NDA Cyber Range Proof of Concept

Tender description

Why the Work is Being Done The NDA is 3 years into a Cyber Security and Resilience Programme, which is implementing change across all of its 8 businesses. A key component of CSRP is the establishment of a Cyber Security Centre of Excellence (CSCoE), which will: • Support security operations capability across the NDA businesses through the provision of a system emulation / digital twinning capability, • Conduct assurance and vulnerability evaluations on Information Technology (IT) and Operational Technology (OT) systems through analysis of virtualised and physically connected systems, • Host business, enterprise and sector cyber exercises, • Act as the focal point for academic research and information sharing. Problem to Be Solved The longer term requirements of the CSCoE cannot be adequately developed without capability demonstration and user interaction. Therefore, CSRP requires a cyber range capability that can enable each of the roles of the CSCoE to be demonstrated through emulation of multiple NDA topologies containing IT and OT components. The cyber range needs to be able to operate within the information and physical security requirements of the NDA (which includes options for locating the cyber range on NDA premises). Who Are the Users The lead for this work within the NDA is the CSRP Programme Manager. The delivery manager and person responsible for tasking of the cyber range is the Cyber Range Project Manager. The delivery manager is also responsible for capturing outputs and translating them into a longer-term requirement set. In order to develop the requirements, the delivery manager needs to run demonstrations, exercises and system trials with various NDA stakeholders (CISOs and security staff) to prove the concept of a reconfigurable cyber range, demonstrate its value, capture its CONOPS and collect evidence to underpin a business case. Early Market Engagement Work Already Done The NDA has previously employed skilled resource to develop a cyber range, located at the Energus site in Warrington. It has been configured to be representative of an NDA network, but is not rapidly reconfigurable. This range has been used to derisk CSCoE work and in particular has been used as part of a national level exercise (in conjunction with BEIS). The hardware is available for use in this project if necessary. The Energus site is the preferred site for the Cyber Range associated with this contract. Existing Team The supplier will work as part of the CSRP team, which is made up of a combination of NDA staff, contractors and other suppliers that are responsible for CSRP related services (such as Incident Response, Threat Intelligence and Assurance/Testing). The supplier may encounter other suppliers as they engage with NDA businesses, who have their own support teams and security services in place. Current Phase Discovery Work Location Whitehaven, Cumbria and Workington, Cumbria. Some meetings may take place at NDA sites including Warrington, Cheshire Working Arrangments Whilst Covid restrictions limit contact in the near term (allowing the supplier to work remotely during early phases), the intent is for the cyber range to be located in Workington from January 2021 at the latest and for remote access/interaction to take place with stakeholders that cannot attend the Workington site. The supplier PM and key personnel will be expected to be routinely available with daily stand-ups by conference call. Online communication is inevitable given the geographic spread of NDA sites Security Clearance SC minimum (or equivalent) and personnel may need to go through NDA clearance checks Additional T&Cs Skills & Experience Technical capability to replicate/emulate mixed IT and OT topologies in a virtualised cyber range environment Technical capability to run traffic simulation based scenarios for cyber attack/vulnerability analysis (based on MITRE ATT@CK framework) Technical capability to create libraries of relevant configurations and scenarios for rapid re-configuration and running of simulation events Functionality that limits the specialist skills requirements of cyber range users Knowledge and experience of the deployment and employment of security controls and security management tools Ability to design, prepare and deliver trials, demonstrations and exercises on a cyber range Ability to identify, communicate and rapidly collate information for use on the cyber range Nice to Haves Experience in NDA/ONR environment Predefined library of relevant range components, attack scripts, security controls and configurations Library of relevant exercises and mission rehearsal events Ability to conduct multi-site (remote access) exercises and analyses No. of Suppliers to Evaluate 5 Proposal Criteria Ability to meet timeframe Maturity and suitability of technical solution Experience in relation to IT/OT topologies Examples of similar, successful projects Approach to project and task management Value for money (including transparency of costs) Cultural Fit Criteria Ability to work as part of CSRP team Agility in approach and management of tasks Focus on the outcome of the work, not the specifics of their technical capability Willingness to share wider knowledge and experience of supplier Willingness to take risk and responsibility Payment Approach Capped time and materials Assessment Method Case study Presentation Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers No questions have been answered yet Budget range