NAT26002-SESPRA_qa.xlsx
XLSX spreadsheet 16 KB Posted
- Solicitation number
- NAT26002-SESPRA
- Issued by
- Kent County, Delaware
About this file
This is a Question and Answer document prepared by the Delaware Department of Natural Resources and Environmental Control (DNREC) Division of Climate, Coastal and Energy in response to bidder inquiries regarding a comprehensive risk analysis of Delaware's critical energy infrastructure. The procurement requests proposals for professional services to conduct detailed inventory and risk, vulnerability, and dependency assessments of Delaware's major energy supply, distribution, and demand networks, with deliverables supporting system situational awareness, resiliency planning, hazard mitigation, climate change adaptation, and disaster response coordination. The scope of work encompasses a statewide, system-level cyber risk assessment focused on categorical and descriptive analysis rather than facility-level technical evaluation, hazard modeling using existing Delaware and federal datasets, and development of a mapping tool for use by emergency managers and policymakers. Key clarifications indicate that the cyber assessment should address electric transmission and distribution, energy management systems, substation automation, generation control systems, pipeline control systems, and communications infrastructure without penetration testing or active technical cybersecurity testing. The DNREC will facilitate stakeholder access, provide existing studies and data including results from the 2025 Analysis of Delaware's Electricity Distribution Grid, and coordinate information sharing; however, contractor participation with utilities remains voluntary. No on-site visits to facilities are anticipated unless determined necessary post-award. Project milestones include a kickoff meeting, biweekly meetings, two stakeholder meetings, and sequenced deliverables with final results anticipated by the end of the one-year contract term.
Pricing must be presented in phased format rather than lump sum, with no maximum budget or expected budget range specified; DNREC will recommend award to the proposal offering the greatest value to the State from available funding with competing priorities. Bidders may demonstrate experience collectively through prime contractors and proposed subcontractors or key project team members across required areas including distribution system operational evaluation, interconnection of distributed energy resources, and work with investor-owned, municipal, and cooperative utilities. Comparable critical-infrastructure risk, vulnerability, dependency, or resilience assessments qualify as relevant projects if methodology and technical scope are directly applicable to RFP objectives. For privately held small businesses unable to provide independently audited financial statements, alternative documentation demonstrating financial stability such as reviewed or compiled financial statements or tax documentation will be accepted. Required audited financial statements and supplemental work product samples do not count toward the 50-page proposal maximum length limit.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| NAT26002-SESPRA_rfp.pdf | ||
| NAT26002-SESPRA_pr.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q&A
| Category | Category No. | Question | DNREC Answer | |
| Budget and Finance | 1 | Is there a maximum budget or an expected budget range for this project? | The DNREC SEO has funding available from several sources with competing priorities and will recommend an award to the proposal which the evaluation team finds offer the greatest value to the State. | |
| Budget and Finance | 2 | Is pricing to be presented as Lump Sum? Is there a certain format it should be delivered in? | It should be presented in a phased format | |
| Budget and Finance | 3 | Does DNREC have a budget in mind? | The DNREC SEO has funding available from several sources with competing priorities and will recommend an award to the proposal which the evaluation team finds offer the greatest value to the State. | |
| Budget and Finance | 4 | How much funding /budget is available for this scope of work? | The DNREC SEO has funding available from several sources with competing priorities and will recommend an award to the proposal which the evaluation team finds offer the greatest value to the State. | |
| III. Required Information | 1 | Section III.B.3 (page 3) requires the Vendor to provide its most recent audited financial statement(s). Please confirm whether the audited financial statements are considered required attachments stipulated in the RFP and therefore excluded from the 50-page proposal limit, or whether they count toward the 50-page limit. | Any additional documentation that the RFP asked for will not count in the 50-page limit | |
| III. Required Information | 2 | The RFP requests the vendor's most recent audited financial statement(s). For a privately held small business that does not routinely prepare independently audited financial statements, will the State accept alternative documentation demonstrating financial stability, such as reviewed or compiled financial statements, tax documentation, or other appropriate financial records? | We will accept alternative documentation demonstrating financial stability. | |
| III. Required Information | 3 | For purposes of this requirement, does the State define "relevant projects" exclusively as electric-sector engagements, or may comparable critical-infrastructure risk, threat, vulnerability, dependency, resilience, and mission-assurance assessments be included where the methodology and technical scope are directly applicable to the objectives of this RFP? | Yes, comparable critical-infrastructure risk, vulnerability, dependency, or resilience assessments may count as relevant projects where the methodology and technical scope are directly applicable to this RFP's objectives. | |
| Appendix A - MINIMUM MANDATORY SUBMISSION REQUIREMENTS | 1 | The RFP identifies desired experience involving distribution-system operational evaluation, design and assessment; interconnection of distributed energy resources or microgrids; and work involving investor-owned, municipal, and cooperative electric utilities. May the required experience across these areas be demonstrated collectively through the qualifications and past performance of the prime contractor and its proposed subcontractors or key project-team members, or is the lead applicant expected to independently demonstrate experience in each area? | Experience can be demonstrated collectively among the team members | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 1 | For cyber risk analysis, will the focus be on facility level risks (PLCs, SCADA systems, etc.), or on system level vulnerabilities (Energy Management Systems)? | System level vulnerabilities not facility level vulnerabilities | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 2 | Please clarify the intended level of detail for the cyber risk assessment. Is the assessment intended to be a statewide/sector-level assessment based primarily on existing documentation, stakeholder interviews, and available threat data, or is the Contractor expected to perform asset-, system-, or facility-level cybersecurity assessments of individual energy providers and their operational technology (OT), industrial control system (ICS), SCADA, communications, or supporting IT environments? | It is intended to be statewide, we are not expecting the facility level study, we however expect a system level assessment. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 3 | Does the required cyber risk assessment specifically include OT/ICS environments such as SCADA systems, energy management systems, distribution management systems, substation automation/protection systems, DER management systems, generation control systems, pipeline/fuel control systems, telecommunications systems, and other cyber-physical control infrastructure? If so, please identify the categories of OT/ICS environments expected to be evaluated. | Yes, the study should be a categorical and descriptive level, not as a technical evaluation. Categories to be addressed could be: Electric transmission and distribution, Energy Management System and Distribution Management System such as Substation automation and protection systems, Generation Control systems, Pipelines and terminals control systems, Communications infrastructure, Cyber-physical systems (CPS) etc. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 4 | Will the cyber risk analysis include any application security or penetration testing? | No | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 5 | To what extent should the cyber risk assessment leverage and build upon previous Delaware energy security and grid resilience studies, including the Energy Security Plan and Analysis of Delaware's Electricity Distribution Grid? Are there specific cybersecurity gaps, recommendations, or findings from those studies that DNREC would like revalidated, expanded, or updated? | Build on the existing available resources/studies rather duplicate them. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 6 | What level of cyber threat modeling is expected? Should the Contractor evaluate generalized cybersecurity incident scenarios applicable to Delaware's energy sector, or develop threat scenarios specific to individual utilities, systems, technologies, facilities, and adversary capabilities? | The contractor will be required to generate generalized cyber security scenarios not specific to an individual contractor | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 7 | The RFP requires a final tool that can be shared with emergency managers, hazard mitigation planners, policymakers, and community lifeline owners/operators. Please clarify whether the cybersecurity component of this tool is expected to contain utility-, facility-, system-, or asset-specific cybersecurity risk information, or whether sensitive cybersecurity findings should be aggregated/anonymized for inclusion in the broadly shared tool. | Content in the shared tool must be aggregated/anonymized. Further details will be discussed with the selected vendor. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 8 | What level of Penetration Testing is required for this project for interrogation of the network systems? (Network, Web Application, Wireless, Cloud Security) (Firewall, Network Segmentation Effectiveness, SCADA, RTU, Remote Access, Active Directory, Vendor Connections, etc.) | The study will not cover penetration testing | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 9 | Should the Contractor assume that vulnerability scanning, configuration review, network traffic analysis, architecture validation, firewall/rule-set review, or other active/passive technical cybersecurity testing is outside the scope of the required cyber risk assessment unless separately authorized by the affected energy provider? | Yes | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 10 | Will DNREC provide the full set of CIP standards tailored to their system and design standards available for review and analysis of risk recommendations? | DNREC SEO does not have CIP standards yet. Use the NERC CIP | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 11 | For electric-sector entities subject to NERC Reliability Standards, should NERC CIP information be considered only as an input into a broader risk-based cybersecurity assessment? | Yes, you can use the NERC CIP | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 12 | Are on-site visits to utility control centers, substations, generating facilities, DER/microgrid facilities, fuel infrastructure, or other critical energy facilities anticipated? If so, approximately how many site visits should bidders assume for proposal and pricing purposes? | The DNREC SEO does not anticipate the need for site visits. If after award and in | discussion with selected bidder a need should arise, it will be addressed appropriately at that time. |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 13 | The RFP mentions building off of existing state and federal work products, including "Delaware Critical Energy Infrastructure Study." Can you clarify if a study of this type has been completed before and if it would be available to the contractor upon award? Is the expectation to build off of the prior critical energy infrastructure study or complete an independent analysis? | Any previously completed studies that the DNREC SEO has access to will be provided to the selected vendor. It is anticipated that any studies with information/findings that are still relevant can and would be used by the selected vendor rather than doing a new analysis. This will be discussed in more detail with the selected vendor during project kickoff. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 14 | Is there complete mapping of the relevant energy grid components available for use in this project or is that mapping to be developed as part of the project? | Yes, maps exist and are owned by the respective energy providers | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 15 | What level of hazard modeling is expected? For example, should existing model data be used or will this project include additional riverine and/or coastal modeling to consider future conditions or more detailed analysis (such as two-dimensional rain-on-grid analysis)? | Use the existing Delaware and Federal data sets. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 16 | Did DNREC envision anything specific about the tool, e.g., a platform, specific functionalities, required outputs, or scenario modeling? | Mapping Tool that can be updated and maintained by the DNREC SEO and can be used by emergency managers | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 17 | Are results available for use in this study from the 2025 Analysis of Delaware's Electricity Distribution Grid? If so, please describe what will be provided. | Yes | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 18 | Will the data collected as part of the Analysis of Delaware's Electricity Distribution Grid, and other existing data sources (e.g. asset inventories, incident history, past risk assessments, etc.), be available to the awardee? | Yes | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 19 | The RFP includes a sample list of natural hazards (heatwaves, floods, seasonal shifts in precipitation and sea level rise). Should this be considered the full list of hazards? For example, DE State Hazard Mitigation Plan also considers coastal flooding, coastal erosion, drought, severe winter weather, and severe thunderstorms & tornadoes as "highly likely" hazards. Should any of these additional natural hazards be considered? | Yes, please refer to all the natural hazards as stated in the Delaware Energy Security Plan | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 20 | When the RFP speaks to assets - will the assessment look at individual assets (e.g. future projected vulnerability of specific pieces of equipment) or more general asset categories (e.g. substations or above ground power lines)? | The DNREC SEO expects a more general asset study | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 21 | Can you clarify your expectations for quantifying the risks of electric distribution system disruptions? Specifically, is the expectation to evaluate risk at the individual asset level, feeder level, or through a more portfolio-based assessment of distribution system vulnerabilities? | Asset-category and feeder level; portfolio-based assessment, not individual-asset quantification. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 22 | Appendix B (page 44) states that "samples of relevant work products performed for peer state agencies should be submitted as a supplement to the bid submission." Please confirm whether these supplemental work samples are excluded from the 50-page proposal limit or count toward the 50-page limit. | Any additional documentation that the RFP asked for will not count in the 50-page limit | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 23 | Will DNREC/SEO coordinate and facilitate access to participating utilities and other energy-sector stakeholders, including requests for cybersecurity-related information, interviews, workshops, and site access, or will the Contractor be responsible for independently establishing and coordinating those relationships? | Delaware State Energy office will facilitate access to the stake holders, however the contractor will be required to deal with them directly. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 24 | Are there any Public Service Commission mandates or agreements in place for utilities to materially participate in data sharing or will all participation from companies be voluntary? | Participation is voluntary | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 25 | Please provide a copy of simplified energy infrastructure risk assessment conducted by SEO | Yes, this and other referenced prior work products (Delaware Energy Security Plan, Delaware Energy Sector Risk Profile, etc.) will be made available to the awardee to build upon | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 26 | Will SEO provide list of critical assets? How many assets are there? | DNREC SEO will provide the selected vendor with all information available to the DNREC SEO. During project kick-off, if additional items are required for a successful analysis, the DNREC SEO will coordinate with the selected vendor and Delaware energy providers to obtain that information. | |
| Appendix B - SCOPE OF WORK AND TECHNICAL REQUIREMENTS | 27 | What are key milestones for project execution? Is there a target date for final report submission? | Kickoff meeting - biweekly meetings - 2 stakeholder meetings - sequenced deliverables. It is anticipated that final results would be available by the end of the RFP stated contract term of 1 year. |
File details come from the government source that posted it. Updated .