Cyber Security Scoping Work for DECC

Cyber Security Scoping Work for DECC

Contract value: £10,000 – £50,000. The Department of Energy and Climate Change wishes to appoint a supplier to investigate current approaches which assure the cyber security of Industrial Control Systems (ICS) and other Operational Technology. 

TRN 1077/10/2015 – Cyber Security: Product Assurance Scoping Work


Contract summary


Energy and Related Services, Materials and Products, Research and Development, Other Services, Defence and security

Location of contract


Value of contract (£)

£10,000 – £50,000

Published date

15 October 2015

Closing date

13 November 2015

Contract start date

23 November 2015

Contract end date

31 March 2016


The Department of Energy and Climate Change (DECC), wishes to appoint a supplier to investigate current approaches which assure the cyber security of Industrial Control Systems (ICS) and other Operational Technology (OT), and the extent to which these systems are assured across the energy sector internationally. The aim of the DECC Cyber Security Team is to work with the energy sector to reduce the risk of attack on critical national infrastructure (CNI). Effective and reliable energy infrastructure is critical to a secure supply of energy in the UK. This infrastructure is controlled and monitored by complex networks and systems which collate, analyse and store data and enable communication. Cyber threats pose a serious and evolving challenge to the energy sector and a successful cyber-attack could have a serious impact on energy supply, adversely impacting national security, public safety and the UK economy. The Energy Emergencies Executive Committee Cyber (E3CC) subgroup conducted a high-level assessment of cyber security capability across the downstream gas and electricity sector which identified several areas for collective improvement. One such area identified common cyber products in use across the sector which control and monitor CNI, creating a potential systemic risk. Industry has requested assistance in gaining greater assurance of the cyber security of these products. DECC, wishes to appoint a supplier to investigate current approaches which assure the cyber security of ICS and other OT used across the energy sector. The supplier will undertake a review of: • OT/ICS products which are used in or relevant to the energy sector, including their function and any advertised security characteristics; • Existing security standards and certifications for OT/ICS products. This should specify: o background details of the organisation either publishing the standards or granting certification; o the criteria used to certify products; o identify relevant energy sector products which have achieved certification or been developed in accordance to security standards; • Previous security testing conducted on OT/ICS systems detailing what was tested and how; • Organisations (including academia) who are developing security standards, certification schemes, testing beds and testing criteria to assure the cyber security of OT/ICS products. Based on the data gathered, the supplier should recommend: • Security characteristics that should be tested on OT/ICS products relevant or used by the energy sector. This should detail how these can be tested; • Suitable test laboratories/ranges that could undertake testing of OT/ICS products. • A list of OT/ICS products tested and certified, including where they are used and any specific products for the energy sector.

About the buyer

Contact name

Herpreet Bhamra


Area 3C, 3 Whitehall Place





0300 068 8370


Other information



DPF33 Short Form Terms and Conditions template.doc


Product Assurance Scoping Work – ITT.docx

This work should be informed by reviewing open-source material, published guidance, standards or literature relevant to the energy sector and where possible drawing on the knowledge of subject matter experts. The indicative timetable for the project is to launch on 16th November 2015 and to run for 4-5 calendar months. If you wish to take part in this procurement please see the attached Tender documents attached to this Notice and send your completed Proposal to Herpreet Bhamra at address stipulated in the “Who to Contact” section. Any late submissions will not be considered. DECC reserves the right to halt the procurement process and to not award a contract. DECC will not be held liable for recovery of costs from unsuccessful bids if a contract is not awarded. All costs will be borne by the bidding organisations. If a contract is created it will be upon DECC Standard Terms and Conditions, which are available on Contracts Finder with this notice. Completed tender submission must be returned by post to DECC, address given at the top of this advertisement, by Friday 13th November 2015. We require 3 hard copies (one of which must be signed). Electronic versions of your bids are to be sent after the deadline to Herpreet Bhamra ( Interviews, if deemed necessary, will be held in the week commencing Monday 16th November 2015 (suppliers will be notified of this in the week commencing Monday 16th November 2015). If successful and upon contract signature, the supplier is expected to attend a kick-off meeting taking place on Monday 23rd November 2015. Project completion is required by Thursday 31st March 2016.

How to apply

Please apply directly to the buyer using the contact details provided.