v»EPA
United States
Environmental Protection
Agency
Guidance for Responding to
Drinking Water Contamination Incidents
Office of Water (MC 140)
EPA 817-B-18-005
October 2018

-------
Disclaimer
The Water Security Division of the Office of Ground Water and Drinking Water has reviewed and
approved this document for publication. This document does not impose legally binding requirements on
any party. The information in this document is intended solely to recommend or suggest and does not
imply any requirements. Neither the U.S. Government nor any of its employees, contractors or their
employees make any warranty, expressed or implied, or assume any legal liability or responsibility for
any third party's use of any information, product, or process discussed in this document, or represent that
its use by such party would not infringe on privately owned rights. Mention of trade names or commercial
products does not constitute endorsement or recommendation for use.
Questions concerning this document should be addressed to WQ SRS@epa.gov or the following contact:
William E. Platten III, Ph.D.
EPA Water Security Division
26 West Martin Luther King Drive
Mail Code 140
Cincinnati, OH 45268
(513) 569-7148
Platten. W illiam@,epa. gov

-------
Acknowledgements
EPA's Water Security Division developed this document with additional support provided under EPA
contract EP-C-15-012. The following individuals contributed to the development of this document:
•	Steve Allgeier, EPA, Water Security Division
•	Jeff Fencil, EPA, Water Security Division
•	Brian Pickard, EPA, Water Security Division
•	William E. Platten III, EPA, Water Security Division
Peer review of this document was provided by the following individuals:
•	Todd Anderson, Jacobs
•	Gary Burlingame, Philadelphia Water Department
•	Elizabeth Hedrick, EPA, Water Security Division
•	John Laws, Department of Homeland Security
•	Tom Noble, Horsley Witten Group
•	Johnathan Reeves, DC Water
•	Drew Saskowitz, Southeast Morris County Municipal Utilities Authority
•	Maureen Schmelling, DC Water
•	Shannon Spence, Prince William County Service Authority
•	John Strine, The York Water Company
•	Jeremiah York, City of Lebanon Water System

-------
Table of Contents
List of Figures	iv
List of Tables	v
Abbreviations	vi
Section 1: Introduction	1
Section 2: Contamination Incident Response Overview	3
2.1	Distribution System Contamination Response Procedure	3
2.2	Integration into Emergency Response Plan	4
Section 3: Contamination Incident Response Fundamentals	5
3.1	Phases of a Contamination Incident Response	6
3.2	Confidence and Impact Evaluation	7
3.3	Investigation Activities	9
3.4	Response Activities	11
3.5	Remediation and Recovery Activities	14
Section 4: Incident Management and Communication	16
4.1	Incident Command System	16
4.2	Response Partners	17
4.3	Communication Equipment and Methods	18
4.4	Information Management	19
Section 5: Training and Exercises	20
5.1 Implementation through Training and Exercises	20
Section 6: Developing a Response Procedure	25
Section 7: Resources	26
Section 8: References	28
Glossary	29

-------
List of Figures
Figure 1-1. Document Roadmap	2
Figure 2-1. Conceptual Overview of Contamination Response Activities	3
Figure 2-2. Relationship between a Utility ERP and DSCRP	4
Figure 3-1. Overview of a Contamination Incident Response	5
Figure 5-1. Types and Examples of Trainings and Exercises of Varying Complexity and Resource
Requirements	21
Figure 6-1. Steps for Developing a DSCRP	25
iv

-------
List of Tables
Table 3-1. Example List of Information Sources Useful during an Investigation	9
Table 4-1. Typical Roles and Responsibilities for Implementing a DSCRP	18
Table 5-1. Examples of Discussion-based Exercises to Support Implementation of a DSCRP	22
Table 5-2. Examples of Operations-based Exercises to Support Implementation of a DSCRP	23
v

-------
Abbreviations
AAR/IP
After-Action Report/Improvement Plan
CDC
Centers for Disease Control and Prevention
CFR
Code of Federal Regulations
DHS
Department of Homeland Security
DSCRP
Distribution System Contamination Response Procedure
EPA
United States Environmental Protection Agency
ERP
Emergency Response Plan
HazMat
Hazardous Materials Unit
HSEEP
Department of Homeland Security's Homeland Security Exercise and Evaluation

Program
FBI
Federal Bureau of Investigation
FEMA
Federal Emergency Management Agency
ICS
Incident Command System
LIMS
Laboratory Information Management System
NIMS
National Incident Management System
NRF
National Response Framework
PIO
Public Information Officer
RAP
Remediation Action Plan
RCP
Risk Communication Plan
SAP
Sampling and Analysis Plan
SCADA
Supervisory Control and Data Acquisition
SC&SP
Site Characterization and Sampling Plan
WARN
Water/Waste water Agency Response Network
WSI
Water Security Initiative

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 1: Introduction
The United States Environmental Protection Agency (EPA) developed this guidance for drinking water
utilities and their response partners to help them prepare for responding to incidents of contamination in
the distribution system. It provides a framework for responding to
distribution system contamination incidents, discusses the
fundamental concepts of consequence management, highlights the
need for coordinating efforts with local, state, regional, and federal
response partners, and describes the use of training and exercises for
learning and improving response procedures. The overall goal of this
guidance is to assist utilities with planning and creating a
contamination incident response procedure that supplements a utility's
Emergency Response Plan.
The concepts presented in this guidance were developed and refined by EPA in collaboration with five
large drinking water utilities1 and their response partners through the Water Security Initiative (WSI)
Contamination Warning System Pilot Program (EPA, 2015). This guidance is reflective of the way the
concepts were implemented during these pilots. Tips, success stories, and lessons learned from the utility
experiences are also highlighted throughout this guidance.
The concepts presented in this document are applicable and scalable to utilities of all sizes. However, the
degree to which the various responses and decisions are performed by a utility will vary based on utility
resources and size. Most utilities, especially smaller utilities, will need to rely on relationships with other
utilities, response partners, and their primacy agency to accomplish some or most of the activities
required during a contamination incident. Utilities should determine which activities they will perform
internally and establish contracts or mutual-aid agreements with their response partners to perform the
remaining activities.
The Document Roadmap in Figure 1-1 can be used to quickly navigate and explore the topics covered in
this document. Selecting one of the topics will navigate to the desired section. When finished, selecting
the section header will return to the Roadmap.
Template
A template for the response
procedure aligned with the
recommendations presented
in this guidance is available
in Section 6: Developing a
Response Procedure.
^ Referred to in this document as the WSI pilot utilities.
1

-------
Guidance for Responding to Drinking Water Contamination Incidents
Response
Distribution System Contamination	Integration into Emergency
Response Procedure	Response Plan
Contamination Incident
Response Fundamentals
Phases of a Contamination
Incident Response
Confidence and Impact
Evaluation
LLI
CC
a
Ui
u
o
CC
CL
UJ
CO
Investigation Activities
Gather and Review
Available Information
Site Characterization,
Sampling, and Analysis
Response Activities
Operational Response
Risk Communication /
Public Notification
Remediation and Recovery
Activities
Characterization
for Remediation
Decontamination
o
CL
UI
Issuing Use
Restrictions
Clearance
Incident Management
and Communication
Incident Command System
Communication Equipment
and Methods
Response Partners
Information Management
Training and Exercises
Implementation through
Training and Exercises
Discussion-Based
Exercises
Operations-Based
Exercises
Developing a
Response Procedure
Figure 1-1. Document Roadmap
2

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 2: Contamination Incident Response Overview
Drinking water contamination can result in a number of adverse consequences to the public and the
distribution system. Preparing a response procedure for such an occurrence enables a utility to effectively
manage the incident to limit these consequences, providing a decision-making framework for
implementing activities that, ultimately, returns the system to normal operations.
2.1 Distribution System Contamination Response Procedure
Distribution system contamination can occur under a variety of circumstances, including natural,
accidental, and intentional causes (EPA, 2005). Regardless of cause, contamination incidents require a
measured, yet appropriate response to fully address the potential contamination and protect public health
while not over-responding, wasting resources, and causing undue alann to customers. The Distribution
System Contamination Response Procedure (DSCRP) serves as a utility's guide for the investigation of,
response to, and recovery from drinking water contamination incidents. These activities, outlined in
Figure 2-1, are intended to minimize response and recovery timelines through a pre-planned, coordinated
effort. Activities are initiated upon identification of an indicator of water contamination to: (1) investigate
the credibility of the indicator, (2) minimize public health and economic consequences through
operational responses and notifications, and (3) guide remediation and recovery efforts to ultimately
return a utility to normal operations.
The DSCRP relies upon extensive planning efforts to:
•	Establish clear roles and responsibilities within the water utility and with local, state, and federal
response organizations
•	Outline the protocols for investigating the contamination incident
•	Identify potential operational response actions
•	Develop strategies for communicating with the public
•	Prepare for remediation and recovery
Investigation
Operational Responses and
Notifications
Remediation and Recovery
Check other indicators
Assess other data sources
Site characterization and sampling
Field and laboratory analysis
Isolation
Flushing / disinfection
Risk communication
Use restrictions
System / contaminant characterization
Remediation planning
Decontamination
Clearance
Figure 2-1. Conceptual Overview of Contamination Response Activities
3

-------
Guidance for Responding to Drinking Water Contamination Incidents
2.2 Integration into Emergency Response Plan
A DSCRP is an annex or appendix in a utility 's overall Emergency Response Plan (ERP), focusing on
the incident-specific procedures for response to and recovery from a drinking water contamination
incident. Figure 2-2 outlines the relationship between an ERP and a DSCRP.
Water Utility Emergency
Response Plan
Risk Communication
Plan
System-Specific
Information
Roles and
Responsibilities
Core Response Procedures
(e.g., alternate water,
sampling, safety)
Incident-Specific
Response Procedures
Communication
Procedures
Natural Disaster
Response Procedure
(e.g., flood, earthquake)
Emergency Water Main
Break Response
Procedure
Fire-flow
Response Procedure
Distribution System
Contamination
Response Procedure
Source Water
Contamination Response
Procedure
Figure 2-2. Relationship between a Utility ERP and DSCRP
In general, an ERP covers overarching response needs, such as general roles and responsibilities, detailed
system information, and core response procedures (e.g., alternate water services, safety). These
overarching response considerations apply regardless of the type of
incident. Incident-specific response procedures are developed as
supplements to an ERP. These procedures may include details for
responding to natural disasters (e.g., hurricanes, earthquakes) or water
main breaks. A DSCRP is an incident-specific response procedure that
contains the specific, detailed response processes for a drinking water
contamination incident.
Unlike other incident response procedures, a DSCRP includes an investigation process to determine
whether or not contamination has actually occurred. Specific response activities are implemented
incrementally, alongside the investigation, as more information (e.g., identity of the contaminant, extent
of contamination, impact on customers) is discovered through investigative activities. The inherent lack
of information, particularly in the early stages of the incident, necessitates a cycle of discovery and
response until contamination can be confirmed and the extent of the contamination can be fully
characterized. Planning in advance for the investigation activities (e.g., data collection, sampling,
analysis) as well as the response activities (e.g., operational changes and communication with
stakeholders and the public) can accelerate the decision-making process during an incident.
Developing an ERP
Learn more about planning
for emergencies and creating
an ERP for your utility at
EPA's Water Utility Response
website.
4

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 3: Contamination Incident Response Fundamentals
The DSCRP focuses on the activities to perform during a water contamination incident and the steps that
a utility can take to prepare for those activities. Figure 3-1 provides an illustration of the major decision-
points and activities that occur during an incident. A utility's DSCRP should cover each of these topics,
providing responders with a decision-framework and the necessary supporting information to select and
implement the appropriate activities for a given situation.
Validated Indicator of
Water Contamination
I
r
Initiate Investigation
and Response Phase


Gather and Review
Available Information


Evaluate Initial
Findings
Contamination
is Suspected
Contamination
is Ruled Out
Investigation and Response Activities
Site Characterization,
Sampling, and Analysis
Operational
Responses
Risk Communication/
Public Notification
Contamination
is Ruled Out
Evaluate Response
Actions
Contamination
is Confirmed
Initiate Remediation
and Recovery Phase
Remediation and
Recovery Activities
1/1
<
x
CL
o
Q.
1/1
LU
CC
O
<
V3
i/i
LU
>
1/1
<
X
CL
>
CC
LU
>
o
u
LU
CC
O
Operational
Responses
Characterization
Decontamination
Risk Communication/
Public Notification
<
0
Clearance
Figure 3-1. Overview of a Contamination Incident Response
5

-------
Guidance for Responding to Drinking Water Contamination Incidents
3.1 Phases of a Contamination Incident Response
r~
As Figure 3-1 illustrates, an incident begins with the
discovery and validation of an indicator of water
contamination (sqq Important Definition callout box). In
general, an incident is investigated to determine the
credibility of the suspected contamination incident
while performing response activities to reduce potential
consequences. The scope and significance of these
activities increase as the credibility of the
contamination increases. Once contamination has been
confirmed, the investigation ends and the incident
transitions to remediation and recovery. The DSCRP
should include sections to address these two phases of
the incident response.
V
Important Definition
An indicator of water contamination is
anything that could suggest the presence of
contamination in the drinking water (e.g.,
deviation in monitoring results, report of
physical tampering, customer water quality
complaint). It is considered validated after
ruling out other, non-contamination causes,
such as equipment malfunctions, procedural
errors, or normal background variability. If
the indicator is valid, water contamination is
a possibility and Investigation and Response
activities begin.


Example Investigation
and Response Phase
Decision Tree
Hover over to enlarge
Investigation and Response Phase includes the investigation of a suspected water contamination
incident to determine if contamination has occurred. Responses occur in parallel to the
investigation to protect public health and limit economic impacts.
This phase is a cyclical process of collecting and evaluating
information about the suspected incident, while also implementing
appropriate response actions to limit the impact on the system and
customers. Investigation activities include reviewing available
information and performing site characterization, sampling, and
field and laboratory analysis. Response activities may include
operational responses, risk communication/public notification, and
issuing use restrictions. With each new piece of information
gathered through the investigation, the incident should be evaluated
to determine if contamination can be ruled out (the incident ends),
has been confirmed (the incident proceeds to remediation and
recovery), or remains a possibility (the investigation continues). This
phase ends once the contamination has been confirmed or ruled out.
Remediation and Recovery Phase begins after contamination has been confirmed. This phase
shifts the focus from the investigation activities of the previous phase
to planning for remediation while continuing to implement response
activities. Remediation and recovery includes characterization,
decontamination, and clearance to return the system to normal
operation. Characterization involves additional sampling and analysis
from the distribution system in order to determine the source, extent,
and fate of contamination in the system. Information gathered during
characterization informs planning and selection of the
decontamination strategy. Once the decontamination strategy has
been implemented, clearance of the impacted portion of the system
can occur through post-remediation monitoring to verify removal of
the contamination. Once cleared, the system returns to normal
operations.
Example Remediation and
Recovery Phase
Decision Tree
Hover over to enlarge
6

-------
Guidance for Responding to Drinking Water Contamination Incidents
3.2 Confidence and Impact Evaluation
During the investigation of a suspected contamination incident, a utility will need to evaluate its
confidence in the information indicating that the system may be contaminated. Consideration should also
be given to the potential impact of the suspected incident on the system and its customers. Together, the
confidence and impact will inform a utility's response decisions.
Confidence
A utility should evaluate how confident they are that contamination has occurred based on the available
information. The confidence can be expressed using descriptive terms or numbers in a tier or level system
that have predefined meaning to the utility personnel and response partners. For instance, EPA's
Response Protocol Toolbox (EPA, 2003) introduced the terms possible, credible, and confirmed to
express three levels of confidence that contamination is present. Expressing the confidence in a standard
format helps to efficiently convey the current state of the incident to the response team. Criteria can be
established for each confidence level to help the responders assign a level to the incident. Criteria to
consider include:
•	The type of validated indicator of contamination (e.g., verbal threat, water quality anomaly)
•	Information from other utility departments and partners (e.g., treatment status, work orders)
•	Any corroborating evidence (e.g., additional indicators, evidence of tampering)
•	Site characterization and sampling (e.g., sampling results, presence of site hazards)
Impact
A utility should also evaluate the impact of contamination, that is, the potential consequences to its
system and customers. Determining how severe an incident could be will have a significant influence on
when and how response activities are implemented. Like confidence, a tier/level system, such as Low,
Moderate, and High, can be used to express the potential impact of contamination. Criteria to consider for
establishing the impact levels include:
•	Potential impact on public health (e.g., no effect, illnesses/fatalities)
•	Number of customers potentially affected (e.g., single block, pressure zone)
•	Potential impact of use restrictions on customers (e.g., boil warning, do-not-use)
•	Potential impact on critical customers (e.g., hospitals)
•	Potential impact on the system/geographic extent (e.g., single storage tank, entire system)
•	Regulatory impacts (e.g., potential for non-compliance with regulations, reporting requirements)
•	Potential impacts on non-critical measures (e.g., aesthetics of the water, customer confidence)
Confidence and impact should be evaluated initially after a valid indicator of contamination is observed
and periodically throughout the investigation as new information is gathered. At the highest level, the
evaluation should determine whether to rule out contamination, to begin/continue the investigation, or to
confirm contamination has occurred. It can also be used for decision-making when planning the various
investigation and response activities.
As an example, a confirmed contamination incident (high confidence), like one due to the detection of
residual potassium permanganate in finished water, may pose little risk (low impact) to public health,
requiring notification but no use restriction. On the other hand, a verbal, unspecific threat of
contamination with a "toxin" may have low confidence but high potential impact (e.g., severe
consequences to public health), and may warrant aggressive investigation and preliminary responses (e.g.,
isolation).
The confidence and impact levels should be simple and easy to understand in order to convey the
meaning clearly, particularly to response partners. In this guidance, the confidence and impact levels
7

-------
Guidance for Responding to Drinking Water Contamination Incidents
introduced by the Response Protocol Toolbox (EPA, 2003) are described for reference (see
Confidence/Impact Evaluation Example callout box); however, these should be customized as needed to
have the most meaning and value to the utility and its response partners.
While the confidence and impact ratings are useful tools, it is important to use an evaluation process that
allows those leading the incident response the flexibility to adapt to the situation. The evaluation should
help guide response decisions, but not constrain or limit the selection of response activities.
Confidence/Impact Evaluation Example
The Response Protocol Toolbox (EPA, 2003) describes three confidence levels (Possible, Credible, and
Confirmed) and three impact levels (Low, Medium, and High). The confidence levels guide the overall
investigation and response while the impact levels guide the implementation and urgency of specific activities as
the utility's confidence progresses.
•	Possible Contamination is the first confidence level and is usually assigned to the early stages of the
Investigation and Response Phase. This level indicates that the information known about the incident is
minimal, and likely based on a single validated indicator of contamination. The primary action to perform at
this level is to gather additional evidence to corroborate the presence of water contamination. The extent of
the investigation activities (e.g., number of personnel, methods selected), particularly those involving field
personnel, depend mostly on the impact of the indicator. If the results of the investigation corroborate the
initial indicator, contamination is considered Credible (it may also be Confirmed if there is definitive
evidence that contamination has occurred); otherwise the investigation is closed. Response activities should
be considered at this confidence level depending on the impact (Low, Medium, or High), but the options are
usually limited due to the lack of information. While proactive surveillance of the distribution system may
detect a number of Possible contamination incidents, only a small percentage of these are expected to
progress to the Credible contamination level.
•	Credible Contamination is the second confidence level and usually assigned in the latter stages of the
Investigation and Response Phase, This level indicates a heightened level of confidence that contamination
has occurred. Credible contamination can be established using information from multiple sources (e.g.,
corroborating evidence, sampling results). The investigation efforts continue and expand to determine
whether a drinking water contamination incident has definitively occurred. Response activities should be
implemented based on the impact (Low, Medium, or High) of the incident and the consequences of inaction.
•	Confirmed Contamination is the third confidence level and is assigned once there is definitive evidence
that drinking water contamination has occurred, demonstrated by either a positive analytical result or a
preponderance of evidence that the water has been contaminated. The Remediation and Recovery Phase
begins after contamination has been Confirmed. During the Remediation and Recovery Phase, additional
operational responses may be initiated, and planning for remediation and recovery begins, including
characterization of the contamination, selection and implementation of a decontamination strategy, and
clearance of the system to return to normal operations. Ongoing communication with the public is essential
to ensure that the affected population is aware of any water use restrictions, and to keep the public apprised
of progress during remediation.
8

-------
Guidance for Responding to Drinking Water Contamination Incidents
3.3 Investigation Activities
Investigation activities involve the collection of information about the incident in an attempt to either rule
out or confirm contamination. These activities include gathering and reviewing available information
from a variety of sources and collecting new information from the field through site characterization and
sample collection and analysis.
Gather and Review Available Information
To begin the investigation, a utility should gather and review all available information from internal
utility resources and external response partners. This information includes any data or information that is
routinely collected by a utility or a response partner and may have some relevance to the current incident.
Examples include customer calls, online water quality monitoring data, compliance sampling data,
treatment irregularities, maintenance and repair work orders, and public health trends. These sources of
information can provide context and may support decisions on the direction of the investigation and
responses, especially during the initial stages of the incident when very little information is known. These
sources should continue to be checked periodically throughout the investigation for updated information,
particularly those that gather frequent or continuous data (e.g., online monitoring stations, customer
complaint calls).
A utility should list relevant sources of information (see an example in Table 3-1) in their DSCRP along
with how that information can be accessed. The internal information may be located in a central
Supervisory Control and Data Acquisition (SCADA) system or distributed amongst a utility's
departments whereas response partners may have varying procedures for requesting and accessing the
information they collect. When developing a DSCRP, response partners should be contacted to discuss
what information they collect and can share as well as the most efficient way of requesting the
information during an incident.
Table 3-1. Example List of Information Sources Useful during an Investigation
Information
Source
Instrument maintenance records
Instrument logbooks or digital management system
Online monitoring data
SCADA or dedicated water quality information management
system
Flow and pressure data
SCADA or distribution operations department
Pump/tank operating status
SCADA or distribution operations department
Treatment operations information
SCADA or treatment plant operations department
Modeling results
Distribution operations or engineering department
Sampling results
Laboratory information management system (LIMS) or water
quality database
Customer complaints records
Customer service department
Maintenance and repair work orders
Distribution and treatment plant operations department
Reports of drinking water-related illness
Local public health agency
Region/state-wide water advisories
State environmental agency
Recent chemical spills
Spill reporting hotline
Calendar of regional events
City/County events calendars
9

-------
Guidance for Responding to Drinking Water Contamination Incidents
Site Characterization. Sampling, and Analysis
Characterizing the site of an indicator of contamination and collecting samples for field or laboratory
analysis are important activities that support the investigation of suspected contamination. The site of an
indicator may provide further evidence of contamination and samples collected from the site can be
analyzed for water quality parameters and contaminants of concern. Coupled with other available
information, the results from these activities can answer many questions about an incident. Other sites of
interest may also require investigation, such as any locations where contamination is suspected to have
been introduced.
A Site Characterization and Sampling Plan (SC&SP) should be completed for each site to provide
instructions to the field teams for performing these tasks. A SC&SP is a brief checklist-style plan
prepared in advance that can be filled out during an incident by the Incident Commander (see Section 4.1
for command roles) and distributed to field personnel trained to implement the activities, including key
response partners. A SC&SP should describe:
•	The site of interest along with any known information about the site and indicator
•	Field activities to be performed
•	The water quality parameters that will be
analyzed at the site
•	Samples that will be collected for analysis
off-site
•	The personnel and response partners that
will be deployed to the site
•	The disposition of samples after field
activities (e.g., sent to a laboratory, given to
a response partner)
•	The method and frequency of
communicating and reporting results
•	The health and safety requirements
•	Any approvals/authorizations (e.g., Incident
Commander, health and safety officer)
The field activities to perform at a site should be determined by the specifics of the incident and site, the
capabilities of the utility and response partners, and the confidence/impact evaluation. Field activities fall
into five general categories:
•	Visual site hazard assessment, performed upon approach and while accessing the site to screen
for the presence of hazards.
•	Site safety screening, performed to ensure the site is safe for entry.
•	Water quality parameter testing, performed to collect general water quality data in the field.
•	Rapid field testing, performed to collect specific contaminant or contaminant class (volatiles,
metals, etc.) data in the field.
•	Sample collection for laboratory analysis, performed to collect samples for detailed or targeted
analysis in a laboratory.
Sampling should be considered at other locations, in addition to the location of site characterization, to
provide supporting evidence for interpreting any results. Sampling other locations can verify transport of
a contaminant or water quality change downstream through the system, follow the contaminant upstream
to the source, and establish the water quality in uncontaminated regions of the system for comparison. If a
site for characterization has been identified, sampling both upstream and downstream of the site from fire
r
Build Field and Laboratory
Capabilities
V.
Refer to the following guidance documents for
more information on developing field and
laboratory capabilities for conducting site
characterization, sampling, and analysis during
a contamination incident:
•	Guidance for Building Field Capabilities to
Respond to Drinking Water Contamination
•	Guidance for Building Laboratory
Capabilities to Respond to Drinking Water
Contamination
10

-------
Guidance for Responding to Drinking Water Contamination Incidents
hydrants or easily accessible taps can help to determine if the contamination is isolated to the site (e.g., a
problem within the premise plumbing) or is in the distribution main.
To aid decision-making during an incident, a DSCRP should contain instructions for completing an
SC&SP. It is also helpful to include lists for:
•	Established capabilities for each field activity with details on who
(utility/response partner) can perform the activity and general
guidelines for when to include the activity in the plan.
•	Analytical parameters that can be measured in the field or in the
laboratory with details on the parameter or contaminant/contaminant
class name, the method, required equipment, the responsible party
(field personnel/utility laboratory/response partner laboratory), and
approximate turn-around time for the analysis.
•	Sampling locations with general details on the locations such as the
asset ID/name, type (e.g., hydrant, tap), and address or descriptive
directions as well as the significance of the location (i.e., does the
location represent an entry point or a pressure zone).
Listing the capabilities and analytical parameters will expedite the selection of field activities by ensuring
the available options are accessible without the need to consult field and laboratory personnel.
Preselecting sampling locations, such as at fire hydrants or tanks, will reduce the time spent determining
suitable locations during an incident as well as allow utility personnel to become familiar with the
locations through training and exercises. Locations should be chosen throughout the system: near all entry
points into the system, the entry and exit of pressure zones, utility facilities, and important distribution
system infrastructure. Utilities likely have some of these locations already identified for current sampling
needs (e.g., compliance monitoring) and can utilize these same locations during an incident.
Conducting site characterization and sampling will likely occur with limited knowledge of the problem,
which can present unknown risks to the personnel performing the activities. A utility should determine
which circumstances will be handled internally and which will require a response partner, such as law
enforcement or a Hazardous Materials unit (HazMat). Utility personnel should be trained to identify
potential site hazards so they can recognize when a circumstance is beyond their capabilities and training.
An important part of implementation of the SC&SP is maintaining communication between the field
personnel and the Incident Commander to assess any findings and authorize each activity in the plan, as
necessary. A DSCRP should include instructions to guide the Incident Commander in implementing an
SC&SP, noting important points for communication and for providing approval for the next activity in the
plan. Important communication points include site arrival, the discovery of findings, the completion of
each activity, the completion of all site activities, and site exit. Communicating with the laboratories that
will be analyzing samples early in the site characterization process is also important to ensure they are
prepared to receive and process the samples as quickly as possible.
3.4 Response Activities
Response activities focus on limiting the consequences of contamination. Operational responses, risk
communication, and issuing use restrictions aim to minimize the extent of contamination, keep the public
informed of the situation, and protect public health.
Example Site
Characterization and
Sampling Plan
Hover over to enlarge
11

-------
Guidance for Responding to Drinking Water Contamination Incidents
Operational Response
As information on the incident is gathered through the investigation process, a utility should consider
operational responses. Operational responses are changes to the operation of the distribution system that
limit the spread of contaminated water and prevent or reduce the impact on customers and the system. As
information about the contamination incident is gathered, operational response options should be
developed by the utility distribution system operators and evaluated by the Incident Commander for
implementation. If the location of the source of contamination is known or suspected, a distribution
system model and/or knowledge of the distribution system can be used to estimate spread and identify
potentially effective operational responses. Operational responses to consider include complete isolation
of the affected area or reducing or diverting flow (e.g., opening/closing valves, flushing, isolating tanks,
or changing the hydraulic gradient in the system through pump and tank operations) to slow or limit the
spread. Operational responses should be considered throughout the Investigation and Response Phase,
and may be continued into the Remediation and Recovery Phase, if necessary, to limit the area of the
system requiring remediation.
Since any operational response will likely disrupt service to some portion of the distribution system, the
decision to implement a response action should weigh the current confidence/impact assessment of the
incident against the effect of the operational response on customers. Furthermore, due to the lack of
information about the source and spread of contamination at the beginning of an incident, a utility should
consider the potential of operational responses to increase the extent of contamination. While minor
changes in operations can be implemented with little impact, more significant changes should only be
implemented when warranted by the confidence/impact assessment. If a change in operations will directly
affect customers, they should be notified as soon as practical. As new information is collected about the
incident, any implemented change in operations should be re-evaluated and adjusted, as necessary.
Operational responses are situation-dependent, but some common options can
be planned in advance to hasten the response. Plans for common operational
responses, such as isolation or flushing, can be developed for specific
facilities, such as tanks and pump stations, and for hydraulically distinct areas
of the system. Planning these responses in advance will allow distribution
system operators to implement these actions quickly and effectively.
A DSCRP should contain the list of planned operational responses that
describe the anticipated effect of the operational response on system
hydraulics and contaminant spread, an estimate of the time to implement the
response, and any adverse impacts to customers or the system. There should
also be a decision-making framework, such as a decision tree, to allow the
Incident Commander to quickly decide if an operational response is feasible
and appropriate to the situation (i.e., confidence/impact levels). Specific
procedures for implementing each operational response should also be documented and made available to
operators.
Distribution System Model
Implementing operational responses requires knowledge of the anticipated path of the contaminant through the
distribution system. Distribution system operators will be able to provide approximate information, but a more
accurate method is to build a distribution system model. Modeling results that estimate the extent of
contamination and allow for examining alternative hydraulic/operational scenarios can be used to inform
decisions related to operational responses and sampling. Modeling capabilities can also support system planning,
operations, and water quality management. A model should be updated to capture changes in operations,
demand, and configuration to ensure that model projections are sufficiently accurate for their intended use.

Example Operational
Response Planning
Decision Tree
Hover over to enlarge
12

-------
Guidance for Responding to Drinking Water Contamination Incidents
Risk Communication/Public Notification
Risk communication plays a key role during an incident, keeping the public and customers aware of the
situation and providing vital information to protect public health. Public water systems are required by the
Safe Drinking Water Act and EPA regulations (40 CFR 141, Subpart Q) to notify the public when
"situations with significant potential to have serious adverse effects on human health as a result of short-
term exposure, as determined by the primacy agency either in its regulations or on a case-by-case basis"
become apparent, which may include incidents under investigation without confirmed contamination
(Public Notification of Drinking Water Violations, 2012). By law, a utility must contact the primacy
agency to determine public notification requirements as soon as practical, but not later than 24 hours after
learning of the situation. These situations require a Tier 1 public notice (see 40 CFR 141, Subpart Q for
information on Tier 1 public notices). Refer to EPA's "Revised Public Notification Handbook" for
additional guidance regarding public notifications and the requirements of the notification rule (EPA,
2010).
A utility should develop a comprehensive Risk Communication Plan (RCP) that is well coordinated with
the steps and procedures contained in their DSCRP. An RCP is part of a utility's ERP (see Figure 2-2 in
Section 2) covering the utility's communication procedures during an emergency. The purpose of an RCP
is to guide a utility and its partners regarding:
•	When and how to issue public notifications, including drinking water use restrictions
•	How to identify target audiences and develop messages
•	How to work with the media
•	How to establish a delivery system for the message (e.g., media, radio, television, auto-dialer
telephone systems)
An RCP generally describes the responsibilities of a utility's Public Information Officer (PIO) (see
Section 4.1 for command roles) during all phases of an incident. It also covers internal and external
communications and coordination with external agencies as well as with the media. An RCP may include
an overview of basic crisis communication principles, RCP decision trees for use by the PIO, a section
with tools and resources that provide forms, templates, and sample notification documents, and contact
information.
Development of an RCP should be led by a utility's PIO and
confirmed through their counterparts at response partner
organizations. A utility and other agencies may already have much of
this information covered in existing RCPs or Public Notification
Plans, but roles and responsibilities during the response to a
contamination incident may still need to be coordinated and
confirmed amongst the groups. The goal is to coordinate
communication with the public across agencies to promote messages
that are clear, consistent, and concise (i.e., messages do not give out
superfluous or contradictory information).
Issuing Use Restrictions
Issuance of use restrictions is part of risk communication, but is discussed separately in this guidance
because it is one of the most important decisions made during the Investigation and Response Phase.
During an incident, it may become necessary to inform the public and customers that the water may be
contaminated, an investigation is underway, and that use of the water should be restricted in some
manner. The purpose of issuing use restrictions is to protect the health of the public by alerting them to
the issue and providing instructions/restrictions for the use of the drinking water supply. Types of use
restrictions include instructions to "do not use," "do not drink," or "boil water." Depending on the
Develop a Risk
Communication Plan
Refer to Developing Risk
Communication Plans for
Drinking Water Contamination
Incidents for more information
on how to organize and write
an effective RCP.

13

-------
Guidance for Responding to Drinking Water Contamination Incidents
restriction, this notification should be closely coordinated with the provision of alternate sources of
drinking water. A utility's DSCRP should contain directions for issuing the restrictions in the context of
an ongoing investigation; however, the general guidance for developing and issuing the restriction should
be contained in an RCP.
3.5 Remediation and Recovery Activities
Once contamination has been confirmed, the Remediation and Recovery Phase begins. Remediation
activities include characterizing the nature and extent of contamination, implementing further response
activities as additional information is gathered, planning and implementing a decontamination strategy,
clearing the system for return to service, and continuously updating the public and customers with
information on progress.
Characterization for Remediation
The Remediation and Recovery Phase begins with fully characterizing the nature and extent of
contamination. The goal is to identify the contaminant (if not already identified) and to determine the
source, extent, and fate of the contamination in the distribution system. Sampling and analyses are
continued from the Investigation and Response Phase; however, the parameters of interest narrow to only
those most relevant to the identified contaminant (e.g., the contaminant, related chemical
groups/degradation products, important water quality parameters). The number of sampling locations
increases in order to fully capture the spread of contamination within the distribution system and guide
expanded response activities. Personnel with expert knowledge of the distribution system should
determine the approximate boundaries of the contaminated area, which will aid the selection of sampling
locations for confirming the extent of contamination. A distribution system model can also assist with
establishing the contaminated area. A risk assessment can then be conducted to establish the clearance
goals for remediation, which will set the parameters to measure, the number of samples to collect, and the
locations from which to sample. A Sampling and Analysis Plan (SAP) should be created specifying the
details of the characterization activities. While similar to an SC&SP from the Investigation and Response
Phase, an SAP focuses primarily on collecting only the specific samples needed to characterize the
contaminant and verify the extent of contamination. An SAP may include methods and procedures
outside of those typically used by a utility, depending on the nature of the contamination.
As the extent of contamination and the risk to customers are determined, additional operational responses
may be implemented to limit the area requiring decontamination and risk communication and
notifications should be updated and/or issued. These responses should be continually assessed during the
characterization process until it has been completed.
Decontamination
A decontamination strategy should be developed and implemented to remove and treat the contaminated
water, decontaminate the system, and return the system to normal operation. The strategy should address
removal of the contaminated water from the system, treatment and disposal of the contaminated water
(i.e., treatment options or direct discharge), and decontamination of contaminated infrastructure, if
necessary. Disposal, either with or without treatment, should be closely coordinated with any partners or
agencies responsible for receiving the discharge, such as a wastewater utility for sewer disposal.
A Remediation Action Plan (RAP) should be created to document the decontamination strategy. The
RAP should describe the process for implementing the decontamination strategy, including the objectives,
methods, schedule, personnel involved, health and safety information, and required approvals. The RAP
may need to be revised if new information becomes available relating to contaminant properties, the
effectiveness of decontamination methods, or anything else that could impact the ability of the
decontamination strategy to meet the clearance goals.
14

-------
Guidance for Responding to Drinking Water Contamination Incidents
While the RAP is developed and implemented, operational responses and risk communication continue.
Operational responses should be maintained to isolate the contaminant and protect the system until it can
be decontaminated. Risk communication should provide updates to the public and stakeholders until the
remediation process is completed and any drinking water use restrictions can be lifted.
Clearance
The system must go through clearance before it can return to normal operation. Clearance involves
additional sampling and analysis throughout the contaminated areas of the distribution system to verify
that clearance goals have been met. The primacy and public health agencies play a lead role in assessing
if the goals have been achieved and providing final clearance, but the decision could also include other
stakeholders and subject matter experts. If the goals have not been met, adjustments to the risk assessment
may be necessary or additional decontamination activities may be required. If the clearance goals have
been achieved, the system can return to service. As part of returning to service, the primacy and public
health agencies may require a long-term monitoring program to demonstrate that the contaminant
concentration remains below the remedial goal. Depending on the specifics of the incident, different
sections of the system may be cleared at different times or the clearance may occur gradually, which
allows different uses of the water (e.g., toilet flushing, bathing, consumption) at different stages in the
clearance process.
15

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 4: Incident Management and Communication
Successful investigation, response, and remediation of a contamination incident require coordinated
management of the incident and effective communication among those involved. A well-defined
command structure is necessary to organize and integrate utility personnel performing tasks outside their
normal chain-of-command with any response partners that may be providing support to the incident. In
addition, proper methods for communication and information management ensure all involved in the
incident have the necessary information to respond in a coordinated effort. A utility's DSCRP should
include the details on how to organize the command structure and the equipment, methods, and systems
for communication and information management.
4.1 Incident Command System
The National Incident Management System (NIMS), developed by the Federal Emergency Management
Agency (FEMA), provides a systematic, proactive approach guiding government agencies at all levels,
the private sector, and nongovernmental organizations to work seamlessly to prepare for, prevent, respond
to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in
order to reduce the loss of life and property. The Command and
Management component of NIMS includes the Incident Command
System (ICS), which should be integrated into utility response
procedures. The ICS is a widely applicable management system
designed to enable effective and efficient incident management by
integrating a combination of facilities, equipment, personnel,
procedures, and communications operating within a common
organizational structure.
A utility's ERP should have an overview of how the utility implements the ICS during an emergency. A
DSCRP should contain provisions for how roles specific to a contamination incident fit into that ICS
structure and for when the ICS should be activated, regardless of the scale of the incident and whether the
response is managed internally or in cooperation with response partners. It is important to note that the
ICS structure is flexible and can be modified or enhanced to meet a utility's needs. Also, the utility ICS
may evolve during the course of an incident, and all sections (Operations, Planning, logistics, and
Finance/Administration) may not be activated at once. As the contamination incident escalates, the ICS
can expand to provide additional resources and support for the investigation and response. At the same
time, Incident Command may pass laterally between personnel in different utility departments, transition
to higher levels of supervision and management within a utility, or become integrated into a multi-agency
command structure under a Unified Command, led by a state or federal agency. Note that passing the role
of Incident Commander should be done formally to avoid any confusion during an incident, particularly
in the early stages when it may pass quickly between different managers.
Many personnel involved in routine operations at the utility that have a role in investigating and
responding to a contamination incident would fall under the Operations Section of the ICS structure,
grouped in Branches or Divisions/Groups by geography/function (e.g., field sampling personnel could fall
under a Field Operations Branch). However, personnel may find themselves assigned to tasks not typical
of their daily functions due to the demands of an incident. For instance, a distribution team may be asked
to support sampling personnel if there are not enough field teams to perform the required sampling. Some
operations personnel with specialist knowledge, such as laboratory capabilities or distribution operations,
may be moved over to the Planning Section to provide their knowledge to planning and coordinating
various activities. The Planning (outside of the technical specialists), Logistics, and
Finance/Administration Sections and the Command Staff (except the PIO) perform similar functions
during all types of emergencies and would likely not need specific instructions included in a DSCRP.
Learn about the ICS
Refer to FEMA's Emergency
Management Institute and ICS
Resources Center for a variety of
resources and courses to learn
more about NIMS and the ICS.
16

-------
Guidance for Responding to Drinking Water Contamination Incidents
WSI Pilot Utility ICS Structure Examples
Each of the WSI pilot utilities included two example ICS structures in their response procedure that were specific
to a contamination incident. These examples were not prescriptive, but served to inform the response personnel
how the ICS structure might look during an incident. They also helped personnel visualize how their normal role
at the utility might fit into the ICS structure during an emergency. Selecting the thumbnail images below will
enlarge two example ICS structures similar to those developed by the pilots.
Example ICS structure for a small-scale incident: This structure reflects an internal utility
command structure that does not require the full activation of all sections of the ICS. The pilot
utilities all found that a fusion of their normal command structure with the standard ICS structure
worked best for smaller incidents.	Hover over to enlarge
Example ICS structure for a large-scale incident: This structure reflects a more formal and
complete activation of all sections of the ICS. It also incorporates a Unified Command to include
response partners and stakeholders that would be involved in larger-scale incidents.
Hover over to enlarge
4.2 Response Partners
An effective response to a contamination incident will likely require support from a variety of utility
personnel and response partners. A DSCRP should identify the roles and responsibilities of all parties
involved in a response. Roles and responsibilities outlined in a DSCRP should provide a utility with a
description of what they are prepared to do and what is expected from local, state, and federal response
partners during the response to a contamination incident. Response to any emergency begins at the local
level and thus would engage local response partners first. State and federal response partners may become
involved depending on the nature of the incident and the resources required for the response. Roles and
responsibilities of response partners will likely be worked out and refined over the course of developing a
DSCRP through meetings, workshops, and exercises. Formalizing the relationships through an agreement
(e.g., memorandum of understanding, memorandum of agreement, mutual aid and assistance agreement)
should be considered to explicitly define expectations.
A DSCRP should include notification and communication
procedures for each response partner that describes how and
under what circumstances each partner should be contacted.
In some cases, response partners may want to be notified only
for their situational awareness while in other cases their active
assistance may be requested. Keeping an up-to-date contact
list in a DSCRP with names and contact details will ensure
notifications and requests for assistance are made to the
appropriate personnel at each agency.
A utility should also identify key stakeholders to include in the planning for a contamination incident.
Key stakeholders are public and private organizations that are not directly involved in the response, but
have influence or are greatly impacted by the incident. For instance, local governments will need to be
apprised of the situation, but play only a minimal role in the response. Likewise, local hospitals and other
critical care facilities need to know how water use restrictions will impact their operations, but would not
have a role in response other than caring for the injured.


Mutual Aid and Assistance
Learn more about establishing
relationships with other local utilities
to obtain help during an emergency,
such as a contamination incident,
through the Water/Wastewater
Agency Response Network (WARN)
program at EPA's Water Utility
Response website.
17

-------
Guidance for Responding to Drinking Water Contamination Incidents
EPA, and other federal agencies, can provide a range of assist/ance during an incident. They can become
involved through a number of avenues and authorities depending on the circumstances. More information
on accessing EPA assistance can be found at EPA's Water Utility Response website.
Table 4-1 provides a general overview of the roles and responsibilities that the utility and response
partners may play in implementing a DSCRP. Note that this is an example only and not a comprehensive
list, since response partner organizations and roles may vary among localities.
Table 4-1. Typical Roles and Responsibilities for Implementing a DSCRP
Partner
Typical Responsibilities
Drinking water utility
incident command
Coordinates and implements overall incident response activities including the
investigation, operational responses, risk communication, and planning for
remediation. Provides appropriate notifications to response partners.
Local health
department
Supports development of public notifications and serves as a conduit to state and
federal health agencies. Serves as a technical resource during the investigation.
Provides information about health risks associated with suspected contaminants.
Local fire departments
Coordinates with the utility if water service in a specific response area should be shut
down. They can notify affected neighborhoods and assist in distribution of alternate
drinking water supply. They may also be able to assist with flushing operations,
provide input regarding fire suppression requirements, and communicate safety
considerations related to use of contaminated water for firefighting.
HazMat
Supports site characterization and sampling activities. Takes responsibility for a
location where contamination occurred or a hazard may exist until a determination is
made regarding the level of the hazard present.
Local law enforcement
Supports investigation activities by controlling access to a suspected contamination
site. May serve as a conduit to state and federal law enforcement and intelligence
agencies. May assist in distribution of an alternate drinking water supply.
Environmental and
public health
laboratories
Provide or coordinate laboratory support for the analysis of water samples during
investigation and remediation efforts. State public health laboratories provide access
to the Centers for Disease Control and Prevention's (CDC's) Laboratory Response
Network.
State drinking water
and wastewater
primacy agencies
Provide resources and technical expertise during investigation, response, and
remediation, and advises the utility regarding regulatory requirements for treating
contaminated water, public notification, environmental concerns about discharged
water and provision/quality of alternate drinking water supplies.
Federal agencies
(EPA, CDC, FBI,
DHS/FEMA)
Provide resources, technical expertise, and support to the utility on investigating and
responding to a contamination incident. May assume Incident Command and take
charge of the activities under certain circumstances, such as intentional contamination.
National Guard
Provides resources and support for a wide range of incident activities. Acts as a "force
multiplier," bringing personnel trained in a formal command structure who can perform
a wide range of tasks (e.g., distributing bottled-water, collecting samples, staffing call
centers, analyzing samples). While a federal agency, the National Guard can be
activated by state governors in response to an emergency without federal involvement.
Local government
Communicates with constituencies regarding the impact of the incident on the
community, actions taken to protect the public, and updates on the progression of
response and recovery efforts.
4.3 Communication Equipment and Methods
A variety of equipment and methods can be used to communicate information about a drinking water
contamination incident with personnel and response partners as well as stakeholders and the public.
Standard equipment and methods are likely already a part of a utility's other response procedures and/or
in a utility's ERP. Planning for communications during emergency response should consider requirements
18

-------
Guidance for Responding to Drinking Water Contamination Incidents
such as coordinating the activities of multiple field teams and communicating directly with response
partners.
Communication equipment and methods can include the following:
•	TV/radio
•	Landline telephones
•	Cell phones
•	Satellite phones
•	Auto-dialer or reverse 911 voice recording systems
•	Hand-held or 800 MHz radios
•	Audiovisual systems (including intercoms and closed-circuit television monitors)
•	Written bulletins or newsletters
•	Email
•	Social media
•	Web portals or file-sharing platforms (e.g., SharePoint sites)
Regardless of the equipment and methods used to disseminate the message, utilities should ensure that the
public and response partners are both receiving and understanding the message, particularly for the public
who may have limited access to the various means of communication or require accessibility
considerations.
4.4 Information Management
Information management is the process of collecting, documenting, and managing the large amount of
information (e.g., indicators of water contamination, characterization findings, analysis results) that may
be generated and used during an incident to support decisions about various response actions. Developing
an effective information management strategy helps to promote and maintain overall awareness and
understanding of an incident within and across jurisdictions and thus contributes to sound communication
principles. As an incident progresses and the number of personnel and response partners involved
increases, a well-planned strategy will ease both conveying information to and collecting information
from all involved parties. Documenting incident information may also help to effectively manage liability
issues, cost recovery, and meeting certain regulatory requirements that may arise as a result of a
contamination incident.
A utility should establish a records management system as part of their DSCRP for maintaining and
organizing both paper records as well as electronic information. The system should include methods for
collecting and sharing information both internal to the utility and externally with response partners.
Information that may be captured in a records management system includes:
•	Information about the incident
•	Results, findings, and outcomes of any investigation and response activities
•	Chronological log of events
•	Written records for all response decisions
•	Chain-of-custody documentation for all laboratory samples
•	Time records for all personnel involved
•	Invoices and resource allocation records
•	Information collected or provided by response partners
Considerations should also be given to other systems that may need to be accessed during the response to
an incident, such as SCADA, LIMS, work order systems, water quality databases, etc.
19

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 5: Training and Exercises
The ability to effectively implement the concepts, guidance, and procedures of a DSCRP requires that the
personnel responsible for responding be trained on the DSCRP and supporting procedures. Exercises
allow utility personnel and response partners to practice these procedures and tasks that fall outside of
their typical job duties, enabling them to meet the challenges associated with a contamination incident. In
addition, effective training and exercise programs are useful for integrating utility response procedures
with those of external partners.
Training and exercises have three main purposes:
•	To regularly review and update all procedures, contact
lists, and other materials in the DSCRP and ERP.
•	To practice carrying out the aspects of the DSCRP with
the multiple parties that may be involved in incident
response.
•	To capture problems in the implementation of
procedures during exercises in order to continually
improve and compensate for changes.
Ultimately, training and exercises allow a utility to learn from its mistakes in a no-fault environment,
thereby recognizing potential opportunities to improve execution of plans and procedures, and to modify
them when necessary. This section provides guidance on how to plan and conduct appropriate exercises
and training for a DSCRP.
5.1 Implementation through Training and
To ensure an effective incident response, training should be
conducted to familiarize utility personnel and response
partners with the DSCRP and their corresponding tasks.
Training should include information concerning how the
DSCRP is organized (e.g., investigation activities, response
activities, planning for remediation), as well as roles and
responsibilities of personnel and response partners.
Additionally, training activities associated with specific
DSCRP activities (e.g., field sampling, site characterization)
should be conducted.
Training should also stress coordination between utility
personnel and external response partners to establish a consistent, shared understanding of roles and
capabilities during investigation of and response to a contamination incident. The roles of all parties
during an incident should be clearly understood, including the process of working together under an ICS.
There are several resources that can be used to assist with training development. Many federal agencies,
including EPA and the Department of Homeland Security (DHS), and state agencies have created
resources for developing training programs for utilities and periodically conduct general training and
large-scale exercises. Local emergency planning committees may also have local training opportunities
that allow water utilities to practice response functions with local emergency partners.
The training strategy recommended for DSCRPs is a suite of core courses in the ICS (see ICS Training
callout box on the next page), augmented by a training program based on the Department of Homeland
Pilot Experience
The WSI pilot utilities found
regular communication, such as
through routine joint training and
exercises, greatly improved their
coordination with response
partners and maintained familiarity
with their DSCRP.

Exercises
Important Tool
EPA has developed an Sf?S Exercise
Development Toolbox to provide
utilities with an interactive program to
aid in designing, developing,
conducting, and evaluating exercises
for contamination scenarios. This
enables utilities and their response
partners to conduct exercises that will
help develop, teach, and improve
their response procedures.

20

-------
Guidance for Responding to Drinking Water Contamination Incidents
Security's Homeland Security Exercise and Evaluation Program (HSEEP). As shown in Figure 5-1, this
program begins with "Discussion-Based" exercises (seminars, workshops, and tabletop exercises) to
introduce and teach new concepts and to assess plans and procedures with contamination scenarios.
Following the discussion-based exercises, "Operations-Based" exercises (drills, functional exercises, and
full-scale exercises) test and evaluate procedures and program effectiveness under more advanced
simulated or real-world "what-if scenarios.
Operations-
Based
<
V.
Discussion-
Based ^

V
DSCRP Tabletop Exercise
Site Characterization Tabletop Exercise
Site Characterization Workshop
FEMA ICS 100 and NIMS 700Training
Supervisor and Upper Management Orientation Seminar
Operations Staff Orientation Seminar
a
LU
cc
LU
U
QC
Z3
o
l/l
LU
QC
a
z
<
>-
X
o
u
z
LO
<
LU
cc
u
Figure 5-1. Types and Examples of Trainings and Exercises of Varying Complexity and Resource
Requirements
Utilities with an existing emergency preparedness training program should incorporate DSCRP-specific
training and exercises. The training program should include internal exercises to maintain the DSCRP and
its supporting procedures, such as site characterization and public notifications, as well as to maintain the
competency of personnel in their respective procedural roles. It is recommended that discussion-based
exercises be conducted annually or after routine updates to the DSCRP. Operations-based exercises
should be conducted on a two- to three-year cycle or after any significant modifications to the DSCRP or
changes in personnel.
21

-------
Guidance for Responding to Drinking Water Contamination Incidents
ICS Training
Introductory ICS training is recommended foraii utility personnel:
® ICS-100 Introduction to the Incident Command System
•	IS-700 NIMS, an Introduction
Additional courses are also recommended for utility personnel who may activate or lead an incident:
•	ICS-200 ICS for Single Resources and Initial Action Incidents
® ICS-300 Intermediate ICS for Expanding Incidents
•	ICS-400 Advanced ICS
•	IS-800 National Response Framework (NRF), an Introduction
Details on the training courses are available at the following locations:
•	FEMA's ICS Resources Center
•	Water utility-specific training videos for ICS-100, ICS-200, IS-700, and IS-800 are available at EPA's
Water Resilience Traininc website
Discussion-Based Exercises
Discussion-based exercises are normally used as a starting point in a progressive building-block approach
leading up to operations-based exercises. They include:
•	Seminars', used to orient participants to, or provide an overview of, authorities, strategies, plans,
policies, procedures, protocols, resources, concepts, and ideas.
•	Workshops: similar to seminars, workshops are typically used to test new ideas, processes, or
procedures; train groups in coordinated activities; and build products like a DSCRP. Workshops
often require more participation than seminars, and may use breakout sessions to explore parts of
an issue with smaller groups.
•	Tabletop Exercises: used to assess plans, policies, and procedures or to assess types of systems
needed to guide the prevention of response to, or recover}' from a defined/simulated incident.
Tabletop exercises are typically aimed at facilitating an understanding of concepts/plans,
identifying strengths and areas for improvement, and/or achieving changes in perception.
Discussion-based exercises are appropriate tools to develop procedures and to familiarize utility personnel
and response partners with their roles and responsibilities in implementing these procedures. Table 5-1
provides an example of discussion-based exercises that can be conducted to support implementation of a
DSCRP. They can be used and modified to train utility personnel and external response partners.
Table 5-1. Examples of Discussion-based Exercises to Support Implementation of a DSCRP
Title
Exercise Type
Description
DHS FEMA/NIMS IS-
100 and IS-700
Seminar
Introduces ICS procedures and NIMS for utility personnel.
DSCRP Development
Workshop
Workshop
Discusses development of the DSCRP including
confidence/impact assessments, phase decision trees, and
response partner involvement. This may include both utilities and
response partner personnel.
DSCRP Orientation
Training
Seminar
Provides training to utility personnel on roles/responsibilities as
outlined in the DSCRP.
DSCRP Tabletop
Exercise
Tabletop Exercise
Presents contamination scenarios to utility and response partner
personnel, allowing them to discuss procedures in the DSCRP
during a simulated incident.
22

-------
Guidance for Responding to Drinking Water Contamination Incidents
Title
Exercise Type
Description
Site Characterization
Workshop and
Tabletop Exercise
Uses contamination scenarios to demonstrate the procedures
that guide the development of an SC&SP. This training is
intended for the incident command / management personnel that
would be responsible for planning site characterization activities
in response to a specific incident. Response partners that would
be involved in these activities (e.g., HazMat) may also be
included.
Operations-Based Exercises
Once the DSCRP has been drafted and personnel are trained and prepared, the overall DSCRP should be
tested to identify necessary corrections and opportunities for improvement. This evaluation can be done
through implementation of operations-based exercises.
Operations-based exercises are characterized by actual mobilization of personnel and resources, and
usually held over longer periods of time, from several hours to a couple of days. Operations-based
exercises can be used to validate plans, procedures, policies, and agreements; clarify roles and
responsibilities; and identify resource gaps. They include:
•	Drills: used to test a single specific operation or function in a response plan through a
coordinated/supervised activity (e.g., practice using equipment, develop/test new policies or
procedures, practice and maintain current skills).
•	Functional Exercises: a single or multi-agency activity designed to evaluate capabilities and
multiple functions using a simulated response. Functional exercises are typically focused on
exercising and evaluating plans, policies, and procedures. They often engage personnel involved
in management, direction, command, and control functions. They are conducted in a realistic,
real-time environment; however, movement of personnel and equipment is usually simulated.
•	Full-Scale Exercises: a multi-agency, multi-jurisdictional activity involving actual deployment of
resources in a coordinated response as if a real incident had occurred. This facilitates the
evaluation of field procedures concurrently with the management processes that guide
implementation of the DSCRP. A full-scale exercise is typically used to assess plans, procedures,
and coordinated responses under crisis conditions.
These exercises often follow discussion-based exercises, which provide basic training on procedures.
Overall, operations-based exercises are more complex and detailed than discussion-based exercises and
require more time to coordinate, assemble, and conduct. Table 5-2 provides an example of operations-
based exercises that can be conducted for a DSCRP.
Table 5-2. Examples of Operations-based Exercises to Support Implementation of a DSCRP
Title
Exercise Type
Description
Site Characterization
and Sampling
Drill
Tests and practices implementation of site characterization and
triggered sampling procedures/equipment for field response
personnel.
Laboratory Analysis
Drill
Tests and practices the collection, transport, and analysis of
samples and reporting of results for field and laboratory
personnel.
Public Notification
Drill
Practices the procedures for assessing when a public notification
is necessary, coordinating with primacy/public health agencies,
and creating/issuing notifications.
Utility Functional
Exercise
Functional
Exercise
Exercises roles for utility personnel and/or response partners,
tests all of the procedures in a simulated environment (no
personnel or equipment movement), and identifies improvements.
23

-------
Guidance for Responding to Drinking Water Contamination Incidents
Title
Exercise Type
Description
Utility and Response
Partner Full-Scale
Exercise
Full-Scale
Exercise
Exercises roles for utility personnel and response partners in a
field environment (full deployment and mobilization of personnel
and equipment), tests the full implementation of the DSCRP
involving the majority of the DSCRP procedures, and identifies
improvements.
As noted in Tables 5-1 and 5-2, several exercise types (Tabletop, Functional, and Full-Scale Exercises)
involve the identification of improvements to be made to the DSCRP and/or other plans. Improving
response plans is a significant outcome of exercises and is necessary to ensure that the DSCRP remains
relevant and useful overtime. Following an exercise, recommended improvements are typically captured
in an After-Action Report/Improvement Plan (AAR/IP). FEMA, as part of its HSEEP resources, offers an
AAR/IP template.
24

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 6: Developing a Response Procedure
A DSCRP is an actionable document that guides utility actions during a contamination incident. A step-
wise process for developing a DSCRP (summarized in Figure 6-1) is detailed in a companion document
to this guidance: Planning for Contamination Primer. This guide provides a short set of instructions and
supporting worksheets to help utilities complete a DSCRP for their
ERP using the DSCRP template. The template can be opened in
Word by clicking the icon in the callout box.
STEP 1:	STEP 2:	STEP 3:	STEP 4:	STEP 5:	STEP 6:	STEP 7:
Assess Current	Integrate Existing Interview Response Create an Initial	Engage Response	Complete a	Implement
Preparedness	Capabilities	Partners	Draft	Partners	Final Draft	and Maintain
Figure 6-1. Steps for Developing a DSCRP
The DSCRP should continue to be updated and maintained once it is complete. Certain sections, such as
the contact list, may need to be updated yearly, or more often, as personnel, response partners, and utility
capabilities change. The remaining sections should be reviewed periodically after the utility conducts
training and exercises, after an actual incident occurs, or alongside reviews of the ERP and other
emergency response procedures. In particular, the AAR/IPs from exercises and actual incidents provide
important lessons-learned from real experiences for improving the DSCRP. It may be helpful to create a
schedule for performing updates and assign the task to a specific person at the utility, rather than using an
"as needed" updating approach. The schedule adds accountability to the task and ensures it is not
forgotten.
|w|
This template can be
used to develop a
DCSRP.
25

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 7: Resources
Water Quality Surveillance and Response System Primer
This document provides an overview of Water Quality Surveillance and Response Systems
(SRSs) for drinking water distribution systems. It defines the components of an SRS, describes
common design goals and performance objectives for an SRS, and provides an overview of the
approach for implementing an SRS. EPA 817-B-15-002, May 2015.
http: //www. epa.gov/sites/production/file s/2015 -
06/documents/water quality sureveillance and response svstem primer.pdf
Water Utility Response Website
EPA provides several resources for preparing for and responding to emergencies tailored
specifically for water utilities, including information on Emergency Response Plan development,
joining a Water/Wastewater Assistance Response Network, and accessing federal resources
during an emergency.
https://www.epa.gov/waterutilitvresponse
Guidance for Building Field Capabilities to Respond to Drinking Water Contamination
Provides guidance for drinking water utilities to plan for and implement field activities that
support sampling and analysis in response to drinking water contamination emergencies. EPA
817-R-16-001, January 2017.
https://www.epa. gov/sites/production/files/2017-
01/documents/field capabilities guidance ianuarv2017.pdf
Guidance for Building Laboratory Capabilities to Respond to Drinking Water Contamination
Provides guidance to assist drinking water utilities with building laboratory capabilities for
responding to water contamination incidents. It presents contaminants of concern; lists analytical
methods for those contaminants; and provides information on the role of national laboratory
networks in responding to drinking water contamination incidents. EPA 817-R-13-001, March
2013.
https://www.epa. gov/sites/production/files/2015-
06/documents/guidance for building laboratory capabilities to respond to drinking water co
ntamination .pdf
Developing Risk Communication Plans for Drinking Water Contamination Incidents
Provides guidance on developing an effective Risk Communication Plan to guide
communications with response partners and the public during drinking water contamination
incidents. EPA 817-F-13-003, April 2013.
https://www.epa. gov/sites/production/files/2015-
07/documents/developing risk communication plans for drinking water contamination incide
nts.pdf
Federal Emergency Management's (FEMA's) Emergency Management Institute (EMI)
The EMI supports the Department of Homeland Security and FEMA's goals by improving the
competencies of the U.S. officials in Emergency Management at all levels of government to
prepare for, protect against, respond to, recover from, and mitigate the potential effects of all
types of disasters and emergencies on the American people. The EMI provides a number of
training resources, including online courses, on emergency management topics, such as the ICS.
https://training.fema. gov/emi .aspx
26

-------
Guidance for Responding to Drinking Water Contamination Incidents
FEMA's Incident Command System (ICS) Resources Center
The ICS Resources Center provides materials related to the implementation of the ICS. ICS is a
management system designed to enable effective and efficient domestic incident management by
integrating a combination of facilities, equipment, personnel, procedures, and communications
operating within a common organizational structure.
https://training.fema.gov/emiweb/is/icsresource/
SRS Exercise Development Toolbox
The Exercise Development Toolbox helps drinking water utilities to design and conduct exercises
to evaluate procedures developed to support a SRS. These exercises can be used to refine SRS
procedures and train personnel in the proper implementation of those procedures. The toolbox
guides users through the process of learning about training programs, developing realistic
contamination scenarios, designing SRS discussion-based and operations-based exercises, and
creating exercise documents. February 2016.
https://www.epa.gov/waterqualitvsurveillance/water-qualitv-surveillance-and-response-svstem-
exercise-development-toolbox
Department of Homeland Security's Homeland Security Exercise and Evaluation Program
Provides a set of guiding principles for exercise programs, as well as a common approach to
exercise program management, design and development, conduct, evaluation, and improvement
planning. This exercise and evaluation doctrine is flexible, adaptable, and is for use by
stakeholders across the whole community and is applicable for exercises across all mission areas
- prevention, protection, mitigation, response, and recovery.
https://www.fema.gov/hseep
https://preptoolkit.fema.gov/web/hseep-resources
Water Resilience Training Website
EPA has recorded a series of training webinars for water and wastewater utilities on ICS
including ICS-100, ICS-200, IS-700, and IS-800.
https://www.epa.gov/waterresiliencetraining/emergencv-management-training-water-and-
wastewater-utilitie s
Planning for Contamination Primer
Provides a set of instructions and supporting worksheets to help drinking water utilities complete
a Distribution System Contamination Response Procedure for their Emergency Response Plan
that guides utility actions during a contamination incident. EPA 817-B-18-006, October 2018
https://www.epa.gov/waterqualitvsurveillance/water-contamination-response-resources
27

-------
Guidance for Responding to Drinking Water Contamination Incidents
Section 8: References
EPA, 2015. Summary of Implementation Approaches and Lessons Learned from the Water Security
Initiative Contamination Warning System Pilots, 817-R-15-002. Washington, D.C.
EPA, 2005. WaterSentinel System Architecture, Draft for Science Advisory Board Review. EPA 817-D-
05-003, Washington D.C.
EPA, 2003. Response Protocol Toolbox: Planning for and Responding to Drinking Water Contamination
Threats and Incidents. Contamination Threat Management Guide - Module 2, EPA-817-D-03-
002. Washington, D.C.
EPA, 2010. Revised Public Notification Handbook, 816-R-09-013. Washington, D.C.
Public Notification of Drinking Water Violations, 2012. 40 CFR 141, Subpart Q §§ 141.201-141.211.
28

-------
Guidance for Responding to Drinking Water Contamination Incidents
Glossary
baseline. Values for a datastream that include the variability observed during typical system conditions.
characterization for remediation. The process of collecting information to determine the extent and fate
of contamination in the distribution system and identify the source of contamination. The results of
characterization are used in a risk assessment to establish clearance goals.
clearance. The process of verifying that clearance goals have been met and approving the return to
normal use of the drinking water supply by the public. Following clearance, long-term monitoring may be
conducted to verify that the contaminant concentrations remain below the clearance goal.
clearance goals. The target concentration of the contaminant(s) in drinking water that is considered
acceptable for normal water usage.
confidence. Descriptive terms or numbers that a utility uses to describe how confident they are that a
water contamination incident has occurred. The terms or numbers have predefined meaning to the utility
personnel and response partners that will be responding to the incident.
confirmed. Contamination is considered confirmed when the analysis of all available information
provides definitive, or nearly definitive, evidence of the presence of a specific contaminant or
contaminant class in a distribution system. While positive results from laboratory analysis of a sample
collected from a distribution system can be a basis for confirming contamination, a preponderance of
evidence, without the benefit of laboratory results, can lead to this same determination. Confirmed
contamination is the highest/third confidence level presented in the Response Protocol Toolbox (EPA,
2003).
consequence. An adverse public health or economic impact resulting from a contamination incident.
contamination incident. The presence of a contaminant (microorganism, chemical, waste, or sewage) in
a drinking water distribution system that has the potential to cause harm to a utility or the community
served by the utility. Contamination incidents may have natural (e.g., toxins produced by a source water
algal bloom), accidental (e.g., chemicals introduced through an accidental cross-connection), or
intentional (e.g., purposeful injection of a contaminant at a fire hydrant) causes.
credible. Contamination is considered credible if information collected during the investigation of
possible contamination corroborates a validated indicator of contamination. Credible contamination is the
middle/second confidence level presented in the Response Protocol Toolbox (EPA, 2003).
decontamination. The process of removing the contaminated water from the distribution system, treating
the contaminated water and infrastructure as necessary, and properly disposing of any waste residuals that
are generated.
Distribution System Contamination Response Procedure (DSCRP). A planned decision-making
framework that establishes roles and responsibilities and guides the investigative and response actions
following a determination that distribution system contamination is possible.
29

-------
Guidance for Responding to Drinking Water Contamination Incidents
distribution system model. A mathematical representation of a drinking water distribution system,
including pipes, junctions, valves, pumps, tanks, reservoirs, and other appurtenances. These models
predict flow and pressure of water through the system, and, in some cases, water quality.
Emergency Response Plan (ERP). A documented plan that describes the actions a drinking water utility
would take in response to a variety of emergencies such as contamination incidents, natural disasters, or
acts of terrorism.
Finance/Administration Section. The Section responsible for all incident costs and financial
considerations.
Hazardous Materials unit (HazMat). A specially trained unit of professionals with responsibility for
responding to uncontrolled releases of hazardous materials. In situations where the presence of hazardous
materials is suspected or discovered, HazMat supports implementation of site characterization activities.
impact. Descriptive terms or numbers that a utility uses to describe the potential consequences of a water
contamination incident to public health and the distribution system. The terms or numbers have
predefined meaning to the utility personnel and response partners that will be responding to the incident.
Incident Command System (ICS). A standardized, all-hazards emergency operations structure that is
flexible and can be used for incidents of any type, scope, and complexity. ICS is a part of the National
Incident Management System.
Incident Commander (IC). A person responsible for directing and/or controlling resources by virtue of
explicit legal, agency, or delegated authority.
indicator of water contamination. Anything that could suggest the presence of contamination in the
drinking water (e.g., deviation in monitoring results, report of physical tampering, customer water quality
complaint). It is considered validated after ruling out other, non-contamination causes, such as equipment
malfunctions, procedural errors, or normal background variability. If the indicator is valid, water
contamination is a possibility and the and Investigation and Response activities begin.
information management. The processes involved in the collection, storage, access, and visualization of
information. In the context of a contamination incident, information includes anything that may be
generated or collected during an incident (e.g., investigation results, documentation of decisions, etc.) as
well as information relevant to the incident collected prior to the start of the incident (e.g., utility
operational information, baseline, etc.).
Investigation and Response Phase. The investigation of a validated indicator of water contamination to
determine if contamination has occurred, and the implementation of responses to protect public health and
limit economic impacts. This phase is a cyclical process of evaluating information, planning the
investigation and response activities, and implementing the plans to gather new information and limit the
impact on the system/customers. The phase ends if contamination is ruled-out or if contamination is
confirmed.
Logistics Section. The Section responsible for providing facilities, services, and materials for the
incident.
monitoring. The process of collecting and analyzing a datastream over time.
30

-------
Guidance for Responding to Drinking Water Contamination Incidents
National Incident Management System (NIMS). A system that provides a consistent nationwide
framework and approach to enable all government, private-sector, and nongovernmental organizations to
work together during domestic incidents. NIMS works within the National Response Framework (NRF),
which serves as a guide to national response to all types of disasters and emergencies that range from the
serious but purely local to large-scale terrorist attacks or catastrophic natural disasters. NIMS provides the
template for the management of incidents, while the NRF provides the structure and mechanisms for
national-level policy for incident management.
Operations Section. The Section responsible for all tactical operations at the incident.
operational response. A change in the way a distribution system is operated (e.g., changes in pumping,
storage facility operations, or valve configuration) in order to limit the spread of contamination and
prevent or reduce the impact on the system and on customers.
possible. Contamination is considered possible if an indicator of contamination is investigated and
contamination cannot be ruled out. Possible contamination is the lowest/first confidence level presented in
the Response Protocol Toolbox (EPA, 2003).
Planning Section. Responsible for the collection, evaluation, and dissemination of information related to
the incident, and for the preparation and documentation of the Incident Action Plan.
primacy agency. The organization responsible for overseeing drinking water utility compliance with
drinking water regulations. In most cases the primacy agency is a state agency such as a state department
of environmental protection, environmental quality, or public health, but in some circumstances EPA
serves as the primacy agency.
public notification. Official communication to utility customers regarding the quality and safety of their
drinking water. A public notification may include instructions to customers, such as to not use the water
for any purpose, not use the water for drinking, or boil the water before use.
rapid field testing. Testing performed in the field to identify specific contaminants or contaminant
classes in water and to help determine if additional personal protective equipment or safety precautions
are necessary and to focus the investigation.
Remediation Action Plan (RAP). A plan developed to guide the process of treating and decontaminating
the drinking water distribution system after contamination has been confirmed and fully characterized.
The plan specifies the details for performing the decontamination, including the objectives, methods,
schedule, personnel involved, health and safety information, and required approvals.
Remediation and Recovery Phase. The characterization of the contamination to determine its source,
extent, and fate in the distribution system; the planning and implementation of treatment and
decontamination of the contaminated water and infrastructure; and the clearance of the distribution
system to return to normal operation. This phase follows the Investigation and Response Phase, beginning
once contamination has been confirmed by the investigation.
response activity. An action taken by a utility, public health agency, or another response partner to
minimize the consequences of an undesirable water quality incident. Response actions may include
issuing a public notification, changing system operations, flushing the system, or others.
31

-------
Guidance for Responding to Drinking Water Contamination Incidents
response partners. A subset of external partners that assist a water utility during emergency response
activities such as site characterization, laboratory analysis, public notification, and provision of alternate
water supply.
risk communication. The communication of issues and information, both internally and externally to a
utility, concerning the impact and outcome of an incident, including public information releases.
Risk Communication Plan (RCP). A plan developed by a utility to guide communications with the
public and coordination with response partners and the media during an emergency.
sample collection for laboratory analysis. The collection of water samples for laboratory analysis from
taps, dedicated sampling stations, fire hydrants, and storage tanks in the distribution system by field
personnel to support the determination of whether drinking water contamination has occurred.
site characterization. The process of collecting information from the site of a suspected contamination
incident. Site characterization activities include the visual site hazard assessment, site safety screening,
rapid field testing, sample collection, and sample packaging and shipping.
Site Characterization and Sampling Plan (SC&SP). An incident-specific set of instructions prepared
by utility management to guide field response activities. The SC&SP specifies the location of the
investigation site or sampling location; field tests to be performed; and the types of samples to collect for
laboratory analysis. If multiple locations will be investigated, a separate site-specific
SC&SP is required for each location.
site safety screening. The process of screening for environmental hazards at the site of a field
investigation to help ensure worker safety. Typical site safety screening includes instrumentation for
monitoring volatile or combustible gases and radiation.
source water. Water from natural resources that is generally treated in order to produce drinking water
for a community. Source water is usually classified as either groundwater (drawn from aquifers) or
surface water (drawn from rivers, streams, lakes, ponds, etc.). Prior to being removed for the purpose of
drinking water production, surface water may have other uses such as recreation (e.g., boating,
swimming, fishing), aquaculture, and transportation route, etc.
Supervisory Control and Data Acquisition (SCADA). A system that collects data from various sensors
at a drinking water treatment plant and locations in a distribution system, and sends this data to a central
information management system.
Technical Specialist. An ICS unit under the Planning Section that is unique to a contamination incident.
The unit is comprised of utility and response partner personnel with specialized knowledge, such as
laboratory capabilities or distribution operations, that can aid the Incident Commander in planning and
coordinating the various investigation, response, and remediation activities.
Unified Command. An application of the Incident Command System used when there is more than one
agency with incident jurisdiction. Agencies work together through the designated members of the Unified
Command. Often the senior person from agencies participates in the Unified Command, to establish a
common set of objectives and strategies and a single Incident Action Plan.
use restriction. A notification issued during a water contamination incident to inform the public and
customers that the water may be contaminated, an investigation is underway, and that use of the water
32

-------
Guidance for Responding to Drinking Water Contamination Incidents
should be restricted in some manner. A use restriction provides instructions/restrictions for the use of the
drinking water supply (i.e., "do not use," "do not drink," or "boil water").
validated indicator. An indicator of water contamination is considered validated after ruling out other,
non-contamination causes, such as those caused by equipment malfunctions, procedural errors, or normal
background variability. If the indicator is valid, water contamination is a possibility and Investigation and
Response activities begin.
visual site hazard assessment. Visual inspection of an investigation site or sampling location for
immediate hazards and indicators of suspicious or criminal activity. Information from a visual site hazard
assessment is used to make an initial determination of site safety and to determine if an emergency
response partner (law enforcement, HazMat) is needed.
water quality parameter testing. Measurement of water quality parameters using instruments in the
field or in the laboratory. Examples include disinfectant residual, pH, and temperature.
Water Quality Surveillance and Response System (SRS). A system that employs one or more
surveillance components to monitor and manage source water and distribution system water quality in
real time. An SRS utilizes a variety of data analysis techniques to detect water quality anomalies and
generate alerts. Procedures guide the investigation of alerts and the response to validated water quality
incidents that might impact operations, public health, or utility infrastructure.
Water Security Initiative (WSI). A program developed by EPA to design, evaluate, and promote
adoption of Water Quality Surveillance and Response Systems within the drinking water sector.
33

-------