URS Washington Group International, Inc. Infrastructure as a Key Element in Sustaining Economic Growth Critical Infrastructure Protection September 9, 2019

Infrastructure Investment Infrastructure Investment in the United States will exceed US$1 Trillion over the next few years Combined Capital Programs from the main agencies in the New York Metropolitan Region exceed US$50 Billion over the same period Some notable new projects under development for added capacity to Manhattan’s Central Business district include: East Side Access Trans-Hudson Tunnel 2nd Avenue Subway

Critical Infrastructure Energy Resources Agricultural Resources Water Resources Transportation Infrastructure Information Systems Telecommunication Systems Banking and Finance

Risk Analysis

THREAT AND VULNERABILITY ASSESSMENTS

Security Improvements in Unified Methodology - Process Define Asset Review Documentation Site Survey Component #1 Threat Assessment Workshop Develop Comprehensive Threat Assessment Matrix for Workshop Conduct Workshop 1. Brainstorming 2. Threat Development 3. Preliminary Risk Analysis Using Unified Methodology Guidelines Capture all risk items from spreadsheet in database for further development Automatically analyze and prioritizes risks showing results on a graphical interface SecureRisk keeps a comprehensive record of the disposition of risks identified by expert workshop teams Component # 2 SecureRisk Database Risk Documentation Capture All Risk Items From Spreadsheet Analyze and Prioritize Risks Collapse to Global Risks Retire Low Risks or Combined With Others YES NO WATCH SecureRisk tracks all interdependent threats and vulnerabilities/risks allowing for adjustment as other tasks as well as local, regional and national priorities and mitigation developed and/or changed Security Improvements in Component # 3 Develop Schematic SecureRisk Database Brainstorm Security Improvements Coordinate and Shift Appropriate Security Improvements To : 1. Other Tasks (e.g. Surveillance, C3, Hardening etc.) 2. Other Jurisdictions (e.g. Coast Guard, TSA, etc.) Retire Risks When Shifted YES NO WATCH Component # 4 Reduced Risk/Cost Benefit of Security Improvements Develop Schematic Security Improvements Estimate Security Improvements Provide Relative Risk Reduction Compared to Costs of all for the Asset Security Improvements Based on: 1. First Cost 2. Operation & Maintenance Cost 3. Life Cycle Cost Implement Next Phase YES NO SecureRisk cost benefit approach allows trade offs between first cost and operational (CONOPS) strategies SecureRisk tracks all security improvements from conception through design and implementation/construction SecureRisk tracks all interdependent threats and vulnerabilities/risks allowing for adjustment if security priorities and/or budget changes SecureRisk tracks automates the production of reports and risk reduction cost curves Benefits / Analytic Approach Use SAVE international job plan as the best method for multidiscipline workshop team interaction Allows synergistic interaction between cross - disciplinary experts such as: 1. Security/Law Enforce. 2. E/A Trans. Infrastructure 3. Blast Modeler 4. Systems Integrator 5. Operations 6. Emergency Response Analyzes all interdependent threats and vulnerabilities to ensure none fall between the cracks Arrays relative risks on a single spread sheet for complete transparency

Quantitative Evaluation

Quantitative Evaluation Sample Reports

Priority Ranking

ASSET HARDENING

Asset Hardening

WIDE-AREA EARLY WARNING SYSTEMS

Early Warning Systems

Critical Infrastructure Assets

WORLD TRADE CENTER

Lower Manhattan

World Trade Center World Trade Center, New York

LEGISLATION IN THE UNITED STATES THE SAFETY ACT

U.S. Dept. of Homeland Security SAFETY Act The SAFETY Act is the Support Anti-terrorism by Fostering Effective Technologies Act of 2002 (updated in July 2006). It is legislation passed by the United States Congress that makes a promise to providers of QATTs that they will be protected from American plaintiffs' lawyers, who could otherwise introduce liability suits The SAFETY Act applies to a broad range of technologies, including products, services, and software, or combinations thereof, as long as the Secretary, as an exercise of discretion and judgment, determines that a technology merits Designation

URS Washington Group International, Inc. Infrastructure as a Key Element in Sustaining Economic Growth Critical Infrastructure Protection September 9, 2019