1-25-215-P RFP Information Technology SCADA Cybersecurity Incident Response Plans.pdf

REQUEST FOR PROPOSAL NO. 25-215-P

INFORMATION TECHNOLOGY & SCADA

CYBERSECURITY INCIDENT RESPONSE PLANS

PRE-PROPOSAL MEETING:

Friday, September 5, 2025 at 1:00 PM Central

SUBMITTALS ARE DUE PRIOR TO:

Thursday, September 18, 2025, at 10:00 AM Central

RFP MAY BE SUBMITTED ELECTRONICALLY TO (Registration is free):

ntmwd.bonfirehub.com

DOCUMENTS MAY BE DELIVERED TO:

NORTH TEXAS MUNICIPAL WATER DISTRICT

PROCUREMENT DEPARTMENT

501 E. BROWN STREET

WYLIE, TX 75098

DOCUMENTS MAY BE MAILED TO:

NORTH TEXAS MUNICIPAL WATER DISTRICT

PROCUREMENT DEPARTMENT

PO BOX 2408

WYLIE, TX 75098

NORTH TEXAS MUNICIPAL WATER DISTRICT CONTACT:

Hannah Mulla hmulla@ntmwd.com

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 2 of 24

SOLICITATION SUMMARY FOR

REQUEST FOR PROPOSAL 25-215-P (RFP)

1 GENERAL DESCRIPTION

The North Texas Municipal Water District (NTMWD) is seeking proposals from a contractor or firm with specific experience and expertise in creating Incident Response Plans (IRP), Business Continuity Plans and Disaster Recovery Plans for Industrial Control Systems (ICS), Operational Technology (OT) networks, and an enterprise Information Technology (IT) network.

2 SCHEDULE OF EVENTS

Please find below a tentative schedule of events for this RFP. NTMWD reserves the right, in its sole discretion, to revise the tentative schedule of events if the said revision is in its best interest.

RFP Release Date: August 28, 2025

Pre-Proposal Meeting: September 5, 2025, at 1:00 PM Central

Deadline for Questions: September 9, 2025, at 4:00 PM Central

Proposal Due Date and Time: September 18, 2025, at 10:00 AM Central

Contract Execution: Anticipated in late September or October 2025

The proposal opening will be held via Webex link provided via ntmwd.bonfire.com (Bonfire) immediately following the Proposal Due Date and Time. Only the names of companies who submitted proposals will be read.

3 TERM

The initial term of this agreement shall commence on the date of the last signatory and shall be for a period of one

(1) year. The agreement will automatically renew under the same pricing, terms, and conditions for four (4) additional one-year periods unless NTMWD provides Contractor with written notice of its intent to terminate the agreement at least sixty (60) days prior to the expiration of the current term. If said notice is given by NTMWD, the agreement shall terminate at the conclusion of the current one-year term. In no event shall the entire term of this agreement exceed five (5) years.

Prices shall remain firm for the duration of the initial contract period. Thereafter, price changes are subject to the price adjustment provisions of this Contract.

NTMWD reserves the option to temporarily extend this service for an additional ninety (90) days from its expiration date for any reason.

4 INSURANCE REQUIREMENTS

Before a contract can be executed, the successful proposer shall provide evidence of insurance coverage in accordance with the “Insurance Provisions” in SPECIAL PROVISIONS contained within this solicitation document. Bidders and their insurance agent, broker or representative must review the insurance provisions to understand its requirements and cost to contract with NTMWD. An insurance affidavit is included in this solicitation to verify the proposer will comply with the insurance provisions if a contract is awarded.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 3 of 24

TABLE OF CONTENTS

PROPOSAL INSTRUCTION AND REQUIREMENTS

1 Contact Information 2 Addenda and Clarifications 3 Proposal Preparation 4 Proposal Format Requirements 5 Submittal of Proposals 6 Proposal Receipt / Evaluation of Proposals 7 Proposal Award 8 Determination of Non-Responsible Proposer 9 Determination of Non-Responsive Proposal 10 Rejection of Proposals 11 Withdrawing Proposals

EVALUATION CRITERIA

SCOPE OF WORK

SPECIAL PROVISIONS

1 NTMWD’s Right to Inspect and Audit 2 Term 3 Insurance Provisions

GENERAL TERMS AND CONDITIONS

1 Assignment 2 Changes In Contract 3 Compliance With Laws 4 Confidential or Proprietary Information 5 Federal Fair Labor Standards Act (Federal Minimum Wage) 6 Fiscal Year Funding 7 Force Majeure 8 Indemnification and Hold Harmless 9 Independent Contractor 10 Jurisdiction 11 Non-Compete Agreement or Clauses 12 Notice of Delays 13 Occupational Safety and Health Act of 1970 14 Personal Liability of Public Officials 15 Severability 16 Subletting of Contract 17 Tax Exemption Status 18 Termination of Contract: Default And Remedies 19 Termination of Contract For NTMWD Convenience 20 Terms of Payments 21 Third-Party Beneficiary Clause

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 0 of 24

PROPOSAL INSTRUCTIONS & REQUIREMENTS

A Proposal is requested by NTMWD. NTMWD will receive separate sealed Proposals until the Proposal Due Date and Time. This Section provides information on how and where to submit a Proposal and other pertinent information regarding this RFP. Those who submit proposals are required to read and comply with these instructions.

1. CONTACT INFORMATION

It is the Proposer’s responsibility to ask questions and obtain clarification of any information contained herein. Proposers must submit all questions or requests for clarification ONLY in writing and ONLY to the contact person identified on the Cover of this RFP (the “NTMWD Contact”). The Solicitation Number must be referenced in all correspondence pertaining to this RFP. Proposer contact with NTMWD personnel, other than the NTMWD Contact, may be cause for Proposal rejection.

2. ADDENDA AND CLARIFICATIONS

NTMWD may, in its sole discretion, elect to issue changes or clarifications to the RFP. NTMWD will issue changes or clarifications in the form of a written addendum. Written addenda shall be the ONLY FORM of amendment to the RFP. Other written information or verbal communications shall not constitute a change to the requirements of the RFP. Addenda, if issued, will be mailed, faxed, and/or emailed to all known prospective Proposers prior to the date and time of the Proposal Due Date and Time.

It is the Proposer’s responsibility to ensure receipt of any addenda issued by NTMWD. Failure of any Proposer to receive any such addendum or interpretation shall not relieve the Proposer from any obligations under its Proposal as submitted. The Proposer must sign all addenda and return them with their Proposal. All addenda shall become part of the contract documents.

3. PROPOSAL PREPARATION

A. Submittals: Proposer must submit all Proposal Response Forms, plus all addenda, completed forms, and any requested information and documentation as part of its Proposal. Proposer’s failure to include all submittals may be cause to consider a Proposal non-responsive.

B. Endorsing the Proposal: An authorized officer of the Proposing Firm must sign the Proposal. Signature of the

Proposal will signify agreement and compliance with all requirements set forth in this RFP except where properly noted in the Proposal Response Forms. Proposers that take exception to NTMWD’s General Terms and Conditions, Special Provisions, and/or Scope of Work shall do so at the risk of Proposal rejection.

C. Tax Exempt Status: Purchases by NTMWD are exempt from sales and use tax under Section 151.309 of the

Texas Tax Code (the “Code”). In addition, purchases of tangible personal property and taxable services for the purpose of reselling them to NTMWD may also be exempt from sales and use tax under Code Section

151.302. Where legally permitted, a Consultant shall provide the vendor or supplier with a properly executed resale certificate at the time of purchasing tangible personal property and/or taxable services that are to be resold to NTMWD pursuant to a contract.

D. Acceptance of Specification Requirements: NTMWD will presume that the service offered complies with each requirement of the scope of work unless indicated otherwise. If the service offered is different than specified, Proposer must note the difference on an attached document that details the exception(s) to scope of work.

Failure of the Proposer to make the required acknowledgements may cause the Proposal to be considered non-responsive, in the sole determination of NTMWD. Should any product be delivered or service performed which is not as the Successful Proposer has purported it to be in its Proposal, said Successful Proposer will be required to correct any deficiencies without additional cost to NTMWD.

E. Proposer Requirements: The Proposer must have demonstrated experience of a similar nature and scope in the successful completion of the services to be performed pursuant to the Scope of Work. The Successful Proposer must take prime Consultant responsibility, including the management and performance of all subcontractors and products (goods) provided.

F. Proposer Costs: Any costs that may be incurred to prepare responses, attend meetings, attend site inspections, 25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 1 of 24 provide requested follow-up information, make formal and informal presentations, and / or contract negotiations, if applicable, shall be the sole responsibility of the Proposer.

G. Confidential or Proprietary Markings: Any portion of the Proposal that Proposer considers confidential or proprietary information, or to contain trade secrets of Proposing Firm, must be marked accordingly. This marking must be explicit as to the designated information. This designation may not necessarily guarantee the non-release of the information under the Public Information Act or as otherwise required by law but does provide NTMWD with a means to review the issues thoroughly and, if justified, request an opinion by the Attorney General's office prior to releasing any information requested under the Public Information Act.

4. PROPOSAL FORMAT REQUIREMENTS

Overview

To facilitate and expedite the evaluation process, all information in the Proposal should be organized and presented as directed below. A Proposal may be deemed to be non-responsive and may be disqualified, at NTMWD’s discretion, if the Proposal fails to comply with the following instructions.

Proposal Organization

The original hard copy Proposal shall be submitted in a 3-ring binder or electronically via Bonfire.

Proposals that are uploaded to Bonfire by the specified due date and time will satisfy the bidding requirements.

Proposal text shall be typed in font no smaller than 10 point, on 8.5-inch by 11-inch paper, with one-inch margins.

Proposals may be either single-sided or double-sided pages and single-spaced the entire document.

All Proposal sections shall be divided by the use of numeric index tabs. All pages within these sections shall be uniquely numbered for purposes of easy reference.

Proposals shall be assembled in accordance with the following format.

Cover Letter (1 Page Limit)

Include an explicit statement indicating that the Proposer, if successful, will be the Prime Consultant for the Work.

Table of Contents

Include references to sections and page numbers.

Disclosure Statements

Proposer’s disclosure and description of any outstanding legal issues and claims against it in connection with current Scope of Work or other Scope of Work undertaken in the last five (5) years.

Proposer shall include in its response a statement affirming that no member of NTMWD, no officer, director, agent, or employee of NTMWD, and no member of any commission, committee, NTMWD or corporation controlled or appointed by NTMWD has already received, in connection with or related in any way to this contract, or has been promised, in the event this contract is awarded to the firm, any commission, finder's fee or other thing of value. In addition, the firm shall furnish a statement that identifies any member of NTMWD and any official or employee of NTMWD who, the firm has reason to believe, would or may be financially affected, whether affirmatively or negatively, and whether personally or through a spouse or other family member, if this contract were awarded to the Proposer. Upon request by NTMWD’s Executive Director, or an authorized agent thereof, the Proposer shall respond to any questions relating to the subject of this section.

Addenda

The acknowledgement page(s) of all addenda issued by NTMWD shall be signed by the Proposer’s authorized representative and submitted in this section.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 2 of 24

Section 1 – Company Overview & Team Qualifications

Provide the name of the person who is authorized to answer questions regarding the firm’s proposal.

Please include a phone number and e-mail address.

Provide a brief overview of your firm including history, mission and/or philosophy, services offered, areas of expertise and organizational structure. Include the number of years in business and the size of company.

Describe your understanding of the work to be performed and your firm’s ability to perform the work within the time frame provided.

Describe your firm’s history in developing Cybersecurity Incident Response Plans, Business Continuity Plans and Disaster Recovery Plans for Supervisory Control and Data Acquisition (SCADA) and OT networks and how many your firm has developed in the last five (5) years. The firm must provide examples of demonstrated experience working in an OT environment.

Describe your firm’s history in developing Cybersecurity Incident Response Plans, Business Continuity

Plans and Disaster Recovery Plans for enterprise IT networks and how many your firm has developed in the last five (5) years. The firm must provide examples of demonstrated experience working in an IT environment.

Describe how and why your firm should be considered for this proposal. This should include an explanation of the firm’s philosophy, size, structure, and qualifications for serving governmental organizations with a similar size and operations.

Identify the key personnel who will be assigned to this project. Please provide resumes and/or background information that discuss their education, professional certifications, qualifications, and indicate their relevant experience with the development of Incident Response Plans, Business Continuity Plans and Disaster Recovery Plans for the following scopes:

1. SCADA and OT networks

2. Enterprise IT network

Indicate what specific responsibilities each individual listed above will have in regards to this project.

Proposers shall complete the forms titled “Vendor Supplemental Information” and “Proposal Endorsement” included in the Proposal Response Forms of this RFP.

Section 2 – Methodology and Approach

Describe and identify clearly and fully, your firms proposed approach to develop Cybersecurity Incident Response Plans, Business Continuity Plans, and Disaster Recovery Plans, including standards and/or frameworks utilized, software tools utilized, project communication approach etc. for the following scopes:

1. SCADA and OT networks

2. Enterprise IT network

Provide a detailed training plan overview. This shall include who will be performing the training and how the training will be executed for the following:

1. NTMWD SCADA and OT Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan

2. NTWMD IT Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan

Describe the tentative schedule required to provide a final Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan for SCADA and OT per the timeline dictated in this RFP.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 3 of 24

Describe the tentative schedule required to provide a final Incident Response Plan, Business Continuity

Plan and Disaster Recovery Plan for IT per the timeline dictated in this RFP.

Include a description of the proposed methodology to achieve the following:

1. IT, Operations, and Maintenance staff input

2. Critical asset identification

3. Asset risk analysis

4. Recovery resource identification

5. Development of the Incident Response and Business Continuity Plans

6. Staff training

Describe what assistance will be required from NTMWD’s staff.

Identify inherent Scope of Work challenges and the overall plan for meeting project management challenges and requirements.

Provide any additional information which will be useful in evaluating your proposal.

Section 3 – Past Experience

Please list a minimum of five (5) references each for OT and IT engagements, for which work has been completed. References shall be from customers for whom your firm has provided services in similar size and scope as the District needs specified in this request for proposal. Provide examples of recent, relevant projects. Please include a narrative description of the scope of the project, the tools and resources used, and the completion time of the projects referenced. The reference list should include public entities if available. Include the following information:

1. Company/Entity name

2. Location (city and state)

3. Contact name(s)

4. Phone number

5. Email address(s)

6. Description of work performed, duration of the implementation, and how it is relevant to the Scope of Work in this RFP. Also list any team members who worked on the referenced project that are also proposed for this RFP’s Scope of Work.

List all clients that have, in the past two (2) years, terminated their contract prior to the contract’s original completion date, including decisions by the client not to exercise remaining contract option years.

For any contracts listed, give the reason for termination (if known) and the names and telephone numbers of the client’s agent or employee responsible for administering the contract.

Pricing (Do not include this information in the binder)

Provide one (1) copy of the proposed pricing in a sealed envelope entitled “Pricing”. Proposal pricing shall be assembled and presented in accordance with the format and instructions of this RFP.

SUBMITTAL OF PROPOSALS

NTMWD will accept Proposals no later than the Deadline for Proposal Due Date and Time. NTMWD will not consider late proposals. All Proposals submitted in response to this RFP shall become the property of NTMWD and will not be returned to the Proposer.

Hard Copy Proposals must be signed, sealed in an envelope or container, and delivered to NTMWD’s

Procurement Department. Unsigned, unsealed or late Proposals will not be considered. The Proposer must submit one (1) original. The Proposal submittal must be clearly marked with the RFP Number, Proposal Due Date and Time and addressed to the attention of the Procurement Department.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 4 of 24

Proposals that are uploaded to Bonfire by the specified due date and time will satisfy the bidding requirements. Technical questions regarding how to upload your submission should be directed to Bonfire support. All other questions regarding this solicitation should be directed to the Public Q&A section on Bonfire by the question due date and time.

Proposer must provide all information requested in this RFP for a Proposal to be considered responsive.

Non-Compete Agreements or Clauses: By submission of a bid or proposal or the execution of a contract, Bidder/Consultant agrees that NTMWD will not be bound by any non-compete agreements or similar agreements that inhibit NTMWD’s right to award and execute a contract to any company that submits a bid or proposal to NTMWD.

PROPOSAL RECEIPT / EVALUATION OF PROPOSALS

Responses to this RFP (Proposals) become the exclusive property of NTMWD. Proposals will be opened by NTMWD so as to avoid disclosure of contents to competing Proposers and kept secret during the process of negotiation.

After Proposals are opened, they will be evaluated on the basis given in the Scope of Work and as described in the “Evaluation Criteria” Section of this RFP. Until final award of a Contract, NTMWD reserves the right to reject any or all Proposals, to waive technicalities, or to proceed with an award for the services otherwise as deemed in NTMWD’s best interest.

NTMWD reserves the right to require additional information from any or all Proposers and to conduct necessary investigations to determine (a) if the product and/or service offered meets NTMWD’s requirements, (b) the quality and reliability of the Proposer’s performance, and/or (c) to determine the accuracy of the Proposal information. As part of said investigations, NTMWD may interview and/or visit companies or public entities listed as references.

NTMWD reserves the right to select any/all options that is/are determined to be in its best interests and at the sole discretion of NTMWD.

PROPOSAL AWARD

If a Purchase Order or Contract is awarded as a result of this RFP, it will be made by NTMWD to the Proposer whose Proposal is determined to be the most advantageous to NTMWD, taking into consideration the relative importance of price and other evaluation factors, as identified in the Evaluation Criteria Section of this RFP.

Proposals shall remain valid during the evaluation process time period including award of the Purchase Order or Contract. This time period is a minimum of 120 days.

NTMWD reserves the right to make multiple awards if NTMWD believes it is in its best interest to do so.

NTMWD and the Consultant agree to perform this Contract in strict accordance with the documents listed below, all of which are made a part of this award, in the order of precedence listed:

• Addenda, if applicable

• Negotiated Modifications, if applicable

• RFP Scope of Work

• Special Provisions

• General Terms and Conditions

• Consultant’s Proposal

Consultant will sign a confidentiality agreement as it relates to the work and materials developed under and resulting from this Contract.

Proposer is required to review all the terms, conditions and contract provisions contained in this RFP to ensure it can comply with and concurs with all requirements.

Proposer is required to review the payment terms and is advised that, unless other terms are requested and accepted, payment shall be made within 30 days after receipt of a valid invoice or receipt of products /

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 5 of 24 services in accordance with the scope of work, whichever is later.

Under the resulting contract, NTMWD will not reimburse for expenses related to transportation, travel, and subsistence of Consultant incurred in discharge of duties connected with the Work. Any such costs should be built into the project proposal.

DETERMINATION OF NON-RESPONSIBLE PROPOSER

NTMWD may disqualify a Proposer as non-responsible and its Proposal shall not be considered for reasons including but not limited to the following:

• Reason for believing collusion exists among the Proposers.

• The Proposer being in arrears on any existing contract or having defaulted on a previous contract.

• Where the Proposer, in the judgment of NTMWD, has failed to perform in a satisfactory manner on a previous contract.

DETERMINATION OF NON-RESPONSIVE PROPOSAL

NTMWD may disqualify a Proposal as non-responsive and it shall not be considered for reasons including but not limited to the following:

• Proposal received after the Proposal Due Date and Time.

• Proposal was not signed.

REJECTION OF PROPOSALS

NTMWD will automatically reject any Proposal that is submitted after the Proposal Due Date and Time and return it unopened.

Until a Purchase Order is issued, NTMWD reserves the right to reject any or all Proposals, to waive technicalities, to re-solicit, to decline to proceed, or to otherwise proceed with procurement of goods and services herein defined by other method(s) allowed by law and in the best interests of NTMWD.

WITHDRAWING PROPOSALS

Proposer, by submitting a proposal, warrants and guarantees that the proposal has been carefully reviewed and checked and that it is in all things true, accurate and free of mistakes. However, Proposers have a common law right to withdraw a proposal due to material mistake in the proposal.

Proposer must submit a request to withdraw a proposal in writing to the Procurement Manager. The written request to withdraw a proposal must state the reason for the withdrawal request and, if the request is made after the Proposal Due Date and Time, the details of the material mistake must be included in the request.

A proposal for which withdrawal is properly requested prior to the Proposal Due Date and Time will be returned to the Proposer unopened.

If the Proposer elects to withdraw its proposal and the withdrawal is accepted by the Procurement Manager or Designee, then the proposal/bid will become null and void. The proposal/bid will not be eligible to be reinstated.

END OF PROPOSAL INSTRUCTIONS AND REQUIREMENTS

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 6 of 24

EVALUATION CRITERIA

1 The evaluation criteria listed below will be used to determine which proposal response is most advantageous to NTMWD. Said determination will be made by NTMWD based on NTMWD’s best interest, and shall be considered final. Responses received to this RFP will be evaluated based on the criteria and corresponding weight given in each evaluation category listed herein. NTMWD’s evaluation team may consider feedback from references and/or NTMWD’s direct experience with a Proposing Firm as part of their evaluation process and consideration for scoring proposals. NTMWD’s evaluation team reserves the right to shortlist firms based upon scores/ratings received during the evaluation process.

2 Discussions may be conducted with finalist firms as determined by the evaluation team for clarifications as needed. Proposers shall be treated fairly and equally with respect to any opportunity for discussions. Inasmuch as NTMWD may not request best and final offers, Proposers are strongly urged to provide competitive pricing since revisions may not be permitted after submissions and before the award of the Contract.

3 The evaluation criteria are listed below:

Criterion Weight

Company Overview, Qualifications and Experience of Firm (Sections 1) 35%

Methodology, Approach, Understanding of Work to be Performed (Section 2) 30%

Prior Experience Completing Similar Projects (Section 3) 15%

Price 20%

END OF EVALUATION CRITERIA

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 7 of 24

SCOPE OF WORK – SCADA and OT Networks

OVERVIEW

The North Texas Municipal Water District (NTMWD) provides Water, Wastewater, and Solid Waste services to over 2 million customers north and east of Dallas, Texas. To provide these services responsibly and reliably, NTMWD uses a SCADA System at a variety of different locations. With the emergence and continued presence of cyber threats, NTMWD is seeking to establish and maintain an incident response plan and a business continuity plan that will cover all NTMWD SCADA locations. Because this plan will apply to the SCADA system, the approach, recommendations, and techniques are expected to be somewhat different from those of a traditional Information Technology (IT) solution. Therefore, the selected contractor shall have significant experience in an Operational Technology (OT) environment. The OT environment consists of servers, workstations, programmable logic controllers (PLCs), firewalls, licensed and unlicensed radios, power monitoring devices, cellular modems, network switches and other IP-addressable devices. The incident response plans and business continuity plans for all NTMWD SCADA locations will be completed in phases. This initial phase will focus on one (1) to three (3) locations. Subsequent, optional renewal terms may have more than one (1) phase to allow in excess of three (3) locations as NTMWD project capacity and budget will allow.

STATEMENT OF WORK

This RFP shall procure the professional services of a contractor or firm with specific experience and expertise in creating Incident Response Plans (IRP) and Business Continuity Plans for Industrial Control Systems (ICS) and Operational Technology networks.

This IRP shall provide recommendations for protecting the ICS and provide documentation for preparing for and responding to disruptive incidents when the ICS is threatened or compromised. The contractor or firm shall understand ICS vulnerabilities, control system intrusion techniques and tools, and methods to prevent or mitigate ICS incidents. The contractor or firm shall demonstrate the proper application of the following standards for previous clients from the National Institute of Standards and Technology (NIST):

NIST SP 800-53 Revision 5 NIST SP 800-61 Revision 2 NIST SP 800-82 Revision 2 NIST SP 800-82 Revision 3

A. INCIDENT RESPONSE PLAN

The Incident Response Plan shall:

1. Establish goals and objectives for the plan.

2. Classify incidents.

3. Specify ways in which incidents are identified and reported.

4. Specify methods to prioritize incidents to determine the cause and immediate escalation is required.

5. Address contact information for resources needed to resolve the incident.

6. Provide methods to evaluate and analyze a reported incident.

7. Define specific procedures for each type of incident.

8. Address communications with the media, first responders, civil authorities, and local and global organizational contacts.

9. Address cyber forensics.

10. Identify roles and responsibilities.

11. Establish mechanisms that outside parties can use to report incidents.

The IRP shall fully cover ICS cyber incident response to include prevention, preparation, planning, incident management, recovery, mitigation, remediation, post incident analysis, and lessons learned. The contractor or firm shall identify potential vulnerabilities, identify current control measures and preparedness, and develop recommendations to mitigate deficiencies.

B. BUSINESS CONTINUITY PLAN

Business continuity planning is important in responding to situations where SCADA Systems operations have been impacted. This business continuity plan specifies roles and responsibilities, assigns personnel to activities associated with restoring plant operations after a disruption or failure.

The Business Continuity Plan shall document the procedures necessary to maintain essential services and mission-critical functions during disasters that affect the ICS system. The Business Continuity Plan shall also detail the procedures

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 8 of 24 for returning the ICS to the best possible operating state that existed before the incident. The contractor shall develop the comprehensive Business Continuity Plan to ensure NTMWD maintains the appropriate mission-critical functions. The Business Continuity Plan shall identify agencies, chain of command, the organizational relationship between NTMWD and other agencies and critical service providers, and the relationship between NTMWD and post-emergency response resources (e.g., State assistance). The Business Continuity Plan shall include NTMWD-specific planning for critical personnel and systems, as well as other functions and the plan and implementation procedures to ensure continued operations during and emergency event.

The Business Continuity Plan shall be developed to restore full operation of affected facilities in the shortest amount of time following the detection of an incident. The Business Continuity Plan shall:

1. Identify essential missions and business functions and their associated continuity requirements.

2. Define recovery objectives, restoration priorities, and metrics, to include but not be limited to, protecting sensitive data, communicating with stakeholders, and restoring normal operations.

3. Document contingency roles, responsibilities, assigned individuals with contact information.

4. Document the methods for maintaining essential missions and business functions despite disruption, compromise, or failure of one or more of the NTMWD SCADA systems.

5. Specify the continuance of essential missions and business functions with little or no loss of operational continuity and support that continuity until full SCADA system restoration at primary operations, processing, and/or storage sites.

6. Document the process for SCADA system restoration without deterioration of the security safeguards originally planned and implemented.

7. Include capacity planning for information processing, telecommunications, and environmental support during event operations.

Determine the need for and feasibility of an alternate storage site and an alternate operations or process site. The alternate storage site is an offsite location where relevant SCADA configuration and data backups are securely stored and can be used in recovery operations from a loss of SCADA configuration or data. The characteristics of an alternate storage site include:

1. Necessary agreements to permit the storage and retrieval of SCADA system backup information.

2. Security safeguards equivalent to the primary site.

3. Physical separation between the primary and alternate sites to reduce the susceptibility to the same threats.

4. Configuration to facilitate recovery operations in accordance with defined recovery time and recovery point objectives.

5. Limited to no accessibility problems in the event of an area-wide disruption or disaster and explicit mitigation actions if there are access limitations.

The alternate operations or process site is an offsite location placed into operation when the primary site is unable to continue operations. To facilitate the support of operations when the primary site is lost, the characteristics of an alternate operations or process site include:

1. Necessary service agreements to permit the transfer and resumption of SCADA systems for essential missions/business functions within a specified timeframe when the primary operations or processing capabilities are unavailable.

2. Equipment and supplies required to transfer and resume operations at the alternate operations or processing site within the organization-defined time period for transfer/resumption.

3. Security safeguards equivalent to the primary site.

4. Separation from the primary operations or processing site to reduce susceptibility to the same threats.

5. Limited to no accessibility problems to the alternate operations or processing site in the event of an area-wide disruption or disaster and explicit mitigation actions if there are access limitations.

Telecommunication Services are essential to continued operations. The awarded firm shall provide recommendations for alternate telecommunications to permit the resumption of SCADA systems operations for essential missions and business functions within a specified timeframe when primary telecommunications capabilities are unavailable at either the primary or alternate operating, processing, or storage sites.

C. DISASTER RECOVERY PLAN

NTMWD Disaster Recovery Plan (DRP) is essential to continued availability of the SCADA systems. A DRP is required as part of this RFP. DRP should include the following items:

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 9 of 24

1. Required response to events or conditions of varying duration and severity that would activate the recovery plan.

2. Procedures for operating the SCADA systems in manual mode with all external electronic connections severed until secure conditions can be restored.

3. Roles and responsibilities of responders.

4. Procedures to recover and reconstitute the SCADA system to a known state after a disruption, compromise, or failure.

5. Procedures to restore SCADA system components within a specified time from controlled and integrity-protected information representing a known, operational state for the components.

6. Complete and up-to-date SCADA network diagrams.

7. Personnel list for authorized physical and cyber access to the SCADA systems.

8. Communication procedure and a list of personnel to contact in the case of an emergency including SCADA system vendors, network administrators, SCADA support personnel, etc.

9. Current information for all SCADA components.

10. Requirements for the timely replacement of components in the case of an emergency.

TASKS

In addition to the development of the plans, the following project management duties shall be provided by the awarded firm:

A. EXISTING DATA COLLECTION

NTMWD will provide all relevant data requested to assist with the development of the IRP, Business Continuity Plan and Disaster Recovery Plan.

B. MEETINGS

The awarded firm shall be expected to attend and lead meetings, clarify outstanding issues and respond to NTMWD comments when drafting the plans. Meetings will be scheduled at intervals determined by NTMWD and awarded firm.

The following types of meetings are to be expected:

1. Kickoff Meeting – conduct one (1) initial kick-off meeting to review goals, schedule, and deliverables for the project.

2. Progress Meetings – participate in a minimum of one progress meeting per month to discuss progress since last meeting, expected achievements for the next month, outstanding issues that have not been resolved, change orders, and information needs.

C. TRAINING

Training shall be provided by the awarded firm and shall include how to execute the developed plans.

DELIVERABLES

The awarded firm shall provide both a draft Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan and a final Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan in digital and hard copy format by the dates provided in the section below as well as Training.

TIMELINE

Draft plans shall be provided no later than June 30th and final plans shall be delivered by August 31st of the current fiscal year.

DATA OWNERSHIP

All materials developed under this contract are property of NTMWD. Under no circumstances shall the firm place a copyright on any material that the firm develops, provides, and receives for payment under this contract. All materials, to include source codes for programming, shall be provided to NTMWD representative at the time of project completion and closeout in a format defined by NTMWD. In conducting business and in anticipation of conducting business with contractor, it may be necessary for NTMWD to share trade secrets and/or other confidential information and/or proprietary information or matter with contractor. The parties agree that such information and the materials referenced in the contract, the results and developments therefrom are confidential/proprietary information which belongs to NTMWD. Contractor agrees not to disclose to any third party any such trade secrets and/or confidential or proprietary information for its own separate benefits. Contractor will be responsible for its employees or agents complying with the provisions of this Contract.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 10 of 24

SCOPE OF WORK – Enterprise IT Network

OVERVIEW

The North Texas Municipal Water District (NTMWD) provides Water, Wastewater, and Solid Waste services to over 2 million customers north and east of Dallas, Texas. Outside of plant operations to provide these services, NTMWD operates an enterprise Information Technology (IT) network in a variety of locations including operational facilities and support or administrative facilities.

With the emergence and continued presence of cyber threats, NTMWD is seeking to establish and maintain an incident response plan and a business continuity plan that will cover all NTMWD enterprise locations. Because this plan will apply to the enterprise IT system, the approach, recommendations, and techniques are expected to be somewhat different from those of a SCADA system. Therefore, the selected contractor shall have significant experience in an IT environment. The IT environment consists of servers, storage arrays, workstations, firewalls, cellular modems, network switches, routers, wireless access points, other IP-addressable devices and many Software as a Service (SaaS) solutions. The incident response plans and business continuity plans for the NTMWD IT environment will be completed in one phase and can be done in parallel with the OT scope of work.

STATEMENT OF WORK

This RFP shall procure the professional services of a contractor or firm with specific experience and expertise in creating Incident Response Plans (IRP) and Business Continuity Plans for information technology networks. This IRP shall provide recommendations for protecting the IT environment and provide documentation for preparing for and responding to disruptive incidents when the organization is threatened or compromised. The contractor or firm shall understand vulnerabilities, system intrusion techniques and tools, and methods to prevent or mitigate cybersecurity incidents. The contractor or firm shall demonstrate the proper application of the following standards for previous clients from the National Institute of Standards and Technology (NIST):

NIST SP 800-53 Revision 5 NIST SP 800-61 Revision 2

A. INCIDENT RESPONSE PLAN

The Incident Response Plan shall:

1. Establish goals and objectives for the plan.

2. Classify incidents.

3. Specify ways in which incidents are identified and reported.

4. Specify methods to prioritize incidents to determine the cause and immediate escalation is required.

5. Address contact information for resources needed to resolve the incident.

6. Provide methods to evaluate and analyze a reported incident.

7. Define specific procedures for each type of incident.

8. Address communications with the media, first responders, civil authorities, and local and global organizational contacts.

9. Address cyber forensics.

10. Identify roles and responsibilities.

11. Establish mechanisms that outside parties can use to report incidents.

The IRP shall fully cover IT cyber incident response to include prevention, preparation, planning, incident management, recovery, mitigation, remediation, post incident analysis, and lessons learned. The contractor or firm shall identify potential vulnerabilities, identify current control measures and preparedness, and develop recommendations to mitigate deficiencies.

B. BUSINESS CONTINUITY PLAN

Business continuity planning is important in responding to situations where IT system operations have been impacted.

This business continuity plan specifies roles and responsibilities, assigns personnel to activities associated with restoring District operations after a disruption or failure.

The Business Continuity Plan shall document the procedures necessary to maintain essential services and mission-critical functions during disasters that affect the IT system. The Business Continuity Plan shall also detail the procedures for returning the IT environment to the best possible operating state that existed before the incident. The contractor shall develop the comprehensive Business Continuity Plan to ensure NTMWD maintains the appropriate mission-critical functions. The Business Continuity Plan shall identify agencies, chain of command, the organizational relationship between NTMWD and other agencies and critical service providers, and the relationship between NTMWD and post-emergency response resources (e.g., State assistance). The Business Continuity Plan shall include NTMWD-specific

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 11 of 24 planning for critical personnel and systems, as well as other functions and the plan and implementation procedures to ensure continued operations during and emergency event.

The Business Continuity Plan shall be developed to restore full operation of affected facilities in the shortest amount of time following the detection of an incident. The Business Continuity Plan shall:

1. Identify essential missions and business functions and their associated continuity requirements.

2. Define recovery objectives, restoration priorities, and metrics, to include but not be limited to, protecting sensitive data, communicating with stakeholders, and restoring normal operations.

3. Document contingency roles, responsibilities, assigned individuals with contact information.

4. Document the methods for maintaining essential missions and business functions despite disruption, compromise, or failure of one or more of the NTMWD IT systems.

5. Specify the continuance of essential missions and business functions with little or no loss of operational continuity and support that continuity until full IT system restoration at primary operations, processing, and/or storage sites.

6. Document the process for IT system restoration without deterioration of the security safeguards originally planned and implemented.

7. Include capacity planning for information processing, telecommunications, and environmental support during event operations.

Determine the need for and feasibility of an alternate storage site and an alternate operations or process site. The alternate storage site is an offsite location where relevant IT configuration and data backups are securely stored and can be used in recovery operations from a loss of IT configuration or data. The characteristics of an alternate storage site include:

1. Necessary agreements to permit the storage and retrieval of IT system backup information.

2. Security safeguards equivalent to the primary site.

3. Physical separation between the primary and alternate sites to reduce the susceptibility to the same threats.

4. Configuration to facilitate recovery operations in accordance with defined recovery time and recovery point objectives.

5. Limited to no accessibility problems in the event of an area-wide disruption or disaster and explicit mitigation actions if there are access limitations.

The alternate operations or process site is an offsite location placed into operation when the primary site is unable to continue operations. To facilitate the support of operations when the primary site is lost, the characteristics of an alternate operations or process site include:

1. Necessary service agreements to permit the transfer and resumption of IT systems for essential missions/business functions within a specified timeframe when the primary operations or processing capabilities are unavailable.

2. Equipment and supplies required to transfer and resume operations at the alternate operations or processing site within the organization-defined time period for transfer/resumption.

3. Security safeguards equivalent to the primary site.

4. Separation from the primary operations or processing site to reduce susceptibility to the same threats.

5. Limited to no accessibility problems to the alternate operations or processing site in the event of an area-wide disruption or disaster and explicit mitigation actions if there are access limitations.

Telecommunication Services are essential to continued operations. The awarded firm shall provide recommendations for alternate telecommunications to permit the resumption of IT operations for essential missions and business functions within a specified timeframe when primary telecommunications capabilities are unavailable at either the primary or alternate operating, processing, or storage sites.

C. DISASTER RECOVERY PLAN

NTMWD Disaster Recovery Plan (DRP) is essential to continued availability of IT systems. A DRP is required as part of this RFP. DRP should include the following items:

1. Required response to events or conditions of varying duration and severity that would activate the recovery plan.

2. Procedures for operating administrative and support processes in manual mode with all external electronic connections severed until secure conditions can be restored.

3. Roles and responsibilities of responders.

4. Procedures to recover and reconstitute the IT system to a known state after a disruption, compromise, or failure.

25-215-P Information Technology & SCADA Cybersecurity Incident Response Plans Page 12 of 24

5. Procedures to restore IT system components within a specified time from controlled and integrity-protected information representing a known, operational state for the components.

6. Complete and up-to-date IT network diagrams.

7. Personnel list for authorized physical and cyber access to the IT systems.

8. Communication procedure and a list of personnel to contact in the case of an emergency including IT system vendors, network administrators, IT support personnel, etc.

9. Current information for all IT components.

10. Requirements for the timely replacement of components in the case of an emergency.

TASKS

In addition to the development of the plans, the following project management duties shall be provided by the awarded firm:

A. EXISTING DATA COLLECTION

NTMWD will provide all relevant data requested to assist with the development of the IRP, Business Continuity Plan and Disaster Recovery Plan.

B. MEETINGS

The awarded firm shall be expected to attend and lead meetings, clarify outstanding issues and respond to comments from the District when drafting the plans. Meetings will be scheduled at intervals determined by NTMWD and awarded firm. The following types of meetings are to be expected:

1. Kickoff Meeting – conduct one (1) initial kick-off meeting to review goals, schedule, and deliverables for the project.

2. Progress Meetings – participate in a minimum of one progress meeting per month to discuss progress since last meeting, expected achievements for the next month, outstanding issues that have not been resolved, change orders, and information needs.

C. TRAINING

Training shall be provided by the awarded firm and shall include how to execute the developed plans.

DELIVERABLES

The awarded firm shall provide both a draft Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan and a final Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan in digital and hard copy format by the dates provided in the section below as well as Training.

TIMELINE

Draft plans shall be provided no later than June 30th and final plans shall be delivered by August 31st of the current fiscal year.

DATA OWNERSHIP

All materials developed under this…