Cyber Platform

The Department of the Navy Naval Supply Systems Command seeks a commercially available Software-as-a-Service cybersecurity training platform for the National Defense University, with proposals due September 22, 2026. The procurement is a total small business set-aside under NAICS 611420, and only U.S.-based small business prime contractors are eligible; authorized resellers, distributors, and subcontractor arrangements are not acceptable.

Place of performance includes the contractor's location and the National Defense University in Washington, DC. The platform must be contractor-hosted, browser-accessible (Chromium-based, Mozilla Firefox, Apple Safari), and provide twenty simultaneously reassignable seats supporting an estimated pool of up to fifty-five authorized users with maximum twenty concurrent active users. The subscription includes one twelve-month base period and one twelve-month option period, with platform activation and user provisioning due within ten business days of award. The platform must deliver immersive hands-on laboratories, realistic cyber range exercises, structured learning pathways, and scenario-based training covering penetration testing, defensive security operations, digital forensics, incident response, malware analysis, web exploitation, Active Directory exploitation, and reverse engineering. A real-time usage and learning analytics dashboard must refresh within five minutes, display user presence, login/logout times, session duration, courses accessed, laboratory completion, performance scores, and skill development, and support CSV or XLSX export without additional charge. The contractor must provide unlimited seat reassignments at no charge, maintain 99.5 percent monthly availability with seventy-two hours advance notice for scheduled maintenance, deliver customer support Monday through Friday 0800–1700 Eastern Time with one-hour acknowledgment and four-hour restoration or workaround for Severity 1 issues, and include contractor-issued certification preparation with unlimited vouchers and assessment attempts for all seats. The Government retains all data ownership and prohibits commercialization or use of Government data without authorization. Acceptance testing occurs within five business days of activation. The Government accepts the platform publisher's standard commercial terms of service and SOC 2 Type II reports without requiring FedRAMP authorization. Quoters must submit Volume 1 (Technical, two pages maximum) with product identification, completed crosswalk, technical specifications, security documentation disclosures, and subcontractor information, plus Volume 2 (Price) with all costs consolidated into a single firm-fixed-price unit and completed FAR provisions 52.219-28, 252.204-7014, and 252.204-7998. Questions after Amendment 0002 (issued September 16) will not be answered.