Cyber Security Vulnerability Assessment 2026

The Lansing Board of Water and Light (BWL) is seeking a consultant to conduct a Paper Cyber Vulnerability Assessment that meets or exceeds NERC CIP 010-4 requirements. The assessment will focus on BWL's Medium-Impact BES Cyber System, which includes 2 Control Centers and 120 Cyber Assets. The consultant will be required to perform a network discovery, logical network accessible network ports identification, vulnerability review, and wireless review. The project is expected to last approximately 136 days, with a final deliverable due on November 16, 2026. Key requirements of the project include: • Network discovery to identify all Electronic Access Points to the Electronic Security Perimeter • Logical network accessible network ports identification to verify that all enabled logical network accessible ports have an appropriate business justification • Vulnerability review of security rulesets and configurations • Wireless review to identify common types of wireless networks and review their controls • Vendor personnel with access to BWL's confidential information must pass BWL's NERC CIP Personnel Risk Assessment and complete BWL's NERC CIP Basics training module • The consultant must describe how BWL will securely transmit and receive sensitive information and how BWL's confidential information will be secured while at rest and destroyed following the conclusion of the project