CITY OF SIMI VALLEY
MEMORANDUM
A
ugust 4, 2025
T
O: Board of Directors, Ventura County Waterworks District No. 8 F
ROM: Department of Public Works
S
UBJECT: AWARD OF PROFESSIONAL SERVICES CONTRACT TO PREPARE THE 2025 RISK AND RESILIENCE ASSESSMENT AND EMERGENCY
RESPONSE PLAN, RFP NO. PW 25-05
STAFF RECOMMENDATION
I
t is recommended that the Board of Directors award a contract (page 4) to Carollo Engineers, Inc. in the amount of $ 129,950 to prepare the 2025 R isk and R esilience Assessment (RRA) and Emergency Response Plan (ERP), RFP No. PW 25-05.
BACKGROUND AND OVERVIEW
T
he Ventura County Waterworks District No. 8 (District) owns and operates a potable water distribution system consisting of 22 pump stations, 43 water storage reservoirs, 15 pressure-reducing stations , 2,800 fire hydrants, and approximately 357 miles of distribution pipelines. The District also owns and operates two production wells and a water treatment plant located in the Gillibrand Groundwater Basin, north of Simi Valley .
The District serves approximately 68 percent of the developed portion of the City, as well as some unincorporated areas of Ventura County adjacent to the City. The District ’s service area covers approximately 45 square miles and serves a population of approximately 87,000 residents.
T
he Safe Drinking Water Act (SDWA) section 1433, which was amended by America’s Water Infrastructure Act (AWIA) of 2018, requires water utilities to update their RRA and ERP every five years. The District prepared the previous RRA and ERP in March 2021.
The RRA evaluates the District’s critical assets and identifies any vulnerabilities, threats, and consequences from potential hazards. The ERP outlines strategies, resources, and procedures to improve the resilience of the system and lessen the impact of a malevolent act or natural hazard. To account for evolving threats and maintain compliance with AWIA, the District is required to update its RRA and ERP and certify to the U.S.
Environmental Protection Agency (EPA) that this work has been completed. The deadlines for submitting a certification statement for the RRA and ERP are December 31, 2025, and June 30, 2026, respectively.
AGENDA I
TEM NO.
Consent (8)
FINDINGS AND ALTERNATIVES
On May 12, 2025, a Request for Proposals was posted on the City’s website. On June 9, 2025, two proposals were received; one from AARC Consultants, LLC, and the other from Carollo Engineers , Inc . (Carollo). A panel of three staff members evaluated both proposals and ranked them based on five criteria:
• Approach to completing project (35%)
• Demonstrated professional skill and credentials of staff (20%) • Related experience in the preparation of RRA and ERP studies (20%) • Understanding the scope of work (15%)
• Cost of Proposal (10%)
The results of the proposal evaluation are summarized below:
CONSULTANT RATING
Carollo Engineers, Inc 93%
AARC Consultants, LLC 92%
Staff determined that Carollo is the most qualified consultant based on the five criteria above. Carollo received the highest score from the panel and was found to have a superior understanding of the scope of work and requirements for preparing the RRA and ERP. Carollo previously prepared the District’s RRA and ERP in 2020 and therefore has in-depth knowledge and familiarity with the District’s facilities.
The FY 2025-26 Waterworks Budget contains sufficient funding to prepare the 2025 RRA and ERP. Sufficient funds are available to cover the proposed contract amount.
The following alternatives are available to the Board of Directors:
1. Award a contract to Carollo in the amount of $129,950 to prepare the 2025 RRA and ERP, RFP No. PW 25-05;
2. Do not award a contract at this time and provide staff further direction.
Staff recommends Alternative No. 1.
SUGGESTED BOARD MOTION
I move to award a contract to Carollo in the amount of $129,950 to prepare the 2025 RRA and ERP, RFP No. PW 25-05.
2 SUMMARY
On May 12, 2025, a Request for Proposals was posted on the City’s website to prepare the 2025 Risk and Resilience Assessment and Emergency Response Plan, RFP No. PW 25-05. Two proposals were received, and staff determined that Carollo is the most qualified consultant based on their knowledge and familiarity with the District’s facilities .
Staff recommends that the Board of Directors award a contract to Carollo in the amount of $129,950.
____________________________________
Ronald K. Fuchiwaki
Public Works Director
Prepared by: Michel Kadah, Principal Engineer
INDEX Page
Contract ............................................................................................ 4 3
AGREEMENT NO. 3260007
PROFESSIONAL SERVICES AGREEMENT
BETWEEN
THE CITY OF SIMI VALLEY AND
CAROLLO ENGINEERS, INC.
FOR THE RISK AND RESILIANCE ASSESSMENT AND EMERGENCY RESPONSE PLAN
THIS AGREEMENT is entered into this 4th day of August, 2025, by and between the CITY OF SIMI VALLEY, a municipal corporation and general law city (“CITY”) and CAROLLO ENGINEERS< INC., a California corporation (“CONSULTANT”).
1. CONSIDERATION.
A. As partial consideration, CONSULTANT agrees to perform the work listed in the SCOPE OF SERVICES, below;
B. As additional consideration, CONSULTANT and CITY agree to abide by the terms and conditions contained in this Agreement;
C. As additional consideration, CITY agrees to pay CONSULTANT a sum not to exceed $129,950 for CONSULTANT’s services. CITY may modify this amount as set forth below. Unless otherwise specified by written amendment to this Agreement, CITY will pay this sum as specified in the attached Exhibit “B,” which is incorporated by reference.
2. SCOPE OF SERVICES.
A. CONSULTANT will perform services listed in the attached Exhibit “A,” which is incorporated by reference.
B. CONSULTANT will, in a professional manner, furnish all of the labor, technical, administrative, professional and other personnel, all supplies and materials, equipment, printing, vehicles, transportation, office space and facilities, and all tests, testing and analyses, calculation, and all other means whatsoever, except as herein otherwise expressly specified to be furnished by CITY, necessary or proper to perform and complete the work and provide the professional services required of CONSULTANT by this Agreement.
3. PERFORMANCE STANDARDS. While performing this Agreement, CONSULTANT will use the appropriate generally accepted professional standards of practice existing at the time of performance utilized by persons engaged in providing similar services. CITY will continuously monitor CONSULTANT’s services. CITY will notify CONSULTANT of any deficiencies and CONSULTANT will have fifteen (15) days after such notification to 4 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
cure any shortcomings to CITY’s satisfaction. Costs associated with curing the deficiencies will be borne by CONSULTANT.
4. PAYMENTS. CITY will pay CONSULTANT in accordance with the schedule of fees in Exhibit “ B”. For CITY to pay CONSULTANT as specified by this Agreement, CONSULTANT must submit a detailed invoice to CITY which lists the hours worked and hourly rates for each personnel category and reimbursable costs (all as set forth in Exhibit “B”) the tasks performed, the percentage of the task completed during the billing period, the cumulative percentage completed for each task, the total cost of that work during the preceding billing month and a cumulative cash flow curve showing projected and actual expenditures versus time to date.
5. NON-APPROPRIATION OF FUNDS. Payments due and payable to CONSULTANT for current services are within the current budget and within an available, unexhausted and unencumbered appropriation of the CITY. In the event the CITY has not appropriated sufficient funds for payment of CONSULTANT services beyond the current fiscal year, this Agreement will cover only those costs incurred up to the conclusion of the current fiscal year.
6. ADDITIONAL WORK.
A. CITY’s City Manager (“Manager”) may determine, at the Manager’s sole discretion, that CONSULTANT must perform additional work (“Additional Work”) to complete the Scope of Work. If Additional Work is needed, the Manager will give written authorization to CONSULTANT to perform such Additional Work.
B. If CONSULTANT believes Additional Work is needed to complete the Scope of Work, CONSULTANT will provide the Manager with written notification that contains a specific description of the proposed Additional Work, reasons for such Additional Work, and a detailed proposal regarding cost.
C. Payments over $129,950 for Additional Work must be approved by CITY’s City Council, Manager or Department Head as provided in title 2, chapter 9 of CITY’s municipal code. All Additional Work will be subject to all other terms and provisions of this Agreement.
7. FAMILIARITY WITH WORK.
A. By executing this Agreement, CONSULTANT agrees that it has:
i. Carefully investigated and considered the scope of services to be performed;
5 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
ii. Carefully considered how the services should be performed; and
iii. Understands the facilities, difficulties, and restrictions attending performance of the services under this Agreement.
B. If services involve work upon any site, CONSULTANT agrees that CONSULTANT has or will investigate the site and is or will be fully acquainted with the conditions there existing, before commencing the services hereunder. Should CONSULTANT discover any latent or unknown conditions that may materially affect the performance of the services, CONSULTANT will immediately inform CITY of such fact and will not proceed except at CONSULTANT’s own risk until written instructions are received from CITY.
8. TERM. The term of this Agreement will be from August 4, 2025 to June 30, 2026 .
Unless otherwise determined by written amendment between the parties, this Agreement will terminate in the following instances:
A. Completion of the work specified in Exhibit “A”;
B. Termination as stated in Section 16.
9. TIME FOR PERFORMANCE.
A. CONSULTANT will not perform any work under this Agreement until:
i. CONSULTANT furnishes proof of insurance as required under Section 23 of this Agreement; and
ii. CITY gives CONSULTANT a written notice to proceed.
B. Should CONSULTANT begin work on any phase in advance of receiving written authorization to proceed, any such professional services are at CONSULTANT’s own risk.
10. TIME EXTENSIONS . Should CONSULTANT be delayed by causes beyond CONSULTANT’s control, CITY may grant a time extension for the completion of the contracted services. If delay occurs, CONSULTANT must notify the Manager within forty- eight hours (48 hours), in writing, of the cause and the extent of the delay and how such delay interferes with the Agreement’s schedule. The Manager will extend the completion time, when appropriate, for the completion of the contracted services.
11. CONSISTENCY. In interpreting this Agreement and resolving any ambiguities, the main body of this Agreement takes precedence over the attached Exhibits; this 6 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
Agreement supersedes any conflicting provisions. Any inconsistency between the Exhibits will be resolved in the order in which the Exhibits appear below:
Exhibit “A” – Scope of Services
Exhibit “B” – Schedule of Fees
12. CHANGES. CITY may order changes in the services within the general scope of this Agreement, consisting of additions, deletions, or other revisions, and the contract sum and the contract time will be adjusted accordingly. All such changes must be authorized in writing, executed by CONSULTANT and CITY. The cost or credit to CITY resulting from changes in the services will be determined in accordance with written agreement between the parties.
13. TAXPAYER IDENTIFICATION NUMBER. CONSULTANT will provide CITY with a Taxpayer Identification Number.
14. PERMITS AND LICENSES . CONSULTANT, at its sole expense, will obtain and maintain during the term of this Agreement, all necessary permits, licenses, and certificates that may be required in connection with the performance of services under this Agreement.
15. WAIVER. CITY’s review or acceptance of, or payment for, work product prepared by CONSULTANT under this Agreement will not be construed to operate as a waiver of any rights CITY may have under this Agreement or of any cause of action arising from CONSULTANT’s performance. A waiver by CITY of any breach of any term, covenant, or condition contained in this Agreement will not be deemed to be a waiver of any subsequent breach of the same or any other term, covenant, or condition contained in this Agreement, whether of the same or different character.
16. TERMINATION.
A. Except as otherwise provided, CITY may terminate this Agreement at any time with or without cause.
B. CONSULTANT may terminate this Agreement at any time with CITY’s mutual consent. Notice will be in writing at least thirty (30) days before the effective termination date.
C. Upon receiving a termination notice, CONSULTANT will immediately cease performance under this Agreement unless otherwise provided in the termination notice. Except as otherwise provided in the termination notice, any additional work performed by CONSULTANT after receiving a termination notice will be performed at CONSULTANT'’ own cost; CITY will not be obligated to compensate CONSULTANT for such work. 7 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
D. Should termination occur, all finished or unfinished documents, data, studies, surveys, drawings, maps, reports and other materials prepared by CONSULTANT will, at CITY’s option, become CITY’s property, and CONSULTANT will receive just and equitable compensation for any work satisfactorily completed up to the effective date of notice of termination, not to exceed the total costs under Section 1(C).
E. Should the Agreement be terminated pursuant to this Section, CITY may procure on its own terms services similar to those terminated.
F. By executing this document, CONSULTANT waives any and all claims for damages that might otherwise arise from CITY’s termination under this Section.
17. OWNERSHIP OF DOCUMENTS; EXCEPTIONS; WARRANTY. Except as otherwise provided below, all documents, data, studies, drawings, maps, models, photographs and reports prepared by CONSULTANT (collectively, “Documents”) under this Agreement are CITY’s property. CONSULTANT may retain copies of such Documents as desired but will deliver all original materials to CITY upon CITY’s written notice. CITY agrees that use of CONSULTANT’s completed work product, for purposes other than identified in this Agreement, or use of incomplete work product, is at CITY’s own risk. CONSULTANT warrants that all Documents it drafts and completes pursuant to this Agreement constitutes original work. Specifically, CONSULTANT understands and agrees that use of artificial intelligence (AI) tools including, without limitation, ChatGPT, Microsoft’s Bing Chat, Google’s Bard, and Meta’s LLaMA (Large Language Model Meta AI), in the performance of this Agreement does not constitute an original work, i.e., submitting Documents generated by such AI tools to CITY and representing it as CONSULTANT’s original work constitutes a material breach of this Agreement, constitutes a false claim, and may also violate applicable intellectual property right laws including, without limitation, United States Copyright Law. Accordingly, and notwithstanding any other provision of this Agreement as to ownership, CITY specifically rejects ownership of such Documents. CONSULTANT is required to indemnify and defend CITY to the fullest extent allowed by applicable law should it violate this Section.
18. PUBLICATION OF DOCUMENTS. Except as necessary for performance of service under this Agreement, no copies, sketches, or graphs of materials, including graphic art work, prepared pursuant to this Agreement, will be released by CONSULTANT to any other person or public CITY without CITY’s prior written approval. All press releases, including graphic display information to be published in newspapers or magazines, will be approved and distributed solely by CITY, unless otherwise provided by written agreement between the parties.
19. INDEMNIFICATION.
8 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
A. CONSULTANT agrees to the following:
i. Indemnification for Professional Services. CONSULTANT will save harmless and indemnify and at CITY’s request reimburse defense costs for CITY and all its officers, volunteers, employees and representatives from and against any and all suits, actions, or claims, of any character whatever, brought for, or on account of, any injuries or damages sustained by any person or property resulting or arising from any negligent , recklessness, or willful misconduct of CONSULTANT or any of CONSULTANT’s officers, agents,
employees, or representatives, in the performance of this Agreement, except for such loss or damage arising from CITY’s sole negligence or willful misconduct.
ii. Notwithstanding the foregoing, for any claim alleging Consultant’s negligent performance of professional services, Consultant’s obligations regarding the City’s defense under this paragraph include only the reimbursement of the City’s reasonable defense costs incurred to the extent of Consultant’s negligence as expressly determined by a final judgment, arbitration, award, order, settlement, or other final resolution. Consultant must not be responsible for warranties, guarantees, fitness for a particular purpose, or breach of fiduciary duty. Additionally, Consultant must not be responsible for acts or decisions of third parties, including governmental agencies, other than Consultant’s subconsultants, that impact project completion and/or success.
iii. Indemnification for other Damages. CONSULTANT indemnifies and holds CITY harmless from and against any claim, action, damages, costs (including, without limitation, attorney’s fees), injuries, or liability, arising out of this Agreement, or its performance, except for such loss or damage arising from CITY’s sole negligence or willful misconduct. Should CITY be named in any suit, or should any claim be brought against it by suit or otherwise, whether the same be groundless or not, arising out of this Agreement, or its performance, CONSULTANT will defend CITY (at CITY’s request and with counsel satisfactory to CITY) and will indemnify CITY for any judgment rendered against it or any sums paid out in settlement or otherwise.
B. For purposes of this section “CITY” includes CITY’s officers, officials, employees, agents, representatives, and certified volunteers.
C. It is expressly understood and agreed that the foregoing provisions will 9 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
survive termination of this Agreement.
D. The requirements as to the types and limits of insurance coverage to be maintained by CONSULTANT as required by Section 23, and any approval of said insurance by CITY, are not intended to and will not in any manner limit or qualify the liabilities and obligations otherwise assumed by CONSULTANT pursuant to this Agreement, including, without limitation, to the provisions concerning indemnification.
20. ASSIGNABILITY. This Agreement is for CONSULTANT’s professional services.
CONSULTANT’s attempts to assign the benefits or burdens of this Agreement without CITY’s written approval are prohibited and will be null and void.
21. INDEPENDENT CONTRACTOR. CITY and CONSULTANT agree that CONSULTANT will act as an independent contractor and will have control of all work and the manner in which is it performed. CONSULTANT will be free to contract for similar service to be performed for other employers while under contract with CITY.
CONSULTANT is not an agent or employee of CITY and is not entitled to participate in any pension plan, insurance, bonus or similar benefits CITY provides for its employees.
Any provision in this Agreement that may appear to give CITY the right to direct CONSULTANT as to the details of doing the work or to exercise a measure of control over the work means that CONSULTANT will follow the direction of the CITY as to end results of the work only.
22. AUDIT OF RECORDS. CONSULTANT will maintain full and accurate records with respect to all services and matters covered under this Agreement. CITY will have free access at all reasonable times to such records, and the right to examine and audit the same and to make transcript therefrom, and to inspect all program data, documents, proceedings and activities. CONSULTANT will retain such financial and program service records for at least three (3) years after termination or final payment under this Agreement.
23. INSURANCE.
A. Before commencing performance under this Agreement, and at all other times this Agreement is effective, CONSULTANT will procure and maintain the following types of insurance with coverage limits complying, at a minimum, with the limits set forth below:
Type of Insurance Limits
C ommercial general liability: $2,000,000
Professional Liability $1,000,000
10 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
Business automobile liability $1,000,000
Workers compensation Statutory requirement
B. Commercial general liability insurance will meet or exceed the requirements of the most recent ISO-CGL Form. The amount of insurance set forth above will be a combined single limit per occurrence for bodily injury, personal injury, and property damage for the policy coverage. Liability policies will be endorsed to name CITY, its officials, and employees as “additional insureds” under said insurance coverage and to state that such insurance will be deemed “primary” such that any other insurance that may be carried by CITY will be excess thereto. Such endorsement must be reflected on ISO Form No. CG 20 10 11 85 or 88, or equivalent. Such insurance will be on an “occurrence,” not a “claims made,” basis and will not be cancelable or subject to reduction except upon thirty (30) days prior written notice to CITY.
C. Professional liability coverage will be on an “occurrence basis” if such coverage is available, or on a “claims made” basis if not available. When coverage is provided on a “claims made basis,” CONSULTANT will continue to renew the insurance for a period of three (3) years after this Agreement expires or is terminated. Such insurance will have the same coverage and limits as the policy that was in effect during the term of this Agreement, and will cover CONSULTANT for all claims made by CITY arising out o f any errors or omissions of CONSULTANT, or its officers, employees or agents during the time this Agreement was in effect.
D. Automobile coverage will be written on ISO Business Auto Coverage Form CA 00 01 06 92, including symbol 1 (Any Auto).
E. CONSULTANT will furnish to CITY duly authenticated Certificates of Insurance evidencing maintenance of the insurance required under this Agreement and such other evidence of insurance or copies of policies as may be reasonably required by CITY from time to time. Insurance must be placed with insurers with a current A.M. Best Company Rating equivalent to at least a Rating of “A:VII.”
F. Should CONSULTANT, for any reason, fail to obtain and maintain the insurance required by this Agreement, CITY may obtain such coverage at CONSULTANT’s expense and deduct the cost of such insurance from payments due to CONSULTANT under this Agreement or ter minate pursuant to Section 16.
11 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
G. Self-Insured Retention/Deductibles. All policies required by this Agreement must allow CITY, as additional insured, to satisfy the self -insured retention (“SIR”) and deductible of the policy in lieu of CONSULTANT (as the named insured) should CONSULTANT fail to pay the SIR or deductible requirements. The amount of the SIR or deductible is subject to the approval of the City Attorney and the Risk Manager. CONSULTANT understands and agrees that satisfaction of this requirement is an express condition precedent to the effectiveness of this Agreement. Failure by CONSULTANT as primary insured to pay its SIR or deductible constitutes a material breach of this Agreement. Should CITY pay the SIR or deductible on CITY’s behalf upon the CONSULTANT’S failure or refusal to do so in order to secure defense and indemnification as an additional insured under the policy, CITY may include such amounts as damages in any ac tion against CONSULTANT for breach of this Agreement in addition to any other damages incurred by CITY due to the breach.
24. USE OF SUBCONTRACTORS . CONSULTANT must obtain CITY’s prior written approval to use any consultants while performing any portion of this Agreement. Such approval must approve of the proposed consultant and the terms of compensation.
25. INCIDENTAL TASKS. CONSULTANT will meet with CITY monthly to provide the status on the project, which will include a schedule update and a short narrative description of progress during the past month for each major task, a description of the work remaining and a description of the work to be done before the next schedule update.
26. NOTICES. All communications to either party by the other party will be deemed made when received by such party at its respective name and address as follows:
If to CONSULTANT:
If to CITY:
Attention: Shawn Corrigan Attention: Michel Kadah
Carollo Engineers, Inc. City of Simi Valley
707 Wilshire Boulevard, Suite 3920 2929 Tapo Canyon Road Los Angeles, CA 90017 Simi Valley, CA 93063
(778) 901-5580 (805) 583-6893
[email protected] [email protected]
Any such written communications by mail will be conclusively deemed to have been received by the addressee upon deposit thereof in the United States Mail, postage prepaid and properly addressed as noted above. In all other instances, notices will be deemed given at the time of actual delivery. Changes may be made in the names or addresses of persons to whom notices are to be given by giving notice in the m anner prescribed in this paragraph.
12 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
27. CONFLICT OF INTEREST . CONSULTANT will comply with all conflict of interest laws and regulations including, without limitation, CITY’s conflict of interest regulations.
28. SOLICITATION. CONSULTANT maintains and warrants that it has not employed nor retained any company or person, other than CONSULTANT’s bona fide employee, to solicit or secure this Agreement. Further, CONSULTANT warrants that it has not paid nor has it agreed to pay any company or person, other than CONSULTANT’s bona fide employee, any fee, commission, percentage, brokerage fee, gift or other consideration contingent upon or resulting from the award or making of this Agreement. Should CONSULTANT breach or violate this warranty, CITY may rescind this Agreement without liability.
29. THIRD PARTY BENEFICIARIES . This Agreement and every provision herein is generally for the exclusive benefit of CONSULTANT and CITY and not for the benefit of any other party. There will be no incidental or other beneficiaries of any of CONSULTANT’s or CITY’s obligations under th is Agreement, and no right to assert a claim against Consultant by assignment of indemnity rights or otherwise must accrue to a third party as a result of this Agreement or the performance of Consultant's services hereunder.
30. INTERPRETATION. This Agreement was drafted in, and will be construed in accordance with the laws of the State of California, and exclusive venue for any action involving this agreement will be in Ventura County.
31. COMPLIANCE WITH LAW. CONSULTANT agrees to comply with all federal, state, and local laws applicable to this Agreement.
32. ENTIRE AGREEMENT. This Agreement, and its Attachments, sets forth the entire understanding of the parties. There are no other understandings, terms or other agreements expressed or implied, oral or written. There are 2 Attachments to this Agreement. This Agreement will bind and inure to the benefit of the parties to this Agreement and any subsequent successors and assigns.
33. RULES OF CONSTRUCTION. Each Party had the opportunity to independently review this Agreement with legal counsel. Accordingly, this Agreement will be construed simply, as a whole, and in accordance with its fair meaning; it will not be interpreted strictly for or against either Party.
34. SEVERABILITY. If any portion of this Agreement is declared by a court of competent jurisdiction to be invalid or unenforceable, then such portion will be deemed modified to the extent necessary in the opinion of the court to render such portion enforceable and, as so modified, such portion and the balance of this Agreement will continue in full force and effect.
13 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
35. AUTHORITY/MODIFICATION. The Parties represent and warrant that all necessary action has been taken by the Parties to authorize the undersigned to execute this Agreement and to engage in the actions described herein. This Agreement may be modified by written amendment. CITY’s M anager, or designee, may execute any such amendment on behalf of CITY.
36. ELECTRONIC SIGNATURES. This Agreement may be executed by the Parties on any number of separate counterparts, and all such counterparts so executed constitute one Agreement binding on all the Parties notwithstanding that all the Parties are not signatories to the same counterpart. In accordance with Government Code §16.5, the Parties agree that this Agreement, Agreements ancillary to this Agreement , and related documents to be entered into in connection with this Agreement will be considered signed when the signature of a party is delivered by electronic transmission. Such electronic signature will be treated in all respects as having the same effect as an original signature.
37. CAPTIONS. The captions of the paragraphs of this Agreement are for convenience of reference only and will not affect the interpretation of this Agreement.
38. TIME IS OF ESSENCE. Time is of the essence for each and every provision of this Agreement.
39. FORCE MAJEURE. Should performance of this Agreement be prevented due to fire, flood, explosion, acts of terrorism, war, embargo, government action, civil or military authority, the natural elements, or other similar causes beyond the Parties’ reasonable control, then the Agreement will immediately terminate without obligation of either party to the other.
40. STATEMENT OF EXPERIENCE. By executing this Agreement, CONSULTANT represents that it has demonstrated trustworthiness and possesses the quality, fitness and capacity to perform the Agreement in a manner satisfactory to CITY. CONSULTANT represents that its financial resources, surety and insurance experience, service experience, completion ability, personnel, current workload, experience in dealing with private consultants, and experience in dealing with public agencies all suggest that CONSULTANT is capable of performing the proposed contract and has a demonstrated capacity to deal fairly and effectively with and to satisfy a public CITY.
[SIGNATURES ON NEXT PAGE]
14 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
IN WITNESS WHEREOF , the parties hereto have executed this Agreement the day and year first hereinabove written.
Attest: City of Simi Valley, A Municipal Corporation
By:
Lucy Blanco, City Clerk Dee Dee Cavanaugh, Mayor of the City of Simi Valley, California
Approved as to Form: Carollo Engineers, Inc.
By:
Algeria R. Ford, City Attorney
Print Name: Daniel P. Baker
Approved as to Content: Title: Vice President
By:
Samantha C. Argabrite, City Manager
Print Name: Shawn Corrigan
Title: Resilience and Sustainability Technical
Johanna Medrano, Practice Director
Deputy Administrative Services Director/
Budget & Purchasing
Ronald K. Fuchiwaki,
Public Works Director
15 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
EXHIBIT “A”
SCOPE OF SERVICES
16 PROPOSAL / RFP No. PW 25-05 / JUNE 2025
RISK AND RESILIENCE
ASSESSMENT AND
EMERGENCY RESPONSE PLAN
City of Simi Valley/Ventura County
Waterworks District No. 8
Prepared for
EXHIBIT A
18 RFP NO. PW 25-05
SUBMIT WITH PROPOSAL
3 VENTURA COUNTY WATERWORKS DISTRICT NO. 8
CITY OF SIMI VALLEY
REQUEST FOR PROPOSAL ACKNOWLEDGEMENT FORM
PROPOSALS ARE DUE: NO LATER THAN 3:00 P.M. ON June 9, 2025.
The City of Simi Valley/Ventura County Waterworks District No. (City/District) is seeking proposals from qualified firms to provide professional services to prepare a Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP), in accordance with the Safe Drinking Water Act (SDWA) Section 1433, which was amended by America's Water Infrastructure Act (AWIA) Section 2013, RFP NO. PW 25-05.
1. Submit three original Proposals of the Technical Qualifications and three Proposals for the Cost Proposal in separate envelopes to:
City Clerk/District Secretary’s Office
2929 Tapo Canyon Road
Simi Valley, CA 93063
2. Proposer must honor proposal prices for 60 days.
3. Proposals must include this Proposal form and be signed by the vendor's authorized representative.
4. Award of a contract , if any, will be made by the Board of Directors based upon the criteria set forth in this R equest for Proposal and will be made based upon the best qualified Proposer rather than lowest price.
PROPOSER TO READ
I have, read, understood, and agree to the terms and conditions on all pages of this Request for Proposal. The undersigned agrees to furnish the commodity or service stipulated on this Proposal as stated above.
__4710 Kingsway, Metrotower l, Ste 925,
Burnaby, BC V5H
4N2_________________________
Address
__Carollo Engineers,
Inc._________________________
Company
___Shawn
Corrigan_________________________
Name (Print)
___+1 (778)
901-5580_________________________
Company Phone No.
__________________________________
Signature
___VP, Resilience and Sustainability
Technical Practice
Director______________________________
_ Title of Person Signing Proposal
19 carollo.com
00030024 SIM007 / 00-CoverLetter.indd
June 9, 2025
Michel Kadah, Principal Engineer
Public Works Department, Ventura County Waterworks District No. 8 2929 Tapo Canyon Road
Simi Valley, CA 93063
Subject: Request for Proposals to Provide Professional Services to Prepare a Risk and Resilience Assessment and Emergency Response Plan, RFP No. Pw 25-05
Dear Mr. Kadah:
To maintain compliance with the America’s Water Infrastructure Act (AWIA) of 2018, a water utility must update its Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP) every five years. These updates are due in December 2025 (RRA), and June 2026 (ERP) for the Ventura County Waterworks District No. 8 (District).
In order to meet these deadlines, it is essential to have a team of seasoned professionals with the expertise needed to streamline the process and confirm compliance. Carollo Engineers, Inc. (Carollo) is that team. We commit experienced staff to assist you in achieving compliance with the range of America’s Water Infrastructure Act (AWIA) requirements prior to the deadline and tailor work products to your needs. With 92 years of experience in supporting utilities nationwide, our water and resilience experts have successfully guided clients to AWIA compliance through the required RRA and ERP updates. Our team also includes local staff that are familiar with the District’s staff and facilities. Our multidisciplinary team offers the following key differentiators:
Technical Excellence and Local Experience. Our team includes industry-leading professionals with expertise in physical and cybersecurity, risk management, and emergency preparedness for water utilities. Leveraging American Water Works Association (AWWA) standards, we delivered more than 30 AWIA compliance projects during the initial compliance period in 2019. Today, we are working with various clients across the U.S. on AWIA recertification. Our local management team is familiar with the District’s facilities and has supported the District with technical and non-technical projects including development of the original RRA and ERP in the 2020 AWIA certification cycle. Most of the proposed Carollo team were involved with the original project, bringing institutional knowledge and unmatched project experience.
Streamlined and Collaborative Approach. We understand the importance of meeting the District’s deadlines while minimizing disruptions to staff. Through workshops, stakeholder engagement, and efficient project management practices, we will deliver a comprehensive and cost-effective solution tailored to meet the District’s needs.
Established Performance. We have successfully delivered numerous resilience and emergency management projects for cities and utilities in California - and across the US - using the United States Environmental Protection Agency (USEPA) recommended AWWA J100 standard and related AWWA standards. Our expertise also includes using the AWWA G440-11 Standard, which provides useful guidance relevant to the District’s need to achieve compliance. We will leverage our specific knowledge of your systems and the region to assess compliance relative to AWIA requirements, reducing the burden on utility staff for information.
Commitment to Capability Maturity; Our Approach Goes Beyond Compliance. We focus on aligning emergency preparedness and security programs with utility-wide goals, building a roadmap for sustainable resilience, and validating readiness through targeted exercises and training programs. T o deliver the highest level of service and expertise, Carollo partners with Enterprise Protection Associates (EPA), a trusted collaborator on all of our AWIA and security projects. EPA brings extensive experience in threat-risk assessments and risk mitigation planning for utilities nationwide and was instrumental in supporting the District through its original AWIA process in 2020.
DIR Number
1000007174
707 Wilshire Boulevard, Suite 3920
Los Angeles, California 90017
213-489-1587
20 Michel Kadah
City of Simi Valley/Ventura County Waterworks District No. 8 June 9, 2025
We look forward to the opportunity to work with the District on this important project and are eager to contribute to the success of your AWIA recertification and long-term resilience, emergency preparedness, and security goals. Please feel free to reach out to us with any questions or further clarification.
Carollo will work with the District to see that all requirements stated in the Request for Proposals are achieved following contract award.
Sincerely,
CAROLLO ENGINEERS, INC.
Shawn Corrigan, CEM, ABCP, ENV SP
S
teven Dowker, ABCP
VP, Resilience and Sustainability T echnical Practice Director Project Manager, Point-of-Contact
SCorrigan@carollo
.com
SDowk
[email protected]
21 TOC
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Table of Contents
Section 1: Introduction ......................................................................2 Section 2: Project Analysis
.............................................................3 Section 3: Objective, Scope,
..........................................................4 Nature of Proposed Program
Section 4: Work Program
................................................................6 Section 5: Methodology
..................................................................11 Section 6: Project Management
....................................................15
Section 7: Assigned Personnel
......................................................16 Section 8: Schedule
..........................................................................20 Section 9: Program Monitoring
.....................................................22 Section 10: District Resources
........................................................23 Section 11: Subcontractors
..............................................................24 Section 12: Statement of Proposer’s Qualifications
................26
and References
Section 13: Optional Proposals
......................................................29 Section 14: Conflict of Interest
.......................................................35 Appendix
- Exhibit C - Insurance
- Resumes
22 PROPOSAL / May 2025
Section 1:
Introduction
23 2
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 1: Introduction
Carollo has specialized in risk, resilience, security,
cybersecurity and emergency planning for water
and wastewater utilities since the early 2000s. The
team has successfully completed over 100 projects
including threat assessments, risk assessments,
security reviews, resilience evaluations, and
emergency response planning.
With a robust background in resilience planning,
Carollo was among the first consultants to work
closely with AWWA and EPA staff, helping clients
throughout the nation complete value-added RRA
and ERP efforts to achieve compliance. Carollo’s
team brings local knowledge, proven leadership, and
unmatched resilience expertise. We have assembled
the same team of highly qualified experts who
supported the District in the original RRA and ERP
development process to support the 2025 update
and recertification process. We offer the following:
Expertise, Experience, and Teamwork.
Our team’s strength lies in effective
collaboration, a shared passion for resilience, and
diverse expertise in security, risk, and resilience
planning for water utilities. We thrive on the
challenge of investigating hazard vulnerabilities
and developing targeted mitigations and solutions
for clients. This synergy and commitment enable
us to deliver a high-impact approach to recertifying
your RRA and ERP.
Local Knowledge and Collaboration.
With experience supporting the District
through the initial RRA and ERP certification process,
we understand local laws, critical regulations, and
operating practices on the ground and will bring this
legacy experience forward for the 2025 AWIA
recertification process.
Proven Leadership and a
Trusted Security Partner.
Our team, led by Project Manager Steven Dowker
and senior leaders Shawn Corrigan and George
Whitten, possesses proven expertise in AWIA-
compliant RRA and ERP development. Having
delivered over 30 AWIA projects in the initial
compliance phase, we now support approximately 13
Tier 1 utilities and are prepared to assist the District as the recertification deadline approaches. Our
20-year partnership with Enterprise Protection
Associates (EPA) enhances our capabilities. EPA
brings deep expertise from more than 100 security
projects in the water sector that focus on security
assessments, vulnerability analysis, and response
planning for comprehensive AWIA compliance and
resilience. This combination of local knowledge,
regulatory insight, and technical expertise is the
reason AWIA considers our team an industry leader
in this competitive sector.
America’s Water Infrastructure Act Compliance
Emergency and Continuity Management Planning
Response and Recovery
Response and Recovery Support
Security Master Planning and Design
Cybersecurity Solutions
24SIM0625-AWIA-CA-Map-2024.ai
The map below highlights Carollo’s extensive experience leveraging our technical expertise in water and wastewater to help utilities complete their AWIA legislative requirements. 24 PROPOSAL / May 2025
Section 2:
Project Analysis
25 3
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 2: Project Analysis
The District requires an update to its RRA and
ERP, in compliance with AWIA requirements. Our
team recognizes the goal of maintaining system
compliance, enhancing resilience, and integrating
new regulatory and infrastructure changes
since the 2020 assessment. Key updates must
incorporate significant changes to infrastructure,
lessons identified through real-world emergencies
within the industry, and best practices for risk
management and emergency management in the
water sector.
The first phase of the project will focus on collecting and reviewing system changes over the last five
years, in addition to lessons learned from the first
round of AWIA certification. This assessment will
include evaluating updated physical and cyber risks,
supply chain vulnerabilities, and impacts of events
like COVID-19. The inclusion of newly-constructed
water facilities will be a critical component of
the asset review and risk reassessment.
We will facilitate discussions on asset changes,
threat prioritization, and mitigation strategies through a series of workshops. Our approach includes
engaging key departments, such as Information
Technology (IT), to evaluate cyber-related
vulnerabilities and confirm system resilience to
both physical and digital threats.
Using data collected through document review,
workshop discussions, and stakeholder meetings,
we will develop an updated RRA for the District with
prioritized risks and mitigation options to increase
resilience. The final phase involves updating the ERP
to incorporate findings from the RRA. The ERP will
follow industry best practices and USEPA guidance
when detailing procedures for responding to both
malevolent acts and natural hazards. Throughout the
effort, we will maintain a strong focus on achieving
timely certification for both the RRA and ERP.
In support of the scope of work detailed in the
RFP, Carollo has compiled two optional scopes of
work that directly support the implementation of
operational resilience programs. These optional
components build on work that the District has
recently completed specific to IT and cybersecurity
assessments and presents a valuable ERP validation
opportunity to support ongoing implementation
of emergency preparedness into the District’s
operating culture.
Carollo’s innovative AWIA update process meets
the United States Environmental Protection
Agency (USEPA) standards and enhances
emergency preparedness. The five-year AWIA
update process fosters a continuous cycle of risk
and emergency program development, improving
the District’s overall resilience. Carollo’s approach
revitalizes resilience programs and effectively
meets USEPA’s requirement to demonstrate new
strategies for strengthening existing systems.
24SIM0525pf2-emergency-cycle-circle.ai
STA K EH O LD ER EN G AG EM ENT
The AWIA update cycle is more than just the check of a box, it represents an opportunity to improve overall system resilience.
A successful resilience program requires a consistent update to review latest system risks and how to effectively manage those risks as they evolve.
26 PROPOSAL / May 2025
Section 3:
Objective,
Scope, Nature
of Proposed
Program
27 4
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 3: Objective, Scope,
Nature of Proposed Program
Congress passed America’s Water Infrastructure
Act (AWIA) in October 2018 to “improve drinking
water and water quality, deepen infrastructure
investments, enhance public health and quality of
life, increase jobs, and bolster the economy.” To
meet AWIA compliance requirements, each water
utility serving over 3,300 customers completed a
risk and resilience assessment (RRA) and updated
its emergency response plan (ERP) in 2020/2021.
To maintain compliance, these utilities must update
and recertify their RRA and ERP every five years to
support continued preparedness and the ability to
handle emergency situations quickly and efficiently.
The AWIA does not require a specific methodology
for fulfilling the legislative requirements. However,
the USEPA recommends use of the AWWA J-100
Standard to achieve compliance. The legislation
and subsequent USEPA and American Water Works
Association (AWWA) guidance identify multiple other
voluntary consensus standards including, but not
limited to:
• AWWA Cybersecurity Guidance Tool.
• AWWA M19 Emergency Planning for Water and
Wastewater Utilities.
• AWWA G300 Source Water Protection.
• AWWA G430 Security Practices for Operation
and Management.
• AWWA G440 Emergency Preparedness Practice.
Our team worked closely with each of these
standards to develop compliant plans on all of our
previous AWIA projects. More specifically, having
completed the District’s first AWIA compliant plans,
our team is able to streamline the use of these
standards and tailor them appropriately to fit the
District’s needs.
Carollo played a key role on the
Project Advisory Committee
for the AWWA Water Sector
Cybersecurity Risk Management
Guidance and the AWWA
Cybersecurity Assessment Tool.
Our hands-on experience in
developing and implementing
this tool directly supports
compliance with ANSI/AWWA
G430, helping the District
minimize vulnerabilities and
reduce the risk of cyber-attacks.
Carollo’s expertise can give you
peace of mind that your water
and wastewater systems are not
only compliant but also resilient
against emerging threats.
28 5
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
SECTION 3: OBJECTIVE, SCOPE, NATURE OF PROPOSED PROGRAM Deliverables Activities Objective
Project
Management
Data Collection
and Site Visits RRA Updates ERP Updates
Manage project status,
schedule, budget, and quality
management practices.
Gather and review data for
risk and resilience analysis,
incorporating current
information.
Update the District’s 2020
RRA with new information,
threats, and vulnerabilities to
enhance resilience.
Update the District’s
existing ERP to meet AWIA
compliance and reflect
current risk and resilience
profiles identified through the
RRA process.
Emergency Response Plan
Carollo implements a structured approach to conducting RRA and ERP updates. The following table provides an overview of project activities and key deliverables. Project plan, schedule ,
and status reports.
Kick
-off and prioritization
workshop results.
Meeting notes and action
items.
Updated data request
log.
Site visit reports
and photographic
documentation.
Meeting and site visit
schedule.
Draft and Final RRA
R
eport including updated
appendices, i.e., G430
conformance updates.
Risk Management T
echnical
Memorandum Update.
Risk and R
esilience
Assessment Certification
Letter.
Draft and Final Emergency
R
esponse Plan (ERP).
Emergency R
esponse Plan
Certification Letter.
Hold a 2-hour virtual
work
shop to assess the
current ERP against AWIA
requirements and the
updated RRA, identifying
gaps and areas for
improvement.
R
evise the ERP structure
to reflect updated
asset-threat pairs,
organizational changes,
and new AWIA guidelines,
addressing outdated
information.
Submit the updated ERP
to the District for review
and incorporate feedback
from k
ey stakeholders.
Conduct a virtual meeting
to discuss feedback and
revisions, finalizing the
updated ERP document.
R
eview and update assets
and threats, validate the
relevance of previous
threat-asset pairs, and
assess new risks.
R
ecalculate risk rankings
based on updated data and
update the prior AWWA
G430.
V
alidate and prioritize risk
mitigation projects, ranking
them by benefit-cost for
review with District staff at
a dedicated risk manage-
ment workshop. Update
the risk management
technical memorandum
accordingly.
Prepare an updated RRA
report with versioning.
Submit data requests that
cover security
, resilience,
and emergency response
updates.
Collect data from
stak
eholder meetings and
reviews.
Visit critical system assets
and document conditions
(include photos).
Confirm data aligns
with A
WIA compliance
requirements.
Coordinate with
District staff on
deliverables, project
goals, and milestones,
establishing alignment on
methodology
.
Submit monthly invoices
and status reports and
hold regular meetings to
review project progress,
schedule
, and budget.
Schedule and facilitate
meetings with k
ey
stakeholders (e.g., O&M
staff, DHS), providing
agendas and meeting
minutes.
Plan and conduct
workshops to assess asset
changes, threats, and
validate risk analysis.
29 PROPOSAL / May 2025
Section 4:
Work Program
30 6
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 4: Work Program
Overview
In order to complete the scope of work detailed
in the RFP, Carollo will complete two primary
project tasks, consisting of the RRA and the ERP
updates. These tasks will be completed over a
12-month period to achieve compliance with the
AWIA certification deadlines in 2025 and 2026,
respectively. The following section provides a
detailed breakdown of each primary task and the
meetings and deliverables associated with each.
Task 1 – Risk and Resilience
Assessment Updates
Carollo will complete the following subtasks to
support successful delivery of the updated water
system RRA. A variety of meetings and workshops
will be required and initial efforts will focus on site visits and meetings with key stakeholders (i.e., utility management, operations, IT, etc.). As the project
moves forward, the team will transition to draft
document review.
Task 1.1 – Project Management
This task includes project management activities,
submittal of monthly progress reports, and
overall coordination and assistance associated
with the initial RRA update task. The RRA update
task duration is 6 months. Efforts will include
implementation of a project plan and management of
the project schedule and budget. Monthly progress
reports will contain current project status and
identification of key issues or elements of the project that will need to be addressed in the proceeding
weeks. The monthly progress reports will be
presented virtually, and a copy will be submitted
electronically via email (PowerPoint or Word).
Task 1.2 – Kickoff/Visioning/Facility
Prioritization Workshop
Carollo will facilitate an in-person project kickoff/
visioning meeting with District staff. This team will
schedule this meeting during the same visit as the
subsequent site visits and Workshop No. 1. The
meeting will accomplish several objectives:
• Make sure the entire team has a
thorough understanding of the key
project goals, performance expectations,
and AWIA requirements.
• Develop an understanding of the methodologies
and guidance documents to be followed for the
RRA and ERP updates.
• Confirm schedule milestones and any required
coordination with ongoing and/or future planning,
design, or construction efforts.
• Review existing risk/resilience, security,
emergency response, and emergency/disaster
planning approaches, and discuss desired
enhancements as they relate to the water system.
• Discuss the latest system configuration and
assets to clearly understand any updates to
specific materials, processes, information,
and equipment that will be protected and the
operational priorities of each.
• Present methodology for the efforts to be
completed for the remainder of the project.
• Identify key project stakeholders.
Task 1.3 – Progress Meetings
Carollo will conduct RRA progress meetings to
discuss project status including plan development,
required decisions, upcoming activities, budget
status, and overall project schedule. Meetings will
be scheduled between other project workshops and
meetings. Progress meetings will be conducted via
teleconference with up to three (3) meetings planned
as part of this task.
Task 1.4 – Stakeholder Meetings
As part of the kickoff meeting, Carollo will work
with the District to schedule subsequent meetings
with other key project stakeholders that may
have critical input and recommendations during
the planning effort. These groups may include
operations and maintenance staff, IT staff, local
law enforcement/first responders, and the U.S.
Department of Homeland Security (DHS). The team
will distribute an agenda prior to each meeting
and provide meeting minutes to all participants.
Carollo will make every effort to schedule these
meetings in conjunction with other project
meetings and/or site visits to promote efficiency.
31 SECTION 4: WORK PROGRAM
7 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Task 1.5 – Workshop No. 1
The purpose of Workshop No. 1 is to review
assets, assess changes that occurred in the
past five (5) years, discuss threats, and identify
and prioritize threat-asset pairs. This will be an
in-person workshop, scheduled in conjunction
with the kickoff meeting and followed by site
visits to representative utility assets. The
workshop is planned for a half-day, with site visits
occurring on the first three (3) days following
the workshop. The site visits will help the team
confirm site conditions and validate vulnerabilities
determined during the first AWIA phase.
Task 1.6 – Data Collection and Site Visits
Carollo will submit an initial data request in advance
of the project kickoff meeting. The request will
include documentation developed since the 2020
RRA and 2021 ERP and other documentation
developed within the prior five (5) years related to
security, emergency, and disaster response planning,
including, but not limited to:
• Vulnerability Assessments
• Threat Assessments
• Emergency Response Plans
• Cybersecurity Plans
• Business Continuity Plans
• Contracts
• Security Policies
• Documented Procedures
• Utility and/or Departmental Requirements
• Existing Operational Documentation
• Existing Master Planning or Resiliency Related
Documentation
The initial data request will be discussed during
the kickoff meeting and may lead to follow-up
discussions and additional data requests. This
information will be critical to promoting
efficiency and facilitating open dialogue with key
project stakeholders.
As part of the kickoff and Workshop No. 1 visit,
Carollo will visit new system assets constructed
since the 2020 AWIA efforts and any additional
sites that would benefit from follow-up visits due to
changed site conditions. As noted, site visits will be
scheduled and completed the same week as the
kickoff meeting. Carollo will document the results
of each visit (including site photos) for use in the
subsequent assessment effort.
Task 1.7 – AWWA G430 Analysis Update
The intent of this task is to conduct an AWWA G430
analysis. The G430 is not a regulatory requirement,
but we conduct this task as an added value for
our clients. This analysis will outline the minimum
requirements for a security program: promoting
protection of employees, public safety, health, and
confidence. The result of this task will be an updated
AWWA G430 table, highlighting any additional areas
needing improvement.
Task 1.8 – Workshop No. 2
Workshop No. 2 includes a facilitated discussion
with utility staff to determine how the water system
and threat changes discussed in Workshop No. 1
impact primary risk factors for the utility; namely the consequence, vulnerability, and threat likelihood
for each critical asset. This workshop is planned
to be held virtually. A cyber threat discussion will
be included in this workshop. Note that the team
will hold separate stakeholder meetings with
each utility IT department to discuss cyber-related
vulnerabilities in more detail given the sensitive
nature of the information.
Task 1.9 – Complete Risk Calculations
This subtask includes validation of the 2020
calculated risk and resilience values for specific
threat-asset pairs. This effort will commence after
validation of key risk factors with utility staff in
Workshop No. 2. As part of the task, the team will
recalculate the risk of threat-asset pairs based on
updated information from prior tasks.
The anticipated outcome is an updated asset
risk ranking table. The District’s overall system
resilience will be recalculated using the Utility
Resilience Indicator (URI). By using the same J100
risk calculation and URI resilience calculation
methodologies from 2020, the District will have
a clear point of comparison to the initial
benchmark RRA.
32 SECTION 4: WORK PROGRAM
8 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Task 1.10 – Draft Updated RRA
Using the information generated during previous
tasks, the team will create an updated version of
the District’s 2020 RRA Report. The report will
include an upfront versioning table that highlights
the general updates made and the timing of those
updates for record and sign-off. The assumption
is that the chapter and appendix structure of the
existing RRA document will remain unchanged, with
the addition of any value-added documents as
appendices to the report. The report will consider
and discuss the following critical components in
alignment with AWIA requirements:
• The risk to the system from malevolent acts and
natural hazards.
• The resilience of the pipes and constructed
conveyances, physical barriers, source water,
water collection and intake, pretreatment,
treatment, storage and distribution facilities,
electronic, computer, or other automated
systems (including the security of such systems)
which are utilized by the system.
• The monitoring practices of the system.
• The financial infrastructure of the system.
• The use, storage, or handling of various
chemicals by the system.
• The operation and maintenance of the system.
• The draft report will be submitted to the District
for review two (2) weeks prior to Workshop No. 3.
Task 1.11 – Workshop No. 3
Workshop No. 3 is a facilitated, working meeting to
review the final risk calculations and update the draft report by incorporating the District’s comments. The
workshop will be held virtually and will also serve
as the introduction for the ERP update process.
Following the workshop, the team will implement
requested changes, as agreed upon by all parties
during the workshop, for delivery of an updated RRA
in advance of the 2025 deadline.
Task 1.12 – Risk and Resilience
Management
Carollo will take the information from previous
tasks and work with the District to reduce risks and
enhance system resilience. This task will include
discussions with stakeholders to:
• Decide whether the estimated levels of risk and
resilience are acceptable.
• Define countermeasures, consequence
mitigation, and resilience options.
• Evaluate options for net benefits and cost-
benefit ratios.
• Select specific options in planning and
budgeting.
This task provides an overall management approach
to the process that involves recalculating risk with
a reduced number of vulnerability quantifiers
based on the mitigation options selected. Carollo
will deliver an updated risk management technical
memorandum that includes capital improvement
recommendations for District use.
Task 1.13 – Final Updated RRA
This subtask includes implementation of draft RRA
update comments and feedback from Workshop
No. 3. The final deliverable will be an updated
2025 District RRA Report complying with AWIA
requirements in advance of the required certification
deadline.
Task 1 Meetings
• Kickoff/Visioning/Facility Prioritization Workshop
(2-hour in-person).
• Workshop No. 1 - Review Assets, Changes,
Threats, and Prioritize T-A Pairs (4-hour in-
person).
• Workshop No. 2 - Utility changes, security
measures, cyber, impacts to C, V, TL (4-hour
virtual).
• Workshop No. 3 - Review final risks, integrate
comments, ERP intro.
• Workshop No. 4 - Review risk management
findings and recommendations with District staff.
• Up to three (3), 1-hour progress meetings.
33 SECTION 4: WORK PROGRAM
9 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Task 1 Deliverables
• Meeting agenda, materials, minutes, and
comment logs (1 electronic PDF for each).
• Monthly progress reports (electronic).
• Data Request Log (electronic).
• Draft RRA Update with Appendices (1 electronic
PDF).
• Final RRA Update with Appendices (1 electronic
PDF).
• Risk Management Technical Memorandum
Update.
Task 2 – Emergency Response Plan
Updates
The District’s 2020 ERP will be utilized as a baseline
for the ERP-related requirements outlined by AWIA.
The updates will be based on the information
gathered, and risk and resilience updates
identified, as part of the RRA tasks. This task will
result in updates to the existing ERP document
specific to any new-found asset-threat pairs, or
any changes in organizational structure since the
prior ERP update. This update will also consider
how real-world incidents across the industry have
redefined emergency response actions, priorities
and structures to enable the 2025 ERP to meet
the needs of the District for use in real-world
emergencies.
The ERPs will follow FEMA’s Comprehensive
Preparedness Guide (CPG) 101v3, industry best
practices, and USEPA/AWWA guidance to align with
the following AWIA legislative requirements:
• Strategies and resources to improve the
resilience of the system, including physical
security and cybersecurity.
• Plans and procedures that can be implemented,
and identification of equipment that can be
utilized, in the event of a malevolent act or
natural hazard that threatens the ability of the
community water system to deliver safe drinking
water.
• Actions, procedures, and equipment that can
obviate or significantly lessen the impact of a
malevolent act or natural hazard on the public
health and the safety and supply of drinking
water provided to communities and individuals.
• Strategies that can be used to aid in the
detection of malevolent acts or natural
hazards that threaten the security or resilience
of the system.
Having completed the original development of the
District’s ERP to AWIA standards will enable the
Carollo team to compare and contrast the content
in the existing plan and confirm that the plans,
processes and response guidance provided within
the plan aligns with industry best practice and
incorporates new information identified as being
pertinent for inclusion in the plan.
Task 2.1 – Project Management
This task includes project management activities,
submitting monthly progress reports, and overall
coordination and assistance associated with the
ERP update task. The ERP update task duration is
6 months. Efforts associated with this task include
implementation of a project plan and management of
the project schedule and budget. Monthly progress
reports will include current project status and
identification of key issues or elements of the project that will need to be addressed in the proceeding
weeks. The monthly progress reports will be
presented virtually, and a copy will be submitted
electronically via email (PowerPoint or MS Word).
Task 2.2 – Progress Meetings
Carollo will conduct ERP progress meetings
to discuss the project status including plan
development, required decisions, upcoming
activities, budget status, and overall project
schedule. Meetings will be scheduled between other
project workshops and meetings. Progress meetings
will be conducted via teleconference with up to two
(2) meetings planned as part of this task.
Task 2.3 – Stakeholder Meetings
Similar to Task 1.4, the Carollo team will work with
the District to schedule meetings with key project
stakeholders that may have critical input into
emergency response, including elements of the
critical dependencies identified in the ERP (i.e.,
power providers, chemical suppliers, etc.). Carollo
will distribute an agenda prior to each meeting
and will provide meeting minutes to all participants.
Carollo will attempt to schedule these meetings in
conjunction with other project meetings or site visits
to promote efficiency.
34 SECTION 4: WORK PROGRAM
10 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Task 2.4 – Workshop No. 4
Following Task 1.12 – Risk and Resilience
Management, our team will hold a virtual workshop
to review the District’s 2021 ERP to compare the
document with the latest RRA and risk management
findings. During the workshop, the team will review
the existing ERP with utility staff to determine
whether any of the risk mitigation findings are
addressed at some level in the document or could
be addressed in the subsequent updates. The
result of the workshop will be an actionable list of
necessary ERP updates.
Task 2.5 – Draft ERP Updates
This subtask includes implementation of the findings
from Workshop No. 4 to meet AWIA compliance
requirements. Carollo will deliver a draft ERP to the
District two (2) weeks prior to Workshop No. 5 for
utility review in advance of the review workshop.
Task 2.6 – Workshop No. 5
Workshop No. 5 includes a facilitated review of the
District’s draft ERP update comments and feedback.
The virtual workshop is estimated to be two (2) hours
in duration and will lead to a final log of action items to complete the ERP update task.
Task 2.7 – Final ERP Updates
This subtask includes implementation of draft
document comments captured during Workshop No.
5 to develop a final 2026 District ERP meeting the
AWIA compliance requirements. ERP updates will be
completed in advance of the 2026 ERP compliance
deadline.
Task 2 Meetings
• Up to two (2), 1-hour progress meetings.
• Workshop No. 4 - Review current ERP and
identify needed updates (2-hour virtual).
• Workshop No. 5 - Review ERP
updates (2-hour virtual).
Task 2 Deliverables
• Meeting agenda, materials, minutes, and
comment log (1 electronic PDF for each).
• Draft ERP update (1 electronic PDF).
• Final ERP update (1 electronic PDF).
35 PROPOSAL / May 2025
Section 5:
Methodology
36 11
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 5: Methodology
Overview
The guiding standards for the development of this
RRA are the AWWA J100 and G430 standards. The
purpose of the AWWA J100 standard is to support
resource allocation decisions that reduce risks and
enhance resilience of critical water and wastewater
infrastructure. The J100 process includes multiple
steps designed to provide an objective that is
repeatable and transparent; and a quantitative
approach to performing the RRA that will be
accepted by AWWA, USEPA, and Department of
Homeland Security (DHS). These steps include:
1. A
sset characterization.
2. T
hreat characterization.
3. C
onsequence analysis.
4. V
ulnerability analysis.
5. T
hreat analysis.
6. R
isk analysis.
7. R
esilience analysis.
8. R
isk management.
The J100 process guides risk analysis by helping
identify threat likelihoods, vulnerabilities, and
consequences to critical assets. It also determines
and prioritizes associated risk reduction measures
based on relative effectiveness and cost benefits.
Using the outputs of this process, decision makers at
various levels - such as owners, community leaders,
and government executives - can decide which
measures to carry out.
The AWWA G430 standard outlines the minimum
requirements for a security program that promotes
protection of employee safety, public health, public
safety, and public confidence. The standard includes
13 unique security criteria which can be evaluated
to understand the utility’s physical, electronic, and
operational security profile. This profile impacts the
utility’s vulnerability and resilience scores and is an important component in the risk analysis process.
While USEPA recommends the use of the AWWA
J100 standard to achieve AWIA compliance,
any voluntary consensus approach that meets
the AWIA requirements is appropriate. One of
the key advantages to using AWWA standards
is that they can reduce a utility’s liability if a
human-made or natural disaster occurs based
on their Support Anti-terrorism by Fostering
Effective Technologies (SAFETY) Act of 2002
Act designation. The SAFETY Act was enacted
by Congress in the wake of the terrorist attacks
on September 11, 2001 as an incentive for the
deployment of technologies and services with anti-
terrorism capabilities. Given the J100 and G430
standards received SAFETY ACT designations
by the DHS, properly implementing these
standards provides important liability protection
for AWWA and the utility using the standards.
The 2025 RRA process will leverage the latest
version of the AWWA J100 standard (J100-21). Key
updates from the previous version (J100-10) include:
• Consolidation of Process Network Cyberattack
and Business Network Cyberattack into one
hazard category: Cyberattack.
• Increased specification of natural hazard threats,
now grouped by hazard severity.
• Accidental contamination no longer
characterized as a “malevolent” threat.
• Added recommended assessment methodology
for assessing wildfire and ice storm threats.
Previous assessment methodology updated for
earthquakes, hurricanes, and tornadoes.
Other than the above changes, the general
methodology of the J100 risk assessment process
remains unchanged and still relies primarily on the
risk equation.
Carollo and the District followed a methodical
approach to executing the J100 process in achieving
compliance during the first round of AWIA. Carollo
proposes to use these same steps for recertification
of the District’s RRA, with more emphasis placed
on validation exercises rather than rehashing every
conversation and system detail. Carollo knows your
system and will draw on this knowledge to execute
an efficient, compliance, and most importantly
useful document in continuing to built the District’s
resilience profile.
37 SECTION 5: METHODOLOGY
12 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Risk Equation
Understanding the risk equation is essential to the RRA process. The equation quantifies the various components of risk as follows:
W
here:
• R = Risk; calculated as a dollar value.
• C = Consequence; presented as a dollar value.
• V = Vulnerability; presented as a discrete number between 0 (low) and 1.0 (high). • T = Threat Likelihood; presented as a discrete number between 0 (low) and 1.0 (high).
As part of the risk analysis, consequences to infrastructure and utility staff are developed and presented in terms of dollars, based on the vulnerability and likelihood of the event. Calculating risk as a dollar value enables the organization to measure changes in risk using dollars/cost.
This is necessary for the risk and resilience management phase of the J100 process, where benefit-cost ratios are calculated to compare the cost of existing consequences against the potential cost of consequences if various risk mitigation measures were implemented.
Likelihood measures the probability of an event occurrence, but not necessarily the success of an attack. Vulnerability is a reflection of the security profile of an organization. Vulnerability assumes the event has occurred and is a measure of how likely it is that the associated security profile will prevent or mitigate the estimated consequences. While the likelihood of an event may be very high, the vulnerability to the event may be very low due to the security measures in place. Conversely, the likelihood of an event may be very low, but the facility may have a very high vulnerability to the event.
R = C x V x T
The RRA process involves evaluating all three
factors in the equation to arrive at a quantifiable
risk for a given threat-asset pair. The sections
below discuss each component of the risk
equation in more detail, as outlined by the
AWWAJ100 process.
Asset Characterization
The first step in the process, asset characterization,
involves deciding which of the utility’s facilities and assets should be included in the evaluation process.
The determination of critical assets is primarily
based on the consequences of losing that asset,
specifically related to the utility’s ability to meet
its mission and service goals. Ultimately, this step
includes a ranking of asset criticality to separate
the most critical assets from the least critical assets.
A critical asset is defined as any asset that, when
absent or unavailable, would lead to the following:
• Significant degradation of the utility’s ability to
execute its mission.
• Unacceptable human, financial, or political
consequences to the owner or the community.
Threat Characterization
The next step in the RRA process is threat
characterization. This is an important step that
identifies which threats and hazards to consider for
each asset and defines them in enough detail to
drive the risk assessment. Note that the terms
“threat” and “hazard” are often used interchangeably.
Consequence Analysis
Consequence analysis is the third step in the J100
process. This step estimates the human, economic
and service losses associated with each TA pair
identified as part of the previous step.
Further detailed characterization is done for
natural hazards potentially impacting the utility,
as well as for threat-asset (TA) pairs identified
as part of the J-100 process.
38 SECTION 5: METHODOLOGY
13 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Using the “worst reasonable case” definitions, each
TA pair is evaluated in terms of the following:
• Number of potential fatalities.
• Number of serious injuries.
• Financial losses to the organization.
• Loss of service to regular customers and critical
customers (in million gallons per day [mgd]).
• Duration of service disruption.
To determine the consequences to human life
(fatalities and injuries), the value of statistical life (VSL) is used. This number provides a monetary
value to a lost life and serious injury. In 2023, the U.S.
Department of Transportation (U.S. DOT) determined
a VSL of $13.2M for loss of life, and approximately
$3.5M for a severe injury. Using these values, if an
event caused two fatalities and a severe injury, the
risk of that event at this phase of the assessment
would be approximately $30M.
Vulnerability Analysis
Following the consequence analysis, a
vulnerability analysis is completed for each TA
pair. This analysis provides a mechanism to
assess the ability of a given threat or hazard to
cause the level of consequences identified in
the previous efforts. This potential is measured
by assessing the organizational and local
capacity to prevent the given consequences
(i.e. through security measures, etc.). Note that
this step assumes the attack or natural hazard
is occurring, with no consideration for likelihood
(which is factored as part of a subsequent step).
To determine vulnerability, this assessment focuses
primarily on areas that either do not meet best
practices or may require some level of additional
attention. Best practices are a baseline and are
measures that, when employed judiciously and
appropriately, will reduce a utility’s vulnerability.
These practices are not an exhaustive list of items
that must be followed. Instead, they are a sampling
of practices deemed most appropriate for this
context.
Threat Analysis
This portion of the process involves evaluating the
likelihood of a specific threat occurrence. This is
not to be confused with the vulnerability analysis,
which estimates the chances of an event’s success,
assuming it occurs. For this analysis, each TA pair
is evaluated and assigned an estimated likelihood.
For natural hazards and criminal activities, historical frequencies from government sources can be
consulted to generate a baseline for estimates.
Adjustments can then be made to the baselines from
local intelligence and history. The following types of
hazards are the priority focus of this analysis:
• Malevolent Hazards
• Dependency Hazards
• Natural Hazards
Risk Analysis
One of the final steps in the risk assessment is
estimating the risk to the threats and hazards
identified. This is achieved by calculating the risk
for each TA pair using the risk equation
(R = C x V x T). Overall risk is calculated by the
sum of the consequences accrued from fatalities,
serious injuries, loss of service costs, and financial
losses to the utility. These consequences are then
multiplied by the vulnerability of the asset and the
likelihood of the threat occurring. This process
is conducted for each TA pair and the resulting
values are ranked against each other to determine
the highest relative risks in the water system.
Financial loss to the organization is measured
as follows:
• Repair and replacement costs for assets
damaged or destroyed in the incident. These
costs are estimated with an “emergency
premium,” when relevant, to reflect the higher
costs of “urgent” construction compared to
“business as usual” construction.
• Business interruption costs, including revenue,
emergency operations costs, plus any
penalties for service interruption.
• Environmental remediation and personal
liability costs (after any insurance payments).
• Abandonment costs, if any.
• Other costs directly attributable to the
incident.
39 SECTION 5: METHODOLOGY
14 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Resilience Analysis
According to the AWIA legislation, resilience of
a utility is measured in two key areas: financial
resilience and operational resilience. Financial
resilience represents an organization’s ability to
financially withstand catastrophic events resulting
from the threats discussed earlier in this section.
These events can place a significant strain on the
financial resources of a utility. In most cases, a loss of service results in a significant loss of revenue,
without which there is no way to properly maintain
the system. Note that an impactful event can be
even more consequential in areas of lower income
and/or higher unemployment.
Risk Management
Once risk and resilience levels are established,
the next stage in the J100 process is to effectively
manage the identified risks. Per the AWIA legislation,
water utilities are not required to complete the
risk management step as part of the RRA. Instead,
the risk management described in this section is
meant to complement the emergency response/
preparedness plan updates. The risk and resilience
management effort comprises these tasks:
• Determine whether the calculated risks and
resilience levels are acceptable.
• Define/design countermeasure or mitigation
options for unacceptable risks/resilience levels.
• Estimate the costs of options.
• Re-estimate C, V, and T components given the
options to estimate benefits.
• Combine benefits of options that affect multiple
TA pairs.
• Calculate cost/benefit ratio and net benefits.
• Rank and select the available options relative to
the available budget.
• Manage, monitor, and evaluate selected options.
• Repeat the risk/resilience analysis periodically or
as conditions change.
Emergency Response Plan
Similar to the RRA, Carollo and the District spent a
considerable amount of time during the first round
of AWIA going through system details, threats,
vulnerabilities, and risks to develop a compliant
emergency response plan. Carollo plans to build
on this effort in conjunction with the latest FEMA
Comprehensive Preparedness Guide (CPG) 101v3,
industry best practices, and USEPA/AWWA guidance
to align with AWIA legislative requirements. As
required by the AWIA legislation, Carollo will walk
through each of the core ERP components required
by AWIA and deliver an updated ERP to the District
that helps build on the latest RRA risks and industry
best practices. Specific components driving the
update of the ERP include:
• Strategies and resources to improve the
resilience of the system, including physical
security and cybersecurity.
• Plans and procedures that can be
implemented, and identification of
equipment that can be utilized in the event
of a malevolent act or natural hazard that
threatens the ability of the community water
system to deliver safe drinking water.
• Actions, procedures, and equipment that can
remove or significantly reduce the impact of a
malevolent act or natural hazard on the public
health, safety, and supply of drinking water
provided to communities and individuals.
• Strategies that can be used to aid
in the detection of malevolent acts
or natural hazards that threaten the
security or resilience of the system.
40 PROPOSAL / May 2025
Section 6:
Project
Management
41 15
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 6: Project Management
A successful AWIA project requires a thorough
scope, schedule, and budget that establishes
consensus on the necessary activities and expected
results. Project Manager, Steve Dowker, and
Quality Manager, George Whitten, will work closely
with District staff to develop these documents
and establish the vision for successful project
execution. Steve and George have led more than
25 other AWIA-related projects and have assisted
in developing the tools required to streamline
execution and deliver a high-quality project for the
District. Steve will be the primary point-of-contact
and will coordinate the efforts of the Carollo team
and provide oversight of technical project delivery.
Keeping you in the Loop –
Progress Meetings and Reports
At Carollo, we understand that consistent and
ongoing project review and reporting is critical to
keeping a project on schedule. Steve will schedule
monthly progress meetings upon project kick-off and
submit monthly invoices and status reports to the
District project lead that verify everyone is on the
same page from project start to completion.
Staying on Schedule and Budget
Our team is committed to delivering this AWIA
project within budget and in advance of regulatory
deadlines. We will work together as a team to review
each deliverable, so that there is consensus and
understanding on the progression and integration
of the RRA and ERP Updates. In addition to the
importance of meeting budgets and deadlines,
Carollo is committed to delivering a quality project by incorporating extensive quality assurance and quality
control (QA/QC) practices that catch potential issues
early and avoid re-work. We also assign the right staff for each task so those with the best experience can
complete the work efficiently. Carollo’s involvement
with the District’s RRA/ERP efforts will be a
differentiator in providing a high-quality assessment
that is well integrated with local and regional efforts and efficiently executed.
KEY ELEMENTS OF OUR MANAGEMENT APPROACH
Emphasis on communication with the District and within the project team.
Keep everyone on the same page - do it once and do it right.
Key senior staff involvement for quality control.
Take advantage of the experience of our staff.
Frequent comparison of planned versus actual budget and schedule.
Know where a project is at all times, avoid surprises, and immediately address slippage.
Assemble a dedicated team.
Assemble a team with the right technical skills and experience working together on previous successful projects.
42 PROPOSAL / May 2025
Section 7:
Assigned
Personnel
43 16
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 7: Assigned Personnel
24SIM0525po2
Quality Assurance
Shawn Corrigan, CEM, ABCP,
ENV SP
George Whitten, PE*
Principal-in-Charge
Dan Baker, PE, DBIA
Cybersecurity Lead
Norm Anderson, PE*, CISSP ,
GICSP
Natural Hazards Lead
Rachel Duncan, PE, ENV SP
Resilience Analyst
Natacha Rueda, ABCP
Security and RRA Lead
Shari St. John, M.IPIS
ERP Lead
Steven Dowker, ABCP
Project Manager
Steven Dowker, ABCP
Engineering Support
Ashley Kuwahara, EIT
Licensed in a state other than California.
Ventura County
Waterworks District No. 8
SUBCONSULTANT
1. Enterprise Protection Associates (EPA)
*
Trusted leaders with resilience expertise.
Carollo is an industry leader in the AWIA sector, and we have assembled a highly qualified team of experts to support the District’s RRA and ERP updates. Our expertise, comprehensive local knowledge, and extensive background with security projects for water utilities is unmatched.
44 SECTION 7: ASSIGNED PERSONNEL
17 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Summary of Key Staff
A summary of the education, training, qualifications, and relevant experience of proposed staff is presented below.
NAME/ROLE EDUCATION BIO TIME EXPERIENCE
Dan Baker, PE, DBIA
PRINCIPAL-IN-CHARGE
Years of experience: 31
MS and
BS Civil and
Environmental
Engineering
Dan brings decades of
experience consulting for
water and wastewater utilities
and municipalities, managing
numerous complex planning and
implementation projects. His
expertise includes performance
assessments, asset management,
operations and maintenance
management, information
systems, master planning, system
optimization, and capital program
development.
5%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, Principal-In-Charge
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of
San Diego Public Utilities Department, CA,
Principal-In-Charge
Shawn Corrigan, CEM,
ABCP, ENV SP
QUALITY ASSURANCE
Years of experience: 30
MA, Disaster and
Emergency
Management
Shawn is a manager and
continuity professional with
multidisciplinary experience
in resilience and sustainability
planning. He has provided
leadership to many crisis
response and recovery
organizations. Most recently,
Shawn has supported Tier 1
water utilities in their AWIA
recertification process, acting as
the quality assurance manager.
5%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, ERP Lead
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA, ERP Lead
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of
San Diego Public Utilities Department,
CA, ERP Lead
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands,
CA, ERP Lead
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, ERP Lead
George Whitten, PE
QUALITY ASSURANCE
Years of experience: 13
MS Civil
and
Environmental
Engineering
BS Civil
Engineering
George has managed more than
50 security and resilience-related
planning and design projects,
with over half being AWIA projects
completed in the last five years.
He is well-versed in executing
the AWIA update process using
the latest AWWA J100, G430, and
G300 standards.
10%
Risk & R
esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, Project Manager
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA, Project Manager
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of
San Diego Public Utilities Department, CA,
Project Manager
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands, CA,
Project Manager
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, Project Manager
Dan will be responsible for providing general
oversight to this project and liaise with the
project team to provide the highest value and
quality of work for the District.
George will bring his significant knowledge
and experience with delivering AWIA-related
projects to the review and validation of all
work products. He will remain heavily involved
in workshops and meetings and will act as a
leader for project team members throughout
the course of all tasks.
Shawn will act in a quality control capacity,
reviewing all work products produced,
validating their data and confirming they meet
Carollo’s quality expectations. He will also
contribute to workshop discussions and project
meetings as necessary.
45 SECTION 7: ASSIGNED PERSONNEL
18 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
NAME/ROLE EDUCATION BIO TIME EXPERIENCE
Steven Dowker, ABCP
PROJECT MANAGER,
ERP LEAD
Years of experience: 11
BA Geography
P
ost Graduate
Certificate,
Emergency
Management
and Business
Continuity
Steven has a robust background
in the management and delivery
of emergency management and
business continuity programs. He
was involved in the review and
update of ERPs for Tier 1, Tier 2,
and Tier 3 utilities in the initial
assessment phase and supported
comprehensive updates to many
of these plans.
50%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, ERP Analyst
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA, ERP Analyst
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of
San Diego Public Utilities Department,
CA, ERP Analyst
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands,
CA, ERP Analyst
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, ERP Analyst
Shari St. John, M.IPIS
SECURITY AND RRA
LEAD
Years of experience: 6
Master of
Infrastructure
Protection and
International
Security
Shari is an experienced risk and
resilience analyst with expertise
in threat, hazard, emergency,
and mitigation planning. She
specializes in building sustainable
and resilient communities, with
a critical focus on how natural
and human-made hazards can
impact critical infrastructure. Shari
currently supports over 13 Tier 1
utilities with updates and reviews
to their RRA and ERP in the 2025
compliance cycle.
25%
RRA and ERP Support for 2020 A WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, ERP Analyst
Rachel Duncan, PE,
ENV SP
NATURAL HAZARDS
LEAD
Years of experience: 11
MS and BS
Civil and
Environmental
Engineering
Rachel is a civil engineer who
specializes in climate change
vulnerability assessments
for water and wastewater
infrastructure and water supply
planning projects. She supported
Tier 1, Tier 2 and Tier 3 utilities
in the original AWIA certification
process in 2020, specifically
supporting with the analysis
of natural hazard risks and
vulnerabilities.
25%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, Natural Hazards Analyst
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA, Natural Hazards Analyst
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of San
Diego Public Utilities Department, CA, Natural
Hazards Analyst
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands, CA,
Natural Hazards Analyst
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, Natural Hazards Analyst
Steven will act as both the project manager and
ERP lead for this project. He will leverage his
significant experience delivering operational
resilience projects in the water sector to support
this project. He will be responsible for leading
the review and development of the emergency
response plan and working with technical staff
to make required updates.
Rachel will be responsible for conducting the
natural hazards assessment included as part
of the RRA process. She will lead her team in
assessing the natural hazard vulnerabilities and
determine risk mitigation strategies for each.
Shari will be responsible for leading the RRA
process for this project. She will manage the
work of our subcontractor, EPA, to complete
all steps in the J-100 process and deliver a
comprehensive RRA to the District.
46 SECTION 7: ASSIGNED PERSONNEL
19 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
NAME/ROLE EDUCATION BIO TIME EXPERIENCE
Norm Anderson, PE,
CISSP, GICSP
CYBERSECURITY LEAD
Years of experience: 23
MS Electrical
Engineering
MS Physics
BS Electrical
Engineering
Norm is a cybersecurity
professional and current chair of
the AWWA Cyber Committee. He
is the go-to resource on reliable
SCADA, I&C, electrical, physical,
and cybersecurity for water and
wastewater infrastructure. He has
supported Tier 1, Tier 2, and Tier
3 utilities through their original
AWIA compliance in 2020 and
continues to support Tier 1 clients
in their 2025 recertification.
20%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, Cybersecurity Lead
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA
A
WIA Compliance Planning, Water and
Wastewater Systems (2020), City of
San Diego Public Utilities Department, CA,
Cybersecurity Lead
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands, CA,
Cybersecurity Lead
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, Cybersecurity Lead
Natacha Rueda, ABCP
RESILIENCE ANAL YST
Years of experience: 9
BES
Environmental
Studies
Natacha’s expertise includes
hazard identification and risk
assessments, evacuation
route planning, contingency
and emergency response
plan development, business
continuity programs, and design
and delivery of training and
exercise programs to strengthen
organizational readiness.
30%
Risk & R esilience Assessment and
Emergency Response Plan (2021), City of
Simi Valley, ERP Analyst
Risk and R
esilience Assessment
and Emergency Response Plan per
Requirements of AWIA 2018 (2021),
Sonoma Water, CA, ERP Analyst
RRA and ERP Updates to Support A
WIA
Compliance (2021), City of Redlands,
CA, ERP Analyst
RRA and ERP Support for 2020 A
WIA
Compliance (2020), Orange County Utilities
(OCU), Florida, ERP Analyst
Ashley Kuwahara, EIT
ENGINEERING
SUPPORT
Years of experience: 2
BS Civil
and
Environmental
Engineering
Ashley is an engineering staff
professional who supports
project management, preliminary
and technical design, and pilot
operations. Her work spans water
and wastewater infrastructure,
indirect potable reuse,
groundwater replenishment,
utility security upgrades,
and project planning and
programming.
Norm will lead the analysis of cyber-related
risks and vulnerabilities and will conduct all
of the associated qualitative and quantitative
analysis for the RRA. If the District chooses to
move forward with Alternative Proposal #2
detailed below, he will be the lead resource on
executing the scope of work requested.
Ashley will provide support to the RRA
component of this project. As a local resource,
she will support with on-site data collection
activities and will provide project engineering
support under the supervision of George.
Natacha will provide support to both the RRA
and ERP components. She will support with
compiling data produced by each of the task
leads and consolidating this data into the
relevant formats.
47 PROPOSAL / May 2025
Section 8:
Schedule
48 20
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 8: Schedule
Carollo has a significant background helping clients
achieve AWIA compliance, most notably working
together with the District to successfully achieve
compliance prior to the initial 2020/2021 deadlines.
We will employ all project management and
scheduling processes at our disposal to enable the
District to submit for compliance in December 2025
for the updated RRA, and June 2026 for the updated
ERP. Among the many processes in place is regular
communication between the local project manager
and the project team. This collaborative approach
mitigates issues about the project schedule and
makes sure they are identified and addressed as
early as possible. Monthly formal progress reports
and informal engagement with District staff will
allow any scheduling issues to be discussed and
addressed through updates and revisions to the
project schedule.
Other activities may include rescheduling workshops
and data collection sessions, leveraging virtual
meetings in place of in-person meetings, and adding
additional Carollo staff to the project team in cases
where the project schedule may be at risk of delays.
The following graphic details the proposed schedule
for this project, as well as dates for delivery of key
milestones and deliverables. Carollo will coordinate
with the District to confirm the time required for
reviewing and commenting on draft deliverables.
This detailed delivery schedule will be validated and
confirmed at the project kickoff meeting.
Carollo assumes a Notice to Proceed (NTP) date of
July 22, 2025.
2025 2026
JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN
TASK 1
RRA Updates
TASK 2
ERP Updates
24SIM0625ps1.indd
*ERP intro to be included in Workshop No.3.
Kickoff Meeting
(Virtual)
Notice to Proceed
July 22, 2025 Draft
RRA Draft
ERP
Final RRA and
Certifi cation
Final ERP and
Certifi cation
Workshop
No.3 Workshop
No.4
Workshop
No.5
Site visits &
Workshop #1 & #2 Progress
Meeting
Progress
Meeting
ERP
Intro*
Stakeholder
Meeting
LEGEND
Meeting
Deliverable
49 PROPOSAL / May 2025
Section 9:
Program
Monitoring
50 21
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 9: Program Monitoring
Quality Assurance and Control Reduces Conflicts
We Apply the Right Reviews at the Right Time to Maintain Quality Deliverables Our team is committed to delivering this project
within budget and in advance of regulatory
deadlines. We will work together as a team
to review each deliverable so that there is
consensus and understanding on the progression
of the RRA and ERP development. In addition
to the importance of meeting budgets and
deadlines, Carollo is committed to delivering
a quality project by incorporating extensive
quality assurance and quality control (QA/QC)
practices that catch potential issues early and
avoid rework. We understand the importance of
a relevant and well-founded RRA and ERP to the
District’s future resilience and sustainability.
Risk Management
Carollo understands that projects carry the potential
for risks and unexpected situations. To see that
these are identified and addressed early in the
project planning process, Carollo has developed a
preliminary listing of common and possible risks to the project work with associated mitigation measures that detail how these will be treated if they occur.
QUALITY
ASSURANCE
QUALITY
CONTROL
RESULT
QUALITY MANAGEMENT PLAN
• Establishes procedures for a successful and quality project • Includes both Program Level Quality Assurance
and Project Team Quality Control
• Will be confirmed with you at the start of the project •
Conducted proactively as the
project progresses
•
Independent peer reviews to
address critical issues
•
Early engagement of experts
•
Conducted in early stages to
avoid rework
•
Quality checks prior to
submittals
•
Internal QC workshops prior
to major submittals
•
Independent QC team
Provides high-quality
deliverables that
minimize errors
RESULT
Achieves a systematic
approach to eliminate
gaps and avoid rework
NO. RISK RISK TREATMENT OPTION
1 Project scope creep Carollo employs rigorous project management for all contracts. The local project manager will communicate regularly with internal project team members and client points-of-contact to provide a thorough understanding of project requirements. Issues or questions will be flagged and addressed in a timely manner. Communication will occur outside of monthly progress updates completed as part of all Carollo contracts. 2 Lack of availability
of District staff for
participation in data
collection workshops
The Carollo project team will initiate discussions regarding on-site data collection sessions immediately following contract award. Booking workshops and on-site data collection will be a priority action item to confirm that time is reserved in advance of data collection opportunities. This same strategy will be employed for booking of virtual workshops in the later phases of the project for review and validation of updates to the RRA and ERP. 3 Unplanned changes to
the Carollo project team
While Carollo histroically experiences a low level of staff turnover, it is possible that key members of the project team may become unavailable to support their assigned scope of work. In the event that a key team member is unavailable, Carollo will promptly alert District staff to communicate the absence and provide alternate options. Resumes and project experience will be shared with District staff for review. Any additional proposed staff and/or changes to the team will only occur with approved written consent from the District. 4 Real-world emergency
impacting project
location
In the event that a real-world emergency impacts the District during the project, Carollo, in consultation with District staff, will explore options for rescheduling data collection or site visits. The safety of District and Carollo staff is the utmost priority. Carollo can continue to work on all components of the RRA and ERP remotely, and in the event that on-site data col- lection or workshops need to be delayed, Carollo will make sure that project work continues and all deadlines are met.
51 SECTION 9: PROGRAM MONITORING
22 CAROLLO / PROPOSAL / JUNE 2025
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 Carollo will provide ongoing project management services by a dedicated local project manager. This will include implementation and ongoing tracking of a project plan and management of the project schedule. and budget. Monthly progress reports will include current project status and identification of key issues or elements of the project that will need to be addressed in the following weeks. The monthly progress reports will be presented virtually, and a copy will be submitted electronically via email (PowerPoint or MS Word).
Project Assumptions
• Carollo will complete the services required
in accordance with the prevailing standard of
care by exercising the skill and ability ordinarily
required of consultants performing the same
or similar services, under the same or similar
circumstances.
• The District shall furnish available studies, reports and other data pertinent to Carollo’s services;
authorize Carollo to obtain or provide additional
reports and data as required; and furnish
services of others required for the performance
of Carollo’s services. Carollo shall be entitled to
use and reasonably rely upon all such information
and services provided by the District or others in
performing services.
• In providing opinions of cost, financial analyses,
economic feasibility projections, schedules, and
quantity and/or quality estimates for potential
projects, Carollo has no control over cost or
price of labor and material; unknown or latent
conditions of existing equipment or structures
that may affect operation and maintenance costs;
competitive bidding procedures and market
conditions; time or quality of performance of third
parties; quality, type, management, or direction of
operating personnel; the incoming water quality
and/or quantity; the way the District’s plant(s) and/
or associated processes are operated and/or
maintained; and other economic and operational
factors that may materially affect the ultimate
project elements, including, but not limited to,
cost or schedule. Therefore, Carollo makes no
warranty that the District’s actual project costs,
financial aspects, economic feasibility, schedules,
and/or quantities or quality realized will not vary
from Carollo’s opinions, analyses, projections, or
estimates.
• The services to be performed by Carollo are
intended solely for the benefit of the District. No
person or entity not a signatory to the Agreement
shall be entitled to rely on Carollo’s performance
of its services hereunder, and no right to assert a
claim against Carollo by assignment of indemnity
rights or otherwise shall accrue to a third party as
a result of the Agreement or the performance of
Carollo’s services.
52 PROPOSAL / May 2025
Section 10:
District
Resources
53 23
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 10: District Resources
While most of this project will be completed by the Carollo team, there are requirements for District staff to participate and provide support with identification of pertinent reference materials; workshops and data collection meetings; documentation review; and liaising with the project team. This section details the expected requirements for District staff involvement with the RRA and ERP update process. Staff requirements are outlined for each key phase of the project and the amount of time per resource based on the Work Program provided above.
STAFF PROJECT INVOLVEMENT
DISTRICT
PROJECT
MANAGER
SUPERVISOR /
MANAGER OF
OPERATIONS
IT/OT STAFF KEY OPERATORS SECURITY / EM
STAFF
Kickoff (2hrs)
Workshop No. 1 (4hrs)
Site Visits (12hrs)
Workshop No. 2 (4hrs)
Workshop No. 3 (2hrs)
Workshop No. 4 (2hrs)
Workshop No. 5 (2hrs)
Progress Meetings (5x1hr)
Draft RRA Review (3hrs)
Final RRA Review (2hrs)
Draft ERP Review (2hrs)
Final ERP Review (1hr)
Total Hours 29hrs 24hrs 13hrs 31hrs 24hrs
54 PROPOSAL / May 2025
Section 11:
Subcontractors
55 24
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 11: Subcontractors
Overview
Enterprise Protection Associates
(EPA) has been a trusted partner
for Carollo on all AWIA projects,
boasting extensive experience in
threat-risk assessments and risk
mitigation plans for utilities nationwide. Qualified in the Risk Analysis and Management for Critical Asset
Protection methodology for water and wastewater
infrastructure, they have completed over 100
physical and electronic security master plans and
vulnerability assessments. EPA enhances security
for public and private sector clients while improving
operational efficiency through effective threat
recognition and mitigation strategies. Their hands-on,
practical approach provides a comprehensive, cost-
effective solution that aligns with clients’ operational and business objectives.
Staff Assigned
EPA will be assigning John Saunders to this
scope of work. John supported the original AWIA
compliance activities in 2020 and will support as
a senior security and RRA analyst on this scope of
work. In addition to project-based work detailed
below, John will liaise closely with the project
manager to provide ongoing status reports about
project progress and schedule, and to flag any
issues or requirements needed from the project
team. EPA has provided Carollo with an hourly
rate of $195.00 which has been accounted for
within the detailed cost proposal submitted as a
secondary document to this technical proposal.
NAME/ROLE EDUCATION BIO TIME EXPERIENCE
John Saunders, CPP,
CISSP, CSSA
Senior Security and
RRA Analyst
Years of experience: 36
BA in P olitical Science
Master of
Diplomacy (T
errorism)
John is a board certified security
management professional who
has completed dozens of tailored
threat risk assessments and security
planning projects using various
methodologies across multiple
sectors for more than 30 years.
25%
Risk & R esilience
Assessment and
Emergency Response
Plan (2021) , City of Simi
Valley, RRA Lead
Risk and R
esilience
Assessment and
Emergency Response Plan
per Requirements of AWIA
2018 (2021) , Sonoma
Water, CA, RRA Lead
A
WIA Compliance
Planning, Water and
Wastewater Systems
(2020), City of San Diego
Public Utilities Department,
CA, RRA Lead
RRA and ERP Updates to
Support A
WIA Compliance
(2021) , City of Redlands,
CA, RRA Lead
RRA and ERP Support for
2020 A
WIA Compliance
(2020), Orange
County Utilities (OCU),
Florida, RRA Lead
56 25
CAROLLO / PROPOSAL / JUNE 2025
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 SECTION 11: SUBCONTRACTORS
Work to be Performed
John will be a primary resource supporting with
updating the District’s RRA. He will support all
aspects of Task 1 – Risk and Resilience Assessment
Updates and will be bound by the same schedule
provided within this proposal. John’s specific tasks
and responsibilities include:
• Task 1.2 – Kickoff/Visioning/Facility
Prioritization Workshop
»John will develop workshop presentations
and discussion materials and will be a
primary facilitator of this session.
• Task 1.3 – Progress Meetings
»John will submit monthly progress updates
to the Carollo project manager that detail
work completed in the preceding month as
well as a summary of hours used and hours
remaining on the project.
• Task 1.4 – Stakeholder Meetings
»John will lead meetings with non-district
stakeholders as the need is identified during
the RRA process.
• Task 1.5 – Workshop No. 1
»John will support developing workshop
presentations and discussion materials and
will be a primary facilitator of this session.
• Task 1.6 – Data Collection & Site Visits
»John will attend site visits in-person
alongside Shari St. John to complete all
site visits and in-person data collection
tasks. He will complete detailed data
collection notes that will contribute
to components of the RRA.
• Task 1.7 - AWIA G430 Analysis Update
»John will lead the development of the
G430 update based on information
collected in the field and through reference
documentation provided to the Carollo
project team. He will provide subject-
matter expertise on this assessment
where qualitative analysis is required.
• Task 1.8 – Workshop No. 2
»John will support developing workshop
presentations and discussion materials and
will be a primary facilitator of this session.
• Task 1.9 – Complete Risk Calculations
»John will support risk calculations. This
component of the RRA process is where all
previously completed tasks come together
to produce a detailed assessment of overall
risk and vulnerability. He will provide
subject-matter expertise to troubleshoot
any potential issues or errors that arise to
make sure calculations accurately reflect the
current risk environment.
• Task 1.10 – Draft Updated RRA
»John will co-author the updated RRA
that collates and analyzes data collected
through all preceding project tasks. He will
expand on the results of the RRA process
and contribute subject-matter expertise to
qualitative components of the report.
• Task 1.11 – Workshop No. 3
»John will support developing workshop
presentations and discussion materials and
will be a primary facilitator of this session.
He will provide a detailed walk-through of
the RRA and provide answers to questions
arising during this workshop.
• Task 1.12 – Risk & Resilience Management
»John will lead a virtual meeting with the
client to review risk mitigation options to
reduce the overall risk to each asset. Assist
Carollo in writing detailed meeting minutes.
He will also develop a separate memo and
spreadsheet highlighting the risk mitigation
options, and integrate them into an
improvements plan with costs and benefits
(benefit-cost-ratio).
• Task 1.13 – Final Updated RRA
»Based on comments received from the
District, John will update the draft RRA.
He will provide subject-matter expertise
to assess comments and will formulate
a solution that addresses comments
while adhering to requirements of the
methodology and standards used to conduct
the RRA update.
57 Section 12:
Statement of
Proposer’s
Qualifications
and References
58 26
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 12: Statement of Proposer’s
Qualifications and References
Risk and Resilience Assessment and Emergency Response
Plan per Requirements of AWIA 2018
Sonoma Water, CA
Carollo worked with Sonoma Water to perform an
emergency response gap analysis, identify
opportunities for risk and resilience management,
and update Sonoma’s RRA and ERP in accordance
with AWIA requirements. Carollo reviewed Sonoma
Water’s existing ERP to validate information and
identify gaps and consistencies with risk and
resilience findings from the RRA phase of work,
helping to identify opportunities for increased
preparedness and planning. Carollo subsequently met with Sonoma Water’s staff and stakeholders to expand and validate opportunities for risk reduction during a facilitated workshop focused on risk tolerance, resilience options, and risk mitigation implementation planning. The updated ERP incorporated findings from the document review, stakeholder meetings, and workshops, and was submitted for AWIA certification prior to compliance deadlines.
To further support Sonoma Water in meeting resilience goals, Carollo developed an Implementation Schedule addressing organization-wide recommendations identified through the RRA and ERP process. The schedule addressed gaps related to all hazards planning and provided planning level cost estimates to assist in capital improvement planning. The result was a comprehensive implementation plan with recommended risk mitigation priorities for Sonoma, budgets, and project timelines.
REFERENCE
Grant Davis, General Manager
707-547-1911
[email protected]
CONTRACT AMOUNT
$150,000
COMPLETION DATE
2021
Risk & Resilience Assessment and
Emergency Response Plan
City of Simi Valley
Carollo worked with the District to provide an RRA
and ERP update to meet the key requirements of the
2018 AWIA. AWIA emphasizes a holistic approach to
hazard assessment, risk management, and
emergency planning, drawing on all parts of a water
system to safeguard resilience against all hazards,
including malevolent acts and natural events. This
assessment evaluated various factors that contribute
to the overall reliability and resilience of the District’s water system assets, including physical security, operational procedures, water system configuration, cybersecurity, and natural hazards. The Carollo team worked closely with District staff to identify critical assets, characterize potential threats and consequences, and develop solutions to mitigate identified risks for their unique assets and system operation. The RRA and ERP updates built upon existing planning documents, as well as information obtained from site visits and collaboration with management, operations, maintenance, IT, and emergency response personnel. The Carollo team helped develop a risk management document that could be integrated with other capital improvements projects to enhance overall system resilience.
REFERENCE
Mike Kang, Principal
Engineer
508-383-5628
[email protected]
CONTRACT AMOUNT
$178,512
COMPLETION DATE
2021
59 27
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
AWIA Compliance Planning, Water and
Wastewater Systems
City of San Diego Public Utilities Department, CA
Carollo successfully completed a security master
planning and AWIA compliance project for the City
of San Diego Public Utilities Department (PUD),
beginning with the creation of new security and
disaster response documents. This effort included
developing a Security Master Plan, which updated
the existing ERP and a Disaster Recovery Plan
(DRP). Both plans were essential for identifying
necessary physical, electronic, and operational improvements to enhance the PUD’s preparedness. During the project, the AWIA was enacted, prompting the PUD to request updates to deliver compliance with the new requirements.
Carollo seamlessly integrated current AWWA standards into the Security Master Plan and DRPs. Carollo’s approach included a comprehensive AWWA J100 assessment and analyses of AWWA G430 and G440 standards for the City’s water and wastewater systems. As a result, AWIA RRA and ERP compliance was achieved by March and September 2020, respectively, solidifying the PUD’s commitment to security and resilience.
The PUD successfully achieved AWIA RRA and ERP certification requirements through our project deliverables. Our ability to quickly respond to the AWIA requirements led to fully integrated Security Master Plan, DRP, RRA, and ERP documents for the PUD and its stakeholders. Carollo’s exceptional performance in this initiative led the PUD to select Carollo for the upcoming 2025 AWIA Recertification effort.
REFERENCE
Ivan Perez, Security and
Emergency Planning
Coordinator
619-527-3114
[email protected]
CONTRACT AMOUNT
$150,000
COMPLETION DATE
2020
RRA and ERP Updates to Support AWIA Compliance
City of Redlands, CA
Carollo was retained to provide an assessment that
evaluated the physical security, operational
procedures, water system configuration, cyber
security, natural hazards, and other relevant factors
that contribute to the overall reliability and
resilience of the utility and its water system assets.
The Carollo team worked closely with the utility
to identify critical assets, characterize potential
threats and consequences, and develop solutions to mitigate identified risks for their unique assets and system operation. The RRA and ERP updates built upon the City’s existing planning documents, as well as information obtained from site visits and collaboration with utility management, operations, maintenance, IT, and emergency response personnel. Carollo coordinated closely with local hazard mitigation planning (LHMP) efforts throughout the AWIA project, attending several LHMP group meetings to help leverage critical information discussed at the meetings. The information gathered was critical for creating a comprehensive RRA and ERP for the City. The Carollo team ultimately helped the City achieve compliance and generate a capital improvement program (CIP) to implement the security and resilience gaps identified as part of the RRA.
REFERENCE
Paul Mariscal, Water Production
Operations Superintendent
909-798-7502, ext. 4657
[email protected]
CONTRACT AMOUNT
$187,150
COMPLETION DATE
2021
SECTION 12: STATEMENT OF PROPOSER’S QUALIFICATIONS AND REFERENCES 60 28
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Risk and Resilience Assessment and Emergency Response
Plan per Requirements of AWIA 2018
Orange County Utilities, FL
Carollo collaborated with OCU to update its RRA
and ERP, providing compliance with the 2018 AWIA
requirements for 10 public water systems. This
innovative project enabled each system to meet
compliance deadlines using Carollo-developed
documents. Emphasizing a holistic approach to risk
and emergency planning, the assessment evaluated
physical security, operational procedures,
cybersecurity, and natural hazards, enhancing the
overall resilience of the water system.
Carollo worked closely with the utility to identify critical assets, assess potential threats, and develop tailored solutions for risk mitigation. The updates built on existing planning documents while incorporating insights from site visits and collaboration with utility management and emergency response personnel. Carollo also assisted OCU in drafting compliance letters to the US Environmental Protection Agency (USEPA) and generating a CIP to address identified security and resilience gaps.
OCU successfully met AWIA RRA and ERP certification requirements through our project deliverables. The RRA and ERP updates built upon OCU’s existing planning documents (developed by the Carollo team), as well as information obtained from site visits and collaboration with utility management, operations, maintenance, IT, and emergency response personnel. The Carollo team helped OCU develop compliance letters to the EPA and generate a capital improvement program (CIP) to implement the security and resilience gaps identified as part of the RRA. Confident in Carollo’s project performance, OCU chose us for the upcoming 2025 AWIA Recertification effort.
REFERENCE
Brandon Bryant, Chief Engineer
407-254-9721
[email protected]
CONTRACT AMOUNT
$369,785
COMPLETION DATE
2020
SECTION 12: STATEMENT OF PROPOSER’S QUALIFICATIONS AND REFERENCES 61 RFP NO. PW 25-05
SUBMIT WITH PROPOSAL
15 STATEMENT OF PROPOSER’S QUALIFICATIONS AND REFERENCES The Proposer is required to state the Proposer's financial ability and a general description of similar work performed.
Number of years engaged in providing the work included within the scope of the specifications under the present business name: Six years, but since the AWIA's inception in 2018. .
List and describe fully a minimum of five projects performed by your firm within the last two years, which demonstrate your ability to complete the work included within the scope of the specifications and where the Proposer has performed work in providing professional services preparing a risk and resilience assessment and emergency response plan , particularly in Ventura County’s jurisdiction with government agencies similar to the City/District. Attach additional pages if required. The City/District reserves the right to contact each of the references listed for additional information regarding your firm's qualifications.
Reference No. 1
Phone No.
Year:
Customer Name:
Contact Individual:
Address:
Contract Amount:
Description of work done:
Phone No.
Reference No. 2
Customer Name:
Contact Individual:
Address:
Contract Amount: Year:
Description of work done:
Reference No. 3
Customer Name:
Contact Individual: Phone No.
Address:
Contract Amount: Year:
Description of work done:
City of Simi Valley, CA
$178,512 2021
508-383-5628Mike Kang, Principal Engineer
Sonoma Water, CA
Grant Davis, General Manager 707-547-1911
2021$150,000
City of San Diego Public Utilities Department, CA
619- 527-3114
2020 $335,820
Ivan Perez, Security & ER Plan Coord.
9192 Topaz Way, San Diego, CA 92121
404 Aviation Boulevard, Santa Rosa, CA 95403
2929 Tapo Canyon Road, Simi Valley, CA 93063
Engagement and analysis to develop a compliant RRA and ERP, satisfying requirements set out in the AWIA legislation. This assessment evaluated various factors that contribute to the overall reliability and resilience of the District’s water system assets.
Engagement and analysis to develop a compliant RRA and ERP, satisfying requirements set out in the AWIA legislation. In addition to compliance, Carollo developed a comprehensive Disaster Recovery Plan (DRP) for the City.
Engagement and analysis to develop a compliant RRA and ERP, satisfying requirements set out in the AWIA legislation. The assessment evaluated various factors that contribute to the overall reliability and resilience of the Sonoma water system assets.
62 RFP NO. PW 25-05
SUBMIT WITH PROPOSAL
16 STATEMENT OF PROPOSER’S QUALIFICATIONS AND REFERENCES (continued)
Reference No. 4
Customer Name:
Contact Individual: Phone No.
Address:
Contract Amount: Year:
Description of work done:
Reference No. 5
Customer Name:
Contact Individual: Phone No.
Address:
Contract Amount: Year:
Description of work done:
City of Redlands, CA
$187,150 2021
Paul Mariscal, Water Ops Super 909-798-7502, ext. 4657
Orange County Utilities (OCU), FL
407-254-9721 Brandon Bryant, Chief Engineer
2020 $369,785
955 Parkford Dr., Redlands, CA 92374
9150 Curry Ford Road, Orlando, FL 32825
Engagement and analysis to develop a compliant RRA and ERP, satisfying requirements set out in the AWIA legislation. This work also included scope to develop region-specific and facility-specific ERPs, enhancing OCU’s overall system resilience and response capacity.
Engagement and analysis to develop a compliant RRA and ERP, satisfying requirements set out in the AWIA legislation. The assessment evaluated various factors that contribute to the overall reliability and resilience of the City of Redlands water system assets.
63 PROPOSAL / May 2025
Section 13:
Alternative
Proposals
64 29
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 13: Optional Proposals
Alternative Proposal Number
One – ERP Validation Exercise
Work Program
For ERPs to be effective, they should undergo
validation under conditions that closely mirror reality and become an integral part of the organization’s
culture. This validation opportunity confirms that
emergency plans are dynamic and enables staff
to swiftly execute appropriate actions during
emergencies, which can significantly reduce the
potential severity or impact of a hazard. Further,
consistently validating emergency plans under
realistic scenarios not only facilitates ongoing
enhancement of response capabilities, it also
promotes the sharing of identified lessons
among stakeholders. This practice enhances
the likelihood of achieving favorable outcomes
in actual incidents and strengthens the
organization’s overall resilience. Without validation
against realistic conditions, an organization
cannot confidently rely on its emergency plan
to fulfill primary objectives during crises.
For the District, conducting a functional exercise
designed to simulate a mix of challenging conditions
will offer a valuable opportunity to learn in a secure
environment and assess the effectiveness of the
ERP. This exercise will last one (1) day and will
encompass a comprehensive briefing and debriefing
session, alongside pre- and post-exercise learning
surveys to gauge knowledge acquisition and
areas for improvement. To facilitate a smooth and
educational experience, professional facilitation
will be provided. This will include the distribution
of various materials essential for participants and
observers alike: a facilitation guide to steer the
exercise, a participant briefing guide to prepare
attendees, exercise injects to simulate realistic
scenarios, presentation material to facilitate
learning, and an evaluation and observation guide
to capture insights and feedback effectively.
Phase I – Planning Design and
Development
This subtask includes general and technical scenario
development, inject development, planning
conferences, development of exercise materials, and
development of audit procedures. These activities
build components that will guide participants
through exercise activities and will be focused on
the needs of both operational and decision-making
(management) staff during the exercise.
Phase II – Conduct Exercises
This subtask includes conducting simulation-based
exercises identified and developed as part of Phase I.
Phase III – Exercise Review and Reporting
As part of this optional task, Carollo will provide
engineering services during the contract period
to develop additional detail on specific RRA items
as requested by the District such as detailed
cybersecurity assessments, security plans, and
continuity of operations plans. The scope and cost
of the services will be negotiated as the need is
identified and shall be based on the same cost
parameters used to negotiate this contract.
Each of these subtasks would be developed in
additional detail to meet the needs of the District
prior to implementation.
65 SECTION 13: OPTIONAL PROPOSALS
30 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Methodology
The design of this exercise will be conducted
in alignment with the principles detailed in the
Homeland Security
Exercise and
Evaluation Program
(HSEEP). The four
key components of
this cycle provide
consistency in the
exercise design
and delivery
process and allow
for organizations to
capture and analyze
evaluation data in a
consistent way that
maximizes improvement planning opportunities.
To this end, Carollo will perform the
following high-level functions in support
of this exercise for the District:
Design and Development
Using input of senior leadership from the District,
Carollo will design and develop each of the
components necessary to run the exercise. These
items (listed in the work plan above) will contribute
to participant play and will provide exercise control
staff with the information necessary to keep exercise
play on track. These documents and artifacts will
be provided to senior District staff for review and
validation prior to exercise delivery.
Conduct
Carollo will provide facilitation staff to support
delivery of the exercise for the District. This team
will have all information available on-hand to support
both technical and non-technical participants
through exercise play. While all efforts are made
in the design process to predict and understand
the participants’ expected path through exercise
activities, facilitators will be able to provide guidance or further information to keep the exercise on track
and achieve overall objectives. It is anticipated
that one staff member from the District will support
exercise delivery as a controller to facilitate
participant play.
Figure 2: HSEEP Exercise Cycle
Evaluation
Evaluation is a critical component of the exercise
cycle. Understanding what information you want
to assess during an exercise directly informs the
data collection strategies that are developed for
an exercise. These are ultimately determined by
the objectives established during the design and
development stage and will directly link into the
fourth phase (improvement planning) detailed further
below. As part of Phase 1 – design and development,
Carollo will develop an evaluation strategy
consisting of data collection tools for both live data
collection and pre- and post-exercise data collection.
Following completion of the exercise, a debrief will
be conducted that will provide further opportunities
for Carollo staff to garner important participant
feedback when it is still fresh and top of mind. All
of the data collected by staff will be assessed and
incorporated into a comprehensive after-action
report. Within this report will be a series of findings that are corroborated by data points collected
during the exercise. Each of these findings will have
a recommendation developed that will reinforce a
best practice, help close a gap, or facilitate progress towards an opportunity for improvement.
Assigned Personnel:
Shawn Corrigan
Quality Assurance
Steven Dowker
Project Manager
Natacha Rueda
Resilience Analyst
George Whitten
Quality Assurance
66 SECTION 13: OPTIONAL PROPOSALS
31 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Alternate Proposal No. 2 –
Cybersecurity Services
and Support
Work Program
In an era of increasing cyber threats and evolving
digital infrastructure, the District recognizes the
critical importance of a resilient and compliant
cybersecurity posture and has already taken
initial steps. Following recent progress that the
District has made on assessing and addressing
cybersecurity needs, Carollo is proposing a phased
approach to supporting continued progress towards
cybersecurity resilience. This graduated approach
to assessing and understanding cyber risks is key
to comprehensive system resilience and structured
into five strategic phases. Each item in this scope of
work can be completed individually, or implemented
collectively as part of a larger scope of work. This
provides the District with flexibility in the scope
of services, providing maximum value where it’s
needed the most. Each item in the approach will
be aligned with industry standards and frameworks
such as the NIST cybersecurity framework, AWWA
cybersecurity guidance, and ANSI/IEC-62443
standards alongside the District’s existing risk and
resilience assessments.
Phase I - Review and document progress
on current assessment
• Coordinate existing recommendations vs AWWA
recommended controls to verify all aspects are
documented under the current assessment.
• Document status of implementation of the
coordinated recommendations.
Phase II - Provide a 2-4 Week
Penetration Test
This phase of the proposed initiative will develop a
cybersecurity plan based on the District’s existing
cybersecurity assessments and recommendations.
A cybersecurity plan for the District begins with a
foundational understanding of its current security
posture, informed by previous assessments and
recommendations. The first step in this process
is conducting a gap analysis to identify any
discrepancies between existing cybersecurity
controls and recognized best practices as outline
by industry standards and guidance. A review of
existing recommendations will be made to verify
that they are still valid and applicable to the District’s network infrastructure, add new recommendations
based on evolving threats, and prioritize
implementation of recommendations based on risk
reduction and cost of implementation.
This analysis validates the relevance and
completeness of prior recommendations to cover
all critical aspects of the system including asset
management, threat detection, incident response,
and recovery so they are adequately addressed.
Following the gap analysis, a systematic method
for tracking the implementation progress of
cybersecurity initiatives will be developed. This is
an important aspect of in order to verify progress,
show a return on investment, and quantify
overall cybersecurity maturity. This step involves
documenting the status of each recommendation,
assigning ownership, setting timelines, and
identifying dependencies. A centralized tracking
mechanism, such as project tracking spreadsheet or
dashboard can provide visibility into progress and
help verify accountability of project implementation
as well as assisting in coordination with other
affected groups in the organization. The final
recommendations can then be developed into
more detailed and comprehensive projects as part
of the cybersecurity project plan. The following
summarizes the main tasks of this phase that will aid
in developing a resilient cybersecurity framework for
the District that evolves with emerging threats and
supports overall system resilience.
• Coordinate existing recommendations vs. AWWA
recommended controls to verify all aspects are
documented under the current assessment.
• Document status of implementation of the
coordinated recommendations.
• Develop current baseline of implementation
status.
• Develop project tracking and cybersecurity
metrics.
Phase II - Provide a 2-4 week penetration
test
A penetration testing task for an Operational
Technology (OT) network is a critical component of a
comprehensive cybersecurity strategy, particularly
for municipalities and utilities that rely on industrial control systems (ICS) and SCADA environments.
This task is designed to simulate real-world
cyberattacks from multiple threat perspectives to
uncover vulnerabilities and assess the resilience of
the OT infrastructure. Penetration testing provides
67 SECTION 13: OPTIONAL PROPOSALS
32 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
a detailed supplement to general cybersecurity
risk and vulnerability assessments. These tests
look beyond general network architecture and
cybersecurity mitigation tools down in the specific
network vulnerabilities on your network. This
analysis provides a real-time look at the active
vulnerabilities in a system and provides immediate
actionable items to protect against these discoveries
and further harden security implementations.
Vulnerabilities found can often be corrected through
configuration changes and larger findings added to
cybersecurity projects. Penetration testing is based
on time in the system. Threats that are simple to
target can be discovered and documented in a few
hours or days, while more complex threats can take
weeks or months to find. To start, a short duration
test of a few weeks is proposed to find the easily
exploitable threats as a first step. This will develop
an action plan to address the most easily and
commonly exploited threats as a starting point.
Best practices for cybersecurity resilience follow
a defense in depth approach. This means having
security measures within each level of the overall
system. As such, penetration testing must also look
at the threats at each level of the system and not
solely focus on one particular aspect. Penetration
testing will include a perspective external to the
District, from the IT network to the OT network, and
within the OT network. The external perspective
will evaluate the District’s internet facing assets to
identify potential entry points that a remote attacker
could exploit. This includes scanning for exposed
services, outdated software, misconfigured firewalls,
and weak authentication mechanisms. The goal
is to determine whether an attacker could gain
unauthorized access to the network perimeter
and pivot toward more sensitive internal systems.
Findings will be documented as part of the external
threat analysis.
The IT to OT perspective focuses on the potential
for lateral movement from the District’s Information
Technology (IT) network into the OT environment.
This phase simulates an attacker who has already
compromised an IT asset, such as a workstation
or server, and is attempting to bridge the gap into
the OT network. The test evaluates segmentation
controls, firewall rules, and access restrictions
between IT and OT zones, as well as the presence
of monitoring and alerting mechanisms that could
detect such activity.
Finally, the internal OT network threat analysis
examines the OT environment from the standpoint
of an attacker who has already gained a foothold
within it. This includes mapping the network
architecture, identifying connected devices,
assessing authentication practices, and probing for
vulnerabilities in programmable logic controllers
(PLCs), human-machine interfaces (HMIs), and other
critical components. The objective is to understand
how an attacker could disrupt operations,
manipulate processes, or exfiltrate sensitive data.
Each of these perspectives contributes to a holistic
understanding of the OT network’s security posture.
The findings are compiled into a detailed report that
includes identified vulnerabilities, risk ratings, and
prioritized mitigation recommendations to enhance
the District’s cybersecurity resilience. The following
are the major steps of this task.
• External threat analysis 1-day focusing on
internet facing threats.
• IT to OT focusing on trying to access OT
equipment from the IT network. Only ancillary
discovery of IT vulnerabilities. 3-9 days.
• OT network vulnerability assessment focused on
network architecture, authentication, discovery,
and vulnerabilities of discovered equipment and
threat vectors. 5-10 days.
• Provide a document report of vulnerabilities and
recommended mitigation.
68 SECTION 13: OPTIONAL PROPOSALS
33 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Phase III – Cybersecurity Project Plan
Recommendations can often be difficult to properly
implement without a structured plan that identifies
the aspects and outcomes of a project and
identifies planned costs and schedule. An overall
project implementation approach and plan will be
developed as the final assessment document for
this phase in order to provide an actionable and
implementable plan. The plan will outline the phases
of each project and mitigation execution including
project descriptions, anticipated design and
construction tasks, internal resource requirements,
and estimated budget and schedule. System testing
and plans for continued maintenance will also be
outlined for guidance in long-term operational
integrity. This plan can then be integrated into the
District’s overall CIP and maintenance planning and
budgeting to secure the necessary funding and
support to drive implementation. Project status and
completion can then be tracked using the tools
developed project tracking.
• Vulnerabilities/Recommendations – status of
mitigation – recommended mitigation technique.
• Project plan for larger mitigation tasks.
• Implementable project descriptions outlining the
major tasks and expected outcomes.
• Project budgets and schedules.
• Overall project implementation plan and one
page project summaries for CIP planning.
Phase IV - Detailed Network architecture
review and redesign
A defense in depth approach is a critical aspect of
cyber resilience. Proper network segmentation is
critical to limit the spread of threats, protect critical operating systems, enhance access controls,
improving monitoring and detection, and facilitating
incident response and maintenance. As a part of
this task, the existing network infrastructure will
be reviewed and a design provided to upgrade
network and security implementations. The first
part of this process is to develop an understanding
and initial system block diagram of the network.
This can be done as part of phases I and II of this
approach or as a standalone task included in
this phase. Identification of existing systems will
determine if new or upgraded network infrastructure
components are required as well as identify how
new security implementations can be integrated into
the overall system. The general approach will be to
developed secured zones within the network where
critical control is performed. These zones will have
the highest trust and protection and developed for
the ability to maintain operation if isolated. These
zones will be designed to communicate back to a
centralized monitoring and control location to meet
District requirements for operations, data exchange,
and any type of remote management or support.
An SCADA/OT DMZ will also be included to further
secure personnel and data access to the OT system.
The implementation of enhanced security features
such as authentication practices, networking
monitoring and management, patch and update
management, anti-virus protection, log file analysis,
and additional determined security resources will
be included in the overall design and sequenced
according the overall cybersecurity implementation
plan or prioritization of the recommendations. The
following is a summary of the major tasks conducted
as part of this phase.
• Review and documentation of current
architecture.
• Development of new architecture meeting the
layered network approach and development of a
SCADA/OT DMZ.
• Includes server architecture and recommended
server services such as authentication, update
server, security services, and required upgrades
to OS and computer hardware.
• Deliverable includes network block diagrams
and equipment specs as required for design/bid/
build delivery.
69 SECTION 13: OPTIONAL PROPOSALS
34 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Phase V - Cybersecurity Plan and Policy
Starter kit
A cybersecurity plan is a strategic document that
outlines how an organization protects its digital
infrastructure, data, and operations from cyber
threats. It serves as a roadmap for implementing
security controls, responding to incidents, and
ensuring compliance with relevant standards
and regulations. This provides a documented
approach to assist with maintaining consistency
and standardization during change management
and provide staff with a documented set of policies
and procedures to follow. This plan sets up a
culture of security for the organization providing
guidance on current requirements and develops a
pathway for enhanced resilience. A well-developed
cybersecurity plan includes several key components:
• Includes general cybersecurity plan framework.
• General starter policies.
• Governance and Policy framework.
• Summary of previous assessments and
recommendations.
• Planned security controls and technical
safeguards.
• Incident response and recovery guidelines and
support contacts.
• Training and Awareness.
• Project tracking, system metrics, and continuous
improvements.
By implementation of these steps, the District will
improve their overall cybersecurity resilience and
develop a program that can continually be followed
and aligned with overall improvement planning.
Assigned Personnel:
Norm Anderson
Cybersecurity Lead
70 PROPOSAL / May 2025
Section 14:
Conflict of
Interest
71 35
CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 CAROLLO / PROPOSAL / JUNE 2025
Section 14: Conflict of Interest
Carollo does not foresee conflicts of interest in completing this scope of work for the District. In the event that a situation may arise where a potential conflict of interest exists, the District will be notified through written correspondence as soon as reasonably possible.
72 PROPOSAL / May 2025
Appendix
- Exhibit C
Insurance
- Resumes
73 RFP NO. PW 25-05
29 EXHIBIT C – INSURANCE REQUIREMENTS
To be awarded this contract, t he successful Proposer must procure and maintain the following types of insurance with coverage limits complying, at a minimum, with the limits set forth below:
Type of Insurance Limits
Commercial general liability: $2,000,000
Professional liability $1,000,000
Business automobile liability $1,000,000
Workers compensation Statutory requirement.
Commercial general liability insurance must meet or exceed the requirements of the most recent ISO - CGL Form Number. The amount of insurance set forth above must be a combined single limit per occurrence for bodily injury, personal injury, and property damage for the policy coverage. Liability policies must be endorsed to name the City, its officials, and employees as “additional insureds” under said insurance coverage and to state that such insurance will be deemed “primary” such that any other insurance th at may be carried by the City will be excess thereto. Such insurance must be on an “occurrence,” not a “claims made,” basis and will not be cancelable or subject to reduction except upon thirty (30) days prior written notice to the City.
Professional liability coverage must be on an “occurrence basis” if such coverage is available, or on a “claims made” basis if not available. When coverage is provided on a “claims made basis,” the Consultant must continue to maintain the insurance in effect for a period of three (3) years after this Agreement expires or is terminated (“extended insurance”). Such extended insurance must have the same coverage and limits as the policy that was in effect during the term of this Agreement, and cover the Consultant for all claims made by the City arising out of any errors or omissions of the Consultant, or its officers, employees or agents during the time this Agreement was in effect.
Automobile coverage must be written on ISO Business Auto Coverage Form CA 00 01 06 92, including symbol 1 (Any Auto).
The Consultant must furnish to the City duly authenticated Certificates of Insurance evidencing maintenance of the insurance required under this Agreement, endorsements as required herein, and such other evidence of insurance or copies of policies as may b e reasonably required by the City from time to time. Insurance must be placed with admitted insurers with a current A.M. Best Company Rating equivalent to at least a Rating of “A:VII.” Certificate(s) must reflect that the insurer will provide thirty (30) day notice of any cancellation of coverage. The Consultant will require its insurer to modify such certificates to delete any exculpatory wording stating that failure of the insurer to mail written notice of cancellation imposes no obligation, and to delete the word “endeavor” with regard to any not ice provisions.
By signing this form, the Proposer certifies that it has read, understands, and will comply with these insurance requirements if it is selected as the City’s consultant. Failure to provide this form may render the Proposer’s proposal “nonresponsive.”
__________________ ____________________________
Date Proposer
06/06/2025
74 EDUCATION
MS Civil and
Environmental
Engineering,
Massachusetts Institute
of Technology, 1997
BS Civil and
Environmental
Engineering, Villanova
University, 1994
BA Honors Program,
Villanova University, 1994
LICENSES
Civil Engineer, California,
Arizona
CERTIFICATION
Certified Design-Build
Professional, Design-
Build Institute of America
Certified Construction
Documents Technologist,
Construction
Specifications Institute
PROFESSIONAL
AFFILIATIONS
American Water Works
Association
Information
Management and
Technology Committee
Water Environment
Federation
Automation and
Information
Technology Committee
California Water
Environment Association
Daniel P . Baker, PE, DBIA
Dan Baker has 31 years of experience in business and management consulting for water and wastewater utilities throughout the United States. His education and experience as a professional civil and environmental engineer provide him with the insight to understand his clients' engineering, business, and technology goals. He has managed numerous complex planning and implementation projects for large utilities and municipalities that have drawn on his expertise in a wide range of areas including performance assessments, asset management, operations and maintenance management, information systems, master planning, system optimization, and capital program development. His relevant experience includes:
RELEVANT EXPERIENCE
> Project manager for the Asset
Reliability Assessment and Financial
Plan Project for the City of Simi Valley,
California. He was responsible for
development of the overall asset
management program for the City’s
wastewater treatment plant and
collection system. The project included
complete asset inventory, condition
assessment of aboveground assets,
geographic information system (GIS)-
based analyses of belowground assets,
risk-based assessments for probability
and consequence of failure, asset
valuation, rehabilitation and
replacement (R&R) capital improvement
program development, and a financial
plan including proposed rate
adjustments.
> Principal consultant for the Asset
Management Implementation Plan,
Central Contra Costa Sanitary District,
California. Assisted in asset
management framework development
for standardized condition assessment
of CCCSD’s treatment and collection
system facilities. Also provided
recommendations on integration of
condition assessment and risk analysis
data into CCCSD’s GIS and maintenance
management systems.
> Project manager for City of Tempe,
Arizona, Utilities Department
Enterprise Asset Management
implementation project. Dan is leading
the requirements definition, process
development, and data conversion for
implementation of a new custom
configured software to replace an
existing Hansen CMMS for water, sewer,
stormwater, irrigation, and
transportation assets including
integration with GIS and customer
information systems.
> Project manager for the Enterprise
Resource Planning (ERP) System
Requirements Definition, Software
Selection, and Implementation for the
Elsinore Valley Municipal Water
District, California. He managed the
requirements definition, business
process analysis, procurement, and
program management for replacement
of the District’s financial, human
resources/payroll, customer service, and
utility billing systems. He assisted in the
ERP implementation of project/grants
management and capital/operations
and maintenance budgeting modules.
> Principal consultant for the Asset
Management Program for the City of
Scottsdale, Arizona. He assisted with
the assessment of linear, belowground
assets for the City’s water and
wastewater facilities. His responsibilities
included the planning and design of an
asset management system, integrated
with the City’s existing computerized
maintenance management system
(CMMS), geographic information system
(GIS), and financial and dashboard
75 Daniel P . Baker, PE
reporting systems to support the
identification, prioritization, and
planning for the renewal and
replacement and Capital Improvement
Program (CIP) projects.
> Principal consultant for the Lift
Station and Stormwater Station
Condition Assessment Project for the
City of St. Petersburg, Florida. The City
recently converted its maintenance
management system to Oracle
® Work
and Asset Management (WAM). He
assisted in configuring the WAM Asset
Class Condition Assessment Module for
condition assessments of lift stations,
stormwater pumping stations, and alum
chemical feed stations as part of the
City’s asset management program. He
worked with City staff to develop
criticality, consequence of failure,
condition, and overall risk scores to
prioritize repair and rehabilitation needs.
He also provided assistance and
recommendations to integrate condition
assessment data into Oracle
®.
> Principal consultant for the
Environmental Protection Agency
Water System Improvements Asset
Management, Sanitary Survey, and
SCADA Project for the City of Surprise,
Arizona. He led the evaluation of the
existing asset management software,
including Infor™ Hansen and ESRI
ArcGIS, and made recommendations for
system improvements and data
integration to support best
management practices for water and
wastewater assets. He is currently
assisting in the first phase of
implementation of system
improvements.
> Project manager for the El Estero
Wastewater Treatment Plant Asset
Management Support Services for the
City of Santa Barbara, California. He led
the development and implementation of
an asset management program for the
El Estero Wastewater Treatment Plant
and sewage lift stations including
upgrades to the maintenance program,
computerized maintenance
management system (CMMS) reporting,
inventory management, procurement
process, and a capital improvement
program (CIP) asset renewal plan.
> Principal consultant for the Miramar
Pump Station Condition Assessment
for the San Diego County Water
Authority, California. The project
included mechanical, structural,
electrical, and instrumentation condition
assessments of the Miramar Pump
Station. He developed a renewal
decision analysis report that evaluated
alternatives for rehabilitation and
replacement, conducted a life-cycle cost
analysis that compared the alternatives,
and provided final recommendations for
the Water Authority.
> Project manager for the Asset
Management Plan Project for the
Yorba Linda Water District, California.
He was responsible for development of
the overall asset management program
for the District’s complete water and
sewer assets. The project included
complete asset inventory, condition
assessment of aboveground assets,
geographic information system (GIS)-
based analyses of belowground assets,
risk assessments for probability and
consequence of failure, rehabilitation
and replacement (R&R) program
development, and funding analyses.
76 EDUCATION
Master of Arts in Disaster
and Emergency
Management, Royal
Roads University
Graduate Certificate in
Organization Design and
Development, Royal
Roads University
Certificate in Emergency
Exercise Design, Justice
Institute of BC
Diploma in Forestry, Sir
Sandford Fleming
College
CERTIFICATION
Certified Emergency
Manager (CEM)
Associate Business
Continuity Professional
(ABCP), Disaster Recovery
Institute
Envision Sustainability
Professional (ENV SP)
PROFESSIONAL
AFFILIATIONS
International Association
of Emergency Managers
(IAEM), Past President,
British Columbia Region
Royal Canadian Marine
Search and Rescue
(RCMSAR), Advanced
Crewmember, Past
Deputy Station Leader
Shawn Corrigan, CEM, ABCP , ENV SP
Shawn Corrigan is a certified emergency manager and crisis management professional with 30 years of experience in emergency management and response for numerous industries, including water and wastewater, wildfire, public health, nuclear (firefighting, emergency management, and security), marine search and rescue, education, and consulting.
RELEVANT EXPERIENCE
> Senior consultant for the County of
Maui Department of Water Supply
(DWS), Hawaii, Damage Assessment. In
August 2023, the Town of Lahaina faced
significant devastation due to a fire,
resulting in damage to critical
infrastructure, including the water
delivery system. This project aimed to
catalog water system assets and
evaluate the extent of the damage.
Substantial time was dedicated to on-
site activities involving documenting
damages and validating GIS
representations of the system against
real-world conditions. After the
assessment, the assets were inventoried,
and replacement costs were estimated.
> Senior consultant for various US
Cities, American Water Infrastructure
Act (AWIA), Risk and Resilience
Reviews. Technical support for the
following projects requiring Risk and
Resilience Assessments (RRA) and
Emergency Response Plan (ERP) updates
to support compliance with AWIA 2018:
Central Arkansas Water, Arkansas
Covington Water District,
Washington
Dallas Water Utilities, Texas
City of Edmond, Oklahoma
Eugene Water and Electric Board,
Oregon
Highline Water District,
Washington
Medford Water Commission,
Oregon
Mount Werner Water &
Sanitation District, Colorado
North Harris County Regional
Water Authority, Texas
Orange County Utilities, Florida
City of Porterville, California
City of Redlands, California
City of Round Rock, Texas
City of San Diego, California
Sonoma County Water Authority,
California
South Island Public Service District,
South Carolina
Stillwater, Oklahoma
City of Tempe, Arizona
Tualatin Valley Water District,
Oregon
Ventura County Waterworks
District No. 8, California
City of Yuma, Arizona
Each project leverages previous
experience with security and resilience-
related projects, specific AWIA tools,
federal agency tools, and local hazard
mitigation plans
and tools to develop
and implement a well-planned,
systematic approach–tailored to each
organization for efficient completion
within the regulatory deadlines for AWIA
compliance.
> Senior consultant, Marina Coast
Water District, California, Emergency
Response Plan (ERP) Review. This
evaluation of an updated ERP includes
77 Shawn Corrigan, CEM, ABCP , ENV SP
an analysis of planning assumptions and
the ERP structure compared to best
practices. Recommendations have been
outlined to assist in the further
refinement of the ERP. Additionally, the
review offers an opinion on compliance
with the America’s Water Infrastructure
Act (AWIA).
> Senior consultant for the City of San
Diego Public Utilities Department,
California, Disaster Recovery Plan
(DRP). The DRP offers guidance on
transitioning from response to recovery
procedures. The plan is designed to
complement the Department’s
Continuity of Operations Plan (COOP)
and to set up both short and long-term
planning strategies for rebuilding and
revitalizing affected assets. Key
components of the plan encompass
identifying issues and risks, organizing
training and exercise activities,
specifying personnel and their roles,
establishing communication protocols,
outlining required resources to support
the plan, addressing funding,
incorporating risk management
principles, and providing a
comprehensive concept of operations
for recovery actions.
> Study leader for the DC Water,
Washington DC, Hazard and
Operability Study (HAZOP). Employing
a "parameter first" approach, this study
utilized the HAZOP standard to
systematically identify and assess
potential hazards and operability issues
related to DC Water's Blue Plains Filter
Rehabilitation project. The facilitation
process employed a creative process,
encouraging team members to
anticipate possible scenarios and their
consequences
> Senior consultant for the Capital
Regional District (CRD), Victoria, British
Columbia, Multi-Stakeholder and First
Nations FireSmart Committee (FSC).
The goal of the project was to establish
and lead the FSC. Fire Smart emphasizes
using seven disciplines to lessen the
effects of wildfire, including education,
vegetation management, legislation and
planning, cross-training, interagency
planning, development considerations,
and emergency planning. The Regional
Fire Smart Committee aims to provide a
coordinated landscape-level approach
to community wildfire resilience across
the CRD. The project reviewed existing
Community Wildfire Plans to coordinate
and identify opportunities for further
applications to the Community
Investment Fund. In addition, the work
identified Fire Smart activities to
undertake in regional communities to
best build wildfire resilience in
the highest-risk areas and secure
ongoing funding for Fire Smart
initiatives through municipal, provincial,
and Fire Smart Community Grant
opportunities.
> Senior consultant for the First
Nations Community Nisga’a Lisims,
British Columbia, Development of
Emergency Evacuation Plans. This
project involved comprehensive
consultation with many stakeholders as
part of the data collection and analysis.
Hazards were identified and analyzed to
better understand how evacuations
would occur. GIS-based evacuation
maps were developed following a
thorough review of existing evacuation
procedures and routes to ensure that
route planning is consistent with
regional data. This review also included
population and demographic analysis
and scenario modeling. A detailed
evacuation route plan was developed.
78 EDUCATION
MS Civil and
Environmental
Engineering, Arizona
State University, 2014
BS Civil Engineering,
Arizona State University,
2013
LICENSES
Civil Engineer, Arizona
George A. Whitten, PE
George has 13 years of experience in water infrastructure planning, design, and security.
He specializes in risk and resilience assessments, emergency response planning, and security master plans for drinking water and wastewater systems. As a project manager or security lead, he has supported over a dozen utilities nationwide with compliance under the America’s Water Infrastructure Act (AWIA). His work spans pilot testing, permitting, SCADA/cybersecurity reviews, and vulnerability assessments.
RELEVANT EXPERIENCE
> Security Lead for the City of Simi
Valley/Ventura County Waterworks
District No. 8 (District), California – Risk
and Resilience Assessment (RRA) and
Emergency Response Plan (ERP) Update
to Support Compliance with the
America’s Water Infrastructure Act
(AWIA).
> Project manager for the City of
Riverside, California – Regional Water
Quality Control Plant Security
Assessment Study. This project included
evaluating the wastewater treatment
plant’s threat environment and existing
site security controls and providing
recommendations for security
improvements to meet ANSI 57-10
guidelines and industry best practices.
> Project manager for the City of
Redlands, California – Risk and
Resilience Assessment (RRA) and
Emergency Response Plan (ERP)
Update to Support Compliance with
the America’s Water Infrastructure Act
(AWIA).
> Project manager for the City of
Lathrop, California – Risk and
Resilience Assessment (RRA) and
Emergency Response Plan (ERP)
Update to Support Compliance with
the America’s Water Infrastructure Act
(AWIA).
> Project manager for the South San
Joaquin Irrigation District (SSJID),
California – Risk and Resilience
Assessment (RRA) and Emergency
Response Plan (ERP) Review to Support
Compliance with the America’s Water
Infrastructure Act (AWIA).
> Project manager for the City of
Tempe, Arizona, Risk and Resilience
Assessment (RRA) and Emergency
Response Plan (ERP) Update and
Supplementary Risk and Resilience
Efforts. In addition to baseline
compliance tasks to support America’s
Water Infrastructure Act (AWIA)
requirements, Carollo assisted the City
with a series of supplementary tasks to
enhance the resilience of their water and
wastewater systems including a
Continuity of Operations Plan (COOP)
update, a detailed SCADA/Industrial
system (Cybersecurity) review using the
DHS CSET tool, emergency response
training and exercises, and a review of
current policies and practices.
Additionally, the City included both their
water and wastewater systems for the
complete vulnerability assessment.
Carollo also worked closely with the City
to develop an updatable database of
risk management strategies for
implementation across the utility.
> Project manager for the Medford
Water Commission (MWC), Oregon,
RRA and ERP Update. MWC provides
water to the City of Medford, two water
districts, and six nearby cities on a
wholesale basis. This AWIA compliance
project included a vulnerability
assessment of the water system assets
using the AWA J100, AWWA G430, and
AWWA G430 standards. The assessment
included prioritization of threats, assets,
and vulnerabilities of the system, and
79 George A. Whitten, PE
corresponding risk management
strategies to decrease the risk of
applicable all-hazard consequences at
each critical water facility.
> Project manager for the North
Harris County Regional Water
Authority (NHCRWA) AWIA
Compliance project, which included a
comprehensive vulnerability
assessment of system assets and
corresponding creation of a
comprehensive Emergency Response
Plan. The risk and resilience assessment
was critical to ensuring the Authority’s
independent neighborhoods, municipal
utility districts, small municipalities, and
permitted well owners have access to
secure, long-term, reliable, quality
supply of wholesale drinking water.
> Security engineer for the Cascade
Water Alliance, Washington, Security
Master Plan and Improvements Project.
The project consisted of a master plan,
design, and engineering services during
construction to implement security
improvements at the Cascade Lake
Tapps White River Facility. The security
master plan identified preliminary
security risks, concerns, and
recommendations for assets at the
facility. The Plan identified security
improvements to the design of the
headworks area, including the Corps
Bridge and the Tunnel Intake. Relocation
and design of the head end equipment
was necessary to support the proposed
enterprise platform anticipated for
installation at the Powerhouse.
> Security Lead for the City of San
Diego Public Utilities Department
(PUD), California, Security Master Plan
and Disaster Recovery Plan Updates. As
part of this effort, the team will be
updating each of the plans to assist in
identifying the improvements necessary
to bridge the gap between PUD’s
current systems and facilities and their
desired level of preparedness. The
updates will build upon the City’s
existing planning documents as well as
information obtained from site visits and
collaboration with City management,
operations, maintenance, IT, and
emergency response personnel. As part
of the Security Master Plan update, the
team will review PUD’s 75+ facilities
using the Sandia Labs Risk Assessment
Methodology for Water Systems and
identify recommendations for each,
incorporating the RAMCAP J100
methodology accredited by AWWA. The
team will also develop security best
practices for use by PUD in future facility
evaluations and designs. As part of the
Disaster Response Plan task, Carollo will
develop a new plan that will provide
guidance and procedures for PUD staff
transitioning from the initial Emergency
Response phase of a major disaster or
other significant regional event, into the
recovery phase, and will supplement the
Department Continuity of Operations
Plan. The effort will be completed in
2019.
80 EDUCATION
Post Graduate Certificate,
Emergency Management
and Business Continuity,
2015
BA Geography, Nipissing
Univers
ity, 2014
CERTIFICATION
PWGSC Security
Clearance, NATO Secret
Level
Disaster Recovery
Institute, Associate
Business Continuity
Professional 2021
Emergency Management
Ontario
IMS 100
IMS 200
IMS 250
EM 125
EM 131
EM 200
EM 225
Steven Dowker, ABCP
Steven Dowker is a proven relationship builder who leads multi-disciplinary teams in the development and validation of emergency management and business continuity programs. In roles of increasing responsibility over the last 10 years, Steven has championed over 85 technical projects, each aiming to increase customer resilience. His experience in the emergency management industry has been informed by projects spanning all levels of government and the private sector, resulting in a unique perspective and approach to the development and maintenance of modern emergency management.
RELEVANT EXPERIENCE
> Emergency management analyst for
the City of Redlands, California RRA
and ERP Updates to Support AWIA
Compliance. This project involved
providing an assessment that evaluated
the physical security, operational
procedures, water system configuration,
cybersecurity, natural hazards, and other
relevant factors that contribute to the
overall reliability and resilience of the
utility and its water system assets. The
project team ultimately helped the City
achieve compliance and generate a
capital improvement program (CIP) to
implement the security and resilience
gaps identified as part of the RRA.
> Emergency management analyst for
the City of Tempe Command Post
Exercise, Arizona. Steven supported the
City of Tempe with developing,
delivering and reporting on a Command
Post Exercise (CPX) designed for their
Water Operations Staff. This exercise
simulated a cascading series of impacts
to the city’s water system, bringing key
response personnel together within an
Incident Command System capacity to
organize the City Response. Steven led
all phases of the exercise design process
and guided various stakeholder groups
through the process of defining exercise
objectives, key activities for play, and
other logistics required to run the
exercise. Following the completion of
the exercise, a comprehensive After-
Action Report (AAR) was compiled that
highlighted key findings from evaluation
staff during the exercise. This AAR laid
out a roadmap for implementing
recommendations arising from key
findings and observations.
> Emergency management analyst for
the Region of Peel Wastewater
Vulnerability Assessment and
Emergency Response Plan
Development project. The first phase of
the project completed in late 2019 and
early 2020 saw a vulnerability
assessment completed for the
wastewater Utility. This assessment
included a complete assessment of the
wastewater infrastructure as well as
wastewater policies and procedures. The
second component involved developing
a comprehensive emergency response
plan (ERP) for the wastewater utility, a
flood emergency response plan, as well
as site-specific procedures for the
various wastewater facilities. When
completed the Region of Peel will have a
fully updated emergency management
program that aligns with all local,
provincial, and federal regulations and is
inclusive of industry best practices.
> Emergency management analyst for
the Mercer Island Emergency Response
Plan AWIA Review & Update. Steven
worked for Carollo on behalf of
Enterprise Protection Associates to
conduct a compliance review of the city
of Mercer Island’s water emergency
response plans. The aim of this
compliance review was to determine
whether the emergency plan met
81 Steven Dowker, ABCP
AWARDS
OTHER
ACCOMPLISHMENTS
PSMJ PROJECT
MANAGEMENT
BOOTCAMP
PROJECT
CONSTRUCTION
MANAGEMENT (EGBC)
PROJECT MANAGEMENT
FOUNDATION COURSE
(ESI TRAINING)
IMECHE ESSENTIAL
MANAGEMENT SKILLS
FOR ENGINEERS
OPEN FOR QUOTE
compliance criteria outlined in the
recently passed America Water
Infrastructure Act. Steven led the
development of the assessment matrix
and conducted the review of the ERP.
Upon completion of the review, a series
of recommendations were developed
that identified how areas of non-
compliance could be addressed. Once
the changes were approved by Mercer
Island staff they were incorporated into
the plan. A second component to this
project upon achieving compliance was
to conduct a comprehensive update to
the ERPs. This ERP update brought
Mercer Island’s plan beyond AWIA
compliance and incorporated industry
best-practices.
> Emergency management analyst for
Enterprise Protection Associates (EPA),
American Water Infrastructure act Tier
3 Utilities. Steven worked for Carollo on
behalf of Enterprise Protection
Associates to conduct a compliance
review of six water utility emergency
response plans. The aim of these
compliance reviews was to determine
whether the emergency plans of the
various utilities met compliance criteria
outlined in the recently passed America
Water Infrastructure Act. Steven lead the
development of the assessment matrix
and conducted the review of each utility
ERP. Upon completion of the review, a
series of recommendations were
developed that identified how areas of
non-compliance could be addressed.
Once the changes were approved by
each utility, he was responsible for
incorporating the changes into each
ERP.
> Emergency management analyst for
Enterprise Protection Associates –
American Water Infrastructure Act Tier
2 Utilities. Steven worked for Carollo on
behalf of Enterprise Protection
Associates to conduct a compliance
review of five water utility emergency
response plans. The aim of these
compliance reviews was to determine
whether the emergency plans of the
various utilities met compliance criteria
outlined in the recently passed America
Water Infrastructure Act. Steven led the
development of the assessment matrix
and conducted the review of each utility
ERP. Upon completion of the review, a
series of recommendations were
developed that identified how areas of
non-compliance could be addressed.
Once the changes were approved by
each utility, he was responsible for
incorporating the changes into each
ERP.
> Emergency management analyst for
Enterprise Protection Associates (EPA)
America’s Water Infrastructure Act
Emergency Response Plan – Tier 1
Utilities. Steven worked for Carollo on
behalf of Enterprise Protection
Associates to conduct a compliance
review of ten water utility emergency
response plans. The aim of these
compliance reviews was to determine
whether the emergency plans of the
various utilities met compliance criteria
outlined in the recently passed America
Water Infrastructure Act. Steven led the
development of the assessment matrix
and conducted the review of each utility
ERP. Upon completion of the review, a
series of recommendations were
developed that identified how areas of
non-compliance could be addressed.
Once the changes were approved by
each utility, he was responsible for
incorporating the changes into each
ERP. As a result of the review and
updates to the respective ERP’s, each
Utility was able to achieve compliance
by the September 30th deadline.
82 EDUCATION
Graduate Diploma
Climate Risk
Management, University
of Waterloo, 2023
Master of Infrastructure
Protection and
International Security,
Carleton University, 2022
BA - Honours Political
Science, Carleton
University, 2019
TRAININGS
ISO 9001: 2015 Internal
Auditor
Shari St. John
Shari St. John has centered her six-year career and education on building sustainable and resilient communities, with a critical focus on how natural and human-made hazards can impact critical infrastructure. Over the past five years, she has studied topics in infrastructure asset management, risk analyses and processes, hazard landscapes in North America, climate change science and impacts, and business continuity planning for all hazards. She has experience applying her knowledge in emergency management and resilience initiatives in both the private and public sector, working with municipalities, regional and federal governments, and private organizations to achieve social, physical, and environmental sustainability into the future.
RELEVANT EXPERIENCE
> Analyst, South San Joaquin
Irrigation District (SSJID), California,
Emergency Response Plan (ERP)
Review. This review involved analysis of
the current plans and processes in place
within SSJID to respond to emergencies
compared against best practices in the
industry. Recommendations were
provided within the document to further
enhance the ERP in compliance with
America’s Water Infrastructure Act.
> Analyst for the Orange County
Utilities, Forida, Risk and Resilience
Assessment and Emergency Response
Plan per Requirements of AWIA 2018.
This project had 10 public water systems
that needed to meet compliance within
the OCU RRA/ERP. Each public water
system achieved compliance ahead of
the legislated deadlines using the
Carollo-developed RRA/ERP documents.
This assessment evaluated the physical
security, operational procedures, water
system configuration, cyber security,
natural hazards, and other relevant
factors that contribute to the overall
reliability and resilience of the utility and
its water system assets.
> Project manager, Town of Smithers;
District of Coldstream, British
Columbia, Extreme Heat Response
Plans. Each response plan included
development of a framework that can
be used by the respective local
authorities during an extreme heat
event to maximize public safety.
Recommendations were provided to
supplement emergency response
coordination in each community.
> Project manager and lead
developer, Alberni-Clayoquot Regional
District (ACRD), British Columbia,
Evacuation Plan. This evacuation plan
involved thorough analysis of the
region’s geography, demographics, and
infrastructure under five separate local
government jurisdictions, resulting in
development of a comprehensive
framework to capture both nuances and
similarities across communities.
Recommendations in the plan were
outlined to augment and inform
emergency response planning in the
region.
> Project manager and lead
developer, Alberni-Clayoquot Regional
District (ACRD), British Columbia,
Hazard, Risk and Vulnerability
Assessment (HRVA). This HRVA
involved designing a methodology and
framework for risk analysis across three
geographically diverse communities in
the ACRD. The risk analysis helps to
inform emergency response planning
and initiatives in the region.
> Lead developer, Town of Oliver,
British Columbia, Concept of
Operations and Emergency
Management Plan Update. This project
involved a comprehensive review and
update of the Town’s Emergency
83 Shari St. John
Management Plan against current best
practices and recommendations in the
industry. It also involved the planning
and development of a Concept of
Operations for emergency use of the
Town’s airport during wildfire response.
> Analyst, Defense Research and
Development Canada (DRDC),
Framework for a Concept of
Operations. This framework
development involved a comprehensive
analysis of the current systems and
structures in place in Canada to facilitate
the sharing of science advice amongst
federal organizations during
emergencies. The framework identified
existing gaps in process and included
recommendations for future initiatives
and projects to address those gaps.
> Analyst, Various Projects and
Clients, After Action Reports (AAR).
Reports were developed following
exercises with various clients:
Animal Health Canada
Electricity Canada
Agriculture and Agri-Food
Canada
Canadian Food Inspection Agency
Emergency Management and
Climate Readiness (EMCR; formerly
Emergency Management British
Columbia)
Canada Post
DRDC
City of Winnipeg
Toronto Transit Commission
Each project involved analysis of
observed discussions and actions during
exercise play compared against
expected actions and/or best practices
within each respective industry or
organization. Each report included a
summary of the exercise background
and objectives, as well as a detailed
review of strengths, opportunities for
improvement, and response gaps with
related recommendations to enhance
emergency preparedness.
> Exercise Designer, Various Projects
and Clients, Exercises:
Animal Health Canada
Electricity Canada
Agriculture and Agri-Food
Canada
3
rd Infantry Division, Canadian
Armed Forces
Canadian Food Inspection Agency
City of Nanaimo
Comox Valley Regional District
EMCR
Regional District of Nanaimo
Canada Post
DRDC
City of Winnipeg
Toronto Transit Commission
Exercise design included development
of SMART objectives, scenario content
and injects, and relevant discussion
questions. Related documents
developed to support exercise
facilitation included participant read-in
materials, customized maps and
imagery, presentations, and online
surveys.
> Analyst, Nishnawbe Aski Nation
(NAN), Thunder Bay, Ontario,
Emergency Management Online
Learning Platform. This project involved
research and development of course
module content for an online learning
platform designed to enhance NAN’s
emergency management capacity.
84 EDUCATION
MS Civil and
Environmental
Engineering, Stanford
University, 2015
BS Civil and
Environmental
Engineering, University of
Illinois at Urbana-
Champaign, 2014
LICENSES
Civil Engineer, California
CERTIFICATIONS
Certified, Envision™
Sustainability
Professional, Institute for
Sustainable
Infrastructure, 2020
PROFESSIONAL
AFFILIATIONS
American Water Works
Association – Climate
Change Committee Chair
Rachel S. Duncan, PE, ENV SP
Rachel Duncan is a civil engineer who specializes in climate change vulnerability assessments for water and wastewater infrastructure and water supply planning projects with an emphasis on climate change impact modeling and analysis, alternatives analysis, and decision modeling. She has additional experience in recycled water project planning and design, permitting, funding, and hydraulic modeling. Rachel is a graduate of Stanford University’s Sustainable Design and Construction program with a focus in water resources. Her studies at the University of Illinois at Urbana-Champaign centered on sustainable and resilient infrastructure systems as well as environmental economics and law.
RELEVANT EXPERIENCE
> Lead engineer for the Climate
Change Vulnerability Assessment and
Resilience Plan for the Sand Island
Wastewater Treatment Plant and Sewer
Basin Facilities Plan, City and County of
Honolulu, Hawaii. Carollo evaluated the
vulnerability of Honolulu’s wastewater
system to flooding and coastal erosion
impacts due to climate change. Rachel
identified local climate planning
requirements, available climate and
flooding modeling resources, and the
latest science available to characterize
climate change impacts to flooding and
coastal erosion threats through 2100.
The degree to which these threats would
impact vulnerable components of
wastewater facilities was evaluated
based on expected inundation depths
and erosion extent compared to facility
elevation data determined from site
visits and record drawings. Rachel
recommended adaptation measures to
be included in the City’s capital
improvement program to increase the
resilience of vulnerable facilities.
> Senior engineer for One Water
Honolulu, Honolulu Board of Water
Supply, Hawaii. Carollo is developing
this plan to identify and prioritize
projects to improve the resilience of
Oahu’s water, wastewater, and
stormwater infrastructure to climate
threats including sea level rise, wildfire,
extreme heat, droughts, and hurricanes.
Rachel developed the Climate Change
Adaptation Framework, which includes
the use of climate vulnerability maps to
screen thousands of infrastructure assets
to identify those at the highest risk and
the application of adaptation strategies
to high-risk areas and assets to develop
a prioritized list of 50 adaptation
projects.
> Lead engineer for Risk and
Resilience Assessments for over 20
different cities and water agencies in 11
different states. In response to
requirements in America’s Water
Infrastructure Act, Carollo is conducting
risk and resilience assessments to
evaluate the natural hazard and security
risks to water assets for cities and water
agencies across the country. Rachel has
evaluated the risk to assets from natural
hazards including, but not limited to,
coastal and inland flooding, wildfire,
hurricanes, severe storms, tornados,
extreme heat, and drought. In addition
to evaluating existing risk, she
documented how these risks are likely
to be impacted by climate change and
how hazards may become more or less
frequent or severe in the future. She
recommended adaptation strategies to
mitigate high-priority risks.
> Lead engineer for the Climate
Change Water Resources Monitoring
and Adaptation Plan, California Water
Service. This Plan includes a review of
existing vulnerability assessments and
adaptation planning efforts, a
85 Rachel S. Duncan, PE, ENV SP
vulnerability assessment of Cal Water’s
infrastructure, operations, and services,
and an assessment of climate change
impacts to water supply and demand.
Rachel is leading the water supply and
demand assessment and will analyze
how climate change is expected to
impact surface water, groundwater, and
imported water supplies. The expected
impact to each water supply source will
be compared across all Districts to allow
for the prioritization of Districts to
mitigate near-term, medium-term, and
long-term impacts. The project team will
develop adaptation strategies to reduce
vulnerability to climate threats,
prioritizing strategies based on
adaptation pathways and investment
considerations.
> Project engineer for the Canal
Modernization Project, Contra Costa
Water District, California. While with
her previous firm, Rachel developed
demand projections for the District’s
service area, crafted the objectives of
the Canal Modernization Project, refined
strategies that could be used to meet
the project objectives, and created the
decision framework to complete an
alternatives analysis for the project. She
built a risk model in GoldSim that
utilizes Monte Carlo analysis to
probabilistically evaluate how ten
project alternatives would mitigate
identified risks and meet project
objectives.
> Lead engineer for the Burlingame
Wastewater Treatment Facility Sea
Level Rise Assessment, City of
Burlingame, California. Carollo
performed preliminary design for a new
digester and digester equipment
building for the City’s Wastewater
Treatment Facility. Rachel conducted an
assessment of the potential of new and
existing facilities to be impacted by sea
level rise from the nearby San Francisco
Bay. Based on this assessment, she
recommended a minimum elevation for
the concrete foundation slab for new
facilities.
> Senior Engineer for the Master
Water Report and Information System,
San Luis Obispo County, California.
Carollo is developing a comprehensive
digital information management system
for the County’s water resources data,
including a “living” Master Water Report
that incorporates up-to-date data and
water resources analysis. Rachel is
leading the development of the Master
Water Report update and integration
with the DIMS tool. The Master Water
Report accounts for the quantity and
resilience of supplies and the urban,
rural, agricultural, and environmental
demands throughout the County to
assess potential additional supply needs
in the future.
> Assistant Project Manager for the
Joint Water Commission Water System
Master Plan, Joint Water Commission,
Oregon. Carollo is updating JWC’s
Master Plan to evaluate the capacity and
resilience of their water system and to
develop a comprehensive capital
improvement program to meet their
level of service goals. As the assistant
project manager, Rachel coordinated
with the client and large project team to
ensure smooth delivery of the Master
Plan. She also conducted the 20-year
demand analysis and supply strategy
development for the Master Plan.
> Engineer for the Water Resources
Plan 2040, Marin Municipal Water
District, California. Rachel worked with
the GoldSim modeling team to create
this model, focusing on modeling the
District’s reservoir system and future
supply and demand scenarios.
86 EDUCATION
MS Electrical Engineering,
Iowa State University,
2007
MS Physics, University of
Florida, 2005
BS Electrical Engineering,
Iowa State University,
2002
LICENSES
Professional Engineer,
Florida, Arkansas
Electrical Engineer,
Arizona
CERTIFICATIONS
ANSI Certified, Global
Industrial Cyber Security
Professional, Global
Information Assurance
Certification, 2016
ISA IC32E – Cyber
Security for Automation,
Control, & SCADA
Systems
VTScada Level 2
Advanced Configuration
PROFESSIONAL
AFFILIATIONS
American Water Works
Association
Cybersecurity
Subcommittee
Chairman
International Society of
Automation
Norman E. Anderson, PE, CISSP, GICSP
Norm Anderson is an electrical, instrumentation, and controls (I&C) engineer.
With 23 years of experience, he has been providing secure and reliable SCADA, physical and cyber security, I&C, and electrical solutions for water, wastewater, and environmental projects in both the public and private sectors. He is skilled in the planning, design, commissioning, and management of highly technical automation projects and excels at developing innovative solutions to complex challenges.
Additionally, Norm specializes in industrial control system network security and has previously served as the SCADA manager for a municipal utility, where he faced the challenges of maintaining/expanding automation and communication systems firsthand.
RELEVANT EXPERIENCE
> Cybersecurity lead for the Orange
County Utilities, Forida, Risk and
Resilience Assessment and Emergency
Response Plan per Requirements of
AWIA 2018. This project had 10 public
water systems that needed to meet
compliance within the OCU RRA/ERP.
Each public water system achieved
compliance ahead of the legislated
deadlines using the Carollo-developed
RRA/ERP documents. This assessment
evaluated the physical security,
operational procedures, water system
configuration, cyber security, natural
hazards, and other relevant factors that
contribute to the overall reliability and
resilience of the utility and its water
system assets.
> Cybersecurity lead for the North of
River Sanitary District, California,
SCADA Master Plan. The project
involved developing a standard
approach to optimize the SCADA system
and take advantage of new technologies
while identifying ways to minimize the
overall cost of ownership, maintenance,
and security risks to the project. Project
goals included establishing the current
condition of the SCADA system’s
components, identifying operational
requirements and information/control
needs, defining communication
standards, recommending SCADA
system upgrades, and identifying
system-wide hardware, software, and
communication networks for future
expansion of the treatment facility and
conveyance systems.
> Network design engineer for the
City of San Diego, California, North City
Pure Water Facility. The project
involved the design of a new 40-mgd
direct potable reuse facility consisting of
ozone, membrane filtration, reverse
osmosis, and BAC filtration major
processes. The control system was
based on an Emerson Ovation DCS
having Allen-Bradley remote
programmable logic controllers (PLC)s
and Ethernet instrumentation networks,
and valve networks. The plant network
design included a fiber optic ring
backbone for control, security, and
building management networks
connecting into a City-wide network
system.
> Electrical and I&C Engineer for the
Polk County, Florida Comprehensive
Operational Technology Plan (SCADA
Master Plan). The project was to provide
the design to replace six high-service
pumps, motors, and associated suction
and discharge valves and piping,
electrical system upgrades, piping for
Well No. 1, auxiliary generator and
transfer switch, high-service pump
building renovation, site work,
maintenance of operations during
construction, and incorporating
resiliency requirements. Engineering
services included the final detailed
design, permitting, bid phase assistance,
87 Norman E. Anderson, PE, CISSP , GICSP
SPECIALIZED SKILLS
SCADA Hardware
Schneider Electric,
Modicon, Magelis
GE RX3i
Motorola ACE and
MOSCAD
Allen-Bradley
Cisco
Checkpoint
Cellular Modems
SCADA Software
Trihedral VTScada
GE Proficy iFIX and
Historian
Vijeo Designer
Unity Pro
GE Proficy Machine
Edition
Motorola STS and
ToolBox
Rockwell RSLogix
MDT Autosave
and engineering support services during
construction.
> Project manager for the City of
Oviedo, Florida, Lift Station SCADA
Upgrades Engineering Services During
Construction. The City upgraded its lift
station SCADA system with a Hydralink
SCADA system. This system consists of
64 new PLCs for the lift stations and
local touchscreens for local control.
Carollo provided consulting services
related to the lift station SCADA
upgrades project to support the City
water and wastewater infrastructure with
engineering services during
construction.
> Lead electrical and I&C engineer for
the City of Maitland, Florida, SCADA
Upgrades project. The project involved
expanding the City’s SCADA system to
cover their water treatment plants. The
design included the development of
piping and instrumentation diagrams
(P&IDs) and electrical drawings for the
installation of new SCADA Pack-based
remote terminal units (RTUs) and cellular
communications.
> Lead I&C engineer for the Central
Arkansas Water Authority, Arkansas,
Ozark Point Water Treatment Plant
(WTP) Rehabilitation Improvements
Project. The project involved upgrading
CAW Ozark Point WTP flocculation and
sedimentation systems and upgrading
flash mix, filter, and pumping systems.
New Allen-Bradley PLCs and fiber optic
communications were added as a part of
the project and upgrades to the existing
Inductive automation ignition system
were incorporated.
> Lead electrical and I&C engineer for
the Polk County Utilities, Florida,
Cherry Hill Water Production Facility
Design. The project involved a new
regional water production facility
design, including raw water wells,
storage, high-service pumping, sodium
hypochlorite disinfection, and standby
generator systems. The electrical design
included new utility feed and plant
switchgear with power distribution to
building and process systems,
the design of a new standby generator
system, and site lighting and grounding
systems. I&C design included
instrumentation selection, SCADA
system design, CCTV design, network
design, control logic development, and
construction support and testing
services.
> I&C engineer for the Polk County
Utilities, Florida, Central Regional WPF.
Provided I&C design and construction
support services for a 4 mgd WPF that
included raw water wells, Ozone
treatment, GAC filtration, and sodium
hypochlorite disinfection processes. I&C
systems included instrumentation,
control panels, network and
communications infrastructure, control
logic, SCADA system components, CCTV
systems, and interfaces with intelligent
paralleling switchgear.
> Electrical and I&C engineer for JEA,
Jacksonville, Florida, Oakridge WTP
High Service Pump Replacement.
Carollo provided engineering services to
upgrade the Oakridge Water Treatment
Plant High Service Pump Station. The
project provided the design to replace
six high-service pumps, motors, and
associated suction and discharge valves
and piping, electrical system upgrades,
piping for Well No. 1, auxiliary generator
and transfer switch, high-service pump
building renovation, site work,
maintenance of operations during
construction, and incorporating
resiliency requirements. Engineering
services included the final detailed
design, permitting, bid phase assistance,
and engineering support services during
construction.
88 EDUCATION
BES Environmental
Studies, International
Development, Waterloo
University, 2016
Project Management
Fundamentals, Waterloo
University, 2018
Project Management
Applications, Waterloo
University, 2018
CERTIFICATION
Associate Business
Continuity Professional
(ABCP), Disaster Recovery
Institute, 2020
Associate Diploma
Emergency Management,
Justice Institute of British
Columbia (JIBC), 2025
ICS 100
ICS 200
ICS 300
Emergency Management
Ontario
IMS 100
EM 125
Natacha Rueda, ABCP
Natacha Rueda has dedicated her nine-year career and education to advancing resilient emergency management programs across the public and private sectors. With a strong emphasis on understanding the impacts of natural and human-made hazards on life safety, critical infrastructure, and the environment, she has supported clients in implementing a comprehensive range of prevention, mitigation, and preparedness initiatives. Her expertise spans diverse projects, including hazard identification and risk assessments, evacuation route planning, contingency and emergency response plan development, business continuity programs, and design and delivery of training and exercise programs to strengthen organizational readiness.
RELEVANT EXPERIENCE
> Emergency management analyst for
the City of Tempe, Arizona, Emergency
Response Plan Update and Validation
Exercise. Natacha supported the City of
Tempe in updating its Emergency
Response Plan (ERP) to meet compliance
requirements under the American Water
Infrastructure Act (AWIA). She also led
the development, facilitation, and
reporting of a Command Post Exercise
to validate the ERP. Her contributions
included drafting the revised plan,
collecting supporting data, and
facilitating client engagement sessions
to incorporate feedback and finalize
revisions. The validation exercise
simulated a cascading series of impacts
on the city's water system, engaging key
response personnel in a realistic,
scenario-driven environment. Natacha
was responsible for developing the
exercise materials, including the
scenario, injects, facilitator guide,
participant handbook, and evaluation
tools. She served as an in-person
facilitator and co-authored the After-
Action Report (AAR).
PREVIOUS EXPERIENCE
> Emergency management analyst for
AWIA Emergency Response Plan (ERP)
Tier 1, 2, and 3 Updates for various
clients, US. Natacha supported the
review and update of 15 ERPs for water
utilities across the US. These reviews
aimed to confirm compliance with
America’s Water Infrastructure Act
(AWIA) for Tier 1, 2, and 3 utilities.
Natacha conducted comprehensive
assessments of existing ERPs and
supporting documentation, comparing
them against AWIA legislative
requirements and industry best
practices. She identified key gaps and
provided recommendations to help
utilities align their plans for compliance.
Natacha contributed to drafting revised
content, collecting supporting data, and
facilitating engagement sessions with
utility staff to validate updates and
ensure operational relevance. Her efforts
directly contributed to each utility
achieving AWIA compliance by the
deadline established by the US. Prior to
Carollo.
> Emergency management analyst for
Stillwater Utility Authority (SUA),
Oklahoma, Emergency Response Plan
Update. Natacha supported the SUA in
updating its ERP to achieve compliance
with AWIA requirements. She conducted
a comprehensive review of the existing
ERP against regulatory standards,
identified key gaps, and provided
practical recommendations to align the
plan with compliance expectations. As a
member of the plan update team, she
was involved in drafting revised content,
gathering supporting data, and
facilitating client engagement sessions
to ensure the updated ERP reflected
operational needs and stakeholder
input. Prior to Carollo.
89 Natacha Rueda, ABCP
AWARDS
OTHER
ACCOMPLISHMENTS
PSMJ PROJECT
MANAGEMENT
BOOTCAMP
PROJECT
CONSTRUCTION
MANAGEMENT (EGBC)
PROJECT MANAGEMENT
FOUNDATION COURSE
(ESI TRAINING)
IMECHE ESSENTIAL
MANAGEMENT SKILLS
FOR ENGINEERS
OPEN FOR QUOTE
OTHER
ACCOMPLISHMENTS
Security Clearance, NATO
Secret Level II, Public
Works and Government
Services Canada
> Emergency management analyst for
the Region of Peel, Ontario, Canada,
Emergency Response Plan
Development. Natacha contributed to
the Region of Peel’s emergency
preparedness by supporting the
development of a comprehensive
Wastewater ERP, Flood ERP, and site-
specific emergency procedures for
various facilities. The project began with
a vulnerability assessment of the
region’s wastewater infrastructure,
followed by extensive stakeholder
engagement. As a technical writer,
Natacha led drafting the ERP
documents, incorporating findings from
document reviews, data collection
meetings with facility operators and
regional stakeholders, and risk
assessments to produce final
deliverables tailored to site-specific
operational needs. Prior to Carollo.
> Emergency management analyst for
the Nova Scotia Emergency
Management Office (NS EMO) –
Contingency Planning, Canada. In
response to disruptions caused by the
COVID-19 pandemic and other natural
or human-caused hazards—such as
supply chain shortages, economic
instability, civil unrest, and infrastructure
damage—the Nova Scotia Emergency
Management Office (NS EMO)
commissioned the development of three
contingency plans addressing potential
shortages of water, fuel, and food.
Natacha led the development of these
plans, which included conducting
research on relevant federal and
provincial legislation and policies,
reviewing national and international
best practices, and organizing data
collection workshops with NS EMO staff
and stakeholders. All three final plans
were adopted by the client. Prior to
Carollo.
> Exercise Design and Facilitation for
Multiple Canadian Clients. Designed
and facilitated discussion-based
exercises for over 10 municipal, regional,
and federal clients, including Canada
Post, NRCan, and regional districts.
Deliverables included SMART objectives,
customized scenarios, injects, participant
handbooks, and AARs. Prior to Carollo.
> Evacuation Planning for Multiple
Clients. Developed evacuation plans
incorporating GIS mapping, stakeholder
engagement, and equity-focused
strategies for vulnerable populations.
Prior to Carollo.
> HIRA Projects for Nova Scotia EMO,
Zhiibaahaasing First Nation. Supported
hazard identification and risk
assessments used to prioritize
emergency planning and mitigation
investments. Prior to Carollo.
> Other ERP/Continuity Planning
Projects. Contributed to ERP and
continuity plans for Natural Resources
Canada, Interlake Tribal Council, BC
Maritime Employers Association, and
others. Prior to Carollo.
90 EDUCATION
BS Civil and
Environmental
Engineering, University of
California, 2023
LICENSES
Engineer in Training,
California
PROFESSIONAL
AFFILIATIONS
American Society of Civil
Engineers American
Water Works
Associations
Ashley Kuwahara, EIT
Ashley Kuwahara is a staff professional with two years of experience supporting project management, preliminary and technical design, and pilot operations. Her work spans water and wastewater infrastructure, indirect potable reuse, groundwater replenishment, utility security upgrades, and project planning and programming.
RELEVANT EXPERIENCE
> Staff engineer for the On-call
Security Projects- Design
Improvements for Eastern Region 4
and Western Regions 1, 5 and 7 for
Metropolitan Water District (MWD) of
Southern California, California. Carollo
provided detailed design for security
improvements at multiple Metropolitan
Water District of Southern California
sites across four service areas. The
consolidated bid package included
design drawings, cost estimates, and
technical memoranda. Improvements
generally involved replacing and adding
cameras; upgrading card readers and
door contacts; and adding ground radar,
sensors, and infrastructure. Ashley
provided scoping services visiting 26
sites, collaborating with MWD special
agents, radar specialists, and a security
subcontractor to identify potential gaps
in the existing system and record
findings in site reports. She coordinated
with the security subcontractor to
develop a scoping memo, which
consisted of best practices,
recommended work scope, and design
alternatives considered for detailed
design and the implementation master
plan.
> Assistant engineer for the Water
Sewer Program Security Master Plan
for Alderwood Water and Wastewater
District, Washington. Carollo supported
the client’s 2022 Water and Sewer
Program by providing security and
resiliency analysis and design upgrades.
Working with local partners, the team
focused on enhancing the district’s
water and sewer operations through
proactive system improvements,
building upon the District’s existing
planning documents from the Risk and
Resilience Assessment and Emergency
Response Plan. The project emphasized
collaboration with District staff and
reflected the District’s values of service,
integrity, and respect, ultimately
supporting the mission to deliver clean,
reliable water and wastewater services
to the community. Ashley supported the
preparation of the Security Master Plan
(SMP), pulling from previous security
planning assessments and site visit data
to develop security best practices and
recommended upgrades to both the
water and wastewater infrastructure. She
compiled a map of critical sites and
assets included in the SMP.
> Staff engineer for the Mojave River
Pipeline Traveling Screen Project for
the Mojave Water District, California.
The Mojave River Pipeline Traveling
Screen Project improved water supply
flexibility, capacity, and reliability for the
region. The project included upgrades
to the intake, pump station, and
percolation pond, which are vital to the
Agency’s drinking water system. Carollo
provided construction management and
inspection services, addressing
challenges such as in-water work, pump
replacement, permitting, inter-agency
coordination, and a compressed project
schedule. Ashley led the engineering
review of submittals and Requests for
Information (RFIs) and assisted with the
management of the project.
> Staff engineer for the PFAS
Treatment System for Suburban Water
Systems, California. Carollo designed a
91 Ashley Kuwahara, EIT
15-mgd Per- and Polyfluoroalkyl
Substances (PFAS) treatment plant and
provided bench-scale testing, regulatory
coordination, and selection of ion
exchange technology. The team
supported permitting, funding
applications, and early procurement
strategies to accelerate delivery, with
ongoing services including construction
management and startup assistance.
Ashley developed the technical
specifications and provided support for
the off-site yard piping design. She
assisted the owner with permitting and
funding challenges by innovating
packaging solutions of project
components to mitigate delays.
> Staff engineer for the Sewer Siphon
Replacement Crossing Engineer
Services During Construction for the
Valley Sanitary District, California.
Carollo replaced an exposed 12-inch
sewer siphon with a deeper, safer
pipeline beneath the Coachella Valley
Stormwater Channel at Westward Ho.
The project included the installation of
new 8-inch and 10-inch gravity
pipelines, two 8-inch siphon pipelines,
and an 8-inch air jumper pipeline within
a 1,200-foot high-density polyethylene
(HDPE) sleeve using horizontal
directional drilling. Additional work
involved retrofitting an existing
manhole, adding five new manholes,
and providing construction
management and compliance support
for federal and state funding. Ashley led
engineering review of submittals and
responses to RFIs during construction.
She developed engineering sketches
and responses for change orders.
> Staff engineer and pilot operator for
the Brackish Groundwater Reclamation
Program Phases 1 for the Water
Replenishment District (WRD),
California. Carollo, in partnership with
another consultant, provided
engineering services to support WRD in
remediating brackish groundwater
plumes within the West Coast Basin. As
part of the first phase of this program,
Carollo provided a range of professional
and technical services including:
hydraulic modeling, pipeline alignment
alternatives study, water quality
characterization and simulation, pilot
design and operation, engineering
services during construction, treatment
system alternatives evaluation,
preliminary design, and development of
alternative project delivery solicitation
and contract documents. Ashley
operated and maintained the pilot
during the study, regularly testing water
quality and performing clean-in-place
(CIP) cleanings on the reverse osmosis
(RO) trains when necessary. She led
weekly update meetings with the
consultant and coordinated with
operators to prepare water quality
reports based on pilot data. Ashley
developed two technical memoranda on
the findings of the pilot study and
provided treatment recommendations.
> Assistant engineer for the Capital
Improvement Program Update for
Mesa Water District, California. Carollo
updated Mesa Water’s
10-Year Capital Improvement Program
through 2035. The project included
water use characterization, demand
forecasting, and evaluation of
conservation measures such as recycled
water. Carollo developed a potable
water supply inventory, updated the
hydraulic model, and recommended
system improvements. The team
conducted risk and condition
assessments, reviewed regulations, and
created an Asset Management Program.
Ashley conducted a condition
assessment of the District’s current
maintenance system and tracked valves
and blowoffs within a pilot area.
92 carollo.com
93 City of Simi Valley
Agreement No. 3260007
Carollo Engineers, Inc.
WATER2511.CON.MG RFP No. PW 25-05
EXHIBIT “B”
SCHEDULE OF FEES
17 COST PROPOSAL / RFP No. PW 25-05 / JULY 2025
RISK AND RESILIENCE
ASSESSMENT AND
EMERGENCY RESPONSE PLAN
City of Simi Valley/Ventura County
Waterworks District No. 8
Prepared for
EXHIBIT B
94 carollo.com
707 Wilshire Boulevard, Suite 3920
Los Angeles, California 90017
213-489-1587
July 7, 2025
Michel Kadah, Principal Engineer
Public Works Department, Ventura County Waterworks District No. 8 2929 Tapo Canyon Road
Simi Valley, CA 93063
Subject: Cost Proposal: Risk and Resilience Assessment and Emergency Response Plan, RFP No. Pw 25-05 Dear Mr. Kadah:
The enclosed cost summary information includes hours and costs by tasks based on Carollo Engineers’ 2025 Fee Schedule. Labor costs are based on representative labor rates by personnel classifications.
Carollo has provided revised proposal costing following a proposer interview on June 30th, 2025. The following changes have been made to the proposal costing based on discussions during this interview:
• Combining Workshops 1/2 to streamline data collection efforts (i.e., eliminates Workshop 2). We will validate critical assets during the kickoff meeting, allowing us to use more of the workshop time to discuss threat-asset pairs and consequences.
• Revising project management and progress meeting hours to be more efficient. • Reducing site visit hours to align with a maximum of 3 days of site visits, per the project scope. • Re-allocating hours on individual RRA tasks to create efficiencies in document updates and completion. • Re-allocating hours on the ERP effort to create efficiencies in document updates and completion.
Please feel free to call me if you would like to discuss our proposal at (778) 901-5580 or [email protected].
Sincerely,
CAROLLO ENGINEERS, INC.
Shawn Corrigan CEM, ABCP, ENV SP
VP, Resilience and Sustainability
Technical Practice Director
The total cost of this
proposal is $129,950 as
detailed at the end of the
Cost Proposal section.
95 CAROLLO / PROPOSAL / JULY 2025
2 CITY OF SIMI VALLEY/VENTURA COUNTY WATERWORKS DISTRICT NO. 8 / RISK AND RESILIENCE ASSESSMENT AND EMERGENCY RESPONSE PLAN, RFP NO. PW 25-05 Cost Proposal
Project Role
Principal in
Charge QA/QC QA/QC
Project
Manager &
Emergency
Management
Lead
Cybersecurity
Lead
Security &
RRA Lead
Natural
Hazards Lead
Resilience
Analyst
Engineering
Support DP
Labor Category Principal
Professional
Principal
Professional
Supervising
Professional
Senior
Professional
Senior
Service
Delivery Lead
Senior
Professional
Senior
Professional
Staff
Professional
Staff
Professional
Document
Processor
II
Project Team Member Dan
Baker
Shawn
Corrigan
George
Whitten
Steve
Dowker
Norm
Anderson
Shari
St John
Rachel
Duncan
Natacha
Rueda
Ashley
Kuwahara TBD CAROLLO LABOR
TOTAL
Carollo
PECE
Carollo
Other
Direct
Costs
Enterprise
Protection
Associates
TOTAL OF
EXPENSES
TOTAL
LABOR &
EXPENSESTask # Task Description $364 $364 $361 $282 $364 $282 $282 $265 $265 $172 Hours Dollars $16.00 TASK 1 - RISK AND RESILIENCE ASSESSMENT
UPDATES 10 8 22 14 6 70 32 6 58 12 238 $68,414 $0 $3,000 $19,600 $25,480 $93,894
1.1 Project Management 0 0 0 8 0 0 0 0 0 0 8 $2,256 $0 $- $2,256
1.2 Kickoff/Visioning/Facility Prioritization
Workshop 2 2 2 2 0 2 0 0 2 0 12 $3,836 $390 $390 $4,226
1.3 Progress Meetings 0 0 0 4 0 0 0 0 4 0 8 $2,188 $0 $- $2,188
1.4 Stakeholder Meetings (Operations, IT,
Local First Responders, DHS, etc.) 0 0 0 0 2 2 2 0 2 0 8 $2,386 $780 $780 $3,166
1.5 Workshop No. 1/2 - Review Assets,
Changes, Threats, and Prioritize T-A Pairs 4 0 4 0 0 4 0 4 4 0 20 $6,148 $1,170 $1,170 $7,318
1.6 Data Collection and Site Visits 0 0 0 0 0 24 0 0 8 0 32 $8,888 $3,000 $10,000 $13,000 $21,888
1.7 AWWA G430 Analysis Update 0 0 2 0 0 4 0 0 2 0 8 $2,380 $1,560 $1,560 $3,940
1.9 Complete Risk Calculations 0 0 2 0 0 4 8 0 8 0 22 $6,226 $2,340 $2,340 $8,566
1.10 Draft Updated RRA 2 2 4 0 2 20 8 0 16 8 62 $17,140 $2,340 $2,340 $19,480
1.11 Workshop No. 3 - Review Final Risks,
Integrate Comments, ERP Intro 0 2 2 0 0 2 2 2 2 0 12 $3,638 $780 $780 $4,418
1.12 Risk and Resilience Management 0 0 2 0 0 4 8 0 2 0 16 $4,636 $1,560 $1,560 $6,196
1.13 Final Updated RRA 2 2 4 0 2 4 4 0 8 4 30 $8,692 $780 $780 $9,472 TASK 2 - EMERGENCY RESPONSE PLAN UPDATES 7 11 0 30 4 2 0 59 5 12 130 $36,056 $0 $0 $0 $0 $36,056
2.1 Project Management 0 0 0 8 0 0 0 0 0 0 8 $2,256 $0 $- $2,256
2.2 Progress Meetings 0 0 0 3 0 0 0 0 3 0 6 $1,641 $0 $- $1,641
2.3 Stakeholder Meetings (Operations, IT,
Local First Responders, DHS, etc.) 0 0 0 4 0 0 0 6 0 0 10 $2,718 $0 $- $2,718
2.4 Workshop No. 4 - Review Current ERP
and Identify Needed Updates 3 3 0 3 0 0 0 3 0 0 12 $3,825 $0 $- $3,825
2.5 Draft ERP Updates 2 4 0 8 2 2 0 40 0 8 66 $17
,708 $0 $- $17,708
2.6 Workshop No. 5 - Review ERP Updates 0 0 0 2 0 0 0 2 0 0 4 $1,094 $0 $- $1,094
2.7 Final ERP Updates 2 4 0 2 2 0 0 8 2 4 24 $6,814 $0 $- $6,814 BASELINE TASKS TOTAL 17 19 22 44 10 72 32 65 63 24 368 $104,470 $0 $3,000 $21,040 $25,480 $129,950 96 carollo.com
97