On May 26, 2026, Cowlitz PUD staff submitted a fully revised Administrative Policies volume for Board adoption, covering financial, investment, records, public records, NERC reliability, and cybersecurity policies. Key IT-related changes include an updated Cyber Security Policy that now references a Cybersecurity Program Foundations document for business network security, clarifies scope beyond just computers, and adds a new CIP-003-9–required plan for vendor remote access to low-impact BES cyber systems, as well as refined Public Records and Records Management policies around electronic records and email. These changes are primarily governance and compliance updates rather than a discrete procurement, but they frame how the PUD will handle cyber controls, vendor access, and IT risk going forward.For technology and cybersecurity vendors, this signals that Cowlitz PUD is actively refining its cyber and NERC CIP compliance framework and formalizing expectations for vendor remote access, data governance, and incident response. It creates openings to discuss tools and services for secure remote access, logging and monitoring, incident response, penetration testing, and records retention that align with their updated policies and regulatory obligations, even though no specific RFP is mentioned in this document.

Cyber Security Policy references multiple plans including cyber awareness, incident response, transient cyber assets/removable media, and a vendor remote access controls plan; NERC Reliability Compliance Program and Records Management policies are also being updated administratively.