CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment

Background
Lakeland Electric (LAK) is a vertically integrated municipal electric utility owned and operated by the City of Lakeland, Florida. The utility serves approximately 256 square miles in Polk County and operates critical infrastructure that requires robust cybersecurity measures. The Energy Management System (EMS) is vital for operational reliability and safety, necessitating compliance with NERC CIP-005-7 and CIP-007-6 standards. LAK seeks a qualified Consultant to conduct an independent evaluation of its Operational Technology (OT) network, focusing on firewall infrastructure compliance.

Work Details
The Consultant will perform a comprehensive gap analysis regarding NERC CIP-005-7 and CIP-007-6 R4 & R5 compliance requirements specifically related to firewalls and firewall infrastructure. Key tasks include:

1) Conducting a Firewall Ruleset Analysis using software like NPView;
2) Reviewing existing LAK Compliance Program documents;
3) Collaborating with LAK to address findings before issuing a Final Report;
4) Confirming compliance with various CIP requirements including ESP boundary validation, external routable connectivity, access control rule justification, detection of malicious communications, interactive remote access controls, logging and monitoring, and intrusion alerts;
5) Delivering a Final Report summarizing findings with prioritized remediation recommendations.

Period of Performance
The contract performance period is expected to begin upon award and continue until the completion of the gap analysis and delivery of the final report. This is estimated to be several months based on project scope.

Place of Performance
The work will primarily take place at Lakeland Electric's facilities in Lakeland, Florida.

Bidder Requirements
Bidders must demonstrate relevant experience in NERC CIP compliance assessments. They must also provide evidence of insurance coverage as specified in the RFP, including general liability, automobile liability, workers' compensation, cyber liability, and professional liability insurance. Additionally, bidders are required to comply with safety regulations and provide documentation for personnel training and background checks.