True North Consulting Group LLC 8/26/2024

Page 9 of 26 program, allocating resources efficiently, and maintaining continuity of operations in the event of an incident, event, or emergency. To this end, Everett Transit requests a comprehensive risk and threat vulnerability assessment that covers all critical assets associated with the delivery of its transportation services. This includes identifying an asset’s attractiveness as a target for crime, security incident, or terrorist attack, the vulnerability to a successful criminal or terror incident, and the consequences of a successful incident. Critical assets are defined as those assets required to provide services for the system. These include: • People: Employees, visitors, vendors, customers and surrounding businesses and our community. • Property: Including, but not limited to, transit centers, stations and stops, maintenance facilities and yards, administration facilities, operations and dispatch center, parking facilities, wayside facilities, fare vending machines, information technology, and communications and industrial control systems. • Rolling Stock: Rolling stock consists of revenue and support vehicles. These vehicles interface with nearly all components of our transit agency network, including stations and stops, terminals, and administrative, maintenance, and storage facilities. • Infrastructure: Infrastructure refers to all the stationary assets in Everett’s system, such as passenger stations, real estate, buildings, operations control center, dispatch, communications, and other components necessary to support transit operations. • Reputation: Security incidents can damage or impact reputation. Agencies that do not protect their reputation by managing their risks can face additional oversight by federal or state entities or scrutiny and criticism from the public. They may also have their funding opportunities impacted by the reduction of confidence. Security threats are defined as deliberate actions intended to cause injury or death to people or damage to or loss of critical assets. A threat is characterized as the combination of both intent and capability of a threat actor or threat source to realize a threat or attack against an asset. The threats or attack types to one transit agency may be the same as those faced by other similar transit agencies, but it is critical to understand the threats specific to each individual transit agency. Not all operational environments contain the same challenges or share the exact same vulnerabilities. 2.4 PROJECT SCOPE Work includes developing a comprehensive threat vulnerability assessment that details recommended implementation processes and procedures and estimated physical security upgrade costs for adopted improvements resulting from this study. The comprehensive assessment must address the security risks and requirements of each particular site listed in the agency profile including a comprehensive threat and vulnerability assessment conducted of Everett Transit’s system and assets. As part of the threat and vulnerability assessment, risk assessments must be included in the final comprehensive report. This includes threats connected to criminal activity, terrorism, and civil unrest. This scope of work involves identifying and prioritizing the threats, identifying preventative countermeasures, and identifying the likely costs of each countermeasure to be implemented. Areas to be evaluated for each property listed include, but may not be limited to: RFP