PWS ACIT_Fort Gordon.docx

PERFORMANCE WORK STATEMENT (PWS)

For

United States Army Cyber School Advanced Cyber Industry Training (ACIT)

Period of Performance:

21 January 2026 – 20 January 2029

For

United States Army Cyber School U.S. Army Cyber Center of Excellence (CCoE) Fort Gordon, Georgia 30905-5000

Part 1 General Information:

1. General: This is a non-personal services contract to provide training instruction to the US Army Cyber School, Cyber Center of Excellence (CCoE), Fort Gordon, Georgia. This effort will support training students for the Army’s Advanced Cyber Operations- Academics (ACO-A) functional course, 170A Cyber Warfare Technician WOIC (170A WOIC) and 170A Cyber Warfare Technician WOAC (Follow-On) (170A WOAC) courses, US Army Cyber School, Cyber Center of Excellence (CCoE), Fort Gordon, Georgia. This effort will support training for the Army’s new Cyber Branch. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction: This requirement is to provide the U.S. Army Cyber School with three iterations of eight SANS courses (SEC560, SEC542, SEC580, SEC565, SEC599, SEC660, FOR508, SEC699), six GIACs (GPEN, GWAPT, GDAT, GCFA, GXPN, and GRTP) for the ACO-A functional course, two (2) iterations of 170A Cyber Operations Technician WOAC & 170A Cyber Warfare Technician WOIC courses (SEC588, FOR508 and FOR572), three GIACs (GCFA, GNFA and GCFR). This will also provide the U.S. Army Cyber School with two practice tests for each GIAC over the base performance period of 12 months and the option years.

1.2 Background: The Cyber School was established to provide trained 17 series personnel (17A, 17C, and 170A) that support the Army’s Cyberspace Operations across USCYBERCOM, ARCYBER, and Cyber Protection Brigade missions. As such, USCYBERCOM has required The Cyber School to conduct the curriculum developed by USCYBERCOM for Cyberspace Operators at the Senior certification level.

1.3 Objectives: This effort shall provide technical training support for the USACyS at Fort Gordon, Georgia. Support shall include Advanced Cyber Operations-Academics (ACO-A) functional course, 170A Cyber Warfare Technician WOIC (170A WOIC) and 170A Cyber Warfare Technician WOAC (Follow-On) (170A WOAC) courses. Contractor personnel shall always demonstrate model behavior and professionalism. Support will be conducted at a clearance up to TOP SECRET//SCI//REL TO USA, FVEY.

1.4 Scope: Provide technical instructional support executing the ACO-A functional course and 170A WOIC & 170A WOAC courses. The Government will procure Commercial-of-the-Shelf (COTS) courses identified in Section 3.1 of this PWS. The Government may also procure COTS offerings of all the Contractor’s courses featuring a SANS course designator of 500 or above (i.e. Intermediate and Advanced Courses). Contractor personnel shall always demonstrate model behavior and professionalism.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months, 2 (two) 12- month option years. The Period of Performance reads as follows:

Option Year II 21 January 2028 – 20 January 2029

1.6 General Information:

1.6.1 Quality Control: Quality Control is the responsibility of the contractor (see FAR 52.246-1, Contractor Inspection Requirements). The Contractor shall develop, implement, and maintain an effective Quality Control System which includes a written Quality Control Plan (QCP). The QCP shall implement standardized procedure/methodology for monitoring and documenting task order performance to ensure all task order requirements are met. The Contractors' QCP shall contain a systematic approach to monitor operations to ensure acceptable services/products are provided to the Government. The QCP, at a minimum, shall address continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification and correction; corrective action procedures to include procedures for addressing Government discovered non-conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints. The initial QCP shall be delivered with the contractor’s proposal. After award, the final QCP shall be delivered within 30 days of start date and within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the QCP.

1.6.2 Quality Assurance: The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government shall do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the maximum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not expected to perform services on the following federal holidays:

1.6.4 Hours of Operation: The contractor is responsible for conducting business between the hours of 0800 to 1700 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. Shift work may be required. Anticipated shift schedule is as follows:

Day Shift 0800-1700 Swing Shift 1530-0030 Midnight Shift 2300-0800

1.6.5 Place of Performance: Contractors shall continue to meet tasks, deliverables, and current level of support in accordance with contract at designated Cyber School facility. Personal or company issued equipment may not be used to access the government network infrastructure unless pre-approved; examples include using VPN or a corporate network.

1.6.6 Type of Contract: The government will award a firm fixed price contract.

1.6.7 Security Requirements: Contractor employees performing on this task order shall be U.S. citizens. At task order start date, unless otherwise noted in this PWS, contractor instructor/writers and range developers shall possess a final Top Secret Security Clearance with SCI eligibility (TS//SCI). A waiver will be considered on a case-by-case basis, which vendor may submit candidates with a Secret Security Clearance pending a Top Secret Security Clearance with SCI eligibility (TS/SCI). Vendor will state plan and timeframe for Top Secret Clearance to become adjudicated and take full responsibility to finalize all security requirements IAW the PWS. All contractor employees shall maintain the required security clearance throughout the life of the task order. Failure, inability, or delay in obtaining the appropriate clearance shall not relieve the contractor from performance under the terms of this task order. Additionally, all contractor personnel are required to in-process the CCoE G2 within 10 business days.

The contractor is responsible for acquiring the clearances. The contractor shall ensure that all assigned personnel understand applicable security policies and directives found in DOD 5220.22-M, National Industry Security Program Operating Manual (NISPOM); AR 380-5, Information Security Program, and all other applicable policies and regulations.

The contractor shall ensure that classified data is controlled, protected, and safeguarded in accordance with current Army and DOD policy. Classified information shall be accessed and stored in government spaces only. The contractor shall agree that any data furnished by the government to the contractor shall be used only for performance under this PWS, and all copies of such data shall be returned to the government upon completion of this effort.

The contractor Facility Security Officer (FSO) shall ensure there is a procedure for all terminated employees to out process the CCoE G2. Compliance with DD Form 254, Department of Defense Contract Security Classification Specification, is required.

The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret" and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M. Any adverse action preventing a contractor from retaining access to classified material must be brought to the attention of the COR and contractor Facility Security Officer (FSO) immediately.

1.6.7.1 Handling/Access to Classified Information: The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret" and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M.

Any adverse action preventing a contractor from retaining access to classified material shall be brought to the attention of the COR, Security Office, and contractor Facility Security Officer (FSO) immediately.

1.6.7.2 Information Assurance (IA)/Information Technology (IT) Training: All contractor employees and associated subcontractors shall complete the DoD Cyber Awareness Challenge Training (https://cs.signal.army.mil/) before issuance of network access and annually thereafter. All contractor employees will successfully complete all required IA training as specified in AR 25-2 and as directed by the Government

1.6.7.3 Information Assurance (IA)/Information Technology (IT) Certification: Per DoD 8140/8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8140/8570.01-M shall be completed upon contract award. (Cyber Awareness Training)

1.6.7.4 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information, and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured. In some cases, as determined by the contracting officer’s representative (COR), contractors shall be required to sign for government provided equipment.

1.6.7.5 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.6 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re- keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.7 Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.7.8 Antiterrorism (AT) Level I Training: All contractor employees assigned to this task order shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty (monthly briefings are offered by the Garrison Antiterrorism Officer). Annual refresher Antiterrorism Level I Training shall be completed on-line at https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee to the COR and unit/activity security manager (Ref. Department of the Army, US Army Contracting Agency, SFCA-CO, 05 Sep 07, subject: Incorporation of Measures into the Contracting Process and AR 525-13, Antiterrorism). Note: Contractor personnel shall receive an AOR briefing when traveling OCONUS on TDY. Briefing must be provided by a certified ATO Level II Officer within 7 working days prior to TDY departure outside the 50 United States, its territories, and possessions. This is separate from the normal annual AT Level I training requirement (Ref AR 525-13).

1.6.7.9 iWATCH: All Contractor employees, including subcontractors, assigned to this contract shall receive a brief on the local iWATCH program (provided in conjunction with the AT Level I Training). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within thirty (30) days of reporting to duty and annual refresher training with the results reported to the COR.

1.6.7.10 Operation Security (OPSEC) Training: All contractor employees assigned to this task order shall complete Level I OPSEC training within 30 days of reporting for duty and then annually thereafter. Initial Level 1 OPSEC training will be conducted monthly by the Garrison OPSEC Officer or a Level II certified OPSEC Officer. Annual refresher training shall be completed on-line at https://securityawareness.usalearning.gov/opsec/index.htm. The contractor shall submit certificates of completion for each affected contractor employee to the COR and unit/activity security manager. OPSEC training guidelines are contained in AR 530-1, Operations Security. The contractor shall adhere to local OPSEC policies and procedures of the government requiring activity. When in a TDY status in support of this work effort, the contractor shall also adhere to any OPSEC policies and procedures in effect at TDY locations.

1.6.7.11 Threat Awareness and Reporting Program (TARP) Training: All Contractor employees, including subcontractors, assigned to this contract shall complete TARP training within thirty (30) days of reporting for duty and then annually thereafter. TARP training will be conducted monthly by the 902nd MI Group. The COR will ensure Contractors are notified of available training. Completion of training shall be reported to the COR and the unit/activity security manager (Ref AR 381-12).

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government

1.6.10 Contracting Officer Representative (COR): The COR shall be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, and specifications; monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property; and, provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The contractor shall provide a point of contract responsible for the performance of the work. The point of contact shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The point of contract or alternate shall be available between 8:00 a.m. to 5:00 p.m., Monday thru Friday, except Federal holidays or when the government facility is closed for administrative reasons.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.13 Supervision of Contractors Employees: The Government will not exercise any supervision or control over Contractor or subcontractor employees while performing work under the contract. Such employees shall be accountable solely to the Contractor, not the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or subcontractor employees.

1.6.14 Contractor Travel: Not Applicable.

1.6.15 Other Direct Costs: Not Applicable.

1.6.16 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government will be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.17 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilateral determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.18. PHASE IN /PHASE OUT PERIOD: Not Applicable.

PART 2 DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1 DEFINITIONS:

2.1.1. CONTRACTOR: A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER: A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DELIVERABLE: Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.5. KEY PERSONNEL: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6. PHYSICAL SECURITY: Actions that prevent the loss or damage of Government property.

2.1.7. QUALITY ASSURANCE: The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.9. QUALITY CONTROL: All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10. SUBCONTRACTOR: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.11. WORK DAY: The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK: Monday through Friday, unless specified otherwise.

2.1.13.

2.2 ACRONYMS:

Supplement

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Government-Furnished Resources: All Government-furnished property will be provided in accordance with FAR 52.245-1, and FAR 52.245-9, and may include: office/work space, office supplies, telephone service, computer access, and storage space. Government property shall be used ONLY in performance of this contract and its deliverables. The contractor shall account for all property provided by the Government and shall be responsible for the security and condition of said property. Serialized items shall be annotated at the time of issue, with a signature of acknowledgement by the individual contractors. All GFP is the property of the US Government and shall not be transferred to any individual, or agency, public or private without the express written approval of the Contracting Officer.

3.2 Facilities: The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

3.3 Utilities: The Government will provide electricity, water, phone service, and network services (NIPRNET, SIPRNET, JWICS, and DSN). The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.4 Equipment: The Government will provide contractor personnel computer equipment, other data collection equipment/software, telephones, and monitors. The contractor shall have access to printers, plotters, copy machines, scanners and fax machines as needed. The contractor shall be responsible for any loss or destruction of or damage to items of Government property that are removed from the installation premises by the contractor – with or without Government approval.

3.5 Materials: Not applicable

3.6

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Top Secret/Sensitive Compartmented Information (TS/SCI) Facility Clearance: The contractor shall possess and maintain a Top-Secret Clearance from the Defense Security Service. Contractor employees performing on this contract shall be U.S. citizens. Contractor employees, to include subcontractors, shall possess and maintain a Top-Secret Security Clearance w/ SCI eligibility. The DD 254 is provided.

4.3 Materials. The Contractor shall provide–except for property and services specified as government furnished– all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, other items and non- personal services essential to production environment support necessary to meet the requirements under this PWS.

4.4 Training / Certification: The contractor shall provide, within the specified timeframe, proof of required employee training and/or certifications described under Part 1.

4.5 Contract Management: The contractor shall provide all management, administration, security, quality control, and all else required to ensure successful completion of all deliverables.

4.6 Personnel: The contractor shall furnish adequate supervision, including a program manager and the labor necessary to perform all services in an orderly, timely, and efficient manner. The contractor shall utilize qualified and experienced employees capable of achieving the goals established in the contract. All personnel shall maintain current qualifications and clearances and obtain any and all training required to meet mission requirements. Contractor personnel are employees of the contractor and under its administrative control and supervision. The contractor through its personnel shall perform tasks herein. Contractor shall select, supervise, and exercise control and direction over the employees under this contract. The Government will not exercise any supervision or control over the contractor employees in its performance of contractual services under this contract. The contractor shall ensure that no prohibited personal services are performed under this contract.

4.7 Service Contract Information: Non-Personal Services. The Government and the Contractor understand and agree that the work described in this contract is a "Non-personal Services Contract" as defined in FAR Part 37.101.Therefore, it is further understood and agreed that the Contractor and/or the Contractor's employees:

Shall perform the services described herein as independent contractors, not as employees of the Government.

Shall NOT be placed in a position where they are under the supervision, direction or evaluation of a federal employee, military or civilian, but shall, pursuant to the Government's right to inspect, accept or reject work, comply with such general direction of the Contracting Officer or the duly appointed representative of the Contracting Officer as is necessary to ensure completion of the contract objectives. Shall NOT be placed in a position of command, supervision administration or control over DA military civilian personnel or personnel of other contractors, or become part of the Government organization.

Further as this contract does not create an employer-employee relationship, the entitlements and benefits applicable to such relationships do NOT apply. Such include, but are not limited to, federal income tax withholding, Federal Insurance Contributions Act (FICA), unemployment compensation and workman's compensation benefits by virtue of this contract. Work Force: The successful bidder shall not hire persons not legally residing in the United States of America.

5. Specific Tasks:

PART 5 SPECIFIC TASKS

5.1. Basic Services: The contractor shall provide contractor staff management, instruction, and subject matter expertise, in accordance with (IAW) this PWS.

5.2. Program Management: The contractor shall provide complete program management and administrative tasks to ensure the requirements of the contract are met and to ensure the contractor adequately controls and supervises its personnel who provide the deliverables described within this PWS. The contractor shall provide all necessary personnel, administrative, financial, and managerial resources required to support this contract. The contractor shall also be responsible for the following:

· Shall supervise, coordinate work schedules, resolve minor concerns/issues and complete the administrative tasks associated with this PWS (e.g. deliverables).

· Be familiar with all duties and qualifications stated in the PWS under sections 1.6.8 and Part 5.

· Have the capability and authority to resolve and respond to issues directly with the COR.

· Be able to communicate orally and written with COR.

· Provide project coordination and process improvements thru the Quality Control Plan.

5.3. Training Support: All personnel shall develop government owned training, provide classroom support, participate in operational tests, training material validation, and provide effective training IAW established programs of instruction (POI), the Master Training Plan (MTP), Army Learning Concept (ALC) 2015, USCYBERCOM J7, National Cryptologic Training System (NSA standards per DoDI 3305.09), and DoD Cybersecurity Workforce Framework (i.e. DoD 8570 or 8140) training standards, and the requirements and deliverables of this acquisition. The contractor shall:

· Coordinate all efforts with the COR.

· Perform services at Fort Gordon and other locations determined by training requirements and events; and perform training, receive training, attend workshops, present at conferences, or assess training events as determined by this PWS and the COR.

· Collaborate with current government personnel to establish acceptable training practices and student evaluation criteria.

· Periodically review classroom training materials such as student handouts, lesson plans, slides, and practical exercises for accuracy and adequacy.

· To maintain currency of the courseware and materials, the contractor shall obtain and record information regarding modification requirements gleaned from attendance at local meetings and conferences. The COR will identify the meeting location, security requirements, and method of documentation. Contract personnel shall submit all meeting/conference notes, handouts, and material obtained no later than (NLT) five (5) days after meeting/conference. All course content shall be created, edited, updated, and stored in the official Cyber School version control system. Having content stored in any other location or serving content to students that isn't pulled directly from Cyber School version control is not authorized. All course content that would normally be served as word documents, PowerPoint slides, PDFs, or similar content types shall be stored using the doc markup language as flat text files. Binary files (beyond those required for student exercises, e.g. precompiled programs) are not to be used.

5.4. Provide Classroom Instruction: To train an effective workforce for the Army Cyber Mission Forces (CMF), instructors shall provide a learner-centric learning environment as per TRADOC Pam 525-8-2 paragraph 3-5 (dated 20 January 2011). Instructors curate course material in a manner that encourages students to think creatively to solve complex problems which the students have never seen before. Instructors will refrain from using primarily static teaching methodologies that rely on presentation software. They will instead use dynamic techniques that engage students and encourage them to challenge common definitions of cyber and its potential battlespace effects. Specific requirements may change over the life of this work statement and instructors may need to adjust to incorporate in-scope changes. The contractor shall be responsible for the following:

· Foster a mentality of aggressive self-development

· Deliver approved instruction to students for each lesson via interactive synchronous and asynchronous learning activities.

· Maintain established classroom security requirements and procedures as prescribed in TRADOC Pamphlet 350-70-4, FG policies and CCoE SOPs. All issues shall be reported to the COR or TPOC as soon as identified.

· Maintain and report student attendance, academic records, and statistics to the COR or Cyber School leadership IAW Fort Gordon Regulation 350-5 and CCoE SOPs.

· Provide students with evaluation forms; administer and enforce test control standards; conduct assessments and testing in subjects taught; grade exams; evaluate results; record exam results; conduct AARs; and administer student course critiques. Develop tests associated with the new curriculum. The tests shall be performance-based and/or criterion- referenced. Tests are controlled and sensitive materials.

· Monitor and control entry and exit point(s) for a designated Testing facility or location.

· Maintain classroom conditions IAW Cyber School SOP.

· Train operationally relevant concepts and skill that focus on the following topics:

a. Course: SEC 560 - Enterprise Penetration Testing Certification: GIAC Penetration Tester (GPEN) Learning Outcome/TLO: Learn how to plan, prepare, and execute a penetration test in a modern enterprise.

· Perform detailed reconnaissance to aid in social engineering, phishing, and making well-informed attack decisions

· Scan target networks using best-of-breed tools to identify systems and targets that other tools and techniques may have missed

· Perform safe and effective password guessing to gain initial access to the target environment, or to move deeper into the network

· Exploit target systems in multiple ways to gain access and measure real business risk

· Execute extensive post-exploitation to move further into the network

· Use privilege escalation techniques to elevate access on Windows or Linux systems, or the Microsoft Windows domain

· Perform internal reconnaissance and situational awareness tasks to identify additional targets and attack paths

· Execute lateral movement and pivoting to further extend access to the organization and identify risks missed by surface scans

· Crack passwords using modern tools and techniques to extend or escalate access

· Use multiple Command and Control (C2, C&C) frameworks to manage and pillage compromised hosts

· Attack the Microsoft Windows domain used by most organizations

· Execute multiple Kerberos attacks, including Kerberoasting, Golden Ticket, and Silver Ticket attacks

· Conduct Azure reconnaissance

· Execute Azure Active Directory (AD) password spray attacks

· Execute commands in Azure using compromised credentials

· Develop and deliver high-quality reports

b. Course: SEC 542 - Web App Penetration Testing and Ethical Hacking Certification: GIAC Web Application Penetration Tester (GWAPT) Learning Outcome/TLO: Understand common web application flaws, as well as how to identify and exploit them with the intent of demonstrating the potential business impact.

· Apply OWASP's methodology to your web application penetration tests to ensure they are consistent, reproducible, rigorous, and under quality control

· Analyze the results from automated web testing tools to validate findings, determine their business impact, and eliminate false positives

· Manually discover key web application flaws

· Use Python to create testing and exploitation scripts during a penetration test

· Discover and exploit SQL Injection flaws to determine true risk to the victim organization

· Understand and exploit insecure deserialization vulnerabilities with ysoserial and similar tools

· Create configurations and test payloads within other web attacks

· Fuzz potential inputs for injection attacks with ZAP, BurP'S Intruder and ffuf

· Explain the impact of exploitation of web application flaws

· Analyze traffic between the client and the server application using tools such as the Zed Attack Proxy and BurpSuite Pro to find security issues within the client-side application code

· Manually discover and exploit Cross-Site Request Forgery (CSRF) attacks

· Manually discover and exploit Server-Side Request Forgery (SSRF) attacks

· Use the Browser Exploitation Framework (BeEF) to hook victim browsers, attack client software and the network, and evaluate the potential impact that XSS flaws have within an application

· Use the Nuclei tool to perform scans of target web sites/servers

· Perform two complete web penetration tests, one during the five sections of course instruction, and the other during the Capture the Flag exercise

c. Course: SEC 580 - Metasploit for Enterprise Penetration Testing Certification: None Learning Outcome/TLO: Learn how to apply the capabilities of the Metasploit Framework in a comprehensive penetration testing and vulnerability assessment regimen, and according to a thorough methodology for performing effective tests.

· Guided Overview of Metasploit's Architecture and Components

· Deep Dive into the MSF console Interface, including Logging and Session Manipulation

· Careful and Effective Exploitation

· The Ultimate Payload: The Metasploit Meterpreter In-Depth

· Metasploit's Integration into a Professional Testing Methodology

· Automation with Meterpreter Scripts to Achieve More in Less Time with Consistency

· Using Metasploit as a Recon Tool

· Using Auxiliary Modules to Enhance your Testing

· Ultra-Stealthy Techniques for Bypassing Anti-Virus Tools

· Client-Side Attacks - Using One-Liners instead of Executables

· Port and Vulnerability Scanning with Metasploit, Including Integration with Nmap, Nessus, and Qualys

· Capturing SMB Credentials and Metasploit's awesome PowerShell integration

· Merciless Pivoting: Routing Through Exploited Systems

· Exposing Metasploit's Routing Using SOCKS Proxies

· Privilege Escalation Attacks

· Metasploit's Integration with Other Tools

· Making the Most of Windows Payloads

· Advanced Pillaging - Gathering Useful Data from Compromised Machines

· Evading Countermeasures to Mimic Sophisticated Attackers

· Scripting Up the Meterpreter to Customize Your Own Attacks

· Persisting Inside an Environment

· Carefully Examining Your Attack's Forensic Artifacts

· Integration with CrackMapExec, a Stand-alone Testing Tool

· Command and Control via Third-Party Infrastructure

d. Course: SEC 565 - Red Team Operations and Adversary Emulation Certification: GIAC Red Team Professional Certification (GRTP) Learning Outcome/TLO: Learn how to plan and execute end-to-end Red Teaming engagements that leverage adversary emulation, including the skills to organize a Red Team, consume threat intelligence to map against adversary tactics, techniques, and procedures (TTPs), emulate those TTPs, report and analyze the results of the Red Team engagement, and ultimately improve the overall security posture of the organization.

· Use threat intelligence to study adversaries for emulation

· Build an adversary emulation plan

· Map actions to MITRE® ATT&CK™ to aid in communicating with the Blue Team

· Establish resilient, advanced C2 infrastructure

· Maintain operational security throughout an engagement

· Leverage initial access to elevate and propagate through a network

· Enumerate and attack Active Directory

· Collect and exfiltrate sensitive data in a safe manner

· Close an engagement, deliver value, and plan for retesting

e. Course: SEC 599 - Defeating Advanced Adversaries-Purple Team Tactics & Kill Chain Defenses Certification: GIAC Defending Advanced Threats (GDAT) Learning Outcome/TLO: Learn security controls aimed at stopping, detecting, and responding to your adversaries through a purple team strategy.

· Leveraging MITRE ATT&CK as a "common language" in the organization

· Building your own Cuckoo sandbox solution to analyze payloads

· Developing effective group policies to improve script execution (including PowerShell, Windows Script Host, VBA, HTA, etc.)

· Highlighting key bypass strategies for script controls (Unmanaged Powershell, AMSI bypasses, etc.)

· Stopping 0-day exploits using ExploitGuard and application whitelisting

· Highlighting key bypass strategies in application whitelisting (focus on AppLocker)

· Detecting and preventing malware persistence

· Leveraging the Elastic stack as a central log analysis solution

· Detecting and preventing lateral movement through Sysmon, Windows event monitoring, and group policies

· Blocking and detecting command and control through network traffic analysis

· Leveraging threat intelligence to improve your security posture

f. Course: SEC 660 - Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Certification: GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) Learning Outcome/TLO: Learn how to model the abilities of an advanced attacker to find significant flaws in a target environment and demonstrate the business risk associated with these flaws.

· Perform fuzz testing to enhance your company's SDL process

· Exploit network devices and assess network application protocols

· Escape from restricted environments on Linux and Windows

· Test cryptographic implementations

· Model the techniques used by attackers to perform 0-day vulnerability discovery and exploit development

· Develop more accurate quantitative and qualitative risk assessments through validation

· Demonstrate the needs and effects of leveraging modern exploit mitigation controls

· Reverse-engineer vulnerable code to write custom exploits

· Exploit routing protocol implementations such as OSPF

· Bypass different types of NAC implementations

· Exploit patch updates

· Perform man-in-the-middle attacks to remove SSL

· Perform IPv6 attacks

· Exploit poor cryptographic implementations using CBC bit flipping attacks and hash length extension attacks

· Hijack network booting environments

· Exploit virtualization implementations

· Write Python scripts to automate testing

· Write fuzzers to trigger bugs in software

· Reverse-engineer applications to locate code paths and identify potential exploitable bugs

· Debug Linux applications

· Debug Windows applications

· Write exploits against buffer overflow vulnerabilities

· Bypass exploit mitigations such as ASLR, DEP, stack canaries, SafeSEH, etc

· Use ROP to bypass or disable security controls

g. Course: FOR 508 - Advanced Incident Response, Threat Hunting, and Digital Forensics Certification: GIAC Certified Forensic Analyst (GCFA) Learning Outcome/TLO: Learn advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.

· Understand attacker tradecraft to perform compromise assessments

· Detect how and when a breach occurred

· Quickly identify compromised and infected systems

· Perform damage assessments and determine what was read, stolen, or changed

· Contain and remediate incidents of all types

· Track adversaries and develop threat intelligence to scope a network

· Hunt down additional breaches using knowledge of adversary techniques

· Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents

· Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment

· Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell, Velociraptor, and the SIFT Workstation

· Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue

· Determine how the breach occurred by identifying the root cause, the beachhead systems and initial attack mechanisms

· Identify living off the land techniques, including malicious use of PowerShell and WMI

· Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with living off the land techniques used to move in the network and maintain an attacker's presence

· Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more

· Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis

· Recover data cleared using anti-forensics techniques via Volume Shadow Copy/Restore Point analysis

· Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection

· Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment

· Track data movement as attackers collect critical data and shift it to exfiltration collection points

· Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis and artifact carving

· Use collected data to perform effective remediation across the entire enterprise

· Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects

h. Course: SEC 699 - Purple Team Tactics-Adversary Emulation for Breach Prevention & Detection Certification: None Learning Outcome/TLO: Learn how adversarial techniques can be emulated and detected.

· A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button

· Building a proper process, tooling, and planning for purple teaming

· Building adversary emulation plans that mimic real-life threat actors such as APT-28, APT-34, and Turla in order to execute these plans using tools such as Covenant and Caldera

· In-depth techniques such as Kerberos Delegation attacks, Attack Surface Reduction / Applocker bypasses, AMSI, Process Injection, COM Object Hi-jacking and many more...

· SIGMA rule-building to detect the above techniques

i. Course: SEC 588 – Cloud Penetration Testing Certification: GIAC Certified Forensics Responder (GCFR) Learning Outcome/TLO: Learn how to teach you how to assess and report on the…