Operational Technology Cybersecurity Consultant Services

The Vendor is required to provide Operational Technology (OT) Cybersecurity consultants to provide an infrastructure servers and architecture survey and provide an upgrade to critical cybersecurity documents.
- Must offer critical OT Cybersecurity survey services and provide cybersecurity documents including incident response procedure, business continuity plan, disaster recovery plan, and OT cybersecurity policies and procedures at the university cogeneration facility.
- The review and upgrade for the project will include support with cybersecurity software/hardware already installed and relate to existing network hardware (e.g. iFix, Rockwell Automation Verve Systems).
- The Business Continuity Plan must include operations process mapping, gap analysis, impact analysis, and best practices.
- These services will include the OT cybersecurity policy and procedures review by setting the environmental cybersecurity objectives and outlining principles for reducing cyber risks.
- Complete automated inventory, endpoint asset management, and added context to assets in order to facilitate and verify the use of compensating controls and the ability to remediate issues after they are detected.
- Develop a comprehensive OT Cybersecurity Policy for the Cogeneration Facility that will enable improvement of OT cybersecurity posture by setting the OT environment’s cybersecurity objectives and outlining the principles for reducing cyber risks.
- Architecture Review
•    Topological network check
•    Network chart including explanation
•    Analyzing the current situation and present information security gaps in the topology (i.e. lack of or misplaced of control components used for control access, information leakage prevention, malwares penetration prevention, etc.)
- The OT Cybersecurity Policy will include but not be limited to all the following topics:
•    A Cyber policy that is based on extensive experience, best practices, and known OT standards
•    Short and clear objectives
•    A policy with practical tools and process description
•    Written to use as a management approval paper
•    Roles and responsibilities
•    Cybersecurity management principles
•    Principles of required controls
o    Asset Inventory & Management
o    Remote Access
o    Secure architecture, devices, and configuration
o    Monitor and detection
o    HR – awareness, hiring and termination
o    Incident Response
o    Managing changes
o    Business Continuity
o    Supply chain
o    Physical security