NCPA RFP SCADA Replacement

REQUEST FOR PROPOSAL
for
SCADA Dispatch Control Center
RFP Issue Date: 7/31/2026
RFP Submittal Deadline: 09/18/2026
Introduction
The Northern California Power Agency (NCPA), a California Joint Action Agency, was established
in 1968 by a consortium of locally owned electric utilities to make joint investments in energy
resources that would ensure an affordable, reliable, and clean supply of electricity for
customers in its member communities. NCPA members include municipalities, a rural electric
cooperative, and other publicly owned entities for which the not-for-profit agency provides
such services as the purchase, aggregation, scheduling, and management of electrical energy.
Overview
The purpose of this Request for Proposal (RFP) is to solicit qualified vendors to provide a
modern Supervisory Control and Data Acquisition (SCADA) replacement solution for the
organization's Headquarters and Disaster Recovery Control Centers. The selected solution must
support secure, reliable, and scalable operations within the energy sector, comply with
applicable regulatory requirements, and integrate seamlessly with existing enterprise systems.
Non-Disclosure Agreement
In order to receive additional details of the existing architecture needed to prepare your
proposal, respond to this notification expressing your interest. Respondents will be sent a
nondisclosure agreement (NDA), an example of which is found in Attachment A.
Address your response to:
* SCADA RFP
* Reference RFP# IS-07-2026
* Email: SCADA.RFP@ncpa.com
* Phone: (916) 781-3636

Include:
* The legal company name and any acronym goes by
* Whether it is a sole proprietorship, partnership or corporation
* Company address
* Name & title of the singer who will be signing the NDA
* Email address of the signer
Respondents will receive the NDA filled out with the proposing company's information.
Sign and return it, NCPA will countersign and return a fully executed copy, along with
the detail sheets needed to complete your proposal.
Execution of this NDA does not obligate NCPA to disclose any confidential information
to a third-party vendor. NCPA reserves the right, at its sole discretion, to withhold such
information for any reason.
Submittals
Please submit proposals to NCPA Headquarters no later than 5:00 PM Pacific Daylight Time
on 9/18/2026. NCPA will accept proposals via email or sent as a hard copy. The proposal,
along with any questions about this RFP, should be addressed to:
SCADA RFP
651 Commerce Drive, Roseville CA 95678
SCADA.RFP@ncpa.com
Tentative Schedule
RFP Issued 7/31/2026
Deadline for Questions 08/28/2026
Proposal Due 09/18/2026
Review Responses 9/30/2026
Respondent Interviews/Demos as needed 10/01/2026
Selection of Respondents 10/31/2026
Contract Preparations November 2026
Agency approval of contracts December 2026
Work commences January 2027
RFP - NCPA SCADA Control Center Replacement
Page 2

1. Existing Environment
For an existing environment summary and breakdown an additional NDA will need to be
signed. Please contact SCADA.RFP@ncpa.com to initiate that process.
2. High Level Requirements
Vendors must complete attachment IS-SCADA-REPLACEMENT-RFP-MATRIX_07-2026.xlsx
SCADA requirements matrix and send along with the submittal.
2.1. Qualifications & Experience of Company
Give a brief company description including:
* Identify years in business.
* Number of employees in the office location which is intended to provide services.
* Relevant experience
2.2. Contract Exceptions - The Company selected will be expected to execute NCPA's
standard Agreement, a sample of which is attached for reference in Appendix A. The
proposal shall state all exceptions taken to the terms and conditions of the Agreement,
if any.
Note: Make sure to review the insurance requirements in detail. You will be asked to
provide proof of insurance and copies of all waivers and endorsements if selected.
2.3. Proposal for Scope of Work - Vendors are responsible for responding to how they will
perform services outlined in the scope of work below.
2.4. References - Vendor will provide at least two references for similar services.
2.5. Pricing - Proposal must include itemized pricing for services listed in the Scope of Work.
To control the schedule and final costs, NCPA reserves the right to adjust the proposed
deliverables and Scope of Work negotiations with the selected respondent.
2.6. Timeline
Project is expected to begin after January 2027 and is expected to be completed by
April 2028
RFP - NCPA SCADA Control Center Replacement
Page 3

Detailed Scope of Work
The following scope of work will be conducted at NCPA's physical Headquarters and Disaster
Recovery Center (DRC) location:
Headquarters Disaster Recovery Center (DRC)
651 Commerce Drive 5034 Sunrise Blvd
Roseville, CA 95678 Fair Oaks, CA 95628
The scope of work for this project includes the following key components to be successful:
* Vendor must understand the current architecture and environment and prepare a plan
for how to best transition from the old Control Center SCADA solution to the new.
* The proposed SCADA solution must continue to work within the existing network
architecture and security requirements. This includes being able to operate within a
virtualized hypervisor system, communicate through network segmentations using
firewalls, traditional IT networks, and maintain existing NERC CIP compliance for the
Control Centers.
* Vendor must propose a solution that provides both fault tolerance for both local server
failures as well as the capability to automatically resume operations at the Agency's
Disaster Recovery Center (DRC).
* Development and testing environments also must be included in the proposal, which
should include methods for testing changes and updates prior to being rolled into
production. Screen development, database changes, updates, and security patches
must be considered.
* Proposed solutions must include methods for preserving existing SCADA elements such
as migrating or recreating where needed existing set points, logic, screens, alarms and
security roles.
* Vendor will be responsible for leading the project through the proposed phases and
provide technical expertise in their solutions including design, testing, migration, and
post-production roll out. NCPA will provide subject matter experts related to the
Agency's Operations, SCADA engineering, IT systems administration, and cybersecurity
as part of this process.
* Proposals must also include support for solutions to interface with existing 3rd party
integrations that are used within the Agency. This includes historical data trending,
database archiving, and API calls between custom applications.
RFP - NCPA SCADA Control Center Replacement
Page 4

3. Technical Requirements
Vendors must complete attachment IS-SCADA-REPLACEMENT-RFP-MATRIX_07-2026.xlsx
SCADA requirements matrix and send along with the submittal.
3.1. Asset Support
The proposed solution must be able to seamlessly integrate with a variety of different
electric sector assets for control and monitoring capabilities. These include but not
limited to:
* Combustion Turbine Power Plants
* Hydro Electric Power Plants
* Geothermal Power Plants
* Renewable Energy solutions such as:
* Solar
* Wind
* Battery
* Metering
* CAISO Remote Intelligence Gateways (RIGs)
* Control Center to Control Center communications
* Electric Vehicle Charging Stations
* Building maintenance assets such as HVAC, Power Systems, UPS and other
environmentals.
* Vendor solution must support working within a virtualized environment
3.2. Network Design
* Systems must be able to operate within the following:
* Standard TCP/IP network environments
* Comply with NERC CIP networking standards including NERC-005 Electronic
Security Perimeters
* Comply with ISA-99 Industrial Automation Control System networks
* Vendors must provide documentation for all related service ports used for their
solutions, this includes but not limited TCP, UDP and ICMP protocols.
3.3. Industrial Protocol Support
The proposed SCADA solution must natively support common ICS/OT protocols, including:
* DNP3 (serial and TCP/IP)
* Modbus (RTU and TCP)
* ICCP/TASE.2
* OPC (Both UA and DA)
* Include secure authentication where applicable.
* Ability to operate as both a client and server
* Must handle high volume telemetry without degradation.
* Must support configurable scan rates down to sub second intervals.
RFP - NCPA SCADA Control Center Replacement
Page 5

* Must maintain deterministic communication behavior under load.
Vendors must describe protocol implementation, performance characteristics, and any
limitations.
3.4. Cybersecurity and NERC CIP Compliance
The solution must meet or exceed NERC CIP requirements, including but not limited to:
* Role-based access control
* Multi-factor authentication compatibility
* Secure logging and audit trails
* Logging of all security relevant events:
o Logins,
o Configuration changes
o Failed access attempts
* Encryption of data in transit and at rest
* Secure communication using at least TLS 1.2
* Patch management program and vulnerability reporting and alerting to NCPA
* Network segmentation and secure architecture support
* Provide the appropriate Operating System hardening procedures for solution
* Must comply with all CIP-013 related supply chain requirements as set forth by the
attached Agreement.
Vendors must provide documentation demonstrating compliance and describe how the system
supports ongoing audits.
3.5. Integration with Third Party Systems
The SCADA system must integrate seamlessly with enterprise and OT systems.
Aveva PI (OSIsoft PI)
* Support for PI Data Archive bi-directional data transfer via either a native
interface or utilizing a supported SCADA Protocol interface (ie. OPC).
* Native PI interface or PI Web API integration.
* Ability to push realtime data on either a polling interval or exception basis, and
ability to recover historical data.
* Support for PI AF (Asset Framework) mapping.
Oracle Systems
* Support for Oracle database connectivity (ODBC, JDBC, or API-based).
* Ability to exchange operational data, alarms, and events.
* Support for stored procedures, triggers, and scheduled data transfers.
General Integration Requirements
* REST and/or SOAP APIs.
* Support for message brokers (MQTT, AMQP, Kafka preferred but optional).
* Ability to integrate with enterprise ESB platforms.
RFP - NCPA SCADA Control Center Replacement
Page 6

3.6. Programming, Logic, and Scripting
The system must support a modern programming language for scripting, automation, and
custom logic. Acceptable languages include (but are not limited to):
* Python
* C#
* PowerShell scripting
* JavaScript
The vendor must describe the development environment, debugging tools, and extensibility
model.
3.7. Object-oriented Design
The system must support object-oriented programming (OOP) principles for:
* Reusable templates
* Class-based device modeling
* Inheritance and parameterization
* Centralized updates to object instances
* Trending
* Alarming
* Context-driven graphics toolkit
3.8. Version Control and Governance
The solution must include built-in or integrable version control capabilities to track, audit,
and govern:
* Logic changes
* Configuration updates
* Screen and display modifications
* Deployment history
* Multi-user centralized development
* Integration with Gitbased systems is preferred.
3.9. Alarm Management
* Alarm Shelving
* State Based Suppression
* Severity Aggregation
* Alarm Notifications
* Categorization / Grouping
* Archiving
3.10. Backup and Recovery
The system must include a comprehensive backup and recovery strategy, including:
* Automated scheduled backups
* Full and incremental backup options
RFP - NCPA SCADA Control Center Replacement
Page 7

* Off system storage compatibility
* Disaster recovery procedures and documentation
3.11. Read Only Web Version
The system must provide a read only version of the SCADA screen environment that can be
shared or accessed from the Enterprise network. This ensures the solution:
* Cannot in any possible way write, alter or send control signals to the Dispatch SCADA
system.
* Is no more than 1 minute behind the primary SCADA solution poll rate display
* Can be viewed from a standard Internet browser without requiring a client
* Roles and screen assignment can be restricted to individual users within the Enterprise
3.12. Active Directory Integration
The solution must integrate fully with Microsoft Active Directory (AD), including:
* Centralized authentication using AD credentials
* Role-based authorization mapped to AD security groups
* Support for group policy enforcement
* Password policy inheritance
* Single sign-on (SSO) where applicable
* Audit logging of AD based access events
Vendors must describe how AD integration is configured, maintained, and secured.
3.13. Redundancy and High Availability
The SCADA system must include built-in redundancy to ensure continuous operation in the
event of component failures. Requirements include:
* Redundant servers (application, database, communication front-end)
* Automatic failover and failback
* Redundant communication paths
* No loss of data during failover events
3.14. Logging, Events, and Searchability
The SCADA platform must provide:
* Detailed event and alarm logging
* System and security logs
* Searchable, filterable log interfaces
* Export capabilities for compliance and analysis
* Integration with SIEM tools (e.g., Splunk, Sentinel)
* Sequence of Events (SOE) history of at least 100,000 entries available within the
SCADA system, and ability to automatically export SOE data for indefinite storage in
an external database (ie. ORACLE).
RFP - NCPA SCADA Control Center Replacement
Page 8

3.15. User Environment
The SCADA platform must provide:
* Full screen console access that allows users to visually see all controls, alarms,
and historical data.
* Each user should have the ability to configure their working screens and
environments including saving and remembering the layout to the appropriate
monitors and screen placement.
* Screens capable of displaying one-line diagrams and other ICS graphics using
configurable text, symbols, colors, fonts, naming conventions, and screen
layouts that can be applied consistently across the system.
* Audible alerts that notify Dispatchers to take action, these sound alerts should
be customizable using standard mp3 or wav format.
* Consistent navigation between displays that enables users to efficiently access
overview, detailed, and diagnostic information.
* Visual emphasis techniques, including the use of color and other graphical
indicators, for highlighting alarms, abnormal operating conditions, and operator
actions requiring attention.
* Display layouts and graphical elements that promote operator situational
awareness and facilitate rapid identification of abnormal operating conditions.
* Must allow for Areas of Responsibilities for multiple Dispatchers to
simultaneously monitor, control, respond to events and alerts designed only for
their respective areas within the system.
4. Project Management Requirements
Vendors must complete attachment IS-SCADA-REPLACEMENT-RFP-MATRIX_07-2026.xlsx
SCADA requirements matrix and send along with the submittal.
4.1. Project Management and Oversight
The vendor must provide full project management services, including:
* A dedicated project manager
* A detailed project plan with milestones and deliverables
* Regular status meetings and reporting
* Risk management and mitigation planning
* Change control processes
* Coordination with internal stakeholders and third parties
4.2. Factory Acceptance Test (FAT)
A comprehensive Factory Acceptance Test must be included, covering:
* Functional testing of all SCADA components
* Protocol and communication testing
* Failover and redundancy validation
* Security and access control testing
* Integration testing with PI and Oracle
* Documentation of all test results
RFP - NCPA SCADA Control Center Replacement
Page 9

4.3. Migration into Production
Vendor must provide a plan and strategy for migrating from current to new solution. It must
address:
* The testing approach
* Parallel operations
* Data and screen migrations
* Cutover details and timeline
4.4. Training & Knowledge Transfer
The Vendor shall provide a comprehensive training and knowledge transfer program to
ensure that NCPA personnel can effectively operate, administer, secure, maintain, and
enhance the SCADA solution independently following system commissioning.
Training shall be structured, role-based, documented, and aligned with operational,
engineering, cybersecurity, and IT administration responsibilities. Training must include at
least the following:
Control Center Dispatchers
* System navigation and screen usage
* Alarm management and acknowledgement workflows
* Event review and log searching
* Reporting tools
* Communication failure response procedures
* Failover awareness procedures
SCADA Engineers and Developers
* System architecture and data flow
* Object-oriented development within the SCADA platform
* Template creation and reusable component design
* Debugging and testing tools
* Version control usage and change governance workflows
* Integration methods (API, database connectors, middleware)
* Performance tuning and optimization
* Troubleshooting and remediation
System Administrator
* Installations and upgrades
* Backup/ Recovery procedures
* Disaster Recovery Testing
* Active Directory Integration
* Patch Management
* System hardening procedures and configurations
RFP - NCPA SCADA Control Center Replacement
Page 10