Cybersecurity Special Public Meeting/Commission Workshop for Natural Gas Utilities September 27, 2018

Planning - Governance CIO / CSO Board of Directors Enterprise Security Committee Director of Infrastructure and Security Guest Speakers Regular Reporting Conferences Sr. Security Manager An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties. Security Workgroups

Planning - Governance Enterprise Security Committee Members Dir. of Transmission Ops Dir. of IT and Security Dir. of Generation & Production Mgr. of Reliability Compliance Dir. of Corporate Communications Dir. of Electrical Engineering Sr. Legal Counsel Dir. Human Resources Dir. Environmental Affairs Dir. of Planning & Asset Management Dir of Natural Gas Enterprise Security Committee Work Groups An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

Planning- Security Staff Sr. Security Manager Physical Security Engineer Business Continuity / Emergency Management Security Architect Security Engineer Security Engineer - SCADA Security Engineer - Compliance Security Team Lead Access Administration Security Analyst An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

Planning – Policy Introduction and Scope 400 Configuration Management Policy Introduction 400 Policy Objective Scope 400 Policy Statements Exceptions to the Cyber Security Policy 400.1 Change Management Security Risk Management 400.2 Patch Management 500 System Acquisition, Development & Maintenance Policy Security Awareness 500 Policy Objective Incident Response Management 500 Policy Statements Information Management 500.1 System Assessments 100 - Physical Security Policy 500.2 System Acquisition 100 - Policy Objective 500.3 System Development 500.4 System Maintenance 100 - Policy Statements 600 - System and Information Protection Policy 100.1 Physical Security 600 - Policy Objective 200 - Exception Request Policy 600 - Policy Statements 200 - Policy Objective 600.1 Anti-Virus software 200 - Policy Statements 600.2 Network Protection 600.3 Encryption 200.1 Exception Request Policy 600.4 File Integrity Monitoring (FIM) 300 - Access Control Policy 600.5 Authorized and Unauthorized Devices 300 - Policy Objective 600.6 Secure Configurations for Avista Systems 300 - Policy Statements 600.7 Wireless Device Control 600.8 Secure Communications 300.1 Access Control 600.9 Audit Logs 300.2 Separation of Duties 600.10 Audit Log Storage 300.3 Account Management 600.11 Time Synchronization 300.4 Password Management 600.12 Logon Banner 600.13 Media Protection 300.5 Account Time-outs An overview of your utility’s cybersecurity policy, strategy, or governing document, including how it incorporates both cyber and physical security components. An explanation of how your utility’s cybersecurity policy is audited.

Standards - Cyber Security Framework Describe how your utility prioritizes the implementation of new cybersecurity systems, components and functions. An overview of your utility’s cybersecurity framework.

Standards – Effectiveness An overview of your utility’s process to determine the effectiveness of the current cybersecurity policy and plan, including the frequency of the evaluation. An overview of what needs to happen for improvement actions to take place with regard to your utility’s cybersecurity policy and plan, including any hindrances and what can be done to overcome them). An explanation about the frequency in which your utility’s cybersecurity plan is updated. An explanation about the frequency in which your utility’s cybersecurity plan is tested.

Reporting Cybersecurity reporting An overview of how and when your utility reports cyberattacks, and the threshold for reporting cyberattacks.

Partnerships An overview of your utility’s cybersecurity partnerships (i.e. Emergency management/law enforcement, Department of Homeland Security, fellow utilities, Fusion centers, etc.). An explanation of how and when your utility interacts with the National Cyber Security Division of the U.S. Department of Homeland Security.

Procurement Vendor and device selection Background checks Employees Vendors An overview of your utility’s cybersecurity criteria used for vendor and device selection, and the guidance you follow to ensure that your procurement language is both specific and comprehensive enough to result in acquiring secure components and systems. An overview describing personnel surety/background checks performed on those with access to key cyber components, including vendors and other third parties that have access to key cyber systems screened. An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

Risk Management Risk prioritization Vulnerability assessments Internal External Risk impacts An overview of how your utility prioritizes risks, including the criteria used to prioritize risks, and how often the priority list is updated. An overview explaining who your utility is using to perform vulnerability assessments (i.e. internal personnel or external personnel, such as a third party). An overview of your utility’s process for looking at consequences of cyber incidents that informs your risk management process.

Response & Recovery: Response and recovery plans Responsibility Exercises Sharing & mutual defense Communication plan to address customer perceptions An overview of your utility’s cybersecurity response and recovery coordination plan, including but not limited to, who in your utility oversees response and recovery, any participation in sharing analysis, and mitigation measures with other companies as part of a mutual network of defense, and communication plan to address customer perceptions and expectations when their service has been impacted by a cyberattack event. 

Questions?