Cybershield 2021 security onion cyber training

SOLICITATION: 

W911YP21R0007

AGENCY/OFFICE: 

Utah Army National Guard / USPFO

PLACE OF PERFORMANCE: 

Utah Army National Guard / G6

17800 S Redwood Rd, Camp Williams, UT 84065

PERIOD OF PERFORMANCE: 

12-16 JULY 2021

SUBJECT: 

Security Onion CyberShield 2021 Training

RESPONSE DUE DATE: 

12:00 PM MST 28 MAY 2021

CONTRACTING POC: 

William (Billy) T. Brown III   Email:  William.t.brown68.civ@mail.mil   Phone:  801-432-4273

DESCRIPTION:

*****THIS REQUIREMENT IS BEING SOLICITED AS A BRAND NAME TOTAL SMALL BUSINESS (SB) SET-ASIDE***

The Utah National Guard is soliciting a Brand Name requirement for Security Onion CyberShield 2021 Training under combined synopsis/solicitation W911YP21R0007 and is being issued for Request for Quotations (RFQ).  This requirement is being solicited as a Total Small Business set-aside under NAICS code 611430 - “Professional & Management Development Training” which has a Small Business Size Standard of $12 million (https://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf).  FOR VENDOR’S QUOTES TO BE CONSIDERED, YOU MUST BE REGISTERED IN SAM.GOV AS A SMALL BUSINESS UNDER THIS NAICS CODE OR VERY SIMILAR NAICS CODE.  Furthermore, your company must also demonstrate you have the capability to conduct Security Onion training.

CYBERSHIELD 2021 SECURITY ONION CYBER TRAINING STATEMENT OF WORK

CyberShield 21 Security Onion Solutions:

Cyber Shield is a National Guard exercise, in cooperation with USAR and USMCR, to conduct cyber defensive operations (DCO) training and assessment for DCO-Elements (DCOE), Cybersecurity detachments/cells, and Cyber Protection teams (CPTs) at Camp Williams, UT from 12 July to 16 July 2021. Cyber Shield provides a collective training event for these teams and sets the conditions for evaluation against Army/Joint standards, including: Network Defense, Forensic Analysis, Reporting and Mitigation, Incident Response, etc.

All Vendor provided training must be geared toward one of the Army Cyber standards. Vendors must accurately and completely describe their training courses through the use of a Course Syllabus or Program of Instruction.

DCO-E Operational Training:

Two core components of the DCO-E mission are support to state and local entities and support to infrastructure. It is vital that DCO-Es receive training that focuses on vulnerability assessment, management, network monitoring, and threat detection. Training should enable team members to perform tasks to determine the root cause for a single event or incident.

DCO-E ICS Training Requirements:

1. Vendor must provide a training course no less than 40 hours focusing on open source, software-based Intrusion Detection starting 12th of July 2021 through 16th of July 2021. Course must provide eight hours of instruction per day.

2. Training must focus on the cyber threats to military and government and methods of identifying and mitigating threats.

3. Teams are responsible for evaluating incoming cyber security threat data to determine its usefulness to operations and applicability to the local environment. Vendors must also provide a focus on current cyber vulnerabilities on these systems and demonstrate types of cyber-attacks that can be performed against them.

4. Teams are responsible for gaining a foundational understanding of using SOS 2.0 and how to architect, deploy, and manage their Security Onion 2 grid. Teams must learn the process of major analyst workflows, reinforced through

real-world case studies.

5. Instructors must have real world experience working in this industry and dealing with these threats on a daily basis. Instructors should have the expertise necessary to confidently facilitate scenario-based problem solving as related to interconnected ICS incidents.

6. Vendor must be able to identify the types of agencies, companies, and partners that come together to make the infrastructure run. Portions of the class should focus on understanding the roles of these entities when configuring, controlling, and preparing these systems, as well as roles when responding to various incidents, such as cyber-attacks.

7. Vendor should provide documentation that participants can use as a reference guide for the material learned in their course at Cyber Shield 2021.

8. Vendor must be able to convert from a face-to-face environment to a virtual/hybrid platform due to any Covid-19 restrictions that may be set in place that would limit or prevent the ability of personnel and the exercise to take place in a face-to-face environment.

OPSEC and AT Level 1 Training Requirements:

1. Vendor employees working on Camp Williams must complete OPSEC and Anti-Terrorism Level 1 Awareness training prior to performance on this contract.

SET-ASIDE / FAR REGULATION:

Any award resulting from this solicitation will be made using a TOTAL SMALL BUSINESS set-aside order of precedence as follows:

In accordance with FAR Subpart 19.502-2 Total Small Business Set-Aside Procedures, any awards under this solicitation will be made on a competitive basis first to small business concerns in accordance with FAR 19.502-2.  If there are no acceptable offers from small business concerns, the set-aside shall be withdrawn and the requirement, if still valid, will be made on the basis of full and open competition considering all offers submitted by responsible business concerns.

CONTRACT TYPE / MULTI-OPTION YEARS / EVALUATION CRITERIA: 

The contract type for this procurement will be firm-fixed price contract for Security Onion training to be conducted during CyberShield 2021 12-16 JULY 2021.  Award will be based on an all or none basis using lowest price technically acceptable (LPTA) evaluation criteria.  For proposals to be technically acceptable, it must meet all the specifications outlined in the SOW and indication of past performance experience relating to conducting Security Onion cyber training. Relevancy and currency will be used for past performance criteria and only a rating of ACCEPTABLE, NOT ACCEPTABLE, OR NEUTRAL will be given on past performance.  If a Contractor has no relevant past performance, the Contractor will not be rated Favorably or Unfavorably but will be rated Neutral and not have that count against them.  An LPTA quote is one that meets all the technical aspects outlined in this solicitation and statement of work while being the lowest price quote, IAW FAR 15.101-2. 

SAM REGISTRATION: 

All offerors must have an active registration in System for Award Management (SAM) at time of award in order to be eligible for contract award.  All offerors responding to this solicitation must meet all standards required to conduct business with the Government, including active registration in SAM and WAWF/iRAPT, and be in good standing.  All qualified responses will be considered by the Government.  In addition to providing pricing each quote must include vendor's CAGE/DUNS number, Federal Tax Number, and must include point of contact information. 

IAW FAR 52.212-1(k), prospective awardees shall be registered and active in the System for Award Management (SAM) prior to award and be in good standing.  Prospective offerors may obtain information on registration at WWW.SAM.GOV.  IAW FAR 52.204-7 and DFARS 252.204-7004 Alt A, prospective vendors must be registered in the SAM database prior to award.  Lack of SAM registration shall be a determining factor for award and your bid may be disqualified for not being registered and active in SAM.gov.

PROPOSALS: 

All proposals are due to the United States Property and Fiscal Office for Utah Purchasing and Contracting Division no later than 12:00 pm (Mountain) 28 MAY 2021.  All submissions should be sent via email to:  william.t.brown68.civ@mail.mil.  Facsimiles will not be accepted.  Questions regarding this requirement may also be directed to this email, with sufficient time to do any research to answer question prior to the closing of this posting.  Responses received after the stated deadline will be considered non-responsive and will not be considered.

PROVISIONS & CLAUSES: 

The following provisions and clauses are applicable to this solicitation:

FAR 52.202-1 – Definitions
FAR 52.203-3 – Gratuities
FAR 52.204-7 – Central Contractor Registration

FAR 52.204-24 – Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

FAR 52.204-26 – Covered Telecommunications Equipment or Services-Representation
FAR 52.209-6 – Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarement
FAR 52.212-1 – Instructions to Offerors

FAR 52.212-3 – Offeror Representations and Certifications-Commercial Items
FAR 52.212-3 – Alternate 1
FAR 52.212-4 – Terms and Conditions - Commercial
FAR 52.212-5 – Dev - Statutes/Exec Orders

FAR 52.217-5 – Evaluation of Options

FAR 52.217-8 – Option to Extend Services

FAR 52.217-9 – Option to Extend the Term of the Contract
FAR 52.219-1 (Alt I) – Small Business Program Representation
FAR 52.219-6 – Notice of Total Small Business Set-Aside
FAR 52.219-8 – Utilization of Small Business Concerns
FAR 52.219-14 – Limitations on Subcontracting
FAR 52.219-28 – Post-award Small Business Program Representations
FAR 52.222-3 – Convict Labor
FAR 52.222-21 – Prohibit Segregated Facilities
FAR 52.222-22 – Previous Contract and Compliance Reports
FAR 52.222-25 – Affirmative Action
FAR 52.222-26 – Equal Opportunity
FAR 52.222-36 – Affirmative Action for Workers With Disabilities
FAR 52.222-40 – Notification of Employees Rights Under the National Labor Relations Act
FAR 52.222-50 – Combating trafficking in Persons
FAR 52.222-54 – Employment Eligibility Verification
FAR 52.223-18 – Encouraging Contractor Policy to Ban Text Messaging While Driving
FAR 52.225-23 – Restrictions on Certain Foreign Purchases
FAR 52.225-25 – Prohibition on Contracting with Entities in Certain Activities or Transactions Relating to Iran - Representation and Certifications
FAR 52.232-1 – Payments
FAR 52.232-33 – Payment by Electronic Funds Transfer-Central Contractor Registration
FAR 52.233-1 – Disputes

FAR 52.233-2 – Service of Protest
FAR 52.233-3 – Protest After Award
FAR 52.233-4 – Applicable Law for Breach of Contract Claim
FAR 52.243-1 – Changes-Fixed Price
FAR 52.252-1 – Provisions Incorporated by Reference
FAR 52.252-2 – Clauses Incorporated by Reference
FAR 52.252-5 – Authorized Deviations in Provisions
FAR 52.252-6 – Authorized Deviation in Clauses
DFARS 252.203-7000 – Requirement Relating to Compensation of Former DoD Officials
DFARS 252.203-7002 – Requirements to Inform Employees of Whistleblower Rights
DFARS 252.204-7003 – Control of Government Personnel Work Product
DFARS 252.209-7995 – Representation by Corporations Regarding Unpaid Delinquent Tax Liability of a Felony Conviction Under Any Federal Law
DFARS 252.212-7000 – Offeror Representations and Certification Required to Implement Status of Executive Orders Applicable to Defense Acquisition of Commercial Items
DFARS 252.212-7001 – Dev Terms and Conditions
DFARS 252.225-7001 – Buy America Act and Balance of Payments Program
DFARS 252.225-7002 – Qualifying Country as Subcontractors
DFARS 252.225-7012 – Preference for Certain Domestic Commodities
DFARS 252.232-7003 – Electronic Submission of Payment Requests
DFARS 252.232-7010 – Levies on Contract Payments
DFARS 252.237-7010 – Prohibition of Interrogation of Detainees by Contract Personnel
DFARS 252.243-7001 – Pricing of Contract Modifications
DFARS 252.243-7002 – Requests for Equitable Adjustment.

FAR 52.252-2 – Clauses Incorporated by Reference.  This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text.  Upon request, the contracting officer will make full text available. Also, the full text of a clause may be accessed electronically at:  HTTPS://WWW.ACQUISITION.GOV.