United States
Environmental Protection
Agency
Improving Security through Capacity
Development: Capacity Self-Assessments
Overview
Security is important for drinking water systems of all sizes. While the mission of public water systems has
always been to deliver a dependable and safe supply of water, the challenges inherent in achieving that mission
have expanded to include an increased emphasis on security and emergency response planning. State drinking
water primacy agencies, along with other state agencies and organizations, are working to support this "all
hazards" approach and enhance the security and emergency response capabilities of public drinking water
supplies by:
• providing training and technical assistance;
• integrating security and emergency response into other drinking water program areas;
• increasing communication among inter-state and intra-state agencies, and
• improving measures to protect the public from bioterrorism, man-made threats, and natural disasters.
Integration is one important way state primacy agencies can help to incorporate security into their capacity
development strategies. For example, capacity self-assessment forms used by many states help small systems
analyze their technical, managerial, and financial (TMF) capabilities. Adding security and emergency response-
related questions to these forms will help systems consider elements of basic security and enable them to
explore options that improve performance and enhance security.
This brochure focuses on the needs of drinking water systems serving 3,300 or fewer persons and illustrates
how states can use existing tools—such as capacity self-assessments—to help systems address security
concerns. It also explains why states should encourage systems to assess their vulnerabilities and plan for
emergencies.
How Does a Security "All Hazards" Approach Help Capacity Dev
A well managed, financially sound, and technically proficient water system is better prepared and positioned to
respond to any type of emergency. Any system that has: identified and assessed its physical, human, and cyber
vulnerabilities; taken positive steps to reduce its risk to manmade and naturally occurring events; devised a
strategy to cover improvement costs; and shared strategic decision points with its customers is an excellent
example of a system that demonstrates TMF capacity.
Assessing vulnerabilities and planning for emergencies are important actions for all systems to take because
vulnerability assessments help identify and assess the risks posed by both potential attacks and natural disasters.
They also can help systems plan to reduce risks and respond to emergencies. Some small water systems may
already have emergency response plans (ERPs) that address such issues as the handling and use of chlorine or
loss of power. However, most small system ERPs do not address the potential for intentional attacks or the
consequences of pandemic influenza, so states should consider helping systems design or revise their ERPs to
address these possibly disastrous situations. Each of these activities also support one or more elements of TMF
capacity.
-------
How Can State Capacity Development Programs Help Small Systems Improve Security?
State capacity development programs help drinking water systems acquire and maintain the TMF capabilities
needed to consistently achieve the Safe Drinking Water Act's (SDWA's) public health objectives.The fundamental
goal of capacity development assistance and oversight is to improve a system's ability to provide a safe and
reliable supply of drinking water. Ensuring that a water system has adequate security is an integral part of
reaching that goal.
States can use their capacity development programs to help
small systems better position themselves to prepare for, detect,
deter, respond, and recover from any incident - whether man-
made, ranging from vandalism to intentional contamination, or
natural disasters such as hurricanes, tornadoes, or earthquakes.
Combining these efforts will enable systems to continue to
improve TMF capacity while also protecting against threats and
being better positioned to recover from an event. The capacity
self-assessments that many states use are excellent tools to
incorporate security and emergency response activities. Adding
security-related questions to an existing self-assessment can:
States can use their
capacity development
programs to help small
systems identify and
implement new security
measures and strengthen
existing ones.
Help systems consider security and ERP strengths
and weaknesses;
Help states and systems coordinate planning and
response capabilities to further protect public
health;
Help states target technical assistance, training and
funding opportunities for security enhancements.
Destruction in the wake of Hurricane Katrina
Achieving Integration: Bringing Security and Capacity Development to Small Systems
Assessing the vulnerability of a water system can be integrated into systems' efforts to achieve and maintain TMF
capacity. Coordinating these efforts will enable systems to improve performance and be better prepared for any
emergency. The following questions are intended primarily for use with existing capacity self-assessment forms;
however, the questions can be incorporated into capacity development efforts in other ways to meet the needs
of individual states.
-------
Capacity Development and Security Assessment Questions
Technical Capacity
The following questions relate to the technical capabilities of a water system. Ensuring the security of a system's
infrastructure, equipment, and water source, and planning for continued operation in the event of an attack or
natural disaster are important components of TECHNICAL CAPACITY.
I. Does the system have a plan to protect its facilities? Security procedures, including limiting access to
sensitive sites such as treatment facilities and areas where data (electronic or hard copy) are stored, will help
protect system facilities. Developing procedures to protect the system (including its physical infrastructure and
computer and Supervisory Control and Data Acquisition [SCADA] systems) will help reduce the threat posed by
disgruntled personnel or others. Password control should be a priority.
Fencing provides security for an impoundment.
2. Does the system have basic physical security components, such as door locks and fencing? An ef-
fective way to improve technical capacity and protect a public water system against vandalism and other acts of
destruction is to lock all facilities (e.g., buildings, storage hatches, and access gates) and fenced in infrastructure
components such as well heads, storage tanks, equipment, and water treatment plants (especially areas where
chemicals are stored or used). Roads to treatment plants, storage tanks, and other facilities should be properly
gated, locked, and routinely inspected.
3. Does the system have a policies and procedures manual, and does the manual include security-
related information? Having a policies and procedures manual will help to ensure that system personnel have
a plan of action and are equipped to handle emergencies when they arise. An ERP can establish a clear chain of
command in the event of any security or disaster-related event. It should specify which staff members are re-
sponsible for alerting the police, securing facilities, and contacting customers.
-------
Capacity Development and Security Assessment Questions
4. Is there security-related training available to the operator? As
part of a state's operator certification or other educational programs,
operators should be encouraged to participate in security-related training.
Such training can inform operators about the types of emergencies that may
occur, the appropriate response procedures, and new tools and security-re-
lated information that are available.
5. Are critical facilities and components inspected as part of the
operator's daily routine? Increased frequency of inspections of water
system components and infrastructure will increase the opportunities to
identify and address signs of tampering, vandalism, or potential disrup-
tion. It may also help identify a time frame when the incident could have
occurred which will assist in determining the type and level of response
needed.
6. Does the operator(s) know the location of existing hydrants and
valves? The operator should routinely exercise valves and make sure there
are enough valves, in the proper locations, to isolate any contaminated
parts of the system. Hydrants should be flushed on a regular schedule and
locked when not in use.
A sign warns against tampering
with this hydrant
Public access to storage facilities
should be restricted
7. Have abandoned wells and intakes been properly removed from
service? Abandoned wells should be filled completely with grout to pre-
vent accidental or intentional contamination of an aquifer that provides
drinking water. Such wells and abandoned surface water intakes should all
be physically disconnected from the system.
8. Are chemicals used for treatment properly stored? Flammable or
explosive chemicals should be stored in locked areas with proper safety
equipment. Upon delivery, the operator should review the chain of custody
sheet or bill of lading, stock numbers to verify chemicals are certified for
potable water, and material safety data sheets.
9. Does the water system track chemical usage? The operator should
make sure that records of water and chemical use are kept and routinely
updated. A sudden increase in chemical or water use may signal potential
contamination or tampering with chemical supplies.
10. Is the entire staff properly trained in the location and use of
safety equipment? Staff should know where the safety equipment is and
how to use it with confidence during an emergency. Routine safety drills will
help improve familiarity with safety equipment and operation. Safety equip-
ment should be checked routinely to ensure proper performance.
I I. Does the system have a backflow prevention or cross-connection control program in place? Un-
protected cross-connections can result in serious chemical or microbiological contamination. Cross-connections
should be protected in order to prevent backflow, which can be hard to detect. In any distribution system, po-
tential cross-connections, and therefore sources of contamination can be numerous, varied, and unpredictable.
Having these programs in place can help avoid the costs of responding to a contamination incident.
-------
Capacity Development and Security Assessment Questions
Managerial Capacity
Ensuring that procedures are in place to handle a breach of security or a natural disaster is an extension of mana-
gerial capacity. The questions below will help systems identify communication gaps and vulnerabilities, as well as
the security procedures necessary to ensure adequate MANAGERIAL CAPACITY.
I. Has the system taken measures to improve security? To be prepared for a natural disaster or man-
made emergency, a system may need to improve existing infrastructure and security-related measures. States
can encourage small systems to take a variety of measures, including preparing a vulnerability assessment, an ERR
or both, to assess their security strengths and weaknesses.
2. Are written procedures for operating the system in place and updated regularly? Written proce-
dures are important for consistent operation and are particularly useful for helping new staff members under-
stand the system. Written procedures are important for facilities operated by SCADA systems so that if the
SCADA network fails, the water system can be operated manually. Written procedures—plus training—will
facilitate continued operation of the system before, during, and after an emergency occurs.
3. Does the system have procedures for handling new and former employees (e.g., collecting keys,
changing locks and computer passwords)? New personnel and disgruntled or terminated employees may
present a potential security risk. Limiting access to secure areas using photo identification and developing proce-
dures to protect system components (including physical infrastructure, computer, and
SCADA systems) will help to reduce potential threats to the system. Systems should
practice proper hiring procedures and should conduct background checks on all em-
ployees.
4. How does the system receive information about state security programs?
A water system's knowledge of good security plans and procedures is an indicator of
managerial capacity. A system that understands SDWA requirements and state-specific
protocols, knows how to comply with them, and has the capability (e.g., equipment and expertise) to comply will
also be better prepared to protect public health during an attack, incident, or emergency situation.
5. Does the system communicate regularly with state and local officials, including law enforcement,
on security matters? Using established communication channels with state agencies and local law enforce-
ment, water systems can improve their security risk management by increasing their awareness of new de-
velopments and tools. These channels can also provide state and local officials with up-to-date system contact
information. One of the most advantageous means of achieving this communication is through participation in a
mutual aid network.
6. Has the system established a good working relationship with local emergency response and local
health agencies? Coordinating with local emergency response agencies provides water system personnel with
information about potential threats. Coordinating with local health officials provides opportunities for informa-
tion exchange to meeting common public health protection goals. These relationships will enable the system to
identify other state and local officials who should be notified about breaches of security, natural disasters, and
other health crises.
-------
Capacity Development and Security Assessment Questions
7. Is the system routinely patrolled by local law enforcement, and do the loca aw enorcement per-
sonnel know whom to call at the system in an emergency? Because they are often the first to respond in
an emergency, local law enforcement should be familiar with public water system facilities. Providing local law
enforcement with a list of public water system contacts (including home and cellular telephone numbers) and
their responsibilities will help ensure that facilities and customers are safeguarded in the event of an emergency.
Systems should be encouraged to invite local law enforcement to tour their facilities and should provide informa-
tion about important system components, including their locations.
8. Does the operator know whom to contact in the event of an emergency, and does the system
maintain a written list of contacts? Water system operators should know whom to call in case of natural
disaster and in response to criminal threats and security breaches. The water system should create and maintain
a list of contacts that is updated periodically for this purpose. The method of notification and the appropriate
contact person will depend on the type of threat.
9. Has the system developed a communication plan to alert customers to a natural or intentional
threat to public health? A clear communication plan ensures that the public is alerted when a natural disaster
or criminal attack leads to changes in the water supply. Management must be able to notify and provide instruc-
tions to the public quickly and efficiently before, during, and after an emergency occurs.
10. Does the system work with citizens to promote security awareness? Communication between sys-
tem personnel and customers is an important indicator of managerial capacity. Systems can educate and empow-
er consumers so they can effectively and inexpensively act as security agents to protect system facilities, similar
to neighborhood watch programs.
I I . Has the system conducted or participated in
tabletop or other practice scenarios for water
security or taken advantage of available security
training on topics such as Incident Command Sys-
tem (ICS)? Operators are a small system's first line
of defense. It is critical that they have the knowledge
and understanding to respond appropriately in time
of crisis. Tabletop exercises, held in coordination with
first responders, emergency management personnel,
and law enforcement, can help ensure that any neces-
sary response is appropriate, timely, and well coordi-
nated. Small systems should also be aware of recent
Federal requirements for compliance with the National
Incident Management System-Incident Command Sys-
.... , .. ...... , c . . , .. labletop exercises are useful for planning coordi-
tem as a condition of eligibility for Federal funding.
nated responses to security threats
-------
Capacity Development and Security Assessment Questions
Financial Capacity
Having sufficient resources, or access to adequate financial capital, is important when addressing security-related
matters. Systems need to be prepared financially to deal with emergencies to ensure continued service, protec-
tion of public health, and economic stability of the community. The following questions will help determine if a
system's current financial situation and planning efforts will ensure adequate FINANCIAL CAPACITY to ad-
dress security-related matters.
I. Do the rates cover the costs of security planning and response needs, and are the rates reviewed
at least annually? Annual reviews of water rates should be a part of a system's financial planning. These re-
views help ensure that water rates continue to cover all costs. Anticipating costs early will help the system pre-
pare for necessary improvements and will allow the impacts on system revenues to be spread out over time.
2. Does the system's budget include resources for assessing vulnerabilities and planning for emergen-
cies? A budget that allows a system to assess vulnerabilities and properly prepare for emergencies will ensure
that the water it delivers is safe and consumers are not at risk.
3. Does the system's budget include resources for staff training in
security matters? Having capable staff on hand in an emergency is the
first line of defense for a water system. A budget that ensures the system
has the appropriate staff to handle emergencies is an important part of
water system financial capacity. Funding for training in security matters
will prepare system operators and other personnel to deal effectively
with emergencies.
4. Does the system produce and use a capital improvement plan
that includes security upgrades and components? A capital im-
provement plan is an important part of a system's long-term financial
future. Security improvements that a system plans to make during the
next 5-7 years should be accounted for in its capital improvement plan.
5. Does the system have reserve funds available in the event of
an emergency? In an emergency, a water system may need quick access to capital. An emergency reserve
fund will help prepare the system to meet the financial obligations that may arise (e.g., pumps, chemicals, renting
equipment, supplemental staff)
6. Does the system's budget include funds to communicate with the public to promote security
awareness? Allocating funds to develop communication materials that promote security awareness will ensure
that consumers understand potential security threats, know how to help in case of an emergency, and under-
stand the system's ongoing efforts to improve security. Some systems promote security awareness through
neighborhood watch programs and other community efforts.
7. Does the system's budget include funds to develop and implement a communications plan to alert
customers in an emergency? An emergency may affect a system's ability to provide safe drinking water to the
public. Preparing and implementing a communications plan will ensure that staff know how to provide informa-
tion to the public and partners in an emergency.
•
-------
Capacity Development and Security Assessment Questions
Destruction in the wake 01
~ane Katrina
Communication: Building and Strengthening Partnerships
Communication is a key to system security. To help systems improve security, states should encourage them to
develop and enhance a wide range of communication tools, such as:
Mutual Aid and Assistance Networks
• A mutual aid and assistance agreement is the foundation of the utilities helping utilities concept and
it outlines the parameters for one utility to provide personnel, equipment, or other resources to
another utility during an emergency. Throughout the nation, utilities are joining together to form Water/
Wastewater Agency Response Networks (WARNs)—intrastate mutual aid and assistance programs in
which utilities within the state sign a common mutual aid and assistance agreement.
Health Network (Pandemic Influenza + Local Health Officials)
• Using existing relationships between water systems and state and local officials ensures that system
owners or operators are alerted to new security developments and tools for implementing security
initiatives. It also ensures that the state has up-to-date contact information and knows about system
security efforts and needs.
-------
Water Security Channel (WaterSC)
• This free electronic newsletter helps water systems keep up-to-date with the latest news and events
specific to water security. WaterSC sends out bulletins and advisories issued by USEPA and the
Department of Homeland Security (DHS). The WaterSC also maintains a pass word-protected Internet
library of federal advisories.
Developing new networks. States should encourage water systems to work with community organizations,
stakeholders, customers, local public safety groups, and public health departments to capitalize on the benefits of
networking to improve security and response efforts. States should encourage systems to:
• Work with Local Emergency Planning Committees (LEPCs) to coordinate emergency response efforts.
A typical LEPC is made up of representatives of the municipal government, fire department, hospitals,
environmental organizations, and citizen groups; law enforcement and other emergency response
officials; industry; and other interested parties. LEPCs are charged with developing accident prevention
strategies and improving capabilities to respond to releases of hazardous chemicals. Water systems can
coordinate with their LEPCs to learn about potential threats, identify emergency response procedures,
and develop consumer notification protocols.
• Develop relationships with consumers and stakeholders by creating citizen watch groups. By increasing
communication between consumers, stakeholders, and system personnel, these watch groups can be an
effective and inexpensive way to improve water system security.
• Work with hospitals and local pharmacies to address patterns of illness that may be associated with
contaminated drinking water. In many instances, the local medical community (e.g., hospital emergency
rooms, clinics, and pharmacies) may be the first to discover a potentially widespread public health threat.
Maintaining contact information lists. These lists are important tools for systems to use when developing
emergency response strategies. States should encourage systems to identify contacts (including names and phone
numbers, as well as, where appropriate, home and cellular telephone numbers) for these organizations and place
the information in the system's O&M manual:
• Local public safety (police, fire, and county sheriff's department)
• LEPCs
• Neighboring drinking water utilities
• State drinking water officials
• Local and state public heath departments
• Hazardous materials (Hazmat) response teams
Critical customers, including hospitals, schools, and industries
Power companies
Newspapers/Media
Critical suppliers (chemicals, equipment)
• WARN or mutual aid and assistance network
-------
Additional Information
States also may want to encourage the use of many security-related documents, workbooks, and checklists that
can help small water systems improve security.
• U. S. Environmental Protection Agency (EPA)
.. . http://cfpub.epa.gov/safewater/watersecurity/index.cfm
• American Water Works Association (AWWA),
• Association of State Drinking Water Administrators (ASDWA),
• National Rural Water Association (NRWA),
• Rural Community Assistance Program (RCAP)
• National Environmental Services Center (NESC)
Selected 1 Capacity-Specific Information
Technical Capacity
Infrastructure Adequacy - Source Water Protection - System Operations
• Water Security Research and Technical Support Action Plan
... www.epa.gov/safewater/watersecurity/pubs/action_plan_final.pdf
• Emergency/Incident Planning ... cfpub.epa.gov/safewater/watersecurity/home.cfm?program_id=8
• Interim Voluntary Security Guidance for Water Utilities (includes Tips for Small Systems)
... www.awwa.org/science/wise/report/cover.pdf
• EPA Security Product Guides ... cfpub.epa.gov/safewater/watersecurity/guide/tableofcontents.cfm
• EPA Emergency Response Plan for Small and Medium Systems
... www.epa.gov/safewater/watersecurity/pubs/small_medium_ERP_guidance040704.pdf
Managerial Capacity
Effective External Linkages - Ownership Accountability - Staffing and Organization
• Emergency Response Tabletop Exercises ... www.epa.gov/safewater/watersecurity/tools/trainingcd/
• Top Ten List for Small Groundwater Suppliers
... www.epa.gov/safewater/watersecurity/pubs/fs_security_smallsuppliers_top I O.pdf
• AWWA WARN ... www.awwa.org/Advocacy/govtaff/issues/lssue07_Water_Response_Networks.cfm
Financial Capacity
Credit Worthiness - Fiscal/Management Controls - Revenue Sufficiency
• EPA Water Security - Grants and Funding ... cfpub.epa.gov/safewater/watersecurity/financeassist.cfm
• Drinking Water State Revolving Fund (DWSRF) ... www.epa.gov/safewater/dwsrf/index.html
• NIMS/ICS Training ... www.nimsonline.com/ics_training/index.htm
-------
Capacity Development and Security Assessment Questions
fee
TOP TEN LIST
Water Supply Emergency Preparedness
and Security for Law Enforcement
alancing public health protection, evidence preservation,
public alerts, multi-agency coordination, and the safety of first
responders will be a difficult task. These are ten ideas to help
you achieve that balance:
Know the water systems in your jurisdiction
including the location and function of each water supply source and facility.
Conduct walk through familiarization exercises
regularly with water supply personnel. Discuss areas of system vulnerability.
KnOW tne CnemiCalS* at each facility. Be familiar with emergency
response procedures and routine chemical delivery procedures and schedules.
Meet water supply personnel face to face. Know official vehicles
and identification badge or card type.
Work with established community watch groups.
Be sure to include a feedback mechanism for future support.
Respond, investigate and report each and every incident
involving water supply facilities using the appropriate reporting form. Contact the water
supplier about any incident if they are not already present.
in context
Participate in Public notification strategies
with local emergency response plans. Know the clearly established communications
responsibilities.
HXvlvldv VI til Id DCt during patrols for suspicious activity including those
of vehicle movement, fire hydrant incidents or any other unusual incidents near water
supply facilities.
Know the Homeland Security Advisory System
response steps for law enforcement personnel.
Water supply security...for the community and for
yUUr duTviy* All law enforcement personnel must be cognizant that both
individual and collective efforts for increased water supply security will enhance
community and officer safety.
visit us on the '..„„ „..
http://www.epa.gov/safewater/security/
Local water supplier phone #:
United States
Environmental Protection
k Agency
September 2003
-------
Ad
dditional Resources
EPA Small Systems Web site www.epa.gov/safewater/smallsys.html
EPA Security Web site cfpub.epa.gov/safewater/watersecurity
EPA Drinking Water Academy www.epa.gov/safewater/dwa.html
EPA Homeland Security Research www.epa.gov/ordnhsrc
EPA Emergency Preparedness www.epa.gov/ebtpages/emeremergencypreparedness.html
EPA Lab Compendium www.epa.gov/compendium
EPA Water Contaminant Information Tool www.epa.gov/wcit
Water Security Channel www.watersc.org
Center for Disease Control www.bt.cdc.gov
Department of Homeland Security www.dhs.gov
FEMA Emergency Management Institute www.training.fema.gov/IS/ceus.asp
FEMA National Incident Management System Integration Center .. www.fema.gov/emergency/nims/index.shtm
US National Response Team www.nrt.org
Water Health Connection www.waterhealthconnection.org
Office of Water (4606M)
EPA 8I6-F-05-008
www.e pa.gov/safewate r
November 2007
<3>
Printed on Recycled Paper
------- |