The Michigan Public Service Commission (MPSC) is seeking a contractor to review and update the physical and cybersecurity elements of the Michigan Energy Security Plan (MESP) and identify security-related actions to develop staff capacity and improve the plan. The project aims to enhance the MPSC's understanding, processes, plans, and overall security posture with respect to energy sector risks, with a primary focus on cybersecurity domains.
The contract will involve six primary tasks: (1) Review the existing MESP and deliver written feedback on enhancing security components consistent with federal energy assurance guidance, NARUC cybersecurity guidance, Michigan cybersecurity strategy, and relevant literature; (2) Review existing MPSC security rules (proposed Rule 506 and existing Rule 205 for electric service, Rules 24 and 45 for gas service) and provide written recommendations for improvements; (3) Participate in up to six individual utility meetings (estimated two per month, maximum two hours each, conducted virtually) to discuss security practices, observe MPSC staff interactions, identify security gaps, share expertise, and provide written follow-up memoranda within ten days identifying strengths, weaknesses, and recommendations; (4) Provide three virtual security training sessions (maximum 60 minutes each) to MPSC staff on topics such as information technology security, operational technology security, utility security regulation, security standards, and related areas; (5) Lead approximately ten bi-weekly status update meetings (maximum 60 minutes each) via Microsoft Teams, coordinate agendas, provide post-meeting notes, and discuss action items; (6) Lead one presentation meeting (maximum two hours) to MPSC leadership summarizing project activities and findings via Microsoft Teams.
Key dates include: Issue Date December 12, 2022; Inquiries Due December 22, 2022 (12:00 PM noon); Inquiries Response Posted December 29, 2022; Proposals Due January 12, 2023 (3:00 PM); Anticipated Start Date February 1, 2023. The grant period runs from February 1, 2023 through May 31, 2023. The total project budget is $75,000.00, with progress payments up to 85% of the authorized budget available upon submission of expenditure documentation and project completion verification. Final payment of 15% is due upon project completion and approval of the final report.
Applicants must meet specific eligibility requirements including experience with electric and natural gas utility information technology and operational technology systems; familiarity with energy sector physical and cybersecurity practices and guidance including NERC-CIP, ES-C2M2, API Standard 1164, NIST CSF, and TSA Security Directives; knowledge of the regulatory environment for utility security including roles of state public utility commissions, NERC, and TSA; and exposure to state energy security planning guidance including U.S. DOE's State Energy Security Plan Guidance and NASEO's State Energy Assurance Guidelines.