W9124922R0011 - SOLICITATION - 170A WOAC ADVANCED FORENSICS TSP.pdf

SEE ADDENDUM

(No Collect Calls)

W9124922R0011 02-May-2022

b. TELEPHONE NUMBER

706-791-1828

8. OFFER DUE DATE/LOCAL TIME

07:00 AM 16 May 2022

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912499. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

DEVIN J. KNIGHT

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011672034-0001

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT GORDON

271 HERITAGE PARK LANE

BLDG. 35200

FT GORDON GA 30905

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W58MUV 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

CYBER SCHOOL

SHEKINA GREEN

CCOE, CYBER SCHOOL

621 BARNES AVE CTED BLDG 25602

AUGUSTA GA 30905

TEL: 706-791-3242 FAX:

706-791-8651FAX:

TEL: 706-791-1800 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$12,000,000

NAICS:

611430

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF46

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W9124922R0011

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Job USACyS 170A WOAC Adv Forensics (BY)

FFP

CLASS 22-003

Advanced Protocol Analysis (12 Sep 22 - 16 Sep 22) Advanced Digital Forensics (19 Sep 22 - 23 Sep 22)

(SEE STATEMENT OF WORK AND TECHNICAL SPECIFICATIONS)

FOB: Destination

PURCHASE REQUEST NUMBER: 0011672034-0001

PSC CD: U008

NET AMT

0002 1 Job USACyS 170A WOAC Adv Forensics (BY)

FFP

CLASS 23-001

Advanced Protocol Analysis (30 Jan 23 - 03 Feb 23) Advanced Digital Forensics (06 Feb 23 - 10 Feb 23)

(SEE STATEMENT OF WORK AND TECHNICAL SPECIFICATIONS)

FOB: Destination

0003 1 Job USACyS 170A WOAC Adv Forensics (BY)

FFP

CLASS 23-002

Advanced Protocol Analysis (05 Jun 23 - 09 Jun 23) Advanced Digital Forensics (12 Jun 23 - 16 Jun 23) (SEE

STATEMENT OF WORK AND TECHNICAL SPECIFICATIONS)

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 08-AUG-2022 TO

07-AUG-2023

N/A CYBER SCHOOL

SHEKINA GREEN

CCOE, CYBER SCHOOL

621 BARNES AVE CTED BLDG 25602

AUGUSTA GA 30905

706-791-3242

W58MUV

0002 POP 08-AUG-2022 TO

07-AUG-2023

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 08-AUG-2022 TO

07-AUG-2023

N/A (SAME AS PREVIOUS LOCATION)

STATEMENT OF WORK

STATEMENT OF WORK

1. General. This is a non-personal services contract to provide a training instruction and developed products for the Cyber Operations Technician (170A) Warrant Officer Advanced Course (WOAC), US Army Cyber School, Cyber Center of Excellence (CCoE), Fort Gordon, Georgia. This effort will support training mid-career 170A WOAC students (CW2-CW3) for the Army’s Cyber Branch. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction. The United States Army Cyber Center of Excellence (Cyber CoE) and Fort Gordon require contractor support to instruct a two (2) week cyber technical training support package for the Cyber School Warrant Officer Advanced Course (WOAC). The instruction shall focus on Offensive Cyber Operations (OCO) and Defensive Cyber Operations (DCO). The government anticipates at least three (3) iterations of the required two (2) week, 80 hours, training. Each iteration will have a maximum number of twenty (20) students. This requirement shall provide the U.S. Army Cyber School with curriculum that facilitate adult learning through modern training techniques, methodologies, and hands-on application of learned skills. Personnel attending this Professional Military Education (PME) course will receive quality, contemporary training that prepares them for the technical rigors required in OCO and DCO. Except for property and services specified as government furnished, the contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, other items, and non-personal services necessary to perform instructional support as defined in this Statement of Work. The contractor shall perform to the standards in this contract. Contractor personnel shall demonstrate model behavior and professionalism at all times.

1.2 Objectives. 1.) Present instruction of OCO and DCO training. Primary instruction material for all modules will be up to the UNCLASSIFIED//FOUO Level and will be supported through the fostering of student self-development, platform instruction, student performance assessments, training resource maintenance, training schedule development, exam management and administration, and assisting students with developing, preparing, and practicing presentations.

2.) Training should enable students to perform cyberspace-related intelligence gathering & reconnaissance, projection of power through the preparation, and execute OCO and DCO cyberspace activities. Curriculum and instruction will attain operational relevance through the inclusion of classified discussions of operational techniques, methodologies, and information.

1.3. Scope of Contract. 170A WOAC is designed to incorporate advanced-level OCO and DCO through immersive, hands-on application of cutting-edge knowledge, methodologies, and technologies adapted from operational forces and industry. The contract curriculum and training outlined in this contract shall provide the advanced OCO and DCO technical expertise and knowledge not readily available in the US Army training inventory. To accomplish this, hands-on application of concepts, tools, and techniques shall comprise 80% of the course content, with lecture comprising no more than 20%. Focus shall be on unclassified concepts and operationally relevant classified examples, techniques, and information that lend to seamless transition from the classroom to operations to reduce follow-on unit training and to improve personnel performance upon graduation from the course. The contractor shall provide a complete training support package that includes Instructors, Developed Instruction Material, and anything related to the completion of the training events. The Contractor shall provide instruction and curriculum for the Cyber School, Warrant Officer Advanced Course (WOAC) specific training material on the below topics. The contractor shall provide and maintain updated curriculum; perform planning, research and development, technical analysis, and administration; conduct classroom and lab instruction and maintenance; provide and grade homework assignments, quizzes, and labs; provide blended training solutions, labs, assessment, or self-study products; provide all subject texts and textbooks for the requisite course; provide and employ advanced distributed learning; as directed by the Contracting Officer Representative (COR). Instruction and curriculum will meet the standards outlined in the Program of Instruction (POI), Cyber School training guidance, the USCYBERCOM J7/National Cryptologic Training System (NSA standards per DoDI 3305.09), and DoD Cybersecurity Workforce Framework (i.e., DoD 8570 or 8140). The training support package will focus on the following topics from an intermediate to advanced level and primary instruction material for all modules will be up to the UNCLASSIFIED//FOUO Level, with the inclusion of classified discussions of operational techniques, methodologies, and information. Each topic is one forty (40)-hour work week, five

(5) days, in length. The courses are:

Advanced Protocol Analysis Advanced Digital Forensics

1.4 Period of Performance. This period of performance is based on the anticipated training schedule as indicated below. All curriculum presentations dates are tentative and subject to change based on the Government Training Schedule.

Class 22-003

Advanced Protocol Analysis (12 SEP 22 – 16 SEP22) Advanced Digital Forensics (19 SEP 22 – 23 SEP 22)

Class 23-001

Advanced Protocol Analysis (30 JAN 23 – 03 FEB 23) Advanced Digital Forensics (06 FEB 23 – 10 FEB 23)

Class 23-002

Advanced Protocol Analysis (05 JUN 23 – 09 JUN 23) Advanced Digital Forensics (12 JUN 23 – 16 JUN 23)

1.5. Type of Contract. The government will award a firm fixed price contract.

1.6. General Information

1.6.1 Physical Security. The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.2. Installation Access. All contractor employees, including subcontractors, shall comply with applicable installation and facility access security policies and procedures at all work locations.

All contractors and subcontractors will be issued a Common Access Card (CAC) or an Installation Pass issued through the Automated Installation Entry (AIE) Security System to access the installation. The Fort Gordon military installation is a limited access post.

Unscheduled gate closures by the military police may occur at any time. In accordance with Army Regulation 525-13, paragraph 5-19, all prospective contractors will undergo a verification process by the installation Provost Marshal Office, Director of Emergency Services to determine the trustworthiness and suitability prior to being granted access to federal property. This will be accomplished using the National Crime Information Center (NCIC) Interstate Identification Index (III). This is the minimum baseline background check for entrance onto Army Installations for non-CAC holders to include entrance of visitors (Ref AR 190-13, paragraph 8-2). All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within Fort Gordon's area of jurisdiction. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect. Security procedures may change without notice.

1.6.3. Recognized Holidays. The contractor is not expected to perform services on the following federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth National Independence Day Christmas Day Independence Day

1.6.4. Work Hours. The Contractor shall perform on-site services during the principal period of maintenance from 0800 to 1700, Monday through Friday excluding holidays observed by the Federal Government and this facility. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.4.1 Anticipated shift schedule is as follows:

• Day Shift: 0800-1700

• Swing Shift: 1530-0030

• Midnight Shift: 2300-0800

In the event that personnel assigned to this contract are required for early/late/weekend school retraining of students or needed for classroom observation the anticipated hours are:

• Alternate Day Shift: 0630-1030 and 1500-1900

• Alternate Swing Shift: 1300-1700 and 1900-2300

• Alternate Midnight Shift: 2100-0100 and 0300-0700

• Weekend Shift: 0830-1330 on Saturdays

1.6.4.2. These operating hours and days may vary based on the requirements of the agency.

Contractor personnel work schedules may be “flexed” to meet the training needs of the Cyber School for weekend and extended duty periods during regular training and exercises, while still adhering to the standard five-day work week. Overtime will not be authorized.

1.6.5. Place of Performance. Work outlined in the SOW will be performed within the Cyber School located on Fort Gordon, Georgia 30905-5715.

1.6.6. Contractor Personnel. The Contractor shall utilize qualified personnel to meet the requirements identified in the SOW. Contract personnel shall possess the knowledge, skills, and abilities to perform the duties listed in the SOW immediately without additional train-up time.

1.6.6.1. Contractor personnel performing work under this contract must be U.S. citizens able to speak, read, and write the English language.

1.6.6.2. The Contractor shall not hire any person whose employment used in performance of this contract would result in a conflict of interest under Army Standards of Conduct for Department of Army Personnel (Army Regulation 600-10).

1.6.6.3. Contractor personnel shall visibly wear contractor furnished identification badges at all times while physically on the Army installation. Each badge shall be made of nonmetallic material, be easily readable, and contain the following minimum information: employee first name, middle initial, and last name, contract company name, and employee photograph.

1.6.6.4. In accordance with FAR 37.114 contractor employees shall identify themselves as a contractor at all times while on the job, e.g., in the workplace, when attending meetings, in email, when answering government telephones, or when making phone calls.

1.6.7. Privacy Act. All contract personnel assigned to this task shall have access to information that may be subject to the Privacy Act of 1974. The contractor is responsible for ensuring all assigned contract personnel are briefed on Privacy Act requirements:

The contractor shall ensure that all assigned personnel understand applicable security policies and directives. Personnel who knowingly violate security policies or directives are subject to immediate removal from any work relating to this contract.

Contractor personnel shall have routine and unavoidable access to proprietary information which they are required to protect. Personnel applied to the tasks in this PWS may not work on other tasks for the contractor or for any other agency without a formal written request, and written consent granted by, the contracting officer.

1.6.8. Post Award Conference/Periodic Progress Meetings. The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The Contracting Officer (KO), Contracting Officer Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

2. Instructional Support. Personnel assigned to this contract shall:

Provide progress/completion report(s) for each training iteration focusing on requirements, problems, deliverables, and significant events.

Coordinate all efforts with the Cyber School Course Manager.

Provide recommendations to the Cyber Training and Education Division (CTED).

Maintain established classroom security requirements and procedures.

Administer and enforce test control standards and procedures as directed by the Cyber

School Course Manager/TCO and IAW the test control measures, and guidance found in USA CCoE Regulation 350-22.

The contractor shall be responsible for adhering to the curriculum presentation schedule and coordinating any requirements to obtain installation/facility clearance, obtaining approval for visitors entering the Cyber Leader College or the required training facility, and review of visitor presentation materials due to the various media platforms used to deliver the curriculum.

Provide student material that can be used as a reference during exams, quizzes, and exercises for a given subject. This material shall be updated prior to each training iteration to incorporate current-threat technology and not become 'stale'.

Provide all classroom training materials such as student handouts, lesson plans, slides, and practical exercises.

Perform relevant instructor duties including installation, configuration, and maintenance on any contractor- provided software or hardware.

Contractor shall, with the guidance of the staff instructors and Cyber School Course Manager, provide a Culmination Exercise for each class taught.

Contractor shall, with the guidance of the staff instructors and Cyber School Course Manager, provide a Culmination Exam for each class taught.

2.2. Training Support. The Contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform these services. The Instructor/Writer shall present “Un-Classified” training, provide classroom support, training material validation, and provide effective training IAW established programs of instruction (POI), the Master Training Plan (MTP), Army Learning Concept (ALC) 2015, USCYBERCOM J7, National Cryptologic Training System (NSA standards per DoDI 3305.09), and DoD Cybersecurity Workforce Framework (i.e., DoD 8570 or 8140) training standards, and the requirements and deliverables of this acquisition. The contractor shall coordinate all efforts with the COR.

Work outlined in the SOW shall be performed within the Cyber School located on Fort Gordon, Georgia or within the greater Augusta, Georgia area.

Provide Cyber Specific Training material.

Collaborate with current government personnel to establish acceptable training practices and student evaluation criteria.

Continuously review and update classroom training materials such as student handouts, lesson plans, slides, and practical exercises for accuracy and adequacy. Deliver update training material during each training iteration.

After completion of each training iteration, the contractor and government will conduct a course after action review to discuss course conduct, friction points, and issues at a mutually coordinated time.

Provide daily attendance report prior to class starting.

Work as part of a team, which will include military, contractor, and/or government civilian instructors.

Coordinate all efforts with the Cyber School Course Manager.

Provide recommendations that relate to OCO/DCO training.

Provide weekly academic report; update academic report as needed.

Contractor shall provide a detailed syllabus for students that are mid- and advance-career

Soldiers (CW2-CW3). Courseware materials must be operationally relevant and technically challenging to meet the experience level of personnel attending the course.

Course must contain unclassified tasks that relate to operational missions, targets, and techniques, with discussion that can elevate to the TS/SCI level.

The content of the syllabus must contain the following:

o Course objectives and goals IAW SOW.

o Course content with topic descriptions.

o Classification level(s) and marked appropriately using derivative classifications markings.

o Course assignments/tests.

o Grading criteria and or rubrics (what constitutes a pass/fail).

o Course schedule with detail of curriculum covered each week.

o Text/readings and other resources provided (e.g., virtual training environment course materials provided).

2.3. Provide Classroom Instruction. To train an effective workforce for the Army Cyber Mission Forces (CMF), instructors must provide an innovative, diverse learning environment that supports active/reserve forces with the training and education infrastructure that provides the foundation for creating a learner-centric environment as per TRADOC Pamphlet 525-8-2 paragraph 3-5 (dated 13 APR 2017). Technical instructors guide students as they learn course content. The technical instructors curate course material in a manner that encourages students to think creatively to solve complex problems which the students have never seen before.

Instructors shall refrain from using primarily static teaching methodologies that rely on presentation software. They shall instead use dynamic techniques that engage students and encourage them to challenge common definitions of cyber and its potential battlespace effects.

Specific requirements may change over the life of this work statement and instructors may need to adjust to incorporate in-scope changes. The contractor shall be responsible for the following:

As required based upon Health Protection Condition (HPCON) Levels, deliver approved instruction to students for each lesson via interactive synchronous and asynchronous learning activities within distributed learning or online training environments, through computer-based training that replicate realistic scenarios and capabilities, and tactics, techniques, and procedures (TTP) that enhance student learning.

Stand, bend, and stoop for long periods of time while delivering training.

Maintain established classroom security requirements and procedures as prescribed in

TRADOC Pamphlet 350-70-4, current Cyber Center of Excellence (CCoE) polices and SOPs. All issues shall be reported to the COR or TPOC as soon as identified.

Maintain classroom conditions IAW current Cyber School policies and SOPs.

Inform military and or government personnel to assist with performance of relevant instructor duties including installation, configuration, and maintenance on any contractor-provided software or hardware.

Maintain and report student attendance, records, and statistics to the COR or Cyber School leadership in accordance with Fort Gordon Regulation 350-5 and CCoE SOPs.

Provide students with evaluation forms; administer and enforce test control standards;

conduct assessments and testing in subjects taught; grade exams; evaluate results; record exam results; conduct AARs; and administer student course critiques.

Provide student material that can be used to prepare for labs, exams, homework, and as an operational reference following graduation. This material shall be updated quarterly, semi-annually, or at the request of the Government to ensure operational relevance is maintained.

Provide all classroom training materials such as student handouts, videos, demonstrations, lesson plans, slides, and practical exercises.

Provide hands-on derived curriculum that replicates operations where students identify and mitigate vulnerabilities, conduct target development, plan, and execute cyberspace activities in a virtual environment.

This curriculum, at a minimum, shall include Windows, Linux, Android, and iOS operating systems, routers, switches, firewalls, servers, and simulated network traffic involving a variety of protocols and content.

Throughout the course, students will employ a variety of classified and unclassified information, tools, and techniques to develop the target for offensive operations.

Information gained from individual exercises throughout the course shall build toward a final product, which will then be used to facilitate offensive actions against the developed target.

2.4 Curriculum. The Contractor shall provide curriculum for the Cyber School Warrant Officer Advanced Course (WOAC) “Un- Classified” specific training material on the below topics. Each topic must be one work week (forty (40) hours), five (5) days, in length. Each iteration will have a maximum number of 20 students.

Contractor shall provide detailed Lesson Plans and Training Support Package IAW TRADOC Regulation (TR) 350-70 for each individual lesson to be taught a minimum of two weeks prior to the arranged training period to allow for government review to ensure material is consistent with requirements.

IAW TR 350-70, the contractor shall develop a version A and version B, 40-50 question exams (tests) to be delivered at the end of the training iteration to measure student comprehension.

Contractor shall provide tests to the government for review with lesson plans and training support packages.

IAW TR 350-70, the contractor shall provide test control and appropriate security of test materials to prevent exploitation of testable material. Test results will be recorded and delivered to the government to become a permanent record within student records.

2.4.1 Instructor Qualifications.

(a) Advanced Digital Forensics: Given a disk image, memory image, and captured network traffic activity, the student will compose a written assessment of malicious activity.

a. Education:

i. Bachelor’s degree in Cybersecurity. In lieu of BS degree five (5) years of experience in Cyberspace Operations (CO).

And

b. Experience:

i. A minimum of five (5) years of experience with computer forensics tools like WinHex, Encase, Volatility, Sleuthkit/Autopsy, FTK, or Velociraptor. Has performed digital forensics with traditional disk forensics, live volatile forensics, or acquiring digital evidence in a forensically sound manner locally or through remote forensics tools.

ii. A minimum of three (3) years of experience with teaching Computer/Digital forensics.

iii. Possess advanced presentation speaking skills (e.g. tailoring content and delivery for different audiences, presenting confidently to large or small groups, and using more creative approaches to presenting).

(b) Advanced Protocol Analysis: Given complex network traffic, the student will discern between benign and malicious network activity within more than 75% of the network traffic.

a. Education

i. Bachelor of Science degree in Cybersecurity. In lieu of a BS degree, a minimum of five (5) years of experience in Cyberspace Operations (CO).

And

b. Experience

i. A minimum of five (5) years performing network protocol analysis with tools like Wireshark, tcpdump, tshark, Network Miner, and bro/zeek. Knowledge of syslog events, network flows like IPFIX, j-flow, s-flow, or tools like system of internet level knowledge (SILK).

ii. A minimum of three (3) years teaching network protocol analysis.

2.4.2 Curriculum Presentation. The Contractor shall provide three (3) class iterations of one work week (forty (40) hours), five (5) days training for each of the topics in accordance with the Government Training Schedule.

All curriculum presentations shall be conducted on-site at a government provided facility on or near Fort Gordon, GA.

Course sequence and titles may be changed by the Course Manager.

The contractor shall be responsible for adhering to the curriculum presentation schedule and coordinating any requirements to obtain installation/facility clearance; such as, obtaining approval for visitors entering the Cyber Leader College or the required training facility, and review of visitor presentation materials due to the various media platforms used to deliver the curriculum.

Provide requisite licensing, user account, log in, etc. required to access all services, curriculum, and virtual environment provided by the contractor for approximately 60, 170A WOAC students per year.

2.4.2.1 Curriculum KSAs / Learning Outcomes. The Contractor shall train operationally relevant concepts and skill that focus on the following topics and learning outcomes:

(a) Advanced Digital Forensics: Given a disk image, memory image, and captured network traffic activity, the student will compose a written assessment of malicious activity.

1. Understand different forensics tool suites such as FTK, Encase, Magnet Axiom, or

Autopsy.

2. Understand digital acquisition methods such as local and remote acquisitions with non-memory forensics for non-volatile memory artifacts.

3. Understand digital acquisition methods such as local and remote acquisitions with memory forensics for volatile memory artifacts.

4. Understand browser and email artifact analysis

5. Assess advanced volatile and non-volatile memory analysis with Linux and Windows

Systems

6. Assess advance malware purposes, techniques, and construction

7. Assess mid-level malware changes to systems and networks

8. Comprehend advanced file and process signatures

9. Validate forensic evidence collection

10. Integrate knowledge of threat tactics, techniques, and procedures (TTP) into advanced memory analysis

11. Correlate multiple sources of data into a holistic timeline

12. Develop advanced file and process search capabilities

13. Present analysis of forensic conclusions in operator notes and executive reports.

14. Understand anti-forensics techniques and tactics.

15. Understand enterprise forensic analysis with enterprise platforms like Tanium, Endgame, Carbon Black, or Security Information and Event Management (SIEM) platforms.

16. Perform active hunting of digital forensics artifacts with digital range to defeat read team tactics with purple/blue team tactics.

(b) Advanced Protocol Analysis: Given complex network traffic, the student will discern between benign and malicious network activity within more than 75% of the network traffic.

1. Identify advanced tunneling methods.

2. Understand of advanced encryption methodologies and secure protocols.

3. Understanding of intrusion detection \ prevention system signature development.

4. Understand incorporating log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past.

5. Develop advanced tunneling methods.

6. Develop advanced intrusion detection \ prevention system signatures and heuristic analysis.

7. Develop advanced encryption methodologies and secure protocols.

8. Perform filtering and cutting of network traffic.

9. Perform deep packet analysis and diagram network traffic with timeline analysis.

10. Integrate knowledge of threat tactics, techniques, and procedures (TTP) into advanced network analysis.

11. Extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations.

12. Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation.

13. Develop and modify configuration on typical network devices such as firewalls and intrusion detection systems to increase the intelligence value of their logs and alerts during an investigation.

14. Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping.

3. Government Responsibilities. Provide access, classroom space, and any required training aides such as projectors or white boards.

4. Government Furnished Equipment. Government provided internet connection, classroom space to provide the training, commercial workstations for students and instructors to complete work, and smart whiteboards.

5. Required Insurance under 52.228-5 Insurance – Work on a Government Installation

1. General Liability: $500,000 per occurrence limit on the comprehensive form of policy

2. Workman’s Compensation: IAW State Requirements. Employer's liability coverage in the minimum amount of $100,000.

3. Automobile Liability: On the comprehensive form of policy, minimum of $200,000 per person and $500,000 per occurrence for bodily injury and $20,000 per occurrence for property damage for all automobiles and trucks used in connection with the performance of the contract.

CLAUSES INCORPORATED BY REFERENCE

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-7 System for Award Management OCT 2018

52.204-9 Personal Identity Verification of Contractor Personnel JAN 2011 52.212-1 Instructions to Offerors--Commercial Products and

Commercial Services

DEC 2021

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

DEC 2021

52.222-44 Fair Labor Standards And Service Contract Labor Standards- Price Adjustment

MAY 2014

52.232-33 Payment by Electronic Funds Transfer--System for Award Management

OCT 2018

52.232-40 Providing Accelerated Payments to Small Business Subcontractors

DEC 2021

52.233-2 Service Of Protest SEP 2006 52.237-2 Protection Of Government Buildings, Equipment, And

Vegetation

APR 1984

52.242-13 Bankruptcy JUL 1995 52.252-2 Clauses Incorporated By Reference FEB 1998 252.201-7000 Contracting Officer's Representative DEC 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7008 Compliance With Safeguarding Covered Defense Information

Controls

OCT 2016

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information

OCT 2016

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

DEC 2019

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support

MAY 2016

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By The Government of a Country that is a State Sponsor of Terrorism

MAY 2019

252.211-7003 Item Unique Identification and Valuation MAR 2022 252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.244-7000 Subcontracts for Commercial Items JAN 2021

CLAUSES INCORPORATED BY FULL TEXT

52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services-- Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications- Commercial Products and Commercial Services. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services."

(d) Representations. The Offeror represents that--

(1) It [ ___ ] will, [ ___ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that--

It [ ___ ] does, [ ___ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(End of provision)

52.204-25 PROHIBITION ON CONTRACTING FOR CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

(a) Definitions. As used in this clause--

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered foreign country means The People's Republic of China.

Covered telecommunications equipment or services means--

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means--

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled--

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

(c) Exceptions. This clause does not prohibit contractors from providing--

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise…