Virtual Machine (VM) Development for NATO Courses

Statement of Work (SOW) / Performance Work Statement (PWS)

To design and deploy a virtual machine (VM) environment for teaching Cyber Security courses to NATO personnel, enhancing the current learning experience by providing a robust, interactive, and hands-on training platform.

• VM Environment Development: Create and deploy browser-based virtual machines for students and faculty for specific cyber security courses, including Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, and Machine Learning & Artificial Intelligence (ML&AI) applications.

• Course Content Customization: Compile and customize course content based on existing teaching materials, integrating specified software tools for each course.

• Instructional Materials: Develop and deliver instructional guides and student guides for the specified courses.

• Technical Support: Provide Subject Matter Expert (SME) support during in-class resident weeks (18 weeks annually) with immediate response times, and email support during non-in-class weeks with an eight-hour response time.

• VM Maintenance: Maintain and update all laboratory environments and associated materials to ensure compatibility with current course requirements and software versions.

• Deliverables: Includes tailored VM environments, instructional/student guides, exported VMs in OVA format, web-based user interfaces for student and instructor access, and updated/validated laboratory environments.

• VM environments must support specified student numbers (up to 400 total).

• VM availability must be at least 96%.

• Response time for in-class SME support: Immediate to 30 minutes.

• Response time for non-in-class email SME support: 8 hours.

• Minimum latency for VM access: 90ms.

• Updates must address critical/high priority feedback before course cycles.

• Period of Performance: Base period March 31, 2026 - March 30, 2027, with four one-year option periods through March 30, 2031.

• Place of Performance: Contractor's site. Travel to NATO School Oberammergau (NSO), Germany, may occur once per year if required.

• Browser-Based Access: All VM access must be entirely through a modern web browser (Chrome, Firefox, Safari, Edge).

• No Software Downloads: Students and faculty should not need to download any software.

• SME Qualifications: SMEs must be US citizens with extensive experience in VM development, specific cyber security software tools, and data center deployment.

• Data Collection: Ability to collect and present performance metrics for assessment and course refinement.

• Remote Control: Instructor ability to interact with, control, push/pull files from, and run commands on student VMs.

• Security: Compliance with The Privacy Act of 1974. Contractor personnel must identify as contractor employees and use appropriate identification.

Form / Attachment / Pricing Sheet

This document is a market research questionnaire designed to gather information from potential vendors regarding their capabilities and interest in providing a virtual machine environment for teaching cybersecurity classes. It is intended to help the Naval Postgraduate School and NATO School Oberammergau (NSO) understand the market and refine acquisition strategies.

• Company Information: Fields for company name, point of contact, address, phone, email, and CAGE code.
• Business Size: Questions regarding categorization as a large or small business under NAICS code 611710 (Educational Support Services).
• GSA Schedule: Inquiry about possessing a GSA Schedule contract with relevant services and the applicable Special Item Number (SIN).
• Socioeconomic Certifications: Checkboxes for 8(a) Program, HUBZone Program, SDVOSB Program, and WOSB Program.
• Capability Assessment: Request for information demonstrating the capability to provide services as described in a DRAFT PWS, specifically requiring proof of meeting or exceeding minimum technical requirements outlined in Section 6.0 of the DRAFT PWS. A capability statement of no more than ten (10) pages is acceptable.
• Questions/Comments: Open fields for vendors to submit any questions, comments, or suggestions regarding the requirement.

This questionnaire is crucial for potential bidders to:

• Determine their eligibility and suitability for the requirement based on business size and socioeconomic certifications.
• Understand the specific technical requirements (Section 6.0 of the DRAFT PWS) that need to be addressed.
• Provide direct feedback to the government regarding their capabilities and any concerns or suggestions.
• The point of contact for this "sources sought" is Noni Arcilla, Contract Specialist (noni.p.arcilla.civ@us.navy.mil).

Statement of Work (SOW) / Performance Work Statement (PWS)

To design and deploy a virtual machine (VM) environment for teaching NATO Cyber Security courses, enhancing the learning experience beyond current limitations.

• Develop and deploy replicated, remotely accessible VM environments for specific NATO Cyber Security courses.

• Courses include: Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for Cyber Applications, and Introduction to ML & AI.

• VMs must be browser-based for students and faculty, with options for progress tracking metrics.

• Deliver instructional and student guides for the specified courses.

• Export all VMs in OVA format for government use on different virtualization platforms.

• Provide Subject Matter Expert (SME) support for live technical troubleshooting during in-class resident weeks (18 per year) and email support during non-in-class weeks.

• Maintain and update all laboratory environments and instructional materials based on feedback.

• Offer optional on-site instruction or technical support if required.

• VM environments must support specified student numbers (e.g., 110 for Traffic Analysis, 40 for Reverse Engineering/Mobile Apps, 400 total for other courses).

• VM availability target: 96% of the time.

• Material relevance to course content.

• SME response times: Immediate to 30 minutes for live support, 8-hour email response for non-class weeks.

• Updates must be completed prior to course cycles and address critical/high priority feedback.

• Base Period: March 7, 2026 - March 6, 2027

• Option Periods: Through March 6, 2031

• Place of Performance: Contractor's site. Travel to NATO School Oberammergau (NSO), Germany, may occur once per year.

• VMs must be accessible via modern web browsers (Chrome, Firefox, Safari, Edge) on Windows, macOS, or Linux.

• No software downloads required for students or faculty.

• Minimum latency target of 90ms relative to participant location.

• Ability for instructor and student to interact within a single VM simultaneously.

• Instructor capabilities to push/pull files and run commands on student VMs.

• Ability to collect and present performance metrics.

• Contractor personnel must be US citizens.

• Extensive experience in developing VMs for DoD security and data analysis domains is required.