OT Cybersecurity Risk Assessment

Background
The Colorado River Commission of Nevada (CRCNV) is seeking proposals for an OT Cybersecurity Risk Assessment to identify potential weaknesses in its Operational Technology (OT) networks.

The CRCNV operates a high-voltage transmission and distribution system in Clark County, Nevada, and aims to enhance the security of its infrastructure by addressing vulnerabilities and ensuring compliance with industry standards.

Work Details
The contractor will conduct a comprehensive cybersecurity risk assessment of CRCNV's OT network, which includes five existing networks: CorpNet, ManageNet, SCADANet, RevNet, and Wonderware Modbus Plus Network.

The assessment will involve:
- Preliminary network mapping
- Penetration testing
- Perimeter testing
- Vulnerability assessments of internal and external systems
- User privilege escalation tests
- Segmentation testing
- Wireless scanning
- Application vulnerability scanning (including OWASP Top 10)
- Database assessments for common vulnerabilities
- Physical security evaluations
- Compliance assessments with applicable NERC CIP standards.

Deliverables include a detailed Cybersecurity Risk Assessment Report with an executive summary, assessment methodology, detailed results in written and spreadsheet format, strategic recommendations for immediate and long-term remedies ranked by complexity and cost, and a project plan outlining security projects based on identified remedies.

Period of Performance
The contract is expected to last four years from the estimated start date of March 5, 2025.

Place of Performance
The work will be performed at the Colorado River Commission's facilities in Clark County, Nevada.