Technical study to develop good practice guidance on securing electricity substations against cyber risks.

Notice summary: The Department of Energy and Climate Change wishes to commission a project to develop guidance on securing electricity substations against cyber risks. Developing guidance on how best to secure substations would assist industry by providing guidance on how best to ensure specific risks are mitigated across the sector.

Description: Substations are critical in maintaining a stable and secure supply of electricity and the loss of one or more substations would result in widespread disruption to consumers and extensive financial losses. Indeed the targeted cyber-attack in Ukraine in December 2015, which led to up to 225,000 people having electricity cut off for several hours, was highlighted in the Department of Homeland Security incident report to have been achieved by hackers installing malware within substations that allowed them remote access.

Due to the number of critical sub-stations it would not be possible to undertake a cyber risk assessment at each substation; but developing good practice guidance on how best to secure current substations and how to procure and deploy secure substations (from a cyber risk perspective), including next generation smart substations and associated smart assets, would assist industry by providing guidance on how best to ensure specific risks are mitigated across the sector.

The supplier, via background research and industry engagement, and using their own relevant technical and sector expertise, will produce sector-specific guidance on securing substations, including the transmission and distribution aspects, covering current and future designs (including next generation smart substations).

This will include a review by the supplier of:

• Existing (if any) security standards/guidance for securing substations, • the Ukrainian cyber-attack in December 2015, specifically relating to the method employed and lessons identified.

Following this, engagement with industry through a series of company or site-specific visits including interviews with employees will:

• help to understand the different cyber risks to the transmission and distribution segments of existing electrical substations, • identify designs for future substations (including next generation smart substations) where guidance could be utilised.

Additional information: The supplier will deliver a final report and guidance which outlines the key findings as indicated in the “High Level Specification” section including:

• A review of existing security standards/guidance relevant to securing substations, • A review of the Ukrainian cyber-attack incident in relation to substation compromise, • Analysis of the cyber risk identified on existing assets as demonstrated through their reviews, site visits and interviews, • Recommended sector-specific guidance on how to procure and deploy secure substations, including the different transmission and distribution segments, and covering current and future designs, including next generation smart substations and associated smart assets.

This work will produce sector-specific guidance to be produced (by the end of the financial year) to support a wide range of critical assets not previously reviewed. This will give industry access to sector-specific guidance to enable it to best protect its operational technology assets within significant substations. The work will also give HMG increased assurance that Critical National Infrastructure companies have the appropriate guidance to best manage cyber security risks to their sector. How to Apply If you wish to take part in this procurement please see the attached Tender documents attached to this Notice and send your completed Proposal to Mike Botten at address stipulated in the “Who to Contact” section.

Any late submissions will not be considered. DECC reserves the right to halt the procurement process and to not award a contract. DECC will not be held liable for recovery of costs from unsuccessful bids if a contract is not awarded. All costs will be borne by the bidding organisations. If a contract is created it will be upon DECC Standard Terms and Conditions , which are available on Contracts Finder with this notice. Completed tender submission must be returned by post to DECC, address given at the top of this advertisement, by Friday 26th August 2016. We require 3 hard copies (one of which must be signed). Electronic versions of your bids are to be sent AFTER the deadline to Mike Botten ([email protected]). After reviewing and evaluating the written proposals, DECC may decide to hold bid clarification meetings with suppliers. If successful and upon contract signature, the supplier is expected to attend a kick-off meeting taking place on Monday 5th September. Project completion is required by Friday 3rd March 2017.