UK SBS - PS21262 - Provision of Services to Review the Smart Energy Metering Device Cyber Security Assurance

***** THIS IS AN AWARD NOTICE, NOT A CALL FOR COMPETITION *****

This procurement is being concluded following a mini competition under the CCS RM3764.3 Cyber Security Services 3 Framework.

Brief Description of Requirement:

To summarise, we require specialist cyber security, business analysis, stakeholder engagement and device assurance scheme design capabilities to:

• Review current device assurance arrangement for Smart Metering. The review should include:

- Detailed engagement with BEIS, SSC and NCSC to capture key stakeholder views on the current scheme, what is working well and how it can be improved. We would expect the work to identify the key strategic drivers, priorities and challenges of the scheme.

- An assessment of the efficacy of the current approach in supporting the wider requirements, and continued evolution, of the smart meter security architecture. A particular focus of this element of the work will be managing change (both in terms of new operational requirements and evolving security requirements that impact device assurance).

- Review and analyse feedback received as part of the recent SSC survey (which will be provided to the successful contractor).

- Review other relevant assurance (both national and international) schemes to assess if lessons can be learned This aspect of the work should also include an assessment of the applicability of the NCSC's Principles Based Assurance approach.

- Review of the current governance approach for device assurance within the wider context of its role in supporting the Smart Metering ecosystem, including risk-based decision making, assurance maintenance, re-certification of devices and the operational aspects of the scheme.

• Produce a final report for NCSC, BEIS and SSC, summarising how the current scheme is supporting the requirements of smart metering, its ability to accommodate changes to the scheme and setting out actionable recommendations for improvement

and evolution.

• Present findings in a summarised version at various stakeholder meetings