02-05-2016 BPU RPT 05 - Laserfiche WebLink

Home

A 1 E N E R G Y P U B L I C U T I L I T I E S RIVERSIDE PUBLIC UTILITIES Board Memorandum BOARD OF PUBLIC UTILITIES DATE: FEBRUARY 5, 2016 ITEM NO: 5 File ID — 16 -0202 — C SUBJECT: PROFESSIONAL SERVICES AGREEMENT FOR A VULNERABILITY ASSESSMENT REPORT FOR RIVERSIDE PUBLIC UTILITIES — FOR $342,000 ISSUE: The issues for the Board of Public Utilities consideration are approval of a Professional Consulting Services Agreement with Securicon, LLC for a Vulnerability Assessment Report and approval of the related Work Order No. 1610130. RECOMMENDATIONS: That the Board of Public Utilities: 1. Approve Work Order No. 1610130 in the amount of $342,000; and 2. Approve a Professional Services Agreement with Securicon, LLC located in Alexandria, Virginia, for preparation of the Vulnerability Assessment Report. BACKGROUND: Riverside Public Utilities (RPU) is requesting approval for the services of a professional consulting firm to conduct a vulnerability assessment and to develop guidelines for the City's physical and cyber security environments. In accordance with the latest best practices and generally accepted methodologies in physical and cyber security, the consultant will develop physical and cyber security guidelines. The guidelines will establish standards for personnel and asset protection, physical security and continuity of operations of water, electric and power generation systems, and the operation and maintenance of control systems. In addition, a checklist will be developed to document existing security features, vulnerabilities, and needed improvements. The consulting firm will evaluate RPU's current policies and guidelines, and will assess all critical facilities including water wells, water treatment plants, water storage reservoirs, pump stations, power generation plants, electric substations, major electric supply remission points, major communication hubs, and office buildings. The firm will conduct a gap analysis outlining deviations in the current implementation against the new guidelines, and will document vulnerabilities that could lead to reduced integrity, confidentiality, or availability of the City's critical data. Recommendations will be made to address root causes of any identified vulnerabilities to reduce future risk, with planning level cost estimates for implementing physical and cyber security enhancements. The need for such an assessment stems from increased cyber and physical security threats to the utility environment. Physical security threats, such as copper theft, have been known for years. However, more sophisticated threats have emerged, reiterating the need to continue to develop and enhance guidelines and practices to prepare for such attacks.