WEST YOST ASSOCIATES (#2026112) - Laserfiche WebLink

David Bruzzone June 5, 2025 Page 4 2.Changes to Critical Facilities, including: a.Address b.Capacity c.Year constructed d.Asset value 3.Reduction in system capacity if taken offline. 4.Changes to physical security countermeasures at Critical Facilities (ex. site lighting, perimeter fencing, security cameras). 5.Information related to earthquake analysis. 6.Facilities anchored vs unanchored. 7.Type of pipeline conveyance material used. 8.Changes to cybersecurity or upgrades to Information Technology (IT) / Operational technology (OT) systems. 9.Chemicals used, handling and storage. 10.Information related to vulnerability analysis. Task 2.2 Cybersecurity Risk and Resilience Assessment West Yost will conduct a cybersecurity-specific workshop focused on the City’s supervisory control and data acquisition (SCADA) and IT systems. Workshop 1 – Cybersecurity Controls Assessment West Yost will assist the City with identifying the appropriate members of a Cybersecurity Stakeholder Group to participate in this workshop. Typically, this group consists of staff responsible for the day-to-day secure and reliable operation of the City’s SCADA and IT systems. Workshop 1 – Cybersecurity Controls Assessment is expected to take up to four hours. West Yost will conduct interviews with key staff to understand the City’s use of IT and OT technology. Next, West Yost will facilitate a review of the City’s current cybersecurity practices as previously documented using the AWWA Cybersecurity Tool. The AWWA Cybersecurity Tool is the consensus standard for cybersecurity assessment in the water sector and generates an easy-to-use output for building an AWIA-compliant cybersecurity assessment and improvement plan. The output from the AWWA Tool is a prioritized list of recommended cybersecurity controls based on industry standards including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The workshop will serve to document the status of cybersecurity controls and train utility staff on the use of the AWWA Cybersecurity Tool. This will allow the City staff to continue using the AWWA Cybersecurity Tool as improvements and changes to the system are implemented. West Yost will integrate the findings of this task into the RRA. Task 2.3 Analysis of Consequences, Vulnerability, and Likelihood Based on the results of Task 2.1 Data Request, Workshop 1 – Cybersecurity Controls Assessment and the prior RRA, risk will be reevaluated for each threat-asset pair. This task consists of estimating each of the three variables needed to calculate risk, which are: •The consequence of a threat/hazard to an asset •The vulnerability of an asset to a threat •The likelihood of a threat occurring EXHIBIT A Docusign Envelope ID: 0F3360EC-0957-4BAE-961E-506A072901B6