lsj.pdf

Single Source Justification

Western Area Power Administration

FAR 13.106-1(b)(1), Simplified Acquisitions

19WA129700

1. Identification of the agency and the contracting office.

Western Area Power Administration (WAPA), Upper Great Plains Region, Billings, Montana.

2. Description of supply or service required to meet the agency’s needs.

WAPA requires Project Management services for NERC CIP-012-1 Plan Development. A sole source, firm fixed price contract order will be awarded.

3. The rationale or circumstances for limiting competition.

The NERC standard CIP-013 marks a radical departure from all previous NERC standards. To successfully implement a plan to address the requirements of this standard, it is essential to have a

Project Manager that understands the unique features of CIP-013 to determine the compliance process and develop a plan. These features include:

1. Implementing and maintaining compliance with CIP-013 will require a number of groups within

WAPA to be involved, including Procurement, Maintenance, IT, NERC Compliance and Legal.

2. CIP-013 is the first true risk-based NERC standard, as FERC mandated in Order 829 and requires a completely different approach than performance based standards.

3. The developed plan must address cyber security threats to the BES from vendor products and services, resulting from a) procuring vendor equipment and software; b) installing vendor equipment and software; and c) transitions from one vendor to another. An important part of the initial compliance planning process will be to identify the threats that apply to WAPA in each of these three areas, as well as the relative degree of risk that each threat poses in WAPA’s environment.

4. The new plan shall address 1) threats resulting from installing vendor equipment and software including inadequate user authentication procedures and lack of appropriate network segmentation; 2) threats resulting from transitions from one vendor to another could include relaxation of security controls and lack of proper training on the new system.

5. Each threat identified will need to develop a preferred set of controls, based on the level of vendor and BCS risk. These controls will be needed to provide a “menu” of options for WAPA

Procurement and IT people as they approach each vendor.

6. There will need to be a method of tracking what controls were in fact implemented for each vendor, for each threat.

7. As part of developing the CIP-013 compliance program, it is important to set up a mechanism for review and update of the plan every 15 months leveraging the work done in developing the original supply chain security plan.

Tom Alrich (Tom Alrich, LLC) has been an acknowledged NERC CIP expert for 5 years. He is the only known industry expert to offer his services specifically for CIP-013 development and implementation.

He is also the only vendor to repeatedly and continuously demonstrate a thorough understanding of CIP-

013 and the 7 points above. He does this via:

1. A regularly posted blog on CIP compliance, specifically CIP-013 and its corporate business implications, predicted audit approach, legal ramifications and potential pitfalls.

2. Attendance at the NERC CIP-013 standard development meetings while the standard was being written

3. Participating as an industry expert at NERC’s request in conference panel discussions (e.g.:

CIP-013 implications discussion at NERC’s GridSecCon 2017).

4. Sharing his knowledge through industry conference presentations and directly visiting companies.