Risk & Resilience Assessments and Emergency Response Plans (AWIA Section 2013)

Section 2013 of AWIA requires community water systems that serve a population of 3,300 or more to conduct a risk and resilience assessment and develop an emergency response plan that must be updated and certified every five years.

These requirements are being implemented directly by EPA. See EPA's AWIA website for more information.

Requirements

All community water systems that serve a population over 3,300 must take the following actions.

I. Perform a Risk and Resilience Assessment (RRA)

Community water systems shall assess the risks to, and resilience of, its system. Such an assessment shall include:

1. the risk to the system from malevolent acts and natural hazards;
2. the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer or other automated systems (including the security of such systems) which are utilized by the system;
3. the monitoring practices of the system;
4. the financial infrastructure of the system;
5. the use, storage or handling of various chemicals by the system; and
6. the operation and maintenance of the system.

The assessment may include an evaluation of capital and operational needs for risk and resilience management for the system.

The EPA does not require water systems to use any designated standards, methods or tools to conduct the RRAs. However the system chooses to perform the RRA, it must meet the specific requirements outlined under AWIA Section 2013.

• Risk and Resilience Assessment Requirements and Assistance Resources
• EPA's Vulnerability Self-Assessment Tool (VSAT)
  • Free tool intended for water systems serving a population of 50,000 or greater.
  • VSAT Web 2.0 is a free, user-friendly tool developed by EPA, that can help drinking water utilities of all sizes conduct a risk and resilience assessment.
  • With VSAT Web, a utility can:
    • identify the highest risks to mission-critical operations.
    • find the most cost-effective measures to reduce those risks.
  • Highlights of VSAT Web:
    • No VSAT Web User data is stored by or visible to EPA.
    • Complies with risk assessment standards.
    • Offers liability protection under the Department of Homeland Security's Support Anti-Terrorism by Fostering Effective Technologies (SAFETY) Act program.
    • Designed for mobile devices like tablets and iPads (now available as an app on Apple iOS), as well as personal computers, and runs on most internet browsers.
• EPA’s Small System RRA Checklist
  • Free tool intended for water systems serving a population of less than 50,000.
  • Available as a fillable PDF or downloadable Word document so water systems can customize the document to their needs.
  • Walks system through critical components of water system.
• Cybersecurity resources
  • AWWA’s Water Sector Cybersecurity Risk Management Tool, to be used with Water Sector Cybersecurity Risk Management Guidance
    • Free tool designed to help water systems of all sizes meet the cybersecurity requirements of AWIA.
    • Highlights of tool:
      • Answer 22 yes/no questions about your water system’s current cyber practices.
      • Based on your answers, the tool generates a list of recommended cybersecurity controls the utility should implement to protect their Process Control System against cyberattack.
      • Recommended controls are assigned to four levels of priority.
      • The tool generates an Excel spreadsheet that a utility can use to evaluate and track the implementation status of each recommended control.

II. Submit RRA certification to EPA by the associated deadline based on total population served

• See Certification deadlines section
• See Certification resources section

III. Create Emergency Response Plan (ERP)

An ERP describes strategies, resources, plans and procedures utilities can use to prepare for and respond to an incident, natural or man-made, that threatens life, property or the environment. Incidents can range from small main breaks or localized flooding to large scale hurricanes, earthquakes or system contamination, among other examples.

The EPA does not require water systems to use any designated standards, methods or tools to create an ERP. However the system chooses to create the ERP, it must meet the specific requirements outlined under AWIA Section 2013.

• Emergency Response Plan Requirements and Assistance Resources
• EPA's Emergency Response Plan Template and Instructions
  • The ERP Template and Instructions PDF document features an embedded blank ERP template in Word format that can be easily accessed and modified by utility personnel to meet their own water system needs.

IV. Submit ERP certification to EPA no later than six months after the RRA certification date

• See Certification deadlines section
• See Certification resources section

Certification deadlines

Certification resources

• AWIA requires you to submit only a certification of completion of an RRA and an ERP; therefore, do not submit the actual RRA and ERP documents to U.S. EPA.
• A certification must be submitted for each applicable PWS ID.
• U.S. EPA strongly recommends you electronically submit your community water system's certification statements using their user-friendly, secure online portal. This will be the only reporting method where U.S. EPA will be able to provide an acknowledgment of receipt of your certification statement.
• You can also submit your certification via email or regular mail.

Your utility's deadline

Want to confirm your utility's deadline? Here is the list of systems in Wisconsin that serve a population over 3,300 that includes:

• system name;
• designated AWIA contact name; and
• associated certification due dates.

This list was sent to EPA to assist with their implementation of AWIA. EPA will be using your AWIA contact's email to confirm your certification due dates and for any other AWIA-related communications. Additionally, emails will be sent from EPA's online AWIA certification system with reminders concerning each system's deadlines.

Please contact the department if you have any questions or need to update your system's AWIA contact.

Determining certification due dates: total population served

The total population used to determine AWIA Risk & Resilience Assessment/Emergency Response Plan Certification deadlines includes:

1. the population your system serves directly; AND
2. the population of all consecutive systems that your water system supplies (if applicable).

Here is an example to illustrate. System A serves three consecutive systems: System B, System C and System D.

• System A
  • Direct population served = 30,000
  • Consecutive population served = 15,000 + 8,000 + 2,000 = 25,000
  • Total population served = 55,000
  • AWIA Risk & Resilience Assessment Certification Due Date = December 31, 2020
• System B
  • Direct population served = 15,000
  • Consecutive population served = 0
  • Total population served = 15,000
  • AWIA Risk & Resilience Assessment Certification Due Date = June 30, 2021
• System C
  • Direct population served = 8,000
  • Consecutive population served = 0
  • Total population served = 8,000
  • AWIA Risk & Resilience Assessment Certification Due Date = June 30, 2021
• System D
  • Direct population served = 2,000
  • Consecutive population served = 0
  • Total population served = 2,000
  • AWIA Risk & Resilience Assessment Certification Due Date = N/A (total population < 3,301)

AWIA Resources

• EPA AWIA
• WaterISAC
• Wisconsin Water and Wastewater Agency Response Network (WARN)

Related links

• Drinking water security and emergency preparedness
• America's Water Infrastructure Act (AWIA)