Oklahoma Municipal Assurance Group

PROJECT PURPOSE

OMAG will conduct municipal cyber readiness studies on Supervisory Control and Data Acquisition (SCADA) cybersecurity supporting the following critical infrastructure (in order of priority): water treatment (DWSRF), wastewater treatment facilities (CWSRF), and natural gas distribution systems. OMAG intends this to be a pilot project, with the intent to gauge the overall security of small municipal SCADA operations throughout a sample of approximately 10 smaller, more rural municipalities, primarily lacking dedicated support or with aging systems that might represent easier targets for foreign cyber attackers. We will first look at rural areas with a population between 10,000 ? 30,000. The study will focus on key, critical areas of infrastructure cybersecurity, including network segmentation, physical security and access controls, incident response, and other areas. Deliverables for each studied municipality include a final assessment report to each municipality, presentation to each municipality?s leadership of their specific findings, and a template incident response plan with an instructional video. Future phases may focus on additional cities as well as remediation of Phase I cities.

EVIDENCE

Based on our previous pilot project in 2018, and additional anecdotal evidence gathered through strategic IT assessments (a separate, ongoing initiative by OMAG Technology Services), OMAG believes that municipalities of between 10,000 ? 30,000 population are far more likely to operate SCADA systems connected to critical infrastructure that are high risk for cybersecurity incidents. By providing the services to analyze and identify critical risks, municipalities will be empowered to reduce the risk and implement solutions for robust cyber security.

POPULATION DESCRIPTION

OMAG will first do an intense survey of municipalities and identify those who currently have SCADA systems in place. Municipalities in rural areas normally have the potential for significant cybersecurity vulnerabilities and risk of external attack or internal failure due to mismanagement, lack of standardization, policies, and procedures, and other factors. After a system evaluation to identify those most in need, OMAG will offer the proposed SCADA Cybersecurity assessment services to municipalities who are most at risk. The candidates to receive the services will be prioritized by areas of Qualified Census Tracts, high poverty rates and those disproportionately impacted by COVID. Awards will be based on this priority.

PERFORMANCE MEASURING

OMAG will engage a vendor to conduct risk assessments against approximately 10 municipalities critical infrastructure connected SCADA systems, as an observational study against certain factors about the municipality, including population, tax base, qualified census tracts, the age of the plant or facility itself, and other factors. OMAG will use this data to build a preliminary model to predict the overall risk of SCADA-connected critical infrastructure statewide. Performance will be measured by timely completion of deliverables and response plans will be the performance outcome. OMAG will collect and maintain program data.

ONGOING INVESTMENT AMOUNT

$

ONGOING INVESTMENT DESCRIPTION

None

ONGOING INVESTMENT REQUIRED

Able to continue operation without additional funding from the State of Oklahoma