Cyberspace_Amendment_RFP_PWS_0004.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

Reason for amendment is to correct Paragraph 1.5.7 in PWS. All other terms and condtions remain unchanaged.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 34

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 09-Apr-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W911S018R0020

X 9B. DATED (SEE ITEM 11)

14-Mar-2019

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

09-Apr-2019

CODE

MICC - FORT EUSTIS

705 WASHINGTON BLVD

FORT EUSTIS VA 23604

W911S0 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W911S018R0020

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

PWS (BASE)

PERFORMANCE WORK STATEMENT (PWS)

Fort Gordon Cyber Center of Excellence (CCoE)

US Army Training and Doctrine Command Cyberspace Defense Training Support

30 May 2019 “The JCT&CS is the overarching framework for training development, execution, and assessment of cyber forces.”

PART 1: ......General Information PART 2: ......Definitions and Acronyms PART 3: ......Contractor Furnished Items and Services PART 4: ......Government Furnished Equipment PART 5: ......Specific Tasks PART 6: ......Publications PART 7: ......Technical Exhibits PART 8: ......Standards, Knowledge, Skills, Abilities PART 9: .......Data Center Equipment List

PART 1

General Information

1.1 General:

1.1.1 This is a non-personal services contract to provide training development support, instructional support, logistical support and classroom/laboratory technical support for the US Army Signal School. This is a base IDIQ contract with actual support functions awarded at the task order level. Industry-standard, nationally-recognized (includes Department of Defense (DOD)-recognized) certifications are required to verify and validate student proficiency in cybersecurity roles as defined in the Joint Cyberspace Training and Certification Standards (JCT&CS) Concept of Operations (CONOPS) Appendix 1 to Annex B; specifically, Computer Network Defense (CND) Analyst, Auditor, Incident Responder, Infrastructure Support Specialist, and Manager. The JCT&CS is difficult to locate on the Internet; therefore, the relevant sections are reproduced in Part 8 of this PWS.

1.1.2 This contract requires primary task training in knowledge required to develop skills necessary to obtain certifications required by Programs of Instruction (POIs) for the 25D3 Cyber Network Defender, 25D4 Cyber Network Defender Senior Leader, and 255S Cyberspace Defense Technician Military Occupational Specialty (MOS) producing courses. The certifications listed in the POIs meet the requirements of the cybersecurity roles defined in the JCT&CS, and are listed in paragraph 1.5.5.

1.1.3 The contractors shall provide training that includes advanced technical information security expertise and knowledge. The training will ultimately equip Government personnel with the knowledge and expertise to utilize various tools to defend, monitor, and audit DOD systems; and, detect, analyze, and mitigate threats to those systems.

Training and education shall focus on defending tactical through strategic networks, wired and wireless telecommunications systems, and enterprise-wide networks at all levels (terrestrial, air, and satellite) in support of United States Army, Joint, Combined, and Coalition operations worldwide.

1.2. Description of Products and/or Services: The contractor shall provide, maintain, and make available personnel capable of providing the support specified in this Performance Work Statement (PWS). The intent is to obtain the services of cybersecurity professionals (subject matter experts) who can teach.

1.2.1. Technical Exhibit 3 lists the required training courses and associated certifications. The Government reserves the right to substitute comparable training courses, when operationally necessary. Course sequence may be changed by the Course Manager. The Government will provide the initial course schedule to the contractor at the kick-off meeting. All curriculum presentations shall be conducted on-site at a Government controlled-access facility.

1.3. Background: The 255S Warrant Officer Advanced Course (WOAC) was founded in 2010 as the first cybersecurity-related MOS in the US Army. It was created to fill an urgent need to predict threats to the cyberspace domain and adapt to defeat those threats. The 255S program focused on auditing, responding to incidents, collecting artifacts (forensics), and analysis of packets traversing both wired and wireless systems. In 2012, the 25D MOS was created to provide NCO support to augment the cyberspace defense mission.

1.4. Objective: Using state-of-the-craft training materials and methods, provide high-quality training, management, and personnel for curriculum development and presentation of training courses in the subject areas listed in paragraphs

1.5.5 thru 1.5.7. Courses in paragraph 1.5.5 require nationally-recognized certification exams; courses in paragraph

1.5.6 require either contractor-developed, non-certification assessments or nationally-recognized certification exams;

and, courses in paragraph 1.5.7 require only contractor-developed, non-certification assessments. The selection of certifications as well as the contractor-developed assessments will be approved by the COR and Course Manager.

1.5. Scope:

1.5.1. This PWS establishes and describes the major functions required to support the Cyber Center of Excellence (CCoE); specifically, the U.S. Army Signal School.

1.5.2. Task Order Requests (TORs) may originate, through the Contracting Officer, with the concurrence of the COR, from any CCoE subordinate unit or Department of the Army (DA) agency working initiatives in support of the CCoE.

1.5.3. The training shall provide advanced technical information security expertise and knowledge. The training will prepare Government personnel in cyber-force specialty areas with the knowledge and expertise to utilize various tools to defend, monitor, detect, analyze, audit, and mitigate threats to Department of Defense (DOD) and United States Army networks. Training and education shall focus on defending tactical thru strategic networks, wired and wireless telecommunications systems, and enterprise-wide networks in all five domains of warfare: land, sea, air, space, and cyberspace; in support of United States Army, Joint, Combined, and Coalition operations worldwide.

1.5.4. The subjects listed in this paragraph require an industry-standard, nationally-recognized certification. The currently used certification is listed below for each subject course. The use of alternate certifications is allowed on condition that the contractor submits to the COR and Course Manager for review and concurrence, a technical comparison of the proposed alternate certification and the current certification. This technical comparison must use the work role qualifications and knowledge, skills, and abilities (KSAs) listed in Part 8 as defining factors.

1.5.5. The number in parenthesis following each subject is the maximum number of training hours available including lecture, practical exercise, capstone, certification exam, and classroom preparation. Course descriptions are located in section 8.5.

POI 4-11-C32-255S (CP), Information Protection Technician Warrant Officer Advance Course (Cert), FY19, requires industry-standard, nationally-recognized certification in each of the following four subject areas:

Microsoft Windows Security Administration, paragraph 8.5.10 (120 hours); GCWN or equivalent certification;

Intrusion Analysis, paragraph 8.5.8 (120 hours); GCIA or equivalent certification;

Incident Handling, paragraph 8.5.5 (120 hours); GCIH or equivalent certification; and, Systems and Network Auditing, paragraph 8.5.18 (120 hours); GSNA or equivalent certification.

POI 230-25D30 (CP), Cyber Network Defender (Cert), FY18, requires industry-standard, nationally-recognized certification in each of the following three subject areas:

Essential Security Concepts, paragraph 8.5.4 (80 hours); GSEC or equivalent certification;

Enterprise Defense, paragraph 8.5.3 (120 hours); GCED or equivalent certification; and, Incident Handling, paragraph 8.5.5 (120 hours); GCIH or equivalent certification.

POI 230-25D40-C46 (CP), Cyber Network Defender Senior Leader Course, FY15 requires industry-standard, nationally-recognized certification in each of the following subject:

Certified Systems and Network Auditing, paragraph 8.5.18 (120 hours); GSNA or equivalent certification

1.5.6. Additional training is included in the POIs which addresses topics supporting certifications; but, for which a certification is not required. Subjects listed in this paragraph require either an industry-standard, nationally-recognized certification or a final exam created by the contractor and approved for use by the COR, Course Manager, or duly authorized Government representative. These subject areas support the majority of the Qualification Standards and KSAs listed in Part 8 of this PWS. Course descriptions are in section 8.5.

Information System Continuous Monitoring, paragraph 8.5.6 (40 hours) Implementation and Auditing of the Twenty Critical Security Controls, paragraph 8.5.19 (80 hours) Introductory Linux Security, paragraph 8.5.7(40 hours)

Advanced Linux Security, paragraph 8.5.1 (40 hours) SIEM/Splunk®/Security Onion®, paragraph 8.5.17 (40 hours) Python Scripting for Penetration Testers, paragraph 8.5.16 (40 hours) Python Scripting 8.5.15 (40 hours) Penetration Testing, paragraph 8.5.14 (80 hours) Microsoft Windows Forensics, paragraph 8.5.9 (80 hours)

1.5.7. These modules are specific to the US Army cybersecurity mission and peripherally support specific Qualification Standards or KSAs. The contractor shall provide training for these directed classes as well as a final examination approved for use by the COR, Course Manager, or duly appointed Government representative.

DISA Host-Based Security System, HBSS, paragraph 8.5.13 (40 hours) McAfee Enterprise Security Manager, ESM, paragraph 8.5.12 (32 hours) DISA Assured Compliance Assessment Solution, ACAS, paragraph 8.5.11 (16 hours)

1.5.8. Content currently in the referenced POIs is subject to change at the direction of the Commandant. Historically, certifications and subject areas have changed with only a few weeks’ notice. The most drastic case of this, for example, was a mid-FY replacement of four weeks of training. At the direction of the COR, Contractor should be able to retool its performance to accommodate modifications within 60 days.

1.5.9. In order to comply with the requirements listed in PART 5, it may be necessary for the contractor to employ persons on different schedules: full-time employees (FTEs) who will report to work daily throughout the FY, and part-time employees (PTEs) who will be at the training site only as long as a specific subject area Module or Course is being executed; i.e., for only 1, 2, or 3 weeks at a time. These two distinct types of employees have different security and access requirements. Refer to paragraph 1.7.7.3.

1.6. Period of Performance: The periods of performance shall be for one 30-day phase-in period, one 11-month period, and four 12-month option periods. The Periods of Performance are:

Phase In: 30 days Base period: 11 months Option period 1: 12 months Option period 2: 12 months Option period 3: 12 months Option period 4: 12 months

1.7. General Information:

1.7.1. Quality Control: The Contractor shall establish and maintain procedures for a Quality Control Plan (QCP) to ensure that the requirements of the contract are provided as specified. The plan shall describe the methods for identifying and preventing defects before the level of performance becomes unacceptable. The QCP shall address processes for corrective actions without dependence upon Government direction. The basic tenet of the plan is that the contractor is responsible for quality of service provided. All methods, procedures, and forms, shall support this concept. The contractor shall develop and submit a QCP for Contracting Officer Representative (COR) approval within the first 30 days after the award date. The QCP shall include activities to improve both the support processes and technical approach, and should describe how the contractor will improve customer service over the life of the task order. Revisions to the QCP may be required at any time during performance of the contract to assure contractor compliance with requirements of the PWS. The contractor shall make appropriate revisions and obtain written acceptance of the revised plan from the Contracting Officer.

1.7.2. Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.7.3. Recognized Holidays: On rare occasions, contractor may be required to conduct training on a recognized holiday. Classes are not conducted during Holiday Block Leave (HBL), the dates of which are established annually.

In addition to any other day designated by Federal Statute, Executive Order, or Presidential Proclamation, the following are observed holidays:

New Year’s Day Labor Day Memorial Day MLK Jr.’s Birthday Columbus Day Independence Day Presidents’ Day Veterans’ Day Thanksgiving & Christmas Days

1.7.4. Hours of Operation: The contractor is responsible for conducting business over a 48-hour week, from Monday through Saturday. Group execution of online certification examinations requires considerable bandwidth when combined with normal operational requirements; for this reason, some certification exams are conducted outside normal duty hours, including Saturdays. At no time will the aggregate per-employee hours exceed 40 over the period from Monday through Saturday. The contractor is responsible for conducting business except for observed holidays or when the Government facility is closed due to local or national emergencies, administrative reasons, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the Government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that both the stability and continuity of the workforce are essential.

1.7.5. Place of Performance: Individual TOR will specify the place of performance. However, work shall be performed predominately at the Government facility in Vincent Hall, Fort Gordon, GA.

1.7.6. Type of Contract: The Government will award a fixed price indefinite delivery/indefinite quantity (IDIQ) contract.

1.7.7. Security Requirements:

1.7.7.1 Personnel: There are no special security clearance requirements for this contract. Due to data aggregation potential, contractor employees performing on this contract must be US citizens.

1.7.7.2 Physical: The Contractor shall be responsible for safeguarding all Government owned equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials must be secured.

1.7.7.3 Installation Access: Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements accomplished by the installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.7.7.3.1 PTE contractors and subcontractor personnel will be issued an Installation Pass through the Automated Installation entry (AIE) Security System to access the installation. The Fort Gordon military installation is a limited access post. Unscheduled gate closures by the military police may occur at any time. In accordance with Army Regulation (AR) 525-13, paragraph 5-19, all prospective contractors will undergo a verification process by the installation Provost Marshal Office, Director of Emergency Services to determine the trustworthiness and suitability prior to being granted access to federal property. This will be accomplished using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB). This is the minimum baseline background check for entrance onto Army Installations for non-CAC holders to include entrance of visitors (Army Directive 2014-05/AR 190-13). While on the installation personnel coming under this section shall obey all applicable installation, facility and area commander installation/facility access and local security policies and procedures.

1.7.7.3.2 FTE contractors and subcontractor personnel will require access to a Government computer in support of this contract and are required to obtain a Common Access Card (CAC). Subject FTE shall request a CAC through the COR. The Government issued CAC is the property of the U.S. Government and shall be returned to the COR upon expiration of the contract, replacement or termination of the contractor employee. (CAC card must be turned in to the COR on contractor employee’s last day of employment.) Unauthorized possession of the CAC can be prosecuted criminally under section 701, title 18, United States Code. All contractor personnel coming under the provisions of this section will be required to register for an Army Training Certification Tracking System (ACTCS) account.

1.7.7.3.3 All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within Fort Gordon's area of jurisdiction.

Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect.

Security procedures may change without notice.

1.7.7.4 Identification of Contractor Employees: In accordance with FAR 37.114, contractor employees shall identify themselves as a contractor at all times while on the job, e.g., in the workplace, when attending meetings, in email, when answering Government telephones, or when making phone calls.

1.7.7.5 ID Badges: The Contractor shall provide each contractor employee an identification (ID) badge on contract start date or on employment start date. The ID badge shall be made of nonmetallic material, be easily readable, and shall contain the following minimum information: Employee's Name, Contract Company Name and Employee's Photograph. Contract employees shall wear proper identification at Government workplaces at all times.

1.7.7.6 Display of ID Badges: Contractor employees shall wear the ID badge at all times when performing work under this contract to include attending Government meetings and conferences. Unless otherwise specified in the contract, each contract employee shall wear the ID badge in a conspicuous place on the front of exterior clothing and above the waist except when safety or health reasons prohibit such placement.

1.7.7.7 Answering Telephones: Contractor employees shall identify themselves as a contract employee when answering and making calls on Government telephones.

1.7.7.8 Utilizing Electronic Mail: When Contractor employees send e-mail messages to Government personnel while performing on this contract, the Contractor employee's e-mail address shall include the company name together with the person's name (ex: John Smith, Contractor, ABC Company).

1.7.7.9 Annual Security Refresher Training. All Contractor employees, including subcontractors, assigned to this contract shall complete the online Annual Security Refresher Training located on the Army Learning Management System (ALMS) site. Log into AKO, “Self Service”, “My Training”, “ALMS”, “Go to Mandatory Training”. Training must be completed within 30 days of reporting for duty. The Contractor shall submit certificate of completion for each affected Contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref ALARACT 207/2013, DTG 291848Z Aug 13, Subj: Army Wide Rollout and Requirement for Standardized Computer Web-Based Security Training on the Army Learning Management System (ALMS)).

1.7.7.10 Anti-Terrorism (AT) Level I Training. All Contractor employees, including subcontractors, assigned to this contract shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty. (Monthly briefings will be offered by the Garrison Antiterrorism Officer.) Annual refresher Antiterrorism Level I Training shall be completed on-line at https://jko.jten.mil/courses/atl1/launch.html or they may attend the monthly training offered by the Garrison ATO. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref Department of the Army, US Army Contracting Agency, SFCA-CO, 5 Sep 07, subject: Incorporation of Measures into the Contracting Process and AR 525-13, Antiterrorism).

1.7.7.11 iWATCH: All Contractor employees, including subcontractors, assigned to this contract shall receive a brief on the local iWATCH program (provided in conjunction with the AT Level I Training). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 days of reporting to duty and annual refresher training with the results reported to the COR.

1.7.7.12 Operation Security (OPSEC) Training. All Contractor employees, including subcontractors, assigned to this contract shall complete Level I OPSEC training within 30 days of reporting for duty and then annually thereafter.

Initial Level 1 OPSEC training will be conducted monthly by the Garrison OPSEC Officer or a Level II certified OPSEC Officer. Once a CAC has been issued to a Contractor employee, annual refresher OPSEC training shall be completed on-line at https://www.lms.army.mil/Saba/Web_wdk/ALMS/platform/presentation/portal/portalDriver.rdf. The Contractor shall then submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR and unit/activity security manager. The Contractor shall adhere to local OPSEC policies and procedures of the Government requiring activity. (Ref AR 530-1, Operations Security)

1.7.7.13 Threat Awareness and Reporting Program (TARP) Training. All Contractor employees, including subcontractors, assigned to this contract shall complete TARP training within 30 days of reporting for duty and then annually thereafter. The COR will ensure Contractors are notified of available training. Completion of training shall be reported to the COR and the unit/activity security manager. (Ref AR 381-12).

1.7.7.14 Information Assurance (IA)/Information Technology (IT) Training. All Contractor employees and associated subcontractors must complete the DoD Cyber Awareness Challenge (https://ia.signal.army.mil/DoDIAA/default.asp) before issuance of network access and annually thereafter. Certificates of successful completion, for both initial awareness training and annual refresher training shall be provided to the COR. All Contractor employees will successfully complete all required IA training as specified in AR 25-2 and as directed by the Government. All Contractor employees working IA/IT functions must comply with DoD and Army training requirements in DODD 8570.01, DoD 8570.01-M, and AR 25-2.

1.7.8. Eligibility Verification for Employment: E-Verify is an Internet-based system that compares information from an employee's Form I-9, Employment Eligibility Verification, to data from U.S. Department of Homeland Security and Social Security Administration records to confirm employment eligibility. The U.S. Department of Homeland Security is working to stop unauthorized employment. By using E-Verify to determine the employment eligibility of their employees, companies become part of the solution in addressing this problem. All U.S. employers must complete and retain a Form I-9 for each individual they hire for employment in the United States. This includes citizens and noncitizens. On the form, the employer must examine the employment eligibility and identity document(s) an employee presents to determine whether the document(s) reasonably appear to be genuine and relate to the individual and record the document information on the Form I-9. The list of acceptable documents can be found on the last page of the form. E-Verify is mandatory for employers with federal contracts or subcontracts that contain the Federal Acquisition Regulation E-Verify clause.

1.8. Staffing and Personnel: The Contractor is responsible for the overall management and oversight of this contract. The Government’s estimated workload data is provided under Technical Exhibit 3. The Contractor shall be responsible to propose and deploy the correct labor types, mix, number, and hours required to satisfactorily and professionally meet all PWS requirements. The Government anticipates the requirements within this PWS shall require the following labor categories: instructors, network engineers.

1.8.1. Contractor shall replace departing personnel in a timely manner such that instruction is not disrupted.

Replacement personnel shall be meet all qualifications of the personnel they are replacing.

1.8.2. Contractor personnel shall comply with all provisions of Part 5.

1.8.3. Contractor personnel shall:

be currently certified with the same industry-standard, nationally-recognized certification being used to verify and validate student proficiency in the cybersecurity role being instructed;

be currently certified as an instructor by a nationally-recognized organization (in the case of a PTE as described in this PWS), or the US Army (in the case of FTEs);

demonstrate, at a minimum, five (5) years of direct career field experience within the last 10 years in the cybersecurity role being instructed; and, be able to read, write, speak, and understand American English.

1.8.4. Contractor personnel designated as technical support personnel shall have and maintain an industry-standard, nationally-recognized certification which qualifies them to perform additional functions (described below) in order to directly support the training required by the POIs. These personnel shall provide direct support for all subject courses by developing practical exercises, capstone events, examinations, checks on learning, online content, and printed training materials. In addition to implementing Security Technical Implementation Guides (STIGs), these personnel must be experienced in:

VMware® ESXi Storage management – SAN maintenance and configuration, datapool configurations Virtual machine management - troubleshooting, powercli scripting to manage systems

Network Configuration Management Network Engineering Cisco® Pfsense®

VPN

Linux Administer several versions of Linux: Ubuntu®, CentOS®, Debian® Maintain services: NTP, TACACS, syslog, DNS others as required by training materials Reinforce training by Developing, operating, maintaining Linux lab systems and Challenges/Checks on

Learning/Quizzes/etc.

Windows® Security

Administer Domains Configure Global Policies (GPOs) Manage security groups

Coding and Scripting Coding Python® Using PowerShell® for system management Using Bash and other command line shells Others as dictated by the training materials

Web Development NodeJS®

NGINX®

Hardware Support Maintain physical infrastructure used to provide connectivity to the classrooms

Manage storage solutions (Dell® EC2®) Challenge Development

Create challenges and labs to correspond to training objectives Conduct Bro/Snort packet analysis Conduct Python®/scripting challenges Produce and execute Linux administration labs Conduct device security challenges (hacking, capture the flag events)

Other Docker® Security Onion® Log management and event monitoring

1.9. Program Management Support: The Contractor shall provide complete program management support that manages, controls, and documents all phases of the PWS requirements. The Contractor’s program manager shall be the focal point for all PWS performance and shall keep the Government fully informed, both verbally and in writing.

The Contractor Program Manager (PM) shall be designated as Key Personnel.

1.9.1. The Contractor shall participate in a Government-scheduled, kick-off meeting after base award ,and each task order award; at no additional cost to the Government. The Government will schedule the kick-off meeting and include key personnel from both the prime Contractor and Subcontractor. The purpose of this kick-off meeting is to: (1) aid both Government and Contractor personnel in achieving a clear and mutual understanding of all requirements; and (2) identify and resolve potential problems. The Contractor shall be prepared to discuss any issues requiring clarification and gather information necessary for the Project Management Plan (PMP), including provisions for a Change Management Plan (CMP) to accommodate any subject/certification changes directed by the Government. The PMP is due to the Government within 30 days of contract award. The kick-off meeting will include as a minimum: a program review, existing and planned Applications and Technical Initiatives, and security issues.

1.9.2. Program Management. The Contractor shall conduct quarterly In-Process Reviews (IPRs) to be co-chaired by a Government and Contractor representative. The Contractor shall be prepared to explain the reasoning, assumptions and methods used to arrive at any particular conclusion, recommendation, or alternative in the accomplishment of the tasks required by the contract. The Contractor shall have key personnel, support, and subcontractors, as appropriate, available to execute the meetings. The Government will provide the facilities to conduct IPRs. The Contractor shall prepare the Meeting Agendas as coordinated with the Government. The Contractor shall supply presentation materials to the Government as needed prior to the meeting to enhance productivity and mutual understanding of topics.

1.9.3. Contractor program management shall be conducted in accordance with a PMP. The Contractor shall develop, maintain, and update, throughout each task order period of performance a PMP that is the foundation for information and resource management planning and guidance. The PMP shall include procedures for customer complaints, problem notifications, and customer feedback.

1.9.4. Contractor Manpower Reporting. The Contractor shall report ALL Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract at no additional cost to the Government. The Contractor is required to completely fill in all required data fields using the following address:

https://armycmra.dmdc.osd.mil. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2018.

Contractors may direct questions to the help desk at: dod.ecmra-army-support-desk@mail.mil.

1.9.5. Phase-In/Phase-Out Period: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contractor shall have personnel on board, during the thirty-day (30) phase in/ phase out period. During the phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on contract start date.

1.10. Curriculum Presentation:

1.11. Class schedule will be provided the Contractor during the kick-off meeting.

1.12. When operationally required, course sequence and subjects may change. Changes to the class schedule, including cancellations and additions, will be provided by the Government to the Contractor as far in advance as possible. The CMP shall include provisions to accommodate changes directed by the Government and shall require an estimated timeframe for completion.

1.13. All curriculum presentations will be conducted on-site at a Government facility or a facility designated by the Government for the conduct of such training.

1.14. The Contractor shall be responsible for adhering to the class schedule.

1.15. Certification exams will be conducted immediately following the presentation of the corresponding training materials and the conclusion of appropriate practical exercises and capstone events.

PART 2

DEFINITIONS & ACRONYMS

2.1 Definitions:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. NOTE: The Contracting Officer is the only individual who can legally bind the Government.

2.1.3 CONTRACT ADMINISTRATOR. The official Government representative delegated authority by the Contracting Officer to administer a contract. This individual is normally a member of the appropriate Contracting- Procurement career field and advises on all technical contractual matters.

2.1.4 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. The COR does NOT have authority to change the terms and conditions of the contract.

2.1.5 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.6 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.7 GOVERNMENT-Furnished Property (GFP) or Government Property (GP). Property in the possession of, or directly acquired by, the Government and subsequently made available to the Contractor.

2.1.8 KEY PERSONNEL. Contractor personnel who are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Contract Program Manager. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.9 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.10 QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.11 QUALITY ASSURANCE SPECIALIST. An official Government representative concerned with matters pertaining to the contract administration process and quality assurance/quality control. Acts as technical advisor to the Contracting Officer in these areas.

2.1.12 QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.13 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.14 SUBCONTRACTOR. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.15 WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16 WORK WEEK. Monday through Saturday, unless specified otherwise.

2.2 Acronyms:

AFARS Army Federal Acquisition Regulation Supplement AR Army Regulation AT Antiterrorism ATRRS Army Training Requirements and Resources System CAC Common Access Card CERT Certified (as used in POI Titles) CM Course Manager CMP Change Management Plan CND Computer Network Defense COR Contracting Officer’s Representative CyberCoE United States Army Cyber Center of Excellence

DA Department of the Army DCO Defensive Cyber Operations DFARS Defense Federal Acquisition Regulation Supplement DMDC Defense Manpower Data Center DOD Department of Defense EOCC End Of Course Critique FAR Federal Acquisition Regulation FTE Full-Time Employee FY Fiscal Year IA Information Assurance ISD Information Security Division IPR In-Progress Review JCT&CS Joint Cyberspace Training and Certification Standards MOS Military Occupational Specialty NCO Non-Commissioned Officer OPSEC Operations Security PM Project Manager PMP Project [Program] Management Plan POC Point of Contact POI Program of Instruction PRS Performance Requirements Summary PTE Part-Time Employee PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SLC Senior Leader Course SLDC Senior Leader Development College TARP Threat Awareness and Reporting Program TD Training Development TE Technical Exhibit TOR Task Order Request TO Task Order WOAC Warrant Officer Advance Course

PART 3

CONTRACTOR FURNISHED ITEMS AND SERVICES

3.1 General: The Contractor shall furnish all supplies, equipment, and services required to perform work under this contract that are not listed under Part 4 of this PWS.

3.2 Facility Clearance: n/a

3.3 Training / Certifications: The Contractor shall be ready to train upon task order award.

3.4 Contract Management: The Contractor shall provide all management, administration, security, quality control, and all else required to ensure successful completion of all deliverables.

3.5 Personnel:

3.5.1 The Contractor shall furnish adequate supervision, including program management and the labor necessary to perform all services in an orderly, timely, and efficient manner.

3.5.2 The program manager shall have the authority to act on behalf of the Contractor. The Contractor shall utilize qualified and experienced employees capable of achieving the goals established in Section 1.7 of this PWS.

3.5.3 The Contractor shall ensure all personnel maintain current qualifications and obtain any and all training required to meet mission requirements at no additional cost to the Government.

3.5.4 The Contractor shall exercise administrative control and supervision of its employees. The Contractor, through its personnel, shall perform tasks herein. The Contractor shall select, supervise, and exercise control and direction over its employees under this contract. The Government will not exercise any supervision or control over the Contractor employees in its performance of contractual services under this contract.

3.5.5 The Contractor shall ensure that no personal services are performed under this contract.

PART 4

GOVERNMENT FURNISHED EQUIPMENT

4.1 Vincent Hall:

4.1.1 20 student positions in small (750 sf) classrooms and 32 in large (1800 sf) classrooms.

4.1.2 Desk & chair at the instructor position.

4.1.3 Enterprise Classroom Program (ECP) installed classroom management equipment including multiple wall-mounted 80+ inch flat screen monitors, control station, server, Blu-ray player, sound system, etc.; all installed at the instructor position.

4.1.4 Docking stations and dual monitors at each student location with laptops. (Students sign for laptops and retain control of them for the duration of training).

4.1.5 Centralized data center hosting virtual student pods, public domain imaging software known as “FOG” (an acronym the meaning to which has been lost in the fog), and storage area network (SAN), connected to all classroom student and instructor positions via 1G fiber cabling. Other software is proprietary to the incumbent contractor. A complete list of equipment in the data center is provided at Part 9.

4.2 Other Locations:

4.2.1 Classrooms UNK/TBD

4.2.2 IT Support UNK/TBD

PART 5

SPECIFIC TASKS

5.1 Course Instruction:

5.1.1 Contractor employees shall perform as primary instructors and conduct training on-time IAW published training schedules. All instructors shall be required to instruct training IAW the respective TRADOC-approved Program of Instruction. The Estimated Workload Data is provided at Exhibit 3. Additional information on each MOS program can be found online in the Army Training Requirements and Resources System (ATRRS) catalog at https://www.atrrs.army.mil/atrrscc/ using the following codes: School Code 113, Course Number 230-25D30 (CP);

School Code 113, Course Number 4-11-C32-255S (CP); and, School Code 613, Course Number 230-25D40-C46

(CP).

5.1.2 The Contractor shall ensure that training begins and ends on time. Normal school hours are 0800 to 1700 daily.

Deviations from this schedule will be approved by the COR.

5.1.3 Cyber Range. The Contractor shall reinforce training for all certification objectives and training courses using a COR/Course Manager-approved contractor-provided virtual, capture-the-flag software and scoring platform; i.e., a cyber range. The Defense Advanced Research Projects Agency (DARPA) is developing the National Cyber Range which allows them to replicate larger-scale, complex and diverse networks; enables a realistic testing facility for Internet research; facilitate the scientific use of cyber testing methods; and, provide a virtual environment for the quantitative, qualitative, and realistic assessment of cybertechnologies for research and development, and other capabilities. This section of the PWS requires the creation and execution of similar capabilities on a smaller scale, providing a virtual platform on which training of the certification objectives can be realized without the inherent danger of inflicting harm on other systems and networks. Additionally, the cyber range must be able to score the student’s success in participative practical exercises and rank the students in the class in order of success.

5.1.4 For those courses which have an associated certification exam, the Contractor shall prepare students to pass the certification exam by teaching certification objectives. For those courses which do not require a certification exam, the Contractor shall create and submit to the COR courses of training designed to teach the subject material in addition to an appropriate and applicable final capstone event designed to test student knowledge.

5.1.5 The Contractor shall, with the guidance of cadre instructors and the approval of the COR/Course Manager, provide a five-day capture-the-flag PHASE EXERCISE encompassing all of the subjects taught during the previous courses using the Contractor-provided cyber range described in paragraph 5.1.3.

5.1.6 The Contractor shall, with approval of the COR, provide a four-day culminating CAPSTONE EXERCISE encompassing all of the subjects taught during the previous courses. Use of the contractor-provided cyber range described in paragraph 5.1.3 is the preferred method for execution of this capstone event.

5.1.7 The Contractor shall provide practical exercises (both graded and un-graded), capstone style assessments, self-study materials, a minimum of two practice exams, subject texts and textbooks, and 24-hour per day online access to the identical material incorporated in classroom training beginning on the first day of classroom use. This material will be submitted to the COR in completed form for approval.

5.1.8 The Contractor shall design and conduct COR-/Course Manager-approved training for each certification to span no longer than the maximum number of hours specified in section 1.5.5 for each topic area.

5.1.9 The Contractor shall design and conduct COR-/Course Manager-approved training for each non-certification subject listed in paragraphs 1.5.6 and 1.5.7, spanning no longer than the maximum number of hours specified.

5.1.10 The Contractor shall use instructors with a demonstrated employment history in positions related to the certification training which they are instructing. Proof of compliance with this section can be in the form of a biography, submitted for each contractor instructor. This PWS requires instructors who are experienced, skilled, knowledgeable, and up-to-date in the subject(s) they will instruct.

5.1.11 The Contractor shall document a current certification for all instructors corresponding to the training they will be presenting.

5.1.12 The Contractor shall provide proof of certification as an instructor by a nationally-recognized organization or by the US Army for each instructor.

5.1.13 Instructors will be designated, in writing, by the Contractor, to teach no more than two (2) different certification subjects. This restriction does not apply to common subjects areas listed in paragraphs 1.5.6 and 1.5.7.

5.1.14 The Contractor shall ensure the efficacy of the certification-oriented training by updating it quarterly using only personnel who are certified with the same certification for which the training is intended.

5.1.15 The Contractor shall document, in writing to the COR/Course Manager, changes in all presentation materials.

5.1.16 Instruction shall consist of a minimum of 70% hands-on training.

5.2 Certification Exams:

5.2.1 The Contractor will administer the industry-standard, nationally-recognized certification exams immediately following the presentation of the corresponding training material and the conclusion of appropriate exercises.

5.2.2 The Contractor shall produce a MOS Class pass rate of at least 91%.

5.2.3 The Contractor shall provide one attempt per student per certification exam.

5.2.4 The Contractor shall provide remedial training for students who fail to achieve a passing score on an exam.

Remedial training can be conducted in a classroom environment, one-on-one, via downloadable content or online presentation (paragraph 5.3.2), or combination of these methods. The remedial training will consume a minimum of four hours.

5.2.5 Contractor shall provide for retesting of ALL exams for students who fail the initial exam. Access to certification retests will be managed by the Course Manager or designated representative.

5.2.6 The estimated required number of first-time and retest exams is contained in Exhibit 3.

5.3 Course Materials: