&EPA
United States
Environmental Protection
Agency
Drinking Water Security for
Small Systems Serving 3,300
or Fewer Persons
One of the Simple Tools for Effective
Performance (STEP) Guide Series
-------
Disclaimer
The U.S. Environmental Protection Agency (EPA) prepared this guide to help you enhance the security of your
water system. This document does not impose legally binding requirements on EPA, states, tribes, or the
regulated community, and it may or may not be applicable to a particular situation depending on the
circumstances. EPA and state decision makers retain the discretion to adopt approaches on a case-by-case basis
that may differ from this guidance where appropriate. Any decisions regarding a particular community water system
will be made based on the applicable statutes and regulations. Therefore, interested parties are free to raise
questions and objections about the appropriateness of the application of this guide to a particular situation, and
EPA will consider whetherthe recommendations or interpretations in this guide are appropriate in that situation
based on the law and regulations. EPA may change this guidance in the future. To determine whether EPA has
revised this guide orto obtain additional copies, contact the Safe Drinking Water Hotline at (800)426-4791.
MI
-------
Contents
Is This for [[[ 1
I Learn? ...............................................
Is It to and for ...........................................3
Is a [[[4
I Immediately[[[ 12
Is an Plan[[[ 16
Do I and in the Run[[[ 27
I My Customers[[[30
-------
Is This Guide for Me?
This guide is designed for community water systems (CWSs) serving 3,300 or fewer persons. CWSs include all publicly and privately owned systems
providing drinking waterto at least 25 year-round residential customers or 15 year-round service connections. This guide may be useful for:
Small town systems
Rural water districts
Tribal systems
Manufactured home communities
Homeowners' associations
Small private systems
Public Service Districts (PSDs)
This guide presents basic information and steps you can take to improve security and emergency preparedness at your water system. It explains why
security improvements are important and discusses Vulnerability Assessments (VAs) and Emergency Response Plans (ERPs) - tools that you can
use to improve security at your system.
Additional copies of this guide may be obtained by calling the Safe Drinking Water Hotline at (800) 426-4791. You may also download the guide from
EPA's Water Security Web site at http://epa.gov/safewater/watersecurity.
Your state (see box below) can provide additional security-related material and help you implement appropriate security measures at your water
system. State contact information can be found in AppendixA. Drinking water industry associations and technical assistance providers also are
actively involved with water security issues. See "Where Can I Find Additional Help?" on page 34 for their contact information.
Please note that the term "state" is used in this guide to refer to your Drinking Water Primacy Agency. The Primacy
Agency for most systems is the State Drinking Water Agency. However, the Primacy Agency for systems located in the
Navajo Nation is the tribal office. The Primacy Agency for systems located on othertribal lands, in the State of
Wyoming, or in the District of Columbia is the EPA regional office.
1
a
-------
What Will I Learn?
Part of providing safe drinking water is protecting your system from various threats and preparing for emergencies. Everyone involved in water system
ownership, management, and operation-owners, operators, board members, and local officials-has a responsibility for water system security. If you
are part of any of these groups, this guide will help you by:
• Explaining what Vulnerability Assessments (VA) and Emergency Response Plans (ERP) are
• Describing the main activities and steps involved in completing VAs and ERPs
• Identifying user-friendly tools, templates, software, and checklists that can help you work through your VA and ERP
In this guide, you will learn about drinking water security initiatives and how to take practical actions to improve security at your system. You will also
learn how to help ensure that your system is prepared to handle an emergency.
What Are Systems Serving More than 3,300 Persons Doing?
In response to the 2001 terrorist attacks, Congress passed the Public Health Security and Bioterrorism Preparedness and Response Act (Public
Law 107-188) in 2002. This law requires that a CWS serving more than 3,300 persons conduct a VA. A copy of the VA must be sent to EPA
according to a schedule specified in the law. CWSs serving more than 3,300 persons must also prepare or revise an ERP and certify to the EPA
Administrator that the plan has been completed within 6 months of completing the VA. The ERP should incorporate the results of the VA and
provide details on the actions a system will take to respond to an emergency.
Although the Act's requirements do not apply to systems serving 3,300 or fewer persons, it is important for systems of all sizes to understand their
vulnerabilities and plan for emergencies. Systems serving 3,300 or fewer persons should consider completing a VAand an ERP to improve their
preparedness and response capabilities.
It is important to note that some states have their own VA and ERP requirements. Be sure to check with your state to determine if there are
requirements you must consider.
Building a Team
You will need the help of everyone involved with your water system's ownership, management, and operationsto improve security and emergency
preparedness at your system. Build a team made up of water system operators, board members, and owners and make a team commitment to
improving security and emergency preparedness at your water system.
2
0
-------
Why Is It Important to Improve Security and Prepare for
Emergencies?
There are many threats that may put at risk your ability to provide a reliable and safe supply of water to your customers. Your system may face various
man-made threats, both intentional and accidental, such as:
• Accidents (e.g., construction, traffic)
• Backflow
• Fire/arson
Hazardous material releases
Terrorism
Vandalism
The idea that your system could be the target of terrorism may seem far-fetched to you. Man-
made threats, however, are only some of many potential causes of emergencies at water
systems. Natural disasters that might cause an emergency at your system include:
• Earthquakes
• Floods
• Forest and brush fires
• Hurricanes
• Severe cold weather/ice storms
• Tornadoes
• Waterborne disease outbreaks
Your responsibility is to protect your customers from the negative outcomes of these threats.
These outcomes could include:
A shortage of drinking water
Illnesses ordeaths
Public panic and fear of drinking the water from your system
Costs of rehabilitating, rebuilding, or decontaminating your water system
Long-term contamination of yourwatersupply
Interruption of firefighting capability
Interruption of sanitary services
To deliver safe drinking water to your customers, you should have appropriate security measures in place, and you should know how to
respond to an emergency. If your system is vulnerable to any threat, the health of your customers is at risk. If you are not prepared to
respond to a crisis, the negative effects of the emergency will be magnified. Ignoring vulnerabilities and failing to properly plan for
emergencies jeopardizes the safety of the water you deliver and the health of the people who depend on it. On the other hand, if you act
now, you and your customers will have more confidence and peace of mind knowing that you are improving your system's security and
emergency-response capability.
You will see this key throughout the guide. Pay special attention to these "key points," which highlight
critical information for you and your system.
3
a
-------
What Is a Vulnerability Assessment?
AVAis a step-by-step evaluation of your system and its operations that assesses your ability to reduce the risk of different threats. A VA identifies
weaknesses in your system's security and focuses on the types of possible threats that could keep you from providing a safe and reliable supply of
waterto your customers. Once your VAis completed, you should know which of your system's components might be vulnerable, and you will have
begun to identify and prioritize the security upgrades and operational changes that will reduce risks to your system.
HOW DO I CONDUCTA VULNERABILITY ASSESSMENT?
Identifying potential security threats and completing a VA might seem like an overwhelming challenge. You might think that you need an expert to
properly evaluate your system's security. This section, however, outlines a few basic steps that will allow YOU to examine the risks facing your system.
Using this approach, along with available tools, you can evaluate your system's security and begin to address any problems or needed improvements -
without the help of outside consultants or security experts. Build a team made up of the water system operator, board members, and owners. This team
will help you develop a complete VA.
It is important to note that some states have their own VA requirements. Be sure to check with your state to determine if there are requirements you
must consider. Your state can also be a good source of assistance if you have questions about VAs.
How you perform your VAis completely up to you and should reflect the needs and characteristics of your system. That said, there are six basic steps
that everyone should follow when conducting a VA of their system (see the figure below).1 The steps described in this section offer a general overview
that will help you understand the activities necessary for an effective VA. Completing these steps will help you take a thorough look at the security risks
your system faces.
To complete your VA, follow the six steps on the following pages. The graphic below will help you track the steps as you move from
steps; these tools are listed in "Where Can I Find Additional Help?" on page 34.
1: Evaluate System —^-2: Identify Threats
3: Consider Consequences E 4: Assess Likelihood E 5: Evaluate Measures ^6; Plan Action
1 These six steps are based on the six basic elements listed in Vulnerability Assessment Factsheet, EPA Office of Water (EPA 816-F-02-005); November
2002.
4
ft
-------
VA Step 1
YOUR SYSTEM AND ITS COMPONENTS - KNOWING AND EVALUATING CRITICAL RELATIONSHIPS
In this step you should think about your entire water system, including your primary goals, the customers you serve, and your system's components. To
tackle this step, you should:
Think about your facilities and how
your system operates.
Identify different groups among
your customers and consider their
specific needs.
Examples of customers include
the general public, hospitals, fire
departments, industry, and retail
operations.
Identify your primary system goals.
If water service during an
emergency is especially important
to any of these groups (e.g.,
firefighters), highlight them so that
you can be sure to consider any
special activities needed to
protect their service.
• You'll want to include information
about your water source,
treatment, storage, chemical use
and storage, supervisory control
and data acquisition (SCADA)
and computer systems, and your
distribution system.
• Highlight critical facilities and
"single points of failure," or
components that are especially
important to providing a safe and
reliable supply of water, and
describe any special problems
they might face (e.g., dependency
on electricity, lack of back-up
capacity, etc.).
Although you may feel that you already are familiar with your system and how it works, evaluating each system component (including
system personnel and water source) both independently and as part of overall system operations is the key to identifying its possible
weaknesses. It is important to identify "single points of failure" in the system, or system components or processes that, if they failed,
would interrupt the system's ability to supply reliable, safe water. It is also especially important for you to identify your critical customers
(e.g., hospitals, fire departments), services, and components to help you prioritize your activities. It is important to provide yourself with an
accurate picture of yoursystem in this step. The rest of the VA process relies on this information!
Evaluate Syst
em*)
2: Identify Threats
3: Consider Consequences •
• 4: Assess Likelihood >
5: Evaluate Measures •
: Plan Action
-------
VA Step 2
IDENTIFY POSSIBLE THREATS TO YOUR SYSTEM
The second step of your VA gives you the chance to identify the types of threats that could disrupt your system's ability to provide a reliable and safe
supply of water. To complete this step, you should:
Look at the critical system facilities and components
that you identified in VA Step 1 and think about
whether a threat could realistically harm each of them.
At a minimum, you should consider the following
components in your assessment:
• Source water
• Physical barriers
• Treatment facilities
• Storage facilities
• Distribution and transmission pipes
• Computers or other automated systems (e.g., SCADA)
• Use, handling, and storage of chemicals
• Knowledge base (e.g., water system operator)
• Operations and maintenance practices
Consider each possible threat and which part(s) of
the system it would affect. Consider all types of
threats, including:
• Physical damage to the system
• Contamination of water at any point in the system
• Release of chemicals
• Interruption of electricity
• Loss or destruction of critical infrormation (e.g., stolen
system schematics)
• Loss of computers or SCADA systems
get a better idea of the threats you may face. By coming up with the most complete list you can, you will ensure that your VA considers
as many risks as possible. Making sure you really understand where and how your system is vulnerable will help you tackle VA Step 3.
1: Evaluate System
3: Consider Consequences-
4: Assess Likelihood
5: Evaluate Measures •
>6: Plan Action
6
2
-------
VA Step 3
CONSIDER POSSIBLE CONSEQUENCES
There are numerous negative outcomes that can result from threats against your system, and it's important for you to understand the possibilities. To
complete this step, you should:
Look at the types of threats you identified
in VA Step 2. Carefully consider:
The type of threat (e.g., physical damage,
water contamination)
The critical component(s) or "single
point(s) of failure" it could affect
Consider how each threat you identified
could affect your system, from the
smallest possible impact to the worst-case
scenario. Include these factors in your
thinking:
Customers who will be affected and for
how long
The potential for illnesses or deaths
The potential cost of the emergency
(including repair, decontamination, or
replacement costs for damaged
components and revenue lost during a
service outage)
The impact of the emergency on public
confidence in your system
The long-term problems resulting from the
emergency
Focus on the threats that would most harm your system's ability to provide a reliable and safe supply of water. You should be as
thorough as possible in thinking about the possible consequences of any threat. The plans that you make to reduce risk in VA Step 6
will aim to prevent or reduce the likelihood of these consequences. The more thorough you are, the better your plan will be.
1: Evaluate System
' 2: Identify Threats
3: Consider Consequences
4: Assess Likelihood •
5: Evaluate Measures •
6: Plan Action
-------
VA Step 4
ASSESS THE LIKELIHOOD OF NEGATIVE CONSEQUENCES
This task can be very difficult because often there is too little information to make a good assessment. To help you do the best job you can, you should:
Contact your state, local
law enforcement office, and
public health officials to
determine whether they
have information on the
types of threats that are
most likely in your area.
Contact nearby water
utilities to see what types of
threats they might have
faced.
Review your own incident
reports from the past few
years to better understand
past security problems at
your system.
Assessing the likelihood of specific intentional acts (as opposed to natural or accidental events) and their consequences will be
challenging, but remember that figuring out which threats are most likely will determine how your system will reduce risk and plan for
emergencies. Take advantage of all of the information you have and make sure you continuously re-evaluate the likelihood of specific
acts and their consequences. Additional tools for gathering information are discussed in "Where Can I Find Additional Help?" beginning
on page 34.
1: Evaluate System
' 2: Identify Threats •
3: Consider Consequences
4: Assess Likelihood
5: Evaluate Measures •
: Plan Action
8
ft
-------
VA Step 5
EVALUATE EXISTING MEASURES
Before you can decide what additional measures need to betaken, you should evaluate the effectiveness of what you already do to protect your system.
To complete this step, you should answerthe following questions:
What method(s) does
your system currently
use to detect threats?
The answers to this
question could include:
Intrusion detection
systems
Water quality
monitoring
Operational alarms
Accidental discovery
Neighborhood watch
group
Weather service
warnings (natural
threats)
Intentional threats,
such as vandalism,
arson, and terrorism,
require the most
extensive security
measures, but these
measures could also
help protect your
system against natural
or accidental threats.
What measures are
currently in place to
delay threats against
your system? These
could include:
• Locks and key-control
policies
• Fencing and other
proper protection of
critical system
components
• Cross-connection
control
What policies and
procedures does your
system currently have
in place to respond to
indications of threats?
Have staff members
received training on
them? Threat indicators
include:
• Intrusion alarms
• System malfunction
alarms
• Phone threats
• Water quality
indicators
What security policies
and procedures do you
have now and how well
do you follow them?
You might have policies
and procedures
covering:
Personnel safety
Hiring new employees
and performing
background checks
Security of the
physical facilities and
components
Key and access
badge control
Chemical deliveries,
handling, and storage
Security training
Handling phoned-in
threats
In answering these questions, you probably found that some system components are already adequately protected, while others are
not. This information will help you prioritize the steps you take to protect your system. Be sure to distinguish between measures that
are properly executed and well maintained and those that provide little or no protection because they are poorly executed or
maintained. It is important that you do not overlook vulnerabilities caused by inadequate security measures or lack of knowledge about
existing policies and procedures.
1: Evaluate System
' 2: Identify Threats •
3: Consider Consequences
4: Assess Likelihood
6: Plan Action
-------
VA Step 6
PLAN TO REDUCE RISKS
Based on the assessment you've worked through in VA Steps 1 through 5, you can now develop a plan to reduce the risks facing your system. The
analysis that you've done should allow you to identify your most urgent security needs and develop a plan that addresses these needs first. To develop
yourplan you should:
Develop a list of
recommended actions that
will reduce your system's
vulnerability to threats.
Specific actions are
discussed in more detail in
later sections of this guide. In
general, these actions fall
into three categories:
Sound business practices,
including changes to
policies, procedures, and
training
System upgrades, including
changes in equipment,
infrastructure, or the way you
operate your system
Security upgrades, including
changes that improve your
ability to detect, delay, or
deter threats against your
system
Rank the actions by the
urgency of the need that
each action addresses.
Does it address a threat
that is very likely or severe?
Does it address an
inadequate but critical
existing security measure?
Consider short- and long-
term solutions to each of the
vulnerabilities you identified
in your assessment.
Possible short-term
activities are discussed in
"What Security
Improvements Can I Make
Immediately?" on page 12
Possible long-term activities
are discussed in "How Do I
Maintain and Upgrade
Security in the Long
Run?" on page 27
Try to identify actions that
will produce multiple benefits
for your system or that can
be made as part of other
planned system upgrades,
for example:
Improved treatment
processes can reduce
system vulnerabilities and
enhance the day-to-day
operation of your system
Take the time to review the work you did in VA Steps 1 through 5. This will help to ensure that your plan considers all possible
weaknesses and vulnerabilities. One final word of caution: your VA contains a lot of important and sensitive information — keep it
secure, and keep a second copy in a safe offsite location.
1: Evaluate System
' 2: Identify Threats •
3: Consider Consequences-
4: Assess Likelihood >
5: Evaluate Measures
10
ft
-------
What's Next?
Your VA has identified a number of system vulnerabilities, and you have begun to address those vulnerabilities with a plan to reduce risk. The
next two sections of this guide provide more details on the two methods you can use to reduce risk:
1. You can enhance your system's security by taking direct measures that improve your ability to detect, deter, or delay threats to your
system. The next section briefly describes these concepts and offers basic security improvements that can address vulnerabilities.
2. The results of a VA should be included in your system's ERP so that you can respond effectively should vulnerable parts of your system
be threatened. "What Is an Emergency Response Plan?" on page 16 describes an ERP and takes you through a step-by-step process for
preparing one.
11
-------
What Security Improvements Can I Make Immediately?
This section will help you develop a prioritized list of improvements that will reduce your system's vulnerability to threats. Although security
improvements vary in complexity and cost, you will see in this section relatively inexpensive, practical changes that can be implemented immediately.
You may not have to hire consultants or invest in top-of-the-line technology to act right now and increase the protection of your customers at a very
reasonable cost.
The basic security measures described in this section will help improve your ability to DETECT, DETER, and DELAY security threats (see circles below).
Because many water systems share common vulnerabilities,
there are a number of solutions that most systems should
consider. Several common security actions are described on
the pages that follow. These security actions tend to focus on
intentional threats or acts, but some improvements can
produce several benefits and make your system more secure
against otherthreats (e.g., accidents, natural disasters) as
well.
Rememberthatsome of the measures
suggested on the following pages may
not be needed at your system. Some
might be more complexthan you need;
others might address vulnerabilities
that you've already remedied. Look at
your VA and choose the actions that
remedy your system's highest priority
security needs.
Detect
Know your water system and
keep an eye on your facilities so you
know when your security has been
breached (e.g., patrol your water
system perimeter, check locks and
other points of entry for signs of
tampering, establish a
neighborhood
„ watch program).
Delay
Have multiple security measures
in place to slow down anyone who is
trying to harm your system (e.g., lock
and alarm all points of entry, install
"Jersey barriers," install security
fences around facilities). Delaying an
intruder gives you more time to
detect a problem and more
time to respond.
12
-------
Restrict access to critical water system components to authorized personnel only:
One of the quickest and least expensive ways
to dramatically increase the security of your
system is to deny unauthorized personnel
access to critical system components and
"single points of failure." Supervised guests
may be allowed, but unsupervised or uninvited
guests could cause major problems, even if
they do not intend to. And remember,
disgruntled former employees have sabotaged
systems in the past.
1. Require staff to display current photo IDs at all times.
2. Post signs restricting entry to authorized personnel.
3. Record who has keys and stamp keys "DO NOT DUPLICATE."
4. Change locks and access codes regularly.
5. Require personnel to wear uniforms or other identifying clothing.
6. Identify all system vehicles prominently.
7. Require vehicles to be locked at all times.
8. Remove critical information (e.g., source water maps, plans) from vehicles before
parking them overnight.
9. Require terminated employees to return photo IDs, keys, access codes, and uniforms.
10. Install security fences around facilities.
11. Lock and consider alarming all points of entry: doors, windows, hatches, vents, and
gates.
12. Lock all access points to finished water, even those within a locked or manned
building.
13. Consider installing "Jersey Barriers" to block vehicle access to system facilities.
14. Remove objects that could be used to aid an intruder, such as ladders, overgrown
shrubs, and large rocks, near windows and other points of entry.
15. Block access to elevated storage tanks by putting physical barriers around supports.
13
0
-------
Increase monitoring and oversight:
Once access to your system is restricted and
tight, back up that security by patrolling and
monitoring your facilities so that you can detect
any threats and intrusions. All water system
personnel should know and practice their roles
in protecting your system.
1. Patrol fence perimeters and the water system (periodically and randomly).
2. Check locks and other points of entry for evidence of tampering.
3. Check critical system components regularly.
4. Install adequate exterior lighting around critical components.
5. Clear fence lines of vegetation and overhanging branches.
6. Do not park vehicles where they will block your view of critical components.
7. Update your O&M manual to include evaluation of security systems.
8. Establish a neighborhood watch program with nearby neighbors.
9. Consider expanding monitoring parameters for raw and treated water (e.g.,
pH, color, odor). Develop and maintain a baseline value for each monitored
parameter.
Communicate and coordinate with local law enforcement:
Local law enforcement is a very important
resource that you should use to make your
system more secure, but most police officers
are not familiar with water system facilities or
processes. A police presence might deter
someone from threatening your system.
1. Give police officers a tour of your water system to familiarize them with key
processes and equipment.
2. Arrange for periodic patrols of your facilities. Educate police about the
types of suspicious activities that could take place throughout the water
system.
3. Document suspicious calls and activities. Sample checklists and forms for
documenting suspicious calls and activities are included in some of the
tools found in "Where Can I Find Additional Help?" on page 34.
-------
Improve communication and security when dealing with vendors and suppliers:
Even if you improve the security at your
own facilities, chemical suppliers and
repair persons are potential sources of
vulnerability. The chemicals delivered and
stored at your system deserve special
attention because of the risk that they pose
to system staff and the public if improperly
handled or released. Safeguards will delay
and deter threats to these dangerous
chemicals.
1. Verify that your suppliers take precautions to ensure their products are not
contaminated.
2. Ensure that all deliveries are made in the presence of water system personnel.
3. Keep a delivery log.
4. Store all chemicals in a secure area designated for storage only.
5. Keep tools and equipment needed to respond to an emergency onsite.
6. Accept only deliveries scheduled in advance.
7. Require drivers to show vendor-issued ID.
8. Verify IDs of communication company employees who have access to water supply
structures for maintenance and repair of antennas and related equipment.
Upgrade computer and records security:
If your water system uses computers for
operations or to store sensitive
information, you should take some of these
steps to make sure that information is
protected and backed-up. By safeguarding
your computers and paper records, you
are delaying possible acts of sabotage.
1. Password-protect and virus-protect all computers. Change passwords and update
virus protection programs regularly.
2. Back-up files, programs, and computers regularly.
3. Ensure that no sensitive information about your system is available on Web sites.
4. Store maps, records, and other important documents in a secure location.
5. Store backup copies of maps, records, and other important documents in a secure,
off-site location.
6. Label all sensitive information "confidential" and require its return after projects are
completed.
7. Keep a record of employees who accessed sensitive information and the dates on
which they accessed the information.
Don't be intimidated by the length of these lists. Any security improvements you make will decrease the risks your system faces
and will protect the health of your customers. By detecting, deterring, and delaying threats, you are reducing your system's
vulnerabilities. Any risks you can't minimize through security measures should be addressed as part of your ERP, which is
discussed in the next section.
15
0
-------
What Is an Emergency Response Plan?
An ERP is a written, well-thought-out series of planned actions that help you respond to emergencies of all
types. An effective ERP for a small drinking water system makes use of the system's VA (see "What Is a
Vulnerability Assessment?" on page 4) by addressing possible consequences of vulnerabilities identified
in the VA. An ERP presents clear and logical steps to take in response to possible emergencies,
designates persons responsible for specific actions, provides for train ing and planned practice exercises,
and ensures effective coordination with first responders, law enforcement, and health officials.
If your water system does not have an ERP, you should prepare one. An ERP will help you organize your
response to emergencies before they happen. An emergency can happen at any time, and any problem
with the drinking water supply will become atop priority for you and the affected members of your
community. An emergency could generate tremendous and immediate pressures on system operators,
emergency response professionals, law enforcement, local health officials, and the public. Asystem that
has an ERP and has practiced organized emergency response exercises will have a much better chance of
minimizing the effects of emergencies. Therefore, having a well-planned system response to foreseeable
emergencies makes good sense.
Preparing an ERP can take some effort. You should build an internal team of water system operators, board
members, and owners to develop a complete ERP. The steps below can help you prepare a new ERP (or
update your existing ERP). Keep in mind that the most effective ERP for your system will build on the
findings of your VA. And remember that your state can be a good source of assistance should you have
questions or need help in developing your ERP. Finally, because every system is different, you may need to
modify the ERP development process described below to make it work for you.
It is important to note that some states may have their own ERP requirements. Make sure you check with
your state to see whether it has established specific requirements that you must address.
Keep in mind that the steps that follow offer only a general overview of the activities you should undertake to
complete an ERP. There are a number of resources that offer detailed worksheets or other tools to help you.
They are listed in "Where Can I Find Additional Help?" on page 34.
To complete your ERP, follow the five steps listed on the following pages. The graphic below will help you track the steps as you
move from page to page.
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
16
2
-------
ERP Step 1
ERP PREPARATION
In developing an ERP, you should identify and form partnerships with the people and organizations whose help yoursystem will need in an emergency,
including:
• Local police and fire departments
• Public health officials
• Local Emergency Planning Committees
• Local government/city managers
• State and federal agencies
• Nearby water utilities (for developing interconnections and
mutual aid agreements)
• Health care providers
• Equipment suppliers
• News media
Forming effective partnerships with these organizations and individuals will help you better develop the core elements of your ERP and better coordinate
emergency activities when the ERP is put into action. The partnerships also will help everyone become better prepared for emergency response.
Many communities have Local Emergency Planning Committees (LEPCs). Atypical LEPC is made up of representatives of the municipal government,
fire department, hospitals, environmental organizations, citizen groups, law enforcement and other emergency response officials, industry, and other
interested parties. EPA maintains a database of over 3,000 LEPCs and their contact information. Visit http://www.epa.gov/ceppo/lepclist.htmto see
whether your community has an LEPC. If it does, you should work especially closely with the LEPC when developing your ERP. Doing so will help
ensure that your response to any emergency is coordinated as efficiently as possible.
Reach out to potential partners, describe your plans and objectives to them, and solicit their input and assistance. Helping your
more effective relationships with your partners.
(j: Preparation j—^>
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
17
2
-------
ERP Step 2
THE EMERGENCY RESPONSE PLAN - CORE ELEMENTS
A number of core elements should be included in any ERP, including yours. These elements will help ensure that your ERP and emergency response
capabilities enable you to respond to any kind of emergency or threat. At the same time, the elements are flexible enough to ensure that your ERP
meets the specific needs of your system. The core elements are discussed below.
Core Element 1: System-Specific Information
In an emergency, you should be able to provide basic technical information to personnel who will provide emergency assistance. In most cases, the
organizations providing assistance will be those with which you formed partnerships under ERP Step 1. To ensure that you can provide the necessary
system-specific information quickly and accurately, it is important that you include it as an easily accessible part of your ERP.
The basic information that you should include in this section of your ERP is:
• Owner name, operator name(s), and Public Water System Identification (PWSID) number, which identifies your system to
your state and to EPA
• Population served and number of service connections
• Key information about critical system components (e.g., source water, treatment plant, water and chemical storage, and
distribution system)
• How to isolate parts of your system when the need arises
1: Preparation
3: Putting it Together
18
2
4: Action Plans
5: Next Steps
-------
ERP Step 2 (Continued)
Core Element 2: Roles and Responsibilities
You should specify roles and responsibilities for yourself and for your partners from outside of your system. First, you should designate an Emergency
Response Leader (and a back-up) who will be the main point of contact and the primary decision maker during an emergency. Other system personnel
and your partners also should understand their roles, responsibilities, and place in the chain of command. While it is important not to get bogged down
in terminology and titles, it is also important that you and your Emergency Response Leader make sure all parties are clear about their roles.
Everyone also should be familiarwith what is known as "command structure language." The Federal Emergency ManagementAgency (FEMA) and other
federal agencies are using the National Incident Management System (NIMS) to coordinate emergency efforts. Your state and local government may
also have adopted NIMS. The NIMS Incident Command System (ICS) is the standard organizational structure for all major domestic incidents. It helps to
coordinate the efforts of many emergency responders. NIMS will enable responders at all levels to work together more effectively to manage domestic
incidents no matter what the cause, size, or complexity. You can obtain more information on NIMS and the NIMS ICS from FEMA at http://
www.fema.gov/nims.
At a minimum, your ERP should include the following basic information for your Emergency Response Leader and one back-up
point of contact:
Name
Cell phone number (if applicable)
Worktelephone number
Pager number (if applicable)
Home telephone number
Address
You should also identify other key individuals and partners and describe their roles, responsibilities, and places in the chain of
command. Rememberto communicate this information to your partners verbally and in writing.
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
19
2
-------
ERP Step 2 (Continued)
Core Element 3: Communication Procedures -Who. What, and When
Timely communication with a variety of audiences is an essential component of your ERP. You should plan to notify three groups of people: system
personnel, emergency response partners, and the public/news media.
• System personnel-Your Emergency Response Leader or backup should be the first person notified of an emergency. Other appropriate
personnel should then be contacted.
• Emergency partners - These are the partners you identified in ERP Step 1. They should be contacted as necessary depending on the type of
emergency.
• Public and news media -You should designate in advance a spokesperson who will handle public and media communications during an
emergency. This spokesperson should not be the Emergency Response Leader. You should also develop a plan that your spokesperson can
follow in communicating with the media and the public. This plan will help your spokesperson maintain a message that is clear, accurate, and
easily understood by your audience. For more information about communicating with your water consumers, see "How Should I Communicate
with My Customers?" on page 30.
Your ERP should include contact information for all individuals and organizations that fall into the groups discussed above. The list
sample contact list templates you can use.
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
20
-------
ERP Step 2 (Continued)
Core Element 4: Personnel Safety
Protecting the health and safety of your personnel is an important part of your ERP. In your ERP, you should write out basic safety precautions,
identify the location of first aid supplies, and identify locations where personnel should meet in the event of an emergency. You should also
make sure that your personnel are regularly trained in all of your safety procedures.
•L ,1
The personnel safety section of your ERP should, at a minimum, include the following:
• Directions for proper first aid and medical treatment
• Procedures for using and maintaining emergency response equipment
• Identification of evacuation routes and evacuation procedures
• Identification of assembly areas and procedures for locating all personnel
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
21
2
-------
ERP Step 2 (Continued)
Core Element 5: Identification of Alternate Sources of Water
Your ERP should identify alternate sources of water that can address short-term (hours to days) and long-term (weeks to months) outages. There are a
number of different options for short-term and long-term water supplies. Short-term options include bottled water from outside sources or retailers and
bulk water from a variety of sources. Long-term options may include connecting your distribution system to a neighboring system. These alternate
sources should be clearly identified in your ERP, and the agreements or arrangements for accessing the alternate sources should be clearly spelled out.
Your source list and the agreements with these sources should be kept up to date.
You should also plan forthe impact of various public health notifications, including "boil water," "do not drink," and "do not use" notices. The different
steps you may need to take to deal with each of these notifications should be addressed clearly in your ERP. See "How Should I Communicate with
My Customers?" on page 30 for guidance on notifying your customers and providing them with instructions on how to protect themselves.
The important thing to remember is to identify short-term and long-term alternate water sources in your ERP and to establish
relevant contact information. You should also file copies of your agreements with your ERP.
Core Element 6: Equipment and Chemical Supplies
Using the results of your system's VA, you should identify in your ERP where to find the equipment, repair parts, and chemicals needed in the event of
an emergency.
This section of your ERP should include an updated list of:
• Current equipment
• Repair parts
• Chemical supplies
• Agreements with nearby systems to share portable generators and spare parts
• Contact information for any partners who can assist you with equipment and chemical supplies
1: Preparation
3: Putting it Together
22
4: Action Plans
5: Next Steps
-------
ERP Step 2 (Continued)
Core Element 7: Property Protection
Protecting your facilities, equipment, and records is very important for getting your system running again after an emergency. Your ERP should clearly
describe procedures to secure and protect important assets.
In this section of your ERP, you should consider describing how you will lock down your facilities, how you will control access to your
facilities, and the steps you will take to protect other crucial property and records.
Core Element 8: Water Sampling
Sampling is critical to determining whether the water your system produces is safe for your customers to drink and use. In your ERP, you should
address water sampling and monitoring issues that could arise during an emergency. Water sampling and analysis is critical during the detection of an
incident and during recovery from an incident. When developing your ERP, you should consult with your state on water sampling and monitoring
requirements, including responsibility for water quality monitoring, during an emergency. Make sure you know what to do in an emergency before an
emergency occurs.
You should include the following information in this section of your ERP:
• Proper sampling procedures
• The location and number of required samples
• Who is responsible for taking samples
• Contact information for laboratories or partners who will help analyze the samples and explain the results
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
5: Next Steps
-------
ERP Step 3
PUTTING YOUR ERP TOGETHER AND KNOWING WHEN TO PUT IT INTO ACTION
Now that you've addressed the core elements of your ERP, you should organize and document that information in a useful way. If you have an
existing ERP or other emergency management documents, now is the time to update all of them with the work you've done in ERP Steps 1 and
2. The goal, of course, is to produce a single, complete ERP that is accessible and easy to use. How you organize and document your ERP is
up to you and should reflect the specific needs of your system; however, you should check with your state to see whether it has any
requirements that might affect your finished ERP.
During this step you should also develop procedures for deciding when to put your ERP into action. Knowing when to use your ERP is as
important as preparing and documenting it. In a natural emergency such as a tornado, earthquake, orflood, the decision to put your ERP into
action is obvious. This type of emergency is easy to confirm.
It is more difficult to decide when to put your ERP into action when it comes to intentional acts. Here, the decision is critically important. While
it is essential that you pay attention to any threat, you need to carefully think through and document a process to screen out hoaxes and avoid
false alarms. During each threat incident, it is critical that you or your Emergency Response Leader consider three key questions:
• Is the threat possible?
• Is the threat credible?
• Has the incident been confirmed?
ERP need to be implemented. You or your Emergency Response Leader should exercise judgment when determining how to
respond to a specific threat. More information about assessing threats is offered in some of the tools listed in "Where Can I Find
Additional Help?" on page 34.
1: Preparation
2: Core Elements
»/3: Putting it Together).
4: Action Plans
5: Next Steps
24
-------
ERP Step 4
ACTION PLANS - RESPONDING TO DIFFERENT TYPES OF EMERGENCIES
An Action Plan provides your system with quick approaches for responding to specific types of emergencies. The Action Plans that you develop should
complement the general activities outlined in the core elements of your ERP and should be tailored to specific events (e.g., floods, tornadoes). Action
Plans should be short and concise "rip and run" documents that can be detached from your ERP and taken into the field by emergency responders. The
activities listed in the Action Plans should complement actions already initiated under your ERP. You should develop Action Plans for intentional acts
and for natural disasters and other significant events.
Intentional Acts
Action Plans should coverthe following incidents and threats of such incidents (e.g., hoaxes):
• Contamination
• Structural damage/physical attack
• Intentional hazardous chemical release
• SCADA, computer, or cyber attack
Natural Disasters and Other Significant Events
You may want to incorporate or modify existing plans to deal with a variety of natural disasters and other significant events. If you don't have existing
plans, it makes sense to develop new plans to cover such events that may affect your system, including:
• Fire
• Flood
• Hurricane and tornado
• Severe weather (snow, ice,
temperature, lightning, drought)
Earthquake
Electrical power outage
Mechanical failure
Water supply interruption
Contaminated water treatment chemicals
Accidental hazardous spill/release
Construction accidents
Personnel problems (loss of operator,
medical emergencies)
Special notification requirements
Special response steps necessary for the
specific type of emergency
Recovery actions to bring your system
back into ope ration
Remediation actions needed to make
sure your system is fully restored
1: Preparation
2: Core Elements
3: Putting it Together fr(4; Action Plans) > 5: Next Steps
-------
ERP Step 5
NEXT STEPS
Completing your written ERP is only the first step in making sure that your system is prepared to deal with an emergency. Your ERP should be a "living"
document that you review and update regularly to make sure that all of your information is correct and up to date. Training in how to use your ERP is
just as important as developing and updating it; even the best ERP will be difficult to implement during an emergency if people do not know their
responsibilities. You should regularly practice implementing your ERP. Orientation exercises, table-top workshops, functional exercises, and full-scale
drills are all ways in which you can help to make sure that your well-planned ERP is executed properly and efficiently when a real emergency arises.
You can find more information about these training exercises in the tools listed in "Where Can I Find Additional Help?" on page 34.
1: Preparation
2: Core Elements
3: Putting it Together
4: Action Plans
-------
How Do I Maintain and Upgrade Security in the Long Run?
Completing your VA and ERP does not mean you have reached the finish line; a lapse in security and preparedness can be disastrous. You should
continually assess your weaknesses, upgrade your system's security, and plan for unforeseen events. You should regularly reassess your vulnerabilities
and revise your ERP as threats and personnel change. Rememberto regularly practice implementing your ERP, especially if you make changes to it.
Re-examine Your Vulnerabilities
Part of your long-term security strategy should be to re-evaluate your vulnerabilities. Ask your state if it has changed any of its security requirements.
Your state is also a great resource for finding the latest information available on system vulnerability and security. Perhaps a new threat has emerged in
your area, a new security measure is available, or new funding programs have been created. In addition, you should continue to train staff members so
they understand the system's vulnerabilities and their roles in keeping the system secure.
Neighborhood Watch Program
From "BexarMet Recruits Customers for Community Watch Program," Wilson County News, February 12,2003:
In February 2003, The Bexar Metropolitan Water District (BexarMet) in Texas began asking customers who live near water facilities to
keep a watchful eye on any unusual activity. Participants were asked to call BexarMet any time of the day or night if they observed
suspicious activity around a water facility.
Customers of BexarMet who live near water facilities received a letter requesting their assistance. The letters outlined the program and
identified situations when residents should call 911 or BexarMet dispatchers. In addition, volunteers were given magnets with the phone
number of BexarMet dispatchers. Pablo and Angelita Gallegos were the first volunteers. They live near a water storage tank and see
the program as a good step forward. "We're here all the time," said Pablo Gallegos, "and whenever I see something, I'll call because we
like to help."
27
0
-------
Upgrade Your Security
Besides keeping your understanding of your system's vulnerabilities
current, you might continue to reduce risks by implementing security
upgrades that are more costly or take more time to put in place. As your
vulnerabilities change, you might need new security upgrades. The table
below lists some long-run security measures that can detect, deter, and
delay threats.
Remember that upgrading your security may also benefit other areas of
yoursystem operation. Forexample, properly sealed wells provide source
water protection, backflow prevention programs improve the quality of water
you deliverto your customers, and increased knowledge of your system
can lead to improved technical, financial, and managerial capacity.
Upgrade Security Policies:
1. Screen all potential employees through a job application,
professional references, and a background check.
2. Develop a procedure to deal with public information requests.
3. Develop a procedure to receive notifications of suspected
disease outbreaks immediately after their discovery by local
health agencies.
4. Create a procedure to advise the community of contamination
immediately after its discovery.
5. Put in place a procedure to respond immediately to customer
complaints about a new taste, odor, color, or other detectable
change in water quality.
6. Implement policies regarding access to critical information.
7. Develop and implement computer security policies.
8. Use security warnings and bulletins provided by state, federal,
and non-governmental agencies or organizations.
Upgrade Physical Security:
1. Replace critical doors and hinges that aren't constructed of
heavy-duty reinforced material.
2. Make sure hinges on exterior doors are located on the inside
of the building.
3. Make sure windows are bolted and reinforced with wire mesh
or iron bars.
4. Require authorization and backflow prevention assemblies if a
hydrant is used for any purpose other than fire fighting.
5. Implement a backflow prevention program.
6. Properly seal wellheads.
7. Make sure vents and caps are properly installed and cannot
be removed.
8. Cap all abandoned wells.
9. Install fencing around your surface water source(s).
10. Install valves that allow you to isolate your storage tank.
11. Lock priority fire hydrants to deter contamination (should be
done in consultation with fire department).
12. Install a sampling tap on each storage tank to detect
contamination.
13. Monitor and maintain positive pressure in your distribution
system.
14. Properly protect your computer equipment.
15. Keep your system illuminated.
-------
Update Your ERP
In addition to minimizing the risks posed to your customers, you should continue to prepare for emergencies. You should re-examine your ERP,
especially as your system and its vulnerabilities change, so that you can respond to a crisis. Make sure that you do not let the relationships and
communication channels that you've built deteriorate overtime. If possible, you should conduct drills regularly to make certain that your system is as
prepared as it can be for an emergency.
Threat Response
From Daniel Borunda, "Utilities Take Steps to Protect Water Supplies," El Paso Times, November 23, 2003:
In September 2003, system managers at Las Cruces Water Utilities (TX) emptied a city water tank after an alarm
signaled a break-in. Lacking a means to quickly determine if the water was contaminated, operators elected to drain the
entire storage tank.
The system flushed and refilled the tank, returning it to service the following day. In the meantime, the system used
backup tanks to supply users.
"Our system worked very well," Water Resources Administrator Gilbert Morales said. "There were a couple of areas that
we found where our system could have been better, but this helped us identify those shortcomings and will help us
respond more quickly in the future." The system was able to isolate the problem to the tank, and its customers were not
at risk.
RememberthatyourVAand ERP contain sensitive information and should be stored in asafe place. In addition, copies should be
kept in a secure off-site location. Access to your security information should be limited to staff members and to local and state
officials on a need-to-know basis only.
-------
How Should I Communicate with My Customers?
Good communication with your customers is an important part of your emergency response efforts. The people who depend on you for drinking water will
need immediate, clear, and honest information during an emergency. Without this information, your customers may erroneously assume your water is
unsafe and stop drinking it. Even worse, your customers may continue to drink contaminated tap water because they have not received the message
that it is unsafe.
This section will help you develop a plan for communicating with your customers during an emergency or other crisis. There are several steps. The first
step is to identify your critical customers, the customers who could be most affected by a problem with their water supply. The second step is to
establish relationships with different groups in your community that could help you get your message out when you need to. The third step is to prepare
a plan for notifying your customers during an emergency. The relationships you built during the second step will help you do so quickly and efficiently.
CRITICAL CUSTOMERS
In the event of an emergency, your critical customers will need to be alerted quickly and may require an alternate supply of water. Critical customers are
those most vulnerable to poor-quality water and insufficient quantities of water. Among them are children, the elderly, and the sick, as well as important
institutions such as fire departments, hospitals, and power plants. You should establish communication channels with these customers now so they
can be alerted at the first sign of an emergency.
-------
BUILDING RELATIONSHIPS FOR EFFECTIVE COMMUNICATION
Once you better understand whom you need to notify, you should build relationships and
plan how you will distribute critical public health information during an emergency or other
crisis. These decisions can and should be made long before you face an emergency so that
you are prepared to act quickly and effectively. Your emergency communication will only be
as strong as the relationships you build before a crisis.
You should build relationships with local media outlets, including radio stations, television
stations, and newspapers. Your local media are important because they may be the easiest
and quickest way for your system to notify the public. They are also less likely to exaggerate
or misreport an event if they understand the issues ahead of time. You should designate a
spokesperson in advance who will handle media relations during an emergency. This
spokesperson should NOT be the Emergency Response Leader. Even before an emergency
arises the system spokesperson should meet with local media representatives to determine
exactly what information they will need, how best to get it to them, and when they will need it
to meet their deadlines. Using this input, you should develop a plan for communicating with
the media that yourspokesperson can follow during an emergency.
Existing community networks, such as homeowners' associations, can also help you
efficiently notify your customers during an emergency. It is important that you identify and
test these networks before a threat or other emergency occurs. You might want to consider
developing an e-mail distribution list or a calling chain so that you can notify the lead contact
in each network as quickly as possible.
Helpful Tips for Working with
the Media
At the top of the press release, write
"PRESS RELEASE FOR PUBLIC
SAFETY" to emphasize its importance.
Answer questions as well as you can, and
don't be defensive or afraid to say that you
need to check on something if there is a
question you cannot answer.
Be sensitive to the fact that media
representatives may have tight deadlines
and other pressing needs.
Monitor local media to check whether
they are reporting the information
accurately.
Don't be upset if media coverage is not
exactly as you would want. Politely inform
the media outlet if important information is
wrong or missing.
If a media outlet will not publish or air your
warning, you might need to buy ad space.
The information in this section is taken from EPA's "Public Notification Handbook" (EPA 816-R-00-010-2000). You can find more
information on public notification in the handbook, available fordownloading at http://www.epa.gov/safewater/pn.html orfrom the Safe
Drinking Water Hotline at (800) 426-4791.
31
0
-------
PLAN FOR EMERGENCY NOTIFICATION
All of the preparation and relationships discussed to this point are important because they allow you to communicate quickly and effectively with your
customers during an emergency. Don't forget that you might be communicating with your customers to minimize overreaction by reassuring them that
their water is safe to drink despite the crisis. Here are some practical rules you should keep in mind when communicating with your customers:
Be truthful and up-front
Use simple language that everyone can understand
Make notifications "short and sweet"
Translate alerts for non-English speakers
Clearly identify the name of your system and your service area, especially if your community is served by more than one water system
Explain the exact nature of the emergency, the population at risk, actions that consumers should take, and alternative sources of water (if
necessary)
Provide a telephone number for more information
Limit written warnings to one page designed to catch your customers' attention (bright colors and large text)
There are many ways you can communicate with your customers. The method you choose depends on which of your customers you are trying to reach,
your available resources, and the urgency of the threat. Keep in mind that you will probably need to use a mixture of communication tools, since you
may not reach all of your customers using only one method (e.g., some customers may not listen to the radio, watch TV, or read a newspaper). The
options available to you make it that much more important that you plan ahead so that you are not overwhelmed during an emergency. A partial list of
the communication outlets that you might use is found on page 33.
_ WARNING: When communicating with customers, keep in mind that you want to provide enough information _
• to enable them to act appropriately, but not so much that you increase the system's vulnerability to a threat. I
• For instance, most customers will know if they live down the street from a water treatment facility, but they do •
not need to be informed of that facility's particular vulnerabilities.
-------
COMMUNICATION OUTLETS
BROADCAST MEDIA-Television and radio, if available in your community, may be the quickest way to inform the most customers. Check with
your state to determine whether you can broadcast an alert over the federal Weather Radio alert system. Seethe box on page 31 for more tips on
dealing with the media.
NEWSPAPERS-Depending on the urgency of the situation, you might want to work with the local paper. This outlet can be especially helpful
when you need to keep customers updated during a prolonged crisis.
POSTINGS - Signs can be delivered to each business and residence or posted in public places. For instance, a campground may post signs in
restrooms and at park entrances. If you have the time and staff, you can combine postings with word of mouth by trying to talk to customers as
you post the alert. Remember to make the notices from materials that will hold up against wind and rain.
PERSONAL NOTIFICATION - Word of mouth is the oldest and potentially most time-consuming method. You may call, e-mail, and go door-to-
door to notify customers. E-mail might be particularly effective in a university or office park, while calling may be the quickest method to notify a
homeowners' association. Some systems may use an automatic dialing service to systematically call every customer and play a recorded
message. Though more time-consuming, going door-to-door might be the best way to make sure that all your customers receive the alert.
In addition, you should use any other methods of communicating with your customers that you think will work well for your system. For example,
broadcasting a public health warning from moving vehicles (such as a police vehicle) can be effective if your customers are at home or in a concentrated
area, such as a beach. You should use whatever means you need to communicate with all your customers as quickly as possible.
33
0
-------
Where Can I Find Additional Help?
While improving the security and preparedness of your system takes a lot of work, it's an important step in protecting yoursystem and your customers.
Fortunately, many resources are available to help you accomplish the activities outlined in this STEP Guide. This section provides an overview of some
of these sources of assistance. They include yourstate, EPA, drinking water associations, and technical assistance providers.
The first place you should look for help is your state (see Appendix A for contact information). States and EPA have been working together to identify
ways to help systems address their security vulnerabilities and implement ERPs. Many state efforts, such as sanitary surveys, optimization programs,
source water protection activities, and capacity development, enable the state to provide you with security technical assistance and possibly even
funding. For instance, the state inspector conducting a sanitary survey of yoursystem might be able to help you identify some of your system's
vulnerabilities. Since many states consider security an essential part of technical and managerial capacity, you might also be able to take advantage of
state financial and technical assistance programs.
EPA can also be a source of information and assistance. The Agency has established a water system security page on its Web site
(http://epa.gov/safewater/watersecurity). EPA provides an updated, comprehensive list of publications, information, and other resources for small and
large drinking water systems. In addition, the Web site includes security resources geared specifically towards small system security, public
involvement in water system security, and information sharing between water systems and public and private sector organizations.
Drinking water industry associations and technical assistance providers can be very important partners in efforts to improve system security and
emergency preparedness. Several organizations have produced valuable security tools, ranging from simple how-to books to sophisticated software. In
addition, these organizations are valuable sources of information on the experiences (both positive and negative) of other water systems, and they may
be able to provide information on and evaluations of various security technologies. These organizations also offertraining opportunities, as well as
meetings, conferences, and forums where you can find the latest information on water system security.
Major Providers of Technical Assistance to Drinking Water Systems
The "Helpful Links" and "Alerts and Bulletins" sections that follow are good starting points for identifying the resources available to help you understand
your security vulnerabilities, reduce your risks, and prepare for an emergency. You may also find it useful to hire a consultant to evaluate your system,
help you address your vulnerabilities, or assist you in developing an ERP. Contact your state or technical assistance provider for a referral to someone
who can help.
-------
HELPFUL HINTS
EPA's Security Web site provides links to a number of security tools, training opportunities, outreach materials, and other information. Visit http://
epa.gov/safewater/watersecurity and click on the appropriate links fora list of all materials available. The following paragraphs list some of the materials
you can find through the Web site:
VA Tools (click on "Vulnerability Assessments")
• Self-Assessment Guide for Very Small (Serving Fewer than 3,300 Persons) Systems. Developed by the Association of State Drinking Water
Administrators (ASDWA) and NRWAin consultation with EPA, this document is available from ASDWAs Web site (www.asdwa.org). Scroll down
to the middle of the page to view this document.
• Video: Security Vulnerability Assessment for Water Systems. EPA's Drinking Water Academy and the National Environmental, Safety, and
Health Training Association (NESHTA) have produced a video for water systems serving fewerthan 3,300 persons to aid in assessment of their
vulnerability. You can obtain the video using the order form available at http://www.neshta.org/PDFs/orderform.pdf.
• New England Water Works Association (NEWWA) Automated Security Survey and Evaluation Tool (ASSET). The ASSET VA software is
available from NEWWA by visiting http://www.newwa.org/asset_software/index.php.
• Security and Emergency Management System (SEMS). Contact an NRWA affiliate in your area for more information on this combination VA
and ERP software package.
ERP Tools (click on "Emergency/Incident Planning")
• Video: Emergency Response Plan for Water Systems Serving 3,301 -10,000 persons. NESHTA has developed a video for small water
systems serving populations between 3,301 and 10,000 persons, although smaller systems may also find the video helpful. The video highlights
the relationship between VAresults and ERP development. You can download an orderform at http://neshta.org/Publications/Security.htm or call
(602) 956-6399 to place your order.
• Emergency Response Tabletop CD-ROM Exercises for Drinking Water and Wastewater Systems (EPA-817-C-05-001). This CD-based tool
contains tabletop exercises to help train water and wastewater utility workers in preparing and carrying out ERPs. The exercises provided on the
CD can help strengthen relationships between a water supplier and its emergency response team.
Items with EPA document numbers can be ordered through the Safe Drinking Water Hotline, (800) 426-4791.
35
0
-------
Outreach Products (click on "Publications" and then on "Outreach Materials")
• Water Watchers: We're All in This Together (EPA 810-F-03-006). This brochure for residents describes how they can help local
authorities protect the water utilities in their communities.
• Top Ten List: Water Supply Emergency Preparedness and Security for Law Enforcement (EPA 901-H-03-002). This list is also
available as a poster (11" x 17") for display in local municipal facilities to help in coordinating the efforts of law enforcement, the water
supply industry, and public health officials.
• Water Security Posters. EPA has developed a number of posters to help alert and educate communities about water security. In
addition to the Top Ten List poster, "Report Suspicious Activity at Reservoirs, at Utilities, and at Water Mains" (EPA810-F-03-001) and
"Report Suspicious Activity-Watch Out! Help Out! Report It!" (EPA810-F-03-002, 003, or 004), are available.
ALERTS AND BULLETINS
Many states have begun implementing alert or bulletin systems to provide water systems with critical security information. Regular alerts and
bulletins can be provided via e-mail or fax. Contact your state to see whether an alert or bulletin is available and to find out how you can join the
system.
On a national level, the Water Security Channel (WaterSC) provides alerts and vital security information to key personnel at drinking water
systems and states. WaterSC is a free e-mail notification system that can send notices to mobile devices configured to receive e-mail.
WaterSC maintains a secure Web site that contains an archive of federal alerts, advisories, and bulletins. The service is free and systems can
registeratwww.watersc.org or by calling 1-888-H2O-SC4U.
NRWA has developed a new free Rural Water Alert System (RWAS) to share security information with rural water systems. NRWA expects to
launch RWAS by the end of 2005. The system will provide security information to rural water systems who may not subscribe to the WaterSC.
RWAS will be comparable to the WaterSC in the type of information provided and will be accessible via the Internet. However, RWAS is not a
rapid alert system. More information on RWAS is available through state NRWA affiliates.
-------
Appendix A: Safe Drinking Water Act Primacy Agencies
State Contact Information Web site Phone Number
Alabama
Department of Environmental Management: Water Supply Branch
Alaska
Department of Environmental Conservation: Drinking Water Program
American Samoa
Environmental Protection Agency
Arizona
Department of Environmental Quality: Safe Drinking Water Program
Arkansas
Department of Health: Division of Engineering
California
Department of Health Services: Division of Drinking Water and Environmental
Management
Colorado
Department of Public Health and Environment: Drinking Water Program
Connecticut
Department of Public Health: Drinking Water Division
Delaware
Health and Social Services: Division of Public Health
www.adem.state.al.us/WaterDivision/Drinking/DWMainlnfo.htm
www.state.ak.us/dec/eh/dw
www.asg-gov.com/agencies/epa.asg.htm
www.azdeq.gov/environ/water/dw/index.html
www.healthyarkansas.com/eng/
www.dhs.ca.gov/ps/ddwem/technical/dwp/dwpindex.htm
www.cdphe.state.co. us/wq/drinking_water/drinking_water_
program_home.htm
www.dph.state.ct. us/BRS/water/dwd. htm
www.state.de. us/dhss/dph/about.html
(334) 271 -7700
(907) 269-7647
(684) 633-2304
(602) 771 -2300
(501)661-2623
(916)449-5577
(303) 692-3500
(860) 509-7333
(302) 744-4700
37
0
-------
State Contact Information Web site Phone Number
District of Columbia
Environmental Protection Agency Region 3
Florida
Department of Environmental Protection: Drinking Water Program
Georgia
Department of Natural Resources: Water Resources Branch
Guam
Environmental Protection Agency: Water Programs Division
Hawaii
Department of Health: Environmental Health Division
Idaho
Department of Environmental Quality: Water Quality Division
Illinois
Environmental Protection Agency: Bureau of Water
Indiana
Department of Environmental Management: Drinking Water Branch
Iowa
Department of Natural Resources: Water Supply Program
Kansas
Department of Health and Environment: Bureau of Water
Kentucky
Department for Environmental Protection: Division of Water
Louisiana
Office of Public Health: Safe Drinking Water Program
Maine
Maine Department of Health and Human Services: Drinking Water Program
www.epa.gov/reg3wapd/drinkingwater
www.dep.state.fl.us/water/drinkingwater/index.htm
www.gaepd.org/
www.guamepa.govguam.net/programs/water
www.hawaii.gov/health/envi ronmental/water/sdwb/i ndex.html
www.d eq .state .id. us/wate r/
www.epa .state .i 1. us/water/i ndex-pws .html
www.in.gov/idem/water/dwb/
www.iowadnr.com/water/drinking/index.html
www. kd he .state . ks . us/pws/
www.water.ky.gov/dw
www.oph.dhh.louisiana.gov/engineerservice/safewater/
www.state.me.us/dhs/eng/water/
(215)814-2300
(850) 245-8335
(404) 657-5947
(671)475-1658
(808) 586-4258
(208)373-0194
(217)785-8653
(31 7) 232-8603
(515)725-0275
(785) 296-5503
(502)564-3410
(225) 765-5038
(207) 287-2070
-------
State Contact Information Web site Phone Number
Maryland
Department of the Environment: Water Supply Program
Massachusetts
Department of Environmental Protection: Drinking Water Program
Michigan
Department of Environmental Quality: Water Bureau
Minnesota
Department of Health: Drinking Water Protection Section
Mississippi
Department of Health: Water Supply Division
Missouri
Department of Natural Resources: Water Protection and Soil Conservation
Division
Montana
Department of Environmental Quality: Public Water Supply Program
Nebraska
Department of Health and Human Services: Public Water Supply Program
Nevada
State Health Division: Safe Drinking Water Program
New Hampshire
Department of Environmental Services: Water Division
New Jersey
Department of Environmental Protection: Water Supply Administration
New Mexico
Environment Department: Drinking Water Bureau
www.mde.state.md. us/prog rams/WaterPrograms/Water_
Supply/index.asp
www. mass . gov/d ep/b rp/d ws/d ws home . htm
www.michigan.gov/deq
www.health.state.mn.us/divs/eh/water/index.html
www.msdh.state.ms.us/msdhsite/index.cfm/44,0,76,html
www.d nr.state . mo . us/wpscd/wpcp/i nd ex. html
www.d eq .state . mt. us/wq i nfo/pws/i nd ex.asp
www. hhs .state . ne . us/e nh/pws i nd ex. htm
http://ndep.nv.gov/bsdw/index.htm
www.des.state.nh.us/wseb/
www.state.nj.us/dep/watersupply/
www. nmenv.state . nm . us/dwb/dwbtop . html
(410)537-3000
(61 7) 292-5770
(517)373-7917
(651)215-0770
(601)576-7518
(573)751-1300
(406) 444-4071
(402)471-0521
(775) 687-6353
(603)271-2153
(609) 292-5550
(505)827-1400
-------
State Contact Information Web site Phone Number
New York
New York State Department of Health: Bureau of Water Supply Protection
North Carolina
Department of Environment and Natural Resources: Public Water Supply
Section
North Dakota
Department of Health: Division of Water Quality
Ohio
Environmental Protection Agency: Division of Drinking and Ground Water
Oklahoma
Department of Environmental Quality: Water Quality Division
Oregon
Department of Human Services: Drinking Water Program
Pennsylvania
Department of Environmental Protection: Office of Water Management
Puerto Rico
Department of Health: Public Water Supply Supervision Program
Rhode Island
Department of Health: Office of Drinking Water Quality
South Carolina
Department of Health and Environmental Control: Drinking Water Program
South Dakota
Department of Environment and Natural Resources: Drinking Water Program
www.health.state.ny.us/nysdoh/water/main.htm
www.deh.enr.state.nc.us/pws/
www.health.state.nd.us/mf/
www.epa.state.oh.us/ddagw/
www.deq.state.ok.us/WQDnew/index.htm
http://oregon.gov/DHS/ph/dwp/index.shtml
www.dep.state.pa. us/dep/deputate/watermgt/wsnV
WSM.htm
www.epa.gov/region02/cepd/prlink.htm
www.health.ri.gov/environment/dwq/index.php
www.scdhec.net/eqc/water/html/dwater.html
www.state.sd.us/denr/des/drinking/dwprg.htm
(518)402-7650
(919)733-2321
(701)328-5211
(614)644-2752
(405)702-8100
(971)673-0405
(71 7) 772-401 8
(787) 977-5870
(401)222-6867
(803) 898-4300
(605) 773-3754
-------
State Contact Information Website Phone Number
Tennessee
Department of Environment and Conservation: Division of Water Supply
Texas
Texas Commission on Environmental Quality
Utah
Department of Environmental Quality: Division of Drinking Water
Vermont
Vermont Agency of Natural Resources
Virgin Islands
Department of Planning and Natural Resources: Division of Environmental
Protection
Virginia
Department of Health: Office of Drinking Water
Washington
Division of Environmental Health: Office of Drinking Water
West Virginia
Bureau for Public Health: Department of Health and Human Resources
Wisconsin
Department of Natural Resources: Bureau of Drinking Water and Ground
Water
Wyoming
EPA Region 8: Wyoming Drinking Water Program
www.state.tn.us/environment/dws/index.html
www.tceq .state .tx. us/nav/uti l_wate r/
www.drinkingwater.utah.gov
www.anr.state .vt . us/d ec/wate rs up/wsd . htm
http://dpnr.gov.vi/dep/home.htm
www.vdh.state.va.us/dw/index.asp
www.doh.wa.gov/ehp/dw/
www.wvdhhr.org/oehs/eed/
www.dnr.state.wi.us/org/water/dwg/
www.epa.gov/region08/water/dwhome/wycon/wycon.html
(615)532-0191
(512)239-4691
(801)536-4200
(802) 241 -3400
(340)773-1082
(804) 864-7500
(360)236-3100
(304)558-6715
(608) 266-0821
(303)312-6812
-------
Appendix B: EPA Regional Contacts
To determine which region your state is in, visit http://cfpub.epa.gov/watersecurity/stateinfo.cfm.
US EPA Regional Contacts
EPA Region 1
EPA Region 2
EPA Region 3
EPA Region 4
EPA Region 5
EPA Region 6
EPA Region 7
EPA Region 8
EPA Region 9
EPA Region 10
http://www.epa.gov/NE/eco/drinkwater/dw-security.html
http://www.epa.gov/region2/water/
http://www.epa.gov/reg3wapd/
http://www.epa.gov/region4/water/
http://www.epa.gov/region5/water/
http://www.epa.gov/Arkansas/6wq/swp/security/
http://www.epa.gov/region7/security/index.htm
http://www.epa.gov/region8/compliance/security/secure.html
http://www.epa.gov/region9/water/
http://yosemite.epa.gov/R10/WATER.NSF/webpage/Water+lssues+in+Region+10
(617)918-1694
(212)637-3879
(215)814-5668
(404) 562-9446
(312)886-0190
(214)665-2776
(913)551-7585
(303)312-7021
(415)947-3561
(206)553-1389
-------
Appendix C: Other STEP Documents
This guide is one in a series of Simple Tools for Effective Performance (STEP) documents for small drinking water systems. The STEP
documents can be obtained from EPA by calling the Safe Drinking Water Hotline at (800) 426-4791 and requesting the document by its
publication number. The documents can also be found atwww.epa.gov/safewater/smallsys/ssinfo.htm. Othertitles in the series are:
• Small Systems Guide to the Total Coliform Rule (TCP) • Asset Management Workbook
Publication number: EPA816-R-01-017A Publication number: EPA816-R-03-016
Published: June 2001 Published: September2003
• Safe Drinking Water Act (SDWA) Regulation Overview • Strategic Planning Workbook
Brochure for Small Systems Publication number: EPA 816-R-03-015
Publication number: EPA816-R-03-017 Published: September2003
Published: September 2003
• Taking Stock of your Water System: A Simple Asset Inventory for Very
• Complying With the Revised Drinking Water Standard for Small Systems
Arsenic: Small Entity Compliance Guide Publication number: EPA 816-K-03-002
Publication number: EPA816-R-02-008A Published: October2004
Published: August 2002
------- |