EXHIBIT 1-M

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 1

of 11
Contract Work Authorization

62-4229 CWA (9/26/18) Sourcing

Contract Work Authorization (CWA)

This Contract Work Authorization (“CWA”) No. C15950 is issued under and pursuant to the Blanket Agreement or 

Master Service Agreement No. C73 (formerly 4400011340) dated January 19 2017 (the “MSA”) between the belownamed Contractor (“Contractor”), a Delaware limited liability partnership, and Pacific Gas and Electric Company 

(“PG&E”), a California corporation with its headquarters located at 77 Beale Street, San Francisco, California 94105.

Contractor shall perform all Work under this CWA pursuant to and in accordance with the terms and conditions of the

Contractor’s 

Legal Name:

KPMG LLP Total Number of Pages: 10

Contractor’s 

Address:

Corporation Trust Center 

1209 Orange Street

Wilmington, DE 19801

Project Name: Endpoint Security Strategy Assessment Project

Job Location: PG&E Approved Locations

WORK: Contractor shall, at its own risk and expense, perform the Work described in this Contract Work Authorization and 

furnish all labor, equipment, and materials necessary to complete the Work as summarized below and as more fully described in

Attachment 1, Scope of Work.

To commence the engagement with key stakeholders and agree on key milestones and dates, define leading practices in 

endpoint protection, align capabilities to frameworks and inventory existing capabilities and tools.

ATTACHMENTS: Each of the following documents are attached to this CWA and are incorporated herein by this reference:

Attachment 1: Scope of Work, Pages 3 through 10

CWA TERM: This CWA is effective upon signature by both parties and expires on August 31, 2019. Time is of the 

essence.

CWA

COMPLETION:

Contractor shall commence performance hereof when directed to do so by PG&E and Work shall be 

completed by the completion date of August 31, 2019.

CONSIDERATION: As full consideration for satisfactory performance of the Work under this CWA by Contractor, PG&E’s total 

obligation to Contractor shall not exceed the following amount. This amount is inclusive of all taxes incurred in the performance 

of the Work. Any change to this amount shall only be authorized in writing by a PG&E CWA Change Order, fully executed by 

both PG&E and Contractor.

TOTAL: $172,500.00

Services - $150,000.00 and Expenses - $22,500.00.

PG&E Corporation (“PG&E Corp.”) and Pacific Gas and Electric Company (the “Utility,” and, together with PG&E Corp., the “Debtors”), 

are debtors-in-possession in a proceeding pending under chapter 11 of title 11 of the United States Code (the “Bankruptcy Code”), in the 

United States Bankruptcy Court for the Northern District of California. Nothing herein shall be deemed to constitute an assumption of the 

Contract and/or any CWA or a waiver or modification of the Debtors’ rights to assume, assume and assign, or reject the Contract and/or 

any CWA pursuant to section 365 of the Bankruptcy Code. The Debtors hereby reserve all rights available to them under such 

proceedings. Any amounts paid by the Debtors hereunder must be applied to goods and/or services provided to the Debtors on or after 

January 29, 2019 (the “Petition Date”) and shall not be applied to satisfy Claims (as defined in the Bankruptcy Code) arising prior to the 

Petition Date.

THE PARTIES, BY SIGNATURE OF THEIR AUTHORIZED REPRESENTATIVES, HEREBY AGREE TO THE TERMS OF 

THIS CONTRACT WORK AUTHORIZATION.

PACIFIC GAS AND ELECTRIC COMPANY CONTRACTOR: KPMG LLP

Signature Signature

Name Name

Title Title

Date Date

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA






 

	






Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 2

of 11
Contract Work Authorization

62-4229 CWA (9/26/18) Sourcing

CWA No. C15950

Page 2 of 10

ADMINISTRATION

PG&E

Negotiator

Emeline Samonte Contractor 

Represent Michael Gomez

Phone (707) 980-2259 Phone 209-999-9383

Email Eag2@pge.com Email michaelgomez@kpmg.com

Accounting Reference PR344682 – C15950 CW2295309

PG&E Work Supervisor: Christine Lu Phone: 415.973.4896

INVOICE 

INSTRUCTIONS:

As described in more 

detail in the Invoicing 

section of the Terms and 

Conditions, Contractor 

shall send invoices for 

each payment when due, 

showing the Purchase 

Order Number (starts with 

“27” or “35”) and the Line 

Item number, if 

applicable.

The default submission system for invoices to PACIFIC GAS AND ELECTRIC COMPANY should be through 

the Taulia electronic invoicing portal, which also provides real-time invoice payment status.

In rare cases that it is infeasible for a supplier to use this system, please send paper invoices to the address 

below. Invoice payment status for paper invoices can be accessed through the automated PG&E Paid Help 

Line at (800) 756-PAID (7243) or by emailing APPaidline@pge.com

Send ORIGINAL Invoice to: PG&E Accounts Payable* 

PO Box 7760

San Francisco, CA 94120-7760

Send COPY of Invoice to: Christine Lu

CxI0@PGE.COM

INTERNAL PG&E USE ONLY

Distribution Date

Distribution of Copies:

ARIBA Contracts (“CXXXX” series): Buyer 

uploads an executed copy in Ariba.

Contractor

(Signed Original Copy)

Work Supervisor Manager

Invoice Approver Supervisor

V.P. Sourcing/ Purchasing

Director Law

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 3

of 11
CWA No. C15950

Page 3 of 10

Internal

Attachment 1

Statement of Work – Endpoint Security Strategy 

Assessment

This Statement of Work (“SOW”) outlines the engagement between Pacific Gas and Electric Company 

(“PG&E,” “Company,” or “Client”) with KPMG LLP (“KPMG” or “Contractor”) to perform the services described 

below.

The governing Master Services Agreement for this work is #4400011340, executed January 19, 2017 and 

supersedes all other oral and written representations, understandings, or agreements relating to the subject 

matter hereof, as amended and as supplemented by the Systems Implementation Addendum in Appendix A.

1.0 SCOPE OF WORK

Phase 1 – Discovery

Objectives: To commence the engagement with key stakeholders and agree on key milestones anddates, 

define leading practices in endpoint protection, align capabilities to frameworks and inventory existing 

capabilities and tools.

Duration: Three weeks

Key activities

– Conduct engagement kickoff meeting

– Establish project governance and ongoing communication cadence (status reporting, steering 

committee, deliverable timelines)

– Develop project timeline and resource allocation (both PG&E and KPMG).

– Obtain relevant security documentation (previous red team reports, current baseline, etc.)

– Hold workshops with PG&E stakeholders to:

o Assess current Endpoint Protection Strategy(What choices and priorities were made? Strengths 

and Areas of Opportunity?

o Agree on in-scope leading practices for endpoint protection

o Assess supporting processes for installation, implementation, updating, management and 

monitoring

o Agree and define existing view into risks/threats at the endpoint

o Define desired capabilities for endpoint protection

o Define desired capabilities for capturing Identity Access Management information (such as login, 

etc.)

o Incorporate stakeholders preferences & requirements

o Inventory tools & capabilities (Strengths, Weaknesses, Opportunities and Threats)

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 4

of 11
CWA No. C15950

Page 4 of 10

Internal

o Align tools & processes to NIST CSF profiles (I, P, D, R, R), MITRE ATT&CK framework and 

Cyber Kill Chain, etc.

– Create unified endpoint protection framework based on previous workshops with PG&E to include 

industry-leading standards, desired capabilities, etc.

– Obtain agreement from PG&E on the proposed unified framework

Deliverable Tools and accelerators Value to PG&E

– Kickoff deck

– Status report template

– Unified endpoint protection 

framework based on in-scope 

industry-leading practices and 

PG&E’s environment

– Project management 

methodology and templates

– Industry-leading practices

– KPMG’s penetration testing 

expertise to focus on real-life 

attack vectors

– KPMG’s understanding of the 

Security Operations, 

technology deployed, 

stakeholders involved 

eliminates the summary to 

perform initial/summary or 

high-level reviews

– Structured approach to help 

ensure efficient execution of the 

assessment and adequate 

planning to gain insight into 

PG&E’s endpoint protection 

capabilities as well as supporting 

artifacts

– Helps ensures all milestones, 

interdependencies, and 

resources are defined

– Provides clear visibility into 

project’s progress, including 

roadblocks and accomplishments

– Alignment to industry-leading 

practices

– Consolidated view of all endpoint 

protection dimensions

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 5

of 11
CWA No. C15950

Page 5 of 10

Internal

Phase 2 – Risk & Gap analysis

Objectives: To assess current endpoint protection capabilities against agreed upon scope and identify areas 

for improvements

Duration: Three weeks

Key activities

Risk & Gap analysis

– Assess PG&E capabilities (e.g. Incident Response), processes (e.g. monitoring) and technology (e.g. 

Golden images, GPO) around endpoint protection capabilities against the unified framework using the 

Capability Maturity Model Integration (CMMI) scale

– Perform hands-on technical penetration testing of the endpoint image to identify potential vulnerabilities 

that exist in the image, as implemented. This testing would assess up to two examples of endpoint work 

stations. This testing will leverage automated vulnerability scanning tools and manual validation and 

exploitation to identify missing/out-of-date patches, deviations from the suggested CIS benchmark or 

recent vulnerabilities.

– Develop report outlining observed Strengths, Weaknesses, Opportunities and Threats to PG&E’s 

Endpoint Protection Program along with action plans, highlighting actionable remediation guidance 

rationalized to support PG&E IT operating environment and leading practices in industry

Future State

– Develop suggested Future State Endpoint Protection Strategy (w/ supporting processrevisions, 

technology updates and relative prioritization)

– Review proposed Future State Endpoint Protection Strategy with PG&E management and incorporate 

any feedback

– Revised Future State Endpoint Protection Strategy based on feedback gathered

Deliverable Tools and accelerators Value to PG&E

– Detailed Current State 

Analysis of the Endpoint 

Protection Program that 

includes:

o Gaps between current 

capabilities against unified 

framework

o Recommended 

improvements to the 

endpoint protection 

controls

o Process improvement and 

technological capability 

enhancements

o Penetration testing report

– Executive summary of the 

Current State Analysis to be 

shared with PG&E C-Suite 

level management

– Future State Roadmap with 

detailed actionable 

recommendations

– Unified endpoint protection 

framework based on in-scope 

industry-leading practices and 

PG&E’s environment

– KPMG’s security assessment 

toolkit and penetration testing 

expertise

– Clear view of as-is state of 

endpoint protection capabilities

– Identification of inefficient 

capabilities or processes

– Understanding of potential gaps 

between current capabilities and 

future state

– Alignment to industry-leading 

practices

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 6

of 11
CWA No. C15950

Page 6 of 10

Internal

Phase 3 –Strategy & Implementation roadmap

Objectives: To prioritize initiatives strategically to remediate gaps based on risks, cost and complexity.

Duration: Two week

Key activities

– Develop high level recommended remediation plans and high level project charters for each initiative 

along with financial impact

– Prioritize these initiatives to help PG&E and build an implementation plan

– Review proposed Strategy and Implementation plan with PG&E management and gather feedback

– Deliver final Strategy and Implementation plan, with agreed phasing and timing

– Develop continuous improvement of the recommendations

Deliverable Tools and accelerators Value to PG&E

– Strategy & Implementation 

Roadmap

– High level project charters that 

can be tailored by PG&E 

based on management 

decision

– KPMG’s expertise in delivering 

roadmap and assisting clients 

through their implementation

– Easy to consume, actionable 

project charters to help PG&E 

make decision

– Prioritized roadmap by 

leveraging a risk based approach

1.1 ACTIVITIES NOT IN SCOPE

The following activities are not in scope for the Project:

• Performing installation or configuration services

• Performing Proof of Concept work

• Purchasing servers, software or licenses

 Any other activity or deliverable not specifically mentioned in Phase 1-3

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 7

of 11
CWA No. C15950

Page 7 of 10

Internal

2.0 DELIVERABLES

KPMG will be responsible for producing the deliverables listed in the tables below for each of the 

activities scoped into this engagement.

Project-Specific Deliverables

Activities Deliverables /Configured System

Discovery  Kickoff deck

 Status report template

 Unified endpoint protection framework based on in-scopeindustry-leading 

practices and PG&E’s environment

Risk & Gap Analysis  Detailed Current State Analysis of the Endpoint Protection Program that 

includes:

• Gaps between current capabilities against unified framework

• Recommended improvements to the endpoint protection controls

• Process improvement and technological capability enhancements

• Penetration testing report

 Executive summary of the Current State Analysis to be shared with PG&E CSuite level management

Strategy & Implementation 

Roadmap

 Future State Roadmap with detailed actionable recommendations

 High level project charters that can be tailored by PG&E based on 

management decision

3.0 KEY PERSONNEL

Engagement Partner: Michael Gomez, Principal, will be responsible for contracts and relationship 

management, and is available as a source of escalation as needed.

Engagement Director: Andres Cools, Director, will be the primary resource for overseeing KPMG’s 

services.

Engagement Manager: Romain Goy, Manager He also will serve as the Project Manager, leading all of 

the KPMG services and associated tasks delivered under this SOW.

Engagement Staff: Will be responsible for supporting in KPMG’s overall service delivery

5.0 ENGAGEMENT FEES and EXPENSES

KPMG’s professional fees are based upon the specified skill level of the professionals providing the services 

and the amount of time and materials required to complete the engagement.

Fees. Based upon the engagement scope, assumptions, and estimated hours, KPMG anticipates total 

fees of $150,000. Our professional fees in this SOW are further discounted from the professional fee

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 8

of 11
Internal

CWA No. C15950

Page 8 of 10

hourly rates outlined in the MSA. As such, the professional fees included in this SOW are not subject to 

further discounting, and both the volume rebate and early pay provisions included in the MSA does not 

apply. Execution of this SOW shall satisfiy the requirement of the MSA Exhibit C regarding hourly rates.

Expenses. KPMG team members’ out-of-pocket expenses will be capped at 15 percent of total fees, or

$22,500. These expenses will cover the travel costs of non-local professionals to and from the Client’s 

primary office of 77 Beale St, San Francisco, CA, or other location as deemed necessary by Client. Meals 

will be covered for non-local professionals based upon a per diem rate of $76 per day. KPMG will bill its 

actual cost for hotel at a rate not to exceed $300 per night, which shall satisfy the provisions of section

5.1.7 of Exhibit A of Attachment 1 to the MSA.

The table below shows the estimated fees and expenses for the period through 8/23/2019.

Scope of services Fees

Phase 1 – Discovery

$50,000

Phase 2 – Risk & Gap analysis $50,000

Phase 3 –Strategy & Implementation roadmap $50,000

Sub-total of fees $150,000

*Expenses (Cap = 15% of fees) $22,500

Total fees and expenses $172,500

6.0 ENGAGEMENT ASSUMPTIONS

The success of this Project is highly dependent on Project coordination and support from PG&E:

 PG&E will work with KPMG to resolve any and all issues related to the Project in a timely fashion

 PG&E will identify a program manager and technical architect to work with KPMG. The PG&E 

program maanger will assist in identifying appropriate resources to engage to help obtain relevant 

technical information, actively participate in technical analysis and performing Project management 

and status reporting tasks. PG&E will also identify a Project owner for this project. KPMG will 

transfer the information and knowledge of the Project to the identified Project owner.

 The PG&E program manager will oversee the conduct of this project, including coordination of 

PG&E resources needed and review of draft deliverables. PG&E personnel assigned to the Project 

will review draft deliverables on a timely basis.

 PG&E and KPMG will conduct this Project collaboratively, whereby PG&E will assign 

representatives to work with KPMG professionals throughout the project. Should PG&E be unable 

to assign representatives to work with KPMG, KPMG and the Project sponsor would agreeto meet 

and determine the impact and the appropriate course of action.

 PG&E management is responsible for establishing and maintaining an effective internal 

communication and control structure.

 PG&E will provide appropriate workspace for the KPMG resources on-site, including, but not limited 

to, telephones, workstations, printers, whiteboards, office supplies, photocopiers, internet access, 

and fax machines.

 PG&E will provide timely sign-off for each Project phase. Deliverable sign-off will occur withinfive 

working days from the submission of deliverables.

 PG&E will provide resources, including hardware, software, and personnel

 PG&E will be responsible for the purchase and acquisition of hardware and software necessaryto 

complete the scope of this engagement

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 9

of 11
CWA No. C15950

Page 9 of 10

 PG&E will be responsible for the hardening of operating systems on the in-scopeservers, 

according to PG&E’s information security and support standards

 KPMG efforts and timelines were created based on assumptions of PG&E maintaining Project 

deliverable timeline commitments. Should PG&E delay in delivery of Project commitments, KPMG 

timelines will be impacted and may result in the need for additional time, effort andbudget.

o PG&E gives KPMG the right to use PG&E’s logo on documents prepared for PG&E internally 

(e.g., internal presentations, etc.) and for no other purpose.

7.0 OTHER MATTERS

KPMG will act as an independent contractor in providing the services as set out in this SOW and does not 

undertake to perform obligations of PG&E, whether regulatory or contractual. In carrying out our work 

hereunder:

 KPMG will not act in the capacity equivalent to a member of management or as anemployee 

of PG&E

 KPMG will provide observations to PG&E management during this engagement. PG&E 

management is solely responsible for evaluating such observations and then determining what 

changes/improvements (if any) PG&E should implement in light of PG&E’s objectives in carrying 

out the “SiteMinder to Ping Migration” Project to which KPMG’s services hereunder relate (the 

“Project”)

 KPMG will not form part of the PG&E’s internal control structure

 KPMG will not assume overall responsibility for the Project

 KPMG will not supervise Client or other third-party personnel performing activities in the areas 

of technical design, coding, and/or configuration of the Ping platform (Ping Access and Ping 

Federate)

 Agreeing to a written management framework that identifies Client managers responsible for 

approvals and judgments and for approving key milestones and interim and final deliverables as 

defined by PG&E

 Evaluating the adequacy of the procedures performed by KPMG

 Evaluating the observations and recommendations arising from KPMG’s services contemplated by 

this SOW

PG&E is responsible for ensuring that appropriate internal or third-party resources are available to 

execute those areas of the Project that KPMG will not supervise or execute, including, but not limited to, 

technical systems design, coding, and configuration.

Contractor will provide our services in accordance with the terms and conditions of this SOW. 

Contractor’s services as outlined in this SOW constitute an Advisory Engagement conducted under the 

American Institute of Certified Public Accountants (“AICPA”) Standards for Consulting Services. Such 

services are not intended to be an audit, examination, attestation, special report, or agreed-upon 

procedures engagement as those services are defined AICPA literature applicable to such engagements 

conducted by independent auditors. Accordingly, these services will not result in the issuance of a written 

communication to third parties by Contractor directly reporting on financial data or internal control or 

expressing a conclusion or any form of assurance.

The deliverables presented as part of this engagement are for the internal use of PG&E management, the 

Audit Committee, and Board of Directors and are not to be distributed externally to third parties, in whole 

or in part, without prior written consent from Contractor in each instance, or used for any other purpose.

Contractor disclaims any intention or obligation to update or revise the observations whether as a result 

of new information, future events or otherwise. Should additional documentation or other information 

become available which impacts upon the observations described in the Deliverables, Contractor 

reserves the right to amend its observations and summary documents accordingly.

KPMG acknowledges that the Bankruptcy Court must approve the terms of this SOW and its fees in order 

for KPMG to be compensated. In that regard, KPMG intends to file applications with the Court for 

allowance of compensation and reimbursement of expenses in accordance with the Bankruptcy Code, 

the Bankruptcy Rules, the Local Bankruptcy Rules, and any order of the Bankruptcy Court establishing 

procedures for monthly compensation and reimbursement of expenses for professionals. The Company 

acknowledges that professional time required to prepare detailed applications in accordance with the 

Bankruptcy Code, applicable rules and guidelines differs from KPMG’s normal billing proceduresand, as

Internal

7

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 10

of 11
CWA No. C15950

Page 10 of 10

a result, requires significant effort by KPMG to comply therewith. The expense required by this effort was 

not included in the estimated fees described above. The Company agrees that, subject to Bankruptcy 

Court approval, KPMG shall be reimbursed for up to 3% of fees associated with professional time 

incurred.

To the extent that the services involve procedures in connection with the Company’s restructuring 

activities or emergence from bankruptcy, such work will be considered out-of-scope services under the 

engagement letters (“Out-of-Scope Services”). Such Out-of-Scope Services also include professional 

time required to prepare detailed applications in accordance with the Bankruptcy Code (described 

above). To the extent that changes in circumstances, such as the loss of Company personnel during the 

bankruptcy process, increase the effort required to deliver the services, this additional effort also will be 

billed as Out-of-Scope Services. Out-of-Scope Services will be billed in addition to the estimated fees 

described above, at [100% of] our standard professional hourly rates. In its fee applications, KPMG will 

identify and describe any Out-of-Scope Services.

The provisions in this “Engagement Fee Schedules” will apply with respect to this SOW notwithstanding 

anything in the MSA to the contrary. Without limiting the generality of the foregoing, the Statement of 

Work Template Requirements set forth in Exhibit B, the Sample Resource and Scheduling Budget set 

forth in Exhibit B-1, and Exhibit C of Attachment 1 to the MSA will not apply to this SOW or the services 

provided under this SOW.

Internal

DocuSign Envelope ID: 8EFE6D5A-C455-4197-A2DD-807875AC87AA

Case: 19-30088 Doc# 4901-5 Filed: 11/27/19 Entered: 11/27/19 16:12:26 Page 11

of 11