Hi Jonathan – Thank you for reaching out. I have connected with fellow IT and Engineering staff and have two follow up responses below for you below. I am hoping that these address the primary concerns outlined in your earlier email. Staff and I will plan to be at City Council meeting tonight (starts at 6pm) to help answer any additional questions regarding items 4D and 4F.
Item 4F – Aclara
The City’s Advanced Metering Infrastructure (AMI) system uses Aclara to collect water meter readings, including the account number, meter read, and the date and time of the reading. Customer information is uploaded daily from the City’s financial system into Aclara to support Utility Billing research and customer service activities. Regarding data retention, Aclara retains approximately three years of meter-reading history in its cloud environment, while the City’s on-premises database currently retains the data indefinitely. Access to individual household water-use histories is restricted to staff who have been provided an Aclara account based on specific job responsibilities.
Data transmissions are encrypted, and data stored within Aclara’s cloud environment and the City’s SQL databases are also encrypted. Access is restricted based on role and activity is logged. Data may be released through the public records request process, and the City’s use of meter data is limited to billing, system maintenance, leak detection, customer-requested services, and integration with WaterSmart, a customer-facing water conservation and leak-detection platform. Aclara personnel has remote access to customer data when performing maintenance or supporting system infrastructure, such as work related to the data collection units (DCUs) that receive meter transmissions.
- Advanced Metering Infrastructure (AMI): A system of smart water meters and communications equipment that automatically collects and transmits meter readings without requiring manual meter reading.
- Aclara: The vendor platform used by the City to collect, store, and manage automated water meter readings.
- Data Collection Unit (DCU): Communications equipment that collects data transmitted from smart meters and forwards it to the utility’s management systems.
Item 4D -ProjectTeam Cloud Platform
IT and Information Security reviewed the vendor’s controls and confirmed that several key security requirements have been met. The vendor verified that multifactor authentication (MFA) will be required for all City employees, contractors, and vendor accounts. The application further provides Role-Based Access Controls (RBAC) for granular user authentication and enforcement of least-privilege access. In addition, the vendor confirmed that all City data and backups are encrypted both in transit and at rest, helping protect sensitive information throughout its lifecycle. The review also found that the vendor has undergone recognized security assessments and maintains GovRAMP and FedRAMP compliance (please see below for more information), while its hosting provider, AWS, maintains SOC 2 Type II and SOC 3 compliance.
The review further confirmed that least-privilege access controls are enforced for all internal and external users and that user activity, including access events, is logged. The vendor identified AWS as the hosting provider responsible for storing and maintaining City data, satisfying the requirement to disclose and review entities that may possess City information. The vendor confirmed that they maintain appropriate cyber-liability insurance.
FedRAMP (Federal Risk and Authorization Management Program) is the U.S. federal government’s standardized framework for assessing, authorizing, and continuously monitoring the security of cloud services used by federal agencies.
- GovRAMP (Government Risk and Authorization Management Program) is a similar security validation program designed for state and local governments. It evaluates cloud providers against established cybersecurity controls and provides an independent assessment of their security posture.
The vendor’s compliance with both FedRAMP and GovRAMP indicates that it has undergone rigorous third-party security reviews and maintains cybersecurity controls that align with government-sector standards.
Reach out if we need to connect this afternoon. Otherwise, I am happy to connect before or during tonight’s meeting.
Thank you!
Mike Buettner
PUBLIC WORKS DIRECTOR
Public Works
Leave a Reply