Request for Information - Energy Industrial Control Systems for Approved Products List

REQUEST FOR INFORMATION Energy Approved Products List for Energy Systems USACE-HNC Energy Information Management Program (EIM) 4820 University Square Huntsville, AL 35816 6 May 2016 (Revised 19 May 2016) This is a Request for Information (RFI) addressed to all manufacturers and distributors of energy products and solutions. The purpose of this RFI is to broaden industry participation and gather information which will enable Energy Information Management and Industrial Control Systems (ICS) compliance with cybersecurity requirements. The applicable NAICS code is 541330 -Engineering Services (Energy), the NAICS control series 334512, 334513, 334514, 334515, 334516, and related NAICS that involve the use of ICS. Interested parties should submit their responses in accordance with "Instructions for Responders" shown below. The U.S. Army Corps of Engineers, Huntsville Center (HNC) Energy Division has a mission to provide Army property owners with ways to reduce energy consumption and to increase energy independence, while using products that are compliant with Army policies for cyber-security. The Energy Information Management (EIM) Program is leading an initiative to standardize ICS to be used on all energy project types, to enhance mission accomplishment and effectiveness, system interoperability, and to ensure compliance with Federal, Department of Defense (DoD) and Army cybersecurity initiatives. An Energy-Approved Products List (E-APL) is the anticipated outcome of excellent collaboration between industry and Government. The E-APL is expected to be extensive as necessary, to account for the variety of energy platforms using ICS, as well as to the availability of those systems identified by industry in response to the RFI. The E-APL will be continuously revised as newer systems replace older systems, enabling the Army to execute its mission using secure ICS, while also providing a reliable inventory to meet Army and National Institute of Standards and Technology (NIST) standards. The E-APL is being formulated to be similar in nature, execution, and intent to the existing Defense Information Systems Agency (DISA) Unified Capabilities Approved Products List (UC APL) which is explained in further detail here: http://disa.mil/network-services/ucco. Government computer networks and systems are under incessant cyber-attack, and robust steps are underway to implement trustworthy cybersecurity practices. Recognizing the increased threats, vulnerabilities, and risks the Department of Defense (DOD) recently updated the DOD (DoDI) 8500.01, Cybersecurity on March 14, 2014, and the DoDI 8510.01, Risk Management Framework (RMF) on March 12, 2014. These instructions mandate that Industrial Control Systems (ICS) be made secure against cyber-attacks by implementing an RMF compliance requirement for all systems which may connect to the DoD network or process DoD data. This process is generally referred to as "Assessment and Authorization" (A&A) for Systems and Platform Information Technology Systems, and "Assess-Only" for Platform Information Technology and software. The links below explain the RMF process used by the Army, which contractors would use to accredit their systems: https://rmfks.osd.mil/rmf/RMFImplementation/Pages/default.aspx (Requires Common Access Card (CAC) and registration for first time users http://csrc.nist.gov/groups/SMA/fisma/framework.html (non-CAC accessible) Provisions and clauses which are likely to apply in potential acquisitions which incorporate cybersecurity for ICS are below. Clauses are subject to revision and are not all-inclusive; however, they are a good indication of the risk management goals being sought through Government contractual terms and conditions. Full text versions can be found at: http://farsite.hill.af.mil/ DFARS Provision 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls DFARS Provision 252.225-7000, Buy American--Balance Of Payments Program Certificate FAR Clause 252.204-7009, Limitations on the Use and Disclosure of Third-Party Contractor Reported Cyber Incident Information FAR Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting FAR Clause 252.225-7001, Buy American and Balance of Payments Program FAR Clause 252.225-7017, Photovoltaic Devices FAR Clause 252.239-7000, Protection against Compromising Emanations FAR Clause 252.239-7001, Information Assurance Contractor Training and Certification FAR Clause 252.239-7018, Supply Chain Risk Instructions for Responders: 1. Provide your company name and address 2. Identify the POC, title, email, and phone number. 3. Indicate the company's energy sector and product(s). (note: if there is more than one, submit all product(s) the manufacturer intends to place on the E-APL.) 4. A spreadsheet format summarizing the product(s) with names, model numbers, etc. is requested. A short description of the product is acceptable in the spreadsheet. Do not send product brochures, specifications, or catalogs at this time. 5. Provide your RFI response to the below email or physical address by 5:00 P.M. Central Time on Friday, 3 June 2016. 6. Submit ONE electronic version of your RFI response to the Government Point-of-Contact (POC) shown below, no later than the due date. Only Microsoft Excel Spreadsheet format or comma/tab delimited text (dot CSV) format will be accepted. 7. Questions regarding this RFI should be sent by email to: contact@example.gov Government POC: Ms. Teresa Whalen Project Manager Huntsville Center Energy Division U.S. Army Corps of Engineers Office: +1 (555) 000-0000 E-mail: contact@example.gov Attachments: None *** This is not a Request for Quote or a Request for Proposal. There is no commitment by the Government to issue an RFQ or make an award. *** The U.S. Army Corps of Engineers will not pay for information received in response to this RFI. Responders are solely responsible for all expenses associated with responses. *** RFI responses will not be returned.