VTE_PWS_Draft_2020.10.20.pdf

PERFORMANCE WORK STATEMENT (PWS) FOR

Virtual Threat Environment to Support Cyber Tatanka

Support Services

1.1 General: This is a non-personal services contract to provide Cyber Tatanka Training Event support through the build and provision of a cloud based Virtual Threat Environment (VTE). Vendor will also provide and manage contractor role players who will conduct opposing forces (Red Team) activities for the duration of use of the VTE. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Scope: The contractor shall provide all personnel, equipment, materials, supervision, and quality control necessary to provide a vital realistic element to the Cyber Tatanka training, as defined in this PWS. Training is anticipated to take place in June 2021. Personnel assigned to this task shall possess the skills and expertise necessary to perform assigned tasks associated with this mission. There will be approximately 100 government/civilian personnel attending this training exercise.

1.3 Background: Cyber Tatanka is a military/civilian partnered exercise focused on defensive cyber operations and improving the skills of cyber professionals who work in related disciplines. The overall goal of this exercise is improve the defensive cyber operations knowledge and efficiency of NEARNG DCO-E and our partner organizations, and, most important, show the citizens of Nebraska that there are highly trained cyber professionals within its borders working diligently to protect the infrastructure relied on to live our lives. The Cyber Range will provide an IT infrastructure in a closed environment for each team and will be used as a training tool for trainees to react to pre-built incidents managed and operated by an opposing force.

1.4 Contract Information

1.4.1 Place and Performance of Services: The contractor shall provide services for operational periods at or near location TBD except when the facility/installation is closed due to local or national emergencies, administrative closings, or similar directed facility/installation closings.

1.4.2 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conferences convened by the Contracting Officer in accordance with Federal Acquisition Regulations Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the Contacting Officer will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.4.2.1 The contractor will attend mid and final planning conferences with Cyber Tatanka POC prior to start of exercise. Conference does not have to be in person, phone or video chat is acceptable.

1.4.3 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the Contracting Officer. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the Point of Contact (POC), (or the Contracting Officer if a POC is not assigned), to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the Contracting Officer. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.5 General Information

1.5.1 Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s acceptance in writing of any proposed changes to its QCP.

1.5.2 Quality Assurance (QA): The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) (defect rate(s)).

1.5.3 Recognized Holidays: N/A

1.5.4 Contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential. Telecommuting is not authorized.

1.5.5 The contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

1.5.6 Anti-Terrorism/Operation Security (AT/OPSEC): N/A

1.5.7 COMSEC/IT Security: N/A

1.5.8 Protection of Personally Identifiable Information (PII). The contractor shall protect all Personally Identifiable Information (PII) encountered in the performance of services in accordance with DFARS 224.103 and DoDD 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who’s PII has been compromised.

1.5.9 CAC Requirements: N/A

1.5.10 Trusted Associate Sponsorship System (TASS): N/A

1.5.11 Physical Security.

1.5.11.1 In the event keys, other than master keys, are lost or duplicated the contractor shall, upon direction by the Contracting Official (KO), re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re- keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.5.11.2 The contactor shall prohibit the use of the Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the KO.

1.5.12 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed.

The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e- mail) and dealings with Government or non- Government entities/ Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed. The contractor shall retrieve all identification media (including vehicle passes) from their employees who depart employment for any reason. All identification media (i.e., badges and vehicles passes) shall be returned to the KO within 14 days of an employee’s departure.

1.5.13 Combating Trafficking in Persons: The United States Government has adopted a zero tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The Contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at Federal Acquisition Regulation (FAR) 22.17.

1.5.14 Contractor Travel: All travel must be included in contract price.

1.5.15 Data Rights: The Contractor has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Contractor owned and are the property of the Contractor with all rights and privileges of ownership/copyright belonging exclusively to the Contractor.

1.5.16 Organizational Conflicts of Interest (OCI): The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.17 Contractor will give the Nebraska National Guard the absolute and irrevocable rights to take and use photos and images of its employees, and subcontractors on the Internet (World Wide Web), in print publications, video and multimedia presentations, and/or for any purpose which may include, but not limited to display, public relations, marketing, or design.

2.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

2.0.1 Materials: The Government will not provide any material associated with the performance of this contract.

2.0.2 Equipment: The Government will not provide any equipment associated with the

2.0.3 Facilities/Land: The Government will not provide any facilities associated with the

2.0.4 Services: The Government will not provide any services associated with the

3.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E): The contractor shall furnish everything required to perform the service in the PWS.

4.0 Requirements:

4.1. Cloud based environment that includes an IT environment defined by the exercise planners.

4.1.1 Clients, servers, routers, firewalls, and up to three different “sites”.

4.1.2 All tools used by the trainees will be included in the range (Kibana, Bro, NMAP, Logstash, etc).

4.1.3 VTE must be able to handle at least traffic load of at least 1Gb/s.

4.1.1 VTE must produce enough log data to simulate a realistic enterprise IT environment.

4.2 IT environment will need to be replicated/scaled for up to ten organizations (Blue Teams) participating in the training exercise.

4.3 VTE will be accessed through a web Graphic User Interface (GUI).

4.4 VPN will be set between the cloud environment and the classrooms for range participants

4.5 Vendor will need to provide basic physical networking and cabling for BYOD support.

4.6 Vendor will need to provide an electronic ticketing system for trouble ticket submissions between the support teams and blue teams.

4.7 VTE will be accessible through the first week of the exercise for trainees to conduct VTE Familiarization and Network Validation.

4.8 A full network map and vulnerability scan results will be provided to each Blue Team at the beginning of the training period.

4.8.1 All vulnerabilities will be will have a classification/Risk Level (typically produced by the scanner) that is commensurate with common vulnerabilities seen in an Enterprise IT Environment.

4.8.2 Vendor will focus on top common vulnerabilities that require advanced tactics as needed to ensure successful exploits by their Red Team.

4.9 Vendor will build all cyber injects (incident simulations) and provide at least one person to act as opposing forces (Red Team) for each VTE. They will support injects that are conducive to realistic threats of malware, social engineering, and other methods as dictated by the VTE director.

4.9.1 Cyber injects will be grouped based on the different types of scenarios (vignettes) that will be coordinated by the white cell and VTE director.

4.10 Vendor will provide an electronic ticket submission application that will allow the "reporting" of the cyber incidents identified by Blue Teams, to include unloadable artifacts and other miscellaneous files as needed to demonstrate the threat they found. This in turn will be utilized by the Red Team to validate actions on the objectives.

4.11 Vendor will provide basic traffic flow on top of incident simulations that mimic real traffic activity through both traffic generators and automated mechanisms on the individual virtual machines that mimic real user activity (opening emails, attachments, running applications, etc.).

4.12 Vendor will provide a Common Operational Picture view for the main White Cell that will incorporate all the scenarios and inject real time to ensure Situation Awareness. This should also include technical VTE performance and metrics to ensure situational awareness on infrastructure resources and assist with identifying any issues of the VTE.

4.13 Red Team will initiate all cyber injects and work with assigned blue team to track incidents, validate blue team discovery and actions taken on each inject.

4.14 Red Team will provide up to a 1 hour backbrief and open discussion with their assigned Blue team to review a walkthrough of each cyber inject, and the results they saw (either mitigation and or reporting) after completion of each vignette.