Safe Travelers Course SOW_v2.pdf

CUI

Marine Forces Special Operations Command Marine Raider Regiment

Operational Cyber Security Training Statement of Work

This content is classified at the Controlled Unclassified Information level and may contain elements of controlled unclassified information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DoDI 5230.09 prior to public release.

Marine Forces Special Operations Command Marine Raider Regiment

Operational Cyber Security Training Statement of Work

1. (U) OVERVIEW:

(CUI) This Statement of Work (SOW) covers the need for a reliable and flexible Contractor to provide Operational Cyber Security Training to MARFORSOC. The MARFORSOC Marine Raider regiment (MRR) requires the following pre-deployment operational cyber security training.

a. Safe Travelers Course: The purpose of the course is to deliver a regularly scheduled training course with a focus operational cyber security on device configuration for digital data protection. See MRR required course content in paragraph 4.

2. (U) BACKGROUND:

(CUI) MARFORSOC deployments often require the use of Unmanaged Mobile Devices for both Force Protection and Operational Security. Tactics, Techniques, and Procedures to secure these devices against threats across the globe require specialized training. These training courses are designed to provide deploying personnel with the knowledge and skill to effectively secure their devices and protect themselves and their mission while abroad. This course accomplishes training individuals in the background concepts of identifying vulnerabilities seen in various situations as well as practical instruction on countering vulnerabilities through physical and digital protection measures.

3. (U) APPLICABLE DOCUMENTS:

(U) MARSOCO 2180-1A w/ Change 1 (CUI) USSOCOM 380-3 Cyber Security 11 Dec 202

(U) ECSD 005 Portable Electronics Devices Version 2.0 15 Mar 2012

(U) Joint Publication 3-13.3 Operational Security

4. (U) SCOPE OF WORK:

4.1 (CUI) MRR requires (8) iterations of the Safe Travelers Course to be run at different times throughout the year with up to (30) students per iteration. The course must contain the following:

Table 4.1 – Three Day Course of Instruction (COI) Block of Instruction COI

Day 1 COI Lesson 1.1.1:

Student and Staff Introductions

Student and Staff Introductions.

Lesson 1.1.2:

Admin (Equipment Issue, Student Share, Course Material)

Administrative issues are discussed, equipment is issued, and an instructor shows and explains the items contained within the shared folder. Printed course material is also reviewed.

Lesson 1.1.3:

Digital Device Data

Students will receive in class lectures about Digital Devices and the data stored on them.

Lesson 1.1.4:

Computer Vulnerabilities and Security

Students will receive in class lectures about the vulnerabilities to data stored on computers and how to secure/protect them.

Lesson 1.1.5 Cellular Device Vulnerabilities and Security

Students will receive in class lectures about the vulnerabilities to data stored on mobile devices and how to secure/protect them.

Lesson 1.1.6 Computer Software

Students will receive an introduction to software designed to remove, recover, or protect data.

Lesson 1.1.7 Computer Clean Up

Students are introduced to techniques used to “clean” devices and how to implement them.

Lesson 1.1.8 Data Retrieval Equipment

Students are introduced to equipment used to retrieve/locate data on digital devices and use them to identify vulnerabilities of their “clean” devices.

Lesson 1.1.9 Email Vulnerabilities

Students are introduced to the vulnerabilities of Email.

Lesson 1.1.10:

Internet Vulnerabilities / Security

Students receive in class instruction on the vulnerabilities of Internet Communications.

Lesson 1.1.11:

Wireless Networking Vulnerabilities

Students will receive in class instruction on the characteristics and vulnerabilities of wireless networking Digital Devices.

Lesson 1.1.12:

Review

Students provided opportunity to review course material with instructors.

Day 2 COI Lesson 1.2.1:

Packing

Students will receive in class instruction on travel preparation and packing with a security mindset.

Lesson 1.2.2:

Airport and Aircraft

Students receive in class instruction on security threats within the airport and aircraft.

Lesson 1.2.3:

Customs & Secondary

Students receive in class instruction on the customs process and how it can impact a traveler’s security posture.

Lesson 1.2.4:

Rental Vehicles

Students receive in class instruction on the vulnerabilities of modern-day vehicles, and how to minimize them.

Lesson 1.2.5:

Overseas Cellular

Students receive in class instruction on the security vulnerabilities of cellular communications, and how adversaries can use them against you.

Lesson 1.2.6:

Bed Down Location

Students receive in class instruction on the threat to a traveler’s BDL, and how to potentially harden it.

Lesson 1.2.7:

Pattern of Life

Students receive in class instruction on how their Pattern of Life can be targeted by an adversary, and how to minimize this threat.

Lesson 1.2.8:

Scenario Prep / Device Clean-Up

Students are given the opportunity to harden their devices in preparation of the Culminating Scenario.

Day 3 COI

Exercise 1.3.1:

Customs / Device Security

Students participate in a culminating scenario / training exercise.

Lesson 1.3.2:

Review

Students review their performance in the scenario and share lessons learned with the class.

Lesson 1.3.3:

AAR/Closeout

Students conduct an After-Action Review of the course, make recommendations, and return any gear used.

4.2 (U) Course dates will be identified in follow-on task orders which will be executed and provided to the contractor NLT 30 days prior to execution / course start date.

Contractor shall provide and is responsible for the following:

• Providing instructors with a Secret security clearance and course material. All course material must be in Microsoft Office format (e.g., .docx, .pptx, xlsx, etc.) and or .pdf files for use with Adobe Reader.

• Verifying instructor clearance and access with MARFORSOC Security Office (MARFORSOC SMO code is 209006).

• Any required lodging, travel, and other expenses for instructors.

• Providing completion certificates to all students, and an after-action report (AAR) to the lead government representative. The AAR should address any issues during the training and proposed enhancements for improvement for future courses of instruction, with an attached roster of all students who completed the training.

5.0 MARFORSOC MRR is responsible for and will provide:

• Location for instruction, within the MARFORSOC compound at Camp Lejeune, NC, to include classroom with audio visual support

• Supplying students for each course.

• Executing required Task order(s) for each training course iteration.

6.0 Security. The Contractor shall provide contract services with personnel that meet Government security requirements (Refer to the contract DD254).

• The Contractor’s instructors shall possess a current and verifiable SECRET security clearance.

• Physical Security: The Contractor shall be responsible for safeguarding all Government property provided for Contractor use. Government facilities, equipment and materials shall be secured at the end of each work period.

6.1 Base Access: Marine Corps Base Camp Lejeune has implemented the Defense Biometric Identification System (DBIDS) to facilitate a secure and efficient means of accessing the installation.

DBIDS ensures the protection of active-duty personnel, family members and civilian employees while allowing controlled access to authorized patrons, contractors, vendors, and sponsored visitors.

DoD ID card holders will automatically be enrolled in DBIDS after their first ID scan upon entering Camp Lejeune. DoD ID card holders may also sponsor visitors as outlined in the link below.

All unescorted visitors are required to obtain a DBIDS card or temporary paper pass at the Camp Lejeune Visitor Center or the Contractor Vetting Office to gain authorized access to Camp Lejeune.

Unescorted visitors must be sponsored or on official business. Visitors will have their identity validated and be issued an appropriate DBIDS credential at no cost. Visitors must obtain a DBIDS credential at the Camp Lejeune Visitor Center (Bldg. TT-13). Contractors and vendors on official business must obtain a DBIDS credential at the Contractor Vetting Office (Bldg. 818).

The Contractor Vetting Office is in Bldg. 818 adjacent to the Camp Lejeune Main Gate on Holcomb Blvd, just off N.C. Highway 24. The CVO is open Monday through Friday from 6 a.m. to 2 p.m. and closed on weekends and holidays.

Contractor Vetting Office - Appointments: 910-451-8558

Contractor Vetting Office - Questions: 910-451-3220

Taxi Vetting: 910-449-4208

Email: lejeunecontractorvetting@usmc.mil

Contractors approved for access will receive either a DBIDS credential or temporary pass, depending upon the length of time they require access to the installation. A DBIDS credential is issued to individuals requiring access for 61 days or more. A temporary pass is issued to individuals requiring access for 60 days or less. Contract specifications determine the length of pass.

Contractors will report to the Contractor Vetting Office (CVO) to confirm their access requirements, undergo a background check, and receive their credential/pass. More information can be found at https://www.lejeune.marines.mil/Base- Access/#:~:text=All%20unescorted%20visitors%20are%20required%20to%20obtain%20a,visitors%2 0must%20be%20sponsored%20or%20on%20official%20business.

*PLEASE NOTE: Individuals with active warrants may be subject to arrest on the spot. *

7.0 Enterprise Contractor Manpower Reporting Application (ECMRA): The Enterprise Contractor Manpower Reporting Application (ECMRA) is designed to collect information on funding source, contracting vehicle, organization supported, mission and function performed, and labor hours and costs for contracted efforts providing services to the Department of Defense (DOD) from contractors and DOD activities requiring contracted services from supporting contracting offices.