OT Cybersecurity Risk Assessment

The Colorado River Commission of Nevada (CRCNV) in Clark County has issued a Request for Proposals (RFP) for an Operational Technology (OT) Cybersecurity Risk Assessment. The procurement seeks a qualified contractor to conduct a comprehensive security assessment of the agency's network infrastructure, focusing specifically on OT systems using Schneider Modicon PLCs and Survalent Technology for SCADA operations. The project requires a detailed evaluation of approximately 50 VLANs, 500 servers and network devices, 300 IP addresses, and 5 external-facing applications across roughly 80 locations. Key deliverables include a Cybersecurity Risk Assessment Report with an executive summary, detailed assessment results, recommendations for immediate and long-term remedies, and a project plan aligned with industry standards from NIST, ISO/IEC, IEEE, IEC, and CIGRE. The assessment will cover five existing networks: CorpNet, ManageNet, SCADANet, RevNet, and Wonderware Modbus Plus Network. Proposal submissions are due by December 16, 2024, at 2:00 pm, with vendor evaluation occurring between December 16, 2024, and January 13, 2025. The estimated contract start date is March 5, 2025, with a potential four-year contract term subject to Board of Examiners approval.

The RFP does not specify any specific set-aside designations or restrictions for disadvantaged enterprises. No incumbent contractor is mentioned for this project. The infrastructure is primarily local, with only 5% cloud-based components, and all data is stored locally. Contractors will be required to provide their own assessment tools and technologies rather than leveraging existing solutions. While no specific budget is explicitly stated, the RFP suggests potential opportunities for additional implementation work following the initial assessment. Vendors must comply with mandatory minimum requirements, including Nevada business licensing, no boycott of Israel, and provisions for indemnification and limited liability. The contract will require comprehensive insurance coverage, including Commercial General Liability, Automobile Liability, Workers' Compensation, Technology E&O/Professional Liability, and Network Security and Privacy Liability, with specific minimum coverage limits detailed in the contract documents.