2/26/2025
1 RiversideCA.gov1
RiversideCA.gov
CYBER SECURITY PROFESSIONAL SERVICESCity CouncilMarch 11, 2025Riverside Public Utilities RiversideCA.gov2
1. To safeguard our critical assets and mitigate the escalating risks of cyber threats, it was crucial that Riverside Public Utilities (RPU) develop a Cyber Security Professional Consulting Services Request for Proposal (RFP) to continue to enhance our security posture.2. A cybersecurity consultant can provide expert guidance in navigating NERC CIP regulatory requirements, ensuring that the utility's cybersecurity practices not only comply with current standards but also proactively address emerging threats.BACKGROUND1 2 2/26/2025
2 RiversideCA.gov3
3. A qualified vendor is needed to perform a review of RPU Operational Technology (OT) network architecture, security controls, facilities and systems relating to Critical Infrastructure Protection.4. Additionally, the cyber security scope of services requires an approach that is both modular and capable of maintenance by City of Riverside Public Utilities personnel. BACKGROUND RiversideCA.gov4
1. NERC CIP-008-6― To mitigate the risk to the reliable operation of the Bulk Electric System (BES) as the result of a Cyber Security Incident by specifying incident response requirements. 2. NERC CIP-013-2― To mitigate cyber security risks to the reliable operation of the Bulk Electric System (BES) by implementing security controls for supply chain risk management of BES Cyber Systems.REGULATORY HISTORY3 4 2/26/2025
3 RiversideCA.gov5
1. May 8, 2024 – City staff issued RFP 2340 for Cyber Security Professional Consulting Services. 2. June 12, 2024 – Eight vendors submitted proposals and were ranked by a panel consisting of four RPU employees.3. The evaluation panel evaluated the proposals on the following selection criteria:a. Qualifications (35%)b. Pricing (20%)c. Experience (Projects of similar size and scope) (25%)d. Approach and Methodology (10%)e. Professional References (10%)DISCUSSION RiversideCA.gov6
4. Vendor Scoring TableDISCUSSION
5 6
2/26/2025
4 RiversideCA.gov7
5. AESI’s scope of services includes:• Cyber Program Assessment• Cyber Posture Assessment • Vulnerability Assessment• Penetration Testing• Remediation Services• Incident Response• In-Person Training• One-on-One Mentoring• Budget Scope• Exercise Services DISCUSSION RiversideCA.gov8
1. The initial scope of services for this project will include a comprehensive Cyber Program Assessment followed by a Cyber Posture Assessment. 2. Recommendations from AESI’s Cyber Assessments will be included and incorporated into RPU’s Cyber Program Framework. 3. The continued development of a comprehensive risk mitigation plan will address any identified vulnerabilities and outline specific mitigation solutions. INITIAL SERVICES7 8 2/26/2025
5 RiversideCA.gov9
1. Contracted Amount and Contingency Option Over a 3-Year Period― Total Contracted Amount will be $179,100― Additional Contingency Option will be $150,000― Total Possible Compensation of $329,1002. Contingency Option is a precautionary measure only used to address adverse events, should they arise. FISCAL IMPACT RiversideCA.gov10
3. Fiscal impact is $329,100 over a 3-year period.4. Funds are included in the Fiscal Year 2024/2025 – 2027/2028 budgets in the Electric Fund, Legislative & Regulatory Risk Account No. 6025000-421000, Electric Operations Account No. 6100000-421000, Clearwater Generating Plant Account No. 6120140-421000, and Water Fund, Water Production & Operations Account No. 6200000-421000, approved by the City Council in June 2024. Project cost share is 25% for each account. 5. Funds for future fiscal years will be included as part of the subsequent budget process. FISCAL IMPACT9 10 2/26/2025
6 RiversideCA.gov11
STRATEGIC PLAN ALIGNMENTCommunity Trust
Equity
Fiscal Responsibility
Innovation
Sustainability & Resiliency
Priority 6 – Infrastructure, Mobility and ConnectivityGoal 6.2: Maintain, protect and improve assets and infrastructure within the City’s built environment and enhance reliability, resiliency, sustainability, and facilitate connectivity.Cross-Cutting Threads RiversideCA.gov12
That the City Council:1. Approve the Professional Consultant Services Agreement with AESI, Inc., from RFP 2340, for cyber security consulting services, for a three-year term, in an amount of $329,100; and2. Authorize the City Manager, or his designee, to execute the agreements, including making minor non-substantive changes, and to sign all documents and instruments necessary to complete the transactions.RECOMMENDATIONS11 12