Characterizing Nuclear Cyber Security Using AI/ML
The U.S. Nuclear Regulatory Commission (NRC) is issuing a pre-solicitation notice for a requirement titled, "Characterizing Nuclear Cyber Security States Using Artificial Intelligence/Machine Learning." (Note: This pre-solicitation notice is related to Sources Sought Notice ID No. NRC-FFR-RES-2022-0001.) The purpose of this acquisition is to research the feasibility and utility of applying artificial intelligence and machine learning (AI/ML) technologies to identify, characterize, and differentiate nuclear system states relative to plant events, especially cyber security events.AI/ML technologies have the potential to provide tools for identifying, characterizing, and differentiating events, especially cyber security events at nuclear power plants, i.e., the nuclear cyber security AI/ML use case or simply the AI/ML use case. For example, AI/ML may enable plant staff to monitor increasingly complex plant systems, detect normal and abnormal plant states, differentiate between states resulting from cyber attacks/events and states resulting from some other abnormal condition, and evaluate and respond to abnormal plant states resulting from a cyber event. Important note on the meaning of plant state: While network traffic volume and content may be measures of plant state, for this project, plant state includes all available measures of plant conditions, activities, and changes. For example, plant process control signals and sensor outputs, as well as plant component status indications are important measures of plant state. The AI/ML use case aims to leverage the diversity of plant state measures to detect and differentiate among plant states, especially those resulting from a cyber event. An example AI/ML use case might correlate pump start control signals with operator indications of a running pump, as well as actual pump flows, current demands, and related system pressures. This information may be useful in detecting an abnormal condition in the pump system and in differentiating a pump failure from a false indication of pump status resulting from a cyber event.The NRC seeks to prepare to regulate nuclear applications of AI/ML by conducting research aimed at developing insights and fundamental knowledge about AI/ML and the AI/ML use case. The research will establish a theoretical and experimental framework adequate for designing, testing, and demonstrating a basic/simple, though representative, AI/ML use case. As part of these efforts, the NRC seeks a contractor capable of partnering with the NRC to perform this research. The scope of the resulting contract will include all deliverables and due dates necessary to achieve the desired outcomes of the acquisition. The contractor will provide all required services (i.e., personnel, equipment, materials, etc.) to complete deliverables and ensure successful contract implementation and ultimate attainment of the objectives.Ideally, the contractor's programs and infrastructure would have the following capabilities:1. Capability to represent, simulate, or emulate some basic nuclear power plant systems, states, performance, and operations, including integration with physical components, e.g., hardware-in-the-loop2. Capability to represent, simulate, or emulate some basic nuclear power plant cyber security systems, states, performance, and operations3. Capability to integrate power plant systems and cyber systems representations into a composite system representation suitable for research, testing, and evaluation of cyber events and the consequences of the attacks on plant systems4. Capability to represent, simulate, or emulate cyber events on the composite system representation and measure/evaluate the consequences of the attacks on the composite system5. Capability to develop and implement AI/ML technologies and approaches related to the capture and modeling of composite system states and the detection/identification of abnormal system states, e.g., states resulting from component failures or cyber attacks6. Capability to collect, analyze, and visualize composite system state information and identify and differentiate normal and abnormal states, especially those states that may result from a cyber-attack7. Capability to complete the research effort within 18 months of a contract awardThe contractor must provide a team of key personnel that as a whole possess the following qualifications:1. Understanding of nuclear power plant operational domain including reactor systems, instrumentation and controls, normal and abnormal operating conditions, and other common commercial nuclear power plant structures, systems, and components.2. Knowledge of nuclear power plant cyber security programs, postures, requirements, and controls.3. Knowledge of nuclear power plant simulation.4. Expertise in AI/ML approaches and technologies.5. Experience integrating and researching the applications of AI/ML to cyber-physical systems.The North American Industry Classification System (NAICS) code for the services required is 541715 "Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)."The Government intends to issue Request for Quotation (RFQ) No. 31310022Q0064, which will be posted on, or about, the week of June 13, 2022 as full and open competition under FAR Part 13. Closing date for receipt of quotations will be on, or about, 30 days thereafter.RFQ No. 31310022Q0064 will be distributed solely through the SAM.gov website (https://sam.gov) and FedConnect.net.All future information about this acquisition, including solicitation, and amendments will also be distributed solely through the SAM.gov website and FedConnect.net. Hard copies of the solicitation document and its related documents, as appropriate, will not be available. Because this RFQ will be posted on this website, interested parties are instructed NOT to call, send letters, e-mails or faxes requesting the RFQ. Interested parties are responsible for monitoring the SAM.gov website to assure that they have the most up-to-date information about this acquisition. The Government will not reimburse interested parties for any cost associated with responding to this business opportunity.Quoters must be registered with the System for Award Management (SAM) database to receive a government contract award. In accordance with FAR 4.1102, quoters are required to be registered in SAM.GOV at the time an offer or quotation is submitted to comply with the annual representations and certifications requirements. The North American Industry Classification System (NAICS) Code applicable (541715 listed above) to this acquisition must be in quoter's SAM registration. Note: Update SAM profile to include all applicable NAICS Codes associated with your company. Quoters may register for SAM online at www.sam.gov or by calling 1-866-606-8220.
31310022Q0064 Nuclear Regulatory Commission
6/1/22, 2:14 PM Sources Sought - Characterizing Nuclear Cyber Security Using Artificial Intelligence/Machine Learning
THE U.S. NUCLEAR REGULATORY COMMISSION (NRC) is issuing this Sources Sought Synopsis as a means of conducting market research or as a market survey to determine the availability of potential qualified vendors (including educational institutions) with the technical capability to provide all management, supervision, administration, and labor for the requirement entitled, “Characterizing Nuclear Cyber Security Using Artificial Intelligence/Machine Learning.” A description of requirements/activities as well as required capabilities is included as Attachment No. 1 to this notice. Services are to be provided to the NRC in Rockville, Maryland. The applicable North American Industry Classification System (NAICS) code assigned to this procurement is 541715 - Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology).
THERE IS NO SOLICITATION AT THIS TIME. This request for sources and vendor information does not constitute a request for proposal; submission of any information in response to this market survey is purely voluntary; the Government assumes no financial responsibility for any costs incurred.
The purpose of this announcement is to provide potential sources the opportunity to submit information regarding their capabilities to perform work for the NRC free of conflict of interest (COI). For information on NRC COI regulations, visit NRC Acquisition Regulation Subpart 2009.5 (http://www.nrc.gov/about-nrc/contracting/48cfr-ch20.html).
All interested parties, including all categories of small businesses (small businesses, small-disadvantaged businesses, 8(a) firms, women-owned small businesses, service-disabled veteran-owned small businesses, and HUBZone small businesses) are invited to submit a response. The capabilities package submitted by a vendor should demonstrate the firm's ability, capability, and responsibility to perform the principal components of work listed in Attachment No. 1. The package should also include past performance/experience regarding projects of similar scope listing the project title, general description, the dollar value of the contract, and name of the company, agency, or government entity for which the work was performed.
Organizations responding to this market survey should keep in mind that only focused and pertinent information is requested. If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements. Submission of additional materials such as glossy brochures or videos is discouraged.
HOW TO RESPOND TO THIS SOURCES SOUGHT NOTICE
If your organization has the capability and capacity to perform, as a prime contractor, one or more of the services described in this notice, then please respond to this notice and provide written responses to the following information. Please do not include any proprietary or otherwise sensitive information in the response, and do not submit a proposal. Proposals submitted in response to this notice will not be considered.
Organization name, address, emails address, Web site address and telephone number.
What size is your organization with respect to NAICS code identified in this notice (i.e., "small" or "other than small")? If your organization is a small business under the aforementioned NAICS code, what type of small business (i.e., small-disadvantaged business, woman-owned small business, economically disadvantaged woman-owned small business, veteran-owned small business, service-disabled veteran-owned small business, 8(a), or HUBZone small business)? Specify all that apply.
Although no geographic restriction is anticipated, if responding organizations are located outside the Washington Metropolitan area (Maryland, Virginia, and the District of Columbia), indicate how the organization would coordinate with the NRC program office located in Rockville, Maryland to provide the support services.
Separately and distinctly describe which of the required capabilities listed in Attachment No. 1 that your organization possesses and indicate your organization's role (prime contractor, first tier subcontractor, and/or supplier) in related contracts. Please also provide the contract number, contract type, customer name, address and point of contact phone number and email address, contract value, thorough description of supplies and services included in the scope of that contract, indication of how they differ from the required capabilities described in this notice, period of performance (for services) or delivery date (for products), and any other relevant information.
For Electronic and Information Technology (EIT) product offerings relevant to this requirement provide completed Voluntary Product Accessibility templates or other documentation that addresses compliance with the applicable standards (add website link) for those products. For any federal customers that your agency has provided information technology services within the required capabilities areas, indicate how your company complies with applicable Section 508 standards (see buyaccesible.gov).
For any federal customers that your agency has for the required capabilities, indicate how your company complies with applicable environmental laws and Federal regulations (See NRC’s Green Purchasing Plan at: http://pbadupws.nrc.gov/docs/ML1219/ML12191A130.pdf).
Indicate whether your organization offers any of the required capabilities described in this notice on one or more of your company's own Federal Government contracts (i.e., GSA Federal Supply Schedule contract or Government wide Acquisition Contracts) that the NRC could order from and, if so, which services are offered. Also, provide the contract number(s) and indicate what is currently available for ordering from each of those contract(s).
Provide a standard, non-proprietary commercial price list or similar standard non-proprietary commercial pricing information for how your company sells, as a prime contractor, required capabilities described in this notice that your organization has experience providing. Also, indicate what is included in that pricing.
Is your organization currently performing or have in the past performed same or similar services as those listed above for any of the licensees regulated by the NRC? If so, which licensees? See http://www.nrc.gov/about-nrc/regulatory/licensing.html for more information on NRC licensing.
Has your organization previously faced organizational conflict of interest issues with NRC? If so, what were they and how were they mitigated or resolved?
Interested organizations responding to this Sources Sought Synopsis are encouraged to structure capability statements in the order of the area of consideration noted above. All capability statements sent in response to this notice must be submitted electronically, via e-mail, to Jennifer Dudek, Contracting Officer, at Jennifer.Dudek@nrc.gov, either MS Word or Adobe Portable Document Format (PDF), by 4:00 PM EST on Thursday, February 17, 2022 (i.e., 15 calendar days from the date of publication of this notice).
DISCLAIMER AND NOTES: Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s potential capability and capacity to perform the subject work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published in Federal Business Opportunities. However, responses to this notice will not be considered adequate responses to a solicitation.
NRC-FFR-RES-2022-0001 Nuclear Regulatory Commission
2/2/22, 3:02 PM