1. Simple Tabletop Exercise Objectives:  Evaluate cyber security protocols and procedures  Consider to what degree reliance on SCADA Systems is appropriate  Determine a utility’s ability to “fly solo” (operate without a SCADA system)

2. Zenith City, USA  Located in upper Midwest  20 o F winter/78 o F summer  90,000 people in five boroughs  Historic manufacturing center beginning to attract tourists and conventions  Air, rail, and road transport

3. Zenith City, USA  City government is council/manager form with elected mayor  Fire and rescue services provided by Zenith City Fire Department  City served by four hospitals: St. Michaels (75 beds), Sacred Heart (100- bed facility w/ helipad), North End (50 beds) and Zenith City (50 beds)

4. Zenith City, USA  Constructed on glacial sediments, including sands and gravels that supply water  City receives its drinking water from both surface water and ground water sources

5. Zenith City, USA  Surface water is pumped from the Crystal River to supply drinking water to Zenith City  Alta City, Zenith City’s neighbor to the south, also derives its water supply from the Crystal River  Water treatment consists of coagulation, flocculation, sedimentation, filtration and disinfection. In addition, softening, pH adjustment and fluoridation are also performed.

6. Zenith City, USA  Pumping stations have capacity of 5 MGD, and system can store up to 3 MG  4 supply wells, 4 storage tanks, and 130 miles of distribution pipeline  Many homes and businesses lack backflow prevention valves.

7. Zenith City, USA  Wastewater services are provided in the southern portion of the city via a secondary wastewater treatment plant.  There are two stormwater outfalls: one located along the West River and the other on the Crystal River.

8. Summer  The city just ended its fiscal year  Declining department budgets have led to layoffs  National Threat Advisory Level: Yellow

9. Zenith City Simple Tabletop Exercise After Action Review (“Hot Wash”) Discussion Points

10. Verification That Exercise Objectives Were Met:  Evaluate cyber security protocols and procedures  Consider to what degree reliance on SCADA Systems is appropriate  Determine a utility’s ability to “fly solo” (operate without a SCADA system)