Cyber Security Support Services

Location

85 Ormeau Road

Description

Moyle Interconnector Limited ("Moyle") currently contracts with Siemens Energy Limited ("Siemens") to provide Long Term Maintenance Agreement ("LTMA") services for their two convertor station sites in Northern Ireland and Scotland, which were originally designed, constructed and commissioned by Siemens The Cyber Security Support Services ("CSSS") are required to enhance the cyber security of the Moyle control system. The control system directly operates the converter valves and associated equipment and is therefore critical to the safe and reliable operation of the interconnector. The CSSS will provide enhanced cyber security protections to reduce the likelihood and potential impact of cyber security incidents affecting the control system. The services will also support Moyle in fulfilling its obligations as an Operator of Essential Services under the NIS Regulations. It is proposed to extend the scope of services provided under the existing LTMA contract to include the CSSS and the justification for this is outlined in the sections below.

Total Quantity or Scope

The provision of these services will require an amendment to the current LTMA to incorporate the CSSS. This will amend the scope of the LTMA, but not the term which is coterminous with the life of the control system assets. The nature of the services that are required to be procured directly from Siemens Energy are defined in the amended agreement as 'Regular Services': The Regular Services include: • Vulnerability management for IT; • Security patch management for IT; • User management; • Disaster recovery; • Licence management; • Obsolescence management. Moyle considers that the amendment to the current contract benefits from the exemption outlined in Regulation 88(1)(b) of the Utilities Contracts Regulations. This exemption allows for the non-competitive procurement of additional services that have become necessary, where a change of contractor cannot be made for economic or technical reasons and where such a change would cause significant inconvenience or duplication of costs.

Award Detail

CPV Codes

• 72000000 - IT services: consulting, software development, Internet and support

Indicators

Legal Justification

Award of a contract without prior publication of a call for competition in the cases listed below The procurement falls outside the scope of application of the regulations. Explanation: Moyle considers that the variation benefits from the exemption in Reg. 88(1)(b) UCR, for the reasons outlined below. We wish to engage Siemens for the services outlined because there is a requirement to have a single point of informed contact for any cyber issues. The Interconnector was designed and constructed by Siemens in 2001; the control system was subsequently refurbished by Siemens in 2022. The interconnector is a complex asset, with many interrelated electrical, mechanical, electronic and software components and systems. Third parties may not understand the risk to the converter station primary equipment; Siemens do understand all potential interactions and so are better placed to assess the impact of any cyber attack or threat. The control system integrates directly to the converter station valves and associated equipment. The system comprises a Human-Machine Interface, and programmable logic controllers. These are supported by a sophisticated internal communications infrastructure. The primary (high voltage) equipment is bespoke to Siemens, and uses proprietary light triggered thyristors; the control system (actually a system of systems) is designed to safely and seamlessly integrate with, and operate, this primary equipment. Both the primary equipment and control system contain Siemens intellectual property. This is not a standard IT based infrastructure; the HVDC control engineering and software is intrinsically embedded within the control system itself. Given the complexity involved and the overall design, it would be impracticable for a third party to understand the implications of either cyber protection or risk. Any cyber issue (threat, asset failure or other) could impact the primary operation of the interconnector. In the event of a cyberattack, only Siemens have the end-to-end knowledge to assess and address any such issue and can understand the full impact on the asset. Similarly, where cyber mitigations are identified, only Siemens can confirm that these mitigations can be successfully applied without causing undue effects. Given our primary focus on safe and reliable operation, having a third party in that loop would bring, at best, inefficiency in addressing any issue; at worst, plant would potentially be at risk. For this reason, it was determined that sourcing these cyber services from Siemens would offer the most technically secure solution. Given Moyle's status as Critical National Infrastructure, and the fact that availability of the entire system is fundamental to ensuring the physical and commercial benefits to the Transmission System Operators on either end of the link, these factors outweigh any potential commercial benefit in tendering these services on the open market.