Virtual Machine (VM) Development for NATO Courses

Form / Attachment / Pricing Sheet

This document is the "OFFEROR’S PAST PERFORMANCE DATA" form, intended to collect information from offerors regarding their past performance on previous contracts. This data is considered Source Selection Sensitive Information.

• Section 1: Contract Identification: Collects details about a previously awarded contract, including solicitation number, contractor, contract number, type, period of performance, initial and final costs, and a description of services provided.
• Section 2: Evaluator Identification: Gathers contact information for the individual evaluating the past performance.
• Section 3: Relevant Experience: Asks for an assessment of experience in areas such as Quality of Items, Timeliness of Delivery, and Cost Savings/Avoidance.
• Section 4: Evaluation: Provides a detailed rating scale (A, B, C, D, F, Neutral) for evaluating contractor performance across various aspects, including Program Management (e.g., effectiveness, cooperation, problem resolution, technical compliance, responsiveness) and Cost Performance (e.g., forecasting accuracy, meeting costs, alerting government to unforeseen costs, reporting, subcontracting plan compliance).
• Section 5: Narrative Summary: Includes sections for a general narrative summary, identification of greatest weaknesses, and a determination of whether there would be reservations about soliciting the contractor in the future.

Bidders will need to complete this form to provide documented evidence of their past performance. The detailed evaluation criteria in Section 4 indicate the specific areas the government will assess, guiding bidders on what aspects of their past performance are most critical for evaluation. The information provided here will directly impact the Past Performance evaluation factor of a proposal.

Form / Attachment / Pricing Sheet

This document is an Excel spreadsheet containing detailed pricing information for various CLINs (Contract Line Item Numbers) across multiple contract years, including a base year and four option years. It outlines the quantities, units of measure, and pricing for specific line items related to virtual machine (VM) activation, course updates, and instructor support.

• CLIN 0001 (Base Year): Details pricing for VM activation (410 standard, 40 special), instructor lab guides (for 5 capstones, 36 NPS-developed labs, 48 contractor-developed labs), course development for 7 specific cyber courses, and instructor support labor hours (64 hours).
• CLIN 1001 (Option Year 1): Mirrors the base year for VM activation (410 standard, 40 special) and instructor support (64 hours).
• CLIN 2001 (Option Year 2): Mirrors the base year for VM activation (410 standard, 40 special) and instructor support (64 hours).
• CLIN 3001 (Option Year 3): Mirrors the base year for VM activation (410 standard, 40 special) and instructor support (64 hours).
• CLIN 4001 (Option Year 4): Mirrors the base year for VM activation (410 standard, 40 special) and instructor support (64 hours).
• All listed unit prices and total amounts are currently $0.0.

This pricing sheet provides a breakdown of the anticipated costs for services and items required under the contract. Bidders should review these quantities and line items to understand the scope of work and to formulate their own pricing proposals. The zero dollar amounts indicate that specific pricing will need to be determined by the bidder or may be subject to further negotiation or clarification.

Solicitation / RFP / RFQ

This solicitation is for the development of a Virtual Machine (VM) environment to host training modules for cybersecurity courses taught at the NATO School Oberammergau (NSO). The goal is to provide an improved, hands-on, and interactive learning environment for NATO personnel.

• Development of replicated and remotely accessible VM environments for various cybersecurity courses (e.g., Network Security, Software Reverse Engineering, Mobile Applications).

• Integration of specific software tools within the VMs (e.g., Elastic stack, Wireshark, Splunk, Xcode, Docker).

• Deployment of instructional and student guides for the courses.

• Export of VMs in OVA format for government use.

• Provision of Subject Matter Expert (SME) support for troubleshooting and live technical support during in-class resident weeks.

• Option for on-site instruction or technical support.

• Contract Type: Firm-Fixed-Price (FFP) commercial contract.

• Period of Performance: One 12-month base period, followed by four 12-month option periods. Includes an option to extend services for an additional six months.

• Estimated Value: Not explicitly stated, but the NAICS size standard is $24 Million.

• Submission Deadline: February 9, 2026, at 9:00 AM Pacific Standard Time (PST).

• Submission Method: Via email to the contract specialist.

• Evaluation Process: Tradeoff source selection process. Evaluation will be based on Factor I: Technical (Technical Approach and Subject Matter Experience), Factor II: Past Performance, and Factor III: Price. Technical factors are significantly more important than price.

• Questions Deadline: Three (3) business days prior to the quote submission deadline, by 1:00 PM PST.

• This requirement is a Total Small Business Set-Aside.

• Contractors must be registered in SAM under NAICS code 611710 (Educational Support Services).

• SMEs and supporting contractors must be US citizens.

• The solicitation utilizes FAR subpart 13.5: Simplified Procedures for Certain Commercial Products and Commercial Services.

• All quotes must be complete and accurate to be considered for award.

Statement of Work (SOW) / Performance Work Statement (PWS)

To design and deploy a virtual machine (VM) environment for teaching Cyber Security courses to NATO personnel, enhancing the current learning experience by providing a robust, interactive, and hands-on training platform.

• VM Environment Development: Create and deploy browser-based virtual machines for students and faculty for specific cyber security courses, including Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, and Machine Learning & Artificial Intelligence (ML&AI) applications.

• Course Content Customization: Compile and customize course content based on existing teaching materials, integrating specified software tools for each course.

• Instructional Materials: Develop and deliver instructional guides and student guides for the specified courses.

• Technical Support: Provide Subject Matter Expert (SME) support during in-class resident weeks (18 weeks annually) with immediate response times, and email support during non-in-class weeks with an eight-hour response time.

• VM Maintenance: Maintain and update all laboratory environments and associated materials to ensure compatibility with current course requirements and software versions.

• Deliverables: Includes tailored VM environments, instructional/student guides, exported VMs in OVA format, web-based user interfaces for student and instructor access, and updated/validated laboratory environments.

• VM environments must support specified student numbers (up to 400 total).

• VM availability must be at least 96%.

• Response time for in-class SME support: Immediate to 30 minutes.

• Response time for non-in-class email SME support: 8 hours.

• Minimum latency for VM access: 90ms.

• Updates must address critical/high priority feedback before course cycles.

• Period of Performance: Base period March 31, 2026 - March 30, 2027, with four one-year option periods through March 30, 2031.

• Place of Performance: Contractor's site. Travel to NATO School Oberammergau (NSO), Germany, may occur once per year if required.

• Browser-Based Access: All VM access must be entirely through a modern web browser (Chrome, Firefox, Safari, Edge).

• No Software Downloads: Students and faculty should not need to download any software.

• SME Qualifications: SMEs must be US citizens with extensive experience in VM development, specific cyber security software tools, and data center deployment.

• Data Collection: Ability to collect and present performance metrics for assessment and course refinement.

• Remote Control: Instructor ability to interact with, control, push/pull files from, and run commands on student VMs.

• Security: Compliance with The Privacy Act of 1974. Contractor personnel must identify as contractor employees and use appropriate identification.

Form / Attachment / Pricing Sheet

This document is a market research questionnaire designed to gather information from potential vendors regarding their capabilities and interest in providing a virtual machine environment for teaching cybersecurity classes. It is intended to help the Naval Postgraduate School and NATO School Oberammergau (NSO) understand the market and refine acquisition strategies.

• Company Information: Fields for company name, point of contact, address, phone, email, and CAGE code.
• Business Size: Questions regarding categorization as a large or small business under NAICS code 611710 (Educational Support Services).
• GSA Schedule: Inquiry about possessing a GSA Schedule contract with relevant services and the applicable Special Item Number (SIN).
• Socioeconomic Certifications: Checkboxes for 8(a) Program, HUBZone Program, SDVOSB Program, and WOSB Program.
• Capability Assessment: Request for information demonstrating the capability to provide services as described in a DRAFT PWS, specifically requiring proof of meeting or exceeding minimum technical requirements outlined in Section 6.0 of the DRAFT PWS. A capability statement of no more than ten (10) pages is acceptable.
• Questions/Comments: Open fields for vendors to submit any questions, comments, or suggestions regarding the requirement.

This questionnaire is crucial for potential bidders to:

• Determine their eligibility and suitability for the requirement based on business size and socioeconomic certifications.
• Understand the specific technical requirements (Section 6.0 of the DRAFT PWS) that need to be addressed.
• Provide direct feedback to the government regarding their capabilities and any concerns or suggestions.
• The point of contact for this "sources sought" is Noni Arcilla, Contract Specialist (noni.p.arcilla.civ@us.navy.mil).

Statement of Work (SOW) / Performance Work Statement (PWS)

To design and deploy a virtual machine (VM) environment for teaching NATO Cyber Security courses, enhancing the learning experience beyond current limitations.

• Develop and deploy replicated, remotely accessible VM environments for specific NATO Cyber Security courses.

• Courses include: Network Security, Network Vulnerability Assessment & Risk Mitigation, Cyber Incident Handling & Disaster Response, Network Traffic Analysis, Principles of Software Reverse Engineering, Mobile Applications, ML&AI for Cyber Applications, and Introduction to ML & AI.

• VMs must be browser-based for students and faculty, with options for progress tracking metrics.

• Deliver instructional and student guides for the specified courses.

• Export all VMs in OVA format for government use on different virtualization platforms.

• Provide Subject Matter Expert (SME) support for live technical troubleshooting during in-class resident weeks (18 per year) and email support during non-in-class weeks.

• Maintain and update all laboratory environments and instructional materials based on feedback.

• Offer optional on-site instruction or technical support if required.

• VM environments must support specified student numbers (e.g., 110 for Traffic Analysis, 40 for Reverse Engineering/Mobile Apps, 400 total for other courses).

• VM availability target: 96% of the time.

• Material relevance to course content.

• SME response times: Immediate to 30 minutes for live support, 8-hour email response for non-class weeks.

• Updates must be completed prior to course cycles and address critical/high priority feedback.

• Base Period: March 7, 2026 - March 6, 2027

• Option Periods: Through March 6, 2031

• Place of Performance: Contractor's site. Travel to NATO School Oberammergau (NSO), Germany, may occur once per year.

• VMs must be accessible via modern web browsers (Chrome, Firefox, Safari, Edge) on Windows, macOS, or Linux.

• No software downloads required for students or faculty.

• Minimum latency target of 90ms relative to participant location.

• Ability for instructor and student to interact within a single VM simultaneously.

• Instructor capabilities to push/pull files and run commands on student VMs.

• Ability to collect and present performance metrics.

• Contractor personnel must be US citizens.

• Extensive experience in developing VMs for DoD security and data analysis domains is required.