CIP-005-7 and CIP-007-6 OT Firewall Infrastructure and Compliance Assessment

Lakeland Electric (LAK), a municipally owned utility serving a 256-square-mile area within Polk County, Florida, operates critical electrical infrastructure including a transmission system composed of 28 circuit miles of 230kV lines and 135 circuit miles of 69kV sub-transmission lines, with multiple synchronous ties to neighboring utilities. Central to LAK’s operations is the Energy Management System (EMS), designated as the "OT network" and classified as a single Cyber System, which supports reliable and safe service delivery. The EMS cybersecurity perimeter incorporates about 151 in-scope cyber assets, mostly with external routable connectivity, protected by a cluster of three physical firewalls managed via a virtual firewall management server. The system's impact rating includes two medium impact control centers, seven low impact BES substations, and one low impact generating unit, with no high impact facilities. This solicitation (2026-RFP-007) requests services for the assessment and compliance of LAK’s OT Firewall Infrastructure, specifically addressing CIP-005-7 and CIP-007-6 standards, underscoring LAK's commitment to robust cybersecurity and reliability. Responses were due by February 25, 2026, facilitated through the Compliance & Security office in Lakeland, Florida. The contract requires vendors and contractors to enter into indemnification agreements that emphasize defense, indemnity, and hold harmless clauses protecting the City of Lakeland from liabilities tied to vendor or consultant actions. Compliance with Florida statutes and subrogation waivers is mandated. Ethical contract compliance is further reinforced via a Human Trafficking Affidavit affirming the absence of coercive labor practices. Safety is another critical factor, with contractors subject to evaluations and annual audits covering safety programs, training, experience modification rates, and adherence to Process Safety Management standards, ensuring both cybersecurity and operational safety align with LAK’s standards and regulatory requirements.