SOW CART Training - Draft 2.27.24.pdf

Version 1.0 Page 1

FEDERAL BUREAU OF INVESTIGATION

FINANCE DIVISION | PROCUREMENT SECTION

Digital Evidence Staffing Education and Development (DESED) Unit

Digital Evidence Laboratory (DEL) Training Program Services

For the

Operational Technology Division

Statement of Work

1/24/2024

Version 1.0 Page 2

Table of Contents

STATEMENT OF WORK

1 Introduction

1.1 Background

1.2 Scope

1.3 Objectives

2 Requirements and Responsibilities

2.1 Requirements Objectives and Task Descriptions

2.1.1 Overall Requirements ............................................................ Error! Bookmark not defined.

3 Place of Performance

4 Period of Performance

5 Hours of operation

6 Deliverables

7 Government Furnished Equipment or Information

7.1 Key Personnel/Administration

8 Security Requirements

9 Government Representatives ................................................................ Error! Bookmark not defined.

9.1 Contracting Officer Representative

9.2 Contracting Officer

10 Travel

Version 1.0 Page 3

FEDERAL BUREAU OF INVESTIGATION

STATEMENT OF WORK

1 Introduction

1.1 Background

Operational Technology Division (OTD) and Digital Evidence Staffing Education and Development (DESED) are responsible for the program management of both Digital Evidence Laboratory (DEL) Training for Digital Forensic Examiners (DFE), and Digital Forensic Specialist (DFS) in the Computer Analysis Response Team (CART) and the sponsored Digital Evidence Extraction Technician (DExT) program. One of the critical items that DESED provides as program management is the training of participants in digital forensics. The hands-on course provides students with the knowledge and skills necessary to effectively use forensic software tools. These tools include Forensic ToolKit (FTK) Lab, Registry Viewer, FTK Imager and Password Recovery Toolkit, as well as other custom tools that have been tested and validated by OTD. These forensic tools are vetted and on the “approved use” list for digital forensic examiners to use throughout the field. New DFEs and Agents in the DExT sponsor program must be trained in the use of these tools.

1.2 Scope

This is a contract to provide custom specialized training to the Federal Bureau of Investigation (FBI) (OTD) Division (DESED). This customed training is for CART Basic Tools, Intermediate OS Artifacts, and Intermediate Web Artifacts. The FBI is not asking to work with a vendor on developing a training program or pay to have one created. The intent of this contract is for a proven well established training program. This is a non-personal services contract. The Government shall not exercise any supervision or control over contractor employees performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.3 Objectives

To hold a minimum of Nine (9) custom specialized training sessions for DFEs for up to 25 students. There may be a need for additional classes during the fiscal year. There is a possibility to have an advance training class online for 300-400 previously certified examiners when the software company forensic tools have additional feature upgrades. An attendance roster and skills test assessment results with certificates of completion provided based on testing results.

These assessments will detail strengths and weaknesses of each student.

Version 1.0 Page 4

2 Requirements and Responsibilities One “dry run” quality review of the course prior to implementation into the student curriculum will be required for any new vendors. Dry run will occur in one of the FBI training facilities in Huntsville, AL and should be executed as near to student-delivery as possible. The dry run will afford government review of content and delivery to ensure training meets all requirements. As part of this solicitation, the vendors shall provide a sample class module with objectives. Once contract is awarded the vendor shall provide the full class module with objectives (to be determined at kickoff meeting) for the government to provide feedback on necessary updates.

2.1 Requirements Objectives and Task Descriptions

CART Basic Tools (3 days, Week 1, Mon – Wed) The course will provide CART Digital Forensic Examiners with an understanding of how FTK Lab and other tools are used to address the needs of the FBI Special Agent or RCFL task force participants while conducting digital investigations. The course will provide three (3) days of hands-on foundation for intelligent use of Exterro forensic products to include: FTK Lab, Registry Viewer, FTK Imager and Password Recovery Toolkit (PRTK), as set forth by the CART Digital Forensic Examiner training program requirements. The class will provide an understanding of how FTK Lab software interacts and processes the parsing of data for API Integration, PhotoDNA, Explicit Image Detection, Volatile data processing, Foreign Language translation, Cassandra Database Server, and the use of a Known File Filter (KFF). Students will create cases using FTK Lab, by understanding the network license service management, license manager and WiBu Codemeter configurations for the application to maximize its utilization within the network. Students will learn evidence acquisition concepts and how to validate the data collected. The course will cover in-depth use of these tools and forensic techniques such as data filtering, keyword or index searching, data decryption, hash analysis, data carving and export, and creation of reports relating to examination findings. The course will conclude with a comprehensive skills exercise where students will demonstrate their new foundational knowledge.

CART Intermediate OS Artifacts (3 days, Week 1, Thu – Sat) This course will provide CART Digital Forensic Examiners with three (3) days of focused instruction to locate and identify forensic artifacts from the Windows Operating System utilizing Exterro FTK Lab, FTK Imager, Registry Viewer, Sanderson Forensics tools, Eric Zimmerman tools, along with other relevant industry standard tools to compare and validate results with the Exterro products. Focus will be the integration into the FBI CART infrastructure along with the CART specific tools for case creation and examination. This course will use a live running system for analysis in several modules, which will give students useful repetition in creating cases, examining evidence, exporting data, and creating reports. The course will also cover techniques such as regular expressions, forensic data extraction from the Windows Registry as well as advanced Registry Scripting and Reporting. Specialized material and exercises will include Link file, Jumpfile, Version 1.0 Page 5

Prefetch analysis, USB tracking, Event log timelines and the examination of the Volume Shadow Copy files.

CART Intermediate Web Artifacts (3 days, Week 2, Mon – Wed) This course will provide CART Digital Forensic Examiners with three (3) days of focused instruction to locate and identify forensic artifacts associated with common Internet web browsers, cloud-based storage such as Google Drive and Dropbox, SQLite databases, and recovering stored logon credentials and browser form data. The course will utilize Exterro FTK Lab and PRTK, Axiom, Sanderson Forensics tools, along with other relevant industry standard tools to discover relevant Internet artifacts. Focus will be the integration into the FBI CART infrastructure along with the CART specific tools for case creation and examination. The course will further explore the relevance and examination of Volume Shadow Copy files as they pertain to discovery of Internet activity and artifacts.

Testing (1 day, Week 2) An online test to measure skills will be provided with a minimum of 50 questions and expected to be completed within 8 hours to include onsite instructor oversight throughout.

Computer Learning Environment a Virtual Microsoft Windows 10/11 classroom image containing all fully licensed software to include Exterro FTK Lab with collaborative review, LDAP authentication, accessing the API key and usage, image-identification and content filtering, OCR, Foreign Language translations. Volatile memory acquisition and analysis in Exterro FTK Lab’s Volatile tab, FTK Connect, SmartView, FTK-C, Registry Viewer, FTK Imager, PRTK, Sanderson Forensic software, Axiom, and dtSearch Desktop will be provided to each student at the beginning of class for use during classroom instruction and test.

Overall Requirements

Custom Training – CART Basic Tools, Four Times per Fiscal Year Custom Training – CART Intermediate OS Artifacts, Four Times per Fiscal Year Custom Training – CART Intermediate Web Artifacts, Four Times per Fiscal Year

Custom Training – CART Advance training Class On-Line for previously certificated examiners, TBD

Custom Training – for CART DFE course; Basic Tools, Intermediate OS Artifacts, and Intermediate Web Artifacts: Rosters are required for student’s attendance. A skills/test assessment must be designed based on the course material and meets the CART training

Version 1.0 Page 6 programs required passing score of 85%. Upon the successful passing of the course, Certificates of Completion must be provided to each student. A summary of the completion of each course will be provided to the designated training manager after class. Assessments requested by the training program coordinator will detail strengths and weaknesses of each student. Instructors will be required to provide guidance in the form of written or oral communication to students via a customer service process based on the learning material for up to one (1) year after the completion of the course. This deliverable provides a unique and enhanced level of technical support service that the student will be able to rely upon at any time. All contacts with the student after class involving technical assistance will be coordinated with the designated training manager via a single point of contact. Class learning material will be provided for up to 25 students including but not limited to printed student manuals and supplemental documentation necessary for course completion. Class material will be shipped to the FBI training location seven (7) working days in advance to enable classroom setup, along with any electronic access to images and profiles for training use in class.

A file transfer site will be set up and provided to the FBI to allow download access to the files, data and applications applied in training as a continuous review of the material used in each iteration of class. All instructor travel and related instructor expenses will not be incurred by the government, but by the company awarded the contract.

3 Place of Performance Redstone Arsenal Huntsville, AL and other locations as designated by the FBI.

4 Period of Performance The period of performance for this effort will be as follows:

PERIOD BEGIN END

Base Year TBD TBD

Option Year 1 TBD TBD

Option Year 2 TBD TBD

Option Year 3 TBD TBD

Option Year 4 TBD TBD

Version 1.0 Page 7

5 Hours of operation The Contractor’s normal workday will typically be eight work hours a day plus a mandatory thirty-minute lunch within the hours of 6:00 a.m. and 6:00 p.m. Core work hours are 8:00 a.m.

through 5:00 p.m. Flexibility within the normal workday shall be coordinated with the Contracting Officer’s Representative (COR).

6 Deliverables The Contractor shall provide monthly status reports to the Contracting Officer (CO) and the COR. The format will be agreed to by the Contractor and COR at the start of performance, but the contents shall contain the following, at a minimum: Staffing Summary, Hours and Labor performed, Current Management and Administrative problems, and action items. The Contractor shall also provide a bi-weekly status report that describes the activities that were completed (highlights), areas of risk, and personnel and their responsibilities for that timeframe.

The Contractor shall be responsible for providing the following deliverables:

DELIVERABLE TITLE DELIVERABLE DATE METHOD OF DELIVERY

Attendance Rosters and skills test assessment results

Within 5 business days upon class completion

Email

Certificates of Completion provided based on testing results

Last day of each class In person, Email

Detailed Strengths and Weaknesses of each student

Within 3 business days upon class completion

Email

7 Government Furnished Equipment or Information The Government will provide Contractor personnel assigned to this contract with a typical working environment, including office furniture and furnishings, secure and unclassified telephone service, storage for classified and unclassified materials, use of the Government's mail and courier services, and access to copiers, personal computers (PCs) and related software.

7.1 Key Personnel/Administration

Accurate administration of a contract is key to maintain the contract in good standing and ensure the offerors and end users’ expectation are diligently met throughout the life of the contract. To do so, both parties must designate personnel that are dedicated to the management and support of the contract once awarded and the offeror must swiftly designate their representatives and their responsibilities.

Version 1.0 Page 8

Each instructor provided will have been involved in the FBI or RCFL system for CART Examiners for a minimum of 5 years and proficient in the CART tools used in the instruction. Each instructor provided will have been an FBI CART certified forensic examiner and will be aware of changing methodologies of forensic skills necessary in the CART system so the class can be tailored to specific FBI needs. All instructors will have experience in the concepts of digital forensic examination methodologies, processes, and technologies, to shape the curricula specifically to the FBI needs.

KEY PERSONNEL

Instructor Position title

8 Security Requirements Key personnel will need a Top-Secret Clearance. At least one instructor must obtain and maintain a Top-Secret Clearance.

8.1 Contracting Officer Representative

The COR will be identified via letter of COR delegation authority issued by the Contracting Officer (CO) for this contract. The COR is responsible, as applicable, for: receiving all deliverables; inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract; providing direction to the Contractor which clarifies the contract effort, filling in details or otherwise furnishing information necessary to accomplish the SOW; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

The COR does not have the authority to alter or modify the Contractor's obligations, contract terms, conditions, specifications, or cost. If as a result of technical discussions, it is in the Government’s best interest to alter/change contractual obligations or the SOW, the CO will issue such changes.

8.2 Contracting Officer

The CO is the appointed authority to bind the Government to the extent of the authority delegated. Direction that will modify the scope, schedule, terms and conditions, funding, or any other action that may modify the agreement as originally entered with the Government must be given only by the CO.

Version 1.0 Page 9

This contract will be administered by:

CO Robert Shifflet

Email: rtshifflet@fbi.gov

CS Ashley Johnson

Email: aljohnson5@fbi.gov

9 Travel Travel cost for instructor travel is incorporated within the cost estimate of each class cost.

No travel outside of CONUS will occur.

10 Electronic Invoicing Requirements The Federal Bureau of Investigation (FBI) requires vendors to submit invoices and supporting documentation electronically through the Invoice Processing Platform (IPP). IPP is a secure, web-based electronic invoicing system provided by the U.S. Department of the Treasury’s Bureau of the Fiscal Service (Treasury) in partnership with the Federal Reserve Bank of St. Louis (FRSTL). IPP is available at no cost to any commercial vendor or independent contractor doing business with a participating government agency. To learn more about IPP, please visit IPP.gov.

Invoice Submission

Vendors are required to create and submit electronic invoices using the IPP system. Invoices submitted by email will not be accepted. This requirement applies immediately upon contract award. For contract-specific questions, please contact the designated contracting officer for your contract.

Obtaining IPP Access

If your company has already enrolled in IPP:

You will not be required to re-register. Please contact your company's IPP account administrator so that he/she may add you as an additional user to your company’s IPP Collector account.

If your company has NOT enrolled in IPP:

Your company will be auto-enrolled for IPP using information from your SAM.gov account. Your company's Primary Electronic Business Point of Contact (POC) will be designated as an IPP administrator. This POC will be contacted by email to register when the FBI initiates the

Version 1.0 Page 10 enrollment process through IPP. To prevent enrollment delays, please ensure your designated Electronic Business POC in SAM.gov is up to date.

Your company’s IPP administrator will be responsible for initial account registration as well as creating and managing your company’s IPP users and permissions. Please note that due to U.S.

Department of the Treasury guidelines, IPP cannot set up User IDs using a shared email address.

How to register for IPP:

1. Once FBI initiates the enrollment process, your company’s designated Electronic Business POC in SAM.gov will receive two emails from IPP Customer Support (ipp.noreply@mail.eroc.twai.gov):

The first email contains the initial administrative IPP User ID The second email, sent within 24 hours of receipt of the first email, contains a temporary password You must log in with the temporary password within 30 days

2. Registration is complete when the initial administrative user logs into the IPP web site with the User ID and password provided and accepts the IPP rules of behavior. Additional user accounts, including administrators, can be created after initial login.

Training

Vendor training materials, including a first-time login tutorial, are available on the IPP.gov website. Once you have logged in to the IPP application, you will have access to user guides that provide step-by-step instructions for all IPP capabilities ranging from creating and submitting an invoice to setting up email notifications.

Additional Support

IPP Customer Support Team is available Monday through Friday from 8:00 am to 6:00 pm EST

•Phone: (866) 973-3131 or Email: IPPCustomerSupport@fiscal.treasury.gov

•For answers to frequently asked questions, visit the Vendor FAQ page on the IPP.gov web site.