This response was given using the 2020-2021 Ventura County Grand Jury Report form. The form should*

R01

The Grand Jury recommends that the investigated public water providers regularly assess their cybersecurity, addressing both IT and SCADA, consistent with EPA and CISA recommended best practices. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District has consistently addressed both IT and SCADA with EPA, CISA, and FERC recommended best practices. As a member of both the dams and water & wastewater critical infrastructure sectors as defined by CISA, the District receives timely updates on best practices. Furthermore, the District's Santa Felicia Dam is under the regulatory purview of FERC and is required to provide updates to the agency's Security Branch on cyber security efforts. In June 2020, FERC conducted a cyber security inspection, and the District has been implementing recommendations by the Security Branch. For context, FERC leverages its in-house cyber security expertise as well as best practices by CISA. In November 2020, the District underwent a Validated Architecture Review Design Assessment by CISA. As a result of this assessment, some of the recommended best practices include the development of an IT Use Policy and implementation of SANS, NIST, etc. best practices. The District also included a cyber component as part of the Emergency Response Plan as required by the EPA. Ventura County Grand Jury August 19, 2022

R02

The Grand Jury recommends that the investigated public water providers regularly share and exchange information regarding cybersecurity threats, attacks, protections and remedies, and provide training, using such form as the AWAVC. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District regularly receives timely cyber threat intelligence reports from a variety of local, state, and federal partners as well as organizations such as MS-ISAC. Additionally, the District's IT Department actively participates in monthly FBI Cyberhood Calls to share information within a trusted environment. In August 2021, the District arranged a cyber security briefing for the Ventura County Special District Association to discuss both current threats and best practices to mitigate those threats.

R03

The Grandy Jury recommends that the investigated public water providers use free federal and state expert assistance to enhance cybersecurity. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District initiated an inquiry with the Regional CISA Cyber Advisor in 2020. Since then, the District's IT and OT teams have met with CISA staff virtually and on site for various risk-based services and assessments, which are considered industry best practices.

R04

The Grand Jury recommends that the investigated public water providers regularly conduct cyber awareness training. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District has provided cyber security trainings to staff through multiple methods. Virtual training is generally assigned through the District's Learning Management System (LMS). On occasion, the IT Department has hosted lunch-and-learn sessions. Specific, targeted cyber security training has also been and continues to be provided to staff depending on their roles. For example, awareness training on social engineering was provided to the Operations & Maintenance staff at monthly safety meetings. The IT Team also sends advisories providing awareness and tips to all staff utilizing examples from real phishing email attempts. On occasion, the District also shared actional-intelligence reporting to the appropriate staff based on their functions within the organization. . Ventura County Grand Jury August 19, 2022

R05

The Grand Jury recommends that the investigated public water providers address recovery from cybersecurity incidents in their business recovery plans. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District has incorporated recovery from cybersecurity incidents into the Data Recovery Plan.

R06

The Grand Jury recommends that each investigated public water provider establish a CISA- compliant internal protocol for reporting cyber incidents. Response: This recommendation has been implemented. (Pen. Code, § 933.05(b)(1)). Explanation: The District follows CISA and industry standards for reporting cyber incidents. ###