TRN 1077/10/2015 - Cyber Security: Product Assurance Scoping Work

The Department of Energy and Climate Change (DECC), wishes to appoint a supplier to investigate current approaches which assure the cyber security of Industrial Control Systems (ICS) and other Operational Technology (OT), and the extent to which these systems are assured across the energy sector internationally.

The aim of the DECC Cyber Security Team is to work with the energy sector to reduce the risk of attack on critical national infrastructure (CNI). Effective and reliable energy infrastructure is critical to a secure supply of energy in the UK. This infrastructure is controlled and monitored by complex networks and systems which collate, analyse and store data and enable communication. Cyber threats pose a serious and evolving challenge to the energy sector and a successful cyber-attack could have a serious impact on energy supply, adversely impacting national security, public safety and the UK economy.

The Energy Emergencies Executive Committee Cyber (E3CC) subgroup conducted a high-level assessment of cyber security capability across the downstream gas and electricity sector which identified several areas for collective improvement. One such area identified common cyber products in use across the sector which control and monitor CNI, creating a potential systemic risk. Industry has requested assistance in gaining greater assurance of the cyber security of these products. DECC, wishes to appoint a supplier to investigate current approaches which assure the cyber security of ICS and other OT used across the energy sector. The supplier will undertake a review of: • OT/ICS products which are used in or relevant to the energy sector, including their function and any advertised security characteristics; • Existing security standards and certifications for OT/ICS products. This should specify: o background details of the organisation either publishing the standards or granting certification; o the criteria used to certify products; o identify relevant energy sector products which have achieved certification or been developed in accordance to security standards; • Previous security testing conducted on OT/ICS systems detailing what was tested and how; • Organisations (including academia) who are developing security standards, certification schemes, testing beds and testing criteria to assure the cyber security of OT/ICS products. Based on the data gathered, the supplier should recommend:

• Security characteristics that should be tested on OT/ICS products relevant or used by the energy sector. This should detail how these can be tested; • Suitable test laboratories/ranges that could undertake testing of OT/ICS products. • A list of OT/ICS products tested and certified, including where they are used and any specific products for the energy sector.