HomeMy WebLinkAbout2021-062 - Resolution RESOLUTION NO. 2021-062
A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF
RANCHO CUCAMONGA, CALIFORNIA, TO ADOPT RANCHO
CUCAMONGA MUNICIPAL UTILITY'S SECURITY PLAN
PURSUANT TO CALIFORNIA PUBLIC UTILITIES
COMMISSION DECISION 19-01-018
WHEREAS, the City of Rancho Cucamonga desires to ensure that there will be safe,
secure and adequate electric resources to serve all of its Municipal Utility customers; and
WHEREAS, the City of Rancho Cucamonga, a California municipal corporation, is
authorized under various provisions of the California Constitution and the general laws of
California (including, specifically, Article XI, section 9(a) of the California Constitution, Public
Utilities Code Section 10004, and Government Code Section 39732(a) to establish, purchase,
and operate a public utility to furnish its inhabitants with, among other things, electricity; and
WHEREAS, the City of Rancho Cucamonga Municipal Utility (RCMU) provides cost
effective, reliable electric services to residents and businesses in portions of the City of Rancho
Cucamonga: and
WHEREAS, as a municipal electric utility, RCMU is generally subject to the legislative
and regulatory requirements applicable to local publicly owned electric utilities (POUs); and
WHEREAS, in 2014, Governor Brown signed Senate Bill 699 (Stats. 2014, Ch. 550,
Sec. 2), with an effective date of September 25, 2014, amending California Public Utilities Code
Section 364, to require the California Public Utilities Commission (CPUC) to consider adopting
rules to address the physical security risks to the distribution systems of investor owned utilities;
and
WHEREAS, on January 10, 2019, the CPUC adopted Decision 19-01-018 directing all
electric utilities to develop and implement a plan that (1) identifies distribution-level substations
that require greater protection against physical attacks; (2) assesses the risks of a successful
physical attack at any identified distribution-level substation and determines whether existing
mitigation measures effectively mitigate these risks; and (3) identifies new security measures if
any identified risks are not effectively mitigated; and
WHEREAS, each POU is required to have a qualified and independent third-party
review its Utility Security Plan; and
WHEREAS, RCMU identified and selected the San Bernardino County Sheriff's
Department/Rancho Cucamonga Police Department (SBCSD/RCPD) to perform the qualified
Independent Third-Party review and RCMU has incorporated and responded to the
recommendations of SBCSD/RCPD in the final version of RCMU's Security Plan; and
WHEREAS, RCMU has identified and selected the Rancho Cucamonga Fire Protection
District (RCFPD) to serve as the Qualified Authority to validate RCMU's Security Plan and
RCFPD has reviewed RCMU's Security Plan and validated it as adequate.
Resolution No. 2021-062 - Page 1 of 3
NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF RANCHO CUCAMONGA
HEREBY RESOLVES AND FINDS:
SECTION 1: The City Council hereby selects and accepts SBCSD/RCPD to serve as
the qualified Independent Third-Party Reviewer of RCMU's Security Plan and said report
incorporated therein.
SECTION 2: The City Council hereby selects and accepts the RCFPD to serve as the
Qualified Authority for the review and validation of RCMU's Security Plan.
SECTION 3: The City Council approves in substantive form the RCMU Utility Security
Plan, dated June 16, 2021, included as Attachment 2 hereto and incorporated herein by
reference.
SECTION 4: The City Manager, or his duly authorized designee, is hereby authorized
and directed to implement, administer, and carry out any such actions as are necessary or
advisable in the furtherance of the RCMU's Security Plan.
Resolution No. 2021-062 - Page 2 of 3
PASSED, APPROVED, and ADOPTED this 71h day of July 2021.
L. Den is ichae1, ayor
i
ATTEST:
40 ice C�eynolds, City Clerk
STATE OF CALIFORNIA )
COUNTY OF SAN BERNARDINO ) ss
CITY OF RANCHO CUCAMONGA )
I, Janice C. Reynolds, City Clerk of the City of Rancho Cucamonga, do hereby
certify that the foregoing Resolution was duly passed, approved, and adopted by the City
Council of the City of Rancho Cucamonga, at a Regular Meeting of said Council held on the
71h day of July 2021.
AYES: Hutchison, Kennedy, Michael, Scott, Spagnolo
NOES: None
ABSENT: None
ABSTAINED: None
Executed this 8th day of July, 2021, at Rancho Cucamonga, California.
a Reynolds, ity Cler
Resolution No. 2021-062 - Page 3 of 3
RANCHO CUCAMONGA
MUNICIPAL UTILITY
SECURITY PLAN
City of
Rancho Cucamonga
PUBLIC REPORT RCMU'S PHYSICAL SECURITY
PROGRAM FOR DISTRIBUTION-LEVEL FACILITIES
,.:
019-
RCMU
Rancho Cucamonga
Municipal e,�t.11f
June 16, 2021
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
TABLE OF CONTENTS
I. Overview..............................................................................................................................................5
• Goal of Utility Security Plan...........................................................................................................5
• Description of Rancho Cucamonga Municipal Utility..............................................................5
• Results of Utility Security Plan Assessment..................................................................................5
II. BACKGROUND.....................................................................................................................................6
III. Plan Development Process................................................................................................................8
A. Physical Security Principles...........................................................................................................8
B. Utility Security Plan Development Process..................................................................................8
STEP 1: Assessment/Plan Development.............................................................................................8
STEp 1 A: Identify Covered Distribution Facilities...............................................................................9
STEP 1 B: Perform Risk Assessment.......................................................................................................9
STEP 1 C: Develop Mitigation Plan......................................................................................................9
STEP2a Independent Review..............................................................................................................9
STEP3;Validation.................................................................................................................................9
STEP4: Adoption................................................................................................................................10
STEP5: Maintenance.........................................................................................................................10
STEP6: Repeat Process......................................................................................................................10
IV. Identification of Covered Distribution Faciliites (Step 1 A)............................................................ 10
A. Identification Factors................................................................................................................... 10
B. Identification Analysis.................................................................................................................. 11
V. Risk Assessment (Step 1 B) ................................................................................................................. 12
A. Methodology ............................................................................................................................... 12
B. Mitigation Measures.................................................................................................................... 12
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 2 of 34
C. Risk Assessment............................................................................................................................ 13
VI. Covered Distribution Facility Mitigation Plans Ste 1 C 14
A. Substation X Mitigation Plan....................................................................................................... 14
VII. Independent Evaluation and Response (Step 2).......................................................................... 15
A. Requirements for Qualified Third Party Review........................................................................ 15
B. Identification of Third Party Reviewer........................................................................................ 15
C. Public Results of Third Party Evaluation..................................................................................... 15
D. RCMU Response........................................................................................................................... 15
VIII. Validation Ste 3 ....................................................... 16
A. Selection of Qualified Authority ....................•••..............••••• 16
B. Results of Qualified Authority Review........................................................................................ 16
C. RCMU Response to Qualied Authority Reivew....................................................................... 16
IX. Narrative Descriptions for Utility Security Plan................................................................................ 17
A. Asset Management Program..................................................................................................... 17
B. Workforce Training and Retention Program ............................................................................ 17
C. Preventative Maintenance Plan................................................................................................ 17
D. Physical Security Event Training 17
E. Communication Infrastructure Risk Assessment ...................................................................... 17
F. Facility Design Features............................................................................................................... 17
X. ADDENDUM........................................................................................................................................... 18
XI. Addendum 1 -Qualified Third Party Review of RCMU's Physical Security Program for
Distribution Level Facilities..............................................................................................................19
I. Identification of Third Party Reviewer.............................................................................................20
II. Physical Security Plans for Distribution-Level Facilities...................................................................20
A. Electric Utility Security Plans Requirements...............................................................................20
B. Qualified Third Party reviewer Requirements ...........................................................................21
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 3 of 34
C. Utility Security Plan Requirements..............................................................................................21
STEP 1A: Identify Covered Distribution Facilities.............................................................................22
STEP 1 B: Perform Risk Assessment.....................................................................................................22
STEP 1 C: Develop Mitigation Plan....................................................................................................22
III. Evaluation of RCMU Utility Security Plan.........................................................................................23
A. Identification of Covered Distribution Facilities (Step 1 A) ......................................................23
B. Review of Risk Assessment (Step 1 B) .........................................................................................25
1. Substation X Risk Assessment...................................................................................................26
C. Voluntary Distribution Facility Mitigation Plans (Step 1 C)........................................................29
IV. Other Recommendations for Physical Security Improvements...................................................31
XII.Addendum 2- Qualified Authority Memorandum,.,.,,
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 4 of 34
il
OVERVIEW
A. GOAL OF UTILITY SECURITY PLAN
Ensuring the safety of its facilities is a top priority for the City of Rancho Cucamonga (City) and
Rancho Cucamonga Municipal Utility (RCMU) prioritizes safety in all aspects of its design,
operation, and maintenance practices. The overarching goal of this Utility Security Plan is to
describe RCMU's risk management approach towards its distribution system physical security,with
appropriate consideration for resiliency, impact, and cost.
While RCMU does not have any "Covered Distribution Facilities" as defined by the CPUC, the City
recognizes the importance of securing the safety and reliability of its electric system and,
therefore, voluntarily participated in the California Public Utilities Commission's (CPUC) Physical
Security proceeding and has undertaken this assessment. In the spirit of continued voluntary
cooperation, the City offers the following in response to CPUC Decision 19-01-018.
B. DESCRIPTION OF RANCHO CUCAMONGA MUNICIPAL UTILITY
RCMU provides economic and reliable electricity to almost 2,000 metered businesses and
residents in a selected area within the Southeastern portion of the City of Rancho Cucamonga.
Since 2004, RCMU has continued to serve its customers with reliable electricity while maintaining
lower rates than those charged by the local investor-owned utility, along with excellent customer
service.
C. RESULTS OF UTILITY SECURITY PLAN ASSESSMENT
RCMU has one (1) substation that was assessed as part of this planning process.The substation
(Substation X) is interconnected to SCE's 66 kV Subtransmission grid. It is the single point of
connection for RCMU's electrical distribution system which is fed from the substation.
RCMU has determined that this substation is NOT identified as a "Covered Distribution Facility"
within its service territory because it did not meet any of the 7 screening factors identified in the
report below.This determination in combination with the required narrative elements described
above should constitute the RCMU's Utility Security Plan Assessment without the need for the
creation of a Mitigation Plan.
However, RCMU has taken the position that it considers it a best practice to make any security
improvements found by the independent evaluation process to be invaluable to the overall
operations of the utility. RCMU will take these recommendations under advisement and plan
accordingly.
The San Bernardino County Sheriff's Department/Rancho Cucamonga Police Department
(SBCSD/RCPD) was selected to conduct the independent evaluation. SBCSD/RCPD evaluated
Substation X and agreed with RCMU's Security Plan Assessment that it did not need to create a
Mitigation Plan. Additionally, SBCSD/RCPD also agreed with RCMU's position that it considers it a
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 5 of 34
best practice to take under advisement any suggestions submitted in Article IV of the Qualified
Third-Party Review Report in Addendum 1.
RCMU agrees with the independent evaluation and is currently reviewing and taking under
consideration the voluntary recommendations submitted in Article IV in Addendum 1.
BACKGROUND111.
On April 16, 2013, one or more individuals attacked equipment located within Pacific Gas and
Electric Company's (PG&E) Metcalf Transmission Substation, ultimately damaging 17
transformers. These individuals also cut nearby fiber-optic telecommunication cables owned by
AT&T. In response to the attack, the Federal Energy Regulatory Commission (FERC) directed the
North American Electric Reliability Corporation (NERC) to develop new physical security
requirements, resulting in the creation of CIP-014.
At the state level, Senator Jerry Hill authored SB 699 (2014), directing the CPUC to
"consider adopting rules to address the physical security risks to the distribution systems of
electrical corporations." In response to SB 699, the CPUC's Safety and Enforcement Division, Risk
Assessment and Safety Advisory Section (RASA) prepared a white paper proposing a new
requirement for investor owned utilities (IOUs) and publicly owned utilities (POUs) to develop
security plains that would identify security risks to their distribution and transmission systems, and
propose methods to mitigate those risks. The CPUC hosted a series of workshops to better
understand the state of utility physical security protections and to seek input on refiningtheir
proposal.
In order to support a statewide improvement of how utilities address distribution level physical
security risks, the California Municipal Utilities Association (CMUA), which is the statewide trade
association for POUs, coordinated with the state's IOUs to develop a comprehensive Straw
Proposal (Joint IOU/POU Straw Proposal) to serve as a process to identify at-risk facilities and, if
necessary, develop physical security mitigation plans. As a member of CMUA, RCMU staff
participated in the development of the Joint IOU/POU Straw Proposal through a CMUA working
group as well as through direct meetings with the IOUs. The Joint IOU/POU Straw Proposal set out
a process for the following: (1) identifying if the utility has any high priority distribution facilities; (2)
evaluating the potential risks to those high priority distribution facilities; (3) for the distribution
facilities where the identified risks are not effectively mitigated through existing resilience/security
measures, developing a mitigation plan; (4) obtaining third party reviews of the mitigation plans;
(5) adopting a document retention policy; (6) ensuring a review process established by the POU
governing board; and (7) implementing information sharing protocols.
Straw Proposal available at:
"+� wv�N.CpUCCr� JOB✓vp'c�ade Files Fl,(_'✓� nitE'nf/S Let 'iFsk ASS@SSme�yt_C m C �`�/R1_iQ6 9_
rc�aie t� ��JoiL �O�+r w` ���r, �, al= �� d° 0_uv�i 08311 �:20Filin df.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 6 of 34
RASA filed a response2 to the Joint IOU/POU Straw Proposal that recommended various
modifications and clarifications, including a six step process. Additionally, RASA recommended
that the utility mitigation plans include: (1) an assessment of supply chain vulnerabilities; (2)
training programs for law enforcement and utility staff to improve communication during
physical security events; and (3) an assessment of any nearby communication utility
infrastructure that supports priority distribution substations.
In early 2019, the CPUC approved Decision (D.) 19-01-018,which adopted the Joint IOU/POU
Straw Proposal as modified by the RASA proposal.The CPUC Decision provided additional
clarifications and guidance D.19-01-018 clarified that where there is a conflict between the
Straw Proposal and the RASA proposal, then it is the rule in the RASA proposal that controls.3
D.19-01-018 asserted that the POUs should utilize the Utility Security Plan process described
therein. RCMU is following the process and issuing this report at this time to reflect its existing
commitment to safety and to protecting its ratepayers' investment by taking reasonable and
cost-effective measures in an effort to safeguard key assets of its distribution system.
2 RASA Response available at:
rft�iS:Uwww aNed Files iC PLiCVJeksite/Content,`0_e_LZPs� AssessmentphysicaisecurityiFirol2=toff
`G20Recorrime-�Ja+iori Dfor a2OCor-rin,i sion7.2OConsideration-620()10315 �Lif.
3 D.19-01-018 at 43,footnote 58("Should there be any question of which shall predominate should there be any
incongruity or conflict between a utility or SED RASA recommended rule,the SED RASA rule shall apply.").
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 7 of 34
Ill. PLAN DEVELOPMENT PROCESS
A. PHYSICAL SECURITY PRINCIPLES
The Joint IOU/POU Straw Proposal seeks to support the creation of a risk management approach
toward distribution system physical security, with appropriate considerations of resiliency,
impact, and cost. In order to accomplish this risk-based approach, the Joint IOU/POU Straw
Proposal identifies several principles to guide the development of each individual utility's
program. These principles are the following:
1. Distribution systems are not subject to the same physical security risks and associated
consequences, including threats of physical attack by terrorists, as the transmission
system.
2. Distribution utilities will not be able to eliminate the risk of a physical attack occurring,
but certain actions can be taken to reduce the risk or consequences, or both, of a
significant attack.
3. A one-size-fits-all standard or rule will not work. Distribution utilities should have the
flexibility to address physical security risks in a manner that works best for their systems
and unique situations, consistent with a risk management approach.
4. Protecting the distribution system should consider both physical security protection and
operational resiliency or redundancy.
5.The focus should not be on all Distribution Facilities, but only those that risk dictates
would require additional measures.
6. Planning and coordination with the appropriate federal and state regulatory and law
enforcement authorities will help prepare for attacks on the electrical distribution system
and thereby help reduce or mitigate the potential consequences of such attacks.
13. Utility Security Plan Development Process
RCMU utilized a multi-step process to develop this Utility Security Plan that is consistent with the
Joint IOU/POU Straw Proposal and D.19-01-018. The relevant six steps of that process are the
following:
STEP 1 : ASSESSMENT/PLAN DEVELOPMENT
RCMU staff prepared a Draft Utility Security Plan through the process set forth in Steps 1 A, 1 B, and
1 C.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 8 of 34
STEP 1 A: IDENTIFY COVERED DISTRIBUTION FACILITIES
RCMU will evaluate all distribution-level facilities in its service territory that are subject to its
control to determine if any facility meets D.19-01-018's definition of a "Covered Distribution
Facility" using the seven factors identified in the Joint IOU/POU Straw Proposal.
STEP 1 B: PERFORM RISK ASSESSMENT
For every individual Covered Distribution Facility identified pursuant to Step 1 A, RCMU will
perform an evaluation of the potential risks associated with a successful physical attack on that
Covered Distribution Facility, and whether existing grid resiliency, back-up generation, and/or
physical security measures appropriately mitigate identified risks.
STEP 1 C: DEVELOP MITIGATION PLAN
If there are any individual Covered Distribution Facilities where the Risk Assessment performed
pursuant to Step 1 B finds that the existing mitigation and/or resiliency measures do not
effectively mitigate the identified risks, then RCMU will develop a Mitigation Plan for that
Covered Distribution Facility.The Mitigation Plan will use a risk-based approach to select
reasonable and cost-effective measures that can either be security focused (e.g.,walls or
alarms) or resiliency focused (e.g., adequate spare parts).
STEP 2: INDEPENDENT REVIEW
For every Utility Security Plan cycle, RCMU will document the results of the identification process,
risk assessment, and Mitigation Plan development performed pursuant to Steps 1 A, 1 B, and 1 C.
This documentation in combination with narrative description in Section IX below, constitutes
RCMU's Draft Utility Security Plan. Each Draft Utility Security Plan is submitted to a Qualified Third
Party for Independent Review. The Qualified Third Party Reviewer will then issue an evaluation
that identifies any potential deficiencies in the Draft Utility Security Plan as well as
recommendations for improvements. RCMU will then modify its plan to address any identified
deficiencies or recommendations or will document the reasons why any recommendations were
not adopted. The combination of the Draft Utility Security Plan, the non-confidential conclusions
of the Qualified Third Party Reviewer, and RCMU's responses to the Qualified Third Party Review
Will constitute RCMU's Utility Security Plan.
STEP 3: VALIDATION
RCMU will submit its Utility Security Plan to a qualified authority for review. This entity will provide
additional feedback and evaluation of RCMU's Utility Security Plan and, to the extent that this
entity is authorized, such entity deems the Utility Security Plan as adequate.The Rancho
Cucamonga Fire District's Emergency Management Division was selected as the Validation
Entity.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 9 of 34
STEP 4: ADOPTION
RCMU's Utility Security Plan will be presented to and adopted by the City of Rancho
Cucamonga's City Council as the Governing Board at a public meeting.
STEP 5. MAINTENANCE
RCMU will refine and update the Utility Security Plan as appropriate and as necessary to
preserve plan integrity.
STEP 6: REPEAT PROCESS
RCMU will repeat this six step process at least once every five years.
IDENTIFICATIONOF • DISTRIBUTION
As described in Section III, Step 1 A of the Utility Security Plan process involves assessing all
distribution-level facilities that are subject to the control of RCMU to determine which facilities
are "Covered Distribution Facilities" subject to the need for a risk assessment. This Section
describes the factors that RCMU used to evaluate its distribution facilities and the results of its
evaluation.'
{A. IDENTIFICATION FACTORS
The Joint IOU/POU Straw Proposal defines seven screening factors to determine if a facility is a
"Covered Distribution Facility." Some factors require additional definitions and/or clarifications in
order to be applied to RCMU's facilities. The following Table provides the Joint IOU/POU Straw
Proposal's Factors as modified/clarified by RCMU.
Fact_ Joint IOU/POU Straw Proposal Description Additional Clarification
Distribution Facility necessary for crank path, No additional clarification.
black start or capability essential to the
restoration of regional electricity service
that are not subject to the California
1 Independent System Operator's (CAISO)
operational control and/or subject to North
American Electric Reliability Corporation
(NERC) Reliability Standard CIP-014-2 or its
_ successors
Distribution Facility that is the primary source No additional clarification.
of electrical service to a military installation
essential to national security and/or
2 emergency response services (may include
certain airfields, command centers,
weapons stations, emergency supply
depots)
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 10 of 34
i
Distribution Facility that serves installations An installation provides "regional
necessary for the provision of regional drinking water supplies and wastewater
drinking water supplies and wastewater services" if it is the primary source of
3 services (may include certain aqueducts, drinking water supply or wastewater
well fields, groundwater pumps, and services for over 40,000 customer
treatment plants) accounts for an area with a population
of over 100,000.
Distribution Facility that serves a regional RCMU defines "regional public safety
public safety establishment (may include establishment" as any of the following:
County Emergency Operations Centers; (1) Headquarters of a major police or
county sheriff's department and major city fire department serving 1.5 million
police department headquarters; major population with at least 1,000 sworn
4 state and county fire service headquarters; officers; (2) County Sheriff's
county jails and state and federal prisons; Department Headquarters; (3) County
and 911 dispatch centers) Emergency Operations Center; (4)
County/State Fire headquarters; (5) a
California State Prison; (5) a United
States Penitentiary; or (6) a Federal
Correctional Institute.
Distribution Facility that serves a major In addition to the facilities listed in the
transportation facility (may include Joint IOU/POU Straw Proposal, RCMU
International Airport, Mega Seaport, other defines a "major transportation facility"
5 air traffic control center, and international as any transportation facility that has
border crossing) (1) an average of 600 or more flights
per day; or (2) over 50,000 passengers
arriving or departing per day.
Distribution Facility that serves as a Level 1 No additional clarification.
6 Trauma Center as designated by the Office
of Statewide Health Planning and
Development
Distribution Facility that serves over 60,000 No additional clarification.
7 meters
B. IDENTIFICATION ANALYSIS
In performing this identification analysis, RCMU assessed all distribution level facilities that are
subject to its exclusive control, or if the facility is jointly owned, the joint ownership agreement
identifies RCMU as the entity responsible for operation and maintenance. The specific types of
facilities include substations.
Based on this scope, RCMU has identified zero (0) "Covered Distribution Facilities" in its service
territory that are subject to this identification analysis.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 1 1 of 34
The following table summarizes the results of RCMU's identification analysis.
x.
Substation X N/A N/A N/A N/A N/A N/A N/A
V. RISK ASSESSMENT (STEP I B)
A. METHODOLOGY
Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, RCMU
will assess the potential risks associated with a successful physical attack on each of the
Covered Distribution Facilities identified in Section IV above. For purpose of this analysis, a
physical attack is limited to the following: (1) theft; (2) vandalism; and (3) discharge of a firearm.
A "successful physical attack" is limited to circumstances where a theft, vandalism, and/or the
discharge of a firearm has directly led to the failure of any elements of the Covered Distribution
Facility that are necessary to provide uninterrupted service to the specific load identified in
Section IV.
In order to perform this risk analysis, RCMU evaluated the relative risk that (1) a physical attack
on a Covered Distribution Facility could be successful considering the protective measures in
place; or (2) that the impacts of a successful attack would be mitigated due to resiliency and
other measures in place.
B. MITIGATION MEASURES
D.19-01-01 identifies the specific mitigation measures that a utility should consider when
performing this risk analysis. The following table lists these mitigation measures and provides
RCMU's additional clarifications that are necessary to apply these measures to the RCMU's
territory.
Measure PTA 9-01-018 Description Additional Clarification
The existing system resiliency and/or No additional clarification.
redundancy solutions (e.g., switching the
1 load to another substation or circuit
capable of serving the load, temporary
circuit ties, mobile generation and/or
_ storage solutions).
The availability of spare assets to restore a No additional clarification.
2 particular load.
The existing physical security protections to No additional clarification.
3 reasonably address the risk.
The potential for emergency responders to Each facility is evaluated based on
4 identify and respond to an attack in a the likelihood that a law enforcement
timely manner. officer would generally be able to
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 12 of 34
arrive at the Covered Distribution
Facility within 15 minutes of a report
from the public of a break-in or
attack, or of RCMU notifying the law
enforcement agency of the triggering
of an alarm at the facility.
Location and physical surroundings, RCMU evaluated this element based
including proximity to gas pipelines and on the proximity of the Covered
geographical challenges, and impacts of Distribution Facility to populated areas
5 weather. and the extent to which the interior of
the facility is shielded from view and
access due to walls, vegetation, or
other physical obstructions.
History of criminal activity at the Distribution RCMU evaluated the property crime
Facility and in the area. rates in the immediate vicinity of the
Covered Distribution Facility and
compared those crimes rates to
6 property crime rates for the county
and the state to determine if the area
is subject to a higher than average
incidence of property related crimes.
The availability of other sources of energy No additional clarification.
7 to serve the load (e.g., customer owned
_ back-up generation or storage solutions).
The availability of alternative ways to meet No additional clarification.
S the health, safety, or security.
Requirements served by the load (e.g., No additional clarification.
9 back up command center or water
storage facility)
C. RISK ASSESSMENT
Based on the process described in the Joint IOU/POU Straw Proposal and the direction provided
in D.19-01-018, RCMU has determined that even though there are NO Covered Distribution
Facility identified in Section IV, RCMU does have existing programs and measures to effectively
mitigate the risks of a physical attack for its existing substation.
RCMU believes that securing our substation to be of utmost importance and critical to our
overall operations.The existing measures to mitigate security risks are listed below:
1. Our existing physical perimeter is constructed of solid wrought iron fencing of 7' in height.
2. Our entrance area is a solid wrought iron security gate with key card access which is
authorized by the City of Rancho Cucamonga in a department separate from RCMU;
3. Entrance into the substation facility equipment building also requires key card access
which can have a different level of access; all doors automatically close and lock;
4. An additional existing physical perimeter 7' block wall,with portions of area with barbed
wire on the top connects to the substation equipment building;
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 13 of 34
5. Security cameras monitor the facility 24/7 and are monitored by a City of Rancho
Cucamonga Department separate from RCMU;
6. An internal communication system is available with the City's Public Safety Departments
if needed;
7. Emergency response measures and procedures are in place. The Police Department is
located 2.3 miles away, and the nearest Fire Department is 1.6 miles away.The
Substation X is listed in the Rancho Cucamonga Local Hazards Mitigation Plan as a
critical facility for the City.
8. A prevention maintenance plan for the property and all security equipment is in place to
ensure that all mitigation measures are functional and performing adequately.
9. There are no incidents of criminal activity regarding this Substation or property.
10. Spare assets and emergency call outs will be provided by RCMU's substation contractor.
The follow table provides a summary of RCMU's assessment of each mitigation measure for each
Covered Distribution Facility.
IN
Substation X N/A Yes Yes Yes N/A None N/A N/A
As identified above, Substation X does have existing measures sufficient to effectively mitigate
the identified risks of a physical attack. These facilities are discussed in Section VI.
COVERED •
Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, RCMU
has deter fined that for Substation X, even though it is not subject to the requirements for a
Covered Distribution Facility, the existing mitigation measures do effectively reduce the risk of a
physical security attack. This section describes the Mitigation Plan that RCMU has developed for
this voluntarily evaluated Covered Distribution Facility.
A. SUBSTATION X MITIGATION PLAN
RCMU believes it meets or exceeds the required voluntary mitigation measures as outlined in this
report. RCMU welcomes any additional voluntary suggestions from the independent evaluation
team(s) and will continue to make improvements to upgrade or enhance the safety measures
currently in place. RCMU will take each item under consideration and begin the process of
implementation, and schedule for budgeting and construction as noted. In some cases, the
voluntary upgrade suggestions have already started before this report was finalized and have a
completion date after the due date of this report.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 14 of 34
EVALUATIONVII. INDEPENDENT RESPONSE
A. REQUIREMENTS FOR QUALIFIED THIRD PARTY REVIEW
D.19-01-018 specifies the following criteria for a Qualified Third Party Reviewer:
Independence: A Qualified Third Party Reviewer cannot be a division of the POU. A
governmental entity can select as the third-party reviewer another governmental entity
within the same political subdivision, so long as the entity has the appropriate expertise,
and is not a division of the POU that operates as a functional unit, i.e., a municipality
could use its police department as its third-party reviewer if it has the appropriate
expertise.
Adequate Qualifications: A Qualified Third Party Reviewer must be an entity or
organization with electric industry physical security experience and whose review staff
has appropriate physical security expertise,which means that it meets at least one of the
following: (1) an entity or organization with at least one member who holds either an ASIS
International Certified Protection Professional (CPP) or Physical Security Professional (PSP)
certification; (2) an entity or organization with demonstrated law enforcement,
government, or military physical security expertise; or (3) an entity or organization
approved to do physical security assessments by the CPUC, Electric Reliability
Organization, or similar electrical industry regulatory body.
B. IDENTIFICATION OF THIRD PARTY REVIEWER
RCMU has selected the County of San Bernardino Sheriff's Department-Rancho Cucamonga
Police Department (SBCSD/RCPD) as its Third Party Reviewer.The SBCSD/RCPD, as a law
enforcement agency, is well qualified to review this security plan.
C. PUBLIC RESULTS OF THIRD PARTY EVALUATION
See the attached report submitted by the SBCSD/RCPD-Addendum 1 (Qualified Third-Party
Review of RCMU's Physical Security Program for Distribution-Level Facilities).
D. RCMU RESPONSE
RCMU agrees with SBCSD/RCPD's assessment of the RCMU Security Assessment Plan.
Additionally, RCMU accepts SBCSD/RCPD's additional voluntary recommendations and will work
towards implementing as many of the recommendations as possible moving forward. RCMU also
notes that some items are already underway prior to the completion of this report and/or
evaluation.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 15 of 34
VALIDATION
A. SELECTION OF QUALIFIED AUTHORITY
RCMU has identified and selected the Rancho Cucamonga Fire Protection District's Emergency
Management Division as the Qualified Authority to validate RCMU's Security Plan. RCMU is
confident of their qualifications.
RCMU has provided the criteria necessary for their review, inspection, and validation of the
facility as well as a copy of this report including the third party independent review by
SBCSD/RCPD.
B. RESULTS OF QUALIFIED AUTHORITY REVIEW
A copy of the Qualified Validation Authority review is attached-see Addendum 2
C. RCMU RESPONSE TO QUALIFIED AUTHORITY REVIEW
RCMU has accepted the findings of the Qualified Authority Validation from the Rancho
Cucamonga Fire Protection District.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 16 of 34
I X. NARRATIVE DESCRIPTIONS FOR UTILITY SECURITY PLAN
A. ASSET MANAGEMENT PROGRAM
RCMU has identified the on-site small parts list necessary to restore operations with its substation
contractor and will stock these for use as needed, ensuring that replacements and inventory will
be monitored. Additionally, RCMU's substation contractor will work to ensure that any additional
parts required will be identified in the event of an emergency and will assist with outsourcing
these parts. RCMU has also researched a vendor providing larger equipment and parts, such as
mobile transformers.These resources will continue to be evaluated on an ongoing basis in an
effort to locate items for availability and optimization.
B. WORKFORCE TRAINING AND RETENTION PROGRAM
RCMU is a small POU and its electric substation is unmanned, therefor City workforce technicians
do not have the required expertise to make any repairs inside the substation. However, RCMU
maintains a City contract for services with highly-qualified substation contractors that can make
the necessary repairs when called upon. Additionally, RCMU's existing medium/high voltage
contractors are also trained to assess and troubleshoot problems occurring at the substation.
C. PREVENTATIVE MAINTENANCE PLAN
RCMU has a very proactive preventative maintenance plan for its substation. RCMU has taken
steps to implement a preventative maintenance plan for security equipment to ensure that
mitigation measures are functional and performing adequately. Frequency of maintenance
tests and recommendations are in accordance with:
o American National Standards Institute's (ANSI) standards for Maintenance Testing
Specifications for Electrical Power Equipment and Systems;
o Utility industry standard best practices and guidelines for standard maintenance of
electrical substations, and;
o Power System Maintenance Manuals and industry best practices.
D. PHYSICAL SECURITY EVENT TRAINING
RCMU participates with the RCFPD, SBCSD/RCPD and other local agencies in tabletop exercises,
that may include Substation X in the exercise. Local agencies receive updated maps and
contact information as required.
E. COMMUNICATION INFRASTRUCTURE RISK ASSESSMENT
N/A
F. FACILITY DESIGN FEATURES
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 17 of 34
RCMU is reviewing the suggested voluntary improvements listed by SBCSD/RCPD in their report.
Many have been addressed with the appropriate responsible parties, such as the City's facilities
maintenance division. Consideration is being given to structural upgrades/additions.
Surveillance camera upgrades are already underway.
X. ADDENDUM
RCMU has included two (2) required addendum reports as follows:
ADDENDUM 1.-San Bernardino County Sheriff/Rancho Cucamonga Police Department's Third
Party Reviewer's report (pages 19-32).
ADDENDUM 2.- Rancho Cucamonga Fire Protection District's Qualified Authority Review (page
33).
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 18 of 34
SAN BERNARDINO
COUNTY SHERIFF ' S
DEPARTMENT
d
QUALIFIED THIRD-PARTY REVIEW OF
RCMU'S PHYSICAL SECURITY PROGRAM FOR
DISTRIBUTION-LEVEL FACILITIES
m rX-9,
Me;r i i
RCMU
Rancho Cucamor 4
Municipal utility
April 21, 2021
ADDENDUM 1
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 19 of 34
IDENTIFICATION1. OF
The San Bernardino County Sheriff's Department(SBCSD) City of Rancho Cucamonga Police
Department(RCPD). The San Bernardino County Sheriff's Department is the law enforcement
agency for the largest geographical county in the nation. The department serves over 2.1
million residents,with 8 county and 14 contract patrol stations and approximately 3,900
employees to ensure the quality and safety of those we serve. Rancho Cucamonga Police
Department is a contract patrol station.The SBCSD has provided services for the City of Rancho
Cucamonga since it incorporated in 1977 and the station has grown tremendously since then.
RCPD provides security to over 177,000 residents and currently there are approximately 182
Sheriff's personnel serving the citizens in nearly 38 square miles. RCPD is a full-service station
which not only provides proficient patrol services, but also provides a significant full-service traffic
division, Major Accident Investigation Team (MATT), a commercial enforcement unit, parking
enforcement, business, and specialty expertise services.SBCSD also provides a variety of support
services that are available to the City as a part of this contract, including but not limited to
Criminal Intelligence and Analysis, Threat Analysis and Anti-Terrorism Liaison services.To that end,
SBCSD meets and exceeds the "Qualified Third Party Reviewer criteria listed in II.(B) below.
Ill. PHYSICAL SECURITY PLANS FOR •
A.j,ELECTRIC UTILITY SECURITY PLANS REQUIREMENTS
California Public Utilities Commission (CPUC) Decision (D.) 19-01-018 directs all electric utilities to
develop a,physical security plan for the distribution-level facilities located within the electric
utility's seNice territory. Publicly owned electric utilities (POUs) generally treat the CPUC's safety
rules for electric supply systems as key industry standards. Accordingly, Rancho Cucamonga
Municipal Utility (RCMU) has developed a Utility Security Plan consistent with the direction
provided in D.19-01-018. Specifically, is Utility Security Plan must do the following: (1) assess
whether any RCMU controlled distribution level facilities are necessary to maintain electric
service to a critical load with regional impacts; (2) if such facilities are identified, then the Utility
Security Plan must evaluate whether existing security measures sufficiently reduce the risk of a
successful attack or mitigate the impacts of successful attack; and (3) for any facility where the
existing security measures are found to not be sufficient, develop a mitigation plan to address
these issues. D.19-01-018 further directs electric utilities to have a qualified third party evaluate
the Utility Security Plan and identify any potential deficiencies as well as provide any
recommendations for improvements.
This report serves as the Qualified Third Party Review of RCMU's Utility Security Plan. In summary,
this report finds the following:
• Identification: RCMU correctly determined that there are no "covered facilities" (as
defined in the RCMU Utility Security Report), that are controlled by RCMU and which are
located within RCMU's service territory.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 20 of 34
• Risk Assessment:The San Bernardino County Sheriff's Department(SBCSD)/RCPD, agreed
with the analysis of existing mitigation measures at any covered facilities or any
voluntarily identified facilities.
• Mitiaation Plans:Mitigation plan defined in "Alternate (2)" assessment of the proposed
measures by SBCSD/RCPD has agreed with RCMU's plan, and has provided to RCM
additional voluntary recommendations as outlined in "Article IV".
• Other Recommendations for Improvements:SBCSD/RCPD does include additional
voluntary site security and exterior protection measures for RCMU to consider as
additional best practices, for further information see "Article IV".
B. QUALIFIED THIRD-PARTY REVIEWER REQUIREMENTS
D.19-01-018 specifies that a Qualified Third Party Reviewer must meet both of the following
requirements:
Independence: A Qualified Third Party Reviewer cannot be a division of the POU. A
governmental entity can select as the third-party reviewer another governmental entity
within the same political subdivision, so long as the entity has the appropriate expertise,
and is not a division of the POU that operates as a functional unit, i.e., a municipality
could use its police department as its third-party reviewer if it has the appropriate
expertise.
Adequate Qualifications: A Qualified Third Party Reviewer must be an entity or
organization with electric industry physical security experience and whose review staff
has appropriate physical security expertise,which means that it meets at least one of the
following: (1) an entity or organization with at least one member who holds either an ASIS
International Certified Protection Professional (CPP) or Physical Security Professional (PSP)
certification; (2) an entity or organization with demonstrated law enforcement,
government, or military physical security expertise; or (3) an entity or organization
approved to do physical security assessments by the CPUC, Electric Reliability
Organization, or similar electrical industry regulatory body.
The San Bernardino County Sheriff's Department/Rancho Cucamonga Police Department meets
the "independence"requirements described in D.19-01-018. Further, the SBCSD/RCPD has
adequate qualifications including: Crime Prevention Through Environmental Design (CPTED),
Non Profit Security Grant Vulnerability Assessment, Behavioral Threat Assessment-Preventing the
Active Shooter, Targeting-Sabotage and Disruption of Public Utilities. Therefore, the
SBCSD/RCPD meets both of the relevant requirements and is eligible to serve as a Qualified Third
Party Reviewer.
C. UTILITY SECURITY PLAN REQUIREMENTS
D.19-01-018 provides the following three step process for the identification, risk-assessment, and
mitigation plan development elements of a Utility Security Plan.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 21 of 34
STEP 1 A: IDENTIFY COVERED DISTRIBUTION FACILITIES
RCMU evaluates all distribution-level facilities in its service territory that are subject to its control in
order to determine if any facility meets the definition of a "Covered Distribution Facility," using
the seven factors identified in the Joint IOU/POU Straw Proposal, as further defined in the RCMU
Utility Security Plan.
STEP 1 B: PERFORM RISK ASSESSMENT
For every individual Covered Distribution Facility identified pursuant to Step 1 A, RCMU performs
an evaluation of the potential risks associated with a successful physical attack on that Covered
Distribution Facility, and whether existing grid resiliency, back-up generation, and/or physical
security measures appropriately mitigate the identified risks.
STEP 1 C: DEVELOP MITIGATION PLAN
If there are any individual Covered Distribution Facilities where the Risk Assessment performed
pursuant to Step 1 B finds that the existing mitigation and/or resiliency measures do not
effectively mitigate the identified risks, then RCMU will develop a Mitigation Plan for that
Covered Distribution Facility. The Mitigation Plan will use a risk-based approach to select
reasonable and cost-effective measures that can either be security focused (e.g.,walls or
alarms) or resiliency focused (e.g., adequate spare parts).
This report evaluates each of these three steps in the Utility Security Plan development process.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 22 of 34
EVALUATIONOF
A. IDENTIFICATION OF COVERED DISTRIBUTION FACILITIES (STEP 1 A)
The Joint IOU/POU Straw Proposal defines seven screening factors to determine if a facility is a "Covered Distribution Facility." Those
factors are further defined in the RCMU Utility Security Plan. The following table provides San Bernardino County Sheriff Department's
assessment of the identification analysis performed by RCMU.
Factor Joint:IOU/POU Straw.Proposal Description „ � Identification in RCMU Plan Assessment of Qualified,Third Party,
Distribution Facility necessary for crank path, black start
or capability essential to the restoration of regional Third Partv Reviewer Assessment:.
electricity service that are not subject to the California RCMU correctly determined that no
1 Independent System Operator's (CAISO) operational [N/A] Distribution Facility is necessary for the
control and/or subject to North American Electric purposes identified in Factor 1.
Reliability Corporation (NERC) Reliability Standard CIP-
014-2 or its successors
Distribution Facility that is the primary source of Third Partv Reviewer Assessment:.
electrical service to a military installation essential to RCMU correctly determined that no
national security and/or emergency response services [N/A] Distribution Facility is the primary source of
2 (may include certain airfields, command centers, electrical service for a location identified in
weapons stations, emergency supply depots) Factor 2. No military installations are served
by RCMU.
Distribution Facility that serves installations necessary for Third Partv Reviewer Assessment:
the provision of regional drinking water supplies and RCMU correctly determined that no
wastewater services (may include certain aqueducts, Distribution Facility is necessary for a facility
well fields, groundwater pumps, and treatment plants. meeting the definition in Factor 3. No
3 Additional Clarification: An installation provides [N/A] facility in POU's service territory is the
"regional drinking water supplies and wastewater primary source of drinking water or
services" if it is the primary source of drinking water wastewater services for over 40,000
supply or wastewater services for over 40,000 customer customers or for an area with over 100,000
accounts for an area with a population of over 100,000. residents.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 23 of 34
Distribution Facility that serves a regional public safety
establishment (may include County Emergency
Operations Centers; county sheriff's department and
major city police department headquarters; major state
and county fire service headquarters; county jails and
state and federal prisons; and 911 dispatch centers.
Additional Clarification: RCMU defines "regional public Third Partv Reviewer Assessment:
4 safety establishment" as any of the following: (1) [N/A] RCMU correctly determined that no
Headquarters of a major police or fire department Distribution Facility serves a regional public
serving 1.5 million population with at least 1,000 sworn safety establishment as defined in Factor 4.
officers; (2) County Sheriff's Department Headquarters;
(3) County Emergency Operations Center; (4)
County/State Fire headquarters; (5) a California State
Prison; (5) a United States Penitentiary; or (6) a Federal
Correctional Institute.
Distribution Facility that serves a major transportation
facility (may include International Airport, Mega
Seaport, other air traffic control center, and
international border crossing. Third Partv Reviewer Assessment:
Additional Clarification: In addition to the facilities listed RCMU correctly determined that no
5 in the Joint IOU/POU Straw Proposal, RCMU defines a [N/A] Distribution Facility serves a major
"major transportation facility" as any transportation transportation facility as defined in Factor
facility that has (1) an
average of 600 or more flights per 5.
g 9
day; or (2) over 50,000 passengers arriving or departing
per day.
Distribution Facility that serves as a Level 1 Trauma Third Partv Reviewer Assessment:
6 Center as designated by the Office of Statewide Health [N/A] RCMU correctly determined that no
Planning and Development Distribution Facility serves a Level I Trauma
Center.
Distribution Facility that serves over 60,000 meters Third Partv Reviewer Assessment:
7 [N/A] RCMU correctly determined that no
Distribution Facility serves over 60,000
meters.
Rancho Cucamonga Municipal Utility Security Plan
.June 16, 2021
Page 24 of 34
Summary of Third-Party Reviewer Assessment:
Based on the analysis described above, SBCSD/RCPD has determined RCMU correctly identified no Distribution Facilities as meeting
the definition for a Covered Facility.
San Bernardino County Sheriff's Department/RCPD agrees with RCMU's determination to voluntarily perform a risk analysis on
distribution facilities that are of high value, while not meeting the definitions above. For purposes of this report, these substations are
referred to as "Voluntary Distribution Facilities."
B. REVIEW OF RISK ASSESSMENT (STEP 1 B)
The RCMU Utility Security Plan assessed the potential risks associated with a successful physical attack on each of the "Voluntary
Distribution Facilities"as identified in Step IA. For purpose of this analysis, a physical attack is limited to the following: (1) theft; (2)
vandalism;and (3) discharge of a firearm. A "successful physical attack" is limited to circumstances where a theft, vandalism, and/or
the discharge of a firearm has directly led to the failure of any elements of the Substation that are necessary to provide uninterrupted
service to any relevant public health and safety loads, as described above.
For this review, the SBCSD/RCPD assessed RCMU's evaluation of the relative risk that(1) a physical attack on a Voluntary Distribution
Facility will be successful considering the protective measures in place;or(2) that the impacts of a successful attack will be mitigated
due to resiliency and other measures in place. To perform this review, SBCSD/RCPD took the following steps: Law enforcement
personnel conducted a site security assessment of Substation X and an in-the-field evaluation of the facility. The site assessment was
conducted to gather important information about Substation X that can be utilized by law enforcement, fire, paramedics, and other
emergency services agencies during a natural human-caused, or technical hazard crisis event. The following table[s] provides a
summary SBCSD/RCPD evaluation for each identified Substation.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 25 of 34
1 . SUBSTATION X RISK ASSESSMENT
Review of Risk Mitigation Assessment for Substation X
Measure I Risk Mitigation Category RCMU's Assessment Third Party Reviewer'
Evaluation
The existing system resiliency RCMU has one(1) substation that was assessed.The City owned
and/or redundancy solutions substation is interconnected to SCE's sub-transmission grid. It is
(e.g., switching the load to the single point of connection for RCMU's electrical distribution
another substation or circuit system fed from the substation.
capable of serving the load, RCMU has determined that this substation is NOT identified as a
temporary circuit ties, mobile "Covered Distribution Facility"within its service territory Third Partv Reviewer
generation and/or storage because it did not meet any of the 7 screening factors Evaluation:
solutions). identified in the report below.This determination in combination RCMU correctly
with the required narrative elements described above should determined the
constitute the RCMU's Utility Security Plan Assessment without aforementioned
the need for the creation of a Mitigation Plan. from their own
RCMU has taken the position that it considers it a best practice assessment.
to make any security improvements found by the independent
evaluation process to be invaluable to the overall operations of
the utility. RCMU will take these recommendations under
advisement and plan accordingly.
The availability of spare RCMU has contracted with Siemens Industry, Inc.to provide
assets to restore a particular Substation X maintenance,spare parts have been identified
load. and are to be located on site as well as other items deemed Third Partv Reviewer
necessary by RCMU. By using Siemens' additional outside Evaluation:
contacts and resources to search and source the larger more RCMU correctly
2 significant components as well as additional 'stand-by' determined the
resources.
aforementioned
from their own
assessment.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 26 of 34
Review of Risk Mitigation Assessment for Substation X
Measure Risk Mitigation Category I s Assessment Third Party Reviewer
' RCMU' A Evaluation
I I
I
The existing physical security RCMU security protections include fencing, locks, key card Third Partv Reviewer
protections to reasonably access, alarm, cameras, security gate w/ key card access. Evaluation:
address the risk. Signage regarding no access, dangers are posted. RCMU correctly
determined the
aforementioned
3 from their own
assessment. See
mitigation article IV
for the additional
recommendations.
The potential for emergency The facility was evaluated based on the likelihood that a law
responders to identify and enforcement officer would generally be able to arrive at the
respond to an attack in a Covered Distribution Facility within 15 minutes of a report from
timely manner. the public of a break-in or attack, or of RCMU notifying the law
enforcement agency of triggering of an alarm at the facility.
Additional Clarification: Each There are several city departments involved as well from Public
facility is evaluated based Works - Facilities,to Fire and Police. Third Party Reviewer
on the likelihood that a law Evaluation:
enforcement officer would RCMU correctly
4 generally be able to arrive at determined the
the Covered Distribution aforementioned
Facility within 15 minutes of a from their own
report from the public of a assessment.
break-in or attack, or of
RCMU notifying the law -
enforcement agency of
triggering of an alarm at the
facility.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 27 of 34
Review of Risk Mitigation Assessment for Substation X
Measure Risk Mitigation Category RCMU's Assessment Third Party Reviewer
Evaluation
Location and physical
surroundings, including RCMU has evaluated this element based on the proximity of the
proximity to gas pipelines Covered Distribution Facility to populated areas and the extent
and geographical to which the interior of the facility is shielded from view and
challenges, and impacts of access due to walls,vegetation, or other physical obstructions
weather. and finds no additional shielding needed. Third Partv Reviewer
Additional Clarification: Evaluation:
RCMU evaluated this RCMU correctly
5 element based on the determined the
proximity of the Covered aforementioned
Distribution Facility to from their own
populated areas and the assessment.
extent to which the interior of
the facility is shielded from
view and access due to
walls, vegetation, or other
Physical obstructions.
History of criminal activity at
the Distribution Facility and in
the area.
Additional Clarification: None applicable to this facility. This facility is not at a higher
RCMU evaluated the Third Partv Reviewer
property crime rates in the
risk than other areas. Evaluation:
immediate vicinity of the RCMU correctly
6 Covered Distribution Facility determined the
and compared those crimes aforementioned
rates to property crime rates from their own
for the county and the state assessment.
to determine if the area is
subject to a higher than
average incidence of
property related crimes.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 28 of 34
Review of Risk Mitigation Assessment for Substation X
I Third Party Reviewer
Measure Risk Mitigation Category I RCMU's Assessment Evaluation
The availability of other RCMU does not have the availability of other sources of energy Third Partv Reviewer
sources of energy to serve to serve the load. Evaluation:
the load (e.g., customer RCMU correctly
7 owned back-up generation determined the
or storage solutions). aforementioned
from their own
assessment.
The availability of alternative Third Partv Reviewer
ways to meet the health, RCMU does not have the ability to provide for the availability of Evaluation:
safety, or security. alternative ways to meet the health,safety, or security. RCMU correctly
determined the
8
aforementioned
from their own
assessment.
Requirements served by the Third Partv Reviewer
load (e.g., back up RCMU does have a circuit by circuit analysis which identifies Evaluation:
command center or water essential facilities within its service area.The analysis does RCMU correctly
9 storage facility). identify some facilities that have backup power, but not all. determined the
aforementioned
from their own
assessment.
Risk Assessment Conclusion for Substation K.
Statements noted by the City of Rancho Cucamonga describing the Utility's infrastructure and functions of the POU have not been
confirmed (substantiated), by the SBCSD/RCPD. The objective of this report is to identify threat risks, Crime Prevention Through
Environmental Design (CPTED) compliance and determine if the existing measures, as identified by the City of Rancho Cucamonga,
as they pertain to identified risks are sufficient and SBCSD/RCPD agree that no Mitigation Plan is warranted.
C. VOLUNTARY DISTRIBUTION FACILITY MITIGATION PLANS (STEP 1 C)
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 29 of 34
RCMU's Utility Security Plan identified no Distribution Facilities for which the existing mitigation measures did not adequately address
the identified risks. Therefore, no individual substation mitigation plans were prepared. As described above, SBCSD/RCPD agrees with
RCMU's Security Plan Assessment and that no Mitigation Plan is warranted. SBCSD/RCPD also agrees with RCMU's position that it
considers it a best practice to make any security improvements found by the independent evaluation process to be invaluable to the
overall operations of the utility. And that RCMU will take these recommendations under advisement and plan accordingly. Please
refer to the Voluntary Security Recommendations in Article IV.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 30 of 34
VEMENTS
OTHER • • FOR •
Voluntary Security Recommendations Conclusions for Substation X:
This security site assessment report may also be used by appropriate City/County decision
makers to consider and implement security enhancements that may potentially mitigate
vulnerabilities related to identified hazards and/or adversarial actions.
Potential Mitigation Vulnerability Measures:
Exterior Security:
• Security/Notification Signage:There are signs warning of High Voltage, but no security or
notification signage is present along the perimeter fence line to inform individuals of
expected behavior and prohibited activities on property. Also, there is no signage for
prohibited items allowed on the property or within the building. ["No Trespassing",
"Authorized Personnel Only"]. Other signage should be considered that provides
information to individuals what prohibited items are not allowed to be brought on to the
property or into the facility. "Violators will be charged with criminal trespass".
Video Surveillance-Video Surveillance System (VSS) implemented within Substation X,
will provide minimal to satisfactory coverage. Video coverage does not include the
exterior of the building and yard coverage should be expanded.
Plans to upgrade and replace the existing (4) cameras to current software and
technology are underway. Fiber optic networking will replace existing analog,
preventing disruption of radio signals
Plans to install an additional minimum of(4) new video cameras to provide detailed
images of vehicles, individuals, and activities along the North, South and East perimeter,
and expand yard coverage, have also been put in motion.
• Local and remote video monitoring-This facility is unmanned; therefore, the City's Public
Works-Facilities Department manages the VSS and has 24/7 access to view all activity as
it relates to this property. They have the ability to share this VSS with RCMU staff and the
Police Department at any moment, and have access at their workstation and at the
control center(the City's IT Department) with means to share VSS information with
Federal, State or Local Law Enforcement Officer(LEO) agencies upon request and
during a crisis event.
• No signage to indicate Video surveillance and recording was present, externally at
entrances prior to where individuals may enter the fence line, into the building, nor within
the building itself for areas where video of activities was being recorded.
• Consider adding Signage providing notification to all citizens (employee or visitor) is
required for areas under video surveillance, externally or internally of a building. Post at
each entrance and/or public area where video cameras are present.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 31 of 34
• Landscape Maintenance-Bushes and vegetation along the Southern and western
fence line are filling in and growing tall. Tree limbs are growing to a length and size that
they may be used as a breaching aid over the fence and onto the substation. Grooming
bushes and vegetation on Southern and Western fence line should be considered to
allow natural surveillance to those individuals walking near the bushes. Landscaping
procedures should be adopted for vegetation height to ensure no individual can use
vegetation as a place to lurk, hide, attack, or use that vegetation as a breaching aid
onto the property. Recommended height of bushes and vegetation is no taller than 18
inches in most circumstances.
• Consider adding Concrete bollards in front of the entrance/exit gate to prevent
automotive vehicles from colliding or crashing into the substation, pedestrians and or
structures, whether intentional from ram-raids and vehicle ramming attacks or
unintentional losses of control.
• Consider adding Barbed wire, steel fencing wire constructed with sharp edges or points
arranged at intervals along the strands, used atop of the walls surrounding the secured
portion of the property.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 32 of 34
RANCHO CUCAMONGA FIRE DISTRICT
L�.
MEMORANDUM
Date: July 7, 2021
To: Mayor and Members of the City Council
John R. Gillison, City Manager
Jason Welday, Director of Engineering Services
Fred Lyn, Deputy Director of Engineering / Utilities
From: Rancho Cucamonga Fire Protection District
By: Ivan Rojer, Fire Chief
Rob Ball, Fire Marshal
Joseph Ramos, Emergency Management Coordinator
Subject: Review of Rancho Cucamonga Municipal Utility Security Plan.
California Public Utilities Commission (CPUC) Decision (D.) 19-01-018 directs all electric utilities
to develop a Utility Security Plan assessing the physical security risks to certain significant,
distribution-level substations that are operated by the utility and identifying mitigating measures
for those risks. These Utility Security Plans must be evaluated by a qualified third party, and any
recommendations of that third party must be addressed in the Utility Security Plan. As an
additional level of review, the Utility Security Plan of any publicly owned utility (POU) must be
submitted to a"qualified authority,"which must make a recommendation on the overall adequacy
of the plan. After the review by the qualified authority, the finalized plan of a POU is submitted to
its governing board for adoption.
Rancho Cucamonga Municipal Utility (RCMU) has determined that Rancho Cucamonga Fire
Protection District (RCFPD) has sufficient familiarity with relevant federal, state, and local
standards relating to critical asset protection and emergency response in order to serve as the
"qualified authority" for the review of RCMU's Utility Security Plan. RCFPD has relevant
experience in its role of providing all-hazard emergency preparedness, mitigation, response, and
recovery efforts for the District's service area including residents, businesses and visitors.
On May 24, 2021, RCMU submitted its draft Utility Security Plan to RCFPD for review. The scope
of RCFPD's review is to assess the overall adequacy of the plan, based on the reviewer's
ADDENDUM
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 33 of 34
expertise. In this review, RCFPD makes no claims regarding the compliance of RCMU's Utility
Security Plan with any specific requirement or standard. Further, RCFPD has not assessed, and
makes no claim regarding, RCMU's Utility Security Plan's conformance to D.19-01-018 or any
other CPUC standards. RCMU has also indicated in this Security Plan that they are exempt,
however have chosen, as a best practice, to participate in the process. Finally, RCFPD's review
is limited to the information contained within RCMU's Utility Security Plan, and RCFPD has not
performed any additional audits of any identified facilities or reviewed any documents outside of
the information directly included within the Utility Security Plan.
Also, on May 24, 2021, RCFPD participated in a walk-through of RCMU's Electrical Substation
hosted by1RCMU which provided RCFPD with an opportunity to see first-hand security measures
in place and share suggestions with staff. RCFPD provided RCMU with suggestions to consider
in making additional safety and security improvements at the Substation which RCMU has
included within the Utility Security Plan.
Based on this review, RCFPD deems the RCMU's Utility Security Plan adequate and
recommends that the Rancho Cucamonga City Council adopt the Rancho Cucamonga Municipal
Utility Security Plan.
Rancho Cucamonga Municipal Utility Security Plan
June 16, 2021
Page 34 of 34