True North Consulting Group LLC 8/26/2024

Page 11 of 26 2.5 RISK ASSESSMENTS At a minimum, Everett Transit expects that the consultant will conduct multiple risk assessments for the five areas listed in2.4, project scope that will include the following sections. 1. Identification of: a. Critical assets b. Threats c. Vulnerabilities d. Likelihood of an attack or incident e. Consequences and impacts of an attack or incident. f. Identifying potential mitigation measures/countermeasures 2. Assigning the initial risk index to determine the basis for risk decision criteria. 3. Determining residual risk acceptability 2.6 DELIVERABLES The expectation is that the comprehensive Threat and Vulnerability Assessment (TVA) will include at a minimum the following information: 1. Comprehensive Threat and Vulnerability Assessment for Everett Transit’s system and assets and master plan for prioritized implementation of findings from the assessment. a. Comprehensive security report that addresses each site’s specific threat vulnerabilities and countermeasure recommendations. b. Policy recommendations. 2. Detailed estimate of costs to implement the findings. 2.7 MEETINGS The Supplier will conduct a variety of meetings that fall into the following categories: 1. Meetings with internal and external stakeholders to gather input. 2. Monthly status updates with the project manager 2.8 SUPPLIER RESPONSIBILITIES The supplier will report to the Project Manager. The Supplier will provide internal communications and messages in the form of oral and written memos to the Project Manager as needed. 2.9 CITY OF EVERETT RESPONSIBILITIES City staff will be responsible for the following: • Providing a primary contact for the Supplier. • Provide background and requirements. • Provide existing available data and reports to support analysis. • Provide existing background data. • Coordinate review of consultant deliverables. RFP