SOW SANS Courses 15 Sept 2020.docx

UNCLASSIFIED

Statement of Work (SOW) For SANS ICS Training 15 September 2020

PART 1

GENERAL INFORMATION

1.1 Description of Services/Introduction: The contractor must provide worldwide web-based access to on demand training in Industrial Control Systems (ICS) to 8 students, consistent with SANS ICS 410, in ICS cyber security fundamentals and 18 students in ICS network defense and incident response, consistent with SANS ICS 515. This is not a request for the development of a new training course or adaptation, but an already existing online course. The students in attendance will be from the Major Cybercrime Unit (MCU), USACIDC, Quantico, VA, with users located throughout the US and overseas where there is a MCU presence. The capability must include access for each student in a distance learning on demand pace.

1.2 Background: The USACIDC is the premier Military Criminal Investigative Organization (MCIO) within the Department of Defense (DoD) and is responsible for conducting worldwide felony criminal investigations anywhere there is a US Army interest. Among the other missions the USACIDC also conducts are the protective services mission for senior DoD officials, logistics security and major procurement fraud, computer crimes involving US Army networks and computers, and sensitive investigations involving senior US Army personnel and sensitive classified projects. The MCU of USACIDC is also tasked with the investigation of network attacks against the US Army, to include networks involved in critical infrastructure and ICS.

The fundamentals course must provide a foundational set of knowledge to ensure the students will have basic knowledge in defending ICS, and keeping the operational environment safe and secure from emerging cyber threats.

The ICS network defense and incident response training must provide the students with knowledge to deconstruct ICS cyber-attacks, identify and counter threats to ICS, and use incident response procedures to ensure the safety and reliability of operations.

1.3 Objectives: To acquire web based training courses to allow MCU personnel to gain knowledge in responding to criminal attacks on US Army ICS networks.

1.4 Scope: The contractor must provide the following specifications in the required training:

-The training must be web based, and on demand. Due to travel restrictions and global disbursement of our individuals the training must be available worldwide at times appropriate for our various locations.

- The training must include hands on lab exercises and knowledge quizzes

- Subject matter expert instructor support must be available to the students.

- Access to the courses must be unlimited from anywhere in the world at any time for a minimum of three months from registration.

- A Global Information Assurance Certification (GIAC) test with two practice pre-tests must be available.

- Must be an already developed and tested product

- The capability shall be accessible to the Government user 24 hours/7 days/for the duration of the course.

- The ICS 410: ICS/SCADA Security Essentials will provide a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats. And will provide an overview of ICS, as well as instruction on Field Devices and Controllers, Supervisory Systems, Workstations and Servers, and ICS Security Governance.

- The ICS 515: ICS Active Defense and Incident Response will teach the students to deconstruct industrial control system cyber-attacks, leverage an active defense to identify and counter threats in ICS, and use incident response procedures to maintain the safety and reliability of operations. The course will provide instruction in Threat Intelligence, Asset Identification, Network Security Monitoring, Incident response, and Threat and environment manipulation.

-Will provide course materials (text books) in either hardcopy or electronic form.

-Will provide SANS Curriculum and SANS Certified Instructors in a SANS OnDemand training environment.

1.5 Period of Performance: The period of performance for this SOW is from date of award through completion of the training (NTE 4 months).

1.6 Place of Performance: USACIDC-Major Cybercrime Unit, 27130 Telegraph Rd, Quantico, VA 22134

1.7 General Information: NA.

1.7.1 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the terms of the contract.

1.7.2 Government Holidays: NA.