Ventura County Grand Jury
• 2021-2022
• Agency Response
Response to:
Cybersecurity of Water Providers in Ventura County
County of Ventura*
⚠️ Translation Notice: This content has been automatically translated. The original English text is the official version. Translation may contain errors.
⚠️ Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
Findings and Recommendations 9 findings
F01
The Grand Jury finds that cybersecurity of both IT and SCADA systems is essential to safe and effective delivery of water. Response: Agree.
Related Recommendations (1)
R01
The Grand Jury recommends that the investigated public water providers regularly assess their cybersecurity, addressing both IT and SCADA, consistent with EPA and CISA recommended best practices. (F-01, F-02, F-03, F-05) Response: Already implemented. We at Casitas Municipal Water District regularly assess our cybersecurity infrastructure and practices by doing bi-weekly CISA scans and reports along with monthly phishing and penetration testing. All conducted by CISA.
F02
The Grand Jury finds inconsistent levels of cybersecurity for IT systems among the investigated water providers. Response: Disagree partially. We do not know what levels of security other water providers have. However, we at Casitas Municipal Water District have met all standards required.
Related Recommendations (1)
R02
The Grand Jury recommends that the investigated public water providers regularly share and exchange information regarding cybersecurity threats, attacks, protections and remedies, and provide training, using such forums as the AWAVC. (F-01, F-02, F-03, F-04, F-0~, F-07) Response: Has not yet been fully implemented but will participate in the implementation in the future. We at Casitas Municipal Water District agree that the regular flow of cybersecurity information between water agencies is imperative to the improvement and upkeep of not only our individual water agencies, but also as a network of agencies.
F03
The Grand Jury finds inconsistent levels of cybersecurity for SCADA systems among the investigated water providers. Response: Disagree partially. We do not know what levels of security other water providers have. However, we at Casitas Municipal Water District have met all standards required.
Related Recommendations (1)
R03
The Grand Jury recommends that the investigated public water providers use free federal and state expert assistance to enhance cybersecurity. (F-01, F-02, F-03, F-05, F-06, F-07, F-08) Response: Already implemented. We at Casitas Municipal Water District regularly assess our cybersecurity infrastructure and practices by doing bi-weekly CISA scans and reports along with monthly phishing and penetration testing. All conducted by CISA. 07/27/2022 Attachment to Casitas MWD Response to the 2020-2021 Ventura County Grand Jury Report, Entitled "Cybersecurity of Water Providers in Ventura County"
F04
The Grand Jury finds that the level of training on cybersecurity is inconsistent among the investigated water providers. Response: Disagree partially. We do not know what levels of training other water providers have. However, we at Casitas Municipal Water District have monthly cybersecurity training/reminders.
Related Recommendations (1)
R04
The Grand Jury recommends that the investigated public water providers regularly conduct cybersecurity awareness training, (F-01, F-02. F-03, F-04) Response: Already implemented. We at Casitas Municipal Water District have monthly cybersecurity training/reminders.
F05
The Grand Jury finds that the level and frequency of cybersecurity assessments are inconsistent among the investigated water providers. Response: Disagree partially. We do not know what levels or frequency of cybersecurity assessments other water providers have. However, we at Casitas Municipal Water District have bi-weekly CISA scans and reports. In addition to monthly phishing and penetration testing from CISA.
Related Recommendations (1)
R05
The Grand Jury recommends that the investigated public water providers address recovery from cybersecurity incidents in their business recovery plans. (F-01, F-02, F-03, F-09) Response: Already implemented. We at Casitas Municipal Water District have recovery plans in place in the event of a cybersecurity incidents such as ransomware, virus', etc. The effects of a cybersecurity incident were investigated during our Risk and Resilience Assessment in 2020 and procedures were included in our Emergency Response Plan (ERP) which was updated in June 2021.
F06
The Grand Jury finds that knowledge of cyber incident reporting requirements is inadequate among the investigated water providers. 1055 N. Ventura Ave • Oak View CA 93022 • 805.649.2251 • www.casitaswater.org Attachment to Casitas MWD Response to the 2020-2021 Ventura County Grand Jury Report, Entitled "Cybersecurity of Water Providers in Ventura County" Response: Disagree. We do not know what levels of knowledge of cyber incident reporting other water providers have. However, we at Casitas Municipal Water District have met all standards required.
Related Recommendations (1)
R06
The Grand Jury recommends that each investigated public water provider establish a CISA- compliant internal protocol for reporting cyber incidents. (F-01, F-02, F-03, F-06) Response: Already implemented. We at Casitas Municipal Water District have met all standards required. 07/27/2022
F07
The Grand Jury finds that there is insufficient information exchange among the interviewed water providers regarding cybersecurity threats, attacks, protections and remedies. Response: Agree.
No recommendations for this finding
F08
The Grand Jury finds that there is insufficient awareness among public water providers of available government expert cybersecurity services and support for water provider systems. Response: Agree.
No recommendations for this finding
F09
The Grand Jury finds that not all the investigated water providers' business recovery plans addressed recovery from a cyber incident. Response: Disagree partially. We do not know what business recovery plans other water providers have. However, we at Casitas Municipal Water District have plans in place in case of ransomware. Recommendations:
No recommendations for this finding
* This report's PDF did not contain easily extractable text and required Optical Character Recognition (OCR) for analysis. There may be minor errors in the extracted findings and recommendations due to OCR limitations with scanned documents.