&EPA
                 United States
                 Environmental Protection
                 Agency
                                            Key Features  in  Action
The Water Sector has developed the Key Features of an Active and Effective Protective Program
(Key Features) to assist owners and operators of drinking water and wastewater utilities in preventing,
detecting, responding to, and recovering from adverse effects of all hazards, including terrorist attacks
and natural disasters. The Key Features describe the basic elements of a "protective program" for
utility owners/operators to consider as they develop utility-specific approaches.
                                                              The Key Features
                                                   1. Integrate protective concepts into organizational
                                                     culture,  leadership, and daily operations
                                                   2. Identify and support protective program
                                                     priorities, resources, and utility-specific
                                                     measures
                                                   3. Employ protocols for detection of
                                                     contamination
                                                   4. Assess risks and review vulnerability
                                                     assessments (VAs)
                                                   5. Establish facility and information access control
                                                   6. Incorporate resiliency concepts into physical
                                                     infrastructure
                                                   7. Prepare, test, and update emergency response
                                                     and business continuity plans
                                                   8. Develop partnerships with first responders,
                                                     managers of  critical interdependent
                                                     infrastructure, other utilities, and response
                                                     organizations
                                                   9. Develop and  implement internal and external
                                                     communication strategies
                                                  10. Monitor  incidents and threat-level information
PURPOSE

The Environmental Protection Agency (EPA) conducted
two Key Features case studies in the spring of 2010:
•  New England Utility Case Study
•  Mid-Atlantic Utility Case Study

These case studies build on  previous Key Features
case studies, but are smaller in scope.

The objectives of the case studies were to:
•  Document how drinking water and wastewater
   utilities have successfully incorporated one or
   more of the Key Features  into their operations.
•  Provide examples of specific protective practices
   that can be replicated by  other drinking water and
   wastewater utilities.
•  Highlight benefits to utilities of implementing the
   Key Features.


CASE STUDY METHODOLOGY

EPA developed a questionnaire with questions related
to the 10 Key Features.  EPA contacted the utilities
to invite them to participate  in the case study and
subsequently met with the utility staff to conduct
interviews.
                                                                                              FEMA

-------
KEY FEATURES INACTION
                                     page 2
NEW ENGLAND UTILITY CASE  STUDY

The utility interviewed in the New England Area Utility Case Study is a large community water system as
defined by the Public Health and Bioterrorism Preparedness and Response Act of 2002 (serving a popu-
lation of 100,000 or more). An average of 67 million gallons per day (MGD) is consumed by the cities
and towns it serves.  The water supply is comprised of a series of surface water reservoirs, including one
primary reservoir with 90 percent of the utility's total combined capacity.

Highlights of Key  Features Implemented

FEATURE 2. Identify and support protective program priori-
ties, resources, and utility-specific measures: The utility uses
strategic planning to identify protective program priorities, which
includes review of performance measures that assess security
effectiveness.  Priorities are then funded through a separate
budget for security and emergency management.  The utility has
been systematically replacing its aging infrastructure and mak-
ing security improvements.  Improvements have been funded
through  a series of small annual  rate hikes, instead of borrowing
or deferring rate increases. The utility has also received two
Department of Homeland Security Urban Area Security Initiative
(UASI) grants, which were used for upgrades to video cameras,
emergency testing equipment, a  radiological testing kit, and inter-
operable communications equipment to link utility staff with state
and local first  responders.

FEATURE 5. Establish facility and information access control:
The utility has established facility and information access
controls and is preparing to install a new security system.  The
security system will include hardening of assets, motion detec-
tors, enhanced video surveillance and relocated security room
and servers.  The security system under consideration has an
internet backbone; managers would have remote access and all
remote facilities would have video monitoring capability. Ad-
ditionally, the utility controls 95 percent of the land surround-
ing the reservoir and prohibits public access to the watershed.
Security patrols monitor the watershed for trespassers and a
system of  monetary fines has been  implemented  for violators.

FEATURE 7. Prepare, test and  update emergency response,
recovery and  business continuity plans:  The utility has pre-
pared, tested and updated its emergency response, recovery
and business continuity plans.  Approximately 85 percent of all
employees have had Water Sector Incident Command System
(ICS)  100/800 training. All managers will go through the ICS
400 training by the end of 2010. The utility has also partici-
pated in several water security tabletop and field  exercises.
Additionally, the utility has recently reviewed its Emergency
Response  Plan; which is National Incident Management System
(NIMS) compliant; and its Water Supply Plan, Business Conti-
nuity Plan, and Dam Action Plan. The utility's overall goal is to
simplify the plans and integrate them into one comprehensive
document - an all hazards plan that will be NIMS compliant.
BENEFITS
•  ICS/NIMS training has drawn attention to
   the fact that utilities are first responders
   and need the training and equipment to
   support this function.
•  The utility's security initiatives have made
   their employees more aware of safety and
   security.  Employees are better informed,
   more observant of outside activities, and
   more sensitive to  potential consequences
   of their actions.

ISSUES/CHALLENGES

The utility felt the impact of substantial lost
revenue due to lower consumption during the
recent recession. It has lessened the impacts
with rate increases and grant funding.

The utility is working to address the
challenges of  interstate mutual aid.  This
is a particularly important issue in New
England where the states are small and the
infrastructure  is often interconnected.

The utility believes that security and
emergency  management should be
approached from an  all hazards standpoint,
instead of being based solely on malevolent
acts.  Protective programs need to be
tailored to specific regional issues, such as
flooding and hurricanes in New England.

-------
page 3
            KEY FEATURES INACTION
FEATURE 8. Develop partnerships with first responders, managers of critical infrastructure, other utilities and re-
sponse organizations: The utility is a member of its state Water/Wastewater Agency Response Network (WARN).  The
utility has not had to use the WARN, to date, though it offered assistance to a nearby county that had an incident.  The
state WARN  has completed one tabletop exercise, and is considering setting up response teams within WARN to do ini-
tial screening and evaluations for situation reports.  The utility also interacts with critical customers and interdependent
infrastructures. The transmission and distribution staff communicate with the local health sector, including hospitals
and dialysis centers, and have meetings with wholesale customers to keep them informed of utility activities.
MID-ATLANTIC UTILITY CASE STUDY

The utility interviewed in the Mid-Atlantic Utility Case Study is a
medium community water system as defined by the Public Health
and Bioterrorism Preparedness and  Response Act of 2002  (serving a
population of 50,000 or more, but less than 100,000).  The utility
is part of the county government and provides an average of 10 MGD
to the county and city it serves.  Drinking water is supplied by drink-
ing water reservoirs and intakes on area rivers.

Highlights of  Key Features Implemented

FEATURE 2. Identify and support protective program priorities, resourc-
es,  and  utility-specific measures:  Water security is funded by one line
item in the locality's Capital Improvement Plan (CIP). The utility finances
aging  infrastructure improvements and security upgrades through the CIP
Projects are funded according to the priorities identified in the utility's Vul-
nerability Assessment (VA).  The utility also conducts Strategic  Planning
Exercises with a security component.  Major capital improvement projects
are primarily bond-funded, while maintenance and operations are funded
by water/sewer rates and fees.

FEATURE 6. Incorporate resiliency concepts into physical  infrastructure:
The utility has taken several measures to incorporate resiliency concepts
into its physical infrastructure. The utility conducted an assessment of
critical points of failure and provided redundancy in the system for those
points. There is also redundancy built  into the drinking water and waste-
water systems, and all new infrastructure is analyzed to assess redundan-
cy.  There is extra  capacity at the treatment facilities that could be utilized
if there were a disruption in operations at another facility.  The  utility also
has interconnections with an adjacent county,  which increases  resiliency.

FEATURE 8. Develop partnerships with first responders, managers of
critical infrastructure, other utilities and response  organizations: The
county has signed a multi-jurisdictional agreement  with an adjacent coun-
ty and city to provide water and emergency assistance for drinking water
and wastewater.  The main purpose of the agreement was to set water
rates,  however it also serves an emergency preparedness purpose.  The
utility meets annually with the other jurisdictions to discuss the agree-
ment. They also exercise the interconnections with the other jurisdictions
monthly to ensure they are working properly. During a two-year drought,
the county utilized the multi-jurisdictional  agreement to provide water to
the adjacent COUnty. continued on page 4
BENEFITS
•  Dedicated funding has allowed
   the utility to make necessary
   security improvements.
•  Addition of security cameras has
   helped to eliminate vandalism
   and the audio on the cameras
   has assisted in maintenance of
   pump stations.
•  Employee accountability has
   increased with the addition of
   security cameras.
•  Redundancy in the system has
   reduced service disruptions.
•  Utility's multi-jurisdictional
   agreement  increases system
   redundancy and improves  emer-
   gency response time.

ISSUES/CHALLENGES
The utility has considered using on-
line continuous monitoring devices,
but struggled with placement and
reliability of the devices.

-------
KEY FEATURES INACTION
page 4
FEATURE 8...continued from page 3
The utility also developed partnerships with first
responders, managers of critical infrastructure, and
response organizations.  It maintains close work-
ing relationships with other critical infrastructure
partners, including electrical utilities, oil suppli-
ers and chemical suppliers.  The utility has also
established relationships with the local hospital
and local dialysis centers.  A system is in  place
to alert major water users in the event of a water
emergency. Through Table Top Exercises, the
utility has also established a relationship with the
state Department of Emergency Management and
the Federal Bureau of Investigation Emergency
Response Team.
                                                                                                        FEMA
 -CONCLUSION
   The New England Utility and Mid-Atlantic Utility Case Studies highlighted several of the Key Features that are
   critical to protective program success:
   • Assess program priorities/ critical points of failure (Feature 2)
   • Fund  identified priorities (Feature 2)
     - Ensure that there is a dedicated source of funding for the protective program
     - Apply for grants to assist in funding security improvements
   • Build resiliency into the system where vulnerabilities are noted (Feature 6)
   • Develop  partnerships with critical customers and interdependent sectors (Feature 8)
   • Exercise  Emergency Response Plans with partners to ensure efficient coordination during an emergency
     situation (Feature 7)

   These case  studies also emphasized the importance of utilities approaching security and emergency
   management from an all hazards standpoint, tailoring the protective program to specific regional  issues.
   There are many benefits of implementing the Key Features into daily operations including, for example:
   • Increased protection of public health
   • Ability to more quickly detect,  respond to, and recover from any adverse event
   • Increased access to resources during an emergency through mutual aid and assistance
   • Better coordination among all levels of government and  emergency responders
   • Improved public confidence in drinking water and wastewater systems
   • Better understanding of the interdependencies between  the water sector and other critical infrastructure
     sectors
   • Enhanced water security capabilities  and  infrastructure  protection
   Additional Information:  For more information on the Key Features of an Active and Effective
   Protective Program please visit: http://water.epa.gov/infrastructure/watersecurity/index.cfm or
   contact: WSD-outreach@epa.gov
    Office of Water (4608-T)   EPA817-F-10-014   http://water.epa.gov/infrastructure/watersecurity/index.cfm   October 2010

-------