Summary_Questions & Answers.pdf
PDF 83 KB Posted
- Attached to
- OT Cybersecurity Risk Assessment
- Solicitation number
- 69CRC-S3055
- Issued by
- Clark County, Nevada
About this file
This document contains questions and answers related to an OT Cybersecurity Risk Assessment RFP issued by the Colorado River Commission of Nevada for Clark County. The scope involves conducting security assessments on operational technology (OT) systems, including network mapping, vulnerability scanning, penetration testing, and physical security evaluations across approximately 80 locations. The RFP focuses exclusively on OT systems using Schneider Modicon PLCs and Survalent Technology for SCADA operations, with testing to be performed on production systems. Key technical specifications include assessment of 50 VLANs, 500 servers and network devices, approximately 300 IP addresses, and 5 external-facing applications.
The agency confirms there is no incumbent contractor and this is an independent RFP. The infrastructure is primarily local with only 5% cloud-based components, and all data is stored locally. The contractor will be expected to provide their own assessment tools and technologies rather than leveraging existing solutions. While no specific budget is provided, the contractor will have opportunities for additional implementation work following the assessment. The agency will provide high-level network diagrams as baseline documentation, though updates may be required during the planning phase. The project timeline will be determined by the contractor, with changes handled through formal change orders if justified.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Question Date Question Response Date Response
11/18/2024
We see that there is a Reference Questionnaire that you are asking us to have some of our relevant clients complete and forward to your organization. We have several completed questionnaires and Official Customer Performance Assessment Reporting System (CPARS) Evaluations for relevant projects that our federal clients have completed that provide the information you require in your reference questionnaire.
Given that our clients have already taken the time to complete these official evaluations, we respectfully request that you consider allowing us to use these official evaluations in lieu of your Reference Questionnaire. 11/20/2024 Only the reference questionnaire in the RFP package will be accepted.
11/18/2024
Is there currently an incumbent company or previous incumbent, who completed a similar contract performing these services?
If so - are they eligible to bid on this project and can you please provide the incumbent contract number, dollar value, and period of performance? 11/20/2024 There is not an incumbent company. This is an independent RFP for the services requested.
11/18/2024 Specify the VLAN details how many are included in the Scope? 11/20/2024 Assume 50 VLANs. To be determined by bidder during planning phase.
11/18/2024
Can you please provide the current number of infrastructure details (Physical Server, Virtual Server, Network Devices, etc.)? 11/20/2024 Assume 500 servers and network devices combined. To be determined by bidder during planning phase.
11/18/2024 How much (%) of the infrastructure is in the cloud? 11/20/2024 Assume 5%. OT infrastructure is not cloud based. Design documents are stored in a local document server.
11/18/2024 In the IT department/environment, how many employees work? 11/20/2024 RFP is not IT focused.
11/18/2024
Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities? 11/20/2024 All data stored locally.
11/18/2024
Is there a funding/financial/budget range estimated that can help us to provide a quotation for this project? 11/20/2024 No.
11/18/2024 What type of programmable logic controller (PLC) does the CRCNV use? 11/20/2024 Schneider Modicon family.
What is the primary vendor CRCNV has for measuring this SCADA? 11/20/2024 Survalent Technology.
11/18/2024 How many Physical locations? 11/20/2024 Assume 80 locations. To be determined by bidder during planning phase.
11/18/2024 Does wireless communication exist between the devices? 11/20/2024 No.
11/18/2024 Does the CRCNV monitor or manage outside vendors? 11/20/2024 Yes.
11/18/2024
Is SCADA isolated from other networks (CRCNV, other departments, or the internet)? 11/20/2024 Yes. To be determined by bidder during planning phase.
11/18/2024 What database tools does the CRCNV use for data collection and monitoring? 11/20/2024 Products from Survalent, SEL, Schneider.
11/18/2024 Does the client have non production environments that are one for one matches of product for testing?11/20/2024 No 11/18/2024 Does the client have a total number of external and internal IP addresses?11/20/2024 Assume 300 combined IP addresses. Vendor to confirm during planning phase .
11/18/2024 What are the expected outcomes or success criteria for the project? 11/20/2024 Identification of threat vectors and potential intrusion points as well as NERC CIP recommendations as requested in scope.
11/18/2024 Is there an existing topology diagram of the networks and interconnections? 11/20/2024 We are providing high level overviews.
11/18/2024
Are there historical risk assessments, vulnerability tests or penetration tests to reference? 11/20/2024 No.
11/18/2024 What is the expected timeline for deployment, testing and completion? 11/20/2024 As determined by contractor.
11/18/2024 Are there any operational constraints such as conducting work after-hours? 11/20/2024 No.
11/18/2024
Will Colorado River Commission provide any resources (technical staff, equipment, etc.)
for support? 11/20/2024 Yes.
11/18/2024
Is training required by Colorado River Commission prior to executing the Statement of Work? 11/20/2024 More detail will need to be provided to answer this question.
11/18/2024 Are there any maintenance contracts that will impact the Statement of Work? 11/20/2024 No.
11/18/2024
Are there any known environmental or operational risks that need to be accounted for? 11/20/2024 More detail will need to be provided to answer this question.
11/18/2024 Who is the current cyber insurance carrier? 11/20/2024 State of Nevada.
11/18/2024 Has the client experienced any cyber-related claims? 11/20/2024 No.
11/18/2024 How will unexpected challenges or SOW changes be handled during the project? 11/20/2024 If the change is justified, it will be handled by a change order.
Can you confirm whether any existing network diagrams, asset inventories, or system documentation for the listed networks (CorpNet, ManageNet, SCADANet, RevNet, and Wonderware Modbus Plus Network) will be provided to the contractor as a baseline for network mapping? If so, how comprehensive is the current documentation? 11/20/2024 Yes. Updates my be required during planning phase.
11/18/2024
Can you provide the BES Cyber Systems Categorization (CIP-002-5) for the systems?
Or is the goal to have them reassessed to meet v5 categorization? 11/20/2024 WE are not a NERC BES entity. The goal is to be proactive in assessing the system for a NERC BES entity.
11/18/2024
Are OT components expected to be included in pentest scope? Or will the scope focus on only IT systems If included, do contingency plans exist if tests impact critical systems? 11/20/2024 This RFP is only for OT.
11/18/2024
Will there be an opportunity for the contractor to assist with the implementation of the recommendations or remediation actions identified in the risk assessment, or is this scope limited to assessment and reporting only? 11/20/2024 Yes, there will be an opportunity.
11/18/2024 • As part of the wireless testing, will CRCNV be providing wireless access point or controller configuration files to the selected partner for offline inspection and analysis?
Or is that level of testing out of scope for this assessment? 11/20/2024 Wireless access does not touch OT.
11/18/2024
Please clarify if the Brute Force Attack is to be performed only against the selected databases only, or is the scope broader than that and that brute force password testing should be conducted against multiple asset types? 11/20/2024 Brute Force Attack should be preformed against multiple asset types.
11/18/2024
How many sites are included in the scope of the physical security testing? How many buildings or facilities? 11/20/2024 Assume 20 locations. To be determined by bidder during planning phase.
11/18/2024 How many physical locations shall be included in the scope of wireless scanning? 11/20/2024 Assume 20 locations. To be determined by bidder during planning phase.
How much of the described penetration testing scope described in the “Perimeter Testing” section of Attachment A is expected to be performed against devices/systems in the OT environment? If penetration testing against OT assets is desired, would that be performed on production systems or is there a test environment that will be utilized? 11/20/2024 100% on production systems.
11/18/2024
For the 5 mission-critical applications in scope for security risk assessment scans, does CRCNV own the source code for each, or are they vendor-supplied/supported applications? How many of the applications are Internet-facing vs accessible on Internal network only? o Section 12 of Attachment A mentions authenticated application scanning and penetration testing against 5 external facing applications. Are these the same 5 applications as those described as “mission-critical”? Or, will a total of 10 applications be included in the scope of web application scanning? 11/20/2024 Vendor supplied. Internal network only. 5 external facing applications.
11/18/2024
Does the desired scope of the Segmentation Testing include OT systems as well?
Specifically, which of the five networks at the main control room site should be included in the scope of network segmentation testing (e.g., SCADANet, RevNet, etc.)? 11/20/2024 This RFP is only for OT.
11/18/2024
Does CRCNV have an existing OT Security Policy or standard that the assessment should be conducted against, in addition to the other requested frameworks (e.g., NIST CSF, ISO/IEC, etc.) 11/20/2024 NO. This RFP is looking for a contractor to develop a policy.
11/18/2024
For the vulnerability scanning on the IT environment, does CRCNV have an existing solution that they would like the selected partner to leverage for this assessment? Or, should the partner plan to utilize the tool/solution of their choice to scan network assets for vulnerabilities? 11/20/2024 The partner should plan to utilize the tool/solution of their choice to scan network assets for vulnerabilities
Does CRCNV have existing OT visibility solutions (e.g., Claroty, Nozomi, Dragos, etc.) that the selected partner can leverage for the network mapping and vulnerability identification activities? Or, should the bidder’s proposed approach include recommended use of tools/technology in order to perform those functions? 11/20/2024 The bidder's proposed approach should include recommended use of tools/technology in order to perform those functions.
File details come from the government source that posted it. Updated .