Engagement Memo—Technology Asset Inventory

We are initiating an audit of the company’s practices to develop and maintain an inventory of its technology assets to facilitate its ability to protect them from cybersecurity threats. Our objective will be to assess the effectiveness of the company’s practices for identifying and tracking these assets. We plan to focus on systems that support train operations (known as “operational technology”) but may modify our scope or objective during the review. We plan to interview company officials, analyze relevant documents and data, and assess related policies and procedures. We will work to minimize disruptions to the company by coordinating meetings with staff in advance.