The URL can be used to link to this page

Home My WebLink About _ 4.5(a)--REU Utility Security Plan 2026 GI �" Y C� F � � �- ' � ° � � i � CITY OF REDDING �� REPORT TO THE CITY COUNCIL MEETING DATE: May 5, 2026 FROM: Nick Zettel, Director of ITEM NO. 4.5(a) Redding Electric Utility ***APPROVED BY*** � �� t� �.� � y" ,� � -� �,� � . � . � � ��.��-�.,. � .µ� �k ct e o ��rcctor �i9' e in r tric�[Jtriity � � 4122t2��6 G��I1a��arbc�x �'��1�a�nag�r � 4/�912t726 nzettel@cityofredding.org wtarbox@cityofredding.gov SUBJECT: 4.5(a)--Consider approval of the 2026 REU Utility Security Plan for Distribution Level Facilities Recommendation Approve the updated 2026 Redding Electric Utility Security Plan pursuant to Senate Bill 699 (2014) and the California Public Utilities Commission Phase I Decision Order, Instituting Rulemaking, regarding the physical security of electrical corporations. Fiscal Impact There is no f scal impact related to approving revisions to the 2026 Redding Electric Utility (REU) Security Plan. Approval of the 2026 REU Utility Security Plan does not authorize capital improvements or expenditures. Any future physical security improvements identi�ed in the plan would be subject to future City Council (Council) review and budget authorization through the applicable Electric Utility capital or operating budget. Alternative Action The Council may reject staffs recommendation and provide alternative direction. Background/Analysis Senate Bill 699 (2014) established the California Public Utilities Commission's (CPUC) regulatory authority over both investor-owned and publicly owned utilities (POUs) with respect to utility physical security. Under that authority, the CPUC issued Decision 19-01-018, which requires POUs to maintain physical security plans for distribution-1eve1 facilities, obtain an independent third-party review before plan adoption, secure adoption by the applicable loeal governing body, and rep�at that review and adoption process �very five years. As a POU, REU must eomply with those requirements, including identifying facilities that may merit special protection and developing measures to reduce identified risks and threats. Report to Redding City Council Apri129, 2026 Re: 4.5(a)--REU Utility Security Plan 2026 Page 2 To address the risk of long-term outages at distribution facilities, utilities were required to develop and implement physical security mitigation plans. The first REU Utility Security Plan was approved by the Council on June l, 2021. The 2026 plan is the required five-year update to that prior plan. It summarizes actions completed since 2021 and identifies additional physical security enhancements for the next planning period. In compliance with CPUC requirements, the plan was reviewed by an independent third party and validated before returning to the Council for approvaL Decision 19-01-018 expressly allows a governmental entity, such as a police department, to serve as the third-party reviewer if it is organizationally separate from the utility and has the appropriate expertise. The Redding Police Department (RPD) meets those criteria and is qualified to perform the third-party review. An RPD captain completed the assessment, which is included as an appendix to the Utility Security Plan. The assessment concluded that the substations reviewed do not require additional physical security mitigation work at this time, while also noting that the capital improveinents identified in the plan would improve substation resilience. The updated plan also identifies additional security enhancements, including improved access controls, expanded-metal anti-cut and anti- climb fencing, and upgraded substation lighting. The City's Deputy Fire Chief reviewed both the plan and the third-party assessment and validated the Utility Security Plan under the applicable CPUC guidelines. His validation summary is incl�uded as an appendix to the plan. If approved by the Council, staff will submit the revised Utility Security Plan to the CPUC by June 1, 2026. Because the plan contains sensitive security information,portions of the document are not available to the public. EnviNonmental Review This is not a project defined under the California Environmental Quality Act, and no further action is required. Council Pr�iority/City Manager Goals • This is a routine operational item. Attachments Previous Staff Report - REU Utility Security Plan 2021 REU Utility Security Plan 2026 - Redacted � i � � � � � � °- ' � ° � � ' � CITY OF REDDING � REPORT TO TI�E CITY COUNCIL MEETING DATE: June 1,2021 FROM: Daniel Beans, Director of ITEM NO. 4.5(b) Electric Utility ***APPROVED BY*** �. � � � � � � �� Dani�l��'�"Yis; ir�ctar caf Elecfnc Ut�laty 5f19IZ ." S i�ri I�cMaa�d,Ass�stant City � � " 5,�2�/2421 dbeans@cityofredding.org btippin@cityofredding.org SUBJECT: 4.5(b)--Consider Redding Electric Utility's Report on Physical Security for Distribution Level Facilities and Utilit Securit Plan Recommendation Accept Redding Electric Utility's Public Report on Physical Security for Distribution Level Facilities; and approve the Utility Security Plan pursuant to Senate Bill 699 and the California Public Utilities Commission Phase I Decision Order, Instituting Rulemaking, regarding the physical security of electrical corporations. Fiscal Impact There is no fiscal impact related to accepting this report. AZteNnative Action The City Council (Council) could choose not to approve the Utility Security Plan and provide alternative direction to staff. Background/Analysis Senate Bill (SB) 699 is the existing law which states the California Public Utilities Commission (CPUC) has regulatory authority over both investor and publicly owned utilities (POUs). Under this authority, the CPUC implemented the Phase I Decision regarding physical security of utilities. POUs such as Redding Electric Utility (REU) must adhere to the physical security elements of the CPUC decision. The decision requires electric utilities to identify electric distribution assets that may merit special protection and measures to lessen identified risks and threats. To address the risk of long-term outages to a distribution facility, all utilities were required to develop and implement a physical security mitigation plan. The six-step plan is modeled on the security plan requirements set forth by the North America Electrie Reliability Corporation (NERC) Critical Infrastructure Protocol (CIP)-014. Report to Redding City Council May 25,2021 Re: 4.5(b)--Redding Electric Utility Security Plan Page 2 In addition to the security plan, REU� was required to have the plan reviewed by an independent third party and validated prior to being approved by the Council. Both the third-party reviewer and validating staff were required to have relevant physical security qualifications. The Redding Police Department (RPD) is quali�ed under the CPUC requirements to review the plan. The assessment of REU's physical security plan was conducted by an RPD Lieutenant and is included in the Utility Security Plan as an Appendix. In the assessment, RPD noted that the substations did not require additional physical security mitigation work; however, it was noted that the capital improvements outlined within REU's Utility Security Plan will improve the resilience of al1 substations. A1ong with preparing the attached physical security plan, REU staff incorporated additional security enhancements to implement in the �uture, such as security cameras near REU infrastructure and additional solid perimeter walls for select substations within the City of Redding (City). The City's Deputy Fire Chief, Jay Sumerlin, reviewed both the plan and the third-party assessment conducted by RPD. Deputy Fire Chief Sumerlin validated the Utility Security Plan under the guidelines required by the CPUC and his validation summary is provided as an Appendix to the Plan. If approved by the Council, REU's Utility Security Plan wi11 be submitted to the CPUC no later than July 10, 2021. Due to the sensitive information contained in REU's Utility Security Plan, portions of the document are not available to the public. Council Priority/City Manager Goals • Public Safety — "Work to improve all aspects of public safety to help people feel secure and safe where they live, work, and play in the City of Redding." • Government of the 21st Century — `Be relevant and proactive to the opportunities and challenges of today's residents and workforce. Anticipate the future to make better decisions today." Attachments REU's Utility Security Plan (available online) Report to Redding City Council May 25,2021 Re: 4.5(b)--Redding Electric Utility Security Plan Page 3 � , � �� ;r �;�Nt��""��°a��' �,. .�,�� a�,��'�Rt.�� ta�� i �r ' CJ�s�ri�ati�m ��CV�� ` �t�tcs� �.�' 1 �havs�r�,G:��r�� R�^a�i��• �:�u��l�� ?� � �k��Fl�r�I�tr�l ��nt�nt R��.�i�� ,�I�'�� `''' � C��ni�l 6��n:s �+�r�t�nt R�°�ei��°.?�i�"� , ��n,��t�� t� � P�rr�l�ha1i�� Iraitial,w�n�a P.��ri�a� N C:��~;�al�� .� 5 ,��n�ll��'aalt�r�ith hat�rra�� nt,�ssstt��it�r�fia ��+�,Rl.�t�� -- �' � Sh�ri��h�t�.. � w�Pu1 R��e=i�� _ � �:��,�I�k�� ' � Barr�Ti�pim �it�e I��mt�r R��i�^�'�tPRrc�,� ,� ��r��l�� "' R�.., 8 F�rr�l�f�iz� Fir��l�"s��nda Pewri�°a�� :: 4 .:b��A�ol��.�� :� s.- � P��.in��ib�rv��n�il h��tirr� �r'�ls°�9�:�PP� A�e,�nF��w,�v� �' � �6��;F h�r�t�wn��rt th�La��r�f�rr�aatoc rs. ��' i� � �� .��iN� � .��,:�. T�� ai�'t�ilit�r Titl� R�� rt�t�ss Fil� F"�L�Ii� RE�I"s Ut�lit��e a�rity Pl�r�ta��i►�t�l��rmlim��; i f i Electric Utilit� PUBLIG REPORT C�N REDDING E�ECTRIC UTILITY'S PHYSICA� SECURITY PRC�GRAM FOR DISTRIBUTIUN- LEVE� FACILITIES , - ��,��, ;�� , ''� �� , '�'� �,� irki�'�(1i';��YP �.dlr�luvr(r�if 11��'lii �9 q9{y�'��S�j s �.. Ili � � �r '"�r ' � , � �} �. .� � �� > ,�. �� v �, � '��'�'i' � � . � �a, �� ,, Ft, ��;� �� . . E, ��+," a � ��,�wa,, ' ? e " � u, �, �� ', � ,� ,'�iy� , �,� �� " ,a � � �,� June 1, 2Q26 1 � �°�� &� � I. Overview A. Goal of Utility Security Plan.............................................................................................................4 B. Description of Redding Electric Utility ...........................................................................................4 C. Results of Utility Security Plan Assessment.....................................................................................4 II. Background..........................................................................................................................................5 III. Plan Development Process.................................................................................................................6 A. Physical Security Principles.............................................................................................................b B. Utility Security Plan Development Process....................................................................................7 Step 1: Assessment/Plan Development.............................................................................................7 Step 1 A: Identify Covered Distribution Facilities ...............................................................................7 Step1 B: Perform Risk Assessment.......................................................................................................7 Step 1 C: Develop Mitigation Plan......................................................................................................7 Step2:Third-Party Review...................................................................................................................7 Step3: Validation.................................................................................................................................8 Step4: Adoption..................................................................................................................................8 Step5: Maintenance...........................................................................................................................8 Step6: Repeat Process........................................................................................................................8 IV. Identification of Covered Distribution Facilities (Step lA) ...............................................................8 A. Identification Factors......................................................................................................................8 B. Identification Analysis ................................................................................................................... 10 V. Risk Assessment (Step 1 B) .................................................................................................................. 11 A. Methodology................................................................................................................................. 11 B. Mitigation Measures...................................................................................................................... 11 C. Risk Assessment.............................................................................................................................. 13 2 � �$&� � � VI. Covered Distribution Facility Mitigation Plans (Step 1C)................................................................ 15 VII. Independent Evaluation and Response (Step 2) ........................................................................... 15 A. Requirements for Qualified Third-Party Review.......................................................................... 15 B. Identification of Third-Party Reviewer ......................................................................................... 15 C. Public Results of Third-Party Evaluation....................................................................................... 16 D. REU Response................................................................................................................................. 16 VIII. Validation (Step 3) ............................................................................................................................. 16 A. Selection of Qualified Authority................................................................................................... 16 B. Results of Qualified Authority Review.......................................................................................... 16 IX. Narrative Descriptions for tJtility Security Plan................................................................................. 16 A. Asset Management Program....................................................................................................... 16 B. Workforce Training and Retention Program............................................................................... 17 C. Preventative Maintenance Plan.................................................................................................. 17 D. Physical Security Event Training................................................................................................... 17 E. Communication Infrastructure Risk Assessment......................................................................... 17 F. Facility Design Features ................................................................................................................ 18 APPENDICES A. THIRD-PARTY REVIEW OF UTILITY SECURITY PLAN B. VALIDATION OF UTILITY SECURITY PLAN 3 � � � � � A. GC?AL C7� UTILC7Y S��URiI`Y I�LAN Ensuring the safety of its facilities is a top priority for Redding Electric Utility (REU), and REU prioritizes safety in all aspects of its design, operation, and maintenance practices.The overarching goal of this Utility Security Plan (Plan) is to describe REU's risk management approach toward distribution system physical security, with appropriate consideration of resiliency, impact, and cost. REU recognizes the importance of securing the safety and reliability of its electric system and, therefore, REU voluntarily participated in the California Public Utilities Commission's (CPUC) Physical Security proceeding and has undertaken this assessment. In the spirit of continued voluntary cooperation, REU offers the following in response to CPUC Decision 19-01-018. This Plan wili be reviewed and updated at least every five years from initial adoption.A notification of the program acceptance and notifications of future updates will be submitted to the CPUC within 30 days of adoption of the plan. B. C?�SCR'CF'TIC7N C.�F REL)C�ING �L�CTf�[C 11TILITI� REU services 47,273 meters within 61 square miles of service territory. REU has 763 miles of 12kV power lines, 72 miles of 1 15kV transmission lines, and 12 substations. ■ �■� �� ■ ��■■� The Redding Power Plant and Redding Power Step-Up substation will not be considered during this plan since they are not distribution level facilities. C. RE�U�TS OF 'llT1LITY SECIJRITY 1'I.AN ASSE�SM�NI' REU owns and operates eleven (11) 115kV to 12kV disfiribution substations and one (1) 13.8 kV to 1 15kV generation step up substation. Five substations have loads that are critical to the community normally connected to them. Due to varying circumstances (planned or unplanned outages), all substations could have critical loads 4 � ��&� � �� connected and therefore this Plan will treat all of REU's substations as "covered" under the ruling. After assessment, no facilities required mitigation plans, however, optional security measures have been identified for future incorporation as time and budget allows. . w REU has been operating its electric system for over 100 years. System protection for both public and asset safety has been paramount. In order to support a statewide improvement of how utilities address distribution level physical security risks, the California Municipal Utilities Association (CMUA), which is the statewide trade association for publicly owned utilities (POUs), coordinated with the state's investor owned utilities (IOUs) to develop a comprehensive Straw Proposal (Joint IOU/POU Straw Proposal) for a process to identify at-risk facilities and, if necessary, develop physical security mitigation plans. As a member of CMUA, REU staff participated in the development of the Joint IOIJ/POU Straw Proposal through a CMUA working group as well as through direct meetings with the IOUs. The Joint POU/IOU Straw Proposai set out a process for the following: (1) identifying if the utility has any high priority distribution facilities; (2) evaluating the potential risks to those high priority distribution facilities; (3) for the distribution facilities where the identified risks are not effectively mitigated through existing resilience/security measures, developing a mitigation plan; (4) obtaining third- party reviews of the mitigation plans; (5) adopting a document retention policy; (6) ensuring a review process established by the POU governing board; and (7) implementing information sharing protocols. The Risk Assessment and Safety Analytics (RASA) unit of CPUC's Safety and Enforcement Division filed a response to the Joint IOU/POU Straw Proposal that recommended various modifications and clarifications, including a six-step process. Additionally, RASA recommended that the utility mitigation plans include: (1) an assessment of supply chain vulnerabilities; (2) training programs for law enforcement and utility staff to improve communication during physical security events; and (3) an assessment of any nearby communication utility infrastructure that supports priority distribution substations. REU is following the process outlined in California Senate Bill (SB) 699 and issuing this report at this time to reflect its existing commitment to safety and to protecting its customers' investment by taking reasonable and cost-effective measures in an effort to safeguard key assets of its distribution system. Article XI, Section 7 of the California Constitution provides certain POUs with the authority to own and operate their own utility systems and self-regulate their operations. RE� as such is a municipal utility governed by the Redding City Council who serves as the Utility Commission. According to the ruling, the goal is "to establish system-wide industry standards that are aimed at addressing the potential risks and threats associated with a long-term outage at a distribution facility on a statewide basis...", "and...not designed to expand Commission [California Public Utility Commission] investigatory or penalty authority against the POUs." REU is a department within the City of Redding. For security, crime prevention, and response, REU 5 � E��a �„ � is subordinate to the City of Redding Police Department (RPD). r A. PNY�ICAL SECUl�1TY Pf�INCIPLES The Joint IOU/POU Straw Proposal sought to support the creation of a risk management approach toward distribution system physical security, with appropriate considerations of resiliency, impact, and cost. In order to accomplish this risk-based approach, the Joint IOU/POU Straw Proposal identified several principles to guide the development of each individual utility's program. These principles are the following: 1. Distribution systems are not subject to the same physical security risks and associated consequences,including threats of physicai attack by terrorists,as the transmission system. 2. Distribution utilities will not be able to eliminate the risk of a physical attack occurring, but certain actions can be taken to reduce the risk or consequences, or both, of a significant attack. 3. A one-size-fits-all standard or rule will not work. Distribution utilities should have the flexibility to address physical security risks in a manner that works best for their systems and unique situations, consistent with a risk management approach. 4. Protecting the distribution system should consider both physical security protection and operational resiliency or redundancy. 5.The focus should not be on all Distribution Facilities, but only those that risk dictates would require additional measures. 6. Planning and coordination with the appropriate federal and state regulatory and law enforcement authorities will heip prepare for attacks on the electrical distribution system and thereby help reduce or mitigate the potential consequences of such attacks. Additional principles that guide REU include: 7. Increase the level of security through situational awareness and technology as provided by REU's Wildfire Mitigation Plan - Technology Solutions Program (WMP-TSP) and the Emergency Operations Program (WMP-EOP). 8. Ensure the distribution system provides reliability through redundancy. 9. Provide opportunities to better coordinate with Law Enforcement,specifically RPD. 10. Incorporate the security features described in this plan at new or modified substations. 11. Ensure industry best practices are considered and implemented as appropriate and cost-effective. 6 � �' � � � B. �Jtility �ecurifiy Plar� ��Ic�pm�nt Prc�cess The major focus of this Plan is to address the risks and threats of a long-term outage to a distribution facility. Clearly, a long-term outage at any distribution facility poses numerous safety issues. This Plan describes the range of activities that REU is taking or considering to protect its distribution assets, including its various programs, policies, and procedures. This Plan complies with the requirements of CPUC section 364 for publicly owned electric utilities to prepare a physical security plan by July 10,2021,and every five years thereafter.The Plan will be iterative, promote continuous improvement, and represent best efforts to implement industry best practices in a prudent and reasonable manner. REU utilized a multi-step process to develop this Utility Security Plan that is consistent with the Joint IOU/POU Straw Proposal and D.19-01-018.The relevant six steps of that process are the following: STEP 1: ASSESSMENT/PLAN DEVELOPMENT REU staff prepared a Draft Utility Security Plan through the process set forth in Steps 1 A, 1 B, and 1 C. STEP 1A: IDENTIFY COVERED DISTRIBUTION FACILITIES REU evaluated all distribution-level facilities in its service territory that are subject to its control to determine if any facility meets D.l 9-Ol-Ol 8's definition of a "Covered Distribution Facility" using the seven factors identified in the Joint IOU/POU Straw Proposal. STEP 1 B: PERFORM RISK ASSESSMENT For every individual Covered Distribution Facility identified pursuant to Step 1 A, REIJ will perform an evaluation of the potential risks associated with a successful physical attack on that Covered Distribution Facility, and whether existing grid resiliency, back-up generation, and/or physical security measures appropriately mitigate identified risks. STEP 1 C: DEVELOP MITIGATION PLAN In developing the Mitigation Plan, REU assessed the potential risks of our identified "Covered Distribution Facilities," considered the existing protection, and developed further protection measures as necessary to increase facility resiliency. STEP 2: THIRD-PARTY REVIEW For every Utility Security Plan cycle, REU will document the results of the identification process, risk 7 � C�� ;� � assessment, and Mitigation Plan development performed pursuant to Steps 1 A, 1 B, and 1 C. This documentation in combination with narrative description in Section IX below constitutes REU's Draft Utility Security Plan. Each Draft Utility Security Plan is submitted to a Qualified Third-Party for Independent Review.The Qualified Third-Party Reviewer will then issue an evaluation that identifies any potential deficiencies in the Draft Utility Security Plan as well as recommendations for improvements. REU will then modify its plan to address any identified deficiencies or recommendations, or will document the reasons why any recommendations were not adopted. REU's Utility Security Plan will consist of the Draft Utility Security Plan, the non-confidential conclusions of the Qualified Third-Party Reviewer, and REU's responses to the Qualified third-party review. STEP 3: VALIDATION Under guidance of the California Public Utility Commission, validation of REU's Plan was conducted by the City of Redding Deputy Fire Chief on August 28th, 2025, prior to approval from the City Council. A validation memo is attached as an Appendix to the Pian. STEP 4: ADOPTION REU's Utility Security Plan will be presented to and adopted by the Redding City Council at a public meeting. STEP 5: MAINTENANCE REIJ will refine and update the Utility Security Plan as appropriate and as necessary to preserve plan integrity. STEP 6: REPEAT PROGESS REU will repeat this six-step process at least once every five years. r • r r • As described in Section Iil,Step 1 A, the Utility Security Plan identification process involves assessing all distribution-level facilities that are subject to the control of REU to determine which facilities are "Covered Distribution Facilities" and require a risk assessment. This Section describes the factors that REU used to evaluate its distribution facilities and the results of its evaluation. A. IDENTIFICAT:IUN FACTC?I�� The Joint IOU/POU Straw Proposal defines seven screening factors to determine if a facility is a "Covered Distribution Facility." Some factors require additional definitions and/or clarifications in 8 � �-' � � �' order to be applied to REU's facilities. The following Table provides the Joint IOU/POU Straw Proposal's Factors as modified/clarified by REU. Factc�r Jc�int IC�UIPC7U Straw Prc�p€�sal flescriptic�n Adclitional C1a�ri�icatic�n Distribution Facility necessary for crank path, Facilities subject to CAISO operational black start or capability essential to the control or subject to NERC CIP 014-2 will be restoration of regional electricity service excluded. that are not subject to the California 1 Independent System Operator's (CAISO) operational control and/or subject to North American Electric Reliability Corporation (NERC) Reliability Standard CIP-014-2 or its successors Distribution Facility that is the primary source Only sites essential to national security or of electrical service to a military installation emergency responses (For example, this essential to national security and/or would exclude recruiting offices) 2 emergency response services (may include certain airfields, command centers, weapons stations, emergency supply depots) Distribution Facility that serves installations Water treatment and wastewater necessary for the provision of regional treatment with throughput equal to or 3 drinking water supplies and wastewater greater tnan one hundred (100) million services (may include certain aqueducts, gallons per day (mgd). well fields, groundwater pumps, and treatment plants) Distribution Facility that serves a regional REU defines "regional public safety public safety establishment (may include establishment" as any of the following: (1) County Emergency Operations Centers; Headquarters of a major police or fire county sheriff's department and major city department serving 1.5 million population police department headquarters; major with at least 1,000 sworn officers; (2) 4 state and county fire service headquarters; County Sheriff's Department county jails and state and federal prisons; Headquarters; (3) County Emergency and 91 1 dispatch centers) Operations Center; (4) County/State Fire headquarters; (5) a California Stafie Prison; (5) a United States Penitentiary; or (6) a Federal Correctional instifiute. Distribution Facility that serves a major In addition to the facilities listed in the transportation facility (may include Joint IOU/POU Straw Proposal, REU defines International Airport, Mega Seaport, other a "major transportation facility" as any 5 air traffic control center, and international transportation facility that has (1) an border crossing) average of 600 or more flights per day; or (2) over 50,000 passengers arriving or departing per day. Distribution Facility that serves as a Level 1 No additional clarification. 6 Trauma Center as designated by the Office of Statewide Health Planning and Development Distribution Facility that serves over 60,000 Applies to the collective sum of ineters for � meters single point failures, which may include downstream assets. 9 � �$&� � � B. IL7�NTf�ICATIC7N ANALY�IS In performing this identification analysis, REU assessed all distribution level facilities that are subject to its exclusive control, or if the facility is jointly owned, facilities where the joint ownership agreement identifies REU as the entity responsible for operation and maintenance. The specific types of facilities include the substations. Ta le 1 I entific tion of " overe F cilities" Airpc�rt-Redding �eltline Canby ; �Cc�llec�e View 'East Reddinc� �ureka Way '�1c��re Road C�re�an Stree# Sulphur Creek `T�xa�Sprinc�� Waldc�n . .......... � � � � � ��a,�, � '� � � � , � � � � � �,��.� ��,��nnnn��, , �� :a�, � � � „h.,...a,.�,.� �,�. ..i i t.J..��u '- .e .� :1. , at�h4.�. _ _ _ _ _ . _ _ _ �� ■ � � � � � � � ■ � � � � � � �I � � � � � � � � � � �� ■ � � � � � � �I � � � � � � �1 � � � � � � � � � � � � � �I � � � � , � � � ■ � � � 10 � � �� , �� A �W l�� Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, REU assessed the potential risks associated with a successful physical attack on each of the Covered Distribution Facilities identified in Section IV. For the purpose of this analysis, a physical attack is limited to the following: (1) theft; (2) vandalism; and (3) discharge of a firearm. A "successful physical attack" is limited to circumstances where a theft, vandalism, and/or the discharge of a firearm has directly led to the failure of any elements of the Covered Distribution Facility that are necessary to provide uninterrupted service to the specific load identified in Section IV. In order to perform this risk analysis, REU evaluated the relative risk that (1) a physical attack on a Covered Distribution Facility will be successful considering the protective measures in place; or (2) the impacts of a successfui attack will be mitigated due to resiliency and other measures in place. B. t�IITIGATCC7N M�A�l1R�S D.19-01-018 identifies the specific mitigation measures that a utility should consider when performing this risk analysis. The following table lists these mitigation measures and provides REU's additional clarifications that are necessary to apply these measures to REU's territory. M+�c�sure C��9-Cli-018 Descr�ptic�n Adc�itic�nc�l Clar��icatic�n The existing system resiliency and/or No additional clarification. redundancy solutions (e.g.,switching the � load to another substation or circuit capable of serving the load, temporary circuit ties, mobile generation and/or storage solutions). The availability of spare assets to restore a No additional clarification. Z particular load. The existing physical security protections to No additional clarification. 3 reasonably address the risk. The potential for emergency responders to Each facility is evaluated based on identify and respond to an attack in a fihe likelihood that a law enforcement timely manner. officer would generally be able to arrive at the Covered Distribution 4 Facility within 15 minutes of a report from the public of a break-in or attack, or of REU notifying the law enforcement agency of triggering of an alarm at the facility. 11 � �� 4v �� Location and physical surroundings, REU evaluated this element based on including proximity to gas pipelines and the proximity of the Covered geographical challenges, and impacts of Distribution Facility to populated areas 5 weather. and the extent to which the interior of the facility is shielded from view and access due to walls, vegetation, or other physical obstructions. History of criminal activity at the Distribution REU evaluated the property crime Facility and in the area. rates in the immediate vicinity of the Covered Distribution Facility and 6 compared those crimes rates to property crime rates for the county and the state to determine if the area is subject to a higher than average incidence of property related crimes. The availability of other sources of energy No additional clarification. 7 to serve the load (e.g., customer owned back-up generation or storage solutions). The availability of alternative ways to meet No additional clarification. $ the heaith, safety, or security. Requirements served by the load (e.g., No additional clarification. 9 back up command center or water storage facility). While all "covered" facilities have adequate physical security and resilience, there are additional technologies and cooperation underway in order to increase situational awareness by both utility operations and law enforcement. These enhancements have been defined and budgeted through REU's Wildfire Mitigation Plan-Technology Solutions Program and Wildfire Mitigation Plan - Emergency Operations Program. Many of these measures were completed by the July 2021 deadline as listed below. Within the Ruling, there are four strategies where this Plan, through the implementation of the WMP-TSP, and WMP-EOP, and planned capital improvements, will enhance our existing physical security measures: 1. Response Time-Measures to improve the potential for emergency responders to identify and respond to an attack in a timely manner; 2. Deterrent - Measures to discourage unauthorized entry or breach of the facility (e.g., cameras, lights); 3. Access-fences, gates, barriers, or other security devices; and 4. Coordination-Measures to collaborate with law enforcement. The WMP-EOP includes the implementation of a Department Operations Center (DOC) where all of the information from the cameras, our utility operations SCADA system, GIS systems, and other fire awareness technology are gathered.The DOC becomes a physical place to coordinate with first responders,and the technology of the DOC provides virtual coordination to utility staff and first responders. All of these strategies and technologies combine to provide enhanced situational awareness.This, along with improved planning, coordination, and training with RPD provides a very high level of 12 � �� security for REU's distribution assets. ' �� ' �� ■�� C. RI�K A$5ES5M�NT Based on the process described in the Joint IOU/POU Straw Proposal and the direction provided in D.19-01-018, REU has determined that of the five Covered Distribution Facilities identified in Section IV, the existing programs and measures effectively mitigate the risks of a physical attack for all of those Covered Distribution Facilities. 13 � G' &� �„ c� � 0 0 0 �� ■ ■ ■ �� ■ �■� �� .�t ,_,�.,, � � � :� ■ ■ ■ ■ ■ ■ ■ � � � ■ ■ ■ ■ ■ ■ ■ � � � ' ■ ■ ■ ■ ■ ■ ■ � � ; - � � � � � � � � I � � � � � � � � � I � ■ ■ ■ ■ ■ ■ ■ � � ' � � � � � � � � � I �I � � � � � � � � i � � � � � � � � � � � � � � � � � � � � ■ ■ ■ ■ ■ ■ ■ � � , As identified above, all of the Covered Distribution Facilities have existing measures sufficient to effectively mitigate the identified risks of a physical attack. In addition to the physical security measures, our distribution system has flexibility and redundancy built into it through field switching. We are able to feed critical loads from different distribution 14 � �� transformers and even different substations. Redding's system currently has spare substation capacity even during our highest peak periods. Due to this capacity,we have been able to take one or more entire substations offline in order to facilitate major system upgrades. That same approach could be used in the event of an unplanned issue. Redding also has a new and unused substation transformer at the College View Substation that could be relocated and instalied in the event of a catastrophic failure. Other inventory includes transformer bushings, CCVTs, protective relays, circuit breakers, and other critical components. r r • Pursuant to the process identified in the Joint IOU/POU Straw Proposal and D.19-01-018, REU has determined that for the Covered Distribution Facilities subject to REU's control, the existing mitigation measures sufficiently reduce the risk of a physical security attack: • Existing Resiliency • Spare Assets • Existing Physical Security • Prompt Emergency Response • Location • Criminal History • Backup Generation • Alternate Solutions r r • • • r A. I�"EC�UiE2EMENTS FU�Z C�UALIFiEL7 THIRI�-PARTY i2�VlEW ' D.19-01-018 specifies the following criteria for a Qualified Third-Party Reviewer: Independence: A Qualified Third-Party Reviewer cannot be a division of fihe POU. A governmental entity can select as the Third-Party Reviewer another governmental enfiity within the same politicai subdivision, so long as the entity has the appropriate expertise, and is not a division of the POIJ that operates as a functional unit, i.e., a municipality could use its police department as its Third-Party Reviewer if it has the appropriate expertise. Adequate Qualifications: A Qualified Third-Party Reviewer must be an entity or organization with electric industry physical security experience and whose review staff has appropriate physical security expertise, which means that it meets at least one of the following: (1) an entity or organization with at least one member who holds either an ASIS International Certified Protection Professional (CPP) or Physical Security Professional (PSP) certification; (2) an entity or organization with demonstrated law enforcement, government, or military physical security expertise; or (3) an entity or organizafiion approved to do physical security assessments by the CPUC, Electric Reliability Organization, or similar electrical industry regulatory body. B. IdENT1F1CATlUN C}F TF�IRD-PAf�TY l2E�IIEWER REU has selected RPD as its Third-Party Reviewer. As a municipality, under D.19.01.018, RPD has the appropriate expertise to act as the Third-Party Reviewer. 15 � � � �� RPD will conduct the independent review. RE� coordinates with RPD and is subordinate for emergency and public safety issues. REU will work closely with RPD for situational awareness and other public safety issues related to this Plan. RPD will review this Plan and provide comments for consideration by REU. If any suggested changes are not incorporated, justification will be documented and included in Appendix A. C. P��llBLIC RE5ULTS U� TN�RL�-PARTY '��RE�II�W The Redding Police Department completed their review of REU's Utility Security Plan and visited numerous substation sites. The Independent Review is attached as Appendix A. D. REU RESPt�NSE REU met with the Third-Party Reviewer (RPD) and concurs with the recommendations listed in Appendix A. . , . A. ��L�CTION C�� C.��.IALIFI'EC) Al1THt�RITY Under guidance of tne California Public Utility Commission, validation of REU's Plan was conducted by the City of Redding Deputy Fire Chief prior to City Councii approval and is attached as Appendix B. B, RESULTS �7F :QUAL.I�IE[�, AUTHCJRITY I�EVIEW REU concurs with both the third-party review and validation report conducted by security experts from the Redding Police and Redding Fire Departments. . . ' . f�. ASSET MANACEMENT PRC'J�k'AM ' In 2007 REU began implementing fihe substation modernizafiion program that was completed in 2019. The program upgraded all substation controls and protection systems with standardized components.This approach reduced the quantity of spare parts needed as the same equipment is used in all substations for controls and protection. REU has both a central warehouse as well as spare part inventories at each substation. There are spare parts for all substation components, including a 28MVA 1 15kV/12kV transformer and a 2000A 115kV SF6 circuit breaker,which are the highest cost and longest lead time items. REU's 115kV SF6 circuit breakers have a significant service life remaining, allowing for alternative technologies to mature before REU needs new breakers. CARB's SF6 ruling will not impose major 16 � �' � �� complications to REU's service. REU participates in the Electricity Information Sharing and Analysis Center (E-ISAC) for physical security notifications as well as coordination through various joint power authorities. REU is also a member of the California tJtilities Emergency Association (CtJEA) for fast response mutual aid. B. WC�I�I��CUR�E TI�AINI�IC� AIJC7 C2ETENTI(�'N I�RC�GRAN1 REU conducts annual salary and compensation studies for recruitment and retention of highly qualified staff. By maintaining well-trained and qualified employees, REU is able to respond quickly to any equipment needs or repairs within the City of Redding substations. Inventory of equipment for substations is monitored and kept on hand to ensure a timely response to any issues that may arise.Since training for technical staff is a high priority, REU has a substation controls training station for testing new products and improving competency for existing equipment used in the substations. C. PE�E�/ENTATI�JE MAINTENANCE PLAN REU performs weekly and monthly inspections of substation equipment, recording gas levels and operation counts, and noting other visible flaws that may need attention. A Work Order tracking system has been implemented to ensure the completion of open work orders. REU has also developed a GO-174 compliant inspection program and implemented the use of IR equipment. L7. PHYSI�AL S�CUI�ITY EU�N7 `CI�AINING REU's DOC performs two emergency operations (EOPS) drills each year that incorporate substation security training with all departments in Redding Electric Ufiility. E. CUMMUNI�ATIt�N INFRA�TRUCTl112E RISK AS�ESSMENT It was previously identified that the citywide radio equipment on Southfork Mountain, west of the City of Redding, was subject to both wildfire and snowstorms, which impacted emergency radio communication within the City of Redding. REU has since replaced the citywide radio system for public safety and utility infrastructure. The new radio sites were placed within the city limits, reducing the impacts of poor weather conditions and public safety power shutoffs (PSPS). 17 � �� , �� F. FACILI7'Y C�ESIGN FEATl1RE� ' As part of the risk mitigation to the substations, REU has pursued various security measures for installation. � 18 � C �� REVISION HISTORY Versian Revision Summary of Changes Number Date 1.0 6/1/21 Initial 2.0 6/1/26 Reviewed and revised report formatting. Removed Exhibits A and D through J; CPUC ruling, maps, SOPs, programs, and fence specifications. 19 � C �� PPE DI� ��I�I�-P �� RE IE F TILITY � �IT� PL This Page Intentionally Left Blank � iTv X� �. i � . ..r � i " ��;� � _�� DATE: August 12, 2025 TO: Director Nick Zettel, Redding Electric Utility FROM: Captain Chris Smyrnos, Redding Police Department �'��"� SUBJECT: REU SB 699 (2014)Utility Security Plan Independent Review On J�uly 30, 2025, I met with Redding Electric Utility (REU) Electric Program Supervisor (Substations)Clint Torrence and was provided with REU's Utility Security Plan to conduct a third- party independent review. This independent review is required under California State Senate Bill (SB) 699 (2014). I have reviewed the Utility Security Plan in its entirety, conducted multiple physical inspections of several of the substations identified in the Plan, and will offer my recommendations. I have been employed as a law enforcement officer with the City of Redding Police Department for the past 22 years and am currently a captain in charge of the Field Operations Division. My background includes work in all areas of policing,to include Patrol,Dispatch, and Administration. I previously served in our Neighborhood Police Unit where we regularly met with business and other community members to discuss the physical security of buildings and property. I have investigated numerous crimes involving the unlawful entry of buildings and property and I am familiar with the means and methods used by criminals to commit these violations. While conducting site survey assessments, several factors are taken into consideration that include: overall security measures in place, ingress and egress routes, general construction, hazardous materials,internal/external security risk�, crime prevention measures, target hardening, situational awareness, and future plans to improve security at these locations. The City of Redding Utility Security Plan is a comprehensive plan which has been implemented and has taken numerous steps to protect the infrastructure of the City's electric utility, specificaIly related to the substations noted below. The Plan clearly identifies the goals of ensuring the safety of its facilities as the top priority for REU. There are multiple REU facilities throughout the City that include a Power Control Center, a Department Operations Center, one (1) Generator Step-up substation, and eleven (11) distribution substations. Although the security requirem�nts of SB 699 (2014) are specific to "Critical Distribution Facilities" I noted in REU's Security Plan the intent is to ensure all distribution substations are treated the same as related to security. Below is a complete list of REU's distribution substations. Subskati€rn�'acilities Airport-Redding Substation Beltline Substation Canby Substation Collegc Vicw Substation East Redding Substation Eureka Way Substation Moore Road Substation Oregon Street Substation Sulphur Creek Substation Texas Springs Substation Waldon Substation - � Oregon Street and Waldon substations have additional security features in place. After reviewing the Utility Security Plan and visiting several substations, I recommend continuing to make the improvements outlined in the plan. As noted in the last security assessment, To complete my review of REU's Utility Security Plan, I feel it is a detailed and comprehensive plan. The written Plan is comprised of several areas including: - Overview - Background - Plan Development Process - Identification of Covered Distribution Facilities - Risk Assessment - Covered Distribution Facility Mitigation Plans - Independent Evaluation and Response - Validation - Narrative Descriptions for Utility Security Plan - Appendices In my opinion, REU's written Utility Security Plan has adequately provided specific details, making this an effective security plan for the City's electric utility distribution infrastructure. This Plan provides safety measures needed for critical infrastructure as identi�ed through SB 699 (2014). PPE DI� B LI� �I � TILITY E RITY PL This Page Intentionally Left Blank { � � �� " INTERNAL _ � µ COMMUNIGATION DATE: August 28th, 2025 TO: Director Nick Zettel, Redding Electric Utility(REU) FROM: Deputy Fire Chief Jay Sumerlin, City of Redding SUBJECT: REU SB 699 (2014) Utility Security Plan Validation as required by the California Public Utilities Commission (CPUC) On August 13th,2025,I received a copy of the REU Utility Security Plan,including an independent security review performed by Capt. Chris Smyrnos from the Redding Police Department. In addition, I made a site visit to a substation facility with REU Program Supervisor (Substations), Clint Torrence and found that the substation security complies with the written security plan. The REU substation security measures, as documented in the Plan, are both thorough and appropriate to mitigate criminal activity on or near the distribution facilities. My knowledge and experience related to emergency operations as well as criminal activity provide me with the appropriate training to validate REU's Utility Security Plan. I have been employed with the Redding Fire Department as the Deputy Fire Chief for six years.Before my current position, I served another fire agency in Washington State for over twenty-seven years. I have many hours of training in Emergency Planning, Emergency Response to Terrorism, and I am a liaison to the Fusion Center. In addition, I held the Local Emergency Planning Committee Chair and have been part of an FBI Joint Terrorism workgroup in Washington State. The REU Security plan is well written and comprehensive. In addition, the recommendations for capital improvements outlined in the plan and that of the independent evaluatar will enhance site security, adding additional elements of threat detection that will aid law enforcement in protecting the power grid. Therefore, in my review of the REU Utility Security Plan and the independent review conducted by the Redding Police Department, I have determined that the plan and independent review are valid under the guidelines required by the CPUC decision for Publicly Owned Utilities. This Page Intentionally Left Blank