During the acquisition planning phase, the federal agency needs to consider any federal or agency-specific policies and requirements for ECMs that introduce or increase cybersecurity vulnerabilities. If required, the acquisition planning documentation should include cybersecurity as a prospective requirement and all agency personnel (including contracting and legal) should be aware of the potential impact on schedule and cost. For UESCs, integrate the cybersecurity control requirements with the performance assurance plan and include in the task order.

During the contractor selection phase, agencies have the ability to make the contractor or utility aware of the importance of including cybersecurity control(s) in their project. Agencies can add their individual organization’s definition of cybersecurity control(s), legal and regulatory requirements, policies, standards, and expected contractor credentials to the ESPC notice of opportunity or UESC letter of interest. Contractors or utility partners need to be made aware of the agency cybersecurity control expectations and terms and conditions and be prepared if they want to pursue a particular opportunity. To get help with the contractor selection phase including drafting cybersecurity control expectations, agencies should contact their FPE or project facilitator.

FEMP recommends agencies include their cybersecurity control(s) requirements during project development, specifically during the investment-grade audit (IGA) phase and set a trigger point in the development that the requirement must be put in writing and submitted for review. Agencies can require a draft cybersecurity control plan, agreed upon by the site/facility and their cybersecurity subject matter expert, to be submitted prior to the final IGA. The contractor or utility partner will need to produce the valid credentials for those who will conduct the assessment during the IGA. Cybersecurity language should be considered as a part of the Task Order.

The agency will need to identify early in project development, about the time that the ECMs are finalized, what part the site/facility will inspect and validate, who will be appointed to conduct the government witnessing and what the timeframe will be for the appointed agency person to submit their report.

Cybersecurity controls should be considered as a topic of discussion in the post-award review meeting. Examples of topics to address include the approach for the implementation of cybersecurity control processes in the implementation of the ECMs, plans for government witnessing, and authority and credentials of cybersecurity personnel.

Cybersecurity is a continuous process. During the performance period, agencies should ensure there are no infringements or compromises of cybersecurity controls put in place. FEMP recommends agencies summarize any key parameters in the contract management plan. The contract management plan should include the process to ensure that performance of cybersecurity is being delivered.