CAPITAL WORKPAPERS TO PREPARED DIRECT …

1 (U 904-G)COMPANY for authority to update its gas revenue requirement and base rates OCTOBER 2017 Application of SOUTHERN california GASeffective January 1, 2019))))Exhibit No.: (SCG-27-CWP) CAPITAL WORKPAPERS TO PREPARED DIRECT TESTIMONYOF GAVIN H. WORDENON BEHALF OF SOUTHERN california GAS COMPANYBEFORE THE PUBLIC UTILITIES COMMISSIONOF THE STATE OF CALIFORNIAA pplication No. 17-10-___2019 General Rate Case - APPINDEX OF WORKPAPERSE xhibit SCG-27-CWP - CYBER SECURITYPAGEDOCUMENTO verall Summary For Exhibit No. SCG-27-CWP 1 Category: A. PROTECT - RAMP - INCREMENTAL PKI REBULD - RAMP - INCREMENTAL FIREWALL SECURITY - RAMP - INCREMENTAL FOF - CONVERGED PERIMETER SECURITY - RAMP - INCREMENTAL FOF - HOST BASED PROTECTION - RAMP - INCREMENTAL EMAIL SPAM PROTECTION - RAMP - INCREMENTAL IS ZONE REBUILD - RAMP - INCREMENTAL SECURITY ORCHESTRATION - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - 2018 - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - 2019 - RAMP - INCREMENTAL CASB

2 (CLOUD DATA USE) - RAMP - INCREMENTAL WEB APPLICATIONS AND DATABASE FIREWALLS - RAMP - INCREMENTAL ENTERPRISE SOURCE CODE SECURITY - RAMP - INCREMENTAL WIRED NETWORK PREVENTATIVE CONTROLS - RAMP - INCREMENTAL MULTI FACTOR AUTHENTICATION REFRESH - RAMP - INCREMENTAL MY ACCOUNT MULTI FACTOR AUTHENTICATION 113 Category: B. DETECT - RAMP - INCREMENTAL THREAT RESPONSE SYSTEMS - RAMP - INCREMENTAL THREAT RECOVERY SYSTEMS - RAMP - INCREMENTAL SCG NETWORK ANOMALY DETECTION PHASE 1 - RAMP - INCREMENTAL INSIDER THREAT DETECTION / PREVENTION - RAMP - INCREMENTAL SSL DECRYPTION - RAMP - INCREMENTAL NETWORK SECURITY MONITORING - RAMP - INCREMENTAL PERIMETER TAP INFRASTRUCTURE REDESIGN - RAMP - INCREMENTAL THREAT DETECTION SYSTEMS 173 Category: C.

3 RESPOND - RAMP - INCREMENTAL FORENSICS SYSTEM REBUILD - RAMP - INCREMENTAL INCIDENT RESPONSE SECURE COLLABORATION 192 Category: D. IDENTIFY - RAMP - INCREMENTAL ENTERPRISE THREAT INTELLIGENCE - RAMP - INCREMENTAL THREAT IDENTIFICATION SYSTEMS 209 Overall Summary For Exhibit No. SCG-27-CWP In 2016 $ (000)Adjusted-ForecastArea:Witness:CYBER SECURITYG avin H. Worden201720182019A. PROTECT10,51516,0854,807B. DETECT5,6531,47713,193C. RESPOND2021,9140D. IDENTIFY1,47404,731 Total17,84419,47622,731 Note: Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.

4 WordenPage 1 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Summary for Category: A. PROTECTA djusted-ForecastAdjusted-RecordedLabor08 131,035398 Non-Labor08,86815,0504,409 NSE083400 Total010,51516,0854, RAMP - Incremental PKI RAMP - Incremental Firewall RAMP - Incremental FOF - Converged Perimeter Security0011670 Labor002,4001,200 Non-Labor0000 NSE002,5161, RAMP - Incremental FOF - Host Based Protection0011623 Labor002,1510 Non-Labor0000 NSE002, RAMP - Incremental Email Spam Protection001050 Labor001470 Non-Labor008340 NSE001.

5 Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 2 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Adjusted-RecordedAdjusted-Forecast00758K RAMP - Incremental IS Zone RAMP - Incremental Security Orchestration0010535 Labor001,600150 Non-Labor0000 NSE001, RAMP - Incremental Critical Gas Infrastructure Protection001740 Labor001,5000 Non-Labor0000 NSE001, RAMP - Incremental Critical Gas Infrastructure Protection - 2018000291 Labor0002,000 Non-Labor0000 NSE0002, RAMP - Incremental Critical Gas Infrastructure Protection - 2019232000 Labor4,000000 Non-Labor0000 NSE4, RAMP - Incremental CASB (cloud data use)

6 00093 Labor0002,800 Non-Labor0000 NSE0002, RAMP - Incremental Web Applications and Database Firewalls000128 Labor0002,100 Non-Labor0000 NSE0002, : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 3 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Adjusted-RecordedAdjusted-Forecast00758U RAMP - Incremental Enterprise Source Code Security360080 Labor0001,100 Non-Labor0000 NSE36001, RAMP - Incremental Wired Network Preventative Controls6000175 Labor0003,200 Non-Labor0000 NSE60003, RAMP - Incremental Multi Factor Authentication Refresh000140 Labor0002,500 Non-Labor0000 NSE0002, RAMP - Incremental My Account Multi Factor : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No.

7 SCG-27-CWP/Witness: G. WordenPage 4 of 216 Beginning of Workpaper Group00758A - RAMP - Incremental PKI RebuldSouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 5 of 216 CYBER SECURITYG avin H. - RAMP - Incremental PKI RebuldArea:Witness:Category:Category-Sub :Workpaper Group:Budget Code:A. PROTECT1. PROTECTS ummary of Results (Constant 2016 $ in 000s):Forecast MethodAdjusted RecordedAdjusted enterprise PKI currently uses the SHA-1 signature algorithm. SHA-1 algorithm has been widely used since1985 but is vulnerable to hacking and is no longer recommended for PKI.

8 Microsoft, Google and other major providers will not recognize certificates signed using SHA-1 after January 1, 2017. The impact to our users (and potentially customers) will be a series of escalating trust notifications beginning December 2015 and eventual loss of access to Purpose:To secure our websites, intranet communications and applications we must build a new PKI infrastructure using SHA-2 in parallel to the current SHA-1 PKI and issue new certificates to all dependent Description:Enhance security of company websites, intranet communications and applications.

9 Certificate Authorities servers will enable consolidation of systems, simplify support and reduce support complexity. Upgrade to MS Server 2012 will improve high-volume certificate issuance and certificate enrollment across Active Directory Domain Services forest Justification:Note: Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 6 of 216 CYBER SECURITYG avin H. - RAMP - Incremental PKI RebuldArea:Witness:Category:Category-Sub :Workpaper Group:Budget Code:A.

10 PROTECT1. PROTECTF orecast Methodology:Labor - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedN/ASouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 7 of 216 Beginning of Workpaper Sub Details forWorkpaper Group 00758 ASouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 8 of 216 Workpaper Group:Witness:Budget Code:Area:Workpaper Detail:In-Service Date:Description:CYBER SECURITYG avin H.