1

New Risk Assessment and Emergency Response Plan Requirements and Tools

for Water UtilitiesKaren Edwards-Lindsey

Water Security Division

U.S. Environmental Protection Agency

2

Common Disasters

3

Agenda

• Introduction and Background

• AWIA Section 2013 Overview

• Risk and Resilience Assessment Requirements

• Vulnerability Self-Assessment Tool

• Emergency Response Plan Requirements

• Emergency Response Plan Guidance and Template

• Online Certification System

• In-Person Training Opportunities

• AWIA Section 2018

• Additional tools and resources

• Q/A Session

This Photo by Unknown Author is licensed under CC BY-NC-ND

4

EPA’s Role in Water Resilience

5

EPA is the Sector-Specific Agency for Water

6

Water Sector Resilience ASSESS

PLAN

TRAINRESPOND

RECOVER

7

Overview

AWIA Section 2013 (a) – (f)

Replaces SDWA Section 1433 (from 2002 Bioterrorism Act)

Applies to all community water systems serving more than 3,300 people

Conduct Risk and Resilience Assessments and update Emergency Response Plans

Submit certifications to EPA by specified deadlines

Review risk assessments and ERPs every five years

Coordinate with local emergency planning committees

Maintain records

8

Certification Due Dates

Risk Assessment

Population

served

≥100,000

March 31, 2020

Population

served

50,000-99,999

December 31, 2020

Population

served

3,301-49,999

June 30, 2021

Emergency Response Plan (ERP)

Certify ERP no later than 6 months after completion of the risk assessment

9

Risk and Resilience Assessments

10

Risk and Resilience Assessments

Include:Pipes/conveyances, source water, water

collection/intake, pretreatment,

treatment, storage and distribution,

electronic, computer, or other automated systems (including

security)

Monitoring practices

Financial infrastructure

Use, storage or handling of

chemicals

Operation and

maintenance

May include capital and operational

needs for risk management

Consider risks from malevolent acts and natural hazards

11

Use of Previous Risk Assessment and ERP

• A CWS may use a risk assessment or ERP developed prior to enactment of the AWIA.

• To meet certification requirements, a previous risk assessment or ERP must:

• Include all assessment or response components listed in the law.

• Reflect the current condition of the CWS.

• If required assessment or response components have been omitted, the CWS may add those components.

• If the CWS has undergone modifications, the CWS may update the risk assessment or ERP where needed.

12

Baseline Information on Malevolent Acts Relevant to CWS

• What is the purpose of this document?(1) Help water systems identify malevolent acts to include in their risk assessments

• AWIA risk assessments must include both natural hazards and malevolent acts

(2) Help water systems estimate the threat likelihood for malevolent acts

• Why is this document needed?• Assessing risk from a malevolent act to a water system asset requires estimating three

parameters:

(1)Threat likelihood: the annual probability that a perpetrator will attempt to carry out the malevolent act against the facility;

(2)Vulnerability: the probability that the malevolent act will have an adverse impact on the facility; and

(3)Consequences: the public health and economic consequences resulting from the impact of the malevolent act on the facility.

• Threat likelihood for a malevolent act is the most difficult risk parameter to estimate because it requires projecting the actions of a perpetrator.

• For water systems, the difficulty of estimating malevolent threat likelihood can be a barrier to including malevolent threats in risk assessments.

13

How The Baseline Threat Document Helps You?

• Combines many specific reference attacks from J100-10 Standard into a smaller number of broader threat categories

• The analyst can define more specific threats within an assessment

• New Approach! Provides order-of-magnitude likelihood estimates for malevolent acts

• These optional threat likelihood values can be a starting point to help water systems estimate site-specific values

• The estimates are based on the national frequency of reported incidents and public intelligence information, which can indicate the likelihood of different malevolent acts.

• Identifies factors that may increase or decrease the likelihood of malevolent acts at a specific facility

• Will assist CWSs with evaluating the application of the provided threat likelihood values to their facilities and with identifying potential areas for security improvements

• Lists resources for additional information about malevolent acts that may impact CWS facilities

Document is available at https://www.epa.gov/waterriskassessment/baseline-

information-malevolent-acts-community-water-systems.

14

Vulnerability Self-Assessment Tool Web 2.0

• VSAT Web 2.0 can guide you through a risk and resilience assessment that complies with AWIA Section 2013.

• Designed for mobile devices like tablets and iPads as well as PCs.

• Includes embedded tools that assist with estimating risk assessment parameters and resilience.

15

How Does VSAT Web 2.0 Help You?

• Provides a step-by-step process with embedded tools and values to guide you through an AWIA-compliant risk assessment.

• A VSAT risk assessment can be tailored to be simple or complex depending on the needs and resources of the analyst

• Helps you identify the malevolent acts and natural hazards that present the highest risk to critical water system assets

• Utility risk-reduction efforts can be targeted to address the greatest threats

• Supports an optional cost-benefit analysis of additional countermeasures to reduce risk and enhance resilience

• Results can target security expenditures to provide the greatest risk-reduction benefit, as well as justify the allocation of new security resources

16

EmergencyResponse Plans

17

Emergency Response Plans

Include:

Strategies and resources to

improve resilience, including physical

security and cybersecurity

Plans, procedures, and equipment for

responding to a malevolent act or

natural hazard

Actions, procedures, and equipment to lessen the impact of a

malevolent act or natural hazard, including alternative source water,

relocation of intakes, and flood protection barriers

Strategies to detect malevolent acts or

natural hazards

Prepare or revise an ERP that incorporates findings from the risk assessment

18

Preparing for ERP Development

1. Conduct a risk and resilience assessment.

2. Identify state regulatory requirements.

3. Identify and integrate local plans.

4. Coordinate with Local Emergency Planning Committees (LEPCs) and response partners.

5. Plan for resources.

19

Emergency Response Plan Template and Instructions

• The ERP template and instructions assists water utilities with developing an ERP in accordance with AWIA Section 2013(b).

• A single PDF document provides guidance on what information should be provided in each section of the ERP template.

• Includes useful links for additional information and guidance.

• A blank ERP template in Word format is embedded in the PDF document and can be easily accessed and modified to meet your own utilities needs.

• The user-friendly template features fillable tables, checklists and charts to use as a starting point for utilities to develop their own plans.

20

ERP Template Outline

• Utility Information

• Resilience Strategies

• Emergency Plans and Procedures

• Mitigation Actions

• Detection Strategies

21

Utility Information

• During an incident, you need to have system information about your water utility readily available for your personnel, first responders, repair contractors/vendors, the media, and other response partner agencies, including:

• Utility Overview

• Personnel Information

• Primary Utility Components

• Industry Chemical Handling & Storage Facilities

• Safety

• Response Resources

• Key Local Services

22

Emergency Plans & Procedures

• This section of your ERP should contain plans, procedures, and equipment that can be used in the event of a malevolent act or natural hazard that threatens your utility’s ability to deliver safe drinking water.

• Two types of emergency response plans and procedures should be considered as part of your ERP:

• Core Response Procedures

• Incident-Specific Response Procedures (ISRPs)

23

Core Response Procedures

• Core procedures are the “building blocks” for incident-specific procedures, since they apply across a broad variety of incidents (e.g., hurricane, earthquake, flood).

• Core procedures include:

• Access

• Physical Security

• Cybersecurity

• Power Loss

• Emergency Alternate Drinking Water Supplies

• Sampling & Analysis

• Family and Utility Personnel Well Being

24

Mitigation Actions

• This section of your ERP should include actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to your community and individuals, including:

• Development of alternative source water options

• Relocation of water intakes

• Construction of flood protection barriers

• These mitigation actions, procedures, and equipment help your utility to better withstand and rapidly recover from incidents (e.g., flooding, earthquake), thereby increasing overall resilience.

25

Detection Strategies

• This section of your ERP should contain strategies that can aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of your utility.

• These detection strategies can be almost no-cost (e.g., instituting a “See Something, Say Something” campaign at your utility) or require more resources (e.g., installing motion sensors and video cameras to monitor for facility break-ins or tampering) to implement.

• Effective response to an emergency requires timely detection, which allows your utility to implement its ERP as soon as possible.

26

Detection Strategies (cont.)

• Examples of effective strategies for detecting common threats include:

• Unauthorized Entry

• Water Contamination

• Cyber Intrusion

• Hazardous Chemical Release

• Natural Hazards

• Power Outages

27

Certify Your Risk Assessment/Emergency Response Plan

28

Three Ways to Certify

1. Electronic Submission (preferred method)

2. Email

3. Regular Mail

29

Electronic SubmissionEasy-to use, reminders provided

• STEP 1: Account Registration• New users will need to establish username and

password.• Previous users will go to the next step.

• STEP 2: Enter PWSID Number

• STEP 3: Accept Terms and Conditions

• STEP 4: Build Account Profile

• STEP 5: Confirm and Select Organization/Community Water System Information

• Select listed water system.• Search for your system or enter a new

organization.

30

Electronic Submission

• STEP 6: Validate Your Email.

• STEP 7: Select the certification that you are about to complete Certify Your Risk and Resilience Assessment ORCertify Your Emergency Response Plan.

• STEP 8: Read certification statement and select Certify Now.• You can print this page as record for your files.• You will receive an email acknowledgement from U.S.

EPA that your certification is complete.

• STEP 9: Choose final disposition of Vulnerability Assessments submitted to US EPA under the Bioterrorism Act of 2002.

• Permanent disposal by EPA, returned to your or not applicable.

• STEP 10: Future login with username and password to certify remaining document or recertify in 5 years.

31

Email Submission

• Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www.epa.gov/waterresilience.

• Email statement to awiasupport@epacdx.net.

32

Mail Submission

• Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www.epa.gov/waterresilience.

• Mail statement to the following address:

U.S. EPA Data Process Center

ATTN: AWIA

C/O CGI Federal

12601 Fair Lakes Circle

Fairfax, VA 22033

33

Enforcement46

EPA’s main goal

is returning the

system to

compliance and

protecting public

health.

• SDWA Section 1414 is an enforcement provision EPA may

invoke to address an owner/operator of a public water

system's noncompliance with an "applicable requirement"

under the Act.

• Section 1414(i) defines "applicable requirement" broadly

and it expressly includes Section 1433. If a CWS fails to

comply with a requirement under Section 1433 (e.g., fails to

certify they have conducted a risk and resilience

assessment by the statutory deadline), then EPA may

exercise its enforcement discretion by initiating an action

under Section 1414.

• Under Section 1414, EPA may bring an action to require

compliance and may also seek a civil penalty of not more

than $57,317* per day of violation.

*This number is adjusted annually for inflation. See 40 CFR 19.4.

34

https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-plans

35

Compliance Resources

Baseline Threat Guidance Document

Vulnerability-Self Assessment Tool

(update)

Emergency Response Plan

Guidance & Template (update)

Technical Assistance

Primer (new resource for

technical assistance providers)

36

Technical Assistance Primer• New resource for technical assistance

providers and those assisting CWSs comply with AWIA.

• Intended to answer questions from water utilities as they conduct the Risk and Resilience Assessment and develop an ERP.

• Contains useful information to comply with AWIA including:

• Established AWIA deadlines

• Frequently Asked Questions

• Updated Tools and Resources New!

• Certifying Options New!

• Quick Submittal Tips New!

37

39

FAQs4. Is there funding available for conducting the risk assessment?

Currently, there is not one stream of funding that is designated specifically to address the new risk assessment requirement. However, the Drinking Water State Revolving Fund program can be used to conduct a risk assessment since it addresses resilience of the system and the risk assessment may yield a project that the utility may want to invest in to improve the overall system resilience. Both parts of the program can be used. Each state will manage this differently. Please check with your state to see if they have set aside funds for this function specifically either with direct contractor or with reimbursements.

5. Who is qualified to certify a risk assessment or emergency response plan?

Any designated utility representative.

6. How are you determining the population sizes for utilities?

U.S. EPA is using the SDWIS database to determine the population size served by each utility and the corresponding deadline.

40

AWIA Section 2018

41

Emergency Notification

Amends Emergency Planning and Community Right-to-Know Act (EPCRA) Section 304 to add:

(e)(1) Applicable State Agency Notification

(e)(2) Community Water System Notification

42

State (or Tribal) Emergency Response

Commissions (SERC, TERC)

Notification RequirementsPromptly, the State or Tribal Emergency Response

Commission (SERC or TERC) shall:

• Notify the applicable State agency (i.e., the drinking

water primacy agency) of any reportable release of an

EPCRA extremely hazardous substance (Appendices

A and B of 40 CFR Part 355) or a CERCLA hazardous

substance (40 CFR Part 302.4(a)).

• Reportable release: releases that exceed established

reportable quantities within a 24-hour period.

43

The SERC or TERC will provide the drinking water primacy agency

with the following information:

• The chemical name or identity of any substance involved.

• An indication of whether the substance is on the EHS list.

• An estimate of the quantity of any such substance that was

released into the environment.

• The time and duration of the release.

• The medium or media into which the release occurred.

• Any known or anticipated acute or chronic health risks

associated with the emergency and advice regarding medical

attention necessary for exposed individuals.

• Proper precautions to take, including evacuation.

• The name and telephone number of the person or persons to

be contacted for further information.

SERC (or TERC) Notification

Requirements

44

As soon a practicable, the SERC (or TERC) shall provide the

drinking water primacy agency a written follow-up notice:

• The written notice shall provide updates to the information

provided in the original notification, as well as additional

information with respect to:

• Actions taken to respond to and contain the release;

• Any known or anticipated acute or chronic health risks;

and

• Where appropriate, advice regarding medical attention

necessary for exposed individuals.

SERC (or TERC) Notification

Requirements

45

The drinking water primacy agency receiving notice from a SERC

(or TERC) shall:

• Promptly forward the initial notice, and all information

provided, to any community water systems whose source

waters are affected by the release.

• Forward the written follow-up emergency notice provided to

the affected community water systems.

Primacy Agency Notification

Requirements

Notice to Community Water Systems

46

If a state does not have a drinking water primacy agency:

• The SERC (or TERC) shall provide the required notices and

information to the community water systems affected by the

release.

Direct Notification: Notice to

Community Water Systems

47

Chemical Inventory Data Availability

Amends EPCRA Section 312(e) to add

Community Water Systems

48

AWIA Sec 2018(b) amends EPCRA Sec 312

• Requires SERCs (or TERCs) and LEPCs (or TEPCs) to

provide affected* community water systems with chemical

inventory data submitted under Tier 2 of EPCRA for their

source water area, upon request from the system.

* One or more community water systems (as defined in SDWA

Section 1401(15)) that receives supplies of drinking water from

a source water protection area delineated under SDWA Section

1453, in which a facility that is required to prepare and submit

an inventory form under EPCRA Section 312 is located.

Chemical Inventory Data Availability

49

Questions?

50

Action Items

✓ Join the EPA Water Security Division mailing list to receive updates and other information.

✓ Sign up online at epa.gov/waterresilience or Text RESILIENCE to 42828

✓ Conduct your risk and resilience assessment.

✓ Update or develop your emergency response plan.

✓ Register for one of our in-person trainings to learn more about the AWIA Section 2013 and 2018 requirements.

51

Thank you!

AWIA Requirement Questions

dwresilience@epa.gov

Water Security Division

WSD-outreach@epa.gov

epa.gov/waterresilience

Karen Edwards-Lindsey

Edwards-

Lindsey.karen@epa.gov

202-564-3797