Alaska Railroad seeks outside IT help, including industrial control system security

The Alaska Railroad is looking for outside firms it can call on for technology work, including cybersecurity that could range from penetration testing to operational technology and industrial control systems, according to a request for proposals published Oct. 30.

Operational technology and industrial control systems are the computers and controls that run physical equipment, as opposed to office networks. The railroad's request lists "transportation-system cybersecurity" alongside them.

The security work could also include security monitoring, incident response, forensics and malware analysis, controlling who can access which systems, and security awareness training and tabletop exercises. The sample roles the railroad lists range from security analysts and incident responders to an operational technology security specialist.

Cybersecurity is one of eight technology areas in the request. The others cover application development, data and analytics, service desk and end-user support, servers and cloud infrastructure, technology project management, Salesforce administration and IBM i, an IBM operating system the railroad runs.

The railroad says outside firms would supplement its own technology staff, not replace them, through consulting, project work and filling in temporarily for employees. The work could be done at railroad facilities or remotely within the United States. Using workers outside the country would take the railroad's written approval for each assignment.

Each of the eight areas will be awarded separately, and the railroad may hire more than one firm per area. Contracts would run two years, with up to three one-year renewals, but guarantee no minimum amount of work. Alaska businesses that qualify get a 5% price break when bids are scored.

Proposals are due at 3 pm Dec. 9 and must be physically delivered to the railroad's Anchorage offices. Email and other electronic submissions won't be accepted.