2024-214 - Laserfiche WebLink

Home Browse Search

Exhibit A 04ARCADIS submittals for cybersecurity enhancements to validate proposed improvements adequately address OT system vulnerabilities. This review and assessment will be included in the RRA report as a technical memorandum. Review and evaluation results and any recommended cybersecurity design enhancements will be included in the memorandum and proposed mitigation measures associated with RRA overall cybersecurity assessment. This memorandum will be submitted to the Department for review and comment prior to conducting a two-hour virtual meeting with applicable County and Department staff to review results of the OT portion of the cybersecurity assessment. Adjustments to the memorandum will be included in a final memorandum for inclusion in an RRA report Appendix. Deliverables: 1. IT Cyber Workshop PowerPoint slides and materials 2. Workshop summary of key highlights and decisions 3. AWWA Cyber Security Tool Results 4. ICS Network cybersecurity design review and validation technical memorandum 5. Two, two-hour virtual meetings and summaries Task 2.3 — J100 Steps: Assets and Threats Workshop Arcadis will provide subject matter expertise for updating the RRA and approach implementation, including internal and external stakeholder input by staff and leadership. Arcadis will update, enhance, and address any gaps in the existing 2020 RRA following updated J100-21 methodology and operational guidance based on required updates, elements, and overall approach identified in the Gap Analysis and Data Needs Workshop in Task 2.1. Once the Arcadis team has received and reviewed the documentation provided in the Data Needs List, an in-person, three-hour Asset and Threat Workshop will be scheduled with Department staff and appropriate stakeholders. This workshop will be designed to collaborate with Department staff to learn the J100 Steps 1 and 2, Asset and Threat Characterization, respectfully, and focus on accomplishing the following: • Determine water system mission criteria to serve as an assessment baseline. • Review, prioritize, and select mission -critical assets for quantitative analysis. • Gather input related to critical asset dependencies, redundancies and workarounds, emergency connections, back-up resources, upgrades, capacities, critical customers served, service population served, existing and planned mitigation, and other pertinent details. • Review historical threats and impacts, identify potential current and future threats and hazards • Review and select applicable threats and hazards for malevolent acts, natural hazards, dependency hazards, accidental hazards, and proximity threats to assess in the quantitative analysis. • Identify significant threats and hazards applicable to each critical asset to be carried on in the quantitative analysis [Threat -Asset Pairs (TAPs)]. Deliverables: 1. Workshop PowerPoint slides and materials 2. Workshop summary of key highlights and decisions 3. TAP matrix for quantitative analysis in the RRA; Arcadis will quantitatively assess up to 250 TAPs in the RRA for cost estimating purposes. Task 2.4 — Site Visits Three Arcadis Team will conduct a five-day consecutive onsite visit of selected mission -critical and representative assets, physical and cyber related security measures, assess new and emerging hazards, and conduct staff and www.arcadis cow