weeks prior to the beginning of each class to ensure that it aligns with the course content and objectives

Continuously throughout the period of performance

There shall be 24-hour coverage support provided by SME(s) to troubleshoot any issues within the infrastructure during in-residence class weeks, because students will be working from different countries across the globe. 18 in-residence class weeks occur each year.

All VM environments must be completely browser-based

NPS will test the updated VM environment two weeks prior to the beginning of each class to ensure that it aligns with the course content and objectives

Continuously through the period of performance

Continuously throughout the period of performance, with updates and confirmation of operational functionality completed prior to each course cycle and following any major software or course content changes.

If performance falls below the AQL defined above, the Contracting Officer’s Representative (COR) shall document the instance(s), coordinate with the Contracting Officer and advise the Contractor. The Contractor will be requested to review the documentation and provide a written response on how performance will be corrected in the future. Re-performance of any work for failure to perform in accordance with the specified AQL or task requirement shall be completed at the Contractor’s own expense and at no additional cost to the Government.

5.0 Other Requirements for the Virtual Machines (VMs):

· The ability for instructors and students to access the exercise environment on Windows, macOS, or Linux entirely through a modern version of a common web-browser (Chrome, Firefox, Safari, or Edge).

· The VM needs to be completely browser based and shall not require students or faculty to download any software to their machines since some of the machines will be government-owned machines.

· VM environment deployment for a given class should provide minimum latency relative to the locus of class participants (Europe, Middle East, Far East Asia) with a measured response time of no greater than 90ms.

· The ability for the instructor and student to interact within a single VM in an environment simultaneously (allowing the instructor to see what the student is doing, and to allow the instructor to take control to guide the student through some portion of an exercise).

· The ability for the instructor (through the web-based UI) to push files onto some or all of the VMs in the student environments, or to pull files from some or all of the VMs in the student environments

· The ability for the instructor (through the web-based UI) to run commands and/or make configuration changes on some or all of the VMs in the student environments.

· The ability to collect performance metrics (such as time on task, and task completion rates), and to compile and present this data to aid in formative and summative assessments of individuals and classes as well as contributing to the refinement of course materials and environment

6.0 Minimum Technical Requirements:

6.1 Contractor shall have extensive experience in developing VMs across the security and data analysis domains within DoD.

6.2 VM environment developers must be SMEs in the following software tools: Ghidra, commercial IDA Pro, DRAKVUF sandbox, Elastic stack with netflow module, Elastiflow, mininet, Wireshark SiLK netflow, Splunk, ChefSpecial, Argus, Xcode, MobSF, docker, Android SDK, Android Studio, apktool, dex2jar, and drozer.

6.3 Experience in developing virtual lab environments for classroom use that allows students to have hands-on-experience and training using HOTzone platform.

6.4 SME in the ability to configure and deploy a large number of VMs in data centers in Europe, the Middle East and Far east Asia which require extremely redundant and reliable power, cooling, and networking.

6.5 Due to the sensitive nature of working with NATO and coalition partners, all SMEs and supporting contractors must be US citizens.

7.0 Period of Performance:

Base period: March 7, 2026 - March 6, 2027 Option 1: March 7, 2027 - March 6, 2028 Option 2: March 7, 2028 - March 6, 2029 Option 3: March 7, 2029 - March 6, 2030 Option 4: March 7, 2030 – March 6, 2031

8.0 Place of Performance:

This work will be completed at the Contractor’s site. There is no need for this work to be performed at NPS. Travel to the NATO School Oberammergau (NSO) may occur once per year, if necessary (See Section 10.0: “Travel” below).

9.0 Work Week and Hours of Operation:

The Contractor shall provide services during normal working hours excluding federal holidays. Normal working hours are 0730-1630, Monday through Friday, unless requirements dictate otherwise. Exceptions can be permitted by the COR upon request and at the COR’s discretion.

Following is a list of holidays observed by the Government.

If any of the above holidays occur on a Saturday or a Sunday, then such holiday shall be observed by the Contractor in accordance with the practice as observed by the assigned Government employees at the using activity.

10.0 Travel:

Travel will be in accordance with the Joint Travel Regulations (JTR) and will be reimbursed by the government on an as-incurred basis.

To: NSO, in Oberammergau, Germany 1 trip per year

11.0 Human Subject Research:

Contractor personnel performing work under this contract may not support, advise, or conduct research involving human subjects. If at any time during the period of performance of this contract the tasks involve human subject research, the Contractor shall immediately notify the Contracting Officer. The contract must be amended in accordance with DoDD 3216.02 and DFARS 252.235-7004 in the event human subject research is proposed.

12.0 Privacy Act Statement:

“Pursuant to Title 5 United States Code 552a(m)(l), the contractor and all employees of the contractor working under this contract are required to comply with the requirements of 5 U.S.C. 552a (“The Privacy Act of 1974”).”

13.0 Identification of Contractor Employees:

In accordance with DFARS 211.106, there shall be a clear distinction between Government employees and service contractor employees. Service contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel. Contractor personnel will be required to obtain and wear badges or other visible identification for meetings with Government personnel to provide a clear distinction between service contractor employees and Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

14.0 Non-Personal Services Statement:

Contractor employees performing services under this order will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management will insure that employees properly comply with the performance work standards outlined in the SOW. Contractor employees will perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The tasks, duties, and responsibilities set forth in the task order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.