b^ PA^
0 ^
^
^
0 7
* •N
(0 z:
0 (D
0 <Z)
~^
-0 .</
0 ^
L^rio
^
Attachment B
Agenda Report
I
June 14. 2021
TO: Honorable Mayor and City Council
FROM: Water and Power Department
SUBJECT: ADOPTION OF THE WATER AND POWER DEPARTMENT'S UTILITY PHYSICAL SECURITf PLAN
t
i
i
RECOMMENDATION:
It is recommended that the City Council;
1. Find that the proposed action is not a project subject to the California Environmental Quality Act ("CEQA") pursuant to Section 21065 of CEQA and Sections 15060(c)(2), 15060(c)(3), and 15378 of the State CEQA Guidelines and, as such, no environmental document pursuant to CEQA is required; and
; 2. Adopt the Water and Power Department's ("PWP") Utility Security Plan ("Plan") ini compliance with California Public Utilities Commission ("CPUC") Decision D.19-01-018.
BACKGROUND:
: In recognition of threat to electric distribution facilities and consequential risk of long-term I power outage, California legislature enacted Senate Bill 699 ("SB 699") in 2014. SB699 ! directed the CPUC to adopt rules to identify and address the physical security risks to I distribution systems of electrical corporations. ; In response to SB 699, the CPUC has issued new requirements (Decision D.19-01-018) j for Investor-Owned Utilities ("IOU") and Publidy-Owned Utilities ("POU") to develop plans that identify and address security risks to distribution facilities including control centers.The CPUC security plan submittal by POUs such as PWP, is due July 10, 2021 . , Generally, POUs such as PWP are not within the jurisdiction of the CPUC, however, the i CPUC asserts that "Sections 8001-8057, read in light of the Polk decision, make it clear ! that the CPUC has^the authority to apply physical security rules created through this ; rulemaking to the POUs." ; In working with CPUC, California's electric utilities (lOUs and POUs) jointly developed a ; Straw Proposal for a process to identify facilities that may be at-risk ("Covered Distribution !
I
I
I
!
j
•:.;:
t
J
MEETING OF 06/14/2021 AGENDA ITEM NO. 8
Adoption of PWP Utility Security Plan
June 14, 2021
In working with CPUC, California's electric utilities (lOUs and POUs) jointly developed a Straw Proposal for a process to identify facilities that may be at-risk ("Covered Distribution Facilities") and, if necessary, develop physical security mitigation plans. A Covered Distribution Facility is any distribution facility that falls into one of the following categories:
<•
Necessary for crank path, black start, or capability essential to the restoration of regional electricity service that is not subject to the California Independent SystemOperator's operational control and/or subject to NERC's Reliability Standard Primary source of electrical service to a military installation essential to nationalsecurity and/or emergency response servicesServes installations necessary for the provision of regional drinking water suppliesand wastewater servicesServes a regional public safety establishment Serves a major transportation facility
Serves a Level 1 Trauma CenterServes over 60,000 meters The CPUC required utilities to follow a six-step process in development of their Plans:
Step 1: Assessment/Plan Development
Identification of "Covered Distribution Facilities"
ii. Risk Assessment/Mitigation Plan Development
iii. Develop Mitigation Plan
Step 2: Independent Third-Party Review and Utility Response Step 3: Qualified Authority Validation of the Utility Security Plan Step 4: Adoption of the Utility Security Plan
Step 5: Maintenance of the of the Utility Security PlanStep 6: Repeat the Six-Step Process at least once every five years PWP's Utility Security Plan
In order to comply with the CPUC requirements, PWP has developed a Plan which thoroughly analyzed all PWP distribution facilities.Step 1: PWP determined that three of its facilities are identified as "Covered Distribution Facilities". The existing physical security and resiliency measures at those facilities have been examined and determined to be adequate in order to mitigate a potential physical threat. Due to public safety and security reasons the Covered Distribution Facilities are not identified in this agenda report.
Step 2: PWP contracted with Cooper Compliance, Incorporated to conduct an independent review as required by the CPUC order. Cooper Compliance reviewed the Plan, determined that the assessment methodology is sufficient, and that the results are accurate and consistent with good industry practices for physical security of critical infrastructure.
Adoption of PWP Utility Security Plan
June 14, 2021
validate the Plan. The PPD Counter Terrorism Unit Supervisor conducted site inspectionsat PWP distribution facilities, including the Covered Distribution Facilities, and validated the Plan in addition to providing recommendations to enhance existing fencing, addadditional locking devices, perimeter lighting, and numeric access keypads at the Covered Distribution Facilities. PWP is in the process of implementing the recommendations.
The Plan also incorporates the CPUC order requirement that the utility mitigation plans include a detailed narrative explaining how the utility has:
(1) An asset management program for tracking and locating spare parts stock, ensuring availability and the rapid dispatch of available spare parts; (2) A robust workforce training and retention program to employ a full roster of highly-qualified sen/ice technicians able to respond to make repairs in short order throughout a utility's service territory; and,
(3) A preventative maintenance plan for security equipment to ensure that mitigation measures are functional and performing adequately.
The proposed Plan is fully compliant with the CPUC requirements and PWP is committedto appropriately maintaining and updating the Plan (Steps 5 and 6). The Plan is required to be reviewed and updated in intervals of no less than five years. The attached copy of thePlan (Attachment A) has been revised to exclude certain details for security reasons.
PWP respectfully recommends adoption of its unrevised Plan (Step 4) in compliance with CPUC Decision D. 19-01-018.COUNCIL POLICY CONSIDERATION:
PWP's Plan is consistent with the City Council's strategic goals to maintain fiscalresponsibility and stability, and to ensure public safety.
ENVIRONMENTAL ANALYSIS:
The proposed action is not a project subject to CEQA in accordance with Section 21065 of CEQA and State CEQA Guidelines Sections 15060(c)(2), 15060(c)(3), and 15378. The adoption of the proposed Utility Physical Security Plan is an organizational andadministrative action that would not cause either a direct physical change in theenvironment or a reasonably foreseeable indirect physical change in the environment.Therefore, the proposed action is not a "project" subject to CEQA, as defined in Section 21065 of CEQA and Section 15378 of the State CEQA Guidelines. Since the action is not a project subject to CEQA, no environmental document is required, Adoption of PWP Utility Security Plan
June 14, 2021
FISCAL IMPACT:
There is no fiscal impact as a result of adopting the Plan. There will be no anticipated impact to other operational programs or capital projects as a result of this action.
Respectfully submitted,
GURCHARAN S. BAWA
General ManagerWater and Power Department
Prepared by:
^^ 0,^^-^
Marvin D. Moon
Assistant General ManagerWater and Power DepartmentApproved by:STEVE MERMELL City Manager
ATTACHMENT A - PWP Utility Physical Security Plan (public version)
CITY OF PASADENA
WATER & POWER
UTILITY
SECURITY
PLAN
PUBLIC REPORT ON PWP'S PHYSICAL SECURITY PLANFOR DISTRIBUTION-LEVEL FACILITIES June ] 4,202]
TABLE OF CONTENTS
I. Overview..........................................................................................
A. Goal of Utility Security Plan..........................................B. Description of PWP.............................................................C. Results of Utiiity Security PLan Assessment...........................
II. BACKGROUND..........................................................................
III. Plan development process................................................
A. Physical Security Principles.............................................
B. Utility Security Plan Development Process...................
STEP 1: Assessment/Plan Development.....................................
STEP 1A: Identify Covered Distribution Facilities.......................
STEP 1B: Perform risk assessment.................................................
STEP 1C: Develop mitigation plan .........................................STEP 2: Independent review.......................................................
STEP 3: Validation...........................................................................
STEP 4: Adoption......................................................................
STEP 5: Maintenance....................................................................
STEP 6: Repeat process..........................................................
IV. Identification of Covered Distribution Fociliites (Step 1 A) A. Identification Factors...............................................................
B. Identification Analysis........................................................
V. Risk Assessment (Step 1 B).........................................................
A. Methodology...........................................................................
B. Mitigation Measures...............................................................
C. Risk Assessment................................................................. .......4
................4
.....6
....8
................8
.....8
....8
.....8
................9................9
.........,......9
..............10
....10
..10
............10
..............12
..............14
..14
•••I>I•*••••
1. Security Index................................................................................
2. Resiliency Index...............................................................................3. Risk Index..................................................................,..,......—...........
VI. Distribution Facilities Upgrade/Reptacement Plans (Step 1C) VII. Independent Evaluation and Response (Step 2)....................
A. Requirements for A Qualified Third-Party Review.......................
B. Identification of Third-Party Reviewer....................................C. Public Results of Third-Party Evaluation........................................
D. PWP Response..............................................................................
VIII. Validation (Step 3)..........................................................................
A. Selection of A Qualified Authority..........................................
B. Results of The Qualified Authority Review...................................
C. PWP Response to THE QualiFled Authority Review.....................
IX. Narrative Descriptions for Utility Security Plan...........................
A. Asset Management Program............................................
B. Workforce Training and Retention Program..........................C. Preventative Maintenance Plan.............................................. .......16.......16
...18
.......22
.......24
......25
.......25
....25
........26
........26
.......27
....27
...27
.......27
........28........28
..28
...so
IS
I. OVERVIEW
A. GOAL OF UTILITY SECURITY PLAN
Ensuring the safety of its facilities is a top priority for The City of Pasadena, Water and PowerDepartment ("PWP"), and PWP prioritizes safety in all aspects of its design, operation, and maintenance practices. The overarching goal of this Utility Security Plan is to describe PWP's riskmanagement approach toward distribution system physical security, with appropriateconsideration of resiliency, impact, and cost.PWP recognizes the importance of securing the safety and reliability of its electric system and, therefore, PWP voluntarily participated in the California Public Utilities Commission's (CPUC) Physical Security proceeding and has undertaken this assessment. In the spirit of continuedvoluntary cooperation, PWP offers the following in response to CPUC Decision 19-01-018.
I
.i
B. DESCRIPTION OF PWP
Pasadena is an ethnically diverse community thai is home to more than 140 thousand peoplemaking it the 183rd-largest city in the United States. As the ninth largest city in Los Angeles County. Pasadena is one of the primary cultural center of in the San Gabriel Valley. The City covers approximately 22.5 square miles, with an average of ten residents per acre. The medianage of its residents is approximately 36.9 years. There are over 100,000 jobs in a wide variety ofindustries in the City of Pasadena. Pasadena is the home for the Rose Bowl and annual RoseParade.PWP's power delivery system consists of three (3) receiving stations and eleven (11) distribution substations, twenty-seven 34-kV subtransmission lines, and 117 distribution feeders operating at 17-kV and 4-kV. There are 54 power transformers and approximately 300 circuit breakers.
About 75% of PWP's distribution system lines are installed in underground conduits. The subtransmission system ties the supply of power from the east and west ends of Pasadena todistribution substations throughout the city. PWP-owned generation consists of five generators totaling approximately 200 MW; two 220-kV Southern California Edison (SCE) lines interconnects PWP electric system to the California Independent System Operator ("CAISO") at the main PWP Receiving Station. PWP can import up to 336MW per a signed contract between PWP and SCE utilizing three 220-kV/34-kV power transformers.
PWP Utility Security Plan
XXXXXX.XX.2021
4 C. RESULTS OF UTILITY SECURITY PLAN ASSESSMENT
After evaluating all distribution-level facilities in PWP's service territory, PWP decided to assess alltwelve (12) distribution level facilities under its control. These consist of nine (9) distribution substations, one (1) receiving station and two (2) combined receiving and distributionsubstations. Out of these facilities, only three were identified and evaluated as "Covered Distribution Facilities" per the joint IOU/POU Straw Proposal screening factors and are subject to the need for a risk assessment. For these three covered distribution facilities, PWP performed on evaluation of the potential risk of a potential physical attack and whether existing security and resiliency measures appropriately mitigate identified risk.
After determining the three candidate facilities for risk assessment, PWP developed a scoringmethod to determine the Risk Index for each of the covered facilities. The Security Index and Resiliency Index were developed by assigning a score between 0-10 to multiple categories asshown in the Risk Assessment section. After the total security and resiliency computation was processed, the Risk Index for each individual facility was calculated as follows Risk IndexFaciUty i = Security Index^cMty i * Resiliency Index i.-acuuy i B
PWP determined that the three Covered Distribution Facilities have sufficient existing security and resiliency measures in place to effectively mitigate the identified risks of a successful physical attack.In addition. Section VI describes additional upgrade and/or replacement plans for the existing electronic surveillance and lighting systems the Covered Distribution Facilities.An independent evaluation- conducted by Cooper Compliance Inc. as the third party reviewerfound PWP's assessment methodology to be sufficient and the results to be accurate and consistent with good industry practices for physical security of critical infrastructure.
IliI
Ir
;•
rPWP Utility Security Plan
XXXXXX,XX,2021
5 II. BACKGROUND
On April 16, 2013, one or more individuals attacked equipment located within Pacific Gas and Electric Company's (PG&E) Metcalf Transmission Substation, ultimately damaging 17transformers. These individuals also cut nearby fiber-optic telecommunication cables owned byAT&T and Level Three Communications. In response to the attack, the Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability Corporation (NERC) to develop new physical security requirements, resulting in the creation of CIP-014.
At the state level, Senator Jerr/ Hill authored SB 699 (2014), directing the CPUC to "consider adopting rules to address the physical security risks to the distribution systems of electrical corporations." In response to SB 699, the CPUC's Safety and Enforcement Division, Risk Assessment and Safety Advisory Section (RASA) prepared a white paper proposing a new requirement for investor-owned utilities (lOUs) and publicly owned utilities (POUs) to develop security plans that would identify security risks to their distribution and transmission systems andpropose methods to mitigate those risks. The CPUC hosted a series of workshops to betterunderstand the state of utility physical security protections and to seek input on refining their proposal.
In order to support a statewide improvement of how utilities address distribution level physicalsecurity risks, the California Municipal Utilities Association (CMUA), which is the statewide tradeassociation for POUs, coordinated with the state's IQUs to develop a comprehensive StrawProposal' (Joint IOU/POU Straw Proposal) for a process to identify at-risk facilities and, if necessary, develop physical security mitigation plans. As a member of CMUA, PWP staff participated in the development of the Joint IOU/POU Straw Proposal through a CMUA workinggroup as well as through direct meetings with the lOUs. The Joint POU/IOU Straw Proposal set outa process for the following: (1) identifying if the utility has any high priority distribution facilities; (2)evaluating the potential risks to those high priority distribution facilities; (3) for the distribution facilities where the identified risks are not effectively mitigated through existing resilience/securily measures, developing a mitigation plan; (4) obtaining a third party reviews the mitigation plans; (5) adopting a document retention policy; (6) ensuring a review process established by the POU governing board; and (7) implementing information sharing protocols.RASA filed a response2 to the Joint IOU/POU Straw Proposal that recommended variousmodifications and clarifications, including a six-step process. Additionally, RASA recommendedthat the utility mitigation plans include: (1) an assessment of supply chain vulnerabilities; (2) training programs for law enforcement and utility staff to improve communication duringphysical security events; and (3) an assessment of any nearby communication utility infrastructure that supports priority distribution substations.' Straw Proposal available at:
h!tDs,,;wv> A., (.......,;.,),.....\.pi,;>adedl-iles/CPUCWebsite/Content/Satetv/Risk Assessment/Dhvsicalsecuritv/RISO&OO?' Upda!e^2Q,^U^A^-S2!.)e'9p05Vl°S2{X?nc.)%2(?Cpv9'^2(5093117%20Filinq,p<,ir. 2 SED Response available at:httc.5://wwA.ct.;.j^..^....iO,'/uDloQdedhiei/CPUCWebsite/Conlent/Sofetv/Risk Asses5ment/Dhysicoisecuritv/Final%205tQlt %20Recoinrt,-n.'Jai.c.'^2Q^!%20Conirni»ion%20Coniideration%20010318.Ddf. t
PWP Utility Security Plan
XXXXXX,XX,2021
6 l.if^.isS.i.-.
In early 20)9. the CPUC approved Decision (D.) 19-01-018, which adopted the Joint IOU/POU Straw Proposal as modified by the RASA proposal, with additional clarifications and guidance.D.19-01-018 clarified that where there is a conflict between the Straw Proposal and the RASA proposal, then it is the rule in the RASA proposal 1hat controls.3D.19-01-018 asserted that the POUs should utilize the Utility Security Plan process describedtherein. PWP is following the process and issuing this report at this time to reflect its existing commitment to safety and to protecting its ratepayers' investment by taking reasonable and cost-effective measures in an effort to safeguard key assets of its distribution system. s'.
;
•f-...
f.
i:
I
t
({If
s
ff,
!
3 D.19-01-0)8 at 43. footnote 58 ("Should there be any question of which shall predominate should there be anyincongruity or conflict between a utility or SED RASA recommended rule. the SED RASA rule shall apply.").
I
PWP Utility Security PlanXXXXXX.XX.2021
7 £
III. PLAN DEVELOPMENT PROCESS
A. PHYSICAL SECURITY PRINCIPLES :' ^^ass. •^ •M:^t'
PWP has taken a risk-based approach toward distribution system physical security, with appropriate considerations of resiliency, impact, and cost. This approach, consistent with theJoint IOU/POU Straw Proposal, identified several principles to guide the development of PWP's security plan. These principles are the following:
1. Distribution systems are not subject to the same physical security risks and associated consequences, including threats of physical attack by terrorists, as the transmission system.2. Distribution utilities will not be able to eliminate the risk of a physical attack occurring, but certain actions can be taken to reduce the risk or consequences, or both. of a significant attack.3. A one-size-fits-all standard or rule will not work Distribution utilities should have the flexibility to address physical security risks in a manner that works best for their systems and unique situations, consistent with a risk management approach.
4. Protecting the distribution system should consider both physical security protection andoperational resiliency or redundancy.5. The focus should not be on all Distribution Facilities, but only those that risk dictates would require additional measures.
6. Planning and coordination with the appropriate federal and state regulatory and law enforcement authorities will help prepare for attacks on the electrical distribution systemand thereby help reduce or mitigate the potential consequences of such attacks.
B. Utility Security Plan Development Process
PWP utilizes a multi-step process to develop a Security Plan that is consistent with the Joint IOU/POU Straw Proposal and D.19-01-018. The relevant six steps of that process are the following:
ISTEP 1: ASSESSMENT/PLAN DEVELOPMENT
PWP prepares a Draft Utility Security Plan through the process set forth in Steps )A, 1B, and 1C. [ST^I A: IDENTIFY COVERED D^
PWP evaluates all distribution-level facilities in its service territory that are subject to its control to determine if any of these facilities meet D. 19-01-018's definition o( a "Covered Distribution Facility" using the seven factors identified in the Joint IOU/POU Straw Proposal.
I
PWP Utility Security Plan
XXXXXX,XX,2021
8 STEP 18: PERFORM RISK ASSESSMENT
For every individual Covered Distribution Facility identified pursuant to Step 1 A, PWP performs an evaluation of the potential risks associated with a successful physical attack on that facility, and whether existing grid resiliency, back-up generation, and/or physical securily measures appropriately mitigate identified risks.
STEP 1C: DEVELOP MITIGATION PLAN
If there are any individual Covered Distribution Facilities where the Risk Assessment performed pursuant to Step I B finds that the existing mitigation and/or resiliency measures do noteffectively mitigate the identified risks. then PWP will develop a Mitigation Plan for that CoveredDistribution Facility. The Mitigation Plan will use a nsk-based approach to select reasonable and cost-effective measures that can either be security focused (e.g., walls or alarms) or resiliency focused (e.g., adequate spare parts).
[STEP 2: INDEPENDENT REVIEW
For every Utility Security Plan cycle, PWP will document the results of the identification process. risk assessment, and Mitigation Plan development performed pursuant to Steps 1A, 1B, and 1C.
This documentation in combination with narrative description in Section IX, constitutes PWP's Draft Utility Security Plan. The Draft Utility Security Plan is submitted to a Qualified Third Party for Independent Review. The Qualified Third-Party Reviewer will then issue an evaluation thatidentifies any potential deficiencies in the Draft Utility Security Plan as well as recommendationsfor improvements. PWP will then modify its plan to address any identified deficiencies or recommendations or will document the reasons why any recommendations were not adopted.The combination of the Draft Utility Security Plan, the non-confidential conclusions of the Qualified Third Party Reviewer, and PWP's responses to the Qualified Third Party Review will constitute PWP's Utility Security Plan.
STEP 3: VALIDATION
PWP will submit its Utility Security Plan to a qualified authority for review. Such entity will provide additional feedback and evaluation of PWP's Utility Security Plan and, to the extent that thisentity is authorized, such entity deems the Utility Security Plan as adequate.
STEP 4: ADOPTION
PWP's Utility Security Plan will be presented to and adopted by Pasadena City Council at apublic meeting. fssiPWP Utility Secufity Plan
XXXXXX,XX,2021
9 STEP 5: MAINTENANCE
PWP will refine and update the Utility Security as appropriate and as necessary to presen/e plan integrity.
I STEP 6: REPEAT PROCESS
PWP will repeal this six-step process at least once every five years, IV. IDENTIFICATION OF COVERED DISTRIBUTION FACILIITES (STEP 1A) As described in Section III, Step 1 A of the Utility Security Plan process involves assessing all distribution-level facilities that are subject to the control of PWP to determine which facilities are "Covered Distribution Facilities" subject to the need for a risk assessment. This Section describesthe factors that PWP used to evaluate its distribution facilities and the results of its evaluation.
I
A. IDENTIFICATION FACTORS m
The Joint IOU/POU Straw Proposal defines seven screening factors to determine if a facility is a "Covered Distribution Facility." Some factors require additional definitions and/or clarifications in order to be applied to PWP's facilities. The following Table provides the Joint IOU/POU Straw Proposal's Factors as modified/clarified by PWP.
Table IV-1: Identification Factor!
Factor Joint IOU/POU Straw Proposal Description Additional Clarification 1 Distribution Facility necessary for crank patn,black start or capability essential to therestoration of regional electricity service that arenot subject to the California Independent SystemOperator's (CAISO) operational control ond/orsubject to North American Electric ReliabilityCorporation (NERC) Reliability Standard CIP-014-2 or its successors PWP identified one distribution facility thatmay be utilized -if necessary- as a crankpath in order to black start PWP generatorsat the Power Plant. This facility is not subjectto CAISO's control. Furthermore. CIP-014-2 isnot applicable to any of PWP facilities. 2 Distribution Facility that is the primary source ofelectrical service to a military installationessential to national security and/or emergencyresponse services (may include certain airfields.command centers, weapons stations.emergency supply depots) City of Pasadena does not house anymilitary facility whether it is for the state ornational army. 3 Distribution Facility that serves installationsnecessary for the provision of regional drinkingwater supplies and wastewater services (mayinclude certain aqueducts, well fields.groundwater pumps, and treatment plants) An installation provides "regional drinkingwater supplies and wostewater services' if itis the primary source of drinking watersupply or wastewater services for over 15,000 customer accounts for an area with
a population of over 100.000.
PWP Utility Security PlanXXXXXX,XX,2021
10 Saas-
•i
PWP provides water services to about40.000 customers. There are 19 non-regionalwater installations within the boundaries ofPasadena. These water installations arebeing served by six different electric PWPdistribution facilities. Multiple circuits couldbe utilized to serve any of theseinstallations. Three out of 19 -Aa'&i facilitiescould be without power for four (4) hourswhile the res1 of the facilities will stayoperational for more than 24 hours.In addition, water installations are interconnected and could support eachother. One PWP distribution facility wasconsidered very critical for water facilities incase of prolonged outages. 4 Distribution Facility that serves a regional publicsafety establishment (may include CountyEmergency Operations Centers: county sheriff'sdepartment and major city police deportmentheadquarters: major state and county fireservice headquarters; county jails and state andfederal prisons: and 911 dispatch centers) PWP defines "regional public safetyestablishment" as any of the following: (!)Headquarters of a major police or firedepartment serving 1.5 million populationwith at least 1.000 sworn officers; (2) CountySheriff's Department Headquarters; |3)County Emergency Operations Center; (4)County/State Fire headquarters: (5) aCalifornia State Prison: (5) a United StatesPenitentiary: or (6) a Federal CorrectionalInstitute.City of Pasadena has its own Police andFire departments. Police department has238 sworn officers stationed only in onebuilding including the 911 Dispatch Center.The Fire department has Eight Stationsserving the City of Pasadena and adjacentneighborhoods. No Federal. State orCounty law enforcement offices are withinthe borders of Pasadena.One distribution facility was considered ascritical for emergency services. 5 Distribution Facility that serves a majortransportation facility (may include InternalionalAirport. Mega Seaport, other air traffic controlcenter, and international border crossing) In addition to the facilities listed in the JointIOU/POU Straw Proposal, PWP defines a"major transportation facility" as anytransportation facility that has (I) anaverage of 600 or more flights per day: or(2) over 50,000 passengers arriving ordeparting per day.None of the above facilities exists within inthe borders of Pasadena. However, PWPserves six LA County Gold Line train stations(none of them is a hub or a major station).Gold Line transports less than 50.000passengers a day utilizing all of its 27stations.
PWP Utility Security Plan
XXXXXX.XX.2021
n
&
Distribution Facility that serves as a Level 1Trauma Center as designated by the Office ofStatewide Health Planning and Development.
City of Pasadena serves only one Level 2Trauma Center (t-tuntington MemorialHospital) within its boundaries. No otherTrauma Center is within the service arec ofPasadena Water and Power. City ofPasadena has its own health departmentthat provide critical services to citizens allyear around. These services are essential infighting the Covid-19 pandemic.No single distribution facility was identifiedas critical for the operation of HuntingtonMemorial Hospital since multiple distribution facilities are providing service/back up tothe hospital. 7 Distribution Facility that serxes over 60,000 meters None of PWP's Distribution facilities directly serves more than 15,000 customers each.PWP serves approximately 67,000customers. However, one distribution facilitywas considered as critical during summerseason and for water facilities in case ofprolonged outages. The main function ofthis facility is to distribute power to the otherfacility. No customers ore being serveddirectly from this facility ?
i
B. IDENTIFICATION ANALYSIS "ll
In performing this identification analysis, PWP assessed all distribution level facilities under its exclusive control. These consist of nine (9) distribution substations, one (1) receiving station and two (2) combined receiving and distribution substations. PWP is the only entity responsible for operation and maintenance these facilities.Based on this scope, PWP has identified 12 facilities that are subject to this identification analysis.
Of these 12 facilities, three facilities fall within at least one of the categories listed above. Thesethree facilities were evaluated as "Covered Distribution Facilities" per the joint IOU/POU Straw Proposal screening factors and are subject to the need for a risk assessment.
Table IV-2 summarizes the results of PWP's identification analysis. If the final score of any facility isgreater than or equal to one (1), then PWP considers this facility as "Covered Distribution Facility." PWP conducted a Risk Assessment analysis for this facility as described in Section v. i.°
,c
IPWP Utility Security Plan
XXXXXX,XX,2021
12 !<»•-
lable IV.2; IdenWlcatlon Scofw ol Coveted Distribution faclllHn I. Crank 2 MUuv r<nh. wack Inilaltoflon Start
FacllDytl
3. l*aton<>l DrinklnBW<rtM/ WoilewoUttwvtet
«.$a(*lyfalabllshmenl(rolte*/ Hr)
5. Ttnmpoirtoflonracnty
* IfUMnia Ci»nt»*rItvrt 1 / HoIpHolt 7.o»*ti5.nn»tei*n lrt»»rcn»ot< Sim 0 fac»vfl 0FucUWy»3 0l[oclny»4 0faclBy IS 0Podlty •«FacUty •7 ves
0 FacUtyM 0flldlty»» 0
focBtyOO Yes Yes »F<ic1y»ll res I
L F<lctv»12 0
PWP Utility Security PlanXXXXXX.XX, 2021
13 RISK ASSESSMENT (STEP 18)
A. METHODOLOGY
Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, PWP willassess the potential risks associated with a successful physical attack on each of the Covered Distribution Facilities identified in Section IV above. For purpose of this analysis, a physical attack is limited to the following: (1) theft; (2) vandalism: and (3) discharge of a firearm. A "successful physical attack" is limited to circumstances where a theft, vandalism, and/or the discharge of afirearm has directly led to the failure of any elements of the Covered Distribution Facility that are necessary to provide uninterrupted service to the specific load identified in Section IV.In order to perform this risk analysis, PWP evaluates the relative risk that (1)a physical attack on a Covered Distribution Facility will be successful considering the protective measures in place; or (2) that the impacts of a successful attack will be mitigated due to resiliency and other measures in place.
B. MITIGATION MEASURES ||rrS-Nl||l^|
D.19-01-018 identifies the specific mitigation measures that a utility should consider when performing this risk analysis. The following table lists these mitigation measures and provides PWP's additional clarifications that are necessary to apply these measures to the PWP's territory.
Table V-1: Mitigation Measures
Measure | D.19-01-018 Description Additional Clarification 1 The existing system resiliency and/orredundancy solutions (e.g., switching theload to another substation or circuitcapable of serving the load, temporarycircuit ties. mobile generation and/orstorage solutions).
No additional clarification.
2 The availability of spare assets to restore a particular load. No additional clarification.3 The existing physical security protectionsto reasonably address the risk.
DHS personnel surveyed PWP distribution facilitiesin 2018 and provided a report on each facility.These reports provided commendations andrecommendations. PWP launched an upgradeproject to improve security facilities a1 each ofthe distribution facilities per DHSrecommendations. 4 The potential for emergency respondersto identify and respond to an attack in atimely manner.
Each facility is evaluated based on the likelihoodthat a law enforcement officer would generallybe able to arrive at the Covered DistributionFacility within 15 minutes of a report from thepublic of a break-in or attack, or of PWP notifyingthe law enforcement agency of triggering of analarm at the facility.
PWP Utility Security PlanXXXXXX,XX,202)
14 fS^i»^f^SS-S'"i aWfflis—s'iEIWriit
5 Location and physical surroundings,including proximity to gas pipelines andgeographical challenges, and impactsof weather.
PWP evaluated this element based on theproximity of the Covered Distribution Facility topopulated areas and the extent to which theinterior of the facility is shielded from view andaccess due to walls, vegetation, or other physicalobstructions. PWP removed or is in the process ofremoving vegetation that may facilitatebreachino into any of the distribution facility.
A
History of criminal activity at theDistribution Facility and in the area.
PWP evaluated the property crime rates in theimmediate vicinity of the Covered DistributionFacility and compared those crimes rates toproperty crime rotes for the county and the slateto determine if the area is subject to a higher than average incidence of property related crimes.
7 The availability of other sources ofenergy to serve the load (e.g., customerowned back-up generation or storagesolutions).
Police Department including the 91 1 dispatchcenter. Emergency Operation Center and eachof the fire stations within the service area of PWPeach has a backup generator. Each of the TraumaCenter. Cat Tech, the City College, the conventioncenter, and the Rose Bowl has a back-up generator fortheir critical loads. 8 The availability of alternative ways to meet the health, safety, or security. No additional clarification. 9 Requirements served by the load (e.g.,back up command center or waterstorage facilitvl.
No additional clarification.
C. RISK ASSESSMENT
Based on the process described in the Joint IOU/POU Straw Proposal and the direction provided in D.19-01-018, PWP has determined that of the three Covered Distribution Facilities were identified in Section IV, the existing programs and measures effectively mitigate the risks of aphysical attack for the three Covered Distribution Facilities. Due to its criticality in deliveringpower to City of Pasadena specially during hot weather conditions, PWP included Facility #10 inthis assessment even though it is a receiving station only and if was previously assessed as notsubject to NERC's standard CIP-014-2. Facility # 10 main function is to distribute power to otherfacilities and not to sen/e customer loads directly.
This section provides an outline for PWP's methodology to address existing risk in the distribution facilities. The framework will enable PWP to assign an individual score for each of its covered facilities which can later be used to prioritize maintenance activities and capital expenditures interms of physical security of distribution facilities.
A Security evaluation along with a Resiliency assessment provides the basis for a Risk-based approach, where Resiliency is related to the ability of PWP system/facility to recover from an incident, Security is associated with the present deterrents to prevent an intruder(s)/attacker(s)from breaching the facility. Risk is measured as the combination of these two metrics.
The objective of developing this methodology is to properly identify and rate the security distribution facilities that may represent the greatest risk to the PWP power system. In order to carry out this process and achieve valuable results, accurate and updated data is required.
PWP Utility Security Plan
XXXXXX,XX 2021
15 Even though every component of the electric system will ahways have an inherited risk of failure, it is essential for PWP to understand the assets risk level, becoming aware if any failures instance is predictable and have reasonable spare parts to service assets in case of failure. Moreover, cost-effective solutions can be implemented in a timely fashion to avoid -forced or unforcedinterruptions of service that could negatively impact public or staff safety not mentioning system reliability.
The ranking list will help determine -if necessary- the number of facilities to be addressed each year.
PROCESS
The key steps to develop the algorithm are summarized below:
.r
Collect, update, and prepare the data for every distribution facility under analysis.Assign factors and modifiers for Security Index calculation.Compute the security index based on physical and operating conditions.
Identify and quantify impact and consequences of loss/failure for each facility.
Calculate Resiliency Index based on loss/failure effects and impacts.Compute Risk Index for each covered distribution facility.Identify the facilities in the highest risk category.
Schedule upgrade, retrofit or maintenance work, projecting required funds on annual basis, and preparing Capital Improvement Programs (CIPs).
This methodology can be applied to any distribution facility and the analysis is expected to produce useful results only if accurate and updated system data is utilized, as well as staffknowtedge on the system.
1. SECURITY INDEX ^cPhysical Security is accomplished by performing an assessment of the covered facility and the surrounding premises. Security Index is a measure of precautions taken to deter intrudersand restrict their visibility or breach into the facilities, including service interruption to criticalcustomers, and adverse impact on the safety of the public and PWP staff.
The Security Index can be explained as the numerical representation of the facility importance for normal system operation, and the impact to the system if that facility is lost due an attack, theft or vandalism. This metric remains constant until factors affecting itchange. Table V-2 provides details on different factors that impact the calculated securityindex for each facility as modified/clarified by PWP. For simplicity, each security measure wasgiven an equally-weighted score on 10-point scale based on conditions related to this measure as detailed in the following tables.Security Index results are shown in Table V-2: Security Index for Covered Distribution Facilities.
The Security Index for each covered facility is calculated by subtracting the average scorefrom perfect 10 score. s
&
I
g'
PWP Utility Secufity PlanXXXXXX,XX,2021
16 >ifr^^.";«,-.--.
Measure: Fences/ Walls
rwin*w/v»i 's^-S/iLW^iiKiMSSSSaSSSSt&
Chain Link Fence Alone
IBtUfcff^
5 points
Chain Link Fence with Outriggers or Barbed Wire 8 pointsMasonry/Brick Wall Alone 8 pointsMasonry/Brick Wall with Outriggers or Barbed Wire | 10 points Measure: Gates/ Controlled Entry
S^l^eitOWife.g
Chain Link Gate Alone S points
Metal Cote Alone 10 points
Measure: Vegetation Control / Perimeter Clearance
^
NO
PartiallyYes
Measure: Electronic Sun/eillance
'*5ureelltance Condition
NoYes
Measure: lllumination/Motion Sensors
Rliiuiiilnation Condition
NOYes
Measure: Parking Control/Bamers
IjParklng Control/Barrlers Condition
NoPartiallyYes
0 points
5 points
10 points
Score
0 points
10 points
Score
0 points
10 points
Score
0 points
5 points
10 points
PWP Utility Security Plan
XXXXXX,XX.2021
17 Measure: Criminal History in Facility Surroundings
Above Average
^^UUSiil
0 points
At Average 5 pointsBelow Average 10 points
Measure: Existing Gas Lines /Location VulnerabilitY
Existing Ga» lines /location VulnerabilityCondition
Existing Gas Lines / Location is Vulnerable
Scow Si
0 points
Existing Gas Lines / Location is not Vulnerable 5 pointsNo Existing Gas Lines / Location is Vulnerable 5 pointsNo Existing Gas Lines / Location is not Vulnerable 10 points Measure: Required Time for a police car to reach any Substation Time required for a rollce car to reach anySubstation Condition score
More than 15 minutes 0 pointsWithin 10 minutes 5 pointsWithin 5 minutes 10 points Measure: Presence of Critical Customers
Presence o( Critical Curtomers Condition ScoreTwo or more Critical Customers 0 pointsOne Critical Customer 5 pointsNo Critical Customers 10 points
2. RESILIENCY INDEX
.-•<.,
Xi'S;%K^: •sls&B'i®••^
B!sI
K^
The Resiliency assessment of electrical facility is associated with its ability of the distribution system to minimize the negative impacts of infrequently occurring adverse events such as aterrorist attack, theft or vandalism. Resiliency Index is a measure of preparations taken to restore operations of the electric system/circuit due to any incident in the distribution facilities, including service interruption to critical customers that may impact on the safety of the public or PWP staff.
The Resiliency Index can be explained as the numerical representation of the facilityimportance during the operation of electric system, and the impact to the system if thatfacility is lost due an attack. Iheft or vandalism. This metric remains constant until factors PWP Utility Security PlanXXXXXX,XX.2021
18 affecting it change. Table V-3 provides the factors that impact the calculated resiliency index for each facility as modified/clarified by PWP. For simplicity, each resiliency measure was given an equally-weighted score on 10-point scale based on conditions related to this measure as detailed in the following tables.Resiliency Index results are shown in Table V-3: Resiliency Index for Covered Distribution Facilities. The Resiliency Index for each covered facility is calculated by subtracting the overage score from perfect 10 score.
Measure: Circuit Ties within Substation Services Areas
;ulti from Same Substation
i
Vi.m&^^^:^'-^: .' :'.'
One Tie 5 pointsTwo Ties 8 pointsThree or more Ties 10 points Measure; Circuit Ties within Adjacent Substation Services Areas Ties with Adjacent Clrcuns (rom Dltterent
Substation
score
One Tie 5 pointsTwo Ties 8 pointsThree or more Ties 10 points Measure: Availability of Mobile /Free Standing Transformer Availability of Mobile /Free Standing Traniformer ScoreNO 0 pointsYes 10 points Measure: Availability of Back up Generation / Battery Storage to Serve Critical Customers Availability of Back up Geneiatlon / BatteryStorage.to Serve Critical CustomersNo Score
0 points
Yes 10 points
Measure: AyailabilitY of Contracts with yendois for Enflineerina Services or Spare Parts Availability ot t-ontrocts wltn vendors torEngineering Services and/or Spare Parts Score
No Contracts for Engineering Services nor SparePorts
0 points
Availability of Contracts for either EngineeringServices or Spore Parts 5 points
Availability of Contracts for both EngineeringServices or Spore Parts 10 points
PWP Utility Security Plan
XXXXXX.XX, 2021
19 Measure: Availability of PWP Emergency Responders
No 0 pointsYes 10 points
Measure: Availability of Mutual Aid Agreements on Local, State and National Levels AvadablBty o( Mutual Aid Agreemenh tds^i. ScoreLocal Level 5 pointsLocal and State Levels 8 pointsLocal. State and National Levels 10 points Measure: Ability to Remotely Isolate/ Restore Services
AbHity to Remotely Isolate/ Restore Services Score
None 0 pointsPartially 5 points
All equipment 10 points
Measure: Ability to Provide Services Under N-1 Conditions N-1 ReliabilityNo 0 points
Partially - Excluding periods of extreme heatwaves 5 pointsAll Times including periods of extreme heatwaves 10 points Measure: Presence/Readiness of Backup DisDatch /Command Center I
i?
II
y:
s'
c
i
I
El
Presence of Critical Customers Condition
,_LA^Si^ .:—^%^S!X^SKiSS]i^'^'. •^':^
No 0 pointsPartially 5 pointsAll Times including periods of emergency state 10 points PWP Utility Security PlanXXXXXX.XX.2021
20 labte V 2: Security Index fo< Coverd Dlttrlbutton facines Subilallon Hem* f»nc»>/ Wall Cafn V»o«<a«ot! Conhot/r»rima1»t Ctwionc* Unhonlc »umm<inc« mumlnutton ' Molon $»mo«« faiklna Conlrob /tarritn Crtmlnol Hfatmy Ga> Un«l /locatton VulnwnbWy Dm* loi ro to reach any SubtkiKon Cilteal Cwtomtn Sftt-urtty 1«-*" hlt—yM t 10 n 5 5 0 3.80
foclytlO 7 10 13 5 5 5 5 0 3"0tocB^tII 9 s 10 11 5 i s s 6 330 Table V.3: •etflency Index lo< Coveted Dlttrtbulton FoclMlet Subrtufton tam»
FacBtV6
TteiWHhtr
SubrtoDof
Smvlc*
AtKI
TteiwtthCliculhfcom an
Acgacwnt
Subdatton
10 Noblle /hn
Slondlng
homtwmw
10 tockyp
G»n«otton /
laffefy
Storaa*
0 0
V»ndon on
Conftad
(ram o<
SWVICM)
i
fWf
Emfg»ncy11—pondmi
MuftialAllt
Afli—nrnh
10 10
AWUtrto
botal./
wrtoc
0 N-1
l.11aMllt
10 »ockup
Otipofeh
/Command
Cfllm
10 XwlSartii.v
ttxtoK
.5^;:
3.50 lac-V •10 10 0 0 0 i 10 10 0 10 10 4.5Crac—ytll 10 10 0 0 s 10 10 0 10 10 3.50 PWP Utility Security PlanXXXXXX.XX.2021
21 rStftasjE([iiffiS!^!3a(a»E(8^^Ei^iW ^Ji?s^%y')»»^
I
I
II
s
!.
3. RISK INDEX
After the Security and Resiliency computation process is finished, a Risk Index for eachindividual facility is calculated, as follows:
Risk litdexpacttity i = Security /ndcxpacdity i * Resiliency Index^acitity i Asset management systems usually represent risk calculation in a matrix, where the horizontal and vertical axis represent the Resiliency and Security scores between 1 and 10, respectively.
The cells inside the matrix are the resulting risk index between 1 and 100, as shown Table V-4. !•
Table V-4: Distribution FoclBty Rbk Index Matrix (Security x ReslHency) I.1
u
</>
10 10 20 30 40 50 60 70 wo
9 18 27 36 45 54 63 72
8 16 24 32 40 48 56 64 72
7 14 21 28 35 42 49 56 63 70 7
6 12 18 24 30 36 42 48 54 60 65 10 IS 20 25 30 35 40 45 504 12 16 20 24 28 32 36 40 43 6 9 12 15 18 21 24 27 30 3 2 4 6 8 10 12 14 16 18 20 2
2 3 4 5 6 7 8 9 10
1 1 2 34567
Resiliency Index
9 10
After performing the risk calculation, the covered distribution facilities under analysis are grouped in categories based on their risk scores, os depicted in Table V-5.
Table V-5: Risk Categories
m
Very High Risk focBUy 76-100
High Risk Facility Brown 50-75
Medium Risk foctlHy Yellow 26-50
low Risk Facility Green 1-25
8 I
Facilities inside the red category of the Risk Matnx -if any- will be addressed first. Covered Facilities are listed Table V-6.
PWP Utility Security PlanXXXXXX,XX,2021
22 ^"SWK^-Sp.y^.. :*^^!<.^,^''at|t%^S^^::-(.;iM!i^^,mffit(i»@'ttoi^-. ,..••-.. .—lii.iNiaiiamMuu,,. .())UWW..<D.W. •--••• Table V-6: Risk Index »0t Coveied Distribution facllUtes Subttation Name twtttnKKy.trKUw-A" Sacurilytodox-f U«k lnd<» (A » ») Ov»»ull PhyihiiaK; ., Stcwiiv ll»tU»H Facility #6 3.50 3.80 13.30 low Rl$k Facility Passedfacility #10 4.50 3.70 1A.65 low Rltk Facility PassedFocllHv#11 3.50 3.30 11.55 low Risk facility Passed Finally, replacement rates and schedules need to be defined, to prepare a respective Capital Improvement Program (CIP). The risk tracking approach for asset replacement is essential to mitigate failure of aging infrastructure. It also requires considerable funding, which is why autility must wisely choose an appropriate upgrade/replacement rate based on available resources, but also considering needs for maintaining safe and reliable energy supply for itscustomers.According to the results displayed in Table V-6, the Covered Distribution Facilities (#6, # 10 and +11) have existing mitigating measures sufficient to effectively mitigate the identified risks of a physical attack, theft or vandalism. Furthermore, the security mitigation measures are considered for an upgrade for each of PWP facilities including the above three covered facilities as discussed in Section VI.
PWP Utility Security PlanXXXXXX,XX,202) 23
DISTRIBUTION FACILITIES UPGRADE/REPLACEMENT PLANS (STEP 1C) Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, PWP hasdetermined that for the Covered Distribution Facilities that are subject to PWP's control, the existing mitigation measures do effectively reduce the risk of a physical security attack. This section of the Plan briefly describes the proposed additional upgrade and/or replacement projects for each of the Covered Distribution Facilities.
Table VI-1: Security Mitigation Pio)ects
Facility Name tsilmatea (-omptetion
tor Proposed Projects
1 Facility #10 FV2022
Scope of Project
I.Add a keypad entry to control house
2. Add lights point upward to distract attackers3. Enhance fencing and lighting at the south west cornerof the facility 2 Facility #6 FY2023 1. Erhance or add more padlocks to the facility gates
2. Enhance the fencing at the west side of the facility3. Add the privacy screens wherever missing 3 | Facility #11 FY2024 ). Control/trim vegetation on the west side of the facility
2. Enhance the fencing of existing walls at the west side ofthe focility PWP Utility Security PlanXXXXXX.XX.2021
24 k-< '< -».-A^^:.<i^"!tjl^.^^^^;#aiftfr^,!.^;tii;<;^Mi'N^.sy*->---.:.^'1'.,'.
VII. INDEPENDENT EVALUATION AND RESPONSE (STEP 2)
A. REQUIREMENTS FOR A QUALIFIED THIRD-PARTY REVIEW
D.19-01-0)8 specifies the following criteria for a Qualified Third-Party Reviewer:
Independence: A Qualified Third-Party Reviewer cannot be o division of the POD. Agovernmental entity can select as the third-party reviewer another governmental entity within the same political subdivision, so long as the entity has the appropriate expertise, and is not a division of the POD that operates as a functional unit, i.e., a municipality could use its police department as its third-party reviewer if it has the appropriate expertise.
Adequate Qualifications: A Qualified Third Party Reviewer must be an entity ororganization with electric industry physical security experience and whose review staffhas appropriate physical security expertise, which means that it meets at least one of thefollowing: (1) an entity or organization with at least one member who holds either an ASIS International Certified Protection Professional (CPP) or Physical Security Professional (PSP) certification; (2) an entity or organization with demonstrated law enforcement, government, or military physical security expertise; or (3) an entity or organization approved to do physical security assessments by the CPUC, Electric Reliability Organization, or similar electrical industry regulatory body.
B. IDENTIFICATION OF THIRD-PARTY REVIEWER
PWP has selected Cooper Compliance Corporafion as its Third-Parly Reviewer. CooperCompliance has staff members who qualify to conduct security plan reviews per requirements and qualifications stated above.The Third-Party Reviewer sewed as the Nuclear Weapons Safety Officer and Nuclear WeaponsSecurity Officer for a nucleor-powered strategic missile submarine from 1998 through 2001. In those rotes, he was responsible for ensuring the entire ship's security, and conducted assessments of threats and deployed personnel as needed to mitigate any perceived threats.
He conducted staff training and qualifications for armed security personnel and coordinated his ship's security with other entities.
He gained additional physical security threat mitigation training and experience when stationedaboard a nuclear-powered attack submarine from 1992 through 1995, which made numerous overseas port calls, including Saudi Arabia. United Arab Emirates, Bahrain. Singapore, Australia, and Canada.
Additionally, he conducted physical security and threat assessment reviews for a fleet of 30+ gas turbine power plants across the US and Canada over the last several years (2017-2020).
Most recently, he conducted a similar CPUC Security Plan review for the City Of Glendale.
I
t
".•
r
s.':;
PWP Utility Security PlanXXXXXX,XX,2021
25 ^^W»-W.?M"WW^tti^^^^-.;>, :i, -^ ^,^i.;;^E^J?fe'»*iS »SS?;-iW".:" -••M^^-^S C. PUBLIC RESULTS OF THIRD-PARTY EVALUATION w~m
An independent evaluation was conducted by Cooper Compliance. He found the assessment methodology to be sufficient and the results to be accurate and consistent with good industry practices for physical security of critical infrastructure.
The reviewer commended PWP on the amount of preparation and research above and beyond what was required for this plan. He noted that it was obvious that PWP had token physicalsecurity and the resiliency of their system seriously for many years, and not just in response to CPUC's decision.
^
D. _ PWP RESPONSE. .^ , ^^ ^ .^ ^ ^^^.._ . _^ ^ ^ ^ ^/ ^ .; ^,;; ; ^',:,:.. ,,,_.__,3 PWP accepts the evaluation results provided by the independent third-party evaluator.
PWP Utility Security PlanXXXXXX.XX.2021
26 VIII. VALIDATION (STEP 3)
;A. SELECTION OF A QUALIFIED AUTHORITY
PWP selected the Pasadena Police Department (PPD) as the qualified authority by contacting andscreening various sections within the department to find a suitable candidate. The PPD assignedthe Counter Terrorism Unit (CTU) supervisor to review and validate this Plan. The selection was basedon the supervisor's expertise and knowledge of physical security and security based environmental design.
is
^ B. RESULTS OF THE QUALIFIED AUTHORITY REVIEW ^!;!
PWP and PPD staff toured 11 out of 12 facilities and conducted inspections of current physical security measures and designs. The inspection included the current configuration of security cameras, fencing, ingress and egress points and overall security design.
PPD validated the Plan and provided minor recommendations to complete repairs to enhance existing fencing, add additional locking devices, perimeter lighting and cameras, and numerickeypads to access critical areas/buildings depending on the criticality of each the "Covered Distribution Facilities."
C. PWP RESPONSE TO THE QUALIFIED AUTHORITY REVIEW
PWP accepts PPD's recommendations and is currently in the process of implementing them. A list of recommended enhancements is provided in Section VI.
PWP is committed to refining, maintaining and updating this Plan -as necessary- in compliance with CPUC requirements to preserve plan integrity and purpose. This security plan shall be concurrent with and integrated into utility resiliency plans and activities. jg
II
i^
s^s.
PWP Utility Security PlanXXXXXX.XX,2021
27 NARRATIVE DESCRIPTIONS FOR UTILITY SECURITY PLAN
The CPUC order has additional requirement that the utility mitigation plans must include: a detailednarrative explaining how the utility has:
A. An asset management program to promote optimization and quality assurance for tracking and locating spare parts stock, ensuring availability and the rapid dispatch of available spare parts;
B. A robust workforce training and retention program to employ a full roster of highlyqualified sen/ice technicians able to respond to make repairs in short order throughout a utility's service territory using spare parts stockpiles and inventory; and, C. A preventative maintenance plan for security equipment to ensure that mitigation measures are functional and performing adequately.
fe
s
A. ASSET MANAGEMENT PROGRAM .^^,a^L.,.j. .,:%^y-AICtix;. y^y Asset Management is the foundation of many risk management frameworks. PWP currently utilizes an asset management application developed by DNV-GL, a global quality assurance and risk management company, called Cascade. Cascade is a software solution for achieving assetperformance management objectives. Cascade provides PWP with a focused solution for riskmanagement, predictive maintenance and other asset management activities that maximizeequipment lifetimes.
This asset management program helps PWP in tracking and locating spare parts stock, ensuring availability and the rapid dispatch of available spare parts of substation security equipment.Having an informed understanding of the performance, configuration, and capabilities of eachsubstation (and the supported feeders of course) across the complete lifecycle of PWP assets will improve not only our operational awareness but each of the substation's security stance too. The asset management program helps PWP identify the risks earlier for better asset maintenance andreplacement cycles.PWP monitors the operational condition of its security systems and does timely repairs if a problemoccurs. The security systems are upgraded os technology improves using the latest securitystandards based on the assessment and recommendations of security experts. A PWP information security officer administers the security systems plan that includes backups, staff training, useradministration.
B. WORKFORCE TRAINING AND RETENTION PROGRAM .-a
One key rote of the City of Pasadena Human Resources Department (HR) is to help PWP find thequaSfied workers we need. HR offers services that may include electronic job orders and job fairs,use of private interview space. background checks and customized screening, and regular referrals of qualified candidates. City of Pasadena works mainly with Goveinment Jobs to find PWP Utility Security PlanXXXXXX,XX,2021
28 tB.&*S':*W^"'^'r-" •i'sfl'-'i: ^ift^l .. -,-.^.^%^\:ft«M(Ft(jyarii.> !',.;;:.ff$g6;---;H>is--"?^-^w,^,. tf',tM-&^.-'::-^.:-3. yv":w:'>-. diverse candidates - such as youth, older workers, individuals with disabilities, and other untapped sources of workers.
The following paragraphs summarize Recruitment, Training and Retention Activities and Programs as conducted by the City of Pasadena.
1;
•j
!!
!
Recruitment
The following are the most common steps taken by City of Pasadena during the hiring process ofnew employees. It is a step-by-step process for hiring a new employee, whereby PWP identifies its talent needs, recruits from its talent pool and eventually hires the most qualified candidates.
1. Identify the hiring need
2. Write/Update the job description
3. Advertise and Recruit the Position4. Review Applications and Initial Screening5. Interviews and Applicant Assessment and Selection6. Background and Reference checks7. Hiring Best Qualified Candidate(s) Training, Education and Up-Skilling
Building the skills and competencies of PWP workforce is essential to ensuring the swift and effective response to make (emergency) repairs in short order throughout PWP's service area using available spare parts and inventory. PWP recognizes that training for individuals must align with the needs ofits business in the electric industry. Here are several ways that PWP supports this need for training toits workforce:
Provides access to training and education programs for all employees. The programsare available through universities, colleges and trade or technical schools; LA Trade Techthrough the Apprenticeship Program is a good example.Offers tuition reimbursement to qualified programs and certifications (not covered inprograms mentioned above in the previous point) to further their education by sharing the expenses with them.Provides a formally approved apprenticeship Programs in Dispatching,Etectronics/communications, Electrical/Meter Test, Electrical Construction and Electrical Distribution for interested staff to become a Test Technician or Electrical Mechanic orElectrical Distribution Mechanic. The Power Plant established a new apprenticeshipprogram that attracted hundreds of interested applicants. All apprenticeships are State certified/Union certified.
• New employees are offered shadowing and cross training with a mix of instruction and onthe-job training.
PWP provides updated procedure manuals/desk reference materials/task manuals for keypositions and ongoing training.
PWP offers two Leadership programs thru Woodbury University and SCPPA s
I
II
,-'.
I
s
1 PWP Utility Secutity Plan
XXXXXX,XX,2021
29 "^? •:^s's
Retention
The success or failure of any organization is increasingly determined by its ability to keep its bestpeople. Therefore, building the skills and competencies of PWP workforce may not enough toretain these highly skilled employees. To overcome this obstacle, PWP took tangible steps in thai direction:
Publish the existing succession plan (career plan) to provide a clear path for career development and advancement.
Continuously adjust employee compensation to insure competitiveness with comparablepositions across the electric industry. PWP also offers extra incentive (pay) for certifications (crane operators/welders) for skills that are above job duties but benefit the utility.
Periodically recognizes outstanding employees and offer awards/certificates ofappreciationsProvide a constructive annual performance evaluation that highlights achievements and goals for individual development.
Provides (refresher) training services to incumbent workers and developing on-the-job and workplace trainingSupporting employee retention by offering services such as mentoring programs to individuals engaged in training
t
?
^.
VC. PREVENTATIVE MAINTENANCE PLAN
PWP defines Preventive Maintenance (PM) as a systematic approach to Power Delivery (PD) operations to predict
and prevent equipment failures before they occur. Toaccomplish this goal, PD crew members conduct routineinspections, maintenance and repairs on assets to ensure they work as the manufacturer intended. This allows crew members to focus more on capital or time-sensitiveprojects and less on reactive maintenance activities.The PM programs aims to extend the asset lifecycle, enhances efficiency and keep people and assets safefrom harm. PWP benefits from the PM program in many ways but not limited to:
Reduction of excess depreciation of equipment
Prevention of early breakdowns of critical equipmentDeferring Capital Investments by extending the useful life of assets PWP Preventive Maintenance Activities
PWP has a proactive approach towards preventive maintenance and conducts the following activities: inspection, detection, correction and prevention. Here how PWP conducts each activityin its preventive maintenance program. a
Inspec
(•on
I
ii?
I$
s
?'•
PWP Utility Security Plan
XXXXXX.XX.2021
30 I. Inspection: Scheduling and conducting regular inspections are necessary parts of our preventive maintenance program. Inspections ensure that equipment is safe, help prevent workplace injuries and protect PWP property. Inspections ensure that equipment is functioning as the manufacturer intended.
2. Detection: Preventive maintenance helps PWP detect problems eariy, when issues are still relatively easy and inexpensive to fix. Operating on a run-to-failure approach should not be an option for PWP. This may end up costing PWP substantial capital dollars.
3. Correction: PWP takes a proactive approach towards equipment care and correct issues before they occur. If an issue for potential issue) is detected, staff take steps to promptly address the problem before it worsens or shuts down operations. For example. Staff repair and replace any defective equipment parts before failure or they can adjust controls for optimal performance and/or energy eHiciency.
4. Prevention: Facility managers can combine inspection records and maintenance notes to learn from past mistakes and correct repeated issues with equipment. Prevention of asset failure reduces stress and increases productivity for facilities teams. When equipment worksas inspected, staff can focus on proactive (rather than reactive) maintenance tasks.
Cleaning assets and lubricating moving parts will reduce the wear-and-tear for example.
Preventive Maintenance
PWP's time-based preventive maintenance approach involves setting up a schedule to perform regular inspections on pieces of equipment, especially those that would have a severe impact on production in the event of a breakdown. Maintenance and replacements are "condition-based"maintenance which means an asset is repaired or replaced based on the findings of the timebased inspection programs. Currently, PWP plans to utilize the existing asset management software(Cascade) to do the following:
Use a work order and PM scheduling module to create recurring PM tasks.
Assign work orders 1o specific crew and receive automatic reminders of upcomingpreventive maintenance tasks. • Upload asset documentation, receipts and proper O&M manuals for future reference.
Cascade is capable to upload and store any document, including O&M manuals, warrantyinformation, receipts and as-built for commissioning reports.
Here are a few examples to illustrate of PWP time-based preventive maintenance:
1. "Inspect Gates/Fences/perimeter lighting once a month"
2. "Inspect and lubricate surveillance cameras once a year"
3. "Inspect vegetation around substations once a year"
E
k
tI
-ENDPWP Utility Secuiity Plan
XXXXXX,XX,2021
31