Performance Work Statement .pdf

STATEMENT OF WORK

National Defense University (NDU), College of Information and Cyberspace (CIC)

Commercial Cybersecurity Training and Certification Platform

1. TITLE. Commercial Cybersecurity Training and Certification Platform

2. OBJECTIVE.

The purpose of this requirement is to procure a commercial off-the-shelf (COTS), web-based cybersecurity training and certification platform to support the educational, cyber workforce development, and operational readiness mission of the National Defense University (NDU), College of Information and Cyberspace (CIC) (NDU-CIC). The Government seeks a commercially available Software-as-a-Service (SaaS) cybersecurity training platform that provides immersive, hands-on cyber learning, realistic cyber laboratory environments, structured learning pathways, cyber range exercises, and cybersecurity certification preparation capabilities that enhance cyber workforce readiness, operational problem-solving, critical thinking, and cyber mission effectiveness. The platform shall support Joint Professional Military Education

(JPME), Department of Defense (DoD) cyber workforce development initiatives, cyber upskilling, and cyber readiness activities for authorized faculty, staff, and students through

Internet-based access to interactive cybersecurity exercises, practical laboratories, and modular cybersecurity training content.

3. BACKGROUND.

The College of Information and Cyberspace (CIC) prepares military and civilian leaders to operate effectively within the information environment and cyberspace domain through rigorous academic instruction, research, and practical application of information technology and cybersecurity principles. As cyber threats continue to evolve in complexity, sophistication, and frequency, the Department of Defense (DoD) requires a workforce capable of rapidly adapting to emerging threats, understanding adversary tactics, techniques, and procedures (TTPs), and effectively operating in contested cyberspace environments. Traditional classroom instruction alone is insufficient to fully prepare students and cyber professionals to respond to real-world cyber incidents and operational challenges.

NDU requires a scalable, commercially available, web-based cybersecurity training platform capable of delivering practical, hands-on cyber exercises aligned with modern cybersecurity operations and workforce development frameworks. The platform shall support individual and team-based learning while enabling users to build technical proficiency through realistic cyber ranges, guided learning paths, capture-the-flag (CTF) exercises, attack-and-defense scenarios, and structured cybersecurity modules.

The platform will support students enrolled in CIC educational programs, including Joint

Professional Military Education (JPME), Leadership Development Programs (LDP), graduate certificate programs, Master of Science degree programs, and distance learning programs. These programs educate senior military officers, Department of Defense civilians, federal government personnel, and other national security professionals in areas including cybersecurity, cyber leadership, cyber strategy, information technology management, information security, risk management, data analytics, emerging technologies, and cyberspace operations.

Commercial cybersecurity training platform providers offer COTS SaaS cybersecurity training environments that deliver immersive cyber learning experiences through browser-based laboratories, gamified learning, and enterprise-grade cyber simulation environments. These platforms support structured cyber learning and operational readiness through cybersecurity pathways focused on penetration testing, defensive security, digital forensics, incident response, malware analysis, web exploitation, Active Directory exploitation, reverse engineering, and related cybersecurity disciplines.

3.1. SALIENT CHARACTERISTICS OF AN EQUAL OFFERING.

To be considered, the platform shall provide, at a minimum:

(1) A contractor-hosted, browser-accessible SaaS platform that does not require Government-hosted infrastructure or integration with NDU operational networks;

(2) A twelve (12) month subscription providing a pool of twenty (20) simultaneously available seats for authorized Government users, with unrestricted reassignment among students and other authorized users throughout the subscription period, as required by Section 5.a.;

(3) Hands-on cybersecurity laboratories, realistic cyber range exercises, structured learning pathways, modular content, and capture-the-flag or equivalent scenario-based exercises;

(4) Training capabilities covering the cybersecurity disciplines identified in Section 5.b., including offensive and defensive operations, penetration testing, digital forensics, incident response, malware analysis, web exploitation, Active Directory environments, reverse engineering, and related disciplines;

(5) Individual and team-based learning activities and browser-based laboratory environments;

(6) A continuously available, administrator-accessible dashboard that provides real-time visibility into user and student access, activity, usage, progress, completion, and skill-development indicators. The dashboard shall allow authorized Government administrators and instructors to view which users are currently logged in or active, the date and time of login and logout, session duration, last activity, courses or learning paths accessed, laboratories or challenges attempted and completed, scores or performance results, completion status, and individual and group-level progression. Dashboard data shall update as user activity occurs and shall not be limited to delayed, daily, weekly, or manually prepared reports.

(7) Cybersecurity certification preparation and the certification assessment opportunities required by Section 5.c.; and

(8) Contractor-provided hosting, maintenance, updates, technical support, administrative support, and onboarding assistance throughout the applicable period of performance.

The Government may request a product demonstration, trial access, technical documentation, or other information.

4. SCOPE. The contractor shall commercial web-based cybersecurity training and certification platform subscription service, associated licensing, hosting, maintenance, technical support, administrative support, and related services necessary to support the NDU-CIC cyber education and workforce development mission.

The cyber platform shall be contractor-hosted and accessible through commercially available web browsers utilizing an Internet-based SaaS delivery model without requiring Government-hosted infrastructure, Government-managed virtualization environments, or integration into

NDU operational networks.

The contractor shall furnish all personnel, software subscriptions, licensing, hosting infrastructure, maintenance, updates, technical support, and related commercial services necessary to meet the requirements of this Statement of Work (SOW).

The Contractor shall meet or exceed every salient characteristic and mandatory performance requirement stated in this SOW.

5. PERFORMANCE REQUIREMENTS. The contractor shall:

a. Platform Access and Licensing.

(1) Provide a web-based cybersecurity training and certification platform subscription service consisting of a pool of twenty (20) seats. The twenty (20) seats may be assigned to, unassigned from, and reassigned among authorized Government users as students rotate through CIC courses and programs.

(2) Provide access to the platform for a twelve (12) month subscription period. The subscription shall include a pool of twenty (20) seats available for reassignment among authorized Government users throughout that period.

(3) Provide individual user accounts with user management and administrative capabilities.

(4) Provide Internet-accessible SaaS platform availability through current supported versions of Chromium-based browsers, Mozilla Firefox, and Apple Safari. The platform shall operate through standard HTTPS web access and shall not require browser plugins, locally installed agents, or administrative privileges beyond settings approved for Government endpoints.

(5) Provide access to cybersecurity learning modules, cyber laboratories, cyber ranges, and gamified cybersecurity exercises.

(6) The Government requires a pool of twenty (20) seats, not twenty (20) permanently named users. The Government may rotate students and other authorized users into and out of the seat pool throughout the twelve (12) month subscription period.

(7) The proposed licensing model shall provide a pool of twenty (20) seats that can be reassigned without restriction among authorized Government users as student populations and course requirements change. The contractor shall clearly identify whether the seats are concurrent, active, or otherwise limited and shall identify all applicable platform rules. A licensing model based on twenty (20) permanently named users, or that limits the total number of students who may use the twenty (20) seats during the subscription period, will not meet the requirement.

(8) The twenty (20) seats shall be fully transferable and reassignable among authorized

Government users throughout the period of performance. The contractor shall permit an unlimited number of reassignments, transfers, account substitutions, and user swaps at no additional charge and without approval, waiting periods, reassignment caps, or other administrative barriers. The Government shall be able to manage reassignment through the contractor's administrative portal or, if contractor assistance is required, the contractor shall complete each reassignment request within one (1) business day. The

Government requires this unrestricted reassignment capability to support changing student populations, course offerings, workforce development activities, Distance

Learning (DL), Joint Professional Military Education (JPME), Leadership

Development Programs (LDP), and other educational requirements throughout the subscription period.

b. Cybersecurity Training Capabilities.

The platform shall support foundational, intermediate, and advanced cybersecurity skill development for students with varying levels of technical experience. The platform should support users ranging from individuals with limited cybersecurity experience through advanced practitioners seeking to enhance technical cyber skills. Training content shall include networking fundamentals, operating systems, vulnerability identification and assessment, cyber defense, cybersecurity operations, and related technical disciplines.

The platform shall provide hands-on learning opportunities involving network mapping, network fingerprinting, vulnerability discovery, Windows and Linux operating systems, network defense concepts, and practical cybersecurity exercises designed to build technical proficiency across multiple skill levels. The platform shall provide capabilities that include, but are not limited to:

(1) Hands-on cybersecurity laboratories and realistic cyber range exercises.

(2) Structured cybersecurity learning pathways and modular training content.

(3) Interactive cybersecurity exercises supporting offensive and defensive cyber operations training.

(4) Capture-the-Flag (CTF) style exercises and scenario-based cyber problem-solving activities.

(5) Training environments supporting penetration testing, defensive security operations, digital forensics, malware analysis, web exploitation, Active

Directory exploitation, reverse engineering, and related cybersecurity disciplines.

(6) Browser -based laboratory environments accessible without requiring

Government-hosted virtualization infrastructure.

(7) Training content aligned with recognized cybersecurity frameworks and modern cyber operational practices.

(8) Continuously updated cybersecurity training content reflecting current vulnerabilities, threats, cyber techniques, and cybersecurity trends.

(9) Provide a continuously available, real-time usage and learning analytics dashboard for authorized instructors and administrators. Dashboard data shall refresh and be available to authorized Government users within five (5) minutes of a user activity event. The dashboard shall provide, at a minimum, current user presence or active-session status; user login and logout times; session duration and last activity; courses, learning paths, laboratories, challenges, and modules accessed; attempts, completions, scores, and performance results; progress and completion status; and individual, course, cohort, and group-level skill-development indicators. An active session shall mean that an authenticated user has generated a platform interaction, such as a page request, laboratory interaction, challenge attempt, or submission, within the preceding fifteen (15) minutes; login alone shall not be treated as active interaction. The dashboard shall support filtering by user, course, cohort, date, learning path, and activity type. Dashboard access shall be available twenty-four (24) hours per day, seven

(7) days per week, except for approved scheduled maintenance and temporary outages affecting the service. The contractor shall maintain dashboard data for the full subscription period. The dashboard shall provide on-demand export in

CSV or XLSX format without additional charge.

(10) The ability to support both individual and team-based cybersecurity learning activities.

c. Certifications and Learning Support.

(1) Provide access to cybersecurity certification preparation content associated with available platform certification pathways and industry-recognized cybersecurity certifications, where applicable.

(2) Provide integrated learning pathways supporting cybersecurity workforce development and technical skill progression.

The contractor shall provide cybersecurity certification preparation and assessment opportunities for all twenty (20) seats.

(3) Provide onboarding guidance, administrative support, and implementation assistance necessary to support platform adoption and user access.

d. Technical Support and Maintenance.

(1) Provide platform maintenance, software updates, and technical support throughout the period of performance.

(2) Provide customer support through a web-based support portal and email during 0800-

1700 Eastern Time, Monday through Friday, excluding Federal holidays.

The contractor shall provide a 24-hour escalation method for Severity 1 incidents affecting all or substantially all Government users or the platform dashboard.

(3) Maintain platform availability and operational functionality throughout the subscription period. The contractor shall maintain a monthly service availability of at least 99.5 percent, excluding approved scheduled maintenance. Scheduled maintenance shall be announced at least seventy-two (72) hours in advance. The availability requirement includes the Government administrator usage and learning analytics dashboard.

(4) Support severity levels and service targets shall be:

- Severity 1 - platform unavailable, dashboard unavailable to all or substantially all

Government users, or suspected compromise affecting Government Data:

acknowledge within one (1) hour, provide updates at least every four (4) hours, and restore service or provide a workaround within four (4) hours when technically feasible;

- Severity 2 - major function unavailable or materially degraded: acknowledge within four (4) business hours and provide daily updates until resolved;

- Severity 3- individual user issue or general support request: acknowledge within one (1) business day. The contractor shall provide escalation procedures and outage-notification procedures with the service activation materials.

(5) Provide planned maintenance notifications, service-status information, and contractor points of contact for technical support and escalation. The contractor shall not materially reduce service availability, dashboard functionality, or support protections during the period of performance without advance written notice to the Government.

e. Training and Administrative Support.

(1) Provide administrative orientation and/or train-the-trainer support sessions if requested by the Government.

(2) Provide user documentation, online help resources, knowledge base access, and administrative support materials associated with the platform. The contractor shall provide documentation explaining dashboard metrics, activity definitions, skill-level indicators, data-refresh behavior, filtering, and report/export functions.

(3) Provide authorized Government administrators and instructors with dashboard access credentials and role-based permissions at service activation and throughout the period of performance.

(4) For dashboard purposes, an active session means that an authenticated user has generated a platform interaction within the preceding fifteen (15) minutes, such as a page request, laboratory interaction, challenge attempt, or submission. Login alone shall not be treated as active interaction. The contractor shall identify the activity rules used to calculate session duration, active time, last activity, progress, completion, and skill-level indicators.

(5) The dashboard shall provide export capability for the Government to download usage, participation, progress, completion, performance, and skill-development data in a commonly used machine-readable format, such as CSV or XLSX, without additional charge.

(6) The contractor shall not restrict dashboard access, impose a separate reporting fee, or require a contractor-generated service request for the Government to view current user and service-usage information required by this Statement of Work.

6. SECURITY REQUIREMENTS.

The contractor shall maintain a documented information-security program appropriate to the hosted SaaS environment and the type of information processed under this requirement. The

Government will not automatically require every available security framework. The applicable security baseline and documentation shall be determined by the Contracting Officer in coordination with the designated NDU security, privacy, and information-technology officials based on the information authorized for processing.

At a minimum, the contractor shall maintain and describe administrative multi-factor authentication; encryption of Government Data in transit and at rest; role-based access control;

vulnerability and patch management; logging and monitoring; backup and recovery; personnel access controls; and security controls applicable to subcontractors, cloud providers, and other service providers.

The contractor shall disclose all subcontractors, cloud providers, hosting locations, and other third parties that may access Government Data or provide material services supporting the platform. The contractor shall maintain equivalent security and data-protection obligations for those entities.

The contractor shall protect Government user account information, credentials, activity data, and

Government Data in accordance with the requirements of this Statement of Work and shall notify the Government before any material change to the hosting arrangement, security controls, privacy policy, or subcontractor structure that could affect Government Data.

7. GOVERNMENT DATA AND PRIVACY REQUIREMENTS.

For purposes of this Statement of Work, Government Data means information provided by or on behalf of the Government or created by authorized Government users in connection with the subscription, including account and contact information, user identifiers, login and activity records, usage data, progress and completion records, performance metrics, dashboard data, reports, course assignments, user-created notes or submissions, and other Government-generated content. Government Data does not include the contractor's pre-existing platform, software, proprietary courseware, or tools.

The Government retains all rights, title, and interest in Government Data. The contractor may access and use Government Data only as necessary to provide, secure, maintain, and support the contracted service.

The contractor shall not sell, advertise against, disclose, commercialize, or use Government Data to train a commercial artificial-intelligence model, develop unrelated products, or for any other unrelated purpose without the Government's prior written authorization.

The contractor shall provide the Government with on-demand access to and export of

Government Data in a commonly used, machine-readable format, including CSV or XLSX for usage, progress, completion, performance, and dashboard data. Export shall be available to authorized Government administrators without additional charge and without requiring a contractor-generated report.

At expiration or termination, the contractor shall return or make available all Government Data designated by the Government within thirty (30) calendar days. The contractor shall maintain the data in a form that permits the Government to retrieve and use it during the transition period.

Within sixty (60) calendar days after return or availability of Government Data, the contractor shall securely delete Government Data from active systems, except for data required to be retained by law. Government Data contained in backups shall be deleted according to the contractor's documented backup-retention cycle and shall remain protected from access or use during that cycle. The contractor shall provide a written deletion certification identifying the date of deletion, systems covered, any data retained by legal requirement, the retention period, and the protections applied.

The contractor shall not disclose Government Data to subcontractors, cloud providers, or other third parties except as necessary to perform the service and only under written obligations consistent with this Statement of Work. The contractor remains responsible for the acts and omissions of those entities concerning Government Data.

7.1. SECURITY INCIDENT NOTIFICATION.

The contractor shall notify the Contracting Officer and the Government technical point of contact within twenty-four (24) hours after discovering a security incident that may affect

Government Data, Government user accounts, platform availability, or the confidentiality, integrity, or availability of the service. The initial notification may be preliminary but shall include the known facts, systems or data affected or potentially affected, time discovered, containment actions, and contractor point of contact.

The contractor shall cooperate with Government inquiries; preserve relevant logs, records, and evidence; support credential resets, containment, investigation, and recovery; provide status updates at least every twenty-four (24) hours during active response unless otherwise directed;

and submit a written incident report and corrective-action plan within ten (10) business days after containment or another period approved by the Contracting Officer.

The contractor shall not notify affected individuals, the media, or other third parties on behalf of the Government without the Government's prior written authorization, except as required by law.

The contractor shall promptly notify the Government of any legally required disclosure.

8. DELIVERABLES.

a. Administrator dashboard access, role-based permissions, and dashboard documentation: At platform activation and throughout the period of performance.

b. Real-time usage and learning analytics dashboard showing current user activity, session information, progress, completion, performance, and skill-development indicators: Continuously available throughout the period of performance.

c. Machine-readable dashboard data export capability for Government analysis and acquisition planning: Available to authorized Government administrators on demand throughout the period of performance.

Deliverable Description Due Date

Platform Access Activation of subscription accounts for authorized users

Within 10 business days after award

User Accounts Provisioning and administration of a pool of twenty (20) reassignable seats

Within 10 business days after award

Technical Support Ongoing technical support and maintenance

Throughout the Period of

Performance

Platform Updates Software updates and maintenance releases

Throughout the Period of

Performance

Administrative Support User onboarding and orientation support, if requested

As requested by the

Government

9. PERIOD OF PERFORMANCE. The period of performance shall consist of one (1) twelve-month base period, and one (1) twelve-month option period. User accounts, platform access, licensing, technical support, software updates, and all associated services shall be provided throughout the twelve-month period.

10. PLACE OF PERFORMANCE.

Government users shall access the platform remotely through Internet connectivity from authorized Government or approved remote locations.

11. GOVERNMENT FURNISHED PROPERTY/INFORMATION. (none)

12. CONTRACTOR FURNISHED ITEMS. (none)

13. ACCEPTANCE CRITERIA.

The Government shall conduct an acceptance test after activation and before acceptance of the subscription. The acceptance test shall verify, at a minimum:

a. Activation of the pool of twenty (20) seats and administrator access;

b. Unlimited seat reassignment among authorized Government users without additional charge or administrative barrier;

c. Access to representative foundational, intermediate, and advanced training paths;

d. Availability and operation of representative laboratories, cyber ranges, CTF or equivalent exercises, and individual and team functionality;

e. Dashboard visibility into current users, active sessions, login and logout times, session duration, activity, progress, completion, performance, and skill-development indicators;

f. Dashboard data refresh within five (5) minutes of a representative user activity event;

g. Dashboard filtering and on-demand CSV or XLSX data export;

h. Submission of a support ticket through the required support channel and receipt of the required acknowledgement;

i. Availability of the required cybersecurity certification preparation and assessment benefits for all twenty (20) seats;

j. Delivery of administrator documentation, security documentation, support contacts, and required onboarding materials; and

k. Compliance with the stated browser, endpoint, accessibility, and network requirements.

The Government may reject incomplete, unavailable, or nonconforming activation or deliverables. The contractor shall correct rejected items at no additional cost within the period specified by the Contracting Officer. Acceptance does not waive the Government's right to require correction of latent defects or nonconforming services discovered during the period of performance.

a. Authorized users are able to successfully access the platform.

b. Required cybersecurity training modules and laboratory environments are available and operational.

c. User management and the real-time usage and learning analytics dashboard function as required, including current user visibility, session and activity information, progress, completion, performance, skill-level indicators, filtering, and data updates without material delay.

d. Technical support and maintenance services are provided in accordance with commercial standards.

e. Deliverables are completed within required timelines.

14. POINTS OF CONTACT:

The following personnel are key Government points of contact for this requirement:

Project Manager (Department Chair)

Captain Victor Lima

College of Information and Cyberspace

Address: Bldg. 62, 300 5th Avenue, Fort Lesley J. McNair, Washington DC 20319

Telephone: 202-685-4010

Fax: (202) 685-3974

Email: victor.a.lima.mil@ndu.edu

Contracting Officer’s Technical Representative

Donna Powers

College of Information and Cyberspace

Address: Bldg. 62, 300 5th Avenue, Fort Lesley J. McNair, Washington DC 20319

Telephone: 202-685-2070

Fax: 202-685-3974

Email: PowersD3@ndu.edu

Resource Manager

Gabriela Armstrong-Santos

College of Information and Cyberspace

Address: Bldg. 62, 300 5th Avenue, Fort Lesley J. McNair, Washington DC 20319

Telephone: 202-685-3757

Fax: 202-685-3974

Email: gabriela.armstrongs.civ@ndu.edu mailto:victor.a.lima.mil@ndu.edu mailto:PowersD3@ndu.edu mailto:gabriela.armstrongs.civ@ndu.edu