TRN 1077/10/2015 - Cyber Security: Product Assurance Scoping Work

Contract summary

Industry

• Petroleum products, fuel, electricity and other sources of energy - 09000000

• Research and development services and related consultancy services - 73000000

• Administration, defence and social security services - 75000000

Location of contract

London

Value of contract

£10,000 to £50,000

Procurement reference

TRN 1077/10/2015

Published date

15 October 2015

Closing date

13 November 2015

Contract start date

14 December 2015

Contract end date

31 March 2016

Contract type

Service contract

Procedure type

Not applicable

Contract is suitable for SMEs?

Yes

Contract is suitable for VCSEs?

No

---

Description

The Department of Energy and Climate Change (DECC), wishes to appoint a supplier to investigate current approaches which assure the cyber security of Industrial Control Systems (ICS) and other Operational Technology (OT), and the extent to which these systems are assured across the energy sector internationally.

The aim of the DECC Cyber Security Team is to work with the energy sector to reduce the risk of attack on critical national infrastructure (CNI). Effective and reliable energy infrastructure is critical to a secure supply of energy in the UK. This infrastructure is controlled and monitored by complex networks and systems which collate, analyse and store data and enable communication. Cyber threats pose a serious and evolving challenge to the energy sector and a successful cyber-attack could have a serious impact on energy supply, adversely impacting national security, public safety and the UK economy.

The Energy Emergencies Executive Committee Cyber (E3CC) subgroup conducted a high-level assessment of cyber security capability across the downstream gas and electricity sector which identified several areas for collective improvement. One such area identified common cyber products in use across the sector which control and monitor CNI, creating a potential systemic risk. Industry has requested assistance in gaining greater assurance of the cyber security of these products.
DECC, wishes to appoint a supplier to investigate current approaches which assure the cyber security of ICS and other OT used across the energy sector.
The supplier will undertake a review of:
• OT/ICS products which are used in or relevant to the energy sector, including their function and any advertised security characteristics;
• Existing security standards and certifications for OT/ICS products. This should specify:
o background details of the organisation either publishing the standards or granting certification;
o the criteria used to certify products;
o identify relevant energy sector products which have achieved certification or been developed in accordance to security standards;
• Previous security testing conducted on OT/ICS systems detailing what was tested and how;
• Organisations (including academia) who are developing security standards, certification schemes, testing beds and testing criteria to assure the cyber security of OT/ICS products.
Based on the data gathered, the supplier should recommend:

• Security characteristics that should be tested on OT/ICS products relevant or used by the energy sector. This should detail how these can be tested;
• Suitable test laboratories/ranges that could undertake testing of OT/ICS products.
• A list of OT/ICS products tested and certified, including where they are used and any specific products for the energy sector.

---

More information

Attachments

• Thales redacted proposal.pdf
• redacted proposal

• Thales signed Contract.pdf
• Contract

---

Award information

Awarded date

8 December 2015

Contract start date

8 December 2015

Contract end date

31 March 2016

Total value of contract

£35,016

This contract was awarded to 1 supplier.

Thales UK

---

About the buyer

Contact name

Herpreet Bhamra

Address

Area 3C, 3 Whitehall Place
London
SW1A 2AW
England

Telephone

0300 068 8370

Email

herpreet.bhamra@decc.gsi.gov.uk