SOW - Reverse Engineering.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

STATEMENT OF WORK

Reverse Engineering Training

For the

Criminal Justice Information Services (CJIS) Division

Statement of Work

08/31/20026

1 Scope

This is a non-personal services contract to provide instructor-led, onsite reverse-engineering training to the Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division. The

Government shall not exercise supervision or control over contractor employees performing the services herein; such personnel shall be accountable solely to the Contractor.

1.1 Description of Services/Introduction

The Contractor shall provide a multi-day, instructor-led training course focused on software reverse engineering and binary analysis using industry-standard tools and methodologies. The training shall consist of classroom instruction, practical exercises, and hands-on activities designed to enhance participant proficiency in analyzing software, binaries, and related artifacts encountered in support of

FBI CJIS Division mission responsibilities.

Section 508 applicability does not apply, as this effort consists of in-person training services only.

1.2 Background

FBI CJIS personnel require foundational and advanced knowledge of reverse-engineering concepts and techniques to support analysis of software and binary code during system integrity reviews, vulnerability assessments, and technical investigations affecting FBI CJIS information systems. This training will enable personnel to develop practical skills necessary for conducting reverse-engineering activities in support of information assurance objectives.

2 Applicable Documents

None.

3 Requirements

3.1 General Requirements

The Contractor shall provide onsite training at FBI CJIS facilities for up to ten (10) Government personnel. The training shall be delivered in a structured, progressive format that enables students to develop practical reverse-engineering skills applicable to mission needs.

3.2 Training Content

The Contractor shall provide instruction and practical exercises that cover reverse-engineering concepts, techniques, and industry-recognized methodologies. Training topics shall include, at a minimum:

• Fundamentals of software reverse engineering and binary analysis

• Static and dynamic analysis techniques

• Use of reverse-engineering tools to examine compiled binaries

• Code navigation, control-flow analysis, and data-flow analysis

• Identification of program structures, functions, and algorithms

• Examination of application behavior and interactions with operating system components

• Techniques for analyzing multiple processor architectures or binary formats

• Practical exercises involving real-world analysis scenarios

3.3 Training Delivery Requirements

The Contractor shall:

• Deliver training onsite at FBI CJIS Division facilities.

• Provide all necessary instructional materials required for participation in class activities.

• Ensure that all training materials can be retained by the Government for future internal reference.

• Provide instructors with demonstrated expertise in reverse engineering and binary analysis.

• Structure practical exercises to reinforce concepts taught during instruction.

3.4 Period and Place of Performance

Training shall occur at FBI CJIS Division facilities in Clarksburg, WV, on dates coordinated between the COR and the Contractor.

4 Key Personnel

Key Personnel shall include the primary training instructor. The instructor shall possess demonstrable experience in software reverse engineering and instruction in technical subject matter.

5 Place of Performance

FBI CJIS facilities, Clarksburg, WV.

6 Deliverables

The Contractor shall provide the following:

• Training Materials: All slides, reference materials, and exercise content, delivered at the start of instruction.

• Completion Summary: Any sign-in sheets and certificates completed within fifteen business days of course completion.

7 Electronic Invoicing Requirements

Invoices shall be submitted using the Invoice Processing Platform (IPP) in accordance with FBI invoicing policies.

Invoice Submission

Vendors are required to create and submit electronic invoices using the IPP system. Invoices submitted by email will not be accepted. This requirement applies immediately upon contract award. For contract-specific questions, please contact the designated contracting officer for your contract.

Obtaining IPP Access

If your company has already enrolled in IPP:

You will not be required to re-register. Please contact your company's IPP account administrator so that he/she may add you as an additional user to your company’s IPP Collector account.

If your company has NOT enrolled in IPP:

Your company will be auto-enrolled for IPP using information from your SAM.gov account. Your company's Primary Electronic Business Point of Contact (POC) will be designated as an IPP administrator.

This POC will be contacted by email to register when the FBI initiates the enrollment process through

IPP. To prevent enrollment delays, please ensure your designated Electronic Business POC in SAM.gov is up to date.

Your company’s IPP administrator will be responsible for initial account registration as well as creating and managing your company’s IPP users and permissions. Please note that due to U.S. Department of the Treasury guidelines, IPP cannot set up User IDs using a shared email address.

How to register for IPP:

1. Once FBI initiates the enrollment process, your company’s designated Electronic Business POC in

SAM.gov will receive two emails from IPP Customer Support (ipp.noreply@mail.eroc.twai.gov):

• The first email contains the initial administrative IPP User ID

• The second email, sent within 24 hours of receipt of the first email, contains a temporary password

• You must log in with the temporary password within 30 days

2. Registration is complete when the initial administrative user logs into the IPP web site with the User

ID and password provided and accepts the IPP rules of behavior. Additional user accounts, including administrators, can be created after initial login.

Training

Vendor training materials, including a first-time login tutorial, are available on the IPP.gov website. Once you have logged in to the IPP application, you will have access to user guides that provide step-by-step instructions for all IPP capabilities ranging from creating and submitting an invoice to setting up email notifications.

Additional Support

IPP Customer Support Team is available Monday through Friday from 8:00 am to 6:00 pm EST

•Phone: (866) 973-3131 or Email: IPPCustomerSupport@fiscal.treasury.gov

•For answers to frequently asked questions, visit the Vendor FAQ page on the IPP.gov web site.

8 Government Furnished Equipment or Information

The Government will provide classroom space and Government-furnished laptops, if required.

9 Personnel Availability

Work shall occur during standard FBI duty hours, coordinated with the COR.

10 Security Requirements

Contractor personnel shall comply with all FBI facility access and security requirements, including visitor processing and onsite escort procedures. No classified information will be accessed or handled under this requirement.

11 Government Representatives

The COR will be identified via delegation letter. Responsibilities include oversight, acceptance of deliverables, and technical clarification.

11.1 Contracting Officer Representative

The COR will be identified via letter of COR delegation authority for this contract. The COR is responsible, as applicable, for: receiving all deliverables, inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract; providing direction to the Contractor which clarifies the contract effort, fills in details or otherwise serves to accomplish the contractual Scope of Work; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

The COR does not have the authority to alter or modify the Contractor's obligations, contract terms, conditions, specifications, or cost. If as a result of technical discussions, it is in the Government’s best interest to alter/change contractual obligations or the Scope of Work, the CO shall issue such changes.

The COR for this contract is Anna K. Mayers. She can be reached at 771-228-3522 and akmayers@fbi.gov.

11.2 Contracting Officer

This contract will be administered by:

Stevon Walker, Contracting Officer

Renae Yuille, Contract Specialist

12 Travel and Other Direct Costs

No travel is anticipated for this requirement. Other Direct Costs are not authorized unless approved in advance by the Contracting Officer.