True North Consulting Group LLC 8/26/2024

sales@tncg.com CONSULTING MADE PERSONAL PAGE 29 OF 57 Phase II – Security Systems Analysis and Physical On-Site Threat and Vulnerability Assessment We assess security risk based on threat, consequences of loss/negative impact to most critical assets, and identified vulnerability in all three domains of security (technology, physical measures/design/layout, and human factor/operations/protocol/training and procedures). Our recommendations are prioritized by their ability to reduce the most critical risk across the entire organization. We have developed our proprietary, multi- phased methodology for information gathering, risk analysis, and reporting to provide clients with the best possible end product. TASK 1 - Determine the level of implementation of recommendations for each item within the project scope and develop a gap analysis between recommendations and implementation of mitigation efforts. Identify equipment and operational changes to increase efficiency and provide necessary improvements. Make preliminary recommendations based on findings, risk, and best practices for all areas of the City of Everett. Asset Analysis •Occurs prior to and during on- site assessment. •Identification of organizational assets. •Rating of assets based on potential consequence of loss. Threat Assessment •Occurs prior to and during on- site assessment. •Definition of target profile. •Identification of relevant PTE motivations. •Review of security incidents targeting similar sites. •Identification and rating of relevant PMAs based on probability and consequence. Vulnerability Assessment •Occurs prior to, during, and after on-site assessment. •Review of physical and technological security measures, security staffing, and security protocols. •Analysis of current levels of protection for high-value assets against relevant PMAs. Risk Assessment •Occurs after on-site assessment. •Analysis of probability and consequence for relevant PMAs based on current security program. Recommendations •Occurs after on-site assessment. •Recommended actions addressing physical, technological, and human security measures. •Designed to reduce or eliminate the probability and consequence of relevant PMAs.