Statement_of_Work.docx

Statement of Work Cyber Shield 17 Cyber Attacks against ICS Transportation Training

Cyber Shield is a National Guard exercise, in cooperation with USAR and USMCR, to conduct cyber defensive operations (DCO) training and assessment for DCO-Elements (DCOE), Cybersecurity detachments/cells, and Cyber Protection teams (CPTs) at Camp Williams, UT from 23 April to 5 May 2017. Cyber Shield provides a collective training event for these teams and sets the conditions for evaluation against Army/Joint standards, including: Network Defense, Forensic Analysis, Reporting and Mitigation, Incident Response, etc.

All Vendor provided training must be geared toward one of the Army Cyber standards. Vendors must accurately and completely describe their training courses through the use of a Course Syllabus or Program of Instruction.

DCO-E Operational Training

Two core components of the DCO-E mission are support to state and local entities and support to infrastructure. It is vital that DCO-Es receive training that focuses on vulnerability assessment, management, network monitoring, and threat detection. Training should enable team members to perform tasks to determine the root cause for a single event or incident.

DCO-E ICS Training Requirements:

1. Vendor must provide a training course no less than 40 hours focusing on ICS Interconnected Infrastructure within transportation starting 1st of May 2017 through 5th of May 2017.

2. Course must provide eight hours of instruction per day.

3. Training must focus on the interconnected infrastructure ICS systems that control trains, vehicles (buses, lorries, cars etc.) shipping, infrastructure, and building, maintaining, and supporting them.

4. Teams are responsible for evaluating incoming cyber security threat data to determine its usefulness to operations and applicability to the local environment. Vendors must also provide a focus on current cyber vulnerabilities on these systems and demonstrate types of cyber-attacks that can be performed against them.

5. Instructors must have real world experience working in this industry and dealing with these threats on a daily basis. Instructors should have the expertise necessary to confidently facilitate scenario-based problem solving as related to interconnected ICS incidents.

6. Vendor must be able to identify the types of agencies, companies, and partners that come together to make the infrastructure run. Portions of the class should focus on understanding the roles of these entities when configuring, controlling, and preparing these systems, as well as roles when responding to various incidents, such as cyber-attacks.

7. Vendor should provide documentation that participants can use as a reference guide for the material learned in their course at Cyber Shield 2017.