SCADA and IT Network Cybersecurity Assessment and Improvement Services

Release and advertisement of RFP: April 6th, 2026

Mandatory Pre-Bid Meeting: April 24th, 2026 at 1:00 P.M. CDT

Proposal submission deadline: May 12th, 2026 at 12:00 P.M. CDT

The government authority in Missouri is seeking a vendor to provide comprehensive cybersecurity assessment and improvement services for its SCADA and IT networks. The selected vendor will be responsible for assessing and recommending secure management practices for non-SCADA devices on the OT network, including desktops, laptops, engineering workstations, and vendor devices. Recommendations should address secure remote management, access controls, multi-factor authentication, jump hosts, and logging to bolster security.

The scope includes implementing or recommending a passive, OT-safe asset discovery approach to identify all connected devices—such as PLCs, HMIs, RTUs, historians, servers, and networking hardware—and establishing strategies for continuous asset visibility. The vendor must also perform a thorough operational and cybersecurity risk assessment, identifying risks including single points of failure, legacy system vulnerabilities, remote access threats, supply chain/vendor exposures, and ransomware susceptibility.

Evaluation of current backup and configuration management practices for SCADA assets is required, with recommendations for secure, segmented, and immutable backups where possible. The project further entails creating comprehensive, auditor-ready network documentation, featuring logical and physical diagrams of network connections—including interfaces between IT, OT, field devices, remote sites, lift stations, wells, and treatment facilities—and full documentation of data flows, trust boundaries, firewall rules, remote access, and third-party connections. The contract will be for a one-year period, and a mandatory pre-bid meeting is scheduled for April 24, 2026.