UNDERSTANDING AMERICA’S WATER INFRASTRUCTURE ACT (AWIA) OF

2018

Kevin M. Morley, Ph.D.Manager, Federal RelationsAWWA – Government Affairs

Terrorism or Intentional Act

AWIA §2013 COMMUNITY WATER SYSTEM RISK & RESILIENCE

Vulnerability Assessment (VA) Risk & Resilience Assessment (RRA)All-Hazard

Submit VA to EPA Certify RRA complete to EPA Emergency Response Plan Prepare/Update & Certify to EPA

Directs EPA to recognize voluntary consensus standards

BT Act 2002 AWIA 2018

Directs EPA to provide baseline threat info

STEP 1. COMPLIANCE DEADLINES#

# Must review, update & recertify every 5 years * Wholesalers must use population of all systems servedα Population is determined by SDWIS Profile

Community Water System

(pop. served)*α

Certify RRA on or no later than:

Certify ERP within 6 months of RRA, but

not later than:

>100K March 31, 2020 September 30, 2020

50,000 – 99,999 December 31, 2020 June 30, 2021

3,300 – 49,999 June 30, 2021 December 30, 2021

STEP 2:CONDUCT RISK & RESILIENCE ASSESSMENT

A. Malevolent Acts and Natural HazardsB. Critical Assets• Pipes and constructed conveyances, physical

barriers, • Source water, water collection and intake,• Pretreatment, treatment, • Storage and distribution facilities, • Electronic, computer, or other automated systems;• Monitoring practices of the system;• Financial infrastructure of the system;• Use, storage, or handling of various chemicals by

the system; and• Operation and maintenance of the system; and• May include an evaluation of capital and

operational needs for risk and resilience management.

STEP 3: PREPARE/UPDATE EMERGENCY RESPONSE PLAN

strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system;

plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water;

actions, procedures, and equipment… lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers; and

strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.

AWIA §2018 SOURCE WATER

• State must promptly notify a community water system of a release impacting source waters

• Access to EPCRA Tier II data from any facility within a delineated source water area granted to community water system

AWWA RISK & RESILIENCE RESOURCE SUITE

Guidance Resources

Planning for an Emergency

Drinking Water Supply

(EPA/AWWA)

Selecting Disinfectants in a Security-

Conscious Environment

Emergency Power Source Planning for Water and

Wastewater

Emergency Water Supply

Planning Guide (CDC/AWWA)

Cybersecurity Guidance &

Use-Case Tool

ANSI/AWWA G430-14 Security

Practices for Operation

and Management

ANSI/AWWA G440-17 Emergency Preparedness Practices

ANSI/AWWA J100-10

(R13) Risk & Resilience

Management

M19 Emergency Planning for Water and

Wastewater Utilities

ANSI/AWWA G300

Source Water

Protection

Operational Guide to AWWA

Standard G300

AWWA Standard

AWWA Manual

Cybersecurity #1 Threat to Critical Infrastructure

• Due Diligence• Best Practices• Foreseeability• Consistent &

Repeatable• Recognized by

USEPA, DHS, NIST and multiple states.

HOW IS RRA AND ERP CERTIFIED?

Option 1: Electronic Submissionhttps://www.epa.gov/waterresilience/how-certify-your-risk-and-resilience-assessment-or-emergency-response-plan

Option 2: Email or Regular Mail (using EPA template)

• Email: awiasupport@epacdx.net

• Mail: U.S. EPA Data Process CenterATTN: AWIAC/O CGI Federal12601 Fair Lakes CircleFairfax, VA 22033

RRA ERP

WHAT IF CERTIFICATION IS NOT SUBMITTED?

• Utility may be subject to enforcement action by EPA under SDWA §1414

• Penalty = $57,317/day

AWWA RISK & RESILIENCE RESOURCE SUITE

Guidance Resource

s

Planning for an Emergency

Drinking Water Supply

(EPA/AWWA)

Selecting Disinfectants in a Security-

Conscious Environment

Emergency Power Source Planning for Water and

Wastewater

Emergency Water Supply

Planning Guide (CDC/AWWA)

Cybersecurity Guidance &

Use-Case Tool

ANSI/AWWA G430-14 Security

Practices for Operation

and Management

ANSI/AWWA G440-17 Emergency Preparedness Practices

ANSI/AWWA J100-10

(R13) Risk & Resilience

Management

M19 Emergency Planning for Water and

Wastewater Utilities

ANSI/AWWA G300

Source Water

Protection

Operational Guide to AWWA

Standard G300

AWWA Standard

AWWA Manual

COMPLIANCE DEADLINES#

Community Water System

(pop. served)*

Certify RRA on or no later than:

Certify ERP within 6 months of RRA, but

not later than:

>100K March 31, 2020 September 30, 2020

50,000 – 99,999 December 31, 2020 June 30, 2021

3,300 – 49,999 June 30, 2021 December 30, 2021

# Must review, update & recertify every 5 years * Wholesalers must use population of all systems servedα Population is determined by SDWIS Profile

QUESTIONS

Kevin M. Morley, Ph.D.Manager, Federal Relations

AWWA – Government Affairs202-628-8303 or kmorley@awwa.org

www.awwa.org/riskwww.awwa.org/cybersecurity