City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: Utilities
Meeting Date: September 14, 2026
Report #:2608-6609
TITLE
Adopt a Resolution approving the City of Palo Alto Utilities Electric Utility Physical Security Plan Update: CEQA Status – Not a Project
RECOMMENDATION
Staff recommend that the City Council:
1. Adopt Resolution (Attachment A) approving the five-year review and update to the City of Palo Alto Utilities Electric Physical Security Plan (Plan).
2. Authorize the Utilities Director to submit notice of the Council's approval of resolution to the California Public Utilities Commission (CPUC) in accordance with Ordering Paragraph 24 of CPUC Decision 19-01-018.
3. Authorize the Utilities Director, or designee, to make future administrative, technical, editorial, or non-substantive revisions to the Plan as necessary, provided such revisions do not materially alter the intent of the Plan or require further City Council action.
EXECUTIVE SUMMARY
The City of Palo Alto Utilities (CPAU) completed the required five-year review and update of its Electric Physical Security Plan in accordance with CPUC Decision 19-01-018 (Phase I Decision on Order Instituting Rulemaking Regarding the Physical Security of Electrical Corporations). The update confirms that the Plan continues to meet the objectives of the Decision and reflects current utility infrastructure, operations, risk assessments, and mitigation measures. The update includes revisions to facility information, risk assessments, mitigation measures, references, and administrative content to improve clarity, accuracy, and consistency. The City’s Office of Emergency Services completed the independent review, and the Palo Alto Fire Department completed the validation. Recognizing the need for confidentiality of its contents, the City Manager has reviewed the plan and confirmed that no substantive policy issues are raised by its findings and implementation. Staff recommend that the City Council adopt a
resolution approving the five-year review and update and authorizing the Utilities Director to provide notice of the approval action to the CPUC.1
BACKGROUND
On April 16, 2013, the physical attack on Pacific Gas and Electric Company's Metcalf Transmission Substation prompted federal and state efforts to strengthen electric utility physical security. Following Senate Bill 699 (2014), the CPUC initiated a proceeding to develop risk-based physical security standards for electric utilities.
In January 2019, the CPUC adopted Decision 19-01-018, which established an industry framework for investor-owned and publicly owned electric utilities to identify “Covered Distribution Facilities”, evaluate physical security risks, develop mitigation plans where appropriate, obtain independent review, validate the assessment, and periodically review and update their Utility Security Plans2.
On September 13, 2021, the City Council adopted Resolution No. 99853 approving CPAU's initial Plan. That plan documented CPAU's evaluation of its electric distribution facilities, identified Covered Distribution Facilities, assessed physical security risks, developed mitigation strategies where appropriate, completed an independent third-party review and qualified authority validation, and authorized staff to provide notice of plan adoption to the CPUC. The resolution also directed CPAU to continue maintaining the Plan and to perform a review every five years.
DISCUSSION
The update represents a comprehensive review of the Plan and confirms that the Plan continues to meet the objectives established by Decision D.19-01-018 while reflecting current utility operations, infrastructure, and risk assessments.
CPAU followed the six-step process outlined in the Joint IOU/POU Straw Proposal and Decision D.19-01-018, Section 6.1 to conduct its review and update.4 The six steps are as follows:
1 Per D.19-01-018 “24. Publicly Owned Utilities shall conduct a program review of their Security Plan and associated physical security program every five years after initial approval of the Security Plan by their Board of Directors or City Council. Notice of such approval action shall be provided to the Commission’s Safety and Enforcement Division within 30 days of Plan adoption by way of copy of signed resolution or letter by a responsible elected- or appointed official, or utility director.” (see page 54 of D. 19-01-018 https://docs.cpuc.ca.gov/PublishedDocs/Published/G000/M260/K335/260335905.PDF.) 2 Per D.19-01-018 “covered is the utility working group term employed to describe those assets that are applicable, or that should be subject to physical security.” For purposes of this Plan, CPAU has determined that Covered Distribution Facilities include Distribution Substations, but not Distribution Control Centers, since analysis of Distribution Control Centers is applicable to Investor-Owned Utilities only (see pages 35 and 49 of D. 19-01-018.) 3 Resolution No. 9985
https://recordsportal.paloalto.gov/WebLink/DocView.aspx?id=61446&dbid=0&repo=PaloAlto&searchid=c55f33a4-84b0-48aa- aa61-74380efefe0d
4 Per D.19-01-018 , Section 6.1 “SED RASA recommends the following six-step procedure for carrying out new physical security plan requirements to address utilities’ distribution assets. ” (see pages 32-34 of D. 19-01-018 https://docs.cpuc.ca.gov/PublishedDocs/Published/G000/M260/K335/260335905.PDF.) STEP 1: Assessment/Plan Development
CPAU staff and/or consultants prepare a Draft Utility Security Plan with any necessary updates through the process set forth in Steps 1A, 1B, and 1C.
STEP 1A: Identify Covered Distribution Facilities
CPAU evaluates whether there are any changes in its facilities meeting D.19-01-018’s definition of a “Covered Distribution Facility” using the seven factors identified in the Joint IOU/POU Straw Proposal.
STEP 1B: Perform risk assessment
For every individual Covered Distribution Facility identified pursuant to Step 1A, CPAU performs an evaluation of any updates to the potential risks associated with a successful physical attack on that Covered Distribution Facility, and whether existing grid resiliency, back-up generation, and/or physical security measures appropriately mitigate identified risks.
STEP 1C: Develop mitigation plan
If there are any individual Covered Distribution Facilities where the Risk Assessment updates performed pursuant to Step 1B finds that the existing mitigation and/or resiliency measures do not effectively mitigate the identified risks, then CPAU will develop a Mitigation Plan for that Covered Distribution Facility. The Mitigation Plan will use a risk-based approach to select reasonable and cost-effective measures that can either be security focused (e.g., walls or alarms) or resiliency focused (e.g., adequate spare parts).
STEP 2: Independent review
For every Utility Security Plan cycle, CPAU will document the results of the identification process, risk assessment, and Mitigation Plan development performed pursuant to Steps 1A, 1B, and 1C. This documentation in combination with narrative descriptions constitutes CPAU’s Draft Utility Security Plan. Each Draft Utility Security Plan is submitted to a Qualified Third Party for Independent Review. The Qualified Third-Party Reviewer will then issue an evaluation that identifies any potential deficiencies in the Draft Utility Security Plan as well as recommendations for improvements. The combination of the Draft Utility Security Plan, the conclusions of the Qualified Third-Party Reviewer, and CPAU’s responses to the Qualified Third- Party Review will constitute CPAU’s Utility Security Plan. The City’s Qualified Third-Party reviewer is the Palo Alto Office of Emergency Services.
STEP 3: Validation
CPAU submits its Utility Security Plan to a Qualified Authority for validation on the overall adequacy of the Plan. The Qualified Authority must have sufficient familiarity with relevant federal, state and local standards regarding critical asset protection and emergency response.
The City’s Fire Department agreed to serve as the Qualified Authority for this validation step, and will provide additional feedback and evaluation of CPAU’s Utility Security Plan and may deem the Utility Security Plan adequate.
STEP 4: City Council Approval Action and Notice to CPUC CPAU’s Physical Security Plan will be adopted through approval action by the City Council at a public meeting. Recognizing the need for confidentiality of its contents, the City Manager has reviewed the plan and confirmed that no substantive policy issues are raised by its findings and implementation. A copy of the resolution adopting the Plan will be provided to the CPUC STEP 5: Maintenance
CPAU will refine and update its Utility Security as appropriate and as necessary to preserve plan integrity. To the extent security measures require Council action such as the Surveillance and Privacy Protection Ordinance, staff will bring those forward separately.
STEP 6: Repeat process
CPAU will conduct a review of its Security Plan and associated physical security program at least once every five years.
For security reasons, staff are not attaching the updated Plan or naming actions to improve physical security at the facilities identified with this report. Internally, staff will continue to refer to the Plan, CPUC regulations, and industry best practices to continually improve physical security for the identified facilities and other electric infrastructure owned and operated by the City’s Utility Department.
FISCAL/RESOURCE IMPACT
Preparation of the Plan update was completed using existing staff resources and consultant support. Implementation of future physical security improvements identified through CPAU's ongoing asset management and capital planning processes will be evaluated and funded through future operating and capital budgets, as appropriate.
STAKEHOLDER ENGAGEMENT
Preparation of the Plan update included coordination among the City of Palo Alto Utility staff, the Office of Emergency Services, and Fire Department.
ENVIRONMENTAL REVIEW
Approval of the Plan Update is administrative in nature and not a Project subject to review under the California Environmental Quality Act (CEQA) (CEQA Guidelines Section 15378(b)(5)).
ATTACHMENTS
Attachment A: Resolution
APPROVED BY:
Alan Kurotori, Director of Utilities