AESI – Final Report Regarding RPU / OSI SCADA Upgrade Project – May 12, 2022 1 / 3
www.aesi-inc.com
[email protected]
5055 Memorial Dr.
Ste A #204
Stone Mountain,
Georgia
USA 30083
P · 770.870.1630
F · 770.870.1629
5575 North Service
Rd
Suite 401
Burlington, Ontario
Canada L7L 6M1
P · 905.875.2075
F ·905.875.2062
May 12, 2022
Jennifer Tavaglione
Riverside Public Utilities
3435 14’th Street
Riverside, CA
Re: OSI SCADA Upgrade Project – AESI’s Final Report
Dear Jennifer,
AESI has finalized our review of the proposed architecture, procurement process, and the contractual documents for the Open Systems International Inc. (OSI) SCADA upgrade project. The following summarizes our review.
A) Architecture Review
Based on our review of the proposed architecture diagram, our discussion with the Riverside Public Utilities (RPU) team on March 15, 2022 and subsequent discussions, our knowledge of industry best practices and our experience with typical OSI Monarch configurations as well other SCADA vendor configurations, it is AESI’s opinion that the planned architecture for RPU’s OSI Monarch SCADA upgrade reflects not only standard OSI practices, but also industry standards and best practices related to reliability and cyber security.
AESI would like to note that per a recent report from Dragos on the state of ICS/OT security, the four key risk areas identified across ICS/OT systems in all critical infrastructure sectors were external connectivity, shared credentials, poor perimeters, and limited visibility. RPU’s proposed architecture addresses all four of these key risk areas.
B) Procurement Process
RPU currently utilizes the Monarch SCADA software from OSI. The software meets all of RPU’s functional requirements, however it is an old version which is no longer supported and will not receive security updates or enhancements, and therefore needs to be upgraded. OSI is the only vendor of this specific software product and does not utilize resellers or system integrators, therefore RPU can only obtain the Monarch software from OSI. Comparable products exist in the market from several vendors with similar pricing for the software itself, however a transition from one vendor to another would incur significant additional costs including but not limited to:
• Thorough evaluation of each bidder’s offering to ensure that it does in fact offer all of the same features as the OSI Monarch software • Conversion of all displays, databases, calculations and system configurations from the current OSI formats to the new vendor’s formats – none of these items are standardized across vendors and significant effort
AESI – Final Report Regarding RPU / OSI SCADA Upgrade Project – May 12, 2022 2 / 3 from both the vendor and RPU would be required to complete them • Testing/commissioning of the new system – because no two SCADA systems are identical and conversion can (and often does) introduce errors and misconfigurations which could lead to outages and safety issues, the new system would need to undergo a lengthy commissioning process to ensure that it works identically to the existing system. Failure to complete such commissioning could lead to incorrect information being provided to the operators and in a worst case scenario incorrect devices being controlled in the field, leading to outages and potentially injury or death.
• Training of operations and maintenance staff – every SCADA system is somewhat different from an operations perspective and often significantly different from a maintenance and configuration perspective. Significant time and money would need to be spent on training all staff who operate and maintain the system, and even with that training, true proficiency would not be gained until perhaps a year or two after implementation. Existing investment into proficiency with the Monarch software would be wasted.
Since the Monarch software meets RPU’s functional requirements, comparable software has similar pricing, and replacement of the Monarch software with another vendor’s offering would incur significant additional costs, replacement is not financially prudent in our opinion. Since OSI is the only vendor offering the Monarch software, AESI’s perspective is that there is no need to go through an RFP process.
C) Contractual Documents Review
In discussion with RPU the following is the proposed Agreement structure for the upgrade project:
I. Master Agreement
II. Exhibit A: Statement of Work
III. Exhibit B: Compensation
IV. Exhibit C: Key Project Personnel
V. Exhibit D: Software Support Plan
VI. Exhibit E: Software License Agreement
VII. Exhibit F: OSI’s Cybersecurity Obligations
VIII. Exhibit G: Patch Management Program
AESI reviewed the most current versions of the contractual documents above and feel that they appropriately meet industry requirements, RPU’s technical requirements, and cyber security. They are in form to be finalized by RPU and OSI.
D) Supporting Documents Review
OSI also provided the following supporting documents:
I. OSI Cyber Security Policy
II. OSI 2022 Audit Report
III. OSI Software Verification Guide and Software Verification Tool Guide IV. FERC Order 881 White Paper
AESI – Final Report Regarding RPU / OSI SCADA Upgrade Project – May 12, 2022 3 / 3
AESI reviewed each of these documents and feel that they are appropriate for RPU.
Jennifer, we trust that this review and analysis assists RPU with your SCADA upgrade project and with your contractual discussions with OSI. We are available to discuss any of these items and to provide more context if required.
Sincerely,
Doug Westlund, P.Eng., MBA
Senior Vice President, Principal Consultant
AESI