WEST YOST ASSOCIATES (#2026112) - Laserfiche WebLink

David Bruzzone June 5, 2025 Page 6 Task 2.4 Risk & Resilience Assessment Summary Report Using the consequences, vulnerabilities, and threat likelihoods estimated in Task 2.3, the risks to and resilience of the City operations will be evaluated. West Yost will prepare a draft RRA to summarize the tasks conducted during this project, the results of the workshops and analyses, and the risk and resilience calculations. The cyber-RRA and climate change assessment results will also be incorporated into this report. The report will be of sufficient depth and breadth to document that the City used an all-hazards approach and is in compliance with AWIA. Draft-RRA Submittal Following Workshop 2- RRA & RRMS Review under Task 2.5, the draft report will be provided to the City for review. Upon receipt of the City’s comments on the draft RRA, West Yost will revise and finalize the document. With completion of this report, the City will be responsible for certifying with the EPA that the RRA is complete. Task 2.5 Risk & Resilience Management Strategy Development Once risks have been calculated, Risk and Resilience Management Strategies (RRMS) will be developed for implementation to reduce the risk of the greatest threat-asset pairs. RRMSs may include physical security or cybersecurity upgrades, natural hazard mitigation, training, policy/procedure changes, monitoring strategies, and operational/financial changes that can make the City more resilient. Workshop 2 – RRA & RRMS Review The West Yost team will conduct Workshop 2 – RRA & RRMS Review to review the draft RRA and the highest risks to the City and Proposed RRMSs to address those risks. The project team will evaluate how RRMSs lower risk to the critical asset. The RRMSs will be prioritized based on risk reduction and cost effectiveness. These results will be incorporated into the RRA. Task 2 Assumptions •If not among West Yost project files, the City will provide an editable version of the 2020 RRA. •The technology-focused cybersecurity RRA interviews and Cybersecurity Controls Assessment will occur during Workshop 1 – Cybersecurity Controls Assessment. This is estimated to be up to four hours in duration. •Workshop 2 – RRA & RRMS Review is assumed to be up to two hours in duration. •The budget assumes that workshops will be in person. •The City will provide a location to hold the workshops. •The City staff will be available to participate in the workshops. •The schedule assumes that the City will complete a review of the Draft RRA within three weeks of receipt of the draft report. Task 2 Deliverables •West Yost will provide an initial data request. •West Yost will prepare all meeting and workshop facilitation materials. •West Yost will prepare the draft and final RRA. EXHIBIT A Docusign Envelope ID: 0F3360EC-0957-4BAE-961E-506A072901B6