Information Technology & SCADA Cybersecurity Incident Response Plans

Background
The North Texas Municipal Water District (NTMWD) is seeking proposals for the development of Incident Response Plans (IRP), Business Continuity Plans, and Disaster Recovery Plans for its Supervisory Control and Data Acquisition (SCADA) systems and enterprise Information Technology (IT) networks. This initiative aims to enhance the security and reliability of services provided to over 2 million customers in the region, particularly in light of increasing cyber threats.

Work Details
The contractor will be responsible for creating comprehensive Incident Response Plans and Business Continuity Plans tailored to both SCADA and IT environments. The scope includes:

1. **Incident Response Plan (IRP)**: Establishing goals, classifying incidents, specifying identification methods, prioritizing incidents, providing contact information for resources, evaluating incidents, defining procedures for various incident types, addressing media communications, cyber forensics, roles and responsibilities, and mechanisms for external reporting.

2. **Business Continuity Plan**: Documenting procedures to maintain essential services during disruptions, identifying critical functions and recovery objectives, detailing contingency roles and responsibilities, ensuring operational continuity during emergencies, and planning for alternate operations sites.

3. **Disaster Recovery Plan (DRP)**: Outlining responses to various events that activate recovery plans, operating procedures in manual mode during crises, roles of responders, recovery procedures for IT systems post-disruption, maintaining up-to-date network diagrams, communication protocols during emergencies, and timely replacement requirements for components.

Period of Performance
The initial term of the contract will commence upon execution and last for one year with options to renew for four additional one-year periods. The draft plans are due by June 30th and final plans by August 31st of the current fiscal year.

Place of Performance
The work will be performed at various NTMWD locations across north and east Dallas, Texas.

Bidder Requirements
Proposers must demonstrate significant experience in developing cybersecurity incident response plans specifically for Operational Technology (OT) environments as well as enterprise IT networks. They must comply with NIST standards including SP 800-53 Revision 5 and SP 800-61 Revision 2. Additionally, proposers must provide evidence of insurance coverage as specified in the solicitation.