PWS_CY3200_Labs_FINAL.docx

Performance Based Statement of Work CY3200 Laboratory Exercises Cyber Academic Group, GSOIS Naval Postgraduate School

1.0 Background/Introduction: The Cyber Academic Group (CAG) is intended to be a national resource for the interdisciplinary study and design of secure and resilient cyber systems and the conduct of cyber operations. Its breadth covers all areas of cyber operation, including the incorporation of cyber effects into operational plans and offensive and defensive cyber operations. The CAG’s program is transformative, being interdisciplinary with both technical foundations and non-technical challenges. The nature of the cyber environment, its opportunities and vulnerabilities, and the broad range of potential threats demands a comprehensive, multidisciplinary approach to cyber operations education and research. The Cyber Academic Group’s composition reflects this diversity and includes participating faculty from departments including Computer Science, Defense Analysis, Electrical and Computer Engineering, Information Sciences, Mathematics, and Operations Research.

2.0 Scope: The CAG requires a contractor to develop comprehensive laboratory exercises in support of the course, CY3200 (Cyber Operations Fundamentals). This course explores the fundamentals of cyberspace operations. The broad goals of the course are to cover the three main domains of cyber – science and technology, computation and data analytics, and strategy, policy and ethics. Conceptually cyberspace operations are the employment of cyber capabilities to achieve objectives in, or, through cyberspace. Nation state militaries, agencies or proxies use these operations as a component of conflict or warfare for political utility or competitive advantage. This course analyzes the offensive and defensive dimensions of cyberspace operations based on actual campaigns and incidents. It examines network architectures, technical methods, and emerging innovations for the conduct of cyberspace operations. The course debates policy and legal precedents to counter malicious actors operating in the domain. The hands-on lab exercises provide students with opportunities to employ cyber tools and techniques used by actors and to engage in war game decisions. The course concludes by proposing novel strategies to mitigate risk and prevail in cyber enabled military affairs.

Learning Outcomes: By the end of this course, students should be able to:

· Comprehend and articulate fundamental concepts for cyberspace operations.

· Explain and differentiate how science and technology underpin network and systems architectures for the conduct of cyberspace operations.

· Describe and contrast how computation and data analytics provide emerging opportunities to sustain military advantage through cyberspace operations.

· Outline and debate what strategy and policy are necessary for the legal and ethical counter of adversary cyber campaigns in and through cyberspace.

· Demonstrate the ability to conduct independent research and write informed papers on subjects directly related to the themes and topics in the course.

2. Network & System Technologies

3. LAB

5. Cyber Campaigns

6. LAB

8. Cyber Surveillance

9. LAB

11. Machine Learning & Data Analytics

12. LAB

14. Anonymity & Attribution

15. LAB

17. Cyber Security Incidents

18. LAB

20. Defense-in-Depth

21. Cyber Policy & Strategy

22. LAB

24. Security for Supply Chain Operations

25. LAB

27. Russo-Georgian War

3.0 Tasks: The contractor shall create eight (8) lab exercises in conjunction with each of the previous course topics.

3.1 Create a lab exercise addressing cyber concepts and network & system technologies within the context of cyber concepts such as:

3.1.1 What is cyberspace?

3.1.2 What is cybersecurity?

3.1.3 What is a cyber crime?

3.1.4 What is cyber power?

3.1.5 What is cyber conflict?

3.1.6 What is cyber warfare?

3.1.7 What are cyber operations?

3.1.8 DODIN (JP 3-12)

3.1.9 What are defensive cyber operations?

3.1.10 What are offensive cyber operations?

3.1.11 Network topologies

3.1.12 Network standards

3.1.13 Internet Maps and History

3.1.14 Network Models: Protocol Layers – OSI vs. TCP/IP

Lab theme: Network topologies: internets; identification and addressing: MAC addresses, IP addresses, port numbers, domain names, and URLs; frames and packets; network protocols and layering; Internet architecture and protocols: IP, TCP, UDP, and ICMP; Domain Name System (DNS); Border Gateway Protocol (BGP).

Learning Objectives:

1) Students will increase their understanding of the trust relationship between people and their information systems

2) Students will be exposed to various perspectives of cyber to include common cyber lexicon and discuss topics such as the 5 Ws of cyber.

3) Students will review significant historical events in the development of modern cyber thinking

Learning Outcomes:

1) Students will be able to describe how an information system might not behave as expected due to an intrusive event and provide a root cause

2) Students will be able to describe the role of computer networks and automation in the proliferation of cyber activities

3) Students will able to define and distinguish phrases in the cyber lexicon to include cyber operations, cyber defense, cyber attack, cyber surveillance, cyber security and cyber superiority.

4) Students shall identify at least five events involving nation-state actors that influenced current cyber practices

5) Students will dictate the role of USC Title 6, 10, 18 and 50 in the conduct of cyber activities.

Learning Objectives:

1. Students will develop a basic understanding of how the Internet works

1. Students will learn how the abstraction of network functions facilitates interoperability and can be applied in different contextual scenarios to include the Internet, Industrial Control Systems, and Cellular Networks.

1. Students will learn of the importance of protocols in computer communications

1. Students will be exposed to the concepts of virtualization and how the provisioning of virtualized resources forms the basis of cloud computing

Learning Outcomes:

1. Students will describe how a layered network architecture provides context to network functionality and promotes interoperability

1. Students will be able to define common terms in the context of computer networking to include autonomous system, protocol, routing, switching and the Internet of Things.

1. Students will describe how a packet travels from NPS to their favorite web site.

1. Students will define and describe common Internet protocols to include IP, TCP, UDP, DNS and HTTP

3.2 Create a lab exercise addressing internet of things and cyber campaigns in the context of cyber campaigns such as:

3.2.1 Types of devices & how they are controlled

3.2.2 Device management and integration

3.2.3 Types of sensors

3.2.4 What can be reported?

3.2.5 Types of network connectivity

3.2.6 IoT Standards and Protocols

3.2.7 Pros and Cons of IoT

3.2.8 Use in command and control

3.2.9 Military applications

3.2.10 Types of actors in cyber campaigns: terrorists, criminal organizations, etc.

3.2.11 Cyber campaign incidents, compromises, and the spectrum of campaigns

3.2.12 Objectives of cyber campaigns

Lab Theme: Communication security: Secure network communications; end-to-end vs link encryption; security protocols, tunneling; SSL/TSL; IPSec; virtual private networks (VPNs); point-to-point protocol (PPP); secure shell (SSH); wireless security: 801.11, EP, WPA.

IoT Standards and Protocols: Popular protocols and standards powering IoT devices, apps, and applications; IoT layers ranging from: infrastructure, identification, comms/transport, discovery, data protocols, device management, semantic, and multi-layer frameworks; compare the internet protocol suite and IP smart objects protocol suite; industry standards: review open standards reference model, alliances and organizations such as ETSI, IETF, IEEE, OMG, OASIS, OGC, IoT-A, OneM2M, OSIOT, IoT-GSI, ISA, W3C, EPC Global, the IEC, ISO, and JTC, RRG, HIPRG.

Learning Objective: Students will gain an introductory understanding the diversity of IoT devices and their interfaces.

Learning Outcomes:

1) Students will be able to list a dozen or more different kinds of IoT devices and their applications

2) Students will be able to describe various ways that IoT devices communicate with each other and potentially with the outside world

3) Students will be able to describe how various IoT devices are managed

4) Students will be able to describe several threats enabled by IoT devices

5) (Optionally) Students will be able to describe the very high level architecture of several kinds of IoT devices and the potential architectures of systems of IoT devices.

Learning Objective: Students will gain comprehension on the geo-political, technical and legal aspects of actual cyber incidents through case study analysis.

Learning Outcomes:

1. Students will be able to identify the different state and non-state actors using cyber power to achieve their desired effects.

1. Students will be able to describe actor campaigns and operations in cyber space to include purpose and intent.

1. Students will be able to outline the geo-political, technical and legal aspects of significant and recent cyber incidents.

3.3 Create a lab exercise addressing cyber surveillance in the context of ethics and international law such as:

3.3.1 DOD Law of War

3.3.2 Use of cyber force

3.3.3 Cyber attribution

3.3.4 Necessity, distinction, proportionality, suffering, escalation, and termination of cyber effects

3.3.5 What is the current state-of-the-art in privacy research?

3.3.6 Cyber surveillance legislation: EO12333, USSID 18, Title 18, Title 50, 4th Amendment, Domestic Law, Legal Standards, Stored communications records including overseas, Encryption and compelled disclosure, Legislative proposals and FISA.

Lab Theme: System break-ins; kill chains; reconnaissance/footprinting; scanning; software identification/fingerprinting; getting access; vulnerabilities; zero-days; hacking and exploit tools; packet sniffing; backdoors; remote access tools; rootkits; “owned” machines; web-related attacks.

Message, file, and device security: Email security and SMTP security; email deceptions; POP and IMAP security; email encryption with S/MIME and PGP, web e-mail; file and device encryption; end-to-end data encryption; homomorphic encryption; file disclosures; file deletion.

Botnets and Denial-of-service Attacks, Disruptions: botnets; command and control; fluxing; denial-of-service (DoS) attacks, including distributed DoS (DDoS), and attack mitigation; IP spoofing.

Learning Objectives:

1) Students will learn the importance of unique identifiers in the process of tracking and targeting

2) Students will develop an understanding of how identifiers across disparate datasets can be correlated to provide a deeper understanding of activity

3) Students will learn how knowledge of an individual’s physical environment, to include location, can enhance understanding of activities

4) Students will review various legislation and statutes the restrict the extent US Government organizations and pursue cyber surveillance

Learning Outcomes

1) Students will describe various methods for determining the location of an individual

2) Students will provide a scenario where knowledge of location provides a deeper understanding of an activity than communication content on its own

3) Students will describe various types of identifiers that may be used for tracking and targeting individuals

4) Students will define and discuss the following components of US law: the Foreign Intelligence Surveillance Act (FISA), the FISA Amendment Act (FAA), the Patriot Act and USA Freedom Act, and USC Title 6, 10, 18 and 50 as they pertain to cyber surveillance.

Learning Objective: Students will gain comprehension on aspects of international law and ethics that are applicable to cyberspace and international efforts to establish norms of responsible state behavior in cyberspace.

Learning Outcomes:

1) Students will be able to describe how the general rules and principles of international law apply to cyberspace.

2) Students will be able to articulate how the law of war governs resort to force (Jus ad bellum) and conduct of cyber operations in armed conflict (Jus in bello).

3) Students will be able to debate if arms control treaties work in cyberspace and the value of other mechanisms such as conventions or agreements.

4) Students will be able to judge the merit of efforts by the United Nations and other international bodies to develop norms of acceptable behavior and other confidence-building measures for cyberspace.

3.4 Create a lab exercise addressing computation and big data and machine learning and data analytics such as:

3.4.1 What is big data?

3.4.2 RDMS, Alternatives to RDMS, Problems with RDMS’, Way Forward

3.4.3 What is machine learning/data analytics and how can it help?

3.4.4 Supervised vs unsupervised learning, and reinforcement learning

3.4.5 Learning methods

Lab Theme: Access control concepts; discretionary access controls (DAC); role-based access controls (RBAC); mandatory access controls (MAC); guards; multilevel security (MSL) and Bell LaPadula model; integrity policy and Biba model; covert channels; least privilege; two-person control; separation of duties; network use/misuse.

Learning Objective: Students will gain an understanding of the reasons for the increasing importance of big-data applications and the obstacles to doing it.

Learning Outcomes:

1) Students will be able to identify major problems suited to big-data methods.

2) Students will be able to enumerate the major obstacles in data sharing, data consistency, data accuracy, data reduction, and data abstraction.

Learning Objective: Students will be able to identify major methods of machine learning and data analytics.

Learning Outcomes:

1) Students will be able to describe in general terms the key machine-learning and data-analytic methods (rule learning, decision trees, Bayesian reasoning, artificial neural networks, support-vector models, case-based reasoning, and distributional models), for both classification and prediction, and identify for what kinds of problems each is useful.

3.5 Create a lab exercise addressing encryption and authentication and anonymity and attribution such as:

3.5.1 The role of cryptography in the cyber domain

3.5.2 How cryptography provides confidentiality, integrity, availability and non-repudiation for DON, DOD, and military cyber operations.

3.5.3 Types of cryptography and modern cryptography

3.5.4 Attribution techniques

Lab Theme: Cryptography basics: Traditional and modern cryptography; steganography; codes vs ciphers; symmetric (single-key) cryptography vs asymmetric (two-key) cryptography; Caesar cipher; Vernam cipher and one-time pad; block cipher standards; DES, 3DES, and AES; modes of operation: electronic codebook (ECB), cipher block chaining (CBC), and counter mode (CTR); cryptanalysis; side-channel attacks; brute force attacks; impact of quantum computing on key cracking; recommended key lengths.

Public key and quantum cryptography: Motivation and objectives; key distribution via an authentication server; public-key (asymmetric) encryption and key agreement; public-kay methods: Diffie-Hellman, RSA, and elliptic curve; cracking private keys via factoring; impact of quantum computing on factoring; recommended key lengths; public-key standards; quantum key agreement.

Cryptographic authentication, digital signatures, and PKI: Authenticating plaintext and ciphertext; hashing; message authentication codes (MACs); digital signatures; public-key certificates; public-key infrastructure (PKI); secret sharing; key recovery.

Identification and Authentication: captchas; passwords; password files; password attacks and cracking; challenge-response; access tokens; biometrics; multi-factor authentication; continuous authentication; single sign-on; device and location authentication.

Learning Objectives:

1) Students will learn the important roles that cryptography plays in the cyber domain. Topics will include: public/private encryption systems, key exchange/management, internet cryptographic protocols (SSH, SSL, etc.), as well as cryptographic attacks.

2) Students will gain an appreciation for the important role authentication plays in cyber security. Both user and content authentication schemes will be covered.

Learning Outcomes:

1) Students will understand the difference between symmetric and asymmetric encryption.

2) Students will be able to explain the complementary roles of public and private key encryption schemes.

3) Students will demonstrate familiarity with current cryptographic standards in wide usage.

4) Students will be able to explain, in general terms, some basic cryptographic attacks such as brute force, man-in-the-middle, as well as protocol and side-channel attacks.

5) Students will be able to describe single/double/multi-factor authentication.

6) Students will show a basic understanding of what hash functions do.

7) Students will be able to explain how hash functions are used in password storage and verification as well as message digests.

8) Student will be able to describe digital signatures and Message Authentication Code (MAC), and understand the role these security schemes play in ensuring integrity and non-repudiation.

9) Students will have a basic understanding of collisions and authentication attacks.

3.6 Create a lab exercise addressing system and network monitoring in the context of cyber security incidents such as:

3.6.1 Network data states

3.6.2 Abnormalities, signatures, and event detection

3.6.3 Types of network anomalies

3.6.4 Whitelist vs blacklist approaches in network monitoring

3.6.5 Modern network monitoring solutions

3.6.6 What is a cyber incident?

3.6.7 What is the cyber kill chain?

3.6.8 Types of malicious cyber activities

Lab Theme: Network and System Monitors: Vulnerability and threat monitoring; packet filtering; ingress and egress filtering; static and stateful filtering; application gateways and proxies; blacklists and whitelists; firewalls; network address translation (NAT); DMZs; intrusion/misuse detection/prevention/analysis; signature and anomaly/behavior detection; threat intelligence.

Malicious software and Degradations: Malicious software (malware), including viruses, worms, Trojan horses, spyware, keyloggers, and more; payloads and propagation methods; stealth techniques and morphing; malware toolkits; anti-malware tools.

Learning Objective: Students will gain an understanding of the weapons used in cyber attacks and their availability for purchase on criminal forums.

Learning Outcomes:

1) Students will be able to describe various types of malware and how vulnerabilities and exploits are used to infect a victim’s system.

2) Students will be able to explain common cyber attack methods and techniques used in actual cyber incidents.

3) Students will be able to articulate pertinent elements of domestic cyber law and the parameters of underground cybercrime markets.

3.7 Create a lab exercise addressing risk management and defense-in-depth in the context of cyber policy and strategy such as:

3.7.1 DOD Policy on cybersecurity risk management (DODI 8500.01 and DODI 8510.01)

3.7.2 Cyber risk definition(s)

3.7.3 Components of risk management

3.7.4 Risk analysis matrix

3.7.5 Risk mitigation: acceptable, avoided, shared, or transferred

3.7.6 Risk mitigation and cybersecurity framework (EO 13636)

3.7.7 What is information assurance?

3.7.8 How can cyber threat intelligence configurations (HUMINT, OSINT, SIGINT, IMINT, and MASINT) help identify specific threats to specific targets?

3.7.9 Other types of threat intelligence gathering: community sharing, DHS/NCCIC/CTIIC, CISCP, ECS

3.7.10 Cybersecurity legislation on sharing (CISA, AIS, TAXII, STIX)

3.7.11 Pros and cons to cybersecurity intelligence sharing

3.7.12 US Federal Cybersecurity Operations Team

3.7.13 US International Strategy

3.7.14 US Defense Strategy

3.7.15 Coercion and compellence

3.7.16 Cyber deterrence by denial and entanglement

Lab Theme: Security Policy and Management: Auditing; data retention; host hardening; patching; risk management; security standards, guidelines, and best practices; security personnel and organization; outsourcing; backup; disaster and contingency planning; incident response.

Learning Objective: Students will gain comprehension of risk management measures for addressing risk tolerance and the use of defense-in-depth strategies to counter cyber attacks.

Learning Outcomes:

1) Students will be able to define risk management components and identify the range of risk response measures to address risk.

2) Students will demonstrate a comprehension of key standards, guidelines, and best practices contained in the NIST cybersecurity framework and the Center for Internet Security critical security controls.

3) Students will be able to articulate the need for a defense-in-depth strategy and the elements for implementation.

4) Students will be able to describe how layered security controls and tools counter activity along the cyber kill chain during incident response.

3.8 Create a lab exercise addressing security for supply chain operations in the context of acquisition of security products/services such as:

3.8.1 DODI 5000.02, DODI 8500.01, DODI 8510.01

3.8.2 The importance of requirements definition

3.8.3 Acquisition life cycle and program management

3.8.4 Test and evaluation

3.8.5 Logistics

3.8.6 Contracting

3.8.7 Describe supply chain operations

3.8.8 Define supply chain management

3.8.9 Examine the flow of information within the supply chain

3.8.10 Major cybersecurity threats to supply chain operations

3.8.11 Use of risk analysis and contingency planning

Lab Theme: Understand the risks involved in acquisition of government systems that contain, transmit, or process information that support operations. A wholistic approach to Risk Management Framework (RMF); NIST SP 80037 Rev 1, Federal Information Security Modernization Act (FISMA) into the NIST security standards; IoT product evaluation and contract negotiation considerations and risk management; Potential threats, impacts, and countermeasures to Product Tampering and Counterfeiting (PTC) awareness; Roles and responsibilities, best practices, and framework for organizing the SCRM response team with respect to the Supply Chain Risk Management (SCRM) Response Plan (RP).

Learning Objective: Students will gain an understanding of the importance of cyber security for supply chain operations and the use of risk analysis and contingency planning to ensure readiness.

Learning Outcomes: Students will be able to identify cyber security threats to supply chain operations and develop appropriate contingency plans to address the major threats.

Learning Objective: Students will gain knowledge and comprehension of the complexity of procuring cyber capability within the Defense Acquisition Decision Support System.

Learning Outcomes:

1) Students will be able to identify and explain the key steps in cyber security procurement from initial requirements definition to integration into an operational DoD organization.

2) Students demonstrate a comprehension of key policies that define the cyber security procurement process.

3.9 Provide videos and workbook activities to accompany lab exercises.

3.10 Create a visual topology of the lab exercises showing the way in which constituent parts are interrelated or arranged.

3.11 Generate software tool with source code available to the government.

3.12 Technical support during the 2019 summer academic quarter, July – September 2019.

3.13 Minor refinement of material and support during alternating quarters between class delivery.

4.0 Deliverables: The lab exercises shall be comprehensive based on course material that ultimately builds upon previous weeks to reinforce and coordinate all learning objectives.

The contractor shall be responsible for providing the following deliverables:

4.1 Lab exercise addressing cyber concepts and network & system technologies in the context of cyber concepts

4.2 Lab exercise addressing internet of things and cyber campaigns in the context of cyber campaigns

4.3 Lab exercise addressing cyber surveillance in the context of ethics and international law

4.4 Lab exercise addressing computation and big data and machine learning and data analytics

4.5 Lab exercise addressing encryption and authentication and anonymity and attribution

4.6 Lab exercise addressing system and network monitoring in the context of cyber security incidents

4.7 Lab exercise addressing risk management and defense-in-depth in the context of cyber policy and strategy

4.8 Lab exercise addressing security for supply chain operations in the context of acquisition of security products/services

4.9 Videos and workbooks to accompany each lab exercise

4.10 Visual topology of the lab exercises showing the way in which constituent parts are interrelated or arranged

4.11 Software with source code

4.12 Technical support during the 2019 summer academic quarter, July – September 2019.

4.13 Minor refinement of material and support during alternating quarters between class delivery

Performance Measurement - Quality Assurance Surveillance Plan

3.1

100% Inspection of Deliverables

Upon completion of deliverables; 45 days from date of award.

The topology shall capture information-related requirements in a coherent manner, and in a way that appropriately reflects the user experience needs of students.

100% Inspection of Deliverables

Upon completion of deliverables; 45 days from date of award.

Each support response is due no later than 24 business hours from the time of receipt.

If performance falls below the AQL defined above, the Contracting Officer’s Representative (COR) shall document the instance(s), coordinate with the Contracting Officer and advise the Contractor. The Contractor will be requested to review the documentation and provide a written response on how performance will be corrected in the future. Re-performance of any work for failure to perform in accordance with the specified AQL or task requirement shall be completed at the Contractor’s own expense and at no additional cost to the Government.

*Acceptable Quality Levels for Each Lab Exercise: Deliverables 4.1 – 4.8

1. Each lab shall be of professional academic quality;

2. Each lab shall be at least fifty (50) minutes and no more than one hundred ten (110) minute to complete, varying depending on the depth and complexity of a specific topic area;

3. The lab exercises shall be available to students to complete asynchronously, 24/7, without the requirement of a professor to proctor the exercises;

4. The presentation aspects shall not overemphasize the pictorial presentation at the expense of the underlying learning objectives for adequate learning, comprehension, and instruction;

5. The labs may be completed by individual students, completed by teams, or a combination of individual and team work based on the content of the lab material;

6. Lab exercises shall also be available to students to re-do individually for individual learning;

7. The delivery of the lab exercises shall be in a format available to students and instructors via the internet;

8. The lab exercises shall be housed within the NPS IT architecture (chunklearning.net) with the ability for the Government to modify the labs as needed to stay relevant with course material;

9. Lab exercises shall employ analytic reasoning skills at the tactical, operational, and strategic levels to examine cyber concepts;

10. Lab exercises shall be consistent, repeatable over time, and a sustainable delivery;

11. Each lab exercise shall demonstrate military relevance for Naval officers;

12. Lab exercises shall be OS (operating system) agnostic;

13. Lab exercises shall be HTML5 compliant in a web browser;

14. Lab exercises shall not utilize command line instructions or activities;

15. Labs shall incorporate an interactive graphical user interface (GUI) with a consistent look and feel for each lab;

16. Lab exercises shall employ analytic reasoning skills at the tactical, operational, and strategic levels to examine cyber concepts;

17. Lab exercises shall be gamified and available on-line persistently;

18. Lab exercises shall be designed within an emulated network in realistic scenarios that are mission-specific using real-world tools;

19. Lab exercises shall employ AI capabilities in real-time to assist students in adapting to new threats;

20. The software solution shall record completion of lab exercises per student;

21. The software solution shall track student progress, strengths, and weaknesses;

22. The software solution shall allow instructors to run reports on student activities;

23. The software solution shall include appropriate role-based access controls for a variety of users (students, instructors, guests, etc.);

24. The contractor shall follow the NICE framework;

25. The proposed solution will operate solely on the UNCLASSIFIED NIPRNET;

26. Present lab material in a coherent, GUI-based format and gamified format, that meets each learning objective.

5.0 Minimum Technical Requirements:

1. Five (5)+ years experience in developing coursework for academic institutions

2. Five (5)+ years experience developing coursework at the Master’s level education

3. Five (5)+ years experience in each topic area, collectively among the contractor team

4. Provide a link for similar products or developments

6.0 Period of Performance:

One (1) year from date of award

Deliverables 4.1 – 4.11: Due within 45 days from date of award Deliverable 4.12: 01 July 2019 – 30 September 2019 Deliverable 4.13: One (1) year from date of award

7.0 Place of Performance:

All work will be completed at the contractor’s site.

8.0 Government Furnished Property/Information:

8.1 Relevant course material for each lab exercise

9.0 Work Week and Hours of Operation:

The Contractor shall provide services during normal working hours excluding federal holidays. Normal working hours are 0730-1630, Monday through Friday, unless requirements dictate otherwise. Exceptions can be permitted by the COR upon request and at the COR’s discretion.

Government holidays include the following and any other day determined to be a holiday by the President of the United States.

If any of the above holidays occur on a Saturday or a Sunday, then such holiday shall be observed by the Contractor in accordance with the practice as observed by the assigned Government employees at the using activity

10.0 Travel:

No travel is required.

11.0 Transition Activities:

It is essential to the Government that services required under this PWS are performed without interruption. At the conclusion of any performance period, including option periods or extensions, the services provided under this PWS may be awarded to another contractor. The contractor in place shall be required to assist in the transition activities.

12.0 Security Requirements:

This contract is unclassified and does not require a security clearance.

Contractor Key Personnel must be U.S. Citizens.

Contractors performing on this contract are required to familiarize themselves with, and participate in, the Naval Postgraduate School’s OPSEC program. Must be familiar with and comply with NPSINST 3432.1B, the NPS Critical Information List, DOD Directive 5205.02E and their applicable references. The contractor will be required to complete OPSEC and counter-intelligence training within 30 days of beginning the work, or provide proof of OPSEC and counterintelligence training completed within the previous 12 months. The contractor may not publicly release any information about developmental work or curriculum at NPS without prior written approval from the Principal Investigator (PI).

13.0 Human Subject Research:

Contractor personnel performing work under this contract may not support, advise, or conduct research involving human subjects. If at any time during the period of performance of this contract the tasks involve human subject research, the Contractor shall immediately notify the Contracting Officer. The contract must be amended in accordance with DoDD 3216.02 and DFAR 252.235-7004 in the event human subject research is proposed.

14.0 Privacy Act Statement:

“Pursuant to Title 5 United States Code 552a(m)(l), the contractor and all employees of the contractor working under this contract are required to comply with the requirements of 5 U.S.C. 552a (“The Privacy Act of 1974”).”

15.0 Identification of Contractor Employees:

In accordance with DFAR 211.106, there shall be a clear distinction between Government employees and service contractor employees. Service contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel. Contractor personnel will be required to obtain and wear badges or other visible identification for meetings with Government personnel to provide a clear distinction between service contractor employees and Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

16.0 Non-Personal Services Statement:

Contractor employees performing services under this order will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management will insure that employees properly comply with the performance work standards outlined in the SOW. Contractor employees will perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The tasks, duties, and responsibilities set forth in the task order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.

17.0 SUPTXT 204-9400 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor.”

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

· SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

· Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

· Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR.