Episode 25: Better Budgeting for Utility Cybersecurity & Modernization – Ampcus VP, Barbara Wilson

Jeremy Boren: Hey, everybody, welcome to the Empower Up podcast. I'm your host today, Jeremy Boren, Gray Matters brand manager. Just a quick reminder to rate and review us on Apple podcasts. It really helps us out when you do that.

Today, we have a special guest, Barbara Wilson is the vice president of technology programs at technology consultant Amicus Incorporated. Barbara, welcome. Thanks for being on the podcast.

Barbara Wilson: Thank you so much for having me.

Jeremy Boren: Good to have you here. So I know Amkis is based in Virginia, but you're in Colorado. Can you kind of tell us a little bit about your background, not only at Amkis, but also in the water industry?

Barbara Wilson: Sure, absolutely. So I'm Barbara Wilson, and I'm the VP of Technology Programs at Amkis. I started Amkis in about a year ago, this January. January.

Previous to that, I spent a number of years, over 15 years in the water sector. My previous experience, I think like a lot of water utility professionals, water was not my first job and sector, but it was my love, right? It is something that I've grown to really appreciate. So I started with working at a pharmaceutical in the procurement range, and then I moved on to a software firm that developed software for international banks and Wall Street for about five years.

And then I decided, like a lot of my family, that I wanted to work as a service person and provide that to my community. So I moved into the public sector. I went and got my master's degree in public administration out of the University of North Texas. Go Eagles.

And started working at the city of Fort Worth, Texas, first in their IT section. And then I moved over to their water enterprise fund, which was something that I really have enjoyed and learned a lot from. I got some mentors at the very beginning. I was first a business analyst in their IT section, and then I ran their IT section until 2013 when I decided I wanted more experience at a different type of utility.

So I moved to Denver, Colorado with Metro Water Recovery, which is a wholesale wastewater utility. And I spent up until 2022 with that facility, almost 10 years there. So a lot of experience, a lot of on the ground learning and a lot of fun with a lot of great people.

Jeremy Boren: That is incredible experience. And I love just like the civil service side of that, too. And just, you know, having having a love for that person profession and what it gives back to the community. I think a lot of people don't think about that, but it is so important and it's part of our critical infrastructure.

Barbara Wilson: Yeah, I mean, I think the water sector is so needs to emphasize how green and how it does sustainability and just makes everyday life happen. Right. You know, you can't provide you can't have a meeting or you can't live at your house or anything without having water to drink or to, you know, have wastewater and to flush your toilet. So it's such an essential mission.

And the folks that I've met have been really passionate about it. And so have I. It rubs off very quickly.

Jeremy Boren: Yeah. And I feel like working in Texas and Colorado, I mean, out west, obviously, water is such an important and sometimes scarce resource. So you would get even a better sense of that than I would necessarily here in Pennsylvania, where we can't get a day without rain, of course.

Barbara Wilson: So I was born and raised outside of Philadelphia, so I totally know the East Coast. And I've only moved west to get my master's degree and in my job search. So it's a very different setting for the different water regions in the country. And it's amazing.

And I think water is going to be a political issue that is more and more talked about.

Jeremy Boren: Totally agree. Absolutely. Absolutely. And so that's actually probably a good segue for what I really wanted to get into the topic for today, which is, you know, budgeting and something that every utility out there has to deal with when it comes to upgrading their technology is the budget process.

And I know you have a special perspective on that. So what are some strategies that utilities should really be considering, you know, to kind of ease and speed up that budgeting process that they're all going through?

Barbara Wilson: So, yeah, I would talk about a split it into two segments, right? There is the building of a budget and then there's the executing of the budget. So some strategies for building a budget when that's an annual process, in some cases, they might have a different process. Some utilities have a biannual process and so forth.

But, you know, as you look at it from an IT perspective, use it as a tool to really understand and streamline what you're looking at in your enterprise. price. For me, there's different ways to budget. You could do cost plus, which means you take your current budget and add a percentage on that you know would increase or maybe incremental increases in certain line items that you know are increasing, maybe due to increases in needs or so forth.

But my favorite was zero-based budgeting, which means that I actually started my budget new every a year and I build it up from the ground up. And what that allowed me to do is optimize our understanding of what was in the budget and to make sure it was still relevant and current, right? So a lot of people, you know, when in clause plus, there might be a disadvantage that you might not see something that's not used anymore or licenses that may not need to be maintained. And so when you do zero-based budgeting, you can look at all those factors.

It does take more time, but it gives you a real sense of where you're coming from and what you have to move to. So, you know, I would the other thing I tell folks in budgeting, especially senior management folks and executive management, is IT is not going to be a place that you save money. It is the place that lets you save money. Right.

So when you have automation, we're seeing a real increase in technology budgets across the utilities and across the nation. And that's because more automation is being put into your organization, which then requires you to pay license fees and maintenance fees and professional services and some materials and supplies that you need. But those costs should be saving in time and effort and really resources for your operational teams, your back office teams, your customer facing teams and so forth. So, you know, when you look at the annual budget, it's more likely than not that there's increases to that every year in a percentage basis across time, especially with the changes in technology we're seeing, right?

The move to the cloud, the move to more collaborative tool sets, the move to more collaborative systems and so forth increases the cost. But when you do your benefits and your analysis, you're really looking at the optimization of those operational teams.

Jeremy Boren: Absolutely. And, you know, one thing we're always hearing from customers is that, you know, unlike maybe a huge corporate enterprise with public agencies, a lot of times they need to really strategize and, you know, make an improvement or an upgrade, you know, over, you know, a couple of years, a couple of budget cycles and to really like develop a strategy for it. And then they also sometimes, you know, struggle to find kind of the right partners because some of this stuff is pretty specialized, you know, especially in the operational technology space and even in IT. So, you know, what are some ways that, you know, you can kind of come up with budgeting strategies like cooperative sole sourcing to make that easier for utility administrators and to find the right solution?

Barbara Wilson: So when you're in the IT and you're in IT management, there is a technical component of your business that you're doing every day. You want to keep those systems up. You want those databases running. You want those.

But there's a process part of your job that budgeting falls into and your business processes, therefore. for. And a lot more work is being done in that contracting of services and of capabilities for systems in IT than previous, right? It used to be on site, you'd buy once out of your capital accounts, and then every five years you would buy again or seven years, depending on your life cycle.

But now with cloud and different structures for procurement, that has increased to a more annual or weekly or daily kind of or monthly need. So IT management folks are being stressed, I think, in some ways because they need to understand the business behind technology. And that increases their capability to understand contracts, contracting language. And what an IT manager or professional like I was, was trying to make sure that you're You're maintaining and managing your daily processes and speeding the time from understanding the need that you have to procurement and execution inside of your structures, right, inside of your utility.

And you want to increase that speed so that you're not waiting a year for a change to happen. So, in that case, you're looking for mechanisms in the procurement area and the procurement rules of a utility or governmental structure that support your needs. And some of the ones that you looked at and I looked at really closely were how do I use sole sources, how do I use cooperatives, and how do I use the procurement rules of the utility to increase the speed to execution? And so the first one that is the easiest, you know, is sole source, right?

And sole source allows you to literally sign off on it. You know, that requires though it not being available by anybody else. There's some procurement rules that you have to follow in that perspective. Generally, it's a proprietary system or a service that is only maintained by that company or in that region for that company and so forth.

And so sole sources have some regulations and rules that you need to follow. What I've learned is that you really have to team up in this day and age. IT management has to team up with procurement management and legal, right? Because of the ability to do this business and use these contracts and so forth, you have to understand the procurement rules.

You have to understand the language of the contracts, and you have to understand your risk legally and regulatory-wise for using those structures. But sole sources would be the first one I would go after. If I couldn't do a sole source, I would move to cooperatives. Now, there's many different cooperatives in the nation, and a cooperative is a entity, some other entity that's governmentally based or the government allows you to use that has already negotiated a contract with that vendor.

The prime one that most people know is GSA, which is General Services Administration, now the feds. But there's also other ones in the capabilities across the nation, some private ones like NASPO, ValuePoint, or Omni Partners, which, you know, they have governmental or public entity cooperatives that you can use, and your procurement folks would have to sign on to using those. Also, in some states, some state procurement agencies create one for the state itself. I know, like in Texas, there's the Department of Information Resources, the DIR, which has master agreements that other public entities can use.

And so what this allows you to do is, again, speed that time to execution up. And so like when you're talking to a vendor, you can ask them, are you on any cooperatives? Can we get cooperative pricing so that we can then have our procurement guys agree to using that cooperative? So then it just moves through the internal processes faster.

But it still provides transparency for all the powers to be that are required by your board and councils. and governmental transparency requirements.

Jeremy Boren: Right, because you're kind of piggybacking on those agreements that have already been worked out, whether it's at a state level or something else.

Barbara Wilson: Absolutely. And I would tell you that was my second go-to. One of the biggest areas that you can use that on really easily is equipment because there is so many equipment or manufacturers sitting in there. Services are the next step, right?

Right. That I think is still in process of being built out, depending on what services you're talking about. For sure. I think that's the new thing cooperatives are trying to hit because of how much you need for transformational work.

Jeremy Boren: So that's kind of some of the how. So let's get into the what. What kind of technology upgrades, whether it's services or equipment, digital transformation initiatives, Are you seeing utilities really prioritize and use sole sourcing and cooperatives to acquire?

Barbara Wilson: So I think we'll step back and say that there's one area that isn't technology, but is technology related. One of the first things that we're really seeing is that there's a huge constraint of skill sets inside utilities and in a lot of governmental entities because the labor markets are so tight. Right. And so to get to those specialized skill sets or the amount of skills they need, you know, just the amount of resources they may need for a project or so forth.

So we're seeing a huge amount of what is single, you know, staff augmentation, which I would put into the operations itself. You may need a database administrator for six months or a year. You may need to backfill somebody because of retirement or, you know, pregnancy or any of those kinds of life issues, quality of life concerns. So staff augmentation is one.

And the second one is turnkey teams. A lot of utilities are really trying to maintain their staff in mission critical services. And so when they have a transformational need, an upgrade to a system or to change to a new system, they may bring in a turnkey management team to do that. And it's managed inside the utility, but the team is all experts for maybe third-party service providers and so forth to provide that change to come into their utility.

So, you know, managing it and actually acquiring a full team just to support you in that change we're seeing. So the people resources, I would say probably number one for the need. The second need, I'm sure everybody has talked about it and I see you've had some other podcasts about it, which is cybersecurity. Yes.

And everybody knows cybersecurity is a crucial issue in our world today. You know, we're basically virtually at war with different components and bad actors from around the world and some inside the United States too. Cybersecurity, I would say that utilities are making progress moving forward with changes and to be more proactive. in that space.

I think it's a little tougher because there's some legacy systems inside utilities, both on the IT and the OT side, that don't convert very well or participate very well, I would say, with cybersecurity and the new tools. So that is a concern for cybersecurity. The other part of cybersecurity is how do you get to move from reactionary and just planning into a proactive state with assessments and planning and training and moving forward and having those skill sets. Again, it comes back to where those skill sets lie and can those utilities actually afford to have them on staff or do they need to contract out for those?

And what we're finding is virtual CISO services and so forth are gaining traction. We're also hearing and are participating with a lot of associations in the water sector. And we predict in about a year or so that there'll be new legislation coming down for cybersecurity, reflecting, you know, closely or kind of looking like what you would see in the electrical space utilities with NERCSEPT, right? That we need to have a more compliance-driven driven cybersecurity, and it needs to be regulated and reviewed and assessed and continuous improvement across time because it was the cyber attacks and so forth.

Those actors are always learning and they're always trying to do something different. So the water utilities really have to understand that. I think what we're seeing in that space is understanding is growing, but not always the the understanding, getting to execution of what that means in the space. So on a water utility, you might see, right, you have multiple networks sitting on a water utility where there's an IT network and then an OT network.

Well, that's very different to do cybersecurity on than just like a financial system or financial company because they have one IT network and they can protect the whole network. So how do you protect an OT network that was built out over the last 30 years? And how do you balance convenience and safety, right? Because that's the daily slug of an IT director or CTO is those operating guys don't want to have 17 passwords that are 17 characters each.

How do you remember all those? Right. And have to log in every three minutes to something as they walk across the campus of a utility. So convenience is a huge area there.

One other player in this that we're starting to see increasingly is insurance companies and rate or to insurance companies and rating agencies. Insurance companies are saying that you might need a cyber rider on your property insurance because the risk for cyber is so hard and so enormous that they're seeing. The issue is unless you do certain technology things like multi-factor authentication, they might not give you the rider. The issue is it doesn't work on the old T-side networks.

So how do you deal with those? Those are some areas that I think are still in the gray.

Jeremy Boren: Yeah. Yeah, no, that's a really interesting point. I mean, it would be like getting health insurance and then requiring you to go to a doctor to get a physical or something. It's like they're going to require you to do certain things to even get that insurance, whether it's an assessment or – and I know with the government regulatory side of things, it seems like those requirements come in the form of assessment and then reporting requirements.

if there is an incident or reporting on what you've done to prepare or to assess your systems.

Barbara Wilson: Yeah, I mean, I think that is correct. You know, reporting is great. The other side needs to work with water utilities because the structure of being an industrial component to their work may not be fully understood by the folks putting those requirements down. So there needs to be some balance there.

The other group that I see a lot more talk, and I've talked to some of them, are bonding agencies. So when utilities are getting municipal bonds and so forth, you're now having supplemental forms that you have to fill out about your cybersecurity. And it could affect your bond ratings in the future, or if not now, depending on how they're doing it.

Jeremy Boren: Now we're really talking about whether that's going to save – that sort of thing could definitely – that affects every financial aspect of your agency at that point.

Barbara Wilson: So that means that in cybersecurity and stuff, you're having new players just in the decision-making themselves, right? Because before it was a technical decision between maybe you and executive management. Now it's a financial decision about risk, right? And so we're also seeing an increase in discussion about risk management in utilities and actually some structures inside utility organization structures changing to allow for new units called risk management that you haven't seen before.

Coming out of the administrative services area into their own, maybe in the legal area or in a compliance area and so forth.

Jeremy Boren: I hadn't heard about the bond rating factor on that. That's really fascinating. I think that might be news to more than just me listening today.

Barbara Wilson: So, yeah, you'll probably see it in the form of supplemental documents that are asked when you're going through bonding and stuff.

Jeremy Boren: Interesting. So, you know, kind of under all of that umbrella bar rule, you know, what are some ways that, you know, partners like Amicus and, you know, Gray Matter, you know, how can utilities, you know, look to third parties like us to kind of make it easier? for their technology acceleration plans for keeping in line with these budget realities, or if it's in cyber to kind of maybe catch up a little bit on their cybersecurity planning?

Barbara Wilson: So I think some of it has to do with how we as their partners handle our own business. And so from the AMCA side, and I know from the Gray Matters side, we've had these discussions discussions about making sure that that pipeline from procurement to execution is sped up. So how do we maximize the sole sources? How do we declare what is sole source services that we can provide?

What cooperatives and how do we train our sales folks and our engagement folks in explaining those and making sure that those utilities understand how you can get that speed up for the procurement aspects. I think from the utility side, you know, they need to be aware of what their procurement rules are and what flexibility they have inside of those areas. So I think there's some of them. I think also from the AMCA side, and I believe Gray Matters, we're working on providing like service packages and working through some of those, especially like in the the cybersecurity realm of what would a typical engagement look like at different levels, right?

Because we have, what, 55,000 different water utilities, if not more, around the nation. They're small, medium, large, extra large. And so we can't just rate to the extra large guys. We have to make sure that we have that capability and those pricing capabilities for those different levels.

Because a utility that has 100 folks and maybe three IT guys in that mix is more tactically based and so forth. And so their needs might be an assessment and more of a support function and providing services, whereas you go to an extra large utility who might have a contingent staff of IT security folks and you might be doing pinpointed work that they want in a turnkey thing. They might need something specifically done. So that is some of those areas.

Some of the other areas that we in Gray Matters are looking at is to make sure we have a partnership so we can cover the IT and OT at the same time so that you're not dividing that structure inside. Because say the bond agencies or the regulatory agencies, they're not really going to care if it's IT or OT. They want to know it's safe and secure for your technically based infrastructure. infrastructure.

And so we need to make sure that we cover both sides from both perspectives, right? IT with availability and so forth, and OT with the reliability. So want to make sure that we have cybersecurity and services and so forth. And getting back to that people stuff, each of our teams has really worked hard to make sure we have top notch experts in different areas for those services so that they can be called on to be that expert in hand for those utilities.

So that, you know, if they get into a situation where they need experts and they need all the way up to support for a critical issue of the day, that that can be achieved in a very reasonable and quick manner. So I think for us at AMCUS, we're really focusing on providing services and making sure that we get to the operational needs of the utilities and not stay at the theoretical, you know, planning stage. We really want to get in and provide that service that moves that needle for those utilities, because myself and some of the folks that have worked with utilities and local government have been on the ground, and we understand those needs. And we want to make sure that we support those folks every day, all day long.

Jeremy Boren: Yeah, and I'll speak to the same thing on gray matter. You know, we have folks that have spent their entire careers working either with or in or both in the water industry, you know, and so they can see both sides of, you know, just the realities of what you have to deal with, like budgeting, like we've been talking about today, and also just what the latest technology is and how that fits in with their IT and OT needs. So it's really cool to work with professionals and to talk with professionals like you who have those dual perspectives and can offer them to others, you know, in the same industry. And that's why, you know, I like to have platforms like this that can get the word out about that and let people know that there are folks with those very diverse expertise levels.

Barbara Wilson: Well, I've been there. I've gotten a call at 2 a.m. I've gotten a call that the ceiling fell in somewhere and you had to make the changes. I've gotten a call.

So I understand those pressures of the IT management who is working behind the scenes to support and be that infrastructure for that utility so they can do their work of cleaning and providing water. And we all every day think about that water is just so critical to the world and we want to make sure we can help there.

Jeremy Boren: For sure. Well, Barbara, thank you for being on the Empower Up podcast. It was great to have you as a guest today.

Barbara Wilson: Thank you so much. And more than happy to come back anytime.

Jeremy Boren: Yeah, we'll have you back. I enjoyed it. that does it for this episode of the empower up podcast rate review and follow us at apple podcasts and to learn more about our cyber security offerings visit us at graymattersystems.com look under the offering section for industrial cyber security and you can get all the info there all right see you next time you