Questions and Answers.docx
DOCX document 19 KB Posted
- Attached to
- Virtual Machine (VM) Development for NATO Courses Federal contract opportunity
- Solicitation number
- N0024426QS006
About this file
This is a Questions and Answers document that clarifies technical and operational requirements for the Virtual Machine Development for NATO Courses solicitation (N0024426QS006). The document addresses 17 industry inquiries regarding system architecture, deployment, and operational expectations for hosting cybersecurity training environments.
Key technical specifications include: contractor-hosted, platform-agnostic virtualization with Ubuntu 24.04 LTS capability; data center location in Germany to minimize latency; concurrent capacity of up to 60 students per course iteration with six courses potentially running in parallel over ten-week periods. Authentication must support automated email-based mechanisms supplemented by initial local credentials. Network architecture requires isolated student environments with restricted east-west traffic by default, multiple subnets in certain courses, and instructor/administrator access to all student environments. Some courses require outbound access to ports 80 and 443. Operational requirements specify an 18-hour response time for non-critical, instruction-impacting issues; no environment changes during live instruction without pre-authorization; help desk SME availability by phone during European working hours (prioritized for first and last course weeks); and OVA exports no more than twice annually. At the conclusion of the Period of Performance, the contractor must deliver OVAs and configuration files for all courses. Three industry questions regarding past pain points, SaaS partnership benefits, and Ph.D.-level lead instructor roles were submitted without government responses in the document.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| Attachment 2 - OPPD.docx | DOCX document | |
| N00244-26-Q-S006 RFQ.pdf | ||
| Attachment 1 - Pricing.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions and Answers
1. Industry Question: What is the anticipated maximum number of concurrent students per course iteration?
Government Answer: 60
2. Industry Question: Are multiple courses expected to run concurrently, and if so, how many in parallel?
Government Answer: Yes. The courses run for ten (10) weeks, and it is possible to have six (6) courses running in parallel.
3. Industry Question: Will students require role-based environments (e.g., attacker, defender, instructor, administrator) at initial deployment?
Government Answer: This depends on the course, but at least one course requires attacker/defender roles. However, all courses will require at least student/instructor/administrator roles.
4. Industry Question: Is there a preferred hosting model (Government-hosted, contractor-hosted, or hybrid)?
Government Answer: Contractor-hosted
5. Industry Question: Are there any mandated virtualization platforms or hypervisors, or is the solution platform-agnostic?
Government Answer: Platform-agnostic. However, one instructor needs the virtualization platform to run a Ubuntu 24.04 LTS image in desktop mode.
6. Industry Question: Are there data residency or geographic hosting requirements tied to NATO regions?
Government Answer: The hosting data center should reside in Germany to minimize latency with the instruction site.
7. Industry Question: What authentication mechanisms are expected (CAC, federated identity, local credentials)?
Government Answer: An automated authentication mechanism tied to their email address is expected, as well as initial local credentials for the start of a course to get courses up and running until credentials can be confirmed (e.g. if an email was incorrect or access to email is unavailable).
8. Industry Question: Are there specific network segmentation or enclave requirements?
Government Answer: This will vary by course, but in general each student should have an isolated environment (i.e. east-west traffic should be restricted by default). Student environments should have multiple subnets in some courses. Instructors and administrators should have access to every student environment. It is common within each student environment to prevent student access to routers and certain databases/servers.
9. Industry Question: Are there any browser, port, or protocol restrictions we should account for?
Government Answer: Some courses may require outbound access to ports 80 and 443. The hosting contractor should work with the instructors to allow ports/protocols as necessary.
10. Industry Question: During live instruction, what response time is expected for non-critical but instruction-impacting issues?
Government Answer: 18 hours
11. Industry Question: Are there change freeze windows during in-residence training periods?
Government Answer: No changes to the environment should occur during the ten week course unless pre-authorized by the instructor.
12. Industry Question: What communication methods are preferred between instructors and technical Subject Matter Experts (SMEs) during courses?
Government Answer: A help desk SME is expected to be available by phone during European working hours during the first and last weeks of courses. During certain periods of the year, this is effectively every week for about two months.
13. Industry Question: What is the expected frequency and format for OVA exports?
Government Answer: This will vary per course, but will be no more than twice a year.
14. Industry Question: Are there defined requirements for environment transition or handoff at the end of the Period of Performance?
Government Answer: Contractor should be prepared to deliver OVAs and configuration files for all courses at the conclusion of the Period of Performance (POP).
15. Industry Question: What are some of the pain points from the past the team (i.e., NPS, NSO) has struggled with around Training?
Government Answer:
16. Industry Question: Is it beneficial to partner with an organization that has a Software as a Service (SaaS) offering for a multitude of cybersecurity courses with the virtual labs built in?
Government Answer:
17. Industry Question: Is there a need for a lead instructor role at the Ph.D. level to assist with topic area deep dives as necessary?
Government Answer:
File details come from the government source that posted it. Updated .