Cybersecurity Risk Assessment Service for Supervisory Control and Data Acquisition System

The Hampton Roads Transit authority in Norfolk, Virginia requires a cybersecurity risk assessment for its custom-built, integrated supervisory control and data acquisition system. This system operates twenty-four hours a day, seven days a week to control light rail operations, including power distribution, signal operations, track and rail yard management, and train identification and location. The agency must ensure that data collected from machines, sensors, and field devices remains continuously available, accurate, consistent, complete, and free from data breaches. The selected vendor will assess the current cybersecurity monitoring tool and document both the current state and proposed changes across critical infrastructure security, data security, internet of things security, and network security. This assessment must cover specific protection domains, including connections and communication channels, traffic monitoring, firewalls, network segmentation, and device protection for laptops, phones, and servers. The scope also requires evaluating antivirus and anti-malware, firewalls, security information and event management, and endpoint detection and response systems. Only onshore United States organizations are eligible to bid on this opportunity. The agency requires all performance of the work to occur offsite. Bidders must submit all questions regarding this procurement no later than June 29, 2026, and the agency is currently seeking proposals to determine the budget.