5-Final Draft Exhibit M - Security and Emergency Events.pdf

Page 1 of 5 Exhibit M - Final Draft RFP 2025

EXHIBIT M

STANDARD OPERATING PROCEDURES FOR SECURITY INCIDENTS; CYBER

SECURITY

A. Purpose

To outline procedures for reporting any injuries, illnesses, security breaches, cyber-attack or damage occurring on District-owned property and physical Assets, to ensure immediate notification to District staff and proper insurance carriers where appropriate; to facilitate an investigation, communication of incident; and to review and reinforce preventative measures.

This includes any time the police, fire, or other public emergency services are admitted to the Water Reclamation Facilities.

B. Step-by-Step Procedures for Security Incidents

1. Intruder/Trespasser Security Incident. Upon notification of an Intruder/Trespasser at

Jones Island or South Shore WRF, the following steps must be taken:

a. Company staff must notify its Security personnel and Milwaukee Police

Department (for Jones Island) or Oak Creek Police Department (for South Shore).

b. Company staff should not confront/engage with the intruder/trespasser but observe their activities from a safe distance, if possible, until security staff arrive on the scene.

c. Once on site, security personnel should assume the investigation and control of the situation until the applicable police department arrives.

d. Company staff must inform MMSD’s Risk Manager of the incident via telephone.

e. Company staff must also notify the following via email regarding the incident:

MMSD Risk Manager, Safety Advisor and Operations Officer.

f. Company staff must provide MMSD’s Risk Manager an intruder/trespasser incident report, including CCTV footage, if available, within 12 hours of the incident. The intruder/trespasser incident report should, at a minimum, include the following:

1. Identification of the intruder/trespasser

2. Time and location of site access.

3. Duration of time intruder/trespasser was on site.

4. Reason(s) for trespassing.

5. Trespassing citation should be issued.

g. Company staff must provide a post incident investigation report with 72-hours of the incident. The report should include a root cause analysis and procedure that will be implemented to prevent future incidents of a similar nature.

2. Other Security Incidents. Upon notification of all other triggering security incidents, the following steps must be taken:

a. Call relevant emergency services (police for security threat, EMS for injury, fire department for fire, etc.).

Page 2 of 5 Exhibit M - Final Draft RFP 2025

b. Company staff must immediately notify MMSD’s staff via telephone in the order below:

1. Risk Manager

2. Safety Advisor

3. Operations Officer

c. Company staff must also notify those staff via email regarding the incident.

d. Company staff must provide MMSD’s Risk Manager a detailed incident report, including CCTV footage, if available, within 12 hours of the incident.

e. Company staff must provide a detailed post incident investigation report within

48 hours of the incident. The report should include a root cause analysis and procedures that are to be implemented to prevent future incidents of similar nature.

C. Safety and Security Responsibilities

As part of the Staffing Plan, the Company is required to have two Safety and Security Positions.

These positions have the following minimum responsibilities:

i. Team Supervision and Coordination:

a. Oversee and manage the security team and patrols and ensuring that all personnel are properly trained and equipped.

b. Continuously view and monitor all CCTV cameras on the premises (Jones Island, South Shore, Thirteenth Street – Vehicle Garage) to detect any security breaches or security incidents, in addition to the security patrols monitoring the CCTV cameras.

c. Assign duties and schedules to security staff, ensuring adequate coverage at all times.

d. Conduct regular team meetings to review performance, discuss security protocols, and address any concerns.

ii. Training and Development:

a. Provide ongoing training and development for security personnel to enhance their skills and knowledge.

iii. Security Assessments and Planning:

a. Conduct regular security assessments and risk analyses to identify potential vulnerabilities and threats.

iv. Communication and Reporting:

a. Serve as the primary point of contact for all security-related matters, ensuring clear and consistent communication with management and stakeholders.

v. Managing contractor and employee badge access

vi. Managing physical key inventory and key access policies.

Page 3 of 5 Exhibit M - Final Draft RFP 2025

D. Access Control and Enrollment System Responsibilities

i. District Provided Equipment. The District shall furnish the Company with all necessary hardware to support access control and badge enrollment functions for Company employees, District employees, contractors, and visitors. The District will hold the maintenance contract for the access control and badge enrollment system.

ii. Company Responsibilities

a. Badge and Access Management: The Company is responsible for controlling access to the Water Reclamation Facilities and managing all visitor access enrollment stations at Jones Island and South Shore, including the biometric enrollment stations, card enrollment stations, and printers.

b. Access Control System Oversight and Equipment Use: The Contractor shall be responsible for the day-to-day management and use of the access control equipment (including door strikes and badge readers) provided by the District.

The Company shall report any equipment malfunctions or suspected tampering to the District immediately.

c. Maintenance Scheduling: The Company is responsible for determining if access control and badge enrollment system maintenance is needed and scheduling service with the District’s contractor. If the District’s maintenance contract does not cover the services needed, the Company shall inform the District, which will determine whether to issue a change order or authorize the Company to make alternative arrangements for service pursuant to Exhibit G.

E. Security Camera System Maintenance

i. District Provided Equipment. The District shall furnish all necessary hardware and appropriate access to its CCTV security camera system for the Company. The District will hold the maintenance contract for the CCTV security camera system.

ii. The Company is responsible for the ongoing visual inspection and basic maintenance monitoring of all security camera systems under its purview. The scope of these responsibilities includes, but is not limited to, the following:

a. Visual Inspections: The Company shall conduct regular visual inspections of all security cameras and related equipment to ensure they are in proper working condition.

b. CCTV Feed Monitoring: The Company shall monitor the CCTV video feeds to ensure all systems are functioning correctly.

c. Maintenance Scheduling: The Company is responsible for determining if camera maintenance is needed and scheduling service with the District’s contractor within 48 hours of discovery. If repair in that timeframe is infeasible, the Company will provide the District a written explanation and anticipated repair date. If the District’s maintenance contract does not cover the services needed, the Company shall inform the District, which will determine whether to issue a change order or

Page 4 of 5 Exhibit M - Final Draft RFP 2025 authorize the Company to make alternative arrangements for service pursuant to Exhibit G.

F. Cyber Security Requirements

The Company is responsible for the security of its information technology systems, including hardware, networks, software, and employee behavior. At a minimum, the Company’s cybersecurity shall meet current cyber security best practices and protocols for the systems they are responsible for as defined in Article 3.07 of the Service Agreement, including the following:

ii. The Company must maintain a documented Cyber Incident Response Plan (IRP) to address and mitigate the impact of cybersecurity incidents on its business network that is located at District Facilities and any network that may put the District at risk. The IRP should designate who is responsible for managing communications with the District, who is responsible for managing the ‘incident’ to resolution, and a summary of the Company’s approach to restoring the compromised system(s). An initial IRP shall be submitted by the Operational Start Date and shall be reviewed annually with the District’s cybersecurity specialist by May 31 of each Contract Year. The Company shall ensure that all systems, applications, and devices it is responsible for are regularly updated with the latest security patches to address known vulnerabilities. All applications and systems should be within two major releases of the manufacturer’s most recently published version. Exclusions are permitted when agreed to in writing by both the Company and the District. The Company will provide an annual report of the installed version number for the software listed in Exhibit Q to MMSD.

iii. All patches or firmware updates downloaded from the internet must be validated as authentic using approved either by verifying digital signatures or checking hash values.

iv. The Company must deploy and maintain up-to-date antivirus and anti-malware solutions across all systems it is responsible for to detect and prevent malicious software.

v. The Company is prohibited from creating/establishing a data application programming interface (API) that links a database beyond the systems it is responsible for managing as part of the daily operations of the WRFs.

vi. The Company is prohibited from exporting data from process network systems without consent from the District.

vii. Only the District’s and the Company’s business networks, the Falcon camera, and certain Solar Turbine monitoring devices will have protected access to the internet.

viii. The Company shall implement measures to protect against phishing attacks, including email filtering, user awareness training, and simulated phishing exercises.

Page 5 of 5 Exhibit M - Final Draft RFP 2025

ix. ‘Shared’ or ‘common’ accounts are prohibited. Company staff are not allowed to share accounts to access systems. Service accounts are permitted to manage automated back-end processes and batch jobs.

x. The Company must establish and enforce cybersecurity policies and provide regular training to employees to ensure awareness of security best practices and protocols.

xi. The Company shall implement monitoring tools and alert systems to detect and respond to potential security threats in real-time.

xii. The Company must secure remote access to its systems using encrypted connections, such as VPNs, and enforce strong authentication mechanisms.

xiii. The Company shall enforce strong password policies and require the use of Multi-Factor Authentication (MFA) for accessing critical systems and data.

xiv. The Company shall participate in annual cyber security training for CIP (Critical Infrastructure Protection), demonstrate routine PEN (Penetration) testing of their business network and participate in the District’s PEN testing of the protected networks and systems listed in Exhibit B, Section 7.

xv. The District has a system to monitor cyber security risks by reviewing patch levels and vulnerability scores (CVE) of the servers operating systems, workstation operating systems, and network equipment at the Facilities. The Company and the District will collaborate to develop a corresponding risk score for the SCADA, fire alarms, uninterruptible power supply and the HVAC control systems.

xvi. The Company must adhere to a recognized cybersecurity framework, such as:

National Institute of Standards and Technology (NIST) Cybersecurity and Infrastructure Security Agency (CISA) Other industry-standard frameworks as approved by the District.

xvii. All cyber security documentation will be stored in a common repository per Section 3.07(g) of the Service Agreement.

Upon notice from the District of a deficiency with any of the above practices, Company shall remedy the deficiency within 30 days.