CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment

The City of Lakeland, Florida, on behalf of Lakeland Electric (LAK), a municipal electric utility serving approximately 256 square miles in Polk County, issued Request for Proposal 2026-RFP-007 seeking a qualified consultant to conduct an independent evaluation of its Operational Technology (OT) network and perform a comprehensive gap analysis regarding NERC CIP-005-7 and CIP-007-6 R4 & R5 compliance requirements, with scope limited to firewalls and firewall infrastructure. The consultant must assess LAK's current compliance and security posture, identify compliance gaps and security risks related to Electronic Security Perimeter and firewall controls, and provide clear, actionable, and prioritized recommendations to remediate identified deficiencies. The engagement scope includes firewall ruleset analysis using software solutions such as NPView, review of compliance program documentation, collaborative remediation efforts, and destruction or return of sensitive information. The critical infrastructure protected comprises two medium-impact control centers, seven low-impact BES substations, and one low-impact generating unit, with approximately 151 in-scope cyber assets protected by an extended Electronic Security Perimeter created by three physical firewalls managed by a virtual firewall management server. Evaluation criteria allocate 40% weight to approach and methodology, 20% to experience and qualifications, 20% to compliance and security measures, and 10% each to cost and timeline reasonableness. The procurement timeline requires written questions by February 16, 2026 at 5:00 pm, with proposal responses due electronically via the City's OpenGov procurement portal by February 25, 2026 at 2:00 pm. No site visits or bidders' conferences are specified, and proposals remain valid for 60 days from the opening date.

The City offers local vendor preference to qualified businesses operating within Lakeland Electric's service territory for at least 12 consecutive months, though no set-asides for disadvantaged enterprises or other restricted designations are identified in the solicitation materials. Consultants must comply with NERC CIP-004-6 requirements for personnel training, background checks, and facility access authorization prior to commencing work and must secure comprehensive insurance including commercial general liability ($1,000,000 single limit), professional liability/errors and omissions ($1,000,000), cyber and privacy protection liability ($1,000,000), with coverage maintained for three years post-completion. Pricing is structured as a lump-sum contract for all scope of work expenses plus estimated reimbursable travel costs, with consultants required to provide itemized cost breakdowns including consulting fees, subcontractor costs, and miscellaneous expenses; however, no specific budget range or award value is disclosed in the RFP materials. Selected contractors must execute multiple compliance documents including indemnification agreements with the City and State of Florida Department of Transportation, non-disclosure and confidentiality agreements protecting Lakeland Electric's proprietary information, human trafficking affidavits, and contractor safety evaluation forms. The contract award will be made based on the City's determination of best overall value rather than lowest cost alone, and no incumbent vendor information is identified in the procurement documentation.