Agmt25 AARC Consultants, LLC - Laserfiche WebLink

Browse Search

REV: 05-27-25 LF Following document review, Consultant shall work with key stakeholders and the City to complete the RRA/ERP checklist, conduct an in-person site visit followed by workshops, and interviews with key stakeholders. Workshops will focus on identifying critical system components, potential vulnerabilities, and the greatest threats. Workshops will include: •Initial RRA Checklist and Workshop(s): Held in person and virtually, where utility staff and stakeholders describe the system’s operations and key processes. •Subsequent workshops (if required): Held virtually, focused on identifying top threats and vulnerabilities and quantifying the worst reasonable consequences of specific threats. •Ongoing discussions: Will address the interdependencies between utilities. This phase will also involve a focused look into natural, malevolent, cybersecurity, and physical security threats. This collaborative approach helps to gather detailed insights from those closest to the system, ensuring the assessment captures real–world risks and operational realities. 2.2 – Draft RRA Consultant shall provide a detailed analysis and development of mitigation measures once the threat and vulnerability identification steps are completed. This process includes: •Critical Assets and Threats: Identify key infrastructure, systems, and resources essential for operations, along with potential threats and vulnerabilities. •Physical Security Assessment: Evaluate facility security measures, access controls, surveillance, and emergency response capabilities. Consultant shall conduct a Physical Security Assessment of the water system infrastructure, utilizing industry standards to evaluate the security posture. This assessment will cover: o A comprehensive evaluation using tools from AWWA’s G430, CISA, and the US EPA to assess barriers, plans, processes, and procedures. o The evaluation will follow the deter, detect, devalue, delay, and respond framework to identify improvements in protecting critical infrastructure from both current and emerging threats. The outcome will be a clear picture of the current physical security posture, with prioritized recommendations for enhancing security measures. •Cybersecurity Assessment: Assess digital infrastructure, network security, data protection, and potential cyber threats. Consultant shall evaluate the City’s cybersecurity posture, using both industry–standard tools and tailored methodologies to identify vulnerabilities and enhance system security. This includes: 1.AWWA Water Sector Cybersecurity Risk Management Tool •Facilitates data–driven risk analysis for operational technologies (e.g., SCADA) and enterprise systems. •Produces a prioritized list of recommended controls tailored to the City’s needs. 2.AARC Cybersecurity Questionnaire and Checklist ATTY/AGR.2025.124/AARC Consultants, LLC(RRA and Update to ERP 2025) (Page 12 of 20)