Attachment 1 - Final IT Training PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

IT Training/Certification

1.0 General:

1.1 Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform Cybersecurity and Information Technology certification training Services, as defined in this PWS.

1.2 Background: DoD Directive 8570 was issued in 2005 to identify, tag, track and manage the information assurance, or cybersecurity, workforce. It also established a manual that includes an enterprise-wide baseline IT certification requirement to validate the knowledge, skills and abilities of people working in cybersecurity roles. It was replaced by DoD Directive 8140 in 2015, which expands upon it.

1.3 Period of Performance (PoP): One (1) Base Year and four (4) Option Years

1.4 General Information: Contract performance does not need to take place at a Government facility.

1.4.1 Place and Performance of Services: This is a computer-based training services contract and does not require interaction with contractors from the company.

1.4.1.1 Telework: Reserved.

1.4.2 Recognized Holidays: The following are recognized United States (US) holidays.

The contractor shall perform services on these days:

1.4.2.1 New Year’s Day: January 1st

1.4.2.2 Martin Luther King, Jr.’s Birthday

1.4.2.3 President’s Day

1.4.2.4 Memorial Day

1.4.2.5 Juneteenth National Independence Day: June 19th

1.4.2.6 Independence Day: July 4th

1.4.2.7 Labor Day

1.4.2.8 Columbus Day

1.4.2.9 Veteran’s Day: November 11th

1.4.2.10 Thanksgiving Day

1.4.2.11 Christmas Day: December 25th

1.4.3 Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary (PRS).

1.4.4 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Performance Requirements Summary (PRS). The PRS is primarily focused on how the Government will verify that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s). A final QCP shall be submitted to the Contracting Officer Representative (COR) NLT 10 days after contract award. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s (KO’s) acceptance in writing of any proposed changes to its QCP.

1.4.5.1 Reserved

1.4.5.1.1 Homeland Security Presidential Directive (HSPD)-12 Background Investigation Requirements: Reserved.

1.4.5.1.2 Trusted Associate Sponsorship System (TASS): Reserved.

1.4.5.1.3 Reserved.

1.4.5.1.4 Reserved.

1.4.5.1.5.1 Reserved.

1.4.5.1.6 Reserved.

1.4.5.3 Reserved.

1.4.5.4 Reserved.

1.4.5.5 Communications Security/Information Technology (COMSEC/IT) Security. All communications with DoD organizations are subject to COMSEC review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the contractor is advised that any time contractor personnel place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DoD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

1.4.5.6 Reserved.

1.4.5.7 Reserved.

1.4.5.8 Reserved.

1.4.5.9 Reserved.

1.4.5.10 Reserved.

1.4.5.11 Reserved.

1.4.5.12 Reserved.

1.4.5.13 Reserved.

1.4.5.14 Reserved.

1.4.6 Physical Security: Reserved

1.4.7 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the KO in accordance with FAR 42.5.

The KO, CS and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the KO will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.4.8 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO.

The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the KO to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.4.9 Organizational Conflicts of Interest (OCI): The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO. In the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may impose other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

2.0 Definitions and Acronyms:

2.1 Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.3 Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.4 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.5 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.6 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.7 Reserved

2.1.8 Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.9 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have priority of contract with the subcontractor.

2.2 Acronyms:

AEI Army Enterprise Infrastructure AR Army Regulation AT/OPSEC Antiterrorism/Operational Security BI Background Investigation CM Contract Manager COR Contracting Officer Representative DA Department of the Army DD254 Department of Defense Contract Security Classification Specification DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DSCA Defense Counterintelligence and Security Agency FAR Federal Acquisition Regulation GFP/M/E/S Government Furnished Property/Material/Equipment/Services HQDA Headquarters, Department of the Army HSPD Homeland Security Presidential Directive IA Information Assurance IS Information System(s) KO Contracting Officer NGB National Guard Bureau OCI Organizational Conflict of Interest PII Personally Identifiable Information PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SCR Service Contract Reporting SSN Social Security Number TE Technical Exhibit USD(I) Under Secretary of Defense for Intelligence

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S):

No government property will be issued under this contract.

3.1 Property: Reserved

3.2 Materials: Reserved

3.3 Equipment: Reserved

3.4 Services: Reserved

3.5 Utilities: Reserved

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E): The contractor is not required to provide any materials or equipment. Therefore, the government shall not need to reimburse the contracted company.

4.1 General: Except for those items specifically stated to be Government-Furnished in Paragraph 3.0, the contractor shall furnish everything required to perform these services as indicated in Paragraph 1.1.

4.2 Secret Facility Clearance: Reserved.

4.3 Contractor Security Clearance: Reserved.

5.0 Requirements: The contractor shall:

5.1 Provide a hybrid environment of hands-on learning and in-depth video courses. An environment that includes a variety of labs, such as virtual labs, security labs, network-based labs and a secure coding range can be utilized to remain current and test new technology prior to the introducing into our production environment.

5.1.1 Provide an environment that meets the continuing education unit requirement for all DoD 8570/8140 cybersecurity professionals. DoDD 8140.01, 5 Oct 2020, "Civilian and military personnel performing cyberspace work roles must meet qualification standards established in DoD cyberspace workforce policy, in addition to other applicable workforce qualification and training requirements (e.g., acquisition, intelligence, communications)."

5.1.1.2 DoD8570.01m, Change 4, 11/10/2015, "C2.3.4. Individuals in IA positions, as defined in Chapters 3, 4, 5, 10, and 11 not meeting qualification requirements must be reassigned to other duties, consistent with applicable law." "C3.2.3.3. Completion of sustainment training/continuing education as required to maintain certification status.

For planning purposes, the standard is normally a minimum of 20 to 40 hours annually", the continuing education annual requirement depends on the Certification required (Security Plus is 17-hours thru CISSP which is 40-hours).

5.1.2 Allow department leadership to assess individual skills to determine what projects and what personnel are best suited for which systems within our environment. We currently do not have an internal method available to determine this, we require a learning platform that enables our organization to assess, develop, and measure our technician’s technical security skills, with up-to-date content on the latest technologies, that allows us to assess skills in different technology areas, to give our organization visibility into our security competency and to identify skill gaps.

5.1.3 Allow managers to build out curriculums for specific training paths, to have a primary and alternate administrator for each technology area. This allows managers to track training requirements for the Elevated Privilege account holders per technology area. Technology areas include but not limited to Information Assurance, Database administration, System administration.

5.2 Service Contract Reporting: Vendor shall ensure that the training website maintains a high-level up of up time and ensures to communicate any website maintenance accordingly.

5.2.1 Vendor shall ensure that the website training catalog maintains up to date with cybersecurity industry trends and with any changes to industry certifications.

6.0 Applicable Publications: Publications applicable to this PWS are listed below:

Publication (Chapter/Page)

Date of Publication

Mandatory or Advisory

Website

Federal Acquisition Regulation https://www.acquisition.gov/?q=browsefar

Defense Federal Acquisition Regulation Supplement http://www.acq.osd.mil/dpap/dars/dfarspgi/current/in dex.html or https://www.acquisition.gov/dfars

Joint Travel Regulation (JTR) https://www.defensetravel.dod.mil/site/travelreg.cfm

DoDM 1000.13-M-V1 DoD Identification (ID) Cards (Enclosure 2, paragraph 3.b)

01/23/2014 (Change 1:

07/28/2020) http://www.esd.whs.mil/Directives/issuances/dodm

Federal Information Processing Standards (FIPS) Publication 201-2 Personal Identity Verification (PIV) of Federal Employees and Contractors

(Paragraph 9)

August 2013 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201

-2.pdf

DoDM 5200.2 Procedures for the DoD Personnel Security Program

(PSP)

04/03/2017 https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.acquisition.gov/?q=browsefar http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html https://www.acquisition.gov/dfars http://www.defensetravel.dod.mil/site/travelreg.cfm http://www.esd.whs.mil/Directives/issuances/dodm http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf https://www.esd.whs.mil/Directives/issuances/dodm/

DoDI 5200.46 DoD Investigative and Adjudicative Guidance for Issuing the Common

Access Card (CAC)

09/09/14

(Change 1:

05/04/2018) https://www.esd.whs.mil/Directives/issuances/dodi/

Homeland Security Presidential Directive (HSPD)-12

Policy for a Common Identification Standard for Federal Employees and

Contractors

08/27/2004 https://www.dhs.gov/homeland-security-presidential-directive-12

DoDI 5400.11 Department of Defense Privacy and

Civil Liberties Programs

01/29/2019 https://www.esd.whs.mil/Directives/issuances/dodi/

DoD 5400.11-R Department of Defense Privacy

Program

05/14/2007 https://www.esd.whs.mil/Directives/issuances/dodm/

DoDD 8140.01 Cyberspace Workforce Management 10/05/2020 https://www.esd.whs.mil/Directives/issuances/dodd/

DoD 8570.01-M Information Assurance Workforce

Improvement Program

12/19/2005 (Change 4:

11/10/2015) https://www.esd.whs.mil/Directives/issuances/dodm/

DoD 5220.22-M National Industrial Security Program

Operating Manual (NISPOM)

02/28/2006 (Change 2:

05/18/2016) https://www.esd.whs.mil/Directives/issuances/dodm/

Army Directive 2014-05 Policy and Implementation

Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors

03/07/2014 https://armypubs.army.mil/ProductMaps/PubForm/A rmyDir.aspx

AR 25-2

Information Assurance

04/04/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 530-1

Operations Security

09/26/2014 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 525-13

Antiterrorism

12/09/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 381-12

Threat Awareness and Reporting Program (TARP)

(Section II, ¶ 2-4.b)

06/01/2016 http://armypubs.army.mil/ProductMaps/PubForm/AR

.aspx

DoD Directive 8570.01 Information Assurance workforce Improvement

Program

11/10/2015 http://www.dtic.mil/whs/directives

DoD Directive 8140.01 Cyberspace Workforce Management

10/05/2020 https://www.esd.whs.mil/Portals/54/Documents/DD/i ssuances/dodd/814001p.pdf

TECHNICAL EXHIBIT 1

Performance Requirements Summary (PRS)

This PRS includes performance objectives the Government will use to determine contractor performance and will compare contractor performance to the Acceptable Quality Level (AQL).

Performance Objective

Performance Standard Acceptable Quality Levels (AQL)

Surveillance Method / By Whom https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.esd.whs.mil/Directives/issuances/dodi/ http://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://www.dtic.mil/whs/directives http://www.esd.whs.mil/Portals/54/Documents/DD/i

5.2 Training website/

portal access

Vendor shall ensure that website maintains a high- level up time.

Meets the standard 99.9% of the time

Periodic Inspection

5.2.1 Maintain up to

date with trends industry updates

Vendor shall ensure that training catalog stay current with industry standards and any changes to industry certifications.

Updating course catalog with 30-60 days of certification version updates.

Periodic Inspection