County of Ventura*

R01

The Grand Jury recommends that the investigated public water providers regularly assess their cybersecurity, addressing both IT and SCADA, consistent, with EPA and CISA recommended best practices. (F-01, F-02, F-03, F-05) Ventura Water already regularly assesses its cybersecurity, addressing both IT and SCADA. Ventura Water is also in the process of doing a full assessment of IT systems, OT systems, and related equipment. It is anticipated that this full assessment will be complete The City of Ventura's Information Technology Department will be conducting a City-wide assessment starting in 2023 that will build upon the findings of the Ventura Water specific assessment. With the completion of these assessments a strategic plan can be developed to address any shortcomings as they relate to EPA and CISA recommended guidelines. For a timeframe for implementation, Ventura Water cannot provide a timeline of implementing these recommendations until the assessments is complete, but it is anticipated that implementation will commence within the fiscal year of 2023-2024. Ventura Water will work diligently to implement those recommendations in a timely manner.

R02

The Grand Jury recommends that the investigated public water providers regularly share and exchange information regarding cybersecurity threats, attacks, protections, and remedies, and provide training, using such forums as the AWAVC. (F-01, F-02, F-03, F-04, F-06, F-07) Ventura Water reached out to the AWAVC to address using the AWA as a forum to address cybersecurity with its regional water agency members. AWAVC was willing to assist and placed this topic as an item for discussion on its July 27, 2022, safety committee workshop. A presentation was provided by a member agency and the topic was discussed. There is a level of uncertainty between agencies if information should be shared and how beneficial it would be to focus a cybersecurity group if there are such strong concerns about sharing information. Ventura Water will continue to look to forums such as the AWAVC and the EPA to provide training and updated materials. Without regulated standards that structure how cybersecurity threats should be shared at the agency level, Ventura Water will be hesitant to participate in sharing information at this time. For a timeframe for implementation, regarding training, Ventura Water already provides training to its employees regarding cybersecurity threats, attacks, protections, and remedies. Ventura Water will provide additional regular training based on the results of the assessment. Ventura Water does not have anything further to add regarding timing for implementation of this recommendation.

R03

The Grand Jury recommends that the investigated public water providers use free federal and state expert assistance to enhance cybersecurity. (F-01, F-02, F-3, F-05, F-06, F-07, F-08) After the completion of the above-mentioned assessment Ventura Water will make an effort to utilize any state or federal resources to assist in developing a strategic plan to meet recommended guidelines for critical infrastructure in regard to cybersecurity and disaster recovery. For a timeframe for implementation, again, Ventura Water anticipates that a water specific I assessment will be completed and will pursue relevant federal and state expert assistance to enhance cybersecurity thereafter.

R04

The Grand Jury recommends that the investigated public water providers regularly conduct cybersecurity awareness training. (F-01, F-02, F-03, F-04) Ventura Water already conducts cybersecurity awareness training with employees. Ventura Water is also in the process of developing an extensive employee onboarding process that will require onboard training to employees prior to use and working on programs and equipment that hold cybersecurity risks. Ventura Water adheres to the policies and procedures of the City of Ventura's IT Department and receives routine training and technical assistance with cybersecurity issues. For a timeframe for implementation, this measure is already being implemented and will continue to be implemented.

R05

The Grand Jury recommends that the investigated public water providers address recovery from cybersecurity incidents in their business recovery plans. (F-01, F-02, F-03, F-09) Ventura Water is in the process of doing a full assessment of IT systems, OT systems, and related equipment. With the completion of this assessment cybersecurity incident recovery will be \in {}^{\mathcal{K}} integrated into our business recovery plans. For a timeframe for implementation, Ventura Water anticipates that this assessment will be completed by 2022.

R06

The Grand Jury recommends that each investigated public water provider establish a CISA- compliant internal protocol for reporting cyber incidents. (F-01, F-02, F-03, F-06) Ventura Water appreciates the recommendation and we have familiarized ourselves with CISA Incident Reporting System. Any incidents will be reported to the CISA Incident Reporting System and if necessary to the CISA Malware Analysis Submission Form. This procedure will be integrated into our business recovery plans. For a timeframe for implementation, this recommendation is being implemented immediately, and will also be integrated into our strategic business and recovery plans by fiscal year 2023-2024. .