BPM004287-AZRamp- Authorization Confirmation -CDM Smith.pdf

5/26/23, 9:15 PM State of Arizona Mail - Re: AZRamp-Intro -CDM Smith https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 1/9

May Forbin <forbin.merrilyn@azdeq.gov>

Re: AZRamp-Intro -CDM Smith 1 message

Emily Gross <egross@azdohs.gov> Tue, Apr 18, 2023 at 4:52 PM To: "Gopalan, Raman" <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>, Thomas Considine <tconsidine@azdohs.gov>, "Dellinger, Anthony S." <dellingeras@cdmsmith.com>, "Belew, Jason J" <BELEWJJ@cdmsmith.com>

Hello everyone, I am happy to report that I have received the client letter from Google and CDM Smith has successfully completed the AZRAMP Moderate Impact review and is now AZRAMP Authorized to access, transmit, process, and/or store State of Arizona "Confidential" information.

AZRAMP Authorized: 4/18/2023 AZRAMP Expiration: 4/18/2026 AZRAMP Renewal Date: N/A NOTE: No Further AZRAMP Renewals.

For all State RFPs/Contacts released after November 1, 2022, all SaaS, IaaS, & PaaS Cloud Services Providers will be required to be StateRAMP Authorized within one (1) year of contract award. Please visit www.StateRAMP.org for more information on obtaining StateRAMP Authorization.

Arizona Department of Environmental Quality is responsible for ongoing vendor compliance with all statewide and agency IT Policies, Standards & Procedures (PSPs).

May Forbin or their designee will assume all vendor management responsibilities moving forward.

CDM Smith is expected to familiarize your staff working on this contract with the State of Arizona Information Technology PSP's. You can locate these IT PSPs HERE

Thank you for all your time and assistance in completing this process.

Emily Gross Sr. Information Security Analyst Security, Privacy, and Risk (SPR) Team | Cyber Command Arizona Department of Homeland Security | State of Arizona 1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398

On Wed, Mar 8, 2023 at 8:18 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

Thank you, Emily.

Raman 602.284.5624

Thumb typed. Please pardon typos.

From: Emily Gross <egross@azdohs.gov> Sent: Wednesday, March 8, 2023 8:13:18 AM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

<dellingeras@cdmsmith.com>; Belew, Jason J <BELEWJJ@cdmsmith.com> Subject: Re: AZRamp-Intro -CDM Smith

Good morning all, Just wanted to provide an update that I have received confirmation from Azure that CDM Smith has an account in good standing. The last thing we are waiting on is confirmation from the Google side.

Thanks, Emily Gross Sr. Information Security Analyst Security, Privacy, and Risk (SPR) Team | Cyber Command Arizona Department of Homeland Security | State of Arizona 1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398

On Tue, Mar 7, 2023 at 9:17 AM Emily Gross <egross@azdohs.gov> wrote:

Thanks for sending that over to them!

Emily Gross Sr. Information Security Analyst Security, Privacy, and Risk (SPR) Team | Cyber Command Arizona Department of Homeland Security | State of Arizona 1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398 http://www.stateramp.org/ https://azdohs.gov/information-security-policies-standards-and-procedures https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov http://azdohs.gov/ mailto:gopalanr@cdmsmith.com mailto:egross@azdohs.gov mailto:gopalanr@cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com mailto:BELEWJJ@cdmsmith.com https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http://azdohs.gov/__;!!OZ2Q16syoZo!6k6WiMif-KkMeb2v5bOit1MnYNaC-PmbcgS_e1us4mr6pWBawWpBFMqzqBX8wDsmTDZ3gDCSAQPi8IXh6o8$ mailto:egross@azdohs.gov https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http://azdohs.gov/__;!!OZ2Q16syoZo!6k6WiMif-KkMeb2v5bOit1MnYNaC-PmbcgS_e1us4mr6pWBawWpBFMqzqBX8wDsmTDZ3gDCSAQPi8IXh6o8$ https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 2/9

On Tue, Mar 7, 2023 at 9:15 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

Thanks for the acknowledgment, Emily. I emailed Jess @ Google that we are currently not a Google Cloud Partner.

Raman 602.284.5624

Thumb typed. Please pardon typos.

From: Emily Gross <egross@azdohs.gov> Sent: Tuesday, March 7, 2023 9:08:53 AM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

<dellingeras@cdmsmith.com>; Belew, Jason J <BELEWJJ@cdmsmith.com> Subject: Re: AZRamp-Intro -CDM Smith

Hi Raman, Thank you for sending this information and the signed form over - I received the other email as well. I also saw the completed template for sharing account information that you sent to Google. Google needs one more bit of information about your account: whether or not you are a Google Cloud Partner (I don't think it needs to be included in the letter, just the email body). Once they receive that they should start working on a client letter for us.

Thanks, Emily Gross Sr. Information Security Analyst Security, Privacy, and Risk (SPR) Team | Cyber Command Arizona Department of Homeland Security | State of Arizona 1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398

On Tue, Mar 7, 2023 at 8:41 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

Hello Emily.

Attached is the completed template FYI (I’ve also emailed it separately to grc@azdohs.gov as you requested).

See below in RED the information you requested for Azure.

1. Official Business Name and Address used to register the Azure account CDM Smith Inc 75 State Street, Suite 701 Boston, MA 02109-1940

2. Azure business account # or Azure Enterprise ID Microsoft Business Agreement No.: U2006916 Public Customer No.: 32338773

3. Whether you're certifying for Azure Government or Azure Commercial Azure Commercial

4. Name and contact information for your representative in the event Azure wants to validate the request or has questions Jason Belew Principal, Senior Manager, Business Technology Operations 865-382-3895 BelewJJ@cdmsmith.com

Thank you.

Raman Gopalan, P.E., PMP, BCEE Project Manager CDM Smith 11811 N Tatum Blvd, Suite 3030, Phoenix, AZ 85028 602-281-7900 office |602-281-7881 direct|602-284-5624 cell cdmsmith.com mailto:gopalanr@cdmsmith.com mailto:egross@azdohs.gov mailto:gopalanr@cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com mailto:BELEWJJ@cdmsmith.com https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http://azdohs.gov/__;!!OZ2Q16syoZo!9QqLmJ2WEarGqoMhJFSYFMaAFPe9ZRglIH4Xw8H4CQx9ja_TcJommvmN_3kA9cwVoJdqWMw0063hAucxGpE$ mailto:gopalanr@cdmsmith.com mailto:grc@azdohs.gov https://www.google.com/maps/search/75+State+Street,+Suite+701+%0D%0ABoston,+MA+02109-1940?entry=gmail&source=g mailto:BelewJJ@cdmsmith.com https://www.google.com/maps/search/11811+N+Tatum+Blvd,+Suite+3030,+Phoenix,+AZ+85028?entry=gmail&source=g http://www.cdmsmith.com/ https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 3/9

From: Emily Gross <egross@azdohs.gov> Sent: Friday, March 3, 2023 12:38 PM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

<dellingeras@cdmsmith.com> Subject: Re: AZRamp-Intro -CDM Smith

Good afternoon everyone, I've attached the supplemental letter template for Azure and GCP to this email. Please see the guidance below:

Please follow these steps to complete the AZRAMP process:

1. Copy & Paste the attached letter on company letterhead

2. Update all fields in RED

3. Sign and return to grc@azdohs.gov

We also need account information for both your Azure and GCP accounts to confirm with them that you are in good standing. Here is the information we need:

Azure

1. Official Business Name and Address used to register the Azure account

2. Azure business account # or Azure Enterprise ID

3. Whether you're certifying for Azure Government or Azure Commercial

4. Name and contact information for your representative in the event Azure wants to validate the request or has questions

GCP

I'll be sending out another email to you and our contacts at Google to confirm that you have an account with them in good standing and that you've agreed to their Terms and Conditions. There will be a template in the email that you need to fill out and send to the email chain that will give permission to Google to provide AZDOHS with the previously mentioned information about your account.

Please let me know if you have any questions.

Thanks, Emily Gross

Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398 https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.cdmsmith.com*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124650643*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=ELM9LTZmtrMNxjgbTyX5JqW8M1SY4x0Zh6NTPbIfKzI*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSU!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRZuv-Nrm$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.facebook.com*2FCDMSmith*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124660596*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=h8lBKbMaBry7B9gUHmp6svJ*2F5LrP3flXI67HKbGzjIs*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJQ!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRQgl4_f7$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Ftwitter.com*2FCDMSmith&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124660596*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=*2Fq4PbAqAZ04aOV9PCGy1FtSDtOlc4b7kkQ71MB9G1B0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRT8ISPmr$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.instagram.com*2Fcdmsmith*2F*3Fhl*3Den&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124670556*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=1FGOtwz6DGSr9gmPFm2jpBKVqubbz4NuJpXZg2zLUpM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSU!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRcFUj3CS$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.linkedin.com*2Fcompany*2Fcdmsmith*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124670556*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=v01yUuXvmBobdkVEVAvvlMFuQMeH*2BV*2B4vEgq9RBdBWs*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRReMumGa$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.youtube.com*2Fuser*2FCDMSmith&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124680509*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=RYE0DiokQuwxQ*2BchegSCQks*2BBtlk4T3wh79Gs*2FpKS0w*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRfjyoPPo$ mailto:egross@azdohs.gov mailto:gopalanr@cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com mailto:grc@azdohs.gov https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!5kWyo0VbtJhRX8Pk9tNGaaMY5gfs2BEc0pZpuHCbxu_yN6HkSqHHz-znvD7mZFH8SEeAWusCHQfkA3swEe4$ https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 4/9

On Tue, Feb 14, 2023 at 11:21 AM Emily Gross <egross@azdohs.gov> wrote:

Hi Raman, I've received the Teams invite. I look forward to speaking with you tomorrow.

Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007 egross@azdohs.gov | azdohs.gov c: 602-732-1398

On Tue, Feb 14, 2023 at 7:06 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

Hi Emily.

I’ve sent out a Teams invite for 4-5 pm tomorrow (Wednesday).

Raman.

Sent: Monday, February 13, 2023 4:10 PM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

I think a meeting would be very beneficial. Tom Considine and I are available this week at the following times:

Wednesday 2/15

4:00PM - 5:00PM MST

Thursday 2/16

10:30AM - 11:30AM MST

Friday 2/17

12:30PM - 2:00PM MST

https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!5kWyo0VbtJhRX8Pk9tNGaaMY5gfs2BEc0pZpuHCbxu_yN6HkSqHHz-znvD7mZFH8SEeAWusCHQfkA3swEe4$ mailto:gopalanr@cdmsmith.com mailto:egross@azdohs.gov mailto:gopalanr@cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 5/9

Thank you, Emily Gross

Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007

On Mon, Feb 13, 2023 at 3:53 PM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

We have ProjectWise, Bluebeam, Autodesk and MOVEit installed on-premise/locally on workstations.

We also use their cloud environments as described in my previous email.

I'm happy to setup a call with our IT team if it helps.

Sent: Monday, February 13, 2023 3:49 PM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

Good afternoon Raman, Just to clarify that you're hosting ProjectWise, Bluebeam, Autodesk, and MOVEit on a cloud environment, not installed on-premise/locally on workstations?

Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007

On Mon, Feb 13, 2023 at 10:29 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!-3lfYeEuFk4BEDMBpq4Z2BQQZ5LsMEfMN3JCMlq1LHC8CzQ8FEU18I3LCuAUFDrevkLJnr3htzUlLn2_cwI$ mailto:gopalanr@cdmsmith.com mailto:egross@azdohs.gov mailto:gopalanr@cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!4yQ7YzKedBf2Ks_zb1KPpn6jSYNd8_PrSDJcoHYUWLzXO60WY6QeXMYPgf6kD_nSKAN4MC9N_N2q16uewsw$ mailto:gopalanr@cdmsmith.com https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 6/9

Here’s a detailed breakdown:

AWS cloud service (our private network is on AWS)

Proposals, brochures and such materials Any project files that don’t have an internal project number assigned yet are also temporarily stored on our private network.

All Trinnex files

Microsoft Azure (via Office 365)

Outlook email (large attachments are transmitted through secure FTP – see below) Office files We store all work files on Bentley’s ProjectWise cloud platform

Bentley ProjectWise

All project files (PDFs, Office, record drawings, contracts, invoices, etc.)

Working CAD files are stored on Autodesk. They are archived on ProjectWise

Revu Bluebeam

Collaboration on PDF files (non-collaborative PDFs are stored on ProjectWise)

Autodesk

Storage space for AutoCAD files Collaboration on AutoCAD files

MOVEit

Secure FTP

Oracle

Financial systems

Please let me know if you have other questions.

Sent: Monday, February 13, 2023 9:23 AM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

Good morning Raman, What cloud services are you utilizing? Also, are you able to provide some detail about what type(s) of data will be stored on the private network vs. the cloud services?

Thank you, Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007

On Mon, Feb 13, 2023 at 6:38 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!45J_Xxv-4o68XtqBfhGh7NnwsY84DYAuBGf6Uz9xYbMyuMy6898_Xwluoz-xkl1kI2yb4ec0FnYe3qolcZE$ https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 7/9

We store work product and deliverables on a combination of private network locations and cloud services.

Sent: Friday, February 10, 2023 2:12 PM To: Gopalan, Raman <gopalanr@cdmsmith.com> Cc: May Forbin <forbin.merrilyn@azdeq.gov>; Thomas Considine <tconsidine@azdohs.gov>; Dellinger, Anthony S.

Thank you for sending over your completed controls sheet. Before we set up a meeting, could you provide me with some details about where you will be storing the data for this project (i.e., in a private network, in a cloud service provider environment, etc.)?

Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007

On Fri, Feb 10, 2023 at 11:27 AM Gopalan, Raman <gopalanr@cdmsmith.com> wrote:

Hello Emily.

Please see attached the completed questionnaire (Column E) as requested by May Forbin.

Please let me know if you’d a quick Teams call between your team and mine – I can set it up for next week.

Thank you.

Raman Gopalan, P.E., PMP, BCEE Project Manager CDM Smith 11811 N Tatum Blvd, Suite 3030, Phoenix, AZ 85028 602-281-7900 office |602-281-7881 direct|602-284-5624 cell cdmsmith.com mailto:forbin.merrilyn@azdeq.gov mailto:tconsidine@azdohs.gov mailto:dellingeras@cdmsmith.com https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!4OYAmCqlD8kn9CCHS56LsNXWxmymYTwG9XBRogbXOHouZ0j2Yb5q5ew8Jo_GgnXnfW01q9iAUcnM5wCKb2s$ mailto:gopalanr@cdmsmith.com https://www.google.com/maps/search/11811+N+Tatum+Blvd,+Suite+3030,+Phoenix,+AZ+85028?entry=gmail&source=g http://www.cdmsmith.com/ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.cdmsmith.com*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124650643*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=ELM9LTZmtrMNxjgbTyX5JqW8M1SY4x0Zh6NTPbIfKzI*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSU!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRZuv-Nrm$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.facebook.com*2FCDMSmith*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124660596*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=h8lBKbMaBry7B9gUHmp6svJ*2F5LrP3flXI67HKbGzjIs*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJQ!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRQgl4_f7$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Ftwitter.com*2FCDMSmith&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124660596*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=*2Fq4PbAqAZ04aOV9PCGy1FtSDtOlc4b7kkQ71MB9G1B0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRT8ISPmr$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.instagram.com*2Fcdmsmith*2F*3Fhl*3Den&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124670556*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=1FGOtwz6DGSr9gmPFm2jpBKVqubbz4NuJpXZg2zLUpM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSU!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRcFUj3CS$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.linkedin.com*2Fcompany*2Fcdmsmith*2F&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124670556*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=v01yUuXvmBobdkVEVAvvlMFuQMeH*2BV*2B4vEgq9RBdBWs*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRReMumGa$ https://urldefense.com/v3/__https:/gcc02.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.youtube.com*2Fuser*2FCDMSmith&data=04*7C01*7Cgcastaneda*40loudounwater.org*7C1ce32e11c77d44c5835008d97d3190e0*7C45150143abbd43d688da3155aaadc5d0*7C1*7C0*7C637678474124680509*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=RYE0DiokQuwxQ*2BchegSCQks*2BBtlk4T3wh79Gs*2FpKS0w*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUl!!OZ2Q16syoZo!qps3bfm9CEE4Bl64K7ukMRfDhh_Ht2l1o9alKeKp-ab6EyjEyEG0IR3qRfjyoPPo$ https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 8/9

Sent: Thursday, February 9, 2023 9:42 AM To: May Forbin <forbin.merrilyn@azdeq.gov> Cc: Gopalan, Raman <gopalanr@cdmsmith.com>; Thomas Considine <tconsidine@azdohs.gov>

Good morning Raman, Before we can begin the AZRAMP assessment on CDM Smith for your Lead Service Line Testing and Inventory project with AZDEQ, I need to know where you will be storing State data. Will you be using your private network/server or a cloud service provider (AWS, Microsoft Azure, GCP, etc.)?

Thank you, Sr. Information Security Analyst

Security, Privacy, and Risk (SPR) Team | Cyber Command

Arizona Department of Homeland Security | State of Arizona

1700 W Washington St, Suite #210, Phoenix, AZ 85007

On Wed, Feb 8, 2023 at 2:50 PM May Forbin <forbin.merrilyn@azdeq.gov> wrote:

Hello Raman

I trust you are well. I would like to introduce you and your team to Emily Gross and Tom Considine from the Arizona Department of Homeland Security (copied on this email). They will be your point of contact for the AZRamp process and will work with you in getting all the information required for CDM Smith's AZRamp assessment

I will continue to be your point of contact on the procurement side, so please keep me copied on all your communication with the AZRamp team, and do not hesitate to let me know if you have any questions or concerns regarding the procurement process

Regards, May Forbin

Senior Procurement Specialist Ph: 602-771-4779 azdeq.gov Your feedback matters to ADEQ. Visit azdeq.gov/feedback

On Wed, Feb 8, 2023 at 9:19 AM May Forbin <forbin.merrilyn@azdeq.gov> wrote:

Hello Raman mailto:forbin.merrilyn@azdeq.gov mailto:gopalanr@cdmsmith.com mailto:tconsidine@azdohs.gov https://www.google.com/maps/search/1700+W+Washington+St,+Suite+%23210,+Phoenix,+AZ+85007?entry=gmail&source=g mailto:egross@azdohs.gov https://urldefense.com/v3/__http:/azdohs.gov/__;!!OZ2Q16syoZo!_NpYcUhZ91n9HASmcLBb45Rf6X1Ln-i72I5riMKOWVtSy3T7j9dycXGpYaJ_mjuVCLwpqK7L-NWLTdj54qc$ mailto:forbin.merrilyn@azdeq.gov https://urldefense.com/v3/__http:/azdeq.gov__;!!OZ2Q16syoZo!_NpYcUhZ91n9HASmcLBb45Rf6X1Ln-i72I5riMKOWVtSy3T7j9dycXGpYaJ_mjuVCLwpqK7L-NWLDmKSzvU$ https://urldefense.com/v3/__http:/azdeq.gov/feedback__;!!OZ2Q16syoZo!_NpYcUhZ91n9HASmcLBb45Rf6X1Ln-i72I5riMKOWVtSy3T7j9dycXGpYaJ_mjuVCLwpqK7L-NWLoaZmQMA$ mailto:forbin.merrilyn@azdeq.gov https://mail.google.com/mail/u/0/?ik=e38762d902&view=pt&search=all&permthid=thread-a:r8811056611104599729%7Cmsg-f:1763560135059537664… 9/9

I trust you are well. I would like to introduce you and your team to Emily Gross and Tom Considine from the Arizona Department of Homeland Security (copied on this email). They will be your point of contact for the AZRamp process and will work with you in getting all the information required for CDM Smith's AZRamp assessment

I will continue to be your point of contact on the procurement side, so please keep me copied on all your communication with the AZRamp team, and do not hesitate to let me know if you have any questions or concerns regarding the procurement process

Regards, Senior Procurement Specialist