NASEO seeks a Subcontractor to research, draft, revise, finalize, and publish cybersecurity tools and resources for State Energy Offices and Public Utility Commissions. This project, implemented in partnership with NARUC and supported by the U.S. Department of Energy Solar Energy Technologies Office (SETO), aims to mitigate cybersecurity risks in solar energy developments and identify model solar-cybersecurity programs for states.
The Subcontractor will develop comprehensive tools across three phases: Phase 1 focuses on educational materials including a Standards Quick Guide covering IEEE, UL, and ISA/IEC standards; an Engineering and System Overview schematic identifying physical and cyber components of PV systems and vulnerability points; and a Risk Ownership Framework for assessing cybersecurity risk allocation. Phase 2 includes Consequence Forecasting guidance presenting risk scenarios based on installed solar generation levels and ownership structures, analyzing potential consequences of inadequate cyber provisions for different stakeholders. Phase 3 delivers Decision Support and Assessment Tools including a PV criticality checklist, solar cybersecurity requirements cost-benefit analysis guidance, and information on Qualified Components Lists.
All deliverables must be written for non-technical audiences in governors' offices, Public Utility Commissions, and State Energy Offices, with digital and physical/printed formats and appropriate graphics and visuals. The Subcontractor shall not have rights to reproduce or publish the developed material without NASEO's express written permission. Project management includes bi-weekly calls with NASEO and NARUC and periodic calls with the CATSS Advisory Group.
Key milestone dates include Kickoff Meeting on December 1, 2021; Standards Quick Guide due February 15, 2022; Engineering and System Overview due March 21, 2022; Risk Ownership Framework due May 31, 2022; Consequence Forecasting Guidance due July 29, 2022; and Decision Support and Assessment Tools due August 31, 2022. Three weeks should be built into the schedule for internal and external reviews and revisions, with DOE final document review potentially requiring up to four weeks. The project period runs from December 1, 2021, to August 31, 2022.