Refinement of Cyber security Procurement Languages for Energy Delivery Systems

Since the launch of the Energy Cyber Security Programme in 2013 the Department of Business, Energy and Industrial Strategy (BEIS) Energy Cyber Security Team and the National Cyber Security Centre (NCSC) have focused efforts on collaboration with operators of Critical National Infrastructure (CNI) to ensure that they have appropriate technical advice and guidance to manage the cyber risks that they are exposed to.

The programme has identified the need to address vulnerabilities across the supply chain, specifically the products, vendors and integrators of operational technology and network and information systems that underpin the operation of energy delivery systems.

There is currently no UK-centric procurement language/reference document available that is structured in a format that can be easily used when procuring a single asset type (e.g. RTU, relay), a full control system or support infrastructure (e.g. entire substation, HVDC system, communications services). Demand for this work has long been recognised by industry but to date no agreement has been reached across companies on an effective approach.

BEIS therefore wishes to appoint a supplier to develop Cybersecurity Procurement Language for Energy Delivery Systems

The supplier will develop industry endorsed cybersecurity procurement language to help bridge the gap between the detailed technical guidance and the high level principles that are currently available. The supplier will produce principles-based procurement language that can be used in contracts to improve cyber security of the product or service. It should address the key asset areas procured by energy network operators (primarily gas and electricity) and should be understandable by non-cyber security experts.

BEIS is working with the Energy Networks Association (ENA) Cyber Security Group to deliver this work. It is expected that the supplier will work collaboratively with the operators that make up this group and stakeholders across the supply chain. The supplier will lead industry workshops and review internal/external standards or guidance available to develop useful, comprehensive procurement language. Though the work should focus primarily on the gas and electricity sectors, the supplier will also be required to consider and demonstrate how the learnings and outcomes can also be applied to other energy sectors.