Information Technology and SCADA Cybersecurity Services

The Vendor is required to provide in creating incident response plans (IRP), business continuity plans and disaster recovery plans for industrial control systems (ICS), operational technology (OT) networks, and an enterprise information technology (IT) network.
- The OT environment consists of servers, workstations, programmable logic controllers (PLCs), firewalls, licensed and unlicensed radios, and power monitoring devices, cellular modems, network switches and other IP-addressable devices.
- The Business Continuity Plan shall:
•    Identify essential missions and business functions and their associated continuity requirements.
•    Define recovery objectives, restoration priorities, and metrics, to include but not be limited to, protecting sensitive data, communicating with stakeholders, and restoring normal operations.
•    Document contingency roles, responsibilities, assigned individuals with contact information.
•    Document the methods for maintaining essential missions and business functions despite disruption, compromise, or failure of one or more of the district SCADA systems.
•    Specify the continuance of essential missions and business functions with little or no loss of operational continuity and support that continuity until full SCADA system restoration at primary operations, processing, and/or storage sites.
•    Document the process for SCADA system restoration without deterioration of the security safeguards originally planned and implemented.
•    Include capacity planning for information processing, telecommunications, and environmental support during event operations.
- The alternate storage site is an offsite location where relevant SCADA configuration and data backups are securely stored and can be used in recovery operations from a loss of SCADA configuration or data.
- The IT environment consists of servers, storage arrays, workstations, firewalls, cellular modems, network switches, routers, wireless access points, other IP addressable devices and many Software as a Service (SaaS) solutions.
- The Business Continuity Plan shall document the procedures necessary to maintain essential services and mission critical functions during disasters that affect the IT system.
- professional services of a contractor or firm with specific experience and expertise in creating Incident Response Plans (IRP) and Business Continuity Plans for information technology networks.
- This IRP shall provide recommendations for protecting the IT environment and provide documentation for preparing for and responding to disruptive incidents when the organization is threatened or compromised.
- To facilitate the support of operations when the primary site is lost, the characteristics of an alternate operations or process site include:
•    Necessary service agreements to permit the transfer and resumption of IT systems for essential missions/business functions within a specified timeframe when the primary operations or processing capabilities are unavailable.
•    Equipment and supplies required to transfer and resume operations at the alternate operations or processing site within the organization-defined time period for transfer/resumption.
•    Security safeguards equivalent to the primary site.
•    Separation from the primary operations or processing site to reduce susceptibility to the same threats.
•    Limited to no accessibility problems to the alternate operations or processing site in the event of an area-wide disruption or disaster and explicit mitigation actions if there are access limitations.
- Provide recommendations for alternate telecommunications to permit the resumption of IT operations for essential missions and business functions within a specified timeframe when primary telecommunications capabilities are unavailable at either the primary or alternate operating, processing, or storage sites.

- Contract Period/Term: 1 year
- Pre-Proposal Meeting Date: September 5, 2025
- Questions/Inquires Deadline: September 9, 2025