Ten Things You Need to Know About America’s Water Infrastructure Act
By Jason Mercer, PE – Many water treatment plant operators and water system managers will soon be addressing new EPA rules contained in the America’s Water Infrastructure Act of 2018 (AWIA). This act requires water system managers and operators to prepare planning and assessment documents concerning a range of operational and risk response measures.
We have staff trained through the American Water Works Association’s Utility Risk & Resilience Certificate Program. We can assist water systems in completing the required Risk and Resilience Assessments (RRA) and Emergency Response Plan (ERP).
Are you a water treatment manager or operator who will be responsible for meeting these new federal requirements? If so, here are 10 things you need to know:
There are several hard deadlines associated with the AWIA, depending on the population you serve. This chart breaks down the communities by size and lists the deadline dates:
|Population Served||Risk Assessment Due||Emergency Response Plan Due|
|≥100,000||March 31, 2020||September 30, 2020|
|50,000 – 99,999||December 31, 2020||June 30, 2021|
|3,301 – 49,999||June 30, 2021||December 30, 2021|
If these deadlines are not met, water systems may be fined up to $25,000/day by EPA. Specifically, failure to certify the completion of your assessment and emergency response plan by the required dates could subject your water system to that maximum fine.
2. Vulnerability vs. Risk and Resilience Assessments
Under the Bioterrorism Act of 2002, water systems serving a population greater than 3,300 were required to complete “vulnerability assessments” that focused on malevolent acts of terrorism or other intentional threats against critical water system components. Under the AWIA 2018, vulnerability assessments are now called Risk and Resilience Assessments (RRAs). RRAs still require an assessment of the water system related to malevolent acts of terrorism or other threats, plus it requires evaluation of your water system related to cybersecurity as well as impacts on the water system from natural hazards. This is considered an “all hazards” approach to evaluating the water system. This approach gives you the water operator a broader picture of threats that may impact the operation of your water system.
Utility-targeted cybercrime is growing. The recent attack on a water plant in Florida is a real-time example of this growing threat. These days our water systems require a significant amount of computing power to run and operate efficiently and effectively, which increases the risk of cybercrime. Evaluating your cybersecurity protocols on your SCADA system is important as is evaluating protocols on your financial and internal HR systems that store personal information on your employees. The review of policies, procedures, and your resilience to these types of attacks is an important addition to the RRA.
The AWWA (American Water Works Association) and EPA (Environmental Protection Agency) have assembled a number of guides and new software to help you complete your RRA and ERP. Their websites offer updated guidance manuals for security, evaluating potential threats, identifying consequences, and calculating your risk and resiliency.
EPA has also developed a tool for assessing risk and resilience in drinking water and wastewater systems, called VSAT (Vulnerability Self-Assessment Tool) Web 2.0. It is a free online tool and can be used to estimate risks from all hazards and evaluate improvements you can make to increase security and resiliency for critical assets.
AWWA also has a cybersecurity tool to help water systems adopt the NIST (National Institute of Standards and Technology) Cybersecurity Framework. This free tool generates a prioritized list of recommended improvements based on your utility.
5. Capital Improvements
Your RRA will generate a list of capital improvements to complete in the near term and long term. Focusing on resiliency during planning and design will ensure the capital improvements plan addresses those items that present the greatest risk. This will help you educate your decision makers on the need for these projects and the value these projects bring to protecting the utility and the customers of the water system.
6. Stakeholder Input
The RRA and ERP are planning level documents and will require input and guidance from many key staff members within the water system and from the local community of emergency responders and agencies. Support from utility leadership, decision makers, and political leadership within the community will help in undertaking this important effort. Their buy in is essential.
In 2002, water system utilities had to submit hard copies of their vulnerability assessments to EPA. Under AWIA 2018, water systems will submit a letters certifying that they have conducted the RRA and completed their ERP by the required deadlines. This is a much simpler process for water systems and something that can be done electronically. An option to these certification letters is online certification.
Plus, your RRA and ERP remain in your custody to help prevent bad actors from tapping into your information.
AWIA 2018 also requires that water systems complete an update and review of their RRA and ERP every five years at a minimum. Utilities must also maintain records of their RRA and ERP—including any updates—for five years.
Documenting and updating your ERP and RRA will be important as you complete projects that improve the resiliency of the water system. One best practice? Treat these documents as “living documents” and review them annually.
If you are starting from scratch or with limited data, the clock is ticking. It is never too early to start, and the more time you can give yourself to do a thorough job, the better. Additional lead time will help to make sure you have done your homework to develop a RRA and ERP that will serve your water system and its customers well.
The term “resilience” means the ability of a community water system (or an asset of a community water system) to adapt to, or withstand, the effects of a malevolent act or natural hazard without interruption. It also helps the system rapidly return to a normal operating condition if something should occur.
No water system operator wants to be in the headlines like the recent incident in Florida because they failed to anticipate a malevolent act or natural hazard. We have seen that water systems increasingly are at risk for such events. A properly prepared RRA and ERP will help you anticipate such events and better yet, position you to respond quickly and effectively, preventing a potential disaster to your system or community.
Morrison-Maierle is here to help. We have staff trained in completing the RRA and ERP. If you have questions about getting started, please contact me.
Jason Mercer, PE brings over 20 years of water and wastewater experience to his leadership role at Morrison-Maierle. He has designed and managed projects in Montana and Arizona. Jason focuses full-time on providing water consulting services through a dynamic team.