Attachment J.1 Required Capabilities Document Amnd 0004.pdf

Required Capabilities Document Cyber Range for Training

BACKGROUND

The Administrative Office, hereby referred to as AO), which includes Department of Technology Services (DTS), Systems Development and Support Office (SDSO), Training Division (TD) that supports the Federal Court community and AO Program Offices to identify, design, deploy, deliver and maintain the Information Technology (IT) training necessary to further the Judiciary's mission.

The SDSO-TD mission is to develop and deliver IT training, both in-person and online, for nationally supported technologies and applications to meet the operational needs of judges, court staff, and AO employees. In addition, the SDSO-TD delivers cybersecurity training to the approximately 1000 IT professionals within the Federal Court community.

This course is designed to enhance the cybersecurity skills of IT personnel through the hands-on use of supported tools and techniques. Participants will engage in realistic, lab-based scenarios that simulate common cyber threats and promote active learning through change detection, risk analysis, and adaptive problem-solving.

SCOPE

This RFQ solicits responses from qualified vendors (“Respondents”) to provide virtual cyber range services to the SDSO-TD. The cyber range should allow for SDSO-TD trainers to conduct live, virtual training events with congruent operating models supporting custom hands-on training on cybersecurity tools. The operating models need to include accurate, simulated court network environments for realistic training events.

Requirements

The Training Division is seeking a cloud-based, hosted cyber range environment that meets the following requirements:

• A custom-built and dedicated range environment with a multi-segment enterprise network that includes fully licensed enterprise software, application servers, database servers, email servers, switches and routers. The range environment will be designed to mimic a court network architecture.

• The vendor will develop a course, based on the outline provided below (Exhibit A) using the cyber range environment, incorporating hands-on exercises using the independent cyber tools listed below. The course should encourage participant interaction and engagement, and exercises based on the varied skills and roles within a team. The course will be designed to be conducted remotely.

• The vendor will train the AO staff on the course including administration, design, creation so AO trainers can create additional courses as shown in the Applied IT Security course (Exhibit A) referenced below. Four AO trainers are required.

The contractor shall deliver a virtual training environment capable of supporting 26 concurrent users. The solution shall allocate adequate compute, memory, and storage resources to ensure reliable session performance. System availability shall meet or exceed 99% uptime during all scheduled training events. The environment shall be accessible using Microsoft Edge, Google Chrome, and Mozilla Firefox without requiring additional client-side software.

• Provides training and support for AO trainers.

• The range environment should support up to 25 students at the same time, with the ability to rotate to a different group of students each month. A total of 235 student licenses per year.

• Within 90 days of contract award the custom range will be ready and Train-the-trainer will be completed.

• The Cyber Range shall be available 24 hours a day 7 days a week the week of and the week immediately following each training exercise, except for routine outages (i.e., time required for patches, firmware updates, viruses/malware and bug fixes). The contractor shall provide U.S. based customer support accessible via toll-free phone number, email and website. The contractor shall provide timely notification of bugs, updates, and revisions for all products covered under this requirement. Electronic notification and distribution are preferred.

• Range incorporates independent cyber tools into the environment for IT professionals to respond to/engage with various threat scenarios IAW with the J.2 Requirements Questionnaire

• Capability to have concurrent range scenarios and/or labs running at any given time.

• All scenarios will provide the capability to be accessible by U.S. Courts users remotely.

• Ability to generate multiple environments to support different scenarios and different users.

• Ability to replicate and employ threats at scale.

• Vendor will provide detailed metrics and feedback about the performance of both the team and each of the individual trainees. Feedback will include review of technical proficiencies, participation in the exercise. Reporting should show continuous changes and improvement over time, which directly translates to decreased levels of cyber risk.

• Ability for range participants to complete self-paced labs or other pre-packaged content for key cybersecurity topics such as, but not limited to, threat hunting, network security, computer security, software security, offensive security, defensive security, digital forensics on network traffic and digital devices, and incident response.

• The Vendor shall meet either FedRAMP moderate controls and standards or NIST 800-53 standards and controls. The AO utilizes the Judiciary Information Security Framework (JISF) that closely aligns with FedRAMP and NIST 800-53 standards and controls. If the solution is currently FedRAMP approved or FedRAMP Ready, then the vendor shall provide a copy of their assessment reports to the COR when requested. If the solution is not FedRAMP approved or FedRAMP Ready then the solution shall allow for assessment by AO staff upon request. Vendor meets all FedRAMP moderate security controls. (Vendor must provide information on how they meet FedRAMP moderate security controls. Ex: FEDRAMP Authorized, FEDRAMP Ready, Third-Party Assessments.)

Initial Course Example Exhibit A:

Course Title: Applied IT Security Course Description The course focuses on providing opportunities for learners to apply defensive strategies in a controlled environment. Emphasis is placed on analyzing the threat landscape, improving situational awareness, and determining the most effective tools and actions to strengthen the court’s security posture.

Participants will gain the practical experience and confidence needed to apply learned techniques in their work environments. By the end of the course, the trainee will be proficient in using cybersecurity tools to detect, mitigate, and respond to threats within the operational context.

The course features a cyber range that provides a collaborative, online environment where participants can respond to simulated cyber-attacks and apply preventative measures in real time.

Course Objectives By the end of this course, participants will be able to:

1. Differentiate the importance of separation of duties with regards to system administration roles and cybersecurity roles and explain their expectations and responsibilities.

2. Apply secure configuration and best practices by incorporating them into existing processes to enhance security.

3. Develop a plan for implementing non-continuously addressable backups that are tested.

4. Create and implement a secure patch management plan, using the judiciary’s patch management tools, that includes a rollback plan.

5. Identify open and insecure ports, protocols, and services that could expose the network to threats.

6. Analyze network intrusion data to detect compromised hosts, vulnerabilities, and potential attacks.

7. Evaluate and prioritize risk by assessing security alerts and determining appropriate remediation strategies based on organizational impact.

8. Apply the judiciary’s cybersecurity tools (above) and techniques to prevent unauthorized access to networks, systems, and data.

9. Investigate and mitigate endpoint vulnerabilities and attacks, strengthening the security of individual devices.

10. Conduct root cause analysis (RCA) and develop after-action reports (AARs) to improve future incident responses.

11. Formulate a custom incident response playbook tailored to the AO’s policies, plans, and procedures.

12. Identify credible cybersecurity media and resources to stay informed on evolving threats and defenses.