WOAC Training

SOURCES SOUGHT SYNOPSIS THIS IS A Sources Sought Notice ONLY. The U.S. Government desires to procure Advanced Protocol Analysis/Advanced Digital Forensics on a small business set-aside basis, provided 2 or more qualified small businesses respond to this sources sought synopsis with information sufficient to support a set-aside. Your responses to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible. We encourage all small business concerns, in all socioeconomic categories (including, 8(a) Business Development Program, Small Disadvantage Business, Historically Underutilized Business Zone, Service-Disabled Veteran-Owned, Women-Owned Small Business concerns), to identify their capabilities in meeting the requirement at a fair market price. This notice is issued solely for information and planning purposes - it does not constitute a Request for Quote (RFQ)/Invitation for Bid (IFB)/Request for Proposal (RFP) or a promise to issue an RFQ, IFB or RFP in the future. This notice does not commit the U.S. Government to contract for any supply or service. Further, the U.S. Government is not seeking quotes, bids or proposals at this time and will not accept unsolicited proposals in response to this sources sought notice. The U.S. Government will not pay for any information or administrative costs incurred in response to this notice. Submittals will not be returned to the responder. Not responding to this notice does not preclude participation in any future RFQ or IFB or RFP, if any is issued. If a solicitation is released, it will be synopsized on the Government wide Point of Entry. It is the responsibility of potential offerors to monitor the Government wide Point of Entry for additional information pertaining to this requirement. The anticipated NAICS code(s) is/are: 611420 - Computer Training with a Small Business Size Standard of $12.0M. BACKGROUND: The contractor shall provide: Advanced Protocol Analysis Learning Outcome: Given complex network traffic, the student will discern between benign and malicious network activity within more than 75% of the network traffic: 1) Identify multiple protocols within network traffic and identify advanced tunneling methods 2) Understanding of advanced encryption methodologies and secure protocols 3) Understanding of intrusion detection \ prevention system signature development based on traffic analysis 4) Perform filtering and cutting of network traffic 5) Perform deep packet analysis and diagram network traffic with timeline analysis 6) Integrate knowledge of threat tactics, techniques, and procedures (TTP) into advanced network analysis 7) Develop advanced tunneling methods 8) Develop advanced intrusion detection \ prevention system signatures and heuristic analysis development 9) Develop advanced encryption methodologies and secure protocols Advanced Digital Forensics Learning Outcome: Given a disk image, memory image, and captured network traffic activity, the student will compose a written assessment of malicious activity: 1) Comprehend forensic evidence collection with volatile and non-volatile data. 2) Understand different forensics tool suites such as FTK, Encase, Magnet Axiom, or Autopsy. 3) Understand browser and email artifact analysis 4) Assess advanced memory analysis with Linux and Windows Systems 5) Assess advance malware purposes, techniques, and construction 6) Assess mid-level malware changes to systems and networks 7) Comprehend advanced file and process signatures 8) Validate forensic evidence collection 9) Integrate knowledge of threat tactics, techniques, and procedures (TTP) into advanced memory analysis 10) Correlate multiple sources of data into a holistic timeline 11) Develop advanced file and process search capabilities 12) Present analysis of forensic conclusions in operator notes and executive reports. 13) Understand forensic analysis with enterprise platforms like Tanium, Endgame, Carbon Black, or Security Information and Event Management (SIEM) platforms. In response to this sources sought, please provide: 1. Name of the firm, point of contact, phone number, email address, DUNS number, CAGE code, a statement regarding small business status (including small business type(s)/certifications(s) such as SDB, 8(a), HUBZone, SDVOSB, WOSB, etc.), and the corresponding NAICS code. If the company has a GSA Schedule provide the schedule number. 2. Identify whether your firm is interested in competing for this requirement as a prime contractor or not. Identify subcontracting, joint ventures or teaming arrangement that will be pursued, if any. 3. Identify what percentage of work will be performed by the small business prime contractor and all similarly situated entity subcontractors. Note: In accordance with FAR 52.219-14 Limitations on Subcontracting (DEVIATION 2020-O0008) - Similarly situated entity means a first-tier subcontractor, including an independent contractor, that has the same small business program status as that which qualified the prime contractor for the award and that is considered small for the NAICS code the prime contractor assigned to the subcontract the subcontractor will perform. An example of a similarly situated entity is a first-tier subcontractor that is a HUBZone small business concern for a HUBZone set-aside. 4. Identify type(s)/certifications(s) such as SDB, 8(a), HUBZone, SDVOSB, WOSB, etc.) of the proposed subcontractors. 5. Information in sufficient detail regarding previous experience (indicate whether as a prime contractor or subcontractor) on similar requirements (include size, scope, complexity, timeframe, government or commercial), pertinent certifications, etc., that will facilitate making a capability determination. 6. Identify how the Army can best structure these contract requirements to facilitate competition by and among small business concerns. 7. Recommendations to improve the approach/specifications/draft PWS/PRS to acquiring the identified items/services. 8. Identify any condition or action that may be having the effect of unnecessarily restricting competition with respect to this acquisition. Please contact the MICC Advocate for Competition, Archina Twitty, at archina.t.twitty.civ@mail.mil or 706-791-1896, if you believe that this action is unreasonably restricting competition. Include the subject of the acquisition, this announcement, and the MICC POC information from the FedBizOpps notice. Provide the specific aspects that unreasonably restrict competition and the rationale for such conclusion.