09-28-2020-R - Laserfiche WebLink

Home Browse Search

Professional Services Agreement Risk and Resilience Assessment Page 3 of 12 Version2.1 02212019 COMPANY has the following approach for asset characterization: i. COMPANY will conduct a system evaluation for the water system assets identified at the above facilities. The evaluation will result in documentation of the function, communication, control, power, and existing security measures at each facility. COMPANY will provide a photo log within the RRA. Site visits will include one COMPANY team member, two days (2) days are planned for this effort. ii. COMPANY staff will identify and document the following items for each facility: SCADA systems, entry control procedures, hazardous chemicals, and interdependences of treatment systems, power systems, and communication systems. iii. COMPANY will develop a preliminary critical asset characterization based on the site visits. COMPANY and CLIENT will have a workshop to discuss whether the CLIENT agrees with the preliminary asset characterization and whether any assets should be added or removed. The workshop attendees will include no more than two COMPANY team members, and four (4) hours planned for this workshop. 2.2.2 Threat Characterization The second step is to perform threat characterization. As a guideline, EPA has identified threat categories for malevolent acts, natural hazards, and dependency/proximity threats. Each critical asset will be assigned the most relevant and probable threats that may adversely affect CLIENT facilities. i. COMPANY will first assign 2-3 of the most likely threat scenarios to pair with each critical asset based on the initial site visit and CLIENT staff discussions. ii. COMPANY and CLIENT will have a workshop (see 2.2.1.iii) to discuss whether the CLIENT agrees with the preliminary threat assignments for each critical asset and whether other threat scenarios should be added. Based on CLIENT input, COMPANY will make adjustments and finalize the threat characterization analysis. 2.2.3 Vulnerability Analysis The Vulnerability Analysis estimates the likelihood that each specific threat or hazard, given it occurs, will damage the asset while considering the utility’s existing countermeasures. Vulnerability analysis involves an examination of existing security capabilities and structural components, as well as counter measures/mitigation measures and their effectiveness in reducing damages from threats and hazards. i. COMPANY and CLIENT will have a workshop (see 2.2.1.iii) to assess the utility’s ability to detect, delay, and respond to the threats assigned to each critical asset. 2.2.4 Threat Analysis Threat analysis estimates the likelihood of malevolent attack, dependency/proximity hazard, or natural hazard based on several factors for threat likelihood.