CSS_Attachment_3_Evaluation_Questionnaire_2024-08-14.pdf

CYBERSECURITY SERVICES QUESTIONNAIRE

ORGANIZATIONAL EXPERIENCE AND

TECHNICAL CAPABILITIES

1. Describe your experience providing cybersecurity for automated industrial manufacturing that is integrated with analytical scientific systems.

2. Describe your capabilities providing cybersecurity for a cohesive virtual research organization that includes all of the following components:

a. enterprise

b. physical analytical laboratory with internal connectivity

c. physical analytical laboratory with external connectivity

d. virtual analytical laboratory

e. collaborative environments (Government-academic, Government-commercial, etc.)

f. closed systems (proprietary/classified)

g. open systems (non-classified, collaborative)

h. federated identify management and single sign-on

3. NIH conducts collaborations with many organizations outside the Federal IT space. This has led to moving data, applications, and other IT solutions to the cloud environment to offload physical access to these resources, thereby ensuring that external stakeholders and collaborators can easily access shared IT resources.

Describe your experience in supporting governance, privacy, and security compliance requirements for Federal IT systems that:

a. span multiple infrastructure and network boundaries, and

b. support the organization’s internal users and external users (collaborators & partners).

4. The scope of the RFP Statement of Work defines the parameters for ensuring cybersecurity for the NCATS seclaborative environment. The concept of "seclaborative" environments is crucial for NCATS' mission of fostering secure and collaborative scientific research. "Seclaborative" can be defined as an adjective that combines the qualities of both "secure" and "collaborative." It refers to a state or environment where collaboration and information sharing occur in a manner that is protected, safe, and free from unauthorized access or breaches. Seclaborative systems or processes prioritize the security and confidentiality of shared data while promoting effective collaboration among individuals or groups. By focusing on logical systems, physical systems, and laboratory environments, NCATS can ensure that their research is both effective and safe. This approach requires ongoing collaboration, rigorous safety standards, and robust security measures to protect both virtual and physical assets.

NCATS programs that require these services are broken down into three areas:

a. Seclaborative Logical Systems (SLS): These are essentially the secure collaborative environments that we are responsible for and generally exist within our environment such as N3C, ASPIRE, RDCRN, the NCATS infrastructure etc. and others.

b. Seclaborative Physical Systems (SPS): This is essentially the NCATS intramural program, but also including ASPIRE, where we combine physical laboratory systems with the ability to connect to collaborative virtual environments to allow for distributed scientific research. We need to ensure every system associated with allowing a remote user to connect to a physical system at NCATS (or a collaborators environment) is secure, and not just for the integrity of data and running successful scientific experiments, but for SAFETY reasons. This leads to the last area:

c. Seclaborative and Safe Laboratory Environments (SSLE): This is a critical element that more we go down the path of distributed physical labs controlled by collaborative virtual environments that we need to consider. Take for example ASPIRE and the Indigo Chemical Reactor. NCATS is currently working on projects to connect the Indigo Reactor with an automated chemical inventory system, which will use both mobile and fixed robots to bring the appropriate chemical reagents from our inventory, load them into the reactor, and perform a reaction. There are multiple layers of SAFETY that must be considered here:

i. Aside from traditional cybersecurity requirements for the logical aspect of the system, we need to ensure that the physical robotics adhere to all appropriate safety requirements.

ii. In addition, given that we are talking about automated chemical reactions, we need to ensure that all chemical engineering safety standards are adhered to, because with an automated reactor having access to an inventory of chemicals and the ability to perform reactions at high pressure and temperature, even at small volumes the mixtures introduced to the system could produce toxins or result in a volatile reaction; i.e. a small BOMB.

iii. Given the seriousness of these considerations with regards to physical and chemical safety, we cannot separate virtual security from physical security given that a key component of this project is to allow for virtual experimentation to guide real experimentation in a physical laboratory in an automated fashion.

iv. Although NCATS is currently developing these systems with all these considerations in mind, a core principle of security and safety is that the development groups IMPLEMENTING the systems cannot be the same as the one AUDITING them in practice, hence the need to have a group capable of ensuring appropriate safety standards are met.

Given the above, please cite a specific, current, and ACTIVE seclaborative environment that:

1. Is currently using AI/ML tools to generate novel molecules

a. Describe what techniques are employed to determine if the generated novel molecule is potentially harmful (i.e. a toxin).

2. Converts the reactions required to generate the molecule into a recipe that can be executed on an automated platform in a physical laboratory.

a. Describe what techniques are utilized to determine the potential safety hazards of the reaction to be executed.

3. Please provide specific points of contact, including any academic principal investigators (PI), grant and/or contract award numbers and associated tasks involved in the effort.

These will be used as a reference.

4. Please provide specific information on the cloud platforms used and the AI/ML models and techniques deployed, both for the generation of novel molecules and the techniques used to gauge any potential safety hazards for the molecule itself and the reaction pathways utilized to generate it.

5. Please provide specific information on how the environment is accessed and how both users and automated processes are authenticated and authorized to use the environment.

6. Please provide specific information regarding all instruments used to generate the molecule. Please include the following information for each:

a. Make

b. Model

c. Serial #

d. Electrical requirements

e. Environmental specifications

f. Communication protocols utilized to control the instrument

g. Communication protocols utilized within a cloud environment

h. Type of API used to control the instrument (REST, etc.)

i. Physical location of the instrument (please include full address)

j. Point of contact for the laboratory PI or manager, including full name, title, and email address to act as a reference

7. If several instruments are integrated as part of the overall platform, please also include:

a. Any information for how samples are moved from one instrument to another

i. Fixed robot, mobile robot, manual, etc.

b. The scheduling software to orchestrate operations, including

i. Vendor information such as the software name/version information

ii. If custom coded, please include information on the software development environment used and any deployment dependencies.

iii. Ability to connect to other automated platforms

c. Information for how the overall activity of the platform is logged