RFI2016723RFI00002.pdf

Subject: Critical Infrastructure Resilience Activity Reference Number: RFI No. 72016723RFI00002 Issuance Date: August 14, 2023 Closing Date: August 28, 2023 Closing Time: 12:00 Central European Time Responses to: Urime Abdyli at uabdyli@usaid.gov and Claudio Ballesteros at cballesteros@usaid.gov

Dear Interested Parties:

The United States Government, represented by the U.S. Agency for International Development (USAID) Regional Office of Acquisition and Assistance, is seeking input from interested organizations and individuals who may provide comments, opinions and recommendations in response to the questions outlined in this Request for Information (RFI) announcement.

This is an RFI issued solely for information and planning purposes. This is not a Request for Proposals (RFP) and is not to be construed as a commitment by the U.S. Government (USG) to issue a Solicitation or ultimately award a contract, or to pay for any information voluntarily submitted as a result of this

RFI.

Responses to this RFI shall not be portrayed as proposals, and will not be accepted by the USG to form a binding contract or agreement. Responders are solely responsible for all expenses associated with responding to this RFI. It should be noted that responding to or providing comment on this RFI will not give any advantage to any organization in any subsequent procurement or funding.

Submission is strictly voluntary. USAID will not provide feedback or responses to questions submitted in response to this RFI and no proposals or resumes will be accepted or considered. Respondents are not required to respond to all questions but may choose to do so.

Thank you for your feedback.

Annexes:

1. Annex A - Section I - Request for Information.

2. Annex B - Draft Requirements Document.

mailto:cballesteros@usaid.gov

Annex A:

Section I - Request for Information

Request for feedback

Within the Critical Infrastructure Resilience Activity, USAID/Kosovo is interested in responses to the following questions:

Technical:

1. In addition to the core objectives identified in Annex B, are there additional objectives that should be included to make Kosovo more resilient to cyber attacks?

2. To achieve the objectives identified in Annex B, should a small grants component be included in the activity? If so, how would small grants be incorporated into the activity, and for what purpose?

3. Are there additional documents or information a potential offeror may need to clarify or support the execution of the objectives?

4. Are there any other comments, suggestions or enhancements you may wish to offer that will strengthen the draft document?

II. Response Submission Instructions

All comments must be submitted electronically in English to Urime Abdyli via email uabdyli@usaid.gov and Claudio Ballesteros via email at cballesteros@usaid.gov with the subject line: “RFI No.72016723RFI00002 - Critical Infrastructure Resilience Activity” by the date listed on the cover letter.

All documents submitted must be .pdf or .doc format. The submitted information must not exceed 15 pages, including annexes/attachments. Do not send zip files.

Respondents are not required to answer all questions but are encouraged to respond to any and all question(s) for which they have knowledge, experience, or ideas. Please number your responses to correspond with the questions in this RFI.

1. Reference: RFI#72016723RFI00002

2. Organization Name:

3. Point of contact name and contact information:

4. Size and type of organization, including U.S. small businesses or other status if applicable

(optional, if applicable):

5. Legal registration status in Kosovo (optional, if applicable):

Respondents may submit:

● responses to some or all of the questions in the RFI; and

● documents, if any, that support the answers to the RFI Questions as attachments.

The collected information will be used to determine the level of interest and will not be released publicly. By responding to this notice, there will be no advantage to any entity or organization.

The submitted documentation and content thereof becomes the property of USAID and will not be returned.

This announcement is not to be construed as a Request for Proposals. It does not commit USAID to reply to information received, or to later publish a request for applications, or to award an agreement based on this information. Furthermore, it does not commit USAID to pay for any costs incurred in response to this RFI. Only the information requested above will be considered.

RFI No. 72016723RFI00002 DRAFT

ANNEX B

Annex B consists of a draft requirements document.

CRITICAL INFRASTRUCTURE RESILIENCE ACTIVITY

PURPOSE:

The purpose of the Critical Infrastructure Resilience Activity (CIR) is to protect Kosovo’s critical infrastructure by improving cyber governance and building capacity in responsible institutions to become more resilient to cyber attacks.

BACKGROUND AND CONTEXT:

Currently, Kosovo is in a situation where the critical infrastructure operators and government bodies are not fully prepared to address cybersecurity threats. There is no clear top-down direction or mandatory requirements for industry stakeholders. This is problematic because more people than ever depend on the services provided by critical infrastructure due to the growth of the world’s population, rural to urban population shifts, as well as the rise of global interconnectedness.

Moreover, Kosovo in particular is highly reliant on a limited number of essential service providers for water, electricity, and transportation. For example, six regional water companies servicing municipalities rely on a single water source; the national power grid has limited redundancy; there is only one operational airport in the country; and the computer emergency response teams (CERTs) from these entities are limited in staff or non-existent. Attacks on any of these systems or assets would have catastrophic consequences on public safety and wellbeing, the environment, and economic progress.

In recognition of the above issues, the Government of Kosovo enacted the Law on Critical Infrastructure1 in March 2019. The purpose of this law is to promote security and resilience within critical infrastructure sectors. In accordance with the Law, the government must identify and designate a subset of infrastructure critical to national security and societal wellbeing. To fulfill this requirement, the government will complete a comprehensive risk analysis that identifies Kosovo’s critical infrastructure in the near future. In addition to the Law on Critical Infrastructure, the Government also enacted the Law on Cybersecurity, which, in part, establishes a new Cyber Security Agency (CSA) to develop, implement, and promote cyber security policy within Kosovo.2 The Government expects to hire and onboard an initial set of CSA staff by the end of the 2023 calendar year.

The GoK has identified the sectors it deems critical to national security, economic vitality, and public health and safety under the Law on Critical Infrastructure (these include, but according to the law, are not limited to: dangerous goods, energy, financial services, food and agriculture, government facilities, 2 Kosovo Law on Cyber Security published on the Official Gazette of the Republic of Kosovo on February 27, 1 Critical infrastructure is the assets, systems, facilities, and networks that society relies upon to maintain national security, economic vitality, and public health and safety. Such entities include physical and cyber infrastructure.

Not all infrastructure is critical to national security; however, sectors commonly recognized as essential are transportation, water, energy, and communications--all of which are interdependent.

https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=70933 https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=70933 healthcare and public health, information and communication technology, national values, public services, transportation, and water and wastewater).

Through its existing Critical Infrastructure Digitalization and Resilience activity, USAID is tackling the problems identified above by supporting the establishment and operationalization of the Critical Infrastructure Cybersecurity Working Group (CICWG). The CICWG is a multi-stakeholder consultative group of representatives from government agencies and ministries, private sector, and academia that will continue to provide support and advice to the government as it builds its capacity to prepare for, respond to, and recover from cyber threats. Beyond the Working Group, however, much more will need to be done to directly support the GOK as it stands up the new Cyber Security Agency, establishes governance frameworks, and begins building institutional cyber capacity across the country.

Linkages to Strategy The USAID/Kosovo Critical Infrastructure Resilience Activity will contribute to Development Objective (DO) 2: Opportunities for Democratic and Economic Participation Increased. Specifically, it will contribute to Intermediate Result (IR) 2.3: Energy Security Improved, IR 2.2: Private Sector Competitiveness in Targeted Sectors Increased, and IR 2.1: Citizen Contribution to Democracy and the Economy Increased. The Activity will also contribute to DO 1: Citizens are Better Served by Accountable and Effective Governance Institutions–specifically IR 1.2 Executive Governance and Legislative Responsiveness Strengthened. These DOs were approved as part of the Mission’s Country Development Cooperation Strategy on March 16, 2021.

The Activity is also linked with Integrated Country Strategy (ICS) Mission Goal 1.3: “Kosovo’s capabilities to counter malign actors, violent extremism, and terrorism enhanced; its security force strengthened;

and its Euro-Atlantic and global integration deepened, including through unique contributions to Operation Allies Welcome, as well as Mission Goal 2.2.1: “Support Kosovo institutions to improve implementation and enforcement of laws and regulatory frameworks, including through targeted reforms and oversight, that support more accountable governance and reduce opportunities for corruption.”

Finally, the Activity aligns with the GOK’s National Cyber Security Strategy 2023-2027, which “presents a plan of directions and approaches approved by the Government of Kosovo aiming to improve the security and resilience of national infrastructures and services.” The Activity also aligns with the March 2023 Kosovo Law on Cyber Security, which “establishes the principles of cyber security, the institutions that develop, implement and promote cyber security policy, the responsibilities of the authorities in the field of cyber security, the duties of cyber security entities, inter-institutional cooperation, the prevention and combating of cybercrime in the Republic of Kosovo against any threat or attack and establishes the National Cyber Security Agency.”

DEVELOPMENT CHALLENGE:

Globally, critical infrastructure is increasingly susceptible to cyber attacks, placing social and economic wellbeing and security at risk. Specifically, the Kosovo government, private businesses, and individual citizens are increasingly experiencing malicious cyber activities. The September 2022 Distributed Denial of Services (DDoS) attacks against government online services and telecommunication systems are evidence of this, as are the increasing number of attacks on countries across the region3.

3 Media reporting about the DDOS attacks against Kosovo institutions https://kallxo.com/lajm/qeveria-e-kosoves-tejkalohet-sulmi-kibernetik-sherbimet-qeveritare-jane-te-qasshme/ https://kallxo.com/lajm/qeveria-e-kosoves-tejkalohet-sulmi-kibernetik-sherbimet-qeveritare-jane-te-qasshme/

The Government of Kosovo has begun planning to address and assign institutional responsibilities to address the challenges outlined above. However, COVID-19 and the ongoing energy crisis have channeled the GOK’s resources away from addressing these long-term challenges with potentially near-term impacts. Now that the focus is shifting back to day-to-day operations, there is an opportunity to make progress on the government’s cyber-related goals, strengthening critical infrastructure resilience to prevent and mitigate prolonged service disruptions, reduce the chance of catastrophic system failures, and minimize incident response and recovery investments.

THEORY OF CHANGE:

IF Kosovo develops policies, rules, and regulations to govern the cybersecurity sector, AND builds the capacity of institutional operators to implement those policies and identify and respond to their own cybersecurity needs, AND operators possess appropriate technological solutions to mitigate cyber risks, THEN Kosovo will become more resilient to cyber attacks.

PROGRAM OBJECTIVES:

The Activity will strengthen critical infrastructure cybersecurity resilience to prevent or mitigate disruptions to essential public services, reduce the chance of catastrophic systems failures, and minimize incident response and recovery investments. USAID will strengthen the governance, institutional capacity, and sustainability of critical infrastructure preparedness, response, and recovery to these major threats.

USAID, in consultation with the GoK and other key stakeholders, will prioritize and target assistance to the following three sectors: energy, telecommunications, and e-government services. Additional sectors may be identified, prioritized, and added to the scope during implementation. This activity will not address cybercrime or law enforcement preparedness and response to crimes committed in the digital environment; nor will it duplicate USAID’s E-Governance Activity by designing, deploying, or expanding e-services or digital solutions for the public sector (see: Relationship to Other USAID Activities section).

The purpose of this activity will be achieved through three mutually supportive objectives:

Objective 1. Governance - Strengthen cybersecurity governance for and institutional coordination with critical infrastructure operators and oversight bodies, primarily through the soon-to-be established Kosovo Cyber Security Agency (CSA)

Objective 2. Capacity Building - Build the capacity of the CSA and targeted critical infrastructure operators to plan for, respond to, and recover from cyber incidents

Objective 3. Technology and Procurement - Support the identification, prioritization, and procurement of cybersecurity technology solutions

RESULTS

While the offerors may propose additional results linked to their proposed approach, at a minimum they must present results demonstrating the following:

● The CSA is established and fully operational in accordance with the Law on Cyber Security

● Cybersecurity sector governance is improved

○ The Government develops, improves, and implements required legislation, strategies, and other cybersecurity-related policy documents

○ Critical infrastructure operators develop and implement procedures that comply with relevant primary and secondary legislation.

○ CSA develops requirements and guidance for critical infrastructure operators to implement systems/protocols that will enable the training, recruitment, retention, and/or procurement of cybersecurity expertise.

● Coordination and collaboration between critical infrastructure owners, operators, and oversight bodies is improved

○ The CSA develops procedures for communicating internally (between critical infrastructure operators) and externally (to the public) about cyber threats and incidents.

● Cyber threat response and prevention capabilities within targeted institutions is strengthened

○ Experts are deployed for rapid response to cyber attacks and to restore system operations.

○ The CSA’s Computer Emergency Response Team (CERT) and targeted critical infrastructure operators have capacity to defend against future attacks.

○ Analyses identify vulnerabilities and provide recommendations for cybersecurity improvements to the targeted critical infrastructure operators.

● Government institutions and critical network operators do not procure work, supplies, or services from manufacturers that pose a risk to Kosovo’s cyber security, critical infrastructure, or national security.

○ Government stakeholders, including the Kosovo Procurement Agency and critical infrastructure operators, are trained on the processes and methods needed to evaluate cybersecurity technology and supply chain risks as well as on how to apply best practices to manage cyber-related procurements.

○ The Kosovo government and critical infrastructure operators can identify, prioritize, and procure Operational technology/Information technology (OT/IT) solutions.

○ The Kosovo government and critical infrastructure operators have the capacity to use, maintain, and invest in OT/IT assets.

○ Hardware/software upgrades for cybersecurity protection and/or response are procured for select entities or bodies.

● The evolving technical needs of the CSA and target critical infrastructure operators are successfully addressed.

GRANTS UNDER CONTRACT

To support the three objectives, this Activity may utilize a Grants Under Contract (GUC) funding mechanism of up to $1.5 million in total. This mechanism would allow the Activity to fund small grants to for profit or non-profit non-governmental entities offering innovative ideas promoting cyber security resilience and technology solutions. The exact structure of the awards will be developed in close coordination with USAID, but will not include capital for equity investments. A minimum of 10 grants is required.

ILLUSTRATIVE INDICATORS:

The successful offeror will propose illustrative indicators that facilitate adaptive learning and management in support of greater local ownership and sustainability. The following are illustrative indicators that the offeror may consider when developing their proposed approach:

● Number of cyber security policies and legal framework drafted.

● Number of cyber security policies and legal framework adopted/implemented.

● Cyber Security Agency established (milestone indicator).

● Number of cybersecurity incidents identified.

● The amount of time needed for response to threats.

● Number of individuals with improved soft skills following participation in USG-assisted workforce development programs.

RELATIONSHIP TO OTHER USAID ACTIVITIES:

The Activity must collaborate strategically and intentionally with other USAID activities, as well as the GOK and other development partners’ programs.

Specifically, this activity will collaborate with USAID’s E-governance Activity and Private Sector Led Workforce Development (PSLWD) Activity. The CIR team must work with these activities to create efficiencies, avoid duplication of interventions, and amplify its results. For example, the CIR team should assess the value of joining the PSLWD’s Workforce Development Council. The CIR team must also work with the E-Governance Activity to develop cybersecurity parameters for online platforms and identify platform specific cyber needs that CIR can meet with tailored assistance.

If USAID’s Cyber Infrastructure and Digitalization Resilience (CIDR) activity has not yet ended, the CIR team must meet with the CIDR team to learn from their experiences in Kosovo. This includes handing over any lessons learned, best practices, or research that would be prudent for the CIR Activity.

The Activity must work with other USAID/Kosovo activities as synergies become clear or the need arises.

RELATIONSHIP WITH THE GOK

The GOK has historically been an enthusiastic partner in USAID interventions. It is anticipated that the Activity will work closely with the GOK, primarily with the ministries responsible for critical infrastructure, and particularly with the soon-to-be-established Kosovo Cyber Security Agency. The Activity should anticipate communicating, coordinating, and possibly partnering with the GOK or other government entities when appropriate to advance the objective of the Activity, especially in the area of cybersecurity for e-government services.

RELATIONSHIP WITH OTHER DONORS

This Activity will require working with international donors and other institutions to support, promote, and lead cybersecurity and climate change resilience policies and initiatives. Additionally, the Contractor must implement the contract in close coordination with other donor-supported activities in Kosovo. This coordination aims to avoid the duplication of efforts, ensure synergies, and maximize impact and investments. The Contractor must ensure that the Activity takes into consideration other related initiatives and maintains complementarity with other donors’ approaches.

GUIDING PRINCIPLES:

Private Sector Engagement: Partnerships between the private sector (small, medium, and large companies), government entities, and associations are strongly encouraged and could bring innovative solutions to addressing Kosovo's challenges to secure costly cybersecurity expertise, especially within the GoK and public-owned critical infrastructure entities.

Sustainability: The Activity’s fundamental achievements must be sustained beyond the life of the Activity. The offeror must include local stakeholders, including the GoK, and all relevant business stakeholders, to seek sustainable solutions. The implementation of the core objectives must consistently reflect sustainability as the end goal of USAID assistance in Kosovo. Sustainability, in this case, is defined as the long-term resilience of a system that is able to address current private sector challenges, as well as future challenges beyond the life of this USAID activity.

The New Partnerships Initiative (NPI): The NPI diversifies USAID’s partner base by creating avenues for local and underutilized partners to work with USAID. NPI seeks to lower the barriers faced by nontraditional partners - including local actors, U.S. small businesses, faith-based organizations, cooperatives, diaspora groups, minority-serving institutions, and civil society organizations, among others - so that the Agency can embrace the diverse potential of the partnering community in pursuit of our shared development goals. NPI strives to support prospective partners to overcome the informational imbalance typically faced by groups that are new to, or less familiar with, how USAID operates.

Integration of Women, Minorities and Persons with Disabilities (PWD): Throughout the process of planning, coordination, and implementation, it is critical that underserved, disadvantaged, and marginalized populations such as women, minorities and PWD have adequate representation.

Interventions must ensure that the representation, participation, and capacity building of these groups

– at all levels of interventions – will be in line with USAID policies including the 2023 Gender Equality and Women's Empowerment Policy and other inclusive development policies.

The Activity must ensure that the role of women and young girls, minorities, and PWD is recognized and enhanced – not undermined – by its interventions. The activity should tailor its interventions based on the needs of women, minorities and PWD. All interventions should integrate these underserved and disadvantaged groups into selection processes, timing of program activities, location, and capacity building program content. The activity must be inclusive and represent the interests of all underserved and marginalized communities in Kosovo. For example, all procured technology must be accessible to people with disabilities.

Do No Harm: The Activity will ensure that the assistance will safeguard against any foreseeable and demonstrable negative impacts on local markets, production, services or employment, and discrimination against one or more socio-economic, religious, political, ethnic, or other citizen subgroups.

Youth: Considering that youth throughout Kosovo remain marginalized and lack the skills to join the labor market, the Activity aims to improve the environment for businesses so that both, the public and private sector, can bring more efficiency and effectiveness to achieve outcomes with regards to youth empowerment and participation in decision-making processes. USAID/Kosovo deploys Positive Youth

Development Approach across all its interventions and aims to provide youth with opportunities for engagement and further development. The activity should be in line with the Youth in Development Policy 2022 update.

Support Changes: Simultaneously work from the bottom-up (e.g., through working directly with small and medium-sized enterprises) and from the top-down (e.g., engaging private sector stakeholders, business associations, independent agencies, government institutions, and other private sector stakeholders) to develop the right enabling conditions for increased capacities of the private sector.

[END OF RFI]