Attachment1-SOWSecurityAssessmentofNGDVChargingStations.pdf

6HQOIG-24-A-XXXX Attachment 1 1

United States Postal Service Office of Inspector General

Office of Audit

Cybersecurity and Technology Directorate

Statement of Work

Security Assessment of Electronic Vehicle Charging Stations

1. Introduction

The United States Postal Service (USPS) Office of Inspector General (OIG) is seeking to award a task order to a Supplier who will perform a security assessment of the USPS Electric Vehicle Supplier Equipment (EVSE), more commonly known as charging stations.

The contract type for this task order is Firm-Fixed-Price and Cost Reimbursable for any necessary travel. The Period of Performance will be one base year.

2. Background

The USPS OIG is an independent agency providing oversight to the USPS and the Postal Regulatory Commission (PRC). Its mission is to:

• Conduct and supervise objective and independent audits, reviews, and investigations relating to Postal Service and PRC programs and operations.

• Promote economy, efficiency, and effectiveness within the Postal Service and

PRC.

• Inform the Postal Service Governors, Postal Service management, PRC Commissioners and Congress of problems, deficiencies, and corresponding corrective actions.

To manage its aging fleet, the USPS plans to modernize mail delivery by creating an efficient network to reach its 163 million delivery locations across the country and further strengthen the sustainability of its critical public service. In December

2022, USPS announced it will invest $9.6 billion to electrify delivery vehicles and install modern charging infrastructures at USPS facilities.

To prepare for the deployment of electric vehicles, in February 2023, USPS awarded three supplier contracts to deliver charging stations and placed an initial order of charging stations used to conduct First Article Testing (FAT) – a process to test and evaluate them for conformance to specified contract requirements before or in the initial stage of production. The USPS used the FAT as an opportunity to measure and compare the security related to the confidentiality, integrity, and availability of the charging stations’ performance and operational data.

6HQOIG-24-A-XXXX Attachment 1 2

3. Scope of Work

The OIG is seeking a Supplier to test, evaluate and analyze USPS’s charging stations and infrastructure to determine whether industrial and other relevant IT security controls are in place and properly configured to prevent unauthorized access through potentially vulnerable points and identify significant vulnerabilities within the security infrastructure to prevent 1) the modification and/or disclosure of sensitive and/or proprietary data, 2) disruption of USPS’s ability to charge its vehicles, and 3) unauthorized use of its charging stations.

Technical and Security Specifications of USPS charging stations:

1. Support AC Level 2 charging through the J1772 Standard connector

2. Deliver an output of 80 amps at 240 VAC (19.2kW) continuously

3. Provide lower-power AC Level 2 EVSE equipment in certain installations where the existing electrical infrastructure is not capable of accommodating the 80-amp

4. The charging stations must comply with SAE J1772 Standard, NEC, and all federal, state, and local code requirements and be UL certified.

5. Provide site energy management and data communications between the EVSE hardware and the management software compliant with OCPP version 1.6.

6. Accommodate integration of a third-party telematics supplier cloud, to provide dynamic charging based on vehicle-reported conditions.

7. Include energy management software that validates the user and vehicle before the charging station activates to dispense power; restarts a previously authorized vehicle charge if the utility power failed and came back on; allow USPS, on a site-to-site basis, to set charging schedules to maximize efficiencies such as limiting charging during utility-designated demand periods.

8. Allows USPS to add, remove, and edit authorized vehicles and users

9. Include communication software system that allows USPS to set system controls and parameters from an office-based computer system; and provide USPS with the following data in dashboard format as well as data that can be downloaded for spreadsheet analysis.

In order to accomplish the above scope, the Supplier shall perform the following tasks:

• Physical assessment of security controls of EV charging stations.

• Assessment of communication protocols being utilized and security of transmission of data.

• Vulnerability assessment of charging station firmware.

• Security of vendor and USPS configurations management websites.

Contractor/Audit Process and Requirements:

6HQOIG-24-A-XXXX Attachment 1 3

A. Kick-off Meeting Within five business days after contract award (ACA), the Supplier shall schedule and coordinate a virtual Kick-Off Meeting. The meeting will provide an introduction between the Supplier and OIG personnel involved with the project.

The meeting will provide the opportunity to discuss technical, management, security issues, and reporting procedures.

During this meeting, the Supplier will present specific proposed methodologies for completing the items outlined in the scope of work section of this document;

the available USPS documents needed from the OIG to conduct this task; and the schedule for completion. This meeting will also allow the OIG to review and give feedback on the proposed methodologies. At a minimum, the attendees shall include Supplier key personnel, representatives from the OIG Cybersecurity and Technology directorate, other relevant OIG personnel, and the OIG Contracting Officer’s Representative.

B. Meetings The Supplier must attend weekly meetings and other meetings as needed to support the full OIG audit engagement process. Besides weekly meetings, the Supplier shall meet with the OIG seven days before deliverable due dates to perform a pre-deliverable review and ensure requirements will be met. These meetings will be virtual; however, the supplier should be available to support in-person meetings at OIG Headquarters in Arlington, VA and/or at the Contractor’s testing center(s) as determined by the Audit Director.

C. Technical Support Supplier must provide the OIG with tactics, techniques, and procedures (TTP's) utilized for every phase of the assessment. These TTP’s are a deliverable item and must be written with sufficient detail that includes how tools and any custom testing scripts were used during every phase of the assessment. The Supplier must provide access to testing enclaves to facilitate observation and validation by

OIG IT Specialists. The Supplier must ensure steps are taken proactively to minimize negative impact to all systems and minimize system downtime.

D. Audit Engagement Support The Supplier must continue to support the contract through project close-out that must occur at the exit conference or up to 250 days ACA. The Supplier must provide a primary POC to coordinate answers to questions and to arrange meetings with the OIG and USPS officials for validation sessions and the exit conference. The POC must work with the OIG to coordinate travel dates for any in-person meetings.

E. Travel

6HQOIG-24-A-XXXX Attachment 1 4

The Supplier may have to travel. If travel is required, the Supplier must submit a detailed request and cost estimate to the OIG COR. If approved, the task order must be modified to add funding for travel before the travel being executed. If required and approved, travel costs will be invoiced and paid under a separate cost-only contract line item.

F. Support Generally Accepted Government Auditing Standards. The Supplier must attest, in writing, to have maintained an attitude of impartiality, having intellectual honesty, and being free of conflicts of interest, in the work performed.

a. The Supplier must provide sufficiently detailed information to support procedures, findings, assumptions, and methods used to develop best practices or supporting documents.

b. The Supplier must document, in writing, its overall efforts and internal processes to ensure quality control, if best practices and supporting documents are provided.

c. The OIG operates under the US Government Accountability Office’s Government Auditing Standards (GAGAS). Thus, the Supplier must complete the following to support the guidance relating to independence, reporting, and quality control.

G. Closeout Meeting No later than two weeks after the review of the OIG’s audit report has been completed, the Supplier must participate in a virtual Closeout Meeting with the OIG. Participants in the meeting must be the Supplier’s key personnel and any OIG personnel involved with the project. The meeting will provide an opportunity to discuss any residual work required to be completed by either party before the end of the period of performance. In addition, the meeting will allow opportunity for both parties to provide feedback (what went well, what could be improved, etc.).

H. Security Assessment of USPS Charging Stations

1. Perform a security assessment of USPS’s charging stations and supporting infrastructure.

a. Within 20 days ACA, the Supplier must provide a Technical Assessment Plan (TAP) that covers the methodology, timeline, estimate of hours, and types of personnel used based upon the OIG identification of applications and/or systems to be tested. The testing shall occur at USPS locations approved by the OIG.

b. Within seven days of completion of each assessment activity and NLT 100 days ACA, the Supplier must upload raw data resulting from assessment and analysis activities to Secure File

6HQOIG-24-A-XXXX Attachment 1 5

Transfer/eShare and send it to the OIG project team.

2. Communication Plan

a. The Supplier must coordinate a communication plan for assessment activities with the OIG. The Supplier must inform the OIG and USPS before assessment activities are conducted. The Supplier shall not communicate issues directly to the USPS unless otherwise approved by the OIG. The communication plan must be included in the TAP.

3. Review, Analysis, and Recommendations

a. The Supplier must review the results of its engagement and analysis activities to identify associated security weaknesses. If additional security concerns are identified during the assessment and analysis activities, the Supplier must assess these weaknesses to include potential impact. All identified security concerns that could have significant implications must be reported to the Audit Manager and IT Specialist.

b. The Supplier must ensure all findings and recommendations are tied to USPS Internal Standards, Federal Government standards, and/or industry best practices. The Supplier must review USPS internal standards and compliance with industry best practices and Federal Government standards.

c. In the remediation/recommendations section, the Supplier must identify exceptions from internal standards that do not comply to best practices and as-is configurations that do not comply with internal standards. The Supplier's recommendations must incorporate industry best practices. As security weaknesses are identified, the Supplier must provide supporting documentation to validate recommendations.

4. Reporting

a. Within 180 days ACA, the Supplier must submit the final report that must include sources to support conclusions, false positives, root cause analysis, and remediation recommendations. The Supplier must upload all reports to Secure File Transfer for distribution to the OIG Project Team.

4. Deliverables

The Supplier shall deliver these items by the dates specified in the table below:

Deliverable Number

Description Due Date(s) Reference SOW Section

1 Kick-Off Meeting 5 Days ACA 3A

2 Meetings Weekly 3B

6HQOIG-24-A-XXXX Attachment 1 6

3 Technical Support As Needed 3C

4 Audit Engagement Support

Exit Conference date up to 250

ACA

3D

5 Travel As Needed 3E

6 Closeout Meetings NLT 2-weeks after Final

Report

3G

7 Technical Assessment Plan

20 Days ACA 3H-1a

8 Security Assessment of USPS Charging

Stations

130 Days ACA 3H

9 Raw Data 100 Days ACA 3H-1b

10 Review Analysis and Recommendations

100 Days ACA 3H-3a-c

11 Reporting 180 Days ACA