The Nuclear Regulatory Commission is planning to award a sole-source contract for evaluating and training its cybersecurity staff, however the commission is giving other prospective vendors a chance to show they can meet the requirements.
The NRC posted a notice on FedBizOps stating that contract officers intend to make a sole-source award to iSIGHT Partners in the coming months.
Notice: Cybersecurity Incident Response Assessment and Analysis
According to the notice, “The objective of this contract/order is to identify the organization’s threat profile, highlight the threat sources actively targeting the NRC assets and associated tactical and strategic implications.”
Under the contract, iSIGHT — or another qualified vendor — would create a “standalone threat space for live exercises,” in which to monitor how the commission’s NRC’s cybersecurity team reacts to incoming threats. This space will be used both for evaluating the team’s current capabilities, as well as training NRC staff on emerging threats and the best practices for dealing with them.
“Based on NRC’s market research, iSIGHT Partners is the only known source that can provide the following capabilities to meet the agency’s requirements,” according to the notice, though that might change depending on responses to the post.
Specifically, NRC is looking for vendors to develop “real-world live-fire exercises” that meet three goals:
- Identify existing process, procedure and structure; plan for on-site engagement; and identify NRC responsibilities for enabling exercise success.
- Conduct a scenario selection and description meeting to inform NRC management and dedicated NRC observers of the details of how the engagement will proceed from an environmental (operating systems; servers, workstations and applications), techniques, tactics and procedures standpoint.
- Provide an on-site standalone virtual environment or “cyber range” and “cyber threat scenario engagement” consisting of a simulated Internet and network environment in which an assessment and analysis are conducted.
The proposed contract will have a one-year base period starting in November 2017, with four one-year option periods.
Submissions are due by 9 a.m. May 12.
