This brochure identifies the
10 Key Features of an Active and
Effective Protective Program and
additional activities the Water Sector
can implement to enhance its water
preparedness programs.
The Key Features describe the basic elements
of a "protective program"for owners/
operators of utilities to consider as they
develop utility-specific approaches. They
address the physical, cyber, and human
elements of prevention, detection, response,
and recovery.
Regardless of the cause of a drinking water
or wastewater service disruption, adopting
a security culture should be a priority to
effectively mitigate adverse public health,
economic, and environmental consequences.
The Key Features use the terms "protective
program,""protection," and "protective" to
describe activities that enhance resiliency
and promote continuity of service, regardless
of the type of hazard or adverse effect a
utility might experience.
Benefits of implementing the
10 Key Features into daily operations:
• Increased protection of public health
• Ability to more quickly detect, respond to, and
recover from any adverse event
• Increased access to resources during an
emergency through mutual aid and assistance
• Better coordination between all levels of
government and emergency responders
• Improved public confidence in drinking water
and wastewater systems
• Better understanding of the
interdependencies between the water sector
and other critical infrastructure sectors
• Enhanced water security capabilities and
infrastructure protection
&EPA
United States
Environmental Protection
Agency
Contact Us:
For more detailed information on the 10 Key
Features of an Active and Effective Protective
Program presented in this fact sheet, please
visit: www.epa.gov/watersecurity
For additional information, please contact:
WSD-outreach@epa.gov
Key Features of an
Active and Effective
Protective Program
The Water Sector has developed the
Active and Effective Protective Program
to assist owners and operators of
drinking water and wastewater utilities in
preventing, detecting, responding to, and
recovering from "all-hazards" incidents (i.e.,
human, natural, cyber).The 10 Key Features
of this program:
• Provide a framework to reduce risk to
the Water Sector, improve resiliency and
continuity of operations, and enhance
overall preparedness
• Su pport the Water Sector-Specific Plan
for Critical Infrastructure Protection
(SSP) goals and objectives to maintain
a resilient infrastructure, increase
communication, outreach, and public
confidence
Office of Water (4608-T) EPA 817-F-10-007
www.epa.gov/safewater June 2010
-------
10 Key Features of an Active and Effective Protective Program
Integrate protective concepts into orga-
nizational culture, leadership, and daily
operations
• Foster attentiveness to protection in the
day-to-day thinking of front-line workers,
emergency responders, management, and
senior leadership
• Identify employees responsible for implemen-
tating protection priorities
Identify and support protective program
priorities, resources, and utility-specific
measures
• Dedicate resources to specific protection
needs through annual capital, operations and
maintenance budgets, and/or staff resource
plans
• Develop measures appropriate to utility-spe-
cific circumstances and operating conditions
Employ protocols for detection of
contamination
• Establish working relationships with local,
state, and public health communities to
detect public health anomalies and evaluate
them for contamination implications
• Track, characterize, and consider customer
complaints to identify potential contamina-
tion events
Assess risks and review vulnerability
assessments (VAs)
• Maintain current understanding and as-
sessment of threats, vulnerabilities, and
consequences
• Establish and implement a schedule for review
of threats, vulnerabilities, and consequences and
their impact on the vulnerability assessment
at least every three to five years to account for
factors such as facility expansion/upgrades and
community growth
Establish facility and information access
control
• Implement physical and procedural controls
to restrict utility access to only authorized
personnel
• Define, identify, and restrict access to security-
sensitive information (both electronic and hard
copy) on utility operations and technical details
Incorporate resiliency concepts into physical
infrastructure
• Include protective program considerations early
in the design, planning, and budgeting pro-
cesses to mitigate vulnerability and/or potential
consequences and improve resiliency
• Develop design and construction specifications
that address both physical hardening of sensi-
tive infrastructure; and adoption of inherently
lower risk technologies and approaches where
feasible
Prepare, test, and update emergency response
and business continuity plans
• Understand, train, and implement National
Incident Management System (NIMS) guidelines
and Incident Command Systems (ICS)
• Review and update emergency plans annually;
and test those plans through tabletop, func-
tional, and full-scale exercises
Develop partnerships with first respond-
ers, managers of critical interdependent
infrastructure, other utilities, and response
organizations
• Forge partnerships in advance of an emer-
gency, ensuring utilities and key partners
are better prepared to work together if an
incident should occur
• Establish relationships with critical
customers (hospitals, manufacturing, first re-
sponders, etc.) to identify interdependency
issues that may impact business continuity
Develop and implement internal and ex-
ternal communication strategies
• Motivate staff to support protective pro-
gram strategies and goals
• Prepare key messages, in advance, for vari-
ous types of emergencies and determine
who and how those messages should be
delivered to the community
Monitor incidents and threat-level
information
• Develop systems to access threat informa-
tion, identify threat levels, and determine
specific response actions (e.g., WaterlSAC)
• Monitor threat information as a regular part
of a utility's protective program
------- |