&EPA
United States
Environmental Protection
Agency
Large Water System Emergency Response Plan Outline:
Guidance to Assist Community Water Systems in
Complying with the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002
-------
Office of Water (4601M)
EPA810-F-03-007
www. epa. gov/safewater/security
July 2003 Printed on Recycled Paper
-------
&EPA
United States
Environmental Protection
Agency
Large Water System Emergency Response Plan Outline:
Guidance to Assist Community Water Systems in
Complying with the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002
United States
Environmental Protection Agency
Office of Water
Office of Ground Water and Drinking Water
-------
Purpose: Title IV of the Public Health Security and Bioterrorism Preparedness and Response Act, Public Law
107-188, requires drinking water facilities serving populations of more than 3,300 to perform vulnerability
assessments and to prepare an Emergency Response Plan that incorporates the results of the vulnerability
assessment. Developing an emergency response plan can take a lot of time and effort. The purpose of this
Emergency Response Plan (ERP) outline is to make the job easier and help create a plan that works for your
water system. This outline is intended for use by large water utility systems due to their complexity and detail.
A modified ERP outline will be available for medium and small water utility systems in the near future.
It is important to note that the Water System ERP is a "living" document requiring periodic updates (i.e., at least
annually or if there is a major change to the water utility system configuration). It should be maintained in a
three ring binder notebook to accommodate revisions and appendices. The ERP document should be flexible
and easily implemented during an emergency with the ability to use removable checklists.
This document provides guidance and recommendations to aid facilities in the preparation of Emergency
Response Plans required under the Public Health Security and Bioterrorism and Response Act. The
Bioterrorism Act requires drinking water utilities to identify plans, procedures, and equipment that can be
implemented or utilized in the event of a terrorist or intentional attack, or that can obviate or significantly lessen
the impact of a terrorist or other intentional attack, on the utility. These are addressed in Sections IV and V of
this outline. The Bioterrorism Act also calls for coordination with Local Emergency Planning Committees,
which is addressed in Section I of this outline. It is understood that numerous states have specific emergency
management planning guidelines as outlined in applicable statutes. Facilities must comply with both the
federal and state laws. Certain state requirements may take precedence over this ERP outline. For example,
the State of California has a Standardized Emergency Management System (SEMS) or Incident
Command/Management System (ICS). Use of SEMS/ICS is mandatory in the State of California and
applicable to other states.
Disclaimer: This outline is provided as guidance only. It contains nationally recognized standards on the
types of information that should be contained in an emergency response plan. EPA recognizes that all of the
sections may not be applicable to your system and all potential situations may not be identified in the outline. It
is your responsibility to evaluate the potential vulnerabilities related to your system and determine the
appropriate responses for your site. As site-specific needs dictate, this outline can be modified to meet your
needs.
-------
Water System Emergency Response Plan Outline
Introduction
Safe and reliable drinking water is vital to every community. Emergency response planning is an essential
part of managing a drinking water system. The introduction should identify the requirement to have a
documented emergency response plan (ERP), the goal(s) of the plan (e.g., be able to quickly identify an
emergency and initiate timely and effective response action, be able to quickly respond and repair
damages to minimize system downtime), and how access to the plan is limited. Plans should be
numbered for control. Recipients should sign and date a statement that includes their (1) ERP number, (2)
agreement not to reproduce the ERP, and (3) they have read the ERP.
ERPs do not necessarily need to be one document. They may consist of an overview document,
individual Emergency Action Procedures, check lists, additions to existing operations manuals,
appendices, etc. There may be separate, more detailed plans for specific incidents. There may be plans
that do not include particularly sensitive information and those that do. Existing applicable documents
should be referenced in the ERP (e.g., chlorine Risk Management Program, contamination response).
Emergency Planning Process
A. Planning Partnerships
The planning process should include those parties who will need to help the utility in an
emergency situation (e.g., first responders, law enforcement, public health officials, nearby
utilities, local emergency planning committees, testing laboratories, etc.). Partnerships should
track from the Water Utility Department up through local, state, regional, and federal agencies, as
applicable and appropriate, and could also document compliance with governmental
requirements.
B. General Emergency Response Policies, Procedures, Actions, Documents
A short synopsis of the overall emergency management structure, how other utility emergency
response, contingency, and risk management plans fit into the ERP for water emergencies, and
applicable polices, procedures, actions plans, and reference documents should be cited. Policies
should include interconnect agreements with adjacent communities and just how the ERP may
affect them. Policies should also address how to handle services to other public utility providers
such as gas, electric, etc.
C. Scenarios
Use your Vulnerability Assessment (VA) findings to identity-specific emergency action steps
required for response, recovery, and remediation for each of the five (5) incident types (if
applicable) outlined in The Guidance for Water Utility Response, Recovery & Remediation Actions
for Man-Made and /or Technological Emergencies, Office of Water (461OM) EPA 810-R-02-001,
April 2002 available at www.epa.gov/safewater. In this section, a short paragraph referencing the
VA and findings should be provided. Specific details identifying vulnerabilities should not be
included. In Section V of this plan, specific emergency actions procedures addressing each of the
incident types should be addressed.
Emergency Response Plan - Policies
A. System Specific Information
In an emergency, a water system needs to have basic information for system personnel and
external parties such as law enforcement, emergency responders, repair contractors/vendors, the
media, and others. The information needs to be clearly formatted and readily accessible so
system staff can find and distribute it quickly to those who may be involved in responding to the
emergency. Basic information that may be presented in the emergency response plan are the
system's ID number, system name, system address or location, directions to the system,
population served, number of service connections, system owner, and information about the
person in charge of managing the emergency. Distribution maps, detailed plan drawings, site
plans, source water locations, and operations manuals may be attached to this plan as
appendices or referenced.
-------
1. PWS ID, Owner, Contact Person
2. Population served and service connections
3. System Components
a) Pipes and constructed conveyances,
b) Physical barriers,
c) Isolation valves,
d) Water collection, pretreatment, treatment, storage and distribution facilities,
e) Electronic, computer, or other automated systems which are utilized by the
public water system,
f) Emergency power generators (onsite & portable),
g) The use, storage, or handling of various chemicals, and
h) The operation and maintenance of such system components.
B. Identification of Alternative Water Sources
1. Amount of water needed for various durations
2. Emergency water shipments
3. Emergency water supply sources
4. Identification of alternate storage and treatment sources
5. Regional Aid Agreements (interconnections)
Also consider in this section, a discussion of backup wells, adjacent water systems, certified
bulk water haulers, etc.
C. Chain-of-Command Chart Developed in Coordination with Local Emergency Planning Committee
(Internal and/or External Emergency Responders, or both)
1. Contact Name
2. Organization and Emergency Response Responsibility
3. Telephone number(s) (hardwire, cell phones, faxes, e-mail)
4. State 24-hour Emergency Communications Center Telephone
D. Communication Procedures: Who, What, When
During most emergencies, it will be necessary to quickly notify a variety of parties both internal
and external to the water utility. Using the Chain-of-Command Chart and all appropriate personnel
from the lists below, indicate who activates the plan, the order in which notification occurs, and the
members of the Emergency Response Team. All contact information should be available for
routine updating and readily available. The following lists are not intended to be all inclusive—
they should be adapted to your specific needs.
1. Internal Notification Lists
a) Utilities Dispatch
b) Water Source Manager
c) Water Treatment Manager
d) Water Distribution Manager
e) Facility Managers
f) Chief Water Utility Engineer
g) Director of Water Utility
h) Data (IT) Manager
i) Wastewater Treatment Plant
j) Other
2. Local Notification
a) Head of local government (i.e., Mayor, City Manager, Chairman of Board, etc.)
b) Public Safety Officials—Fire, Local Law Enforcement (LLE), Police, EMS, Safety
If a malevolent act is suspected, LLE should be immediately notified and in turn
will notify the FBI, if required. The FBI is the primary agency for investigating
sabotage to water systems or terrorist incidents.
c) Other Government Entities: Health, Schools, Parks, Finance, Electric, etc.
3. External Notification Lists
a) State PWSS regulatory agency (or agencies)
-------
b) Regional water authority (where one exists)
c) EPA
d) State Police
e) State Health Department (lab)
f) Critical customers (Special considerations for hospitals, Federal, State and
County government centers, etc.)
g) Service/Mutual Aid
h) Water Information Sharing and Analysis Center (ISAC)
i) Residential and commercial customers not previously notified
4. Public/Media Notification: When and How to Communicate
Effective communications is a key element of emergency response, and a media or
communications plan is essential to good communications. Be prepared by organizing
basic facts about the crisis and your water system. Develop key messages to use with
the media that are clear, brief, and accurate. Make sure your messages are carefully
planned and have been coordinated with local and state officials. Considerations should
be given to establishing protocols for both field and office staff to respectfully defer
questions to the utility spokesperson.
Be prepared to list geographic boundaries of the affected area, (e.g. west of highway a,
east of highway b, north of highway c and south of highway d to ensure the public clearly
understands the system boundaries.)
E. Personnel Safety
77?;s should provide direction as to how operations staff, emergency responders, and the public
should respond to a potential toxic release (e.g., chlorine plume release from a water treatment
plant or other chemical agents), including facility evacuation, personnel accountability, proper
Personnel Protective Equipment as dictated by the Risk Management Program and Process
Safety Management Plan, and whether the nearby public should be "in-place sheltered" or
evacuated.
F. Equipment
The ERP should identify equipment that can obviate or significantly lessen the impact of
terrorist attacks or other intentional actions on the public health and protect the safety and
supply of drinking water provided to communities and individuals. The water utility should
maintain an updated inventory of current equipment and repair parts for normal maintenance
work.
Because of the potential for extensive or catastrophic damage that could result from a malevolent
act, additional equipment sources should be identified for the acquisition and installation of
equipment and repair parts in excess of normal usage. This should be based on the results of the
specific scenarios and critical assets identified in the vulnerability assessment that could be
destroyed. For example, numerous high-pressure pumps, specifically designed for the water
utility, could potentially be destroyed. A certain number of "long-lead" procurement equipment
should be inventoried and the vendor information for such unique and critical equipment
maintained. In addition, mutual aid agreements with other utilities, and the equipment available
under the agreement, should be addressed. Inventories of current equipment, repair parts, and
associated vendors should be indicated under Item 29 "Equipment Needs/Maintenance of
Equipment" of Section IV "Emergency Action Procedures".
G. Property Protection
A determination should be made as to what water system facilities should be immediately "locked
down," specific access control procedures implemented, initial security perimeter established, a
possible secondary malevolent event considered. The initial act may be a divisionary act.
-------
H. Training, Exercises, and Drills
Emergency response training is essential. The purpose of the training program is to inform
employees of what is expected of them during an emergency situation. The level of training on an
ERP directly affects how well a utility's employees can respond to an emergency. This may take
the form of orientation scenarios, table-top workshops, functional exercises, etc.
I. Assessment
To evaluate the overall ERP's effectiveness and to ensure that procedures and practices
developed under the ERP are adequate and are being implemented, the water utility staff should
audit the program on a periodic basis.
IV. Emergency Action Procedures (EAPs)
These are detailed procedures used in the event of an operational emergency or malevolent act. EAPs
maybe applicable across many different emergencies and are typically common core elements of the
overall municipality ERP (e.g., responsibilities, notifications lists, security procedures etc.) and can be
referenced.
A. Event classification/severity of emergency
B. Responsibilities of Emergency Director
C. Responsibilities of Incident Commander
D. Emergency Operations Center (EOC) activation
E. Division internal communications and reporting
F. External communications and notifications
G. Emergency telephone list (division internal contacts)
H. Emergency telephone list (off-site responders, agencies, state 24-hr emergency phone number,
and others to be notified)
I. Mutual Aid Agreements
J. Contact list of available emergency contractor services/equipment
K. Emergency equipment list (including inventory for each facility)
L. Security and access control during emergencies
M. Facility evacuation and lockdown and personnel accountability
N. Treatment and transport of injured personnel (including chemical/biological exposure)
O. Chemical records - to compare against historical results for base line
P. List of available laboratories for emergency use
Q. Emergency sampling and analysis (chemical/biological/radiological)
R. Water use restrictions during emergencies
S. Alternate temporary water supplies during emergencies
T. Isolation plans for supply, treatment, storage, and distribution systems
U. Mitigation plans for neutralizing, flushing, disinfecting tanks, pump stations, or distribution
systems, including shock chlorination
V. Protection of vital records during emergencies
I/I/. Record keeping and reporting (FEMA, OSHA, EPA, and other requirements) (It is important to
maintain accurate financial records of expenses associated with the emergency event for possible
federal reimbursement.)
X. Emergency program training, drills/and tabletop exercises
Y. Assessment of emergency management plan and procedures
Z. Crime scene preservation training and plans
AA. Communication Plans:
1. Police
2. Fire
3. Local Government
4. Media
5. Etc.
BB. Administration and logistics, including EOC, when established
CC. Equipment needs/maintenance of equipment
DD. Recovery and restoration of operations
EE. Emergency event closeout and recovery
-------
V. Incident-Specific Emergency Action Procedures (EAPs)
Incident-Specific EAPs are action procedures that identify specific steps in responding to an operational
emergency or malevolent act. The Guidance for Water Utility Response, Recovery & Remediation Actions
for Man-Made and/or Technological Emergencies, Office of Water (461OM) EPA 810-R-02-001, April
2002, identifies three major steps in developing procedures—response, recovery, and remediation with a
list of initial and recovery notifications required. "Response" refers to actions immediately following
awareness of the incident, "recovery" refers to actions to bring the system back into operations, and
"remediation" refers to long-term restoration actions. When developing an EAP for those incidents
identified in Section V.2, the EAP must consider the impact of the incident on system elements and the
potential impacts on upstream and downstream components of the incident location. If during the VA
process, a specific incident type was judged as not credible then it should be noted as to why it is
not applicable to the ERP. If additional incident types were identified, then these should be
included in the ERP. For those that use the Sandia National Laboratory methodology (RAM-W) the
adversary sequence diagrams provide incident-specific malevolent acts, which may fit under Section V.2.
A. General Response to Terrorist Threats (Other than Bomb Threat and Incident-Specific Threats)
B. Incident-Specific Response to Man-Made or Technological Emergencies
1. Contamination Event (Articulated Threat with Unspecified Materials)
2. Contamination Threat at a Major Event
3. Notification from Health Officials of Potential Water Contamination
4. Intrusion through Supervisory Control and Data Acquisition (SCADA)
C. Significant structural damage resulting from intentional act
D. Customer complaints
E. Severe weather response (snow, ice, temperature, lightning)
F. Flood response
G. Hurricane and/or tornado response
H. Fire response
I. Explosion response
J. Major vehicle accident response
K. Electrical power outage response
L. Water supply interruption response
M. Transportation accident response - barge, plane, train, semi-trailer/tanker
N. Contaminated/tampered with water treatment chemicals
O. Earthquakes response
P. Disgruntled employees response (i.e., workplace violence)
Q. Vandals response
R. Bomb threat response
S. Civil disturbance/riot/strike
T. Armed intruder response
U. Suspicious mail handling and reporting
V. Hazardous chemical spill/release response (including Material Safety Data Sheets)
W. Cyber-security/Supervisory Control and Data Acquisition (SCADA) system attack response (other
than incident-specific, e.g., hacker)
VI. Next Steps
A. Plan Review and Approval
B. Practice and Plan to Update (as necessary; once every year recommended)
1. Training requirements
2. Who is responsible for conducting training, exercises, and emergency drills
3. Update and assessment requirements
4. Incident-specific exercises/drills
VII. Annexes:
A. Facility and Location Information
1. Facility maps
2. Facility drawings
-------
3. Facility descriptions/layout
4. Etc.
VIII. References and Links
A. Department of Homeland Security — http://www.dhs/qov/dhspublic
B. Environmental Protection Agency — http://www.epa.gov
C. The American Water Works Association (AWWA) — http://www.awwa.org
D. The Center for Disease Control and Prevention — http://www.bt.cdc.gov
E. Federal Emergency Management Agency - http://www.fema.gov
F. Local Emergency Planning Committees - http://www.epa.gov/ceppo/lepclist.htm
-------
-------
Office of Water (4601M)
EPA810-F-03-007
www.epa.gov/safewater/security
July 2003
------- |