OT Pillar Industry Day Standing Questions 22APR24 V2.pdf

DCSO - J62 - DM

DLA OT Pillar Equipment Life Cycle Management

Cyber Security Industry Day

Question(s) And Answer(s)

From Industry Day, Dated 9APR24

Questions From the Electrical & Lighting Systems (Building) AND HVAC + Building Automation Systems + Utility Metering System Breakout Session.

1. Question. The Columbus Slide(s) stated the Government does the work, but a contractor present for the event stated they did the work. Please Clarify what work from Columbus and all other site(s) being conducted by Government and what percentage of work being completed by contractor(s)?

Answer:

Elevators Site(s) Approx. Gov’t % Approx Contractor % HQC, Ft. Belvoir, VA N/A 100 Richmond, VA N/A 100 NC/Susq N/A 100 Columbus, OH N/A 100 San Joaquin, CA N/A 100

HVAC

HQC, Ft. Belvoir, VA N/A 100 Richmond, VA 50 50 NC/Susq 80 20 Columbus, OH 50 50

Electrical / Lighting

HQC, Ft. Belvoir, VA N/A 100 Richmond, VA 50 50 NC/Susq 80 20 Columbus, OH 50 50

Potable Water

HQC, Ft. Belvoir, VA N/A N/A Richmond, VA N/A N/A NC/Susq N/A 100 Columbus, OH N/A N/A

Waste Water

HQC, Ft. Belvoir, VA N/A N/A Richmond, VA N/A 100 NC/Susq N/A 100

Electrical Distribution

HQC, Ft. Belvoir, VA N/A 100 Richmond, VA N/A 100 NC/Susq N/A 100

2. Question. Is part of your consideration Defense Critical Infrastructure? Do you have aggregation of data raising classification? Do you require a Cross-Domain Solution?

“Contractor recommended looking at Data Collection and Discussing w/DLA Intelligence and the Governing Security Classification Guide.”

Answer: Defense Critical Infrastructure – DLA does have some Defense Critical I nfrastructure. These are under the POL Pillar. At this time no other OT have been deemed to be Defense Critical infrastructure.

Aggregation of data mostly from the assessed vulnerabilities of a critical system may raise the classification, but at this time only the POL Pillar systems have raised c classification due to their location and discovered vulnerabilities. No other Pillar OT systems have higher classification beyond Controlled Unclassified Information (CUI).

There are no Cross-Domain Solutions present with DLA OT systems. Data Collection / Active monitoring is beyond my responsibility. This is a question Mr. Reid will need to address. However, I do recommend this be entertained.

3. Question. Which Cyber/OT Frameworks are actively being utilized?

Answer: Combination of NIST 800-53 r3 (currently updating to Rev5), NIST 800-82 R3 and ISA 62443 is the guidance DLA uses to RMF Assessments.

4. Question. Can we get a list of Current Contractors (Site Based) & their incumbents?

1 EVSE:

SP4705-23-F-0162 Apollo Sunguard Sys

2 Elevators:

Ric SP4703-19-D-0030 WH Resources Col SP4702-20-C-0007 Oracle Elev Holdco

NC/Sus SP3300-22-P-0585 Kone Inc.

HQ SP4705-19-D-0003 Elcon Enterprises SJ SP3300-22-C-5001 Sunik, LLC

3 Potable Water Systems & Waste Water:

4 Electrical Systems and Ligh�ng Systems-:

HQ SP4705-22-D-0001 VarcoMac

5 HVAC, BAS, & U�lity Metering-

HQ SP4705-20-F-0084 NVE, Inc.

HQ SP4705-20-D-0004 NVE, Inc.

Col SP4702-21-C-0009 Four Seasons Ric SP4703-22-P-0027 Goodwill Ind.

NC/Sus W912DY-21-F-0499 Johnson Controls SJ SP3300-22-C-5001 Sunik

6 Electrical Distribu�on: N/A

5. Question. Will Innovation be included in the Solicitation/Proposal?

Yes, innovation will be included in the requirement.

6. Question. Will DLA require offerors to hold and maintain a Facilities Clearance on any of the requirements (DD254 Required)?

Answer:

Yes.

Contractors needs staff who is cleared.

Fort Belvoir: All of our contracts related to this effort will require all trade staff working on site to hold minimum SECRET clearance, and our electrical requires SCI cleared for some positions. The only exceptions will be the admin who manage work flow and are required to be on site, but are not in the field.

7. Question. When will the Sources Sought for the HVAC+ Building Automation + Utility Metering Systems be released/posted?

Answer:

The source sought was posted on SAM.gov on April 10, 2024 and closed on April 18, 2024. The information below is the estimated timeline for the requirement.

Estimated Value $35M - $100M:

Electrical and Building Lighting Systems HVAC + Building Automation Systems + Utility Metering Systems

Post Draft Solicitation/Hold Pre-Solicitation Conference & Site Visit(s) June/July Post Solicitation (30 – 45 days) Aug/Sep Proposals Due Sep/Oct Tech Eval/Pricing Review/Discussions/etc. Nov 24 thru Feb 25 Contract Award Mar/Apr 25

8. Question. How will this requirement integrate with the existing HVAC Contract?

At this moment no decision has been made regarding any current contracts.

9. Question. If awarded, how will the site determine where to manage a service calls, HVAC or new contractor?

To be detailed in the Task Order.

From the Elevator Breakout Session

10. Question(s) from a cyber contractor in the Elevator Breakout session for context. What will be the different elevator requirements per site/facility? And will some facilities go for a network connected elevator versus standalone?

This is not a cyber security decision. The requirements should be based on the PMO and DM determination and based on DLA CIO guidance for OT systems. Cybersecurity will provide risk assessments for each system based on the required artifacts provided to recommend to the AO for an authorization decision.