RFI_24ITC0680_-_Communications_Data_Portal.pdf

CPUC RFI# 24ITC0680

Communications Data Portal

California Public Utilities Commission

Communications Data Portal (CDP)

Request for Information (RFI)

March 13, 2025

Contents

1. Introduction

2. Disclaimer

3. Key Action Dates

4. Reasonable Accommodation

5. RFI Format and Instructions

6. Respondent Costs

7. RFI Questions

8. CPUC Contact Information

9. Attachments and Exhibits

10. Solution Demonstrations

11. Business Background

12. Requirements

EXHIBIT A – CPUC INFORMATION SECURITY PROVISIONS

List of Tables

Table 1- Abbreviations and Acronyms Table 2 – RFI Key Action Dates Table 3 – CPUC contact Table 4 - Attachments Table 5 – Major outage history Table 6 – Outage and restoral data requests Table 7 – Requirement categories Table 8 – Transaction volumes per year

List of Abbreviations and Acronyms

Table 1- Abbreviations and Acronyms

Abbreviations/Acronyms Meaning

ADA Americans with Disabilities Act

Cal OES California Office of Emergency Services

CAP Corrective Action Plan

CD Communications Division

CDP Communications Data Portal

COP Carrier Oversight and Program branch

CPUC or State California Public Utilities Commission

CSCR California State Contract Register

EO Executive Order

ETC Eligible Telecommunications Carrier

FCC Federal Communications Commission

GIS Geographic Information System

GO General Order

HFTD High Fire Threat District

IOU Investor-Owned Utility

IT Information Technology

MSI Major Service Interruption

PRA Public Records Act

PSAP Public Safety Answering Point

PSPS Public Safety Power Shut off

RFI Request for Information

SB Senate Bill

SCE Southern California Edison

1. Introduction

Background The Carrier Oversight and Programs (COP) Branch is a part of the California Public Utilities Commission’s (CPUC) Communications Division (CD). The CD regulates communications services providers operating throughout the State of California. The COP Branch regulates policies and programs including:

• Service Interruptions and Restoral o Access to communications services, including in emergencies, public safety power shut off (PSPS), disaster events, and system outages.

• Network Resiliency and Emergency Measures o The reliability and resiliency of California’s communications network, including facility-level data and site inspections.

• Service Quality o Monitoring and evaluation of communications service quality, including regular reports and Corrective Action Plans (CAPs) from communications service providers.

The Communications Data Portal The CPUC is seeking to implement a Communications Data Portal (CDP) to support the State’s rapidly changing communications grid and associated regulatory requirements for service access and interruptions, network resiliency, and service quality.

With a CDP, the CPUC will be able to:

1) Provide near real-time tracking of outage and restoration efforts, and critical reports to Commissioners, stakeholders (including the public), management, policy makers and the Administration for informed decision-making and policy development.

2) Facilitate the correlation of network resiliency failures with carrier compliance with service quality standards.

3) Expedite the time to identify carrier violations and enforcement of compliance including establishing citations, making advice letter determinations, and more.

4) Simplify the collection, organization, and storage of data from multiple communication service providers in one (1) unified system.

5) Manage increasing volumes of data as new service providers enter the market or new regulations are introduced.

6) Strengthen the ability to assess and respond to emergencies, outages, and public safety events efficiently.

7) Reduce manual data handling, accelerates data analysis, and supports quicker identification of carrier violations or service issues.

Given the large number of active communications service providers and the high volume of associated communications in the state, CPUC critically needs the CDP to collect, compile, and analyze communications data and information from these providers. This ongoing effort is essential to the CPUC’s mission of ensuring fair and affordable universal access to necessary, high quality, and reliable communications services.

2. Disclaimer

This Request for Information (RFI) is issued for informational and planning purposes only and does not constitute a solicitation. A response to this RFI does not create an offer and cannot be accepted by the CPUC to form a binding contract. Interested suppliers are solely and fully responsible for all expenses associated with responding to this RFI.

All materials submitted in response to this RFI will become the property of CPUC and, as such, are subject to the California Public Records Act (PRA) (Government Code Section 6250, et seq.). CPUC will disregard any language purporting to render all or portions of any Response confidential. If material marked “confidential,” “proprietary,” or “trade secret” is requested pursuant to the PRA, CPUC will make an independent assessment whether it is exempt from disclosure.

3. Key Action Dates

Respondents are requested to provide a written response to this RFI and, if requested, provide a demonstration of their products and services. Listed below are the Key Action Dates and times by which actions must be taken or completed. If CPUC finds it necessary to change any of these dates, an Addendum to this RFI will be posted on the State’s California State Contract Register (CSCR) at www.caleprocure.ca.gov.

Table 2 – RFI Key Action Dates

Key Action Date

Release of RFI 03/13/2025

Last Day to submit written questions regarding RFI

03/21/2025, 12:00 PM (PST)

Response to written Questions 03/26/2025

Last Day to Submit RFI responses 04/23/2025,12:00 PM (PST)

4. Reasonable Accommodation

To comply with the non-discrimination requirements of the Americans with Disability Act (ADA), it is the policy of the State to make every effort to ensure that its programs, activities, and services are available to all persons, including persons with disabilities. For persons with a disability needing a reasonable modification to participate in the RFI process, or for persons having questions regarding reasonable modifications for the RFI process, you may notify ITSolicitations@cpuc.ca.gov. To ensure that we can meet your needs, submit your request for reasonable modification at least five (5) business days before the scheduled event or the due date of RFI documents.

http://www.caleprocure.ca.gov/

5. RFI Format and Instructions

This RFI and the Respondent’s response to this document will be made part of the CPUC’s procurement file.

Responses must contain all requested information and data and conform to the format described in this section. It is the Respondent’s responsibility to provide all necessary information for the State to evaluate the response.

Respondents are welcome to submit multiple solutions for this RFI.

1. Before submitting a response, seek timely clarification of any requirements or instructions that are believed to be vague, unclear, or not fully understood by following the process outlined in Section 7, RFI Questions.

2. Information submitted in the Respondent’s response should be straightforward, detailed, and precise. CPUC will measure the value of a response by its quality, not its volume, packaging, or colored displays.

3. Format requirements

a. Format the narrative portion of the response as follows:

i. Use one-inch margins at the top, bottom, and both sides.

ii. Use a font size of not less than 11 points.

4. Respondents are requested to respond to all applicable information in this RFI and attachments.

a. Respondents should respond to all applicable information in Attachments A, B and C:

i. Attachment A – Letter of Interest

ii. Attachment B – Solution Cost Estimate

1. If submitting multiple solutions, complete separate Attachment B for each.

iii. Attachment C – Respondent Questionnaire

5. Responses must include the applicable required attachments and sent via email to the CPUC Information Technology (IT) Contract Administrator listed in Section 8, CPUC Contact Information.

6. Responses must be submitted by the specified dates and time stated in the Table 2

– RFI Key Action Dates. Responses received after these dates will not be reviewed.

6. Respondent Costs

The cost of preparing and submitting a response to this RFI is the responsibility of each respondent and will not be the responsibility of the State of California.

7. RFI Questions

Respondents must submit questions regarding this RFI, via email, by the specified date and time stated in the Key Action Dates to the email contact stated in Section 8, CPUC Contact information.

What to include in an inquiry:

1. Include in the subject line of the email: “CPUC RFI# 24ITC0680 Question(s)”

2. Respondent name and contact, telephone number, email address.

3. A description of the subject, or issue in question, or discrepancy found.

4. RFI Section, page number, or other information useful in identifying the specific problem or issue stated in the question.

5. All questions and answers will be posted on the CSCR at www.caleprocure.ca.gov by the Table 2 – RFI Key Action Dates in Section 3.

8. CPUC Contact Information

If interested in participating in the RFI, submit your response to the IT Contract Administrator listed below:

Table 3 – CPUC contact

CPUC IT Contract Administrator

Name: Russell Lee

Address: 505 Van Ness Avenue San Francisco, CA 94102

Phone: (415) 703-1804

Email: ITSolicitations@cpuc.ca.gov

9. Attachments and Exhibits

Table 4 - Attachments

Attachment Description

A Letter of Interest

B Solution Cost Estimate

C Respondent Questionnaire

D Process Flows – As Is

E Process Flows – To Be

F Requirements

10. Solution Demonstrations

The CPUC may invite respondents to present a demonstration of the solution(s) outlined in the RFI responses.

11. Business Background

As of December 2024, there are approximately nine hundred ninety (990) communications service providers active in California. The CPUC manages a substantial volume of regulatory activities while:

http://www.caleprocure.ca.gov/ mailto:ITSolicitations@cpuc.ca.gov

1. Addressing the dynamics of the communications marketplace, characterized by a diverse range of providers and technologies.

2. Responding to ongoing challenges presented by wildfires, PSPS events, winter storms, earthquakes, other disaster events, and other system outages on a regular basis.

The COP branch oversees key regulatory activities for these communications providers, which include:

• Service Interruptions and Restoral

• Network Resiliency and Emergency Measures

• Service Quality

Service Interruptions and Restoral

California is experiencing a continuing onslaught of communications service interruptions impacted by fires, storms, and other disaster events. For example, California experienced a record-breaking fire season in 2018. Approximately eight thousand (8,000) wildfires burned close to two million (2,000,000) acres throughout the state that year. These devastating fires resulted in billions of dollars in damage and numerous lives were lost. During the calendar year 2022, Cal FIRE reported more than seven thousand four hundred (7,400) wildfire incidents, which shows the persistent nature of these conditions. Moreover, utilities may temporarily turn off power for public safety purposes via PSPS events in specific areas to reduce the risk of fires caused by electric infrastructure. These electric “de-energizations” impact the commercial power availability to communications networks to keep operating and serve customers. Additionally, in March 2023, the California Governor declared a state of emergency in thirteen (13) of the state’s counties due to severe winter weather, impacting these networks and communications services to the customers. Similarly, in January 2025, the Palisades fire was declared a state of emergency in Los Angeles and Ventura counties.

Communications service providers have thousands of communications facilities in California that are subject to these events on an ongoing basis.

Providers also have other outages that impact communications services in the state. In December 2022, Verizon Wireless had a widespread outage impacting 9-1-1 service in six

(6) states. Similarly, AT&T experienced an outage in August 2023 disabling key portions of its network, which impacted communications and 9-1-1 service delivery in various states.

The CPUC receives several types of service outage and restoral data, as described below.

The data comes in varying formats, email, Excel, etc., and staff spend considerable time manually parsing, transposing, matching, compiling, and analyzing. Staff are unable to provide comprehensive reports in a timely manner to CPUC management and stakeholders while major catastrophes and outages are occurring.

The Commission receives approximately eight thousand (8,000) to ten thousand (10,000) initial and final Major Service Interruption (MSI) reports annually from communications providers. MSI reports contain high-level data on service interruptions reported by carriers pursuant to Federal Communications Commission (FCC) parameters. The table below summarizes the reported major service outages for the three largest mobile providers from 2018-2021, which staff had to track and analyze:

Table 5 – Major outage history

Major Service Outages for Large Mobile providers, 2018-21

2018 2019 2020 2021

Company A 393 572 814 491

Company B 107 280 255 182

Company C 31 47 41 24

Total 531 899 1,110 697

The CPUC also directly collects and analyzes granular outage data and information from communications providers solicited via data request during outage events1.

Table 6 – Outage and Restoral Data

Requests in 2022

CPUC Outage and Restoral Data Requests

Event name Start Date Data Requests Sent*

Coastal Fire 5/11/2022 6

Sheep Fire 6/12/2022 9

Oak Fire 7/22/2022 6

Southern California Edison (SCE) July PSPS 7/22/2022 11

McKinney Fire 7/29/2022 13

Route & Border 32 Fire 8/31/2022 12

Mill & Mountain Fires 9/2/2022 13

Caeser Fire 9/5/2022 9

Fairview Fire 9/5/2022 12

Mosquito Fire 9/6/2022 12

Fork Fire 9/7/2022 6

SCE October PSPS 10/22/2022 8

SCE November PSPS 11/18/2022 15

Earthquake in Humboldt 12/20/2022 8

DR for 2021/2022 PSPS and windstorm events 1/3/2023 37

TOTAL 177

* Data requests required communications providers to submit daily reports to the CPUC for each day of the outage through service restoral.

1 Commission solicited data covers more service outages than the MSI data as FCC parameters only require communications providers to report outages above certain thresholds (e.g. outages impacting more than 90,000 calls). Commission solicited data also provides more granular information on communications subscribers impacted by outage events as well as detail on facilities and circuits impacted by them that MSI data does not include. Similarly, a CalOES solicits 9-1-1 community outage data at the PSAP level, while Commission solicited data contains subscriber level impacts when communications outages occur.

Moreover, the Commission obtains outage-related data from multiple sources including:

a) 9-1-1 community isolation outage data (at the Public Safety Answering Point

[PSAP] level) from the California Office of Emergency Services (Cal OES), pursuant to State Bill (SB) 341.

b) Outage data from General Order (GO) 133 -D standards and metrics for voice services from certain communications providers.

c) Data from various units within the Commission, such as consumer complaint data from the Consumer Affairs Branch (CAB) and electric utility outage data from the Energy and Safety Enforcement Divisions.

Network Resiliency and Emergency Measures

The Commission established Rulemaking (R.) 18-03-011 to adopt an emergency disaster relief program for customers of electric, natural gas, water and sewer, and communications service providers. In D.19-08-025, the CPUC found that the wildfires of 2017, 2018, and 2019 as well as PSPS events initiated by California’s large investor-owned utilities (IOUs) revealed failures in California’s communications network, including a loss of service to customers and endangerment of the lives of customers and first responders.

Phase I of the rulemaking mandated certain consumer protections upon the declaration of a state of emergency by the Governor of California. Communications service providers are mandated to file advice letters to the Commission for review when they activate these protective measures in response to a declared state of emergency. As a result, the CPUC needs to conduct a comprehensive review and analysis of hundreds of these advice letters each year, along with the critical data they include.

Phase II of the rulemaking aims to establish a resilient and dependable communications network that supports first responders and ensures effective communication with the public in a timely manner. This initiative applies to the thousands of communication service provider facilities in California, that regularly encounter ongoing challenges from wildfires, PSPS, and other disaster events.

The CPUC adopted Decisions 20-07-011 and 21-02-029 (collectively, “Resiliency Strategy Decisions”) to address the widespread loss of communications services during disasters and power outages. The Resiliency Strategy Decisions require the implementation of six (6) groups of network resiliency strategies by all facilities-based wireline and wireless communications service providers. The six strategies include the following:

1) Implementation of backup power duration of at least seventy-two (72) hours in High

Fire Threat Districts (HFTDs) of the state.

2) Building and maintaining redundant communication networks.

3) Hardening communication networks.

4) Using temporary facilities.

5) Establishing communication and coordination processes with various stakeholders.

6) Establishing preparedness planning for employees and ensuring sufficient staffing levels.

The CPUC emphasizes the critical need for effective resiliency strategies to ensure uninterrupted access to essential services. These services include:

a) Access to 9-1-1 and 211 services.

b) The ability to receive timely emergency notifications.

c) Access to basic Internet browsing.

It is imperative that these strategies are implemented to safeguard public safety and maintain connectivity including connectivity during emergencies and outages.

The Resiliency Strategy Decisions also require communication service providers to submit five annual reports:

1) Resiliency plans

2) Emergency operations plan

3) Outreach and coordination plans

4) Emergency contact information

5) Emergency preparation exercises.

These reports include granular facility, circuit, and equipment level detail key to monitoring compliance with network resiliency and emergency preparedness requirements.

Communications service providers have reported approximately twenty-one thousand (21,000) communications facilities in the state’s key HFTDs. Numerous provider facilities located in these HFTDs are currently equipped with outdated or non-existent backup power capabilities while facing wildfires, PSPS events, and other natural disasters in California’s “new normal” landscape. Despite limited resources, the CPUC reviews these voluminous carrier filings and conducts facility site visits to evaluate the data reported by carriers. The rulemaking can evolve to include robust enforcement mechanisms as well as the expansion of network resiliency strategies across the entire state of California, which has over thirty-two thousand (32,000) facilities statewide. If these broader strategies were adopted, it would increase the CPUC’s workload in this area.

In addition, the CPUC has ongoing collaboration with the Cal OES and other public safety entities on network resiliency and emergency preparedness. For instance, due to CPUC’s regulatory authority over communications service providers and Cal OES’s regulatory authority over 9-1-1 service, the two (2) entities work together on issues impacting the 9-1-1 system, including:

• Information on 9-1-1 community isolation outages reported to Cal OES pursuant to

SB 341.

• Additional communications service outages and resiliency data reported to the

Commission.

SB 341 requires the CPUC to provide an annual report to the Legislature regarding the actions it has taken based on information received from Cal OES about community isolation outages. It demands collaboration between the CPUC and Cal OES in the preparation of these annual reports. These reports also have a natural nexus with the service quality work described below, specifically concerning information about service outages and service restoral information.

Service Quality

The CPUC oversees service quality for the state by monitoring and evaluating service quality reports from traditional wireline communications service providers pursuant to the standards, metrics, and enforcement measures (fines and reinvestment) specified in the CPUC’s GO 133-D. Currently, the CPUC evaluates monthly data from these carriers with respect to six service quality metrics and prepares resolutions when providers fail to meet GO 133-D metrics. The CPUC also reviews carrier CAPs filed with data and information on how they will address service quality deficiencies when they chronically fail to meet GO 133- D requirements.

The CPUC‘s Rulemaking (R.22-03-016) seeks to amend GO 133-D to expand its applicability from just Plain Old Telephone Service (POTS) to include Voice over Internet Protocol (VOIP), mobile wireless, and broadband services. The rulemaking will address existing and new standards including, but are not limited to, network technical quality, customer service, installation, repair, and billing applicable to the broad universe of telecommunications providers. The expanded applicability will at least quadruple GO 133 data collection, analysis, reporting, and monitoring activity.

The CPUC also issues studies and reports on service quality that underlie policymaking, legislation, and regulatory program activities. For example, the CPUC issued the Network Exam Report, Phase 1 (2010-2017 data) and II (2018-2019 data) which documented deficiencies in the service quality and deteriorations in communications network performance of two (2) key California wireline carriers.

Need for Updated Data Capability and Analysis Despite an expanding volume of workload related to communications service quality, network resiliency, and emergency preparedness, the CPUC is currently relying on outdated and largely manual and labor-intensive methods of collecting, compiling, and analyzing millions of data in these functional areas on an annual basis. As described earlier, this data includes the following:

• Monthly GO 133 data reported by carriers demonstrating compliance with existing and new standards regarding network technical quality, customer service, installation, repair, and billing applicable to the broad universe of telecommunications providers.

• Data associated with network studies and reports, e.g., the Network Exam. Data collected as needed for study/ reports from carriers and other sources.

• High-level data on MSI reported by carriers for outages pursuant to FCC’s threshold parameters. The CPUC receives eight thousand (8,000) to ten thousand (10,000)

MSI initial and final reports annually. Each report contains numerous lines of data.

• Granular communications outages and service restoral data are collected daily for each outage that occurred by the carrier, with numerous lines of data per filing. Data is solicited via the CPUC’s data requests and is more comprehensive than MSI data2 as it is not subject to FCC and Cal OES threshold parameters.

• Hundreds of carrier advice letters are reviewed annually when States of Emergency are declared. Unique advice letter filings are made for each emergency declaration from the California Governor.

• Five (5) annually recurring reports, i.e., resiliency plans, emergency operation plans, outreach and coordination plans, emergency contact information, and emergency preparedness exercises. Per D.20-07-011 and D.21-02-029, the CPUC receives and reviews annual network resiliency and emergency operations plans regarding more than twenty one thousand (21,000) carrier network facilities in key HFTDs. Carriers will report on more than thirty-two thousand (32,000) network facilities statewide annually when resiliency measures are expanded statewide.

• Facility or Site visit data from staff examination of reported carrier facilities

• Cal OES 9-1-1 community isolation data pursuant to SB 341 subject to a limited set of parameters defined by Cal OES. (see footnote 1)

• Other data sources, including but not limited to, electric utility de-energization/ PSPS events outage data, consumer complaint data, etc.

As noted above, the CPUC collects the above data via e-mails, excel spreadsheets, and other manual inputs. Since this is very labor-intensive and time-consuming to parse, transpose, compile, and analyze, it results in the following inefficiencies:

• Staff are often unable to provide complete 360° view with timely and comprehensive reports to CPUC management and stakeholders during major catastrophes such as wildfires, PSPS events, and other natural disasters.

• Carriers often complain that the CPUC lacks a uniform system for this regulatory information.

• Carriers frequently alter Excel templates provided to the CPUC, which complicates data collection, compilation, and analysis.

• Staff spend significant resources validating basic carrier compliance with data reporting obligations before they can conduct analysis of the carrier data itself.

• The CPUC is unable to correlate data from various sources to advance regulatory initiatives. For example, the CPUC cannot correlate GO 133 service quality data with network resiliency data in HFTDs in the state or data on outages when disaster events occur to underly policy and program choices.

• Staff lack the ability to map or analyze the data in a Graphical Information Systems

(GIS) context. Such correlation and GIS analysis are needed to keep pace with the

2 Commission solicited data is covers more service outages than the FCC’s MSI data as the FCC only requires communications providers to report outages above certain thresholds. Commission solicited data also provides more 2 Commission solicited data is covers more service outages than the FCC’s MSI data as the FCC only requires communications providers to report outages above certain thresholds. Commission solicited data also provides more granular information on communications subscribers impacted as well as detail on facilities and circuits impacted by outages and disaster events. Similarly, a CalOES solicits 9-1-1 outage data at the PSAP level, Commission solicited data contains more information on subscriber impacts including 9-1-1 when communications outages occur.

https://docs.cpuc.ca.gov/PublishedDocs/Published/G000/M344/K021/344021480.PDF https://docs.cpuc.ca.gov/PublishedDocs/Published/G000/M366/K625/366625041.PDF current communications market and persistent climate impacts influencing the provision of communications services.

Proposal

The CPUC must take immediate action to move away from manual methods to address service quality, network resiliency, and emergency preparedness aspects of communications services, especially in key HFTDs across the state. Current staffing levels and data systems are hindering the Commission’s ability to ensure that all Californians have universal access to high-quality and reliable communication services. This also affects the response to disasters and PSPS events that frequently disrupt communications services and networks in the state.

The CPUC is seeking potential solutions from Contractors to future implement a CDP to efficiently compile and calibrate big data information from various sources and generate meaningful statistical reports and real-time dashboards to support communications policy-making and regulatory activities. The CDP will be an essential tool in the Commission’s effort to integrate data from multiple sources, enabling better policy and program outcomes.

With the CDP tool, the Commission can:

• Utilize GIS to generate maps identifying locations that suffer from poor service quality of communications services.

• Match these locations with emergency/disaster preparation data to hold service providers accountable before disasters strike a community.

• Enhance collaboration with Cal OES regarding 9-1-1 service across the state.

• Extrapolate communications network infrastructure-related data with corresponding service quality performance data.

• Coordinate sending automated notifications.

Improving our understanding of geo-specific locations affected by poor service quality and inadequate emergency preparedness will assist the CPUC in ensuring service providers maintain network resiliency and resolve communications service outages quickly. Given the scope of outages and the facilities operated by communications service providers, the proposed portal will be essential in helping the CPUC effectively manage and analyze large and complex data sets related to outages. Moreover, having the capability to quickly produce reports and, in some instances, automate data collection and analyses will enable the CPUC to respond more effectively to government agencies, legislatures, and the public inquiries. Staff will also produce reports and data visualizations to CPUC Commissioners, legislative offices, other stakeholders, and the public. These outputs will highlight deficiencies in the communications infrastructure and address risks related to public safety and communications service quality.

The CDP will also streamline the integration of data from other sources, such as Cal OES.

Such automated integrations will enable standardized data templates to solicit input from communications carriers directly via the portal and automated data imports from external sources (e.g., Cal OES)

The portal could perform multiple functions that allow staff to efficiently and interactively acquire, store, monitor, analyze, and report on communications network infrastructure outages, resiliency, and additions/upgrades. This includes:

a) Customized online dashboards featuring statistics with data correlation, linear regression, bar graphs, trend charts, and numerous other automation features.

b) Customized reports, including those focused on specific geographic areas

(e.g., county, city, High Fire Threat District, etc.), at service provider specific facilities.

Process Flows

For more details, we have included process flows in the following attachments.

Attachment D, Process Flows -As is contains a set of eight (8) As-Is process flows.

Attachment E, Process Flows-To be contains eight (8) To-Be process flows. The process flows represent the following activities:

1. Network Resiliency Plans and Compliance Filings

2. Service Quality Reports

3. TQs/MSI (Threshold Quantities/Major Service Interruption) Portal

4. Eligible Telecommunications Carrier (ETC) Biennial Reports and Eligibility

5. Tariff Creation and Violations

6. Tariff Management

7. Cal OES Provider Outages

8. Site Visits

9. Data Requests

12. Requirements

Functional Requirements The chart below lists the categories of functional requirements the CDP must satisfy. Please review the attached requirements and process flows to better understand the detailed types of data CDP will need to collect and analyze.

Table 7 – Functional requirement categories

Requirement Category

# of Requirements

Report intake 27

Analysis 12

Integration 10

Tariffs 9

Eligibility Review 7

Report review 5

Report attributes 5

Notifications 5

Workflow 3

File uploads 3

File export 2

Trouble Tickets 2

Visit Plan 2

GIS 2

Checklist 2

Post Visit 2

Total 98

Data Migration Requirements Currently, CO maintains data in spreadsheets for most subprograms and in an Oracle database for one of the programs (MSI). The CPUC will work with the Contractor to clean the data. However, the Contractor will be responsible for migrating the data into the CDP database. The cost sheet requests that the cost for this migration be estimated separately from implementing the CDP functionality. The chart below is a list of annual records accumulated per year across the different programs. This may be used to determine the scale of a migration.

Table 8 – Transaction volumes per year

Type of Record Frequency Estimated Total records per Year

NORS

Outages (Communications companies are required to send an initial and final NORS reports to CD)

Daily as outages occur 8,000 -10,000

Resiliency Plans (including 72 hour back up power information by facility)

Twice per year (January for Wireless companies, August for Wireline companies)

49* for 21,000 facilities in Tier 2 and 3 HFTDs (voluminous rows of data per plan)

Emergency Operations Plans

Twice per year (January for Wireless companies, August for Wireline companies)

49* for 21,000 facilities in Tier 2 and 3 HFTDs (voluminous rows of data per plan)

Outreach and coordination plans

Twice per year (January for Wireless companies, August for Wireline companies)

49*

Emergency contact information

Twice per year (January for Wireless companies, August for Wireline companies)

49*

Emergency preparedness exercise information

Twice per year (January for Wireless companies, August for Wireline companies)

49*

Cal OES community Outage Information

Per community isolation outage

15,000 – 16,000

Service Quality Reports Monthly data (submitted on quarterly basis)

288**

Data Requests and responses

Per PSPS or disaster event 300-400

NPPS advice letters Per PSPS or disaster event 300- 500

Corrective Action Plans Annually (per company that fails to meet GO133-D standards)

7-12

Facility site visit data Per site visit 50-100***

Consumer Affairs Branch informal complaints

Per customer 1,000 – 5,000

* number may fluctuate due to communication carriers entering and exiting the market as well as transfers and mergers of carriers ** The number may double or triple depending on the outcome of the Service Quality OIR ***The number could increase pursuant to outcome of the emergency disaster relief OIR and related staffing increases (if approved)

EXHIBIT A – CPUC INFORMATION SECURITY PROVISIONS

In the performance of this contract, the Contractor agrees to protect the confidentiality, integrity and availability of all information provided by the California Public Utilities Commission (CPUC).

The Contractor further agrees to implement the following minimum administrative, physical, and technical information security safeguards to comply with the information security provisions specified in State Administrative Manual (SAM) 5305.8.

Reference: https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-8

1. ADMINISTRATIVE SAFEGUARDS

A. DATA OWNERSHIP

1) The information being provided by CPUC under this Agreement remains the exclusive property of CPUC. This information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without written permission from CPUC.

2) The contractor shall have a non-exclusive right to use and process the information for the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of this data to Contractor in the performance of this Agreement does not transfer ownership of information to the Contractor or its employees or agents.

B. INCIDENT REPORTING

All unauthorized or suspected unauthorized access, uses, and/or disclosures of information obtained under this Agreement will be thoroughly reviewed by CPUC ISO and the contractor’s ISO. The Contractor will comply with the incident reporting requirements in accordance with California Civil Code Section 1798.29, California State Administrative Manual Section 5340.4, and State Information Management Manual Sections 5340-A and 5340-C.

1) The Contractor will immediately notify the CPUC ISO of any information security breach involving information accessed or obtained under this Agreement.

Immediately, for purposes of this Agreement, means not later than 24 hours after a security event is detected.

2) Each party will conduct oversight of its users with access to information provided under this Agreement and will immediately notify the other Agency's Information Security Office of any unauthorized or suspected unauthorized accesses, uses, and/or disclosures / (incidents).

Reference: https://cdt.ca.gov/wp-content/uploads/2021/04/TL_12-16_Incident- Response_Final_Remediated.pdf https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-8 https://cdt.ca.gov/wp-content/uploads/2021/04/TL_12-16_Incident-Response_Final_Remediated.pdf https://cdt.ca.gov/wp-content/uploads/2021/04/TL_12-16_Incident-Response_Final_Remediated.pdf

C. USE OF INFORMATION

The Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement will be used solely for the purposes described in this Agreement and agrees to implement policies and procedures to ensure the confidentiality, integrity, and availability of said information. The Contractor further agrees that information obtained under this Agreement will not be reproduced, published, sold, or released in original or any other form for any purpose other than identified in this Agreement.

D. STATEMENT OF CONFIDENTIALITY

Each party will ensure that all employees who have access to confidential, sensitive, and/or personal information of the other party may be required to file a signed confidentiality statement attesting to the fact that he/she is aware of the confidential nature of the data and penalties for unauthorized disclosure under applicable state and federal law. Copies of signed confidentiality statements must be made available upon request to the CPUC ISO.

E. EMPLOYEE ACCESS TO INFORMATION

The Contractor agrees that information will be kept in the strictest confidence and only made available to authorized personnel on a "need-to-know” business basis, and only for the purposes authorized under this Agreement. The term "need-to-know’’ refers to those authorized persons who need information to perform their official duties in connection with the purpose described in the Agreement. The parties recognize their mutual responsibilities to protect the confidentiality of information in their custody as provided by law and ensure such information is disclosed only to those individuals, and of such purpose as authorized by the respective laws.

• Remote access. Must be approved by the CPUC CIO and ISO. Any authorized remote access connections are to be within the CONUS only (prohibiting remote access to data from outside CONUS) and require multifactor authentication.

• All privileged accounts require multi-factor authentication.

F. SECURITY AWARENESS TRAINING

The Contractor and all their users authorized to access all information furnished or obtained under this Agreement must receive security awareness training prior to accessing such information, and annually thereafter.

2. PHYSICAL SAFEGUARDS

A. ACCESS AUTHORIZATION RECORDS

The Contractor will maintain records of all authorized users and the authorization level of access granted to the information obtained under this Agreement.

B. ACCESS CONTROL

The Contractor will maintain and secure its entire computer system (network, hardware, software, and applications) used in the performance of this Agreement in accordance with state policies, standards and procedures held in the State Administrative Manual Chapters 4800 through 5300

Reference: https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360

C. SECURE AREAS

Computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement must not be viewed by the public or other unauthorized persons as described in the Agreement.

D. SECURE STORAGE

Information in all forms must be stored in areas physically secure and protected from access by unauthorized persons. All confidential and personal data requires end-to-end encryption. Call center and IVR system recordings are designed and configured to protect personal information (e.g., use masking for SSN and other personal data protections that limit/restrict recording, copying and excess storage of persona data).

E. MEDIA PROTECTION

The Contractor will employ the use of FIPS 140-3 validated encryption for all confidential information stored on electronic media and obtained in the performance of this Agreement. Confidential information obtained by either party in this Agreement must be secured in accordance with the State Administrative Manual Chapter 5300.

Reference: State Administrative Manual Section 5300 https://www.dgs.ca.gov/Resources/SAM/TOC/5300

F. DESTRUCTION O F RECORDS

All records received under this Agreement and any database(s) created, copies made, or files attributed to the records received will be destroyed when they are no longer needed for the business purpose for which they were obtained, or within thirty (30) calendar days of termination of the contract, using confidential destruction methods. This information includes information stored on all media both digital and physical. The records shall be securely destroyed in accordance with NIST 800-88.

Reference: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

3. INFORMATION SECURITY

Information security is defined as the preservation of the confidentiality, integrity, availability, authenticity, and utility of information. A secure environment is required to protect the confidential information obtained pursuant to this Agreement. Confidential https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf https://www.dgs.ca.gov/Resources/SAM/TOC/5300 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf information obtained by either party in this Agreement must be secured in accordance with the State Administrative Manual Chapter 5300.

A. ELECTRONIC TRANSMISSION

All confidential information transmitted over a public network must be encrypted end-to-end. The Contractor will use FIPS 140-3 encryption standards and FIPS 140-3 validated methods, and NIST special publication 800-53 control requirements such as, but not limited to, utilizing minimum encryption strength of 256-bit AES and Secure File Transfer Protocol (SFTP) when transferring or encrypting electronic files or information. The Contractor will coordinate with CPUC ISO to implement the above referenced encryption standards to send and receive all information as required.

Reference:

1) NIST special publication 800-53, Rev 5, System and Communications Protection

Family, Control SC-8 Transmission Confidentiality and Integrity

i. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53r5.pdf

ii. http://csrc.nist.gov/publications/PubsSPs.html

2) FIPS publication 197

i. http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf

ii. http://csrc.nist.gov/publications/PubsFIPS.html

B. CHANGE CONTROL

All changes to computer systems, hardware, software, file structure, data or record layout, applications, storage media, and network components used for storing and/or accessing information in the performance of this Agreement must be approved by the CPUC ISO in writing in advance prior to implementation.

C. SCREEN-LOCKING

Computers capable of accessing information for the performance of this Agreement must not be left unattended and logged on unless secured by a screen-locking process or mechanism to prevent unauthorized access or secured in a locked room not accessible to unauthorized personnel.

D. AUDITING

The Contractor will maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Logs must be made available to the CPUC ISO upon request. The Contractor will allow audits or inspections by individuals authorized by the CPUC ISO at the Contractor’s premises during regular business hours, prior notice for purposes of determining compliance with the terms of this Agreement.

E. CLOUD COMPUTING

If the Contractor will be using a cloud computing solution, the solution must follow and meet, or exceed, the special provisions for cloud computing services set by the https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf http://csrc.nist.gov/publications/PubsSPs.html http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf http://csrc.nist.gov/publications/PubsFIPS.html

Department of General Services (DGS) and Department of Technology and published on the DGS website.

Reference:

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model- Language/CLOUDCOMPUTING_SaaSGP11192021.pdf?la=en&hash=13820BD4DA66

DB6A8A17D19BC17BC66C724D5046

https://www.dgs.ca.gov/- /media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSPECIALPROVISIONS_Infrastr ucture-as-a-Service-and-Platform-as-a- Service.pdf?la=en&hash=24218F2AED4E47885FBCB20B1107EA484203EFF3

F. DISASTER RECOVERY

The Contractor must meet the following disaster recovery objectives:

1) Upon the executed interagency agreement and the installation of the data transfer method, the Contractor shall provide a copy of disaster recovery plan and procedures that address all essential recovery program elements outlined in State Administrative Manual sections 5325 through 5325.6.

In the event of a disaster, as defined in the disaster recovery plan, the Contractor shall notify CPUC as soon as practical, but not later than 24 hours after declaring a disaster; and shall provide a report to CPUC within two (2) business days, or as soon as practical. In the event of a disaster, the Contractor will notify CPUC for their approval when the need to use an outside vendor occurs ensuring all security measures will be maintained.

2) The Contractor, in collaboration with CPUC and a Disaster Recovery Vendor, shall test their ability to meet the requirements of this Agreement annually in accordance with State requirements and provide CPUC a report regarding the execution of the test and its outcome.

a) The testing must meet the recovery objectives of this Contract and should assess whether the Contractor’s disaster recovery provisions are capable of meeting the recovery objectives. The Contractor and CPUC will be responsible for establishing and conducting periodic Disaster Recovery tests, which will provide a means for Disaster Recovery Plan documentation maintenance as well as early identification and mitigation of any problems that occur as a result of the test.

b) At the minimum, the Contractor, in conjunction with CPUC must conduct one simulation or parallel test of Disaster Recovery plan annually. This test must exhibit end-to-end recovery capability to meet requirements as described in this contract.

Reference: http://sam.dgs.ca.gov/TOC/5300.aspx https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CLOUDCOMPUTING_SaaSGP11192021.pdf?la=en&hash=13820BD4DA66DB6A8A17D19BC17BC66C724D5046 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CLOUDCOMPUTING_SaaSGP11192021.pdf?la=en&hash=13820BD4DA66DB6A8A17D19BC17BC66C724D5046 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CLOUDCOMPUTING_SaaSGP11192021.pdf?la=en&hash=13820BD4DA66DB6A8A17D19BC17BC66C724D5046 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSPECIALPROVISIONS_Infrastructure-as-a-Service-and-Platform-as-a-Service.pdf?la=en&hash=24218F2AED4E47885FBCB20B1107EA484203EFF3 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSPECIALPROVISIONS_Infrastructure-as-a-Service-and-Platform-as-a-Service.pdf?la=en&hash=24218F2AED4E47885FBCB20B1107EA484203EFF3 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSPECIALPROVISIONS_Infrastructure-as-a-Service-and-Platform-as-a-Service.pdf?la=en&hash=24218F2AED4E47885FBCB20B1107EA484203EFF3 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSPECIALPROVISIONS_Infrastructure-as-a-Service-and-Platform-as-a-Service.pdf?la=en&hash=24218F2AED4E47885FBCB20B1107EA484203EFF3 http://sam.dgs.ca.gov/TOC/5300.aspx