Washington Military Department 6/3/2024 (2)

DHS-FEMA-SLCGP-FY22 Page 34 of 36 City of Everett, E24-156 Attachment D WORK PLAN FY 2022 State and Local Cybersecurity Grant Program PROJECT #1 TITLE Cyber Supply Chain Risk Assessment PROJECT DESCRIPTION This project will assess our current environments in order to create a plan for improving security of our public infrastructure systems--namely water utility and waste water treatment facility, which is a combined waste water and storm water system in some parts of the city. This will involve using a vendor's services to assess the OT/ICS Network of our Water Filtration Plant (WFP) and our Water Pollution Control Facility (WPCP) to obtain a Risk and Vulnerability report. GAP BEING ADDRESSED This project will close the following gap: the City of Everett IT department currently monitors and tracks CVEs against City's IT and OT devices and will allow us to more closely follow currently unknown supply chain risks by addressing NCSR category ID.SC-2. As we continue to upgrade and fortify our environment, supply chain risk assessment through a third party will give us greater insight into unknown risks of future equipment. IMPACT In working across departments such as Public Utilities as well as Emergency Services, insight into our supply chain risks will ensure we purchase equipment, software and services that are most likely to continue to provide firmware, software upgrades and security updates. Suppliers will be vetted and assessed as to their business processes and environment. This willl allow us to avoid purchasing assets with known vulnerabilities and ensure our stakeholders that we manage and reduce risk in our IT environments. OUTCOME The outcome of securing a Supply Chain Risk Assessment Vendor is to be agile in selection of appropriate assets and suppliers, with a clear view of risks we accept when purchasing assets.