CIP-005-7_and_CIP-007-6_OT_Firewall_Infrastructure_and_Compliance_Assessment.pdf

REQUEST FOR PROPOSAL

2026-RFP-007

CIP-005-7 AND CIP-007-6 OT FIREWALL INFRASTRUCTURE AND

COMPLIANCE ASSESSMENT

City of Lakeland

1140 E. Parker Street

Lakeland, FL 33801

RELEASE DATE: January 30, 2026

DEADLINE FOR QUESTIONS: February 16, 2026

RESPONSE DEADLINE: February 25, 2026, 2:00 pm

RESPONSES MUST BE SUBMITTED ELECTRONICALLY TO:

https://secure.procurenow.com/portal/lakelandgov https://secure.procurenow.com/portal/%7bproject.government.code%7d

City of Lakeland

CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance

Assessment

I. NOTICE

II. INTRODUCTION

III. SCOPE OF WORK

IV. SELECTION CRITERIA

V. INSURANCE AND SAFETY REQUIREMENTS

VI. SPECIFICATION OF SAFETY AND OCCUPATIONAL HEALTH

VII. VENDOR QUESTIONNAIRE

VIII. PRICING PROPOSAL

Attachments:

B - Indemnification 2026 Consultant

H - Human Trafficking Affidavit

I - Non-Disclosure_and_Confidentiality_Agreement

Request For Proposal #2026-RFP-007 Title: CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment

1. NOTICE

CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment

FOR THE CITY OF LAKELAND

Friday, January 30, 2026

RFP No.2026-RFP-007

Sealed proposals will be received electronically by the Purchasing Manager via OpenGov, the City’s e-

Procurement Portal (“Portal”), until 2:00 pm – Wednesday, February 25, 2026. Proposals received after this specified time and date will not be considered. The sealed proposals will be publicly opened and read aloud on the same date and time in the office of the Purchasing Manager for the following:

RFP Documents may be accessed by visiting our Website athttps://procurement.opengov.com/portal/lakelandgov or by contacting the City of Lakeland

Purchasing Division @ (863) 834-6780.RFP Documents are Required for Submittal. Respondents are required to submit their response through the Portal. Respondents shall sign up on the Portal if an account does not exist.

THE CITY OF LAKELAND IS SOLICITING SEALED PROPOSALS FROM QUALIFIED VENDORS TO

PROVIDE:CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment.

THE PROPOSALS SUBMITTED SHALL BE IN COMPLETE ACCORDANCE WITH, WITHOUT LIMITATION, THIS REQUEST FOR PROPOSAL, THE ATTACHED CITY OF LAKELAND SPECIFICATIONS, ALL CODES AND

REQUIREMENTS REFERENCED THEREIN.

All Questions regarding this request for proposals shall be in writing and submitted electronically via the

Portal through the Question and Answer tab before 5:00 pm on Monday, February 16, 2026. Responses will be released on the Question and Answer Tab.

1.1. CLARIFICATION AND/OR EXCEPTIONS OF DOCUMENTATION

Bidders requiring clarification or having a dispute with these documents must advise the City Purchasing

Division of the nature of the required clarification or basis of the dispute, in writing, no later than 5:00 pm on Monday, February 16, 2026 via the Portal's Question and Answer tab. If no written contact has been made by this specified date, the Bidder waives the right to any future consideration and accepts the documents as published and/or revised by the City. Additionally, submitting a signed bid shall be construed as a total compliance statement. Note: Any use of brand names (manufacturer) in this invitation and specification is for Bidder convenience only and shall not limit this offering. Equal or better equipment and alternate bids may be given consideration.

https://procurement.opengov.com/portal/lakelandgov

1.2. FLORIDA PUBLIC RECORDS LAW

IF THE CONTRACTOR HAS QUESTIONS REGARDING THE APPLICATION OF

CHAPTER 119, FLORIDA STATUTES, TO THE CONTRACTOR’S DUTY TO PROVIDE

PUBLIC RECORDS RELATING TO THIS CONTRACT, CONTACT THE CUSTODIAN OF

PUBLIC RECORDS: KELLY S. KOOS – CITY CLERK AT: PHONE: 863-834-6210, E-

MAIL: cityclerk@lakelandgov.net, MAIL: ATTN: CITY CLERK 228 S.

MASSACHUSETTS AVE., LAKELAND, FLORIDA 33801.

In accordance with Florida Statute §119.0701, the Contractor shall keep and maintain public records required by the City in performance of services pursuant to the contract. Upon request from the City’s custodian of public records, Contractor shall provide the City with a copy of the requested records or allow the records to be inspected or copied within a reasonable time at a cost that does not exceed the cost provided pursuant to Florida Statute Chapter 119 or as otherwise provided by law. Contractor shall ensure that public records that are exempt or confidential and exempt from public records disclosure requirements are not disclosed except as authorized by law for the duration of the contract term and following completion of the contract if the Contractor does not transfer the records to the City. Contractor shall, upon completion of the contract, transfer, at no cost, to the City all public records in possession of the Contractor or keep and maintain public records required by the City to perform services pursuant to the contract. If the Contractor transfers all public records to the City upon completion of the contract, the Contractor shall destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. If the Contractor keeps and maintains public records upon completion of the contract, the Contractor shall meet all applicable requirements for retaining public records. All records stored electronically must be provided to the City, upon request from the City’s custodian of public records, in a format that is compatible with the information technology systems of the City.

1.3. EXPARTE COMMUNICATION

Please note that to insure the proper and fair evaluation of a proposal the City of Lakeland prohibits exparte communication (i.e., unsolicited) initiated by the Respondent to the City Official or Employee evaluating or considering the proposals prior to the time a bid decision has been made. Communication between Respondent and the City will be initiated by the appropriate City Official or Employee in order to obtain information or clarification needed to develop a proper and accurate evaluation of the proposal. Exparte communication may be grounds for disqualifying the offending Respondent from consideration or award of the proposal, then in evaluation, or any future proposal.

1.4. INSURANCE AND SAFETY REQUIREMENTS

All insurance shall be secured from or countersigned by an agent or surety company recognized in good standing and authorized to do business in the State of Florida.

The Contractor shall, within ten (10) days of notification of award and prior to commencement of work, take out and maintain in full force and effect minimum insurance coverage as specified in the attached requirements. This insurance shall remain in force and effect throughout the duration of the contract.

A certificate of existing insurance coverage should be submitted with the proposal as proof of insurability. If the current coverage does not meet the RFP requirements, then the Respondent should mailto:cityclerk@lakelandgov.net request an affidavit of insurability from the Respondent’s insurance agent that certifies the requirements can and will be met. Failure to provide adequate insurance coverage may be cause for disqualification as non-responsive to the RFP requirements. The Contractor agrees to accept and abide by the City of Lakeland safety regulations in complete accordance with the attached requirements.

1.5. INDEMNIFICATION AGREEMENT

The Contractor agrees to indemnify and hold harmless the City of Lakeland in complete accordance with the attached requirements. This agreement shall be signed, notarized and returned with the RFP submittal. Failure to provide the Hold Harmless Indemnification Agreement may be cause for disqualification as non-responsive to the RFP requirements.

1.6. HUMAN TRAFFICKING -- F.S. 787.06(14)

In compliance with Section 787.06(14), Florida Statutes, the attached Affidavit must be completed by an officer or representative of a nongovernmental entity that is executing, renewing, or extending a contract with the City of Lakeland, Florida (the “Governmental Entity”). This attests under penalty of perjury that the nongovernmental entity does not use coercion for labor or services when a contract is executed, renewed or extended between a governmental entity.

1.7. DRUG-FREE WORKPLACE CERTIFICATION

By submitting a proposal in response to this Request for Proposal, you are certifying that your company is a drug-free workplace in accordance with Florida Statute 287.087.

1.8. SUSPENSION AND DEBARMENT CERTIFICATION

By submitting a bid in response to this Invitation to Bid, you are certifying that your company, pursuant to 49 CFR Part 29: (1) is not presently suspended or debarred as, and/or listed on the U.S. General

Services Administration’s System for Award Management (SAM) as such; and (2) will at all times remain eligible to bid for and perform the services subject to the requirements set forth herein and other applicable laws. Bidder agrees that any contract awarded to Bidder will be subject to termination by the

City if Contractor or its subcontractors fail to comply or maintain such compliance.

1.9. PUBLIC ENTITY CRIMES

A person or affiliate who has been placed on the convicted vendor list following a conviction for a public entity crime may not submit a proposal on a contract to provide any goods or services to a public entity, may not submit a proposal on a contract with a public entity for the construction or repair of a public building or public work, may not submit proposals on leases of real property to a public entity, may not be awarded or perform work as a contractor, supplier, subcontractor, or consultant under a contract with any public entity, and may not transact business with any public entity in excess of the threshold amount provided in Section 287.017, for CATEGORY TWO for a period of 36 months from the date of being placed on the convicted vendor list.

1.10. CONFLICT OF INTEREST / STATEMENT OF NON-COLLUSION

The award hereunder is subject to Chapter 112, Florida Statutes. All respondents must disclose with their proposal the name of any officer, director, or agent who is also an employee of the City of

Lakeland. Further, all respondents must disclose the name of any City of Lakeland employee who owns, directly or indirectly, an interest of five percent (5%) or more of the respondent’s firm or any of its branches.

The respondent shall certify that he/she has not, either directly or indirectly, entered into any agreement, participated in any collusion, or otherwise taken any action in restraint of free competitive bidding in connection with the proposal and that the respondent is not financially interested in, or otherwise affiliated in a business way with any other respondent on the same land or improvements.

1.11. E-VERIFY CERTIFICATION

Vendor/Contractor shall utilize the U.S. Department of Homeland Security’s E-Verify system, in accordance with the terms governing use of the system, to confirm the employment eligibility of:

All persons employed by the Vendor/Contractor during the term of the Contract to perform employment duties within Florida; and

All persons, including subcontractors, assigned by the Vendor/Contractor to perform work pursuant to the Contract with the City.

1.12. VENDOR/CONTRACTOR CERTIFICATION REGARDING SCRUTINIZED

COMPANIES

Section 287.135, Florida Statutes, as may be amended, prohibits agencies or local government entities from contracting with companies for goods or services of $1,000,000.00 or more, that are on the

Scrutinized Companies with Activities in Sudan List, the Scrutinized Companies with Activities in the Iran

Petroleum Energy Sector List, the Scrutinized Companies that Boycott Israel List or is engaged in a boycott of Israel and that it does not have business operations with Cuba or Syria.

As the person authorized to submit responses/bids on behalf of respondent/bidder, I hereby certify that the company identified above in the section entitled “Respondent Vendor Name” is not listed on either the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List, the Scrutinized Companies that Boycott Israel List. I further certify that the company is not engaged in a boycott of Israel or has business operations in Cuba or Syria. I understand that pursuant to section 287.135 , Florida Statutes, as may be amended, the submission of a false certification may subject company to civil penalties, attorney’s fees, and/or costs.

1.13. SCRUTINIZED COMPANIES OR OTHER ENTITIES

Pursuant to Florida Statute §287.135(3)(b)2., as may be amended, the City may terminate its contract with Contractor if Contractor is found to have been placed on the Scrutinized Companies or Other

Entities that Boycott Israel or is engaged in a boycott of Israel.

1.14. PROHIBITION AGAINST CONSIDERING SOCIAL, POLITICAL OR IDEOLOGICAL

INTERESTS IN GOVERNMENT CONTRACTING -- F.S. 287.05701

Bidders are hereby notified of the provisions of section 287.05701, Florida Statutes, as amended, that the City will not request documentation of or consider a Bidder's social, political, or ideological interests when determining if the Bidder is a responsible Bidder. Bidders are further notified that the City's governing body may not give preference to a Bidder based on the Bidder's social, political, or ideological interests.

1.15. ADDENDA

It is the Respondent’s responsibility to review all available project documents including Addenda, Notices and Questions & Answers prior to submitting a proposal. Respondent shall acknowledge all addenda electronically within their submission via the Portal.

The failure of a Respondent to submit acknowledgement of any addenda that affects the proposal price(s) may be considered an irregularity and may be cause for rejection of the proposal.

1.16. LOCAL VENDOR PREFERENCE

A copy of City’s Local Preference Policy, Ordinance No. 5912 dated January 3, 2022 is attached.

A Local Business shall be defined as a vendor, supplier or contractor that: (i) conducts business within the jurisdictional limits of Lakeland Electric’s service territory by providing goods, services or construction; (ii) maintains a physical business location within the jurisdictional limits of Lakeland

Electric’s service territory in an area legally zoned for conducting such business; (iii) conducts business on a daily basis from the local business location; (iv) has conducted business from such location for at least twelve (12) consecutive months prior to the due date for the applicable bid or proposal; and (v) provides a copy of its local business tax receipt, if located within the City of Lakeland, or a copy of its

Polk County local business tax receipt, if located outside of the City limits but within Lakeland Electric’s service territory.

1.17. BID PROTEST PROCEDURE

The City’s procedure on bid disputes is located in the City’s Purchasing Manual and can be found at https://www.lakelandgov.net/departments/purchasing/bid-dispute-policy.

1.18. TERMS AND CONDITIONS OF AGREEMENT

A copy of the agreement to be entered into with the successful Respondent is included with this RFP

Attached herein, should the City require such.

1.19. OPENGOV PROCUREMENT

The City of Lakeland uses OpenGov, the e-Procurement Portal (“Portal”), to administer the competitive solicitation process, including but not limited to soliciting quotes, sealed bids, proposals, and qualifications, issuing addenda, posting results and issuing notification of an intended decision. Bidders are strongly encouraged to familiarize themselves well in advance of their intention of submitting a proposal to ensure familiarity with the use of the Portal. The City shall not be responsible for a Bidder’s inability to submit a proposal by the end date and time for any reason, including issues arising from the use of the Portal.

1.20. RFP SUBMITTAL

Respondent shall complete all electronic sections of their response and submit a response before the due date and time identified in the Timeline of this solicitation. Electronic sections may comprise of but https://www.lakelandgov.net/departments/purchasing/bid-dispute-policy are not limited to Contact Information, Addenda Confirmation, Questionnaire, Pricing and Company

Profile.

The City of Lakeland at its sole discretion reserves the right to waive technicalities or irregularities, to reject any or all proposals, and/or to accept that proposal which is in the best interest of the City. The award of this proposal, if made, may be based on considerations other than total cost and may be awarded based on various considerations, including without limitation; Respondent’s experience and/or qualifications, past experience, administrative cost, standardization, technical evaluation and oral and/or written presentations as required. The City reserves the right to accept all or part, or to decline the whole, and to award this RFP to one (1) or more Respondents. There is no obligation to buy. The

RFP, if awarded, will be in the judgement of the City the most responsive to the City’s needs. The City of

Lakeland encourages the use of minority and women owned businesses as subcontractors or in joint venture arrangements.

City of Lakeland, Florida

2. INTRODUCTION

2.1. Summary

Lakeland Electric (LAK) is seeking a qualified Consultant to conduct an independent evaluation of its Operational Technology (OT) network and perform a comprehensive gap analysis with respect to NERC CIP-005-7 and CIP-007-6 R4 & R5 compliance requirements, as applicable to firewalls and firewall infrastructure only. The Consultant shall assess LAK's current compliance and security posture, identify compliance gaps and security risk related to Electronic Security

Perimeter and firewall controls, and provide clear, actionable and prioritized recommendations to remediate identified deficiencies.

2.2. Background

Lakeland Electric (“LAK”) operates critical infrastructure that requires robust cybersecurity measures. The Energy Management System (EMS) is vital to the operation, reliability, and safety of our services. Lakeland Electric is committed to ensuring the security and reliability of its cyber assets.

General information about Lakeland Electric:

A. LAK is a vertically integrated municipal electric utility that is owned and operated by the

City of Lakeland (“City”). LAK serves approximately 256 square miles located entirely within Polk County, Florida.

B. LAK’s transmission system consists of approximately 28 circuit miles of 230kV lines and approximately 135 circuit miles of 69kV sub-transmission lines. LAK has 8 synchronous tie lines with 3 different utilities, Duke Energy Florida (2-230 kV ties), Tampa Electric

Company (2-230 kV ties and 3-69 kV ties), and Orlando Utilities Commission (1-230 kV tie). LAK owns and operates its own generating units.

C. Regarding LAK’s facilities, LAK has two control centers that are rated as medium impact.

LAK has seven BES substations and one generating unit that are rated as low impact. LAK does not have any facilities that are rated as high impact.

D. LAK identifies its Energy Management System (EMS) as the “OT network” with respect to this RFP. The Energy Management System is classified as a single Cyber

System. There are approximately 151 in-scope cyber assets, 145 of which have External

Routable Connectivity contained within an extended Electronic Security Perimeter . The

EMS is protected by an extended Electronic Security Perimeter that is created by three

(3) physical cyber assets (firewall) operating as a cluster that is managed by a virtual firewall management server.

2.3. Contact Information

Tara Walls

Senior Buyer

1140 East Parker Street

Lakeland, FL 33801

Email: tara.walls@lakelandgov.net

Phone: (863) 834-6780

Department:

LE - Compliance & Security

2.4. Timeline

The City Commission may not approve this purchase, or may ask that the plan be modified in some respect. The City may opt to modify and/or terminate the project described within the RFP.

The suggested deployment schedule contained within this RFP is subject to change based on the City’s needs and/or final scoping of the project through the contract negotiation phase.

Estimated Schedule

RFP release January 30, 2026

RFP questions deadline February 16, 2026, 5:00pm

RFP proposal due date February 25, 2026, 2:00pm mailto:tara.walls@lakelandgov.net tel:(863)834-6780

3. SCOPE OF WORK

3.1. Scope Objectives

The Consultant shall perform all work necessary to accomplish the “Objectives” described below (Section A), complete a comprehensive gap analysis with respect to NERC CIP-005-7 and

CIP-007-6 R4 & R5 compliance requirements, and issue a Final Report.

At a minimum, the Scope of Work (“Work”) shall include:

• A comprehensive Firewall Ruleset Analysis that incorporates a software solution such as

NPView (or equivalent product) to evaluate firewall rules, infer network topology, and analyze network connectivity paths.

• Review existing pertinent LAK Compliance Program documents and evidence as it pertains to the “Objectives” described below and comment where improvements are needed to demonstrate compliance.

• Any other work activities that the Consultant considers necessary to accomplish the

Objectives described below and identify compliance and security gaps.

• Work collaboratively with LAK to cure as many findings as is reasonably possible before

Final Report is issued.

• Return or destruction of all sensitive information provided by LAK.

A. NERC CIP-005-7 Compliance

1. CIP-005-7 R1.1 – ESP Boundary Validation

a. Confirm that all “applicable” Cyber Assets (BCA & PCA) connected to a network via a routable protocol resides within a defined ESP.

b. Verify that all “non-applicable assets” are residing outside the ESP.

c. Verify that non-routable assets identified as edge devices are accurately located with respect to the ESP.

d. Confirm that LAK’s network drawing accurately depicts the discovered network topology, firewall placement, ESP boundary, Electronic Access Points, and asset locations.

2. CIP-005-7 R1.2 – External Routable Connectivity (ERC) via Electronic Access Point

(EAP)

a. Confirm that all assets within the ESP are logically separated from assets that are located outside of the ESP and that all ERC goes through a designated EAP.

b. Assess whether EAPs are limited to only necessary subnets, ports and services.

c. Validate LAK’s monitoring and controls of remote access methods to the ESP

(e.g., VPN, Citrix, etc.).

d. Identify source/destination pairs from the FW ruleset that represent ERC.

e. Verify that no assets have unintended direct logical access to the internet and identify any ERC paths that are unauthorized or against policy.

f. Confirm that no unintended shared hardware (router, switch, firewall hypervisor) exists between ESP and non-ESP networks.

g. Identify any network topology issues or misconfiguration (including firewall and switch rulesets) that are bypassing the EAPs.

h. Identify the use of any unsecure/untrusted protocols permitting ERC.

i. Verify that controls effectively limit lateral movement within the ESP.

3. CIP-005-7 R1.3 – Access Control Rule Justification

a. Confirm that all inbound and outbound access permissions are properly implemented and justified.

• FW ruleset includes ‘deny’ all other access by default.

• Inbound interactive access protocols (e.g., Telnet, RDP, SSH) for IRA or system-to-system communications is appropriately restricted.

• Disabled rules are justified or should be retired

• Use of rule naming conventions or comments for clarity.

b. Identify any overly permissive, outdated or unused rules.

c. Identify and misconfigurations or redundant/shadow rules that may create security gaps.

d. Review LAK justifications for each FW ruleset access permission and provide recommendations where improvement is necessary to be compliant.

e. Any disabled access control rules that should be enabled and vice versa.

f. Perform detailed review of 20 randomly selected firewall rule justification

(including supporting information) and report if the rule justifications and supporting evidence are sufficient to demonstrate compliance.

4. CIP-005-7 R1.5 – Detection of Malicious Communication

a. Confirm that LAK has implemented one or more methods for detecting known or suspected malicious communications for inbound and outbound communications.

b. Identify any weaknesses or gaps in LAK’s program and supporting evidence to demonstrate compliance.

c. Verify that inbound and outbound communications are monitored.

d. Confirm that alerts are generated for anomalous or malicious traffic.

5. CIP-005-7 R2.1 – Interactive Remote Access (IRA) Controls

a. Confirm that LAK’s IRA program utilizes an Intermediate System such that the

Cyber Asset initiating Interactive Remote Access does not directly access an applicable Cyber Asset.

• LAK has one authorized vendor that is permitted with IRA when LAK initiates it.

• Controls are in place to prevent split tunneling and dual homing.

• Configuration enforcement and session monitoring

b. Identify any weaknesses or errors in LAK’s IRA program.

6. CIP-005-7 R2.2 – Interactive Remote Access (IRA) Encryption

a. Confirm that LAK’s IRA program utilizes encryption that terminates at the

Intermediate System.

b. Verify that encryption is being used to at the Intermediate System.

c. Confirm that encryption in-use is best choice for application, i.e. strong, not outdated, etc.

7. CIP-005-7 R2.3 – Interactive Remote Access (IRA) Multi-Factor Authentication

(MFA)

a. Confirm that LAK’s IRA program utilizes multi-factor authentication for all sessions.

b. Verify that LAK’s procedure and system configurations satisfactorily demonstrate compliance with R2 for all IRA instances.

c. Validate that MFA is being used to at the Intermediate System.

8. CIP-005-7 R2.4/2.5 – Active Vendor Remote Access Sessions

a. Confirm that LAK’s IRA program has a method for identifying and terminating active vendor remote access sessions.

b. Verify that LAK’s policy and procedure correctly reflect the method for identifying and terminating an active remote session.

9. CIP-005-7 R3.1/3.2 – Vendor Initiated Remote Connections

a. Confirm that LAK has a method to determine authenticated vendor-initiated remote connections.

b. Verify that LAK’s policies and controls prevent vendor-initiated remote access to

Electronic Access Control or Monitoring Systems (EACMS) and Physical Access

Control Systems (PACS) with External Routable Connectivity.

c. Determine if LAK has satisfactory evidence to demonstrate that vendor initiated remote access to PACs or EACMS is not permitted.

B. NERC CIP-007-6 R4 & R5 Compliance (Limited to Firewalls and Firewall Infrastructure

Only)

1. Logging & Monitoring

a. Confirm logging is enabled and correctly configured, and that rules are not negatively impacting performance.

b. Vendor validates:

• Logs are active, centralized and retained per the policy.

• Logs include alerts for unauthorized access for devices and users

2. Intrusion Alerts & Security Configurations

a. Review firewall password policies and access control settings

b. Account listing is limited only to necessary

c. Confirm firewall management server is securely configured

3.2. Planning Activities

The Consultant shall conduct planning activities prior to the start of the review. The following activities should be conducted in collaboration with Lakeland Electric staff:

A. Personnel & Training: For all of Consultant’s personnel, including subcontractors if utilized, that are involved with the work described by this RFP, the Consultant must provide the following evidence in accordance with CIP-004-6:

1. R2 - completed cyber security training,

2. R3 - Personal Risk Assessment including a 7-years criminal background check, and

3. R4 - authorization and provisioning to access Control Center facilities and systems.

B. Kickoff Meeting: Conduct an initial planning meeting with LAK’s stakeholders to discuss:

1. Scope of Work,

2. Objectives,

3. Plans to:

a. Store and exchange sensitive information

b. Consultant to collaboratively report findings and timely remediation by LAK

C. Schedule

D. Final report

1. Expectations and requirements

2. Review process

E. Project Conclusion

1. Planned/scheduled end of the project to ensure clear goals and expectations for both parties.

2. Forced termination in the event there is an unplanned abrupt need to terminate the project.

F. Documentation Review: Review applicable policies and procedures from LAK’s CIP compliance program outlining firewall rules, security management practices, network diagrams and device configurations.

G. Project Plan: Provide a detailed project plan, including a timeline with a breakdown of key activities associated with the review and deliverables.

3.3. Resources & Support

Lakeland Electric (LAK) shall provide the Consultant with the following resources:

A. System Documentation: Detailed documentation for the review, including security management practices, diagrams, network layouts, system configurations, and other relevant information.

B. Compliance Documents: All relevant compliance documentation, internal policies, and procedures.

C. Technical Assistance: Key personnel, including internal stakeholders, who possess expertise on security processes, network structure and configurations.

Note: The Consultant shall be required to establish a “Confidentiality/Non-Disclosure

Agreement” with the City of Lakeland before LAK will provide any sensitive information.

3.4. Deliverables

The Consultant shall at a minimum provide LAK the following deliverables:

A. Final Report: A professionally written report that summarizes the work performed, provides a prioritized list of unresolved findings that were not promptly corrected by

LAK and includes recommended technical or procedural solutions. Findings must be clearly mapped to specific CIP-005 requirements and including severity ratings and remediation recommendations.

B. Gap Analysis: A formal gap analysis comparing LAK’s current practices, policies and technical controls against CIP-005 (and CIP-005-8 transition) requirements. This analysis should clearly Identify deficiencies relative to both compliance obligations and industry best practices and include practical, prioritized recommendations for closing those gaps.

C. Data: All raw data collected during the review (e.g., system logs, diagrams, configurations and any other relevant data) must be included as part of the final deliverables to support internal validation, evidence retention and further review of the findings.

3.5. Proposal Requirements

The Consultant’s proposal to perform the work described by this RFP shall, at a minimum, include the following:

A. Overview of the Consultant, including relevant experience and qualifications in the work described by this RFP and NERC CIP compliance.

B. A detailed description of the Consultant’s approach and methodologies to be used in performing the work described by this RFP, including a description of tools, techniques, and deliverables. Consultant shall provide all tools, equipment, software, etc. necessary to accomplish this scope of work.

C. Proposed project timeline that identifies major milestones, deliverables and tasks with time durations expressed in calendar days or weeks. Where applicable, identify any tasks that: (1) require the Consultant to be at LAK's facilities, and/or (2) required availability of LAK's personnel. (i.e., subject matter experts) necessary to support the

Consultant's work. Timeline should identify a start date, expressed in elapsed calendar days after the City’s notice to proceed. (Example: Work can begin in xx days after receipt of the City’s purchase order)

D. Provide a firm total cost to accomplish all work described by this RFP and the

Consultant’s proposal. The firm prices should contain an itemized cost breakdown to include a summary of consulting fees, subcontractor fees (if any), and any other miscellaneous costs necessary to complete the work, exclusive of travel cost.

E. Provide estimated total cost of travel expenses for the identified project in the proposal if it is necessary to perform any of the work described by this RFP at LAK’s facilities. Consultant will bill actual travel costs incurred for project without markup.

F. An estimated man-hour budget for the Consultant's personnel to perform the work described by this RFP. The man-hour budget should indicate the job classifications, billing rates and total cost per person.

G. Names and intended roles of key personnel that will be assigned to the project including detailed resumes that indicate past work experience and roles on similar projects, educational background, certifications, and any prior regulatory expertise.

H. Names and intended roles of any subcontractors the Consultant intends to use to support the work. Consultant must ensure that all subcontractors have undergone the

CIP-004-6 R3 Personal Risk Assessment requirement prior to the commencement of services.

I. Process for protecting information during transit and storage of BES Cyber System

Information provided by LAK in accordance with CIP-011-3.

J. The Consultant shall submit information about Consultant’s company security policies and procedures as it pertains to personnel, information security, and cyber incident response should a security event occur. At a minimum, the information submitted shall address:

1. CIP-011-3 - Information Protection:

a. Lakeland Electric Non-Disclosure Agreement between both parties.

b. Policies and procedures for protecting BES Cyber System Information during transit and storage.

c. Commitment to return or destroy all sensitive information provided by LAK at the conclusion of work.

2. CIP-010- 4 R4 Attachment 1 – Transient Cyber Assets (If at LAK facilities)

a. Policies and procedures addressing the use of devices for interrogation and scanning of BES Cyber Systems, EACMS, PACS and PCAS.

3. CIP-004-6 R2, R3, R4 – Personnel & Training

a. R2 – Cyber Security Training: Training requirements as outlined in R2 has been met.

b. R3 – Personnel Risk Assessment: Completed PRA including a 7-years criminal background check.

c. R4 – Access Management: Meet requirements for authorization and provisioning prior to accessing Control Center facilities and systems.

4. SELECTION CRITERIA

It is the intent of the City of Lakeland to award the contract to a vendor based on:

No. Evaluation Criteria Scoring Method Weight (Points)

1. Experience & Qualifications

• Familiarity with related standards

(CIP-007, CIP-0010, CIP-003, etc.)

that interface with access control, network architecture, or device monitoring (10 pts)

• Documented expertise performing

NERC CIP gap assessments or version transition projects (e.g., CIP-005, CIP-

007, CIP-010, CIP-013) (10 pts)

Points Based 20 (20% of Total)

2. Approach & Methodology

• Clear methodology for assessing current CIP-005 controls and mapping them to CIP-005-8 requirements with documented technical rationale. (10 pts)

• Defined process for identifying, categorizing and prioritizing compliance gaps, using risk-based logic and relevant impact to BES

Cyber Systems and ESPs. (10 pts)

• Robust strategy for evaluating

Electronic Access Points (EAPs), External Rountable Connectivity

(ERC), Interactive Remote Access

(IRA) and virtualized infrastructure in scope for CIP-005-8. (10 pts)

• Description of tools, techniques and sampling strategies that will be used for firewall analysis, network drawing reviews, evidence validation and stakeholder interviews. (10 pts)

Points Based 40 (40% of Total)

3. Compliance & Security

• Understand the evidence expectations for CIP-005

(procedures, technical artifacts, sample sets, and traceability to requirements/parts). (10 pts)

• Proposed measures to safeguard BES

Cyber System Information and sensitive network details during and after the engagement. (10 pts)

Points Based 20 (20% of Total)

4. Cost Summary

Reasonableness and competitive cost relative to scope, including any optional services (e.g., implementation support, workshops).

Points Based 10 (10% of Total)

5. Timeline

Realistic and well-defined project timeline with clear phases, milestones, SME touchpoints, and final deliverables.

Points Based 10 (10% of Total)

5. INSURANCE AND SAFETY REQUIREMENTS

5.1. STATEMENT OF PURPOSE

The City of Lakeland (the “City”) from time to time enters into agreements, leases and other contracts with Other Parties (as hereinafter defined).

Such Agreements shall contain at a minimum risk management/insurance term to protect the City’s interests and to minimize its potential liabilities. Accordingly, the following minimum requirements shall apply:

5.2. CITY DEFINED

The term City (wherever it may appear) is defined to mean the City of Lakeland itself, its Commission, employees, volunteers, representatives and agents.

5.3. OTHER PARTY DEFINED

The term Other Party (wherever it may appear) is defined to mean the other person or entity which is the counter-party to the Agreement with the City and any of such Other Party’s subsidiaries, affiliates, officers, employees, volunteers, representatives, agents, contractors and subcontractors.

5.4. LOSS CONTROL/SAFETY

Precaution shall be exercised at all times by the Other Party for the protection of all persons, including employees, and property. The Other Party shall comply with all laws, rules, regulations or ordinances related to safety and health, and shall make special effort to anticipate and detect hazardous conditions and shall take such precautionary and prompt action where loss control/safety measures should reasonably be expected.

The City may order work to be stopped at any time, without liability, if conditions exist that present immediate danger to persons or property. The Other Party acknowledges that such stoppage, or failure to stop, will not shift responsibility for any damages from the Other Party to the City.

5.5. INSURANCE - BASIC COVERAGES REQUIRED

The Other Party shall procure and maintain the following described insurance, except for coverage specifically waived by the City of Lakeland, on policies and with insurers acceptable to the City, and insurers with AM Best ratings of no less than A.

These insurance requirements shall in no way limit the liability of the Other Party. The City does not represent these minimum insurance requirements to be sufficient or adequate to protect the Other

Party’s interests or liabilities, but are merely minimums.

"Except for workers’ compensation and professional liability, the Other Party's insurance policies shall be endorsed to name the City of Lakeland as additional insured. It is agreed that the Other Party's insurance shall be deemed primary and non-contributory with respect to any insurance or self-insurance carried by The City of Lakeland for liability arising out of the operations of this agreement."

Except for worker’s compensation, the Other Party waives its right of recovery against the City, to the extent permitted by its insurance policies.

The Other Party’s deductibles/self-insured retentions shall be disclosed to the City and may be disapproved by the City. They shall be reduced or eliminated at the option of the City. The Other Party is responsible for the amount of any deductible or self-insured retention.

Insurance required of the Other Party or any other insurance of the Other Party shall be considered primary, and insurance of the City shall be considered excess, as may be applicable to claims which arise out of the Hold Harmless, Payment on Behalf of the City of Lakeland, Insurance, Certificates of Insurance and any Additional Insurance provisions of this agreement, contract, or lease.

5.6. Commercial General Liability

This insurance shall be an “occurrence” type policy written in comprehensive form and shall protect the

Other Party and the additional insured against all claims arising from bodily injury, sickness, disease, or death of any person other than the Other Party’s employees or damage to property of the City or others arising out of any act or omission of the Other Party or its agents, employees, or Subcontractors and to be inclusive of property damage resulting from explosion, collapse or underground (xcu) exposures. This policy shall also include protection against claims insured by usual personal injury liability coverage, and to insure the contractual liability assumed by the Other Party under the article entitled

INDEMNIFICATION, and “Products and Completed Operations” coverage.

The Other Party is required to continue to purchase products and completed operations coverage for a minimum of three years beyond the City’s acceptance of renovation or construction properties.

Bodily Injury and Property Damage -

Single limit each occurrence shall not be less than:$1,000,000.00

5.7. Business Automobile Liability

Business Auto Liability coverage is to include bodily injury and property damage arising out of ownership, maintenance or use of any auto, including owned, non-owned and hired automobiles and employee non-ownership use.

Bodily Injury and Property Damage -

Single limit each occurrence shall not be less than:$1,000,000.00

5.8. Workers’ Compensation

Workers’ Compensation coverage to apply for all employees for statutory limits and shall include employer’s liability with a limit of $100,000 each accident, $500,000 disease policy limits, $100,000 disease limit each employee. (“All States” endorsement is required where applicable). If exempt from

Worker’s Compensation coverage, as defined in Florida Statue 440, the Other Party will provide a copy of State Workers’ Compensation exemption.

All subcontractors shall be required to maintain Worker’s Compensation.

The Other Party shall also purchase any other coverage required by law for the benefit of employees.

5.9. Excess Liability

This insurance shall protect the Other Party and the additional insured against all claims in excess of the limits provided under the employer’s liability, commercial automobile liability, and commercial general liability policies. The policy shall be an “occurrence” type policy, and shall follow the form of the General and Automobile Liability.

The liability limits shall not be less than:$1,000,000.00

5.10. Cyber & Privacy Protection Liability

This insurance shall be a “claims made” type policy written in comprehensive form and shall protect the

Other Party and the additional insured against claims arising from anyone’s acts errors or omissions including but not limited to outsourcers or vendors and any electronic or non-electronic security events whatsoever for:

A. your actual or alleged breach of any confidence, or violation or infringement of any rights to privacy or other legal protections for personal information, including but not limited to breach of a person’s right of publicity, false light, intrusion upon a person’s seclusion, public disclosure of a person’s private information, or misappropriation of a person’s picture or name for commercial gain;

B. your breach of duty to:

1. protect the security and confidentiality of customer records and information;

2. protect against any anticipated threats or hazards to the security or integrity of such records;

3. protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer;

4. protect any personally identifiable information, or other private or confidential information;

C. under any statute including but not limited to HIPAA and GLB acts, or under any contract, including but not limited to your privacy statement;

The retroactive date of this “claims made” policy must be earlier than or equal to the start date of this contract. The Other Party is required to continue to purchase this coverage for a minimum of three years beyond the completion of this project.

The liability limits shall not be less than$1,000,000.00

5.11. Professional Liability/Malpractice/Errors or Omissions Insurance

The Other Party shall carry professional malpractice insurance throughout the term of this Contract and shall maintain such coverage for an extended period of three (3) years after completion and acceptance of any work performed hereunder. At all times throughout the period of required coverage, said coverage shall insure all claims accruing from the first date of the Contract through the expiration date of the last policy period. In the event that Other Party shall fail to secure and maintain such coverage, Other Party shall be deemed the insurer of such professional malpractice and shall be responsible for all damages suffered by the City as a result thereof, including attorney’s fees and costs.

The liability limits shall not be less than:$1,000,000.00

5.12. EVIDENCE/CERTIFICATES OF INSURANCE

Required insurance shall be documented in Certificates of Insurance which provide that the City shall be notified at least 30 days in advance of cancellation, nonrenewable, or adverse change.

New Certificates of Insurance are to be provided to the City at least 15 days prior to coverage renewals.

If requested by the City, the Other Party shall furnish complete copies of the Other Party’s insurance policies, forms and endorsements.

For Commercial General Liability coverage, the Other Party shall, at the option of the City, provide an indication of the amounts of claims payments or reserves chargeable to the aggregate amount of liability coverage.

Receipt of certificates or other documentation of insurance or policies or copies of policies by the City, or by any of its representatives, which indicate less coverage than required does not constitute a waiver of the Other Party’s obligation to fulfill the insurance requirements herein.

5.13. Indemnification Agreement

See #ATTACHMENTS.

https://procurement.opengov.com/portal/lakelandgov/projects/232092/document?section=2203538

6. SPECIFICATION OF SAFETY AND OCCUPATIONAL HEALTH

City of Lakeland project representatives who assume responsibility for contract management will be responsible for ensuring compliance with these safety requirements by all Contractors and

Subcontractors.

6.1. General

A. All contractors are responsible for providing their employees with a safe and healthful working environment as required the Occupational Health and Safety (OSH) Act of 1970 and the

Occupational Safety and Health Administration (OSHA) standards. Therefore, the contractor and their employees are responsible for following OSHA standards, applicable state regulations, and the City of Lakeland Safety Practices and Policies.

B. The City of Lakeland's Safety Team and City management reserve the right to STOP work for any condition found to be Immediately Dangerous to Life and Health (IDLH). The contractor is solely and exclusively responsible for compliance with all safety requirements and the safety of all their employees and property on the project site. Note: Nothing in this requirement is to be construed to as removing or shifting responsibility from the contractor.

C. The parties hereto expressly agree that the obligation to comply with applicable safety provisions is a material provision of this Contract and a duty of the Contractor. The City reserves the right to require demonstration of compliance with the safety provisions of this Contract. The parties agree that such failure is deemed to be a material breach of this Agreement. The

Contractor agrees upon such breach, all work under the Contract shall terminate until compliance with the provision of this Agreement is demonstrated. In no event shall action or failure to act on the part of the City be construed as a duty to enforce the safety provisions of this Agreement, nor shall it be construed to create liability for the City for any act or failure to act in respect to the safety provisions of this Agreement.

6.2. Personal Protective Equipment (PPE) (OSHA 29CFR§1910 Subpart I)

It is the contractor’s sole responsibility to provide adequate PPE for their employees. Additionally, the contractor is responsible for training their employees in the proper selection, maintenance, use of PPE.

Minimal PPE requirements on City of Lakeland worksites:

A. Foot protection must meet ANSI Z41.1-1999 standards and worn on all City properties.

B. Head protection must meet ANSI Z89.1-1986 standards and worn in all areas except office buildings and office trailers.

C. Eye and face protection must meet ANSI Z87.1-1989 standards and worn in all areas except office buildings and office trailers.

D. Hand and Arm Protection must meet OSHA 29CFR§1910.138 requirements for proper selection, inspection, and care.

E. Hearing Protection must meet ANSI S3.19-74, OSHA 29CFR§1910.95(j) and 29CFR§1910.95

Appendix: B requirements. Hearing protection must be worn in areas where the noise level is over 85 dB

6.3. Housekeeping

It is the contractor’s sole responsibility to keep the project work site clean during and after working hours. Contractor shall supply waste receptacles for each site location. They shall be emptied not less frequently than once each working day, unless unused, and shall be maintained in a clean and sanitary condition. At the completion of the contract the contractor will ensure that all excess materials are removed from the work site and that the worksite is left clean and safe. If the contractor leaves a project work site unkept and in a hazardous condition; the City will have the area cleaned and forward the bill to the contractor.

6.4. Smoking

Smoking is permitted only in designated areas. Receptacle’s must be used or waste removed in contractors’ waste disposal container.

6.5. Safety Kick-offs and Safety Stand-Downs

A safety kick-off to disseminate safety expectations will be conducted before the project commences.

Safety sand-downs will be conducted when major safety concerns, accidents, or near misses occur.

6.6. Training Documentation

OSHA requires documentation of all safety training provided to employees by their employers.

Documentation of all required safety training required for work proposed for this contract must be submitted within thirty days of contract award or before commencement of contracted work. Please reference the Occupational Safety and Health Administration Requirements for details.

6.7. Written Safety Programs or Plans

Contactors awarded contracts with the City of Lakeland must,…