Performance Work Statement.docx

CUI

CUI

ADAP 211-002 PERFORMANCE WORK STATEMENT (PWS)

For Defense Acquisition University (DAU) Mid-Atlantic Directorate (MAT) Cyber Training Range – Network Systems

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide cyber training range (CTR) subscriptions and systems integration services necessary for DAU to conduct training classes for DoD personnel. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to host students and DAU instructors in a cyber training range. The contractor shall perform to the standards in this contract.

1.2 Background: Since 2024, DAU has been training acquisition workforce personnel in cybersecurity using a commercially hosted, “hands on” CTR. Training is conducted in an instructor led training (ILT) classroom setting or in a virtual instructor led training (VILT) environment using MS Teams. All training is conducted using a commercial cloud-based infrastructure which has the ability to scale easily at a relatively low cost per student

1.3 Objectives: Threshold Technical Requirements.

The contractor shall provide a virtual cybersecurity training environment for DAU students, including the following:

a. Dedicated Virtual Machines (VMs): Each student shall have access to dedicated VMs.

b. Dedicated Classroom Website URL: A unique URL for each DAU CTR offering.

c. Web-Based Interface for Curriculum Uploads: DAU instructors/curriculum developers shall have the ability to upload target VMs (OVA formatted) for major operating systems (e.g., Windows 7 through Windows Current, Windows Servers, Ubuntu, RedHat, SUSE, CentOS, Debian, Fedora, and Kali).

d. Web-Based Kali VM for Students: Students shall use a web-based Kali VM for attack training against target VMs, with access to common repositories for offensive security tools (e.g., exploit-db.com, Kali OS updates, GitHub) and general filtered internet access.

e. Real-Time Curriculum Editing: A web-based interface allowing DAU instructors/curriculum developers to edit class curriculum material in real-time using an intuitive WYSIWYG editor.

f. Intuitive Student Curriculum Material: Curriculum material shall be offered intuitively with the VMs on the CTR, including split-screen options and full-screen views for multiple monitors.

g. Static IPv4 Addresses: IPv4 addresses for student VMs and Kali systems shall be static RFC 1918 addresses or dynamically assigned IPs with automatic curriculum updates to ensure correct IP addresses in student instructions.

h. Individual VMs for Class Exercises: Each student shall have their own Kali VM and target VM for most class exercises, with no shared VMs.

i. Configurable Internal Networks: The CTR shall provide configurable internal networks that allow more than two VMs to communicate over configurable network ports for classes requiring multiple target systems.

j. Groups of Target VMs: Groups of target VMs required for classes with multiple targets shall be provided for each student, with no shared VMs.

k. Network Ports/Protocols Configuration: A web based interface shall be provided allowing DAU curriculum developers to configure network ports/protocols among target VMs and dynamically update VMs and curriculum references.

l. Direct Access to VMs: Students shall have direct access to both the Kali VM (GUI access) and the target VM (e.g., RDP access to Windows VM) for single target VM exercises, configurable by DAU curriculum developers.

m. Capture the Flag (CTF) Capabilities: CTF student competition scoreboard/leaderboard capabilities shall be provided, class and event-specific.

n. CTF Configuration: DAU curriculum developers shall have direct access to create CTF questions/challenges with customizable answers and hints.

o. Class-Specific Reporting: Reports shall be provided to include the number of answers successfully completed and the amount of time each student was actively participating.

p. VM Reset Capability: Students and instructors shall have the ability to reset VMs in case of critical errors.

q. Shared Clipboard Capability: Students shall be able to copy text between their clipboard and assigned VMs.

r. Global, Low-Bandwidth Friendly Access: Global, low bandwidth access friendly capability shall be provided (e.g., AWS global network).

s. Scalability: The environment shall scale based on user demand.

t. High Availability and Stability: The environment shall have an availability SLA exceeding 99%.

u. User-Friendly Interface: The CTR shall have a user-friendly interface for individuals with little technical knowledge.

v. Migration Capability: The ability to migrate existing DAU training content to the CTR shall be provided.

w. Access to Contractor’s Training Content: Access to existing contractor training content that aligns with DAU course objectives shall be provided.

x. Modification Capability: The ability to modify existing training content developed by DAU and offered by the contractor shall be provided.

y. Integration with DAU LMS: Integration of the contractor’s student management system with the DAU LMS using SCORM API, including Single Sign-On (SSO) and feedback mechanisms for student completion shall be provided.

1.4 Additional System Design Features: In addition to the threshold requirements stated in paragraph 1.3, the following design features will enhance the final product design and improve DAU’s ability to achieve course objectives:

a. Over-the-Shoulder Monitoring/Interaction: Provide instructors with the ability to see student VM screens and directly interact with the VMs to assist students struggling with tasks.

b. Configurable CTF Questions/Answers: Provide DAU curriculum developers with the ability to configure CTF questions/answers with various formats and rules, including tracking answer attempts, configuring lockout attempts, regex rules for flag answers, customizable points for questions, and hint systems with customizable point penalties.

c. Team Collaboration Capability: Provide the ability to create groups within the CTR class/event for collaborative work on CTF questions and team competition.

1.5 Scope: The contractor shall provide a virtual cybersecurity training environment (range) for 300 DAU students and 10 DAU instructors annually. Services will include 200 engineering labor hours for integration and engineering support and subscriptions to the range as a service for students and DAU instructors.

1.6 Period of Performance: The period of performance shall be for one Base Year of 12 months and four 12-month option periods.

1.7 General Information

1.7.1 Quality Control The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. Problem notice reports (PNR) shall be submitted to the COR and PM per Table 7 reporting requirements.

1.7.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.7.3 Recognized Holidays:

New Year’s Day, January 1.

Martin Luther King Jr.’s Birthday, the third Monday in January.

President’s Day, the third Monday in February.

Memorial Day, the last Monday in May.

Juneteenth National Independence Day, June 19.

Independence Day, July 4.

Labor Day, the first Monday in September.

Columbus Day, the second Monday in October.

Veterans Day, November 11.

Thanksgiving Day, the fourth Thursday in November.

Christmas Day, December 25.

1.7.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 8AM to 4PM Eastern Time, US, Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.7.5 Place of Performance: The work to be performed under this contract will be performed at contractor facilities.

1.7.6 Type of Contract: The government will award a Firm Fixed Price contract for services.

1.7.7 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.7.8 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.13. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: The Government will provide engineering support as necessary to aid the contractor in integration of their student tracking system with the DAU LMS.

3.2 Facilities: None.

3.3 Utilities: None.

3.4 Equipment: None.

3.5 Materials: The Government will provide VM content where it exists in OVA format for inclusion in the courses covered under this contract.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. The contractor shall provide all necessary resources and services to host students and DAU instructors in a cyber training range.

Performance Requirements Summary

Performance Objective

Method of Surveillance

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

DELIVERABLES:

4.1 Deliverables Instructions: Copies of all written deliverables, correspondence, status reports, copies of invoices, etc., as identified in Table 1 shall be delivered to the DAU Contracting Officer’s Representative (COR). The DAU COR will provide project technical coordination with the Contractor within the scope of this PWS. The DAU COR is not authorized to change any of the terms and conditions of the contract. Changes in the scope of work will be made only by the Contracting Officer (CO) by properly executed modifications. The Contractor shall submit deliverables to DAU as electronic files in common business formats or as directed by DAU. The Contractor shall obtain approval for the format to be used for each deliverable from DAU. In general, it is expected that electronic formats accepted are: MS Microsoft Office products, such as Word, Excel, PowerPoint, Project, Access, or MS Visio. Electronic transmission will be the primary means of delivery; however, when requested by DAU hard copies shall be provided in quantities specified by DAU.

a. File Editing - All deliverables (including text and diagrams) shall be submitted in a form that is editable by DAU, unless this requirement is waived by the DAU POC.

b. Media/Format - Interim work products and deliverables shall be submitted in a media and format mutually agreed upon and approved by the DAU POC.

c. Accuracy - Deliverables shall be accurate in presentation, technical content, and adhere to accepted elements of style.

d. Clarity - Deliverables shall be clear in presentation and content. All diagrams shall be relevant to the supporting narrative and shall be easy to read and understand.

4.2 Deliverables Acceptance: Deliverables will be accepted if they are completed in accordance with the specification, schedules or other acceptance criteria stated herein and also those acceptance criteria and other requirements in contract. Deliverables will be accepted when all discrepancies, errors, or other deficiencies have been resolved to the Government's satisfaction.

Table 1

PM: Tim Kuno, tim.kuno@dau.edu

PM: Tim Kuno, tim.kuno@dau.edu

PM: Tim Kuno, tim.kuno@dau.edu

PM: Tim Kuno, tim.kuno@dau.edu

TECHNICAL EXHIBIT 3

ESTIMATED WORKLOAD DATA