Design & Build: Industrial Control System (ICS) Network
Published
Description
Wales & West Utilities (WWU) is embarking upon a significant programme of work to re-architect its industrial control system (ICS) networks to meet recognised best-practice architectures to ensure a secure and resilient industrial network now and for the future. WWU is seeking to partner with an organisation who can work with us on this endeavour and is interested in hearing from companies with expertise in architecting secure operational technology (OT) environments in Microsoft Azure. This is a design and build tender, and the successful supplier will work with us on all aspects and phases of this programme, from design, through to proof of concept and testing and production deployment. You will be required to - • Design, document and deploy new Azure networks • Consult, advise and design OT architecture and governance processes • Design a layered network at Purdue layers 3 and 3.5 • Align the architecture closely to SANS ICS reference architecture • Produce high quality architectural design documentation, to include diagrams produced in a recognised diagramming language such as UML In order to be considered for this contract, you must meet the following requirements - • You must be NCSC CAF assured • You must have previous experience in designing OT/ICS architectures and the Purdue reference architecture. • You must have prior experience of designing in Microsoft Azure environments • Companies with this experience of undertaking similar projects in the CNI sector are of particular interest. Please note: this tender does not include a discovery phase. WWU would like to invite expressions of interest (EOI) based on the information specified and for interested suppliers to submit their EOI to rebecca.crisp@wwutilities.co.uk via email. They will then be invited to the PQQ which will go live on 2nd January. Lot 1: WWU is embarking upon a significant programme of work (called the 'Galileo Programme') to re-architect its industrial control system (ICS) networks to (a) meet recognised best-practice architectures to ensure a secure and resilient industrial network now and for the future, and (b) to take advantage of cost-effective security and resilience opportunities afforded by the cloud which exceed the possibilities afforded by the current on-premise model. The Galileo Programme is a significant, high-risk and multi-year programme of work composed of several different phases and projects. WWU is seeking to partner with an organisation that can work closely with us on all aspects and phases of this programme, seeing it through from initial proof of concept implementations through to testing and eventual production deployment. At the core of the programme will be the design and build of a new ICS network, including an industrial demilitarized zone (DMZ), to be hosted in Microsoft Azure. The new Azure estate will host assets at Purdue layers 3 and 3.5 and will be required to communicate securely with lower and higher layers of the WWU industrial technology stack, which are hosted outside of Azure, as well as external hosts on untrusted networks. The project will therefore include all aspects of Azure network architecture design and implementation, including deployment of SaaS, PaaS and IaaS components as required, and will also define and implement the security policy and governance standards that will apply to the network. However, the programme also encompasses aspects that go beyond the creation of the Azure environment. For example, there is a requirement to bring unmanaged and unsupported ICS devices under proper governance and control, ensuring full lifecycle management, patching and support. Alongside this, a new solution for effective identity and access management for colleagues working in the ICS space will be required. The pros and cons of secure remote access to remote facilities will need to be considered and a secure solution implemented if WWU agrees there are security benefits to be gained. Finally, existing redundant general packet radio service (GPRS) and satellite communication (SATCOM) conduits will also need to be taken into account and factored appropriately into the new architecture design. Objectives 1. To create an architectural design that aligns closely to the SANS ICS Reference Architecture , and which will meet WWU's business requirements for the security, safety, resilience and availability of its gas supply service. 2. To implement this design in the Microsoft Azure cloud, initially as a proof-of-concept environment, and then later developing this into formal development, test and production environments. 3. To design and establish secure network links to relevant WWU assets at layers 2 and 4, including via the use of secure 'push-pull' intermediary hosts in the DMZ. 4. To design and establish secure data exchange solutions with hosts residing in untrusted partner networks 5. To utilize Active Directory or Azure Active Directory as the identity provider for the new network and to establish effective identity and access management architectures, standards and practices for industrial colleagues. 6. To ensure all NIS-scope assets at layers 3 and 3.5 are accounted for and are securely managed throughout their operational lifecycle. 7. To establish and enforce strong security policies in the industrial network and DMZ and to establish and document secure governance practices for the new network. 8. To exploit all available Azure security tooling to the fullest extent. Requirements (i) Partner Requirements Potential partners wishing to tender for this project must be able to demonstrate expertise in Microsoft Azure network design and deployment and strong familiarity and experience with the entirety of the Azure security stack. Additionally, prospective partners must be able to demonstrate expertise in ICS/OT security and the Purdue reference architecture. Preference will be given to companies who can demonstrate previous similar work with CNI customers including successful implementations of ICS networks in Azure, and the integration of those networks with higher and lower layers of the Purdue stack. (ii) Programme Requirements 1. The partner will, having regard to WWU's core requirements for security, high availability, disaster recover, scalability, resilience and cost-effectiveness, work with the WWU Cyber Resilience team and its partners as required to design, document and deploy new Azure networks to include a new ICS layer 3 network and industrial DMZ between the ICS network and the on-prem corporate network. 2. WWU envisages that the programme will logically consist of several different phases, commencing with, design and implementation of a PoC network. Thereafter, formal testing and production deployment phases will follow. The partner will be required to work flexibly and closely with WWU and its partners throughout all of these phases, adopting agile approaches where required, and recognising that it will not necessarily be possible to fully define all requirements in advance of a phase commencing. • With respect to the new Azure environments, the partner will be required to consult, advise and design architectures and governance processes for the secure and effective use of: o Azure regions, availability zones and availability sets o Azure subscription and resource group architecture o Network design to include appropriate VNet and subnet architecture o Azure dedicated hosts o Network and application security groups o SaaS/PaaS/IaaS and serverless execution o Identity and Access Management, to include user provisioning, lifecycle management, Azure Active Directory/Active Directory usage and structure, multi-factor authentication, authorisation and conditional access o Azure managed identities o Logging, monitoring, auditing and incident response including Sentinel integration o Azure security components including Key Vault, Azure Firewall and Azure Web Application Firewall o Load balancing o Infrastructure as code & versioning, ARM templates, Terraform, Blueprints o Azure virtual desktops o ExpressRoute for external connectivity o Microsoft Defender for Cloud o Other Azure capabilities as deemed appropriate by the partner and/or WWU 4. Having regard to best-practice architecture patterns for industrial control systems, the partner will be required to work with WWU to design a layered network at Purdue layers 3 and 3.5 with appropriate vertical and horizontal segregation and major and minor enforcement boundaries as required. WWU requires the architecture to align closely to the SANS ICS reference architecture, which itself is based on the Purdue model and the requirements of ISA/IEC 62443. Key areas for architectural consideration and design will include but not necessarily be limited to: o Defensibility and resilience o Simple recovery o Attack surface minimization o Utilisation of attack trees and attack modeling to inform architectural decisions o Defence in depth across all in-scope assets o Securing internal and external boundaries o Creation of dedicated, function-specific subnets and dedicated DMZ zones o Effective use of network security components including routers with ACLs, next-generation firewalls, data diodes, network and host intrusion detection and prevention o Effective use of application-layer firewalls for web-based assets o Identity and access management o Secure data exchange with untrusted networks such as the WWU corporate network and external partners with whom business data relating to the essential service is shared o Secure remote access o Patch management o Enablement of effective incident response via logging and monitoring 5. It will be a requirement that the partner produces high-quality architectural design documentation, to include diagrams produced in a recognised diagramming language such as UML, with sufficient accompanying narrative to make the documentation accessible to and usable by IT/OT and Security teams with no prior knowledge of the project or architecture. Nothing will be deployed without documentation and therefore the production of such documentation will be a prior or at least parallel task to the creation of new networks and resources in every case without exception. 6. Initially, the partner will use the results of the discovery phase (completed by WWU internally) to produce a documented target architecture for a PoC environment. Thereafter, and with reference to the target architecture, a PoC environment will be created that establishes a segregated ICS network and DMZ in Azure, containing a representative selection of layer 3 assets, and establishing secure links to external networks at layers 4 and 2. In this regard it is worth noting that WWU is currently building a replica gas offtake in a lab environment that can be used for L2 and below connectivity and testing. 7. Following completion of the PoC, and taking into account lessons learned, the project will then formally move into testing and finally production phases. It is not possible to be specific at this point about exactly what will be required for each of these phases and WWU therefore considers it appropriate that each major phase is planned, scoped and costed separately when requirements and timelines are clearer.
Timeline
Publish date
11 months ago
Close date
10 months ago
Buyer information
Wales & West Utilities Ltd
- Contact:
- Rebecca Crisp
- Email:
- rebecca.crisp@wwutilities.co.uk
Explore contracts and tenders relating to Wales & West Utilities Ltd
Go to buyer profileSource
"Find-a-Tender"To save this opportunity, sign up to Stotles for free.
Save in appTender tracking
Access a feed of government opportunities tailored to you, in one view. Receive email alerts and integrate with your CRM to stay up-to-date.
Proactive prospecting
Get ahead of competitors by reaching out to key decision-makers within buying organisations directly.
360° account briefings
Create in-depth briefings on buyer organisations based on their historical & upcoming procurement activity.
Collaboration tools
Streamline sales workflows with team collaboration and communication features, and integrate with your favourite sales tools.
Explore similar tenders and contracts
Browse open tenders, recent contract awards and upcoming contract expiries that match similar CPV codes.
- Openclosing
Traffic Management System & Short Straits Traffic Digital Twins
Department for Transport (DFT)Published today
- Openclosing
ID 5623007 - TEO - Equality Commission NI - IT Support to Equality House ALBs PME
CPD - Supplies and Services DivisionPublished 2 days ago
- Openclosing
ID 5424277 DoF LPS - Replacement of GNSS Network Processing Software
Department of Finance178,000 GBPPublished 2 days ago
- Openclosing
ID 5424277 DoF LPS - Replacement of GNSS Network Processing Software
CPD - Supplies and Services DivisionPublished 2 days ago
- Openclosing
London Borough of Brent on behalf of London Borough of Southwark AutoCad Licenses
London Borough of BrentPublished 2 days ago
- Openclosing
ID 5373395 Tourism Northern Ireland - Destination Management System (DMS) and Content Management System (CMS)
Tourism NI2,800,000 GBPPublished 3 days ago
- Openclosing
ID 5373395 Tourism Northern Ireland - Destination Management System (DMS) and Content Management System (CMS)
CPD - Supplies and Services DivisionPublished 3 days ago
- Openclosing
HCC - 11/24 - Pre-Procurement Market Engagement (PPME) for the Provision of an Applicant Tracking System (ATS)
Hertfordshire County CouncilPublished 3 days ago
Explore other contracts published by Wales & West Utilities Ltd
Explore more open tenders, recent contract awards and upcoming contract expiries published by Wales & West Utilities Ltd.
- Openclosing
1NextGen Electrolysis - Blending Equipment
Wales & West Utilities LtdPublished 16 days ago
- Closed
Health and Safety Risk Management
Wales & West Utilities Ltd3,000,000 GBPPublished 8 months ago
- Closed
GD3 Gas Mains Replacement and Reinstatement
Wales & West Utilities Ltd420,000,000 GBPPublished 10 months ago
- Closed
Accelerate decarbonisation and consumer vulnerability projects
Wales & West Utilities LtdPublished a year ago
- Closed
WWU1342 - Fixed Line VOIP & Redbox Replacement
Wales & West Utilities Ltd300,000 GBPPublished a year ago
- Closed
Call for projects under the Vulnerability and Carbon Monoxide Allowance (VCMA)
Wales & West Utilities Ltd12,000,000 GBPPublished a year ago
Explore more suppliers to Wales & West Utilities Ltd
Sign upExplore top buyers for public sector contracts
Discover open tenders, contract awards and upcoming contract expiries of thousands of public sector buyers below. Gain insights into their procurement activity, historical purchasing trends and more.
Explore top sources for public sector contracts
Stotles aggregates public sector contract data from every major procurement data source. We ingest this data and surface the most relevant insights for our users. Explore our list of public sector procurement data sources below.