The subject of the order is the supply of equipment, devices, licenses and elements of technical infrastructure necessary for the launch, maintenance and operation of cybersecurity solutions implemented within the project “Cybersecure Waterworks”. The delivered devices and licenses must serve to increase the level of cybersecurity of the Contracting Authority's water infrastructure, in particular the environment related to the operation of the treatment plant, water treatment stations, communication with water facilities, IT/OT/ICS/SCADA/PLC systems and processes ensuring the continuity of water supply. The order includes the supply, installation, basic configuration, commissioning, documentation and handover for operation of the equipment and licenses described in this OPZ. 2. Purpose of the order The purpose of the order is to provide the technical infrastructure necessary for: 1. securing the network edge and communication with water facilities; 2. implementing segmentation or preparing the environment for segmentation; 3. providing server infrastructure for security systems; 4. providing disk space and backup repository; 5. enabling automatic backup execution; 6. ensuring power supply continuity for key devices; 7. organizing the infrastructure in the RACK cabinet; 8. delivering transfer stations used in water-and-sewage processes; 9. delivering 7 endpoint protection licenses with ransomware protection and sandboxing; 10. delivering software and licenses for the server; 11. providing backup software with cloud storage; 12. ensuring conditions for the implementation of a monitoring system, SIEM and hardening. 3. Nature of the order The order is of a supply nature with elements of installation, basic configuration, commissioning and documentation. The delivered equipment must be brand new, complete, free from physical and legal defects, licensed correctly, and permitted for trade in the Polish or European market. The Contracting Authority does not allow used, refurbished, ex-display, post-lease or equipment from unauthorized distribution channels. 4. Information about the Contracting Authority's environment Information about the Contracting Authority's environment is provided to enable Contractors to correctly select equipment, licenses and accessories. The Contracting Authority does not provide passwords, access data, detailed addressing, detailed security rules, information about uneliminated vulnerabilities or other information whose disclosure could increase cybersecurity risk in the OPZ. 4.1. General information 1. The locations covered by the project include water facilities, including treatment plants and water treatment stations. 2. The water infrastructure operates in separate networks from the office. 3. PLC systems related to water and sewage are present in the Contracting Authority's environment. 4. The Contracting Authority has PLC controllers coupled with HMI operator panels. 5. The PLC controller is used for communication with devices equipped with local control systems, controlling the operation of the treatment plant, collecting data from measuring sensors, archiving and visualizing data. 6. The Contracting Authority does not currently have network documentation or a logical diagram that can be made available to the Contractor at the stage of the proceedings. 7. The Contracting Authority anticipates the possibility of providing selected technical documentation of the treatment plant systems after signing a confidentiality agreement or after concluding the contract. 4.2. Information on networks and devices 1. The Contracting Authority does not currently use VLANs or network segmentation. 2. There is no network segmentation in the water and sewage facilities. 3. Devices do not support SNMP, Syslog, API or other integration mechanisms. 4. The Contracting Authority has current configurations of network devices. 4.3. Information on servers and systems 1. The Contracting Authority currently has 1 physical server; as part of the project, 1 additional physical server is planned for cybersecurity solutions. 2. Currently, the Contracting Authority does not have virtual servers covered by the project. 3. Currently, the Contracting Authority does not have an implemented virtualization platform. 4. The implementation of a Hyper-V environment or equivalent is planned. 5. Currently used operating systems are Windows and DSM. 6. Windows Server and Linux systems are planned for use. 7. The Contracting Authority currently has Active Directory. 8. The Contracting Authority does not currently use MFA. 9. The Contracting Authority does not currently use central system update mechanisms. 5. Scope of the order The order includes the following modules: Module B1 – UTM/NGFW/firewall device with licenses; Module B2 – one physical server; Module B3 – NAS / backup repository; Module B4 – UPS with 4 batteries; Module B5 – RACK cabinet and accessories; Module B6 – 5 transfer stations (laptops); Module B7 – 7 endpoint protection licenses with ransomware protection and sandboxing; Module B8 – software and licenses for the server; Module B9 – backup software with cloud storage. The Contracting Authority allows for the possibility of pricing individual modules separately, with each module including all elements necessary for its proper delivery, installation, basic configuration, commissioning and acceptance. 6. Common requirements for all modules The Contractor, within the scope of the modules implemented, is obliged to: 1. deliver brand new equipment; 2. deliver equipment from the manufacturer's official distribution channel; 3. deliver complete equipment ready for operation after installation; 4. deliver legal and defect-free licenses; 5. deliver all mounting elements, cables, power supplies, media, licenses, accessories and elements necessary for the proper commissioning of the delivered devices; 6. install, perform basic configuration and commission the devices, if applicable to the module; 7. perform tests of the delivered equipment's functionality; 8. provide technical documentation...
