Contra Costa County Grand Jury • 2019-2020 • Agency Response

East BAY Clifford C. Chan Municipal Utility District General Manager July 24, 2020 Anne N. Granlund, Foreperson*

Published: July 24, 2020 4 pages
View Original PDF

Findings and Recommendations 6 findings

F1
(F1). EBMUD's response to the American Water Infrastructure Act is timely and conforms to all requirements of this Act. EBMUD agrees with Finding Fl.
Related Recommendations (1)
R1
(R1). EBMUD Board of Directors should consider publishing a cyber policy acknowledging the cyberattack threat and informing the public of its programs to overcome and prevent attacks on the public water supply by December 31, 2020. This recommendation has not yet been implemented, but will be implemented by December 31, 2020. The District expects to complete and present a policy to the Board of Directors this fall for consideration and adoption.
F2
(F2). EBMUD's use of staff rather than an outside consultant for the Risk and Resilience Assessment complies with the American Water Infrastructure Act requirements. EBMUD agrees with Finding F2.
Related Recommendations (1)
R2
(R2). EBMUD Board of Directors should consider publishing its conformance with the American Water Infrastructure Act on its public webpage by December 31, 2020. This recommendation was implemented on June 26, 2020.
F3
(F3). EBMUD expects to reuse existing plans to comply with the American Water Infrastructure Act Emergency Response Plan. The Act does not discuss the reuse of existing plans, and the impact on EBMUD's certification cannot be determined. EBMUD partially disagrees with Finding F3. EBMUD plans to utilize an existing assessment of its cyber vulnerability to comply with the AWIA Emergency Response Plan submittal planned later this year. EBMUD agrees that the AWIA does not offer guidance regarding use of existing security assessments relative to compliance. However, EBMUD believes there to be no impact to EBMUD's certification associated with the use of an existing document based on the comprehensiveness of existing security assessments to date and implementation of Industrial Control System equipment supply chain management practices per the National Institute of Standards and Technology (version 1.1) formalized by the Cybersecurity Enhancement Act (2014).
Related Recommendations (1)
R3
(R3). EBMUD Board of Directors should consider applying for a grant to offset new technology costs and strengthen its cybersecurity infrastructure under the Drinking Water Infrastructure Risk and Resilience Program by December 31, 2020. This recommendation has been implemented. The District regularly pursues federal funding to offset implementation costs to ratepayers and will actively consider grant funding under the Drinking Water Infrastructure Risk and Resilience Program as opportunities become available. Anne N. Granlund July 24, 2020 CLARIFICATIONS In addition to the comments on the specific findings and recommendations, EBMUD would like to clarify and correct the following statements in the Grand Jury Report. , 3rd paragraph: Emergency Response Plans, per the AWIA, are due September 30, 2020, not August 31, 2020. Multiple Pages:
F4
(F4). EBMUD's public security notice on its website does not include a discussion about previous risk assessments. EBMUD agrees with Finding F4. Anne N. Granlund July 24, 2020
No recommendations for this finding
F5
(F5). EBMUD's public security notice on its website does not discuss the American Water Infrastructure Act requirements, or how EBMUD intends to comply with this Act. EBMUD agrees with Finding F5.
No recommendations for this finding
F6
(F6). Federal funding is available through the Drinking Water Infrastructure Risk and Resilience Program that could strengthen EBMUD's cybersecurity infrastructure. These grants help offset water rate increases that customers might otherwise pay. EBMUD agrees with Finding F6.
No recommendations for this finding

* This report's PDF did not contain easily extractable text and required Optical Character Recognition (OCR) for analysis. There may be minor errors in the extracted findings and recommendations due to OCR limitations with scanned documents.