Anne N. Granlund, Foreperson

(F7). CCWD's response to the American Water Infrastructure Act is timely and conforms to all requirements of this Act. CCWD agrees with Finding F7.

(F8). CCWD's use of staff and an outside consultant for the Risk and Resilience Assessment complies with the American Water Infrastructure Act requirements. CCWD agrees with Finding F8.

(F9). CCWD's designated Risk and Resilience Assessment & Emergency Response Plan team received specific, relevant training in the areas specified under Section 2013 of the American Water Infrastructure Act. CCWD agrees with Finding F9.

(F10). There is no CCWD public website statement on the issue of cybersecurity or its program to counter cyberattacks. CCWD has posted a public website statement on the issue of cybersecurity and its programs to counter cyberattacks here: https://www.ccwater.com/763/Cybersecurity-and- Enterprise-Systems.

(F11). The Grand Jury found no evidence regarding CCWD's National Institute of Standards and Technology Tier level. The National Institute of Standards and Technology Tier level is releasable to the public and essential to inform CCWD of how safe its water supply is from cyberattacks. CCWD conducts on-going annual audits of its cybersecurity systems and addresses any critical issues identified. The District assesses itself to be at National Institute of Standards and Technology Tier 3, Repeatable. CCWD's cybersecurity practices are regularly updated and based on assessments conducted both internally and externally. CCWD continuously monitors the cybersecurity risk of all technological assets, and there is an organization- wide agreement on staying consistent with industry best practices. CCWD regularly collaborates with outside entities and receives and shares information for the betterment of the organization. A cybersecurity governance committee was also established to 2019-2020 Contra Costa County Civil Grand Jury July 27, 2020 further enhance policy implementation and partnerships.

(F12). Federal funding is available through the Drinking Water Infrastructure Risk and Resilience Program that could strengthen CCWD's cybersecurity infrastructure. These grants help offset water rate increases that customers might otherwise pay. CCWD agrees with Finding F12. CCWD will consider application for various grants to offset costs to ratepayers. Grant opportunities will be reviewed by CCWD's grants program. CCWD's full-time Grants Coordinator will continue to monitor to ensure opportunities are pursued whenever possible.