18 - Laserfiche WebLink

Scope of Services for Preparation of tH, cIt• AWIA-Compliance Documents — egar City of Pleasanton pLEASANTON. Once critical assets are identified, the threats/hazards that could potentially impact each asset will be defined. During this portion of Workshop 1, the group will: • Agree on the insider/outsider physical and cyber malicious adversary attributes. • Determine relevant natural hazards to be analyzed further within the RRA. • Identify dependency and proximity hazards such as power, chemicals, key suppliers, critical employees, transportation, and proximity to dangerous neighboring sites. West Yost recommends the City engage local law enforcement and federal agencies to support threat characterization. While this can be an important step of the threat characterization process, engagement with these external stakeholders is not required. Task 5. Cyber-RRA Under this task, West Yost will evaluate the City's "electronic, computer, or other automated systems" as required by AWIA. This includes the billing system, business network, SCADA and access controls. The cyber-RRA requires a different set of stakeholders and engagement with those stakeholders. In addition,this task is focused on technology,which the City relies on,but relatively few staff are responsible for. To include all internal stakeholders in cyber-RRA discussions is likely an inefficient use of staff time. Therefore, this task includes task-specific stakeholder engagement, including meetings, site-visits, a workshop, and interviews. The AWWA Tool is the standard for cybersecurity in the sector and generates an easy-to-use output for building a cybersecurity improvement plan. This output will be integrated directly into Task 8 —Risk and Resilience Management Strategy Development. All of these efforts will build on recent cybersecurity assessment work the City has done. The City is currently upgrading its SCADA system and has requested that West Yost perform a cyber security review of the design. West Yost has structured this scope of work to align with the City's SCADA design schedule and will review the design submittals and conduct the AWWA Tool analysis on the proposed design technology as part of the design review. The Tool analysis on non-technology components will be completed concurrent with the overall RRA analysis. Task 5.1. Review Draft Design Submittals and Participate in Draft Design Submittal Workshop West Yost will review the draft System Architecture and Network communications design submittals prepared by Tesco. From the review, we will determine if the Priority 1 and Priority 2 technology controls output from the tool are addressed in the design. Additionally, we will assess against the NIST SP 800-82 Revision 2 framework. West Yost will participate in the City's Draft Design Submittal Workshop scheduled for November 19, 2019 to become familiar with the proposed technology design. West Yost will have one in- person participant and one participant by phone. WEST '(0 S T ASSOCIATES 5 City of Pleasanton November 2019 n\m\s\cityp\\2019 AWIA Scope and Budget