WEST YOST ASSOCIATES (#2026112) - Laserfiche WebLink

David Bruzzone June 5, 2025 Page 5 Based on Task 2.1, Workshop 1 – Cybersecurity Controls Assessment and the prior RRA, West Yost will then update estimates of consequences, vulnerabilities, and threat likelihoods for each threat-asset pair. The information produced will be used to calculate the baseline risk for each threat-asset pair. The results will be summarized in the RRA Summary Report. This task includes a detailed evaluation of several hazards as described in the following sections. Climate Change Assessment Once the critical assets are determined and potential consequences evaluated, West Yost will conduct a climate change risk assessment using EPA’s CREAT software application. CREAT was developed by the EPA to assist utility owners and operators with understanding potential climate change threats and assess the related risks to their operations. Results will be compared to other regional and local climate change risk assessments. The results of the analysis will be integrated into the overall RRA to inform the risk and resilience analysis. Seismic Risk Assessment West Yost will develop the seismic risk and consequence analysis for the Maximum Credible Earthquake (MCE) that the City anticipates. This analysis will be based on HAZUS Technical Manual Chapter 8 for non-linear assets (buildings, reservoirs, and pump stations) and the American Lifelines Alliance (ALA) Seismic Guidelines for Pipelines. This represents the best practice for evaluating seismic risk to water systems. Vulnerability Analysis The project team will evaluate the ability of each critical asset and its protective systems to withstand each specified threat or hazard. West Yost will document and account for existing protective systems such as: physical security systems, the City security procedures, backup generators, and existing emergency response capabilities, plans, and protocols. The West Yost team will collect the information to support this portion of the analysis as part of Task 2.1 Data Request. If more information is required, it will be requested through email. Threat Likelihood Analysis West Yost will estimate the threat likelihood (also known as annualized probability or frequency) that a specific threat or hazard will occur for each threat-asset pair retained for analysis. We will use standard information on frequency and severity from sources such as National Oceanic and Atmospheric Administration (NOAA) and United States Geological Survey (USGS), local hazard mitigation plans, and the EPA. The analysis will also account for the utility-specific threat/hazard occurrence information gathered previously. The results will be summarized in the RRA Summary Report. Calculate Risk and Resilience West Yost will calculate risk and resilience for each priority threat-asset pair using the following equation from AWWA’s J100 Standard: Risk = Consequences x Vulnerability x Threat Likelihood (C x V x T) West Yost will also complete the Utility Resilience Index (URI), as presented in AWWA’s J100 Standard. EXHIBIT A Docusign Envelope ID: 0F3360EC-0957-4BAE-961E-506A072901B6