PSA - Develop Risk and Resilience Assessment and Emergency Response Plan and Provide Training for American Water Infrastructure Act Compliance - Arcadis U.S., Inc.

Home Browse Search

Deliverables: • Site visit documentation and photos Task 1.3: CyberBusiness Continuity Risk and Resilience Assessment The AWIA specifically requires water utilities to assess their business continuity and financial resilience. This is usually best addressed by assessing SCADA, critical communications, essential business systems and financial resilience together in a separate workstream from the overall assessment as it usually involves different stakeholders. Arcadis will provide the City with a cybersecurity self -assessment that we have developed which assesses existing systems relative to AWIA requirements and best practices. We will review the self -assessment results and conduct a meeting with City leadership and staff responsible for SCADA, IT, communications, and finance to discuss these results and a path forward. To minimize travel costs, this can be held in conjunction with dates for workshops for the overall assessment or can be accomplished by conference call(s). Deliverables: • Cybersecurity Self -assessment Checklist • CyberBusiness Continuity results planning meeting Task 1.4: Analysis of Threats and Risks and Risk and Resilience Assessment Report Following the first two workshops, Arcadis will also perform a vulnerability analysis (with information and feedback provided by the City via conference calls as needed) to determine the ability of each critical asset and its existing protective systems to withstand each identified threat. Risk and resilience estimates will be developed for each threat -asset pair, and an overall estimated risk and resilience profile (financial and operational) for the City's water system will be calculated. Arcadis will develop a report that summarizes the risk and resilience assessment performed. This report will fulfill the AWIA requirement for a Risk and Resilience Assessment. Deliverables: • Threat analysis results table Risk and resilience estimates for each threat -asset pair • Draft and final Risk and Resilience Assessment report Task 1.5 — Risk and Resilience Management Workshop and Report Risk management is the final step in the J100 risk and resilience process, and the results are a requirement for inclusion into the ERP. This task builds on the RRA work to find solutions to the risks identified. This includes identifying which risks warrant mitigation and collaborating with City staff to develop risk reduction ideas, preliminary costs, and benefits. Arcadis will facilitate a workshop to review and formalize the mitigation strategies. Each strategy will be documented on a business case template. Arcadis will prepare a report summarizing this work. This report will satisfy AWIA requirements and can be used when applying for grant funding for the work. Deliverables: • Templates providing risk and resilience management options • Draft and final Risk Management report Exhibit A, Scope of Basic Engineering Services EJCDC E-520 Short Form of Agreement Between Owner and Engineer for Professional Services. Copyright ©2009 National Society of Professional Engineers for EJCDC. All rights reserved. 'aac 3