USACyS AOC-A_SOW.pdf

Advanced Operations Course – Academics (AOC-A) (CERT) Curriculum SOW

Table of Contents

1.0 (U) INTRODUCTION/BACKGROUND

2.0 (U) SCOPE

3.0 (U) REQUIREMENTS

3.1 (U) Course Format

3.2 (U) Security Requirements………………………………………………………………………...4

3.3 (U) Course Cancellations……………………………………………………………………………...4

3.4 (U) Section 508 Compliance……………………………………………………………………….4

(U) APPENDIX A-ACRONYMS AND DEFINITIONS…………………………………………...5

(U) APPENDIX B – STANDARDS OF CONDUCT AGREEMENT – INSTRUCTOR…………6

1.0 (U) INTRODUCTION/BACKGROUND

The USACyS Cyber School will procure instruction and certification through SANS Institute in support of U.S. Army requirements to establish, administer, and execute an Advanced Cyber Operations Course-Academics (AOC-A). The Government will not exercise any supervision or control over the contract providers providing the products herein. Such contract product providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

The U.S. Army Cyber School is charged with providing Security Essential Certifications Training support to the Advanced Cyber Operations Course-Academics (AOC-A) course initiative.

The Security Essential Certifications requirement is in direct support of Army cyberspace operations.

2.0 (U) SCOPE

This Statement of Work (SOW) defines the needs of the U.S. Army Cyber School (USACyS) for executing the AOC-A functional course. The Government will procure Commercial-of-the-Shelf (COTS) courses identified in Section 3.1 of this SOW. The Government may also procure COTS offerings of all the Contractor’s courses featuring a SANS course designator of 500 or above (i.e. Intermediate and Advanced Courses). -

3.0 (U) REQUIREMENTS

Cyber School requires in-person COTS course instruction with a designator of 500 or above

(i.e. Intermediate and Advanced Courses) and GIAC certification testing that is provided by SANS institute to meet AOC-A training requirements.

3.1 (U) Course Format

The Contractor shall conduct the class within the following parameters:

• Normal day classes shall run from 0800-1700 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

(U) Course Delivery The Contractor shall conduct one (2) class for twenty (20) students during FY25 with their

COTS product and provide means to certify the students.

FY25

(CUI) The Contractor shall conduct classes on Fort Eisenhower, Ga.

Period of Performance FY25: ____14 JAN 25_______ to ____13 JAN 26____

Class 25-201: 14 JAN 25 – 29 MAY 25 Class 25-202: 24 JUL 25 – 07 DEC 25 o (U) The Contractor shall provide:

The Government requests access to the Contractors admin portal to track student progress, grades, and certificates during and after the course instruction.

The Government requests SANS AOC-A student data, limited to first name, last name, student ID, order ID, course ID, and end date, be ingested into the USCYBERCOM training and readiness system of record: Joint Cyber Command and Control – Readiness (JCC2-R). This requirement will support the U.S. Cyber Command’s Cyber Operator work0role (per USCYBERCOM Cyber Training Manual 7-0.1).

Students with a virtual link (e.g., URL) to available course material at class start.

No information storage media is to be provided to students for retention beyond the end of the course unless required for Section 508 compliance.

o (U) Course Topics o The SANS Institute will provide instructor (s) and combined training consisting of eight (8) of their Commercial of the Shelf Training (COTS-T) courses along with six (6) Certifications (See below). COTS-T courses shall run consecutively during the 19 weeks, 4 days AOC-A Functional course.

SEC 560: Enterprise Penetration Testing SEC 542: Web App Penetration Testing and Ethical Hacking SEC 580: Metasploit for Enterprise Penetration Testing SEC 565: Red Team Operations and Adversary Emulation SEC 599: Defeating Advanced Adversaries-Purple Team Tactics & Kill

Chain Defenses SEC 660: Advanced Penetration Testing, Exploit Writing, and Ethical

Hacking FOR 508: Advanced Incident Response, Threat Hunting, and Digital

Forensics SEC 699: Purple Team Tactics-Adversary Emulation for Breach Prevention

& Detection GPEN: GIAC Penetration Tester GWAPT: GIAC Web Application Penetration Tester GCFA: GIAC Certified Forensic Analyst GDAT: GIAC Defending Advanced Threats GXPN: GIAC Exploit Researcher and Advanced Penetration Tester GRTP: GIAC Red Team Professional Certification o (U) Facilities

COR Contracting Officer Representative DDL Data Definition Language DEP Data Execution Prevention DISA Defense Information Systems Agency DMZ Demilitarized Zone DNS Domain Name Service DO Delivery Order IAVA Information Assurance Vulnerability Alerts IAW In accordance with IQP Instructor Quality Program OPSEC Operations Security PEAK ProITTam Evaluation Assessment Key POC Point of Contact PoRT PowerShell for Red Teaming sow Statement of Work TS/SCI Top Secret/Sensitive Compartmented URL Uniform Resource Locator

(U) DEFINITIONS

(U) Asynchronous:

Student-centered teaching method that uses online learning resources to facilitate information sharing outside the constraints of time and place among a network of people.

(U) Course revision:

A more substantive change, not meeting the criteria for course corrections, typically involving updates reflecting new tools and technology. Course learning objectives and outcomes may change provided the course continues to meet the respective minimum technical requirements in this SOW.

(U) Personally Identifiable Information (PII):

Personally Identifiable Information, or Sensitive Personal Information, as used in U.S.

privacy law and information security (Reference Doc: D0D5400.1 lR, OMD Memo M-07-16:

Section #3.0), is information that can be used on its own or with other information to identify, contact or locate a single person, or to identify an individual in context. The contractors shall properly collect, maintain, use, disseminate and safeguard personal information and report lost, stolen or compromised PII.