PCTE Request for Information (Range Engine) ver 5___04.01.2025.pdf

Request for Information (RFI) Title: Persistent Cyber Training Environment (PCTE) Cyber Range Development Software Application Project Issued By: Army Contracting Command Orlando in support of PEO STRI, PM CT2, PdM CRT

PCTE

Issue Date: 1 April 2025 Response Due Date: 21 April 2025

1. Introduction The Program Executive Office Simulation Training and Instrumentation (PEO STRI), Program Manager Cyber Test and Training (PM CT2), Product Manager Cyber Resilience and Training (PdM CRT), Persistent Cyber Training Environment (PCTE) is seeking information from vendors and technology providers regarding the development and deployment of a Cyber Range Software Application. The purpose of this RFI is to explore available solutions, capabilities, and best practices in adopting a scalable and secure cyber range platform for supporting individual, collective and mission rehearsal cyber training.

This RFI is not a solicitation for proposals but rather a means to gather information for potential future procurement. Vendors are encouraged to provide detailed responses that address the requirements outlined below.

2. Objectives The primary objectives of the cyber range development project are:

• To create a realistic and highly scalable cyber range environment for cybersecurity training and exercises.

• To support simulated cyberattacks and defensive scenarios.

• To facilitate multi-user collaboration for cybersecurity drills and red/blue team exercises.

• To provide the ability to share cyber training individual results in xAPI and CMI5 format.

• To integrate with existing and future PCTE on-prem and cloud security tools, network environments, and cloud infrastructure.

• To ensure high levels of security, automation, and reporting capabilities.

3. Requested Information Vendors should provide information on the following aspects:

A. System Architecture & Features

1. Describe your cyber range software’s architecture and scalability. Include a description of the hardware that would best meet your software’s architecture.

2. Does your solution support on-premises, cloud-based, and/or hybrid deployment?

3. How does the system simulate real-world attack/defense scenarios?

4. What types of network environments and protocols does your platform support?

5. Does your system allow for custom scenario development and automation? If yes, please describe format and workflow building those scenarios.

6. Does your system integrate Learning Management System (LMS) features? If yes describe your LMS approach, and standards used.

7. The PCTE current architecture has multiple Enterprise Platforms interconnected. Does your solutions have a mechanism to transfer ranges between platform systems. If so how would that be implemented in a connected scenario and an offline platform system (please talk to file types).

8. Describe your range development solution in terms of user access and supporting team of team’s platform access and provide usage visibility (CPU, memory, and storage).

B. Security & Compliance

1. What security measures are built into the platform?

2. Does your solution comply with NIST, ISO 27001, FedRAMP, or other cybersecurity standards?

3. How does the platform ensure data integrity and confidentiality?

C. User Experience & Training Capabilities

1. What types of user roles and permissions be configured?

2. Does your platform include a user-friendly, interactive dashboard and reporting tools?

3. Can the software application support multi-user collaboration, remote access, and team-based exercises, using the PCTE Enterprise architecture (reference Fig A-1)?

D. Integration & Compatibility

1. What third-party cybersecurity tools and SIEM solutions does your software application integrate with?

2. Does your solution support AI-driven threat analysis and automation?

3. Is there an API for custom integrations?

E. Cost & Licensing

1. What pricing models do you offer (e.g., subscription-based, perpetual license, government purpose rights, are portions open-source)?

2. Are there any hardware or infrastructure requirements or dependencies?

3. What are the estimated costs for scaling up the system, on-premises and in the cloud?

4. Response Submission Interested parties should submit their responses in electronic format (PDF or Word document) by 21 April 2025 to:

Contact Person: ACC-O POC: Jaime Morrison, PCTE POC: Juan B. Orozco, PCTE Acquisition Product Lead, Alfredo Betancourt, PCTE Chief Engineer.

Email: ACC-O POC: jaime.morrison.civ@army.mil, PCTE Acquisition:

juan.b.orozco.civ@army.mil, PCTE Engineering: alfredo.o.betancourt.civ@army.mil Phone: ACC-O Phone Number, kurt.l.kleinlein.civ@army.mil, 321-235-7523 Responses should include a company profile, relevant case studies, and any additional marketing materials or whitepapers that provide insights into the proposed solution.

5. Disclaimer This RFI is for information-gathering purposes only and should not be construed as a commitment by [Your Organization Name] to issue a solicitation or award a contract. No compensation will be provided for responding to this request.

Thank you for your interest in supporting the development of a next-generation PCTE Cyber Range Software Application. We look forward to your insights and responses.

mailto:jaime.morrison.civ@army.mil mailto:juan.b.orozco.civ@army.mil mailto:alfredo.o.betancourt.civ@army.mil mailto:kurt.l.kleinlein.civ@army.mil

Appendix A

PCTE Infrastructure and High-Level Architecture Description

Figure A-1 PCTE Infrastructure

Figure A-2 PCTE Reference Architecture

PCTE Reference Architecture Description: Starting at the top of the diagram, the PCTE Reference Architecture is divided into two planes, the Control Plane and Event Plane. The Control Plane contains the security hardened applications/services that are used to plan, prepare, execute, and assess a cyber event. From the Control Plane, the PCTE Platform provisions computing resources in the Event Plane to support individual, team, and force level training. The two planes are isolated by firewalls and sophisticated networking. The isolation is necessary because the Event Plane may contain unauthorized protocols and malware that are used to emulate adversaries. Systems in the Event Plane may not be Secure Technical Implementation Guide (STIG) compliant and vary depending on the objectives of cyber training.

The remainder of this section steps through each layer in the Control Plane from the bottom to top. Before discussing the Control Plane layers, it’s important to state that the content in each of the layers is conceptual. Due to space limitations, high-level capabilities for each layer were provided as conceptual examples. A PCTE vendor should be able to depict how their solutions align with the layers of the PCTE Reference Architecture. Here is a description of each layer of the Control Plane:

Enterprise Services layer identifies services that provide general business functionality which can be combined with other services to meet new requirements. For example, all vendor applications use the Single Sign On (SSO) enterprise service to authenticate end users.

Cyber Security Services layer identifies applications and services that are used to secure the PCTE Platform.

Application layer identifies the browser-based front-end applications that are used to access the web services that execute the business logic. They are also used to visualize data retrieved from databases for the web services to process.

Service layer identifies the back-end web services that contain the business logic of a PCTE application. Each web service provides a business capability to the overall platform and typically exposes application programming interfaces (APIs) to access the respective business capability (e.g. Exercise Control). The APIs also provide a means for PCTE vendors to integrate their respective applications/services with each other.

Persistence layer identifies the databases used to store data including but not limited to scenarios, tools, intelligence, and files.

The purple layers identify the government provided middleware.

The API Gateway provides a single-entry point into the system and encapsulates the internal system architecture. It also provides functionality that is common across services such as authentication, monitoring, load balancing, and caching.

The Message Bus provides a means for vendor applications/services to integrate with each other via messages.

Container Platform / Hypervisor layer identifies the container orchestration system and hypervisor used by the platform. Containerization allows development teams to move fast, deploy software efficiently, and operate at an unprecedented scale by ensuring consistency among environments. Currently, the container orchestration system is installed on the hypervisor.

Compute layer identifies the environments that PCTE software could be installed on including bare metal hardware, virtual machines, cloud, or a hybrid of these environments.

Transport layer identifies the networks that end users will leverage to access the PCTE Platform.

The PCTE Program Management Office (PMO) will levy requirements on its vendors to employ a modular design, designate, and manage key interfaces, use open standards that are well defined and certify conformance. GitLab will be used for configuration management of interfaces.