oEPA PRIMER FOR TECHNICAL ASSISTANCE PROVIDERS: HELPING COMMUNITY WATER SYSTEMS COMPLY WITH SECTION 2013 OF AMERICA'S WATER INFRASTRUCTURE ACT OF 2018 America's Water Infrastructure Act of 2018 (AWIA) amends the Safe Drinking Water Act (SDWA) and includes new resilience requirements for drinking water utilities. AWIA applies to a subset of community water systems (CWSs), which are drinking water utilities that consistently serve at least 25 people or 15 service connections year-round. AWIA Deadlines Risk and Resilience Assessment March 31, 2020 if serving >100,000 people December 31,2020 if serving 50,000 to 99,999 people June 30, 2021 if serving 3,301 to 49,999 people Every five years, the utility must review and, if necessary, revise the Risk and Resilience Assessment and submit a recertification to the U.S. EPA. The deadline for the recertification is five years from the original statutory deadlines listed above. Emergency Response Plan September 30, 2020 if serving ^.100,00 people June 30, 2021 if serving 50,000 to 99,999 people December 30,2021 if serving 3,301 to 49,999 people Within six months of submitting the recertification for the Risk and Resilience Assessment, the utility must certify it has reviewed and, if necessary revised, its ERR Certification Frequently Asked Questions How will the U.S. EPA determine utility population service size and the certification deadline? ¦ The U.S. EPA will use the CWS population size shown in the Safe Drinking Water Information System (SDWIS) as of the AWIA date of enactment on October 23, 2018. What if a CWS has more than one Public Water System Identification (PWSID) number? ¦ The CWS must certify the completion of its Risk and Resilience Assessment and ERP for every individual PWSID number. Section 2013 of AWIA requires CWSs serving populations more than 3,300 to conduct and certify completion of a Risk and Resilience Assessment and Emergency Response Plan (ERP). to the U.S. Environmental ' '*"*,;*» - f Protection Agency (U.S. EPA). ------- Certifying Process Utilities can begin the initial certification process after completing their Risk and Resilience Assessments. There are three options for certifying: 1, Electronic submission via online portal, which is accessible from the U.S. EPA's AWIA homepage 2, Email certification statement to the U.S. EPA at awiasupport@epacdx.net 3, Mail certification statement to the U.S. EPA at U.S. EPA Data Process Center ATTN: AWIA C/0 CGI Federal 12601 Fair Lakes Circle Fairfax, VA 22033 If you choose to certify via email or regular mail, please use the Risk and Resilience Assessment Certification Statement or ERP Certification Statement fillable PDF provided by the U.S. EPA. The following information is required to complete the document: ¦ Name of the utility ¦ Mailing address » PWSID ¦ Population served ¦ Date of the certification ¦ Name of certifying official Quick Submittal Tips: ¦ The quickest method to certify is to use the secure online portal. The portal is accessible from the U.S. EPA's AWIA homepage. Certifying officials create a login with their PWSID and enter official contact information or the name of their utility. The next step is to read the certification statement and certify completion of the Risk and Resilience Assessment This will be the only certification option where the U.S. EPA will be able to provide an acknowledgement of receipt of the certificatio n statement. ¦ The certification process is the same for the Risk and Resilience Assessment and the ERP. Certifying Official Both Risk and Resilience Assessments and ERPs are self-certified by the utility. There are no specific requirements for the utility certifying official, however, the official must be a utility employee. TOOLS AND RESOURCES Conducting a Risk and Resilience Assessment Developing an Emergency Response Plan ¦ U.S. FPA Baseline Information on Malevolent Acts for ¦ U.S EPA ERP Template and Instructions Community Water Systems . Local Emergency Planning Committees fLEPCs) * U.S. EPA Vulnerability Self-Assessment Tool (VSAI) Web 2.0 Certification Process ¦ U.S. EPA Instructions on How to Certify Your Risk and Resilience Assessment and ERP ¦ Risk and Resilience Assessment Certification Statement ERP Certification Statement Important: ¦ Utilities should NOT submit the Risk and Resilience Assessment itself to the U.S. EPA; only the certification is required. ¦ Utilities should not submit their certification to their state primacy agency in lieu of the U.S. EPA. States are not required to accept or track the utility certifications under AWIA Section 2013. c c t" # M ------- RISK AND RESILIENCE ASSESSMENT Risk and Resilience Assessments allow utilities to identify their vulnerabilities to man-made and natural hazards and evaluate potential improvements to enhance security and resilience. AWIA Section 2013 requires that Risk and Resilience Assessments consider: ¦ Natural hazards and malevolent acts ¦ Monitoring practices ¦ Financial systems (e.g., billing systems) ¦ Chemical storage and handling The assessment may also include an evaluation of capital needs for risk and resilience management of the system. ¦ Operation and maintenance ¦ Resilience of water facility infrastructure and resources \5 and operational TOOLS AND RESOURCES Technical assistance (TA) providers should encourage and facilitate coordination between utilities and local stakeholders, including: • LEPCs ¦ Mutual Aid and Assistance Networks These organizations may be willing to share information concerning local risk assessments. TA providers can direct utilities to available tools to conduct Risk and Resilience Assessments, such as U.S. EPA's VSAT WEB 2.0. VSAT Web 2.0 helps utilities conduct Risk and Resilience Assessments by identifying the highest risks to mission-critical operations and finding the most cost-effective measures to reduce those risks. Risk and Resilience Assessments Frequently Asked Questions What is a malevolent act? ¦ A malevolent act is defined as an intentionally harmful act, such as the use of force, against a utility. The Baseline Information Malevolent Acts for Community Water Systems document can assist utilities in calculating the likelihood of malevolent acts. How are the 2002 mandated vulnerability assessments and the newly required Risk and Resilience Assessments different? ¦ The earlier vulnerability assessments were required by Title IV of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act). The Bioterrorism Act added Section 1433 to the SDWA and required utilities serving more than 3,300 people to conduct and submit to the U.S. EPA a vulnerability assessment. This one-time requirement only considered threats associated with terrorist and other intentional acts. The AWIA Section 2013 Risk and Resilience Assessments must be reviewed and updated every five years and consider additional hazards. AWIA does not require utilities submit their assessments to the U.S. EPA, but instead only requires that utilities certify completion. Can a utility use an existing Risk and Resilience Assessment to comply with the AWIA requirement? ¦ Yes, provided that the previous Risk and Resilience Assessment satisfies all requirements outlined by AWIA. ------- EMERGENCY RESPONSE PLAN Utilities should be prepared for several types of emergencies, including natural hazards and manmade (such as cyber attacks) threats. Utilities should develop their ERPs based on the vulnerabilities identified in their Risk and Resilience Assessments, Required core elements of an ERP include: ¦ Strategies and resources to improve resilience, including physical security and cybersecurity ¦ Plans and procedures for responding to a malevolent act or natural hazard that threatens safe drinking water TOOLS AND RESOURCES ¦ Actions, procedures and equipment to lessen the impact of a malevolent act or natural hazard, including alternative water sources, relocating intakes and flood protection barriers ¦ Strategies to detect malevolent acts or natural hazards that threaten the system TA providers can use resources from the local, state and federal level to guide water utilities in updating or developing an ERP. Utilities must work, to the extent possible, with their LEPCs when creating their ERP. TA providers can assist utilities in contacting their LEPCs. The U.S. EPA ERP Template and Instructions can help utilities develop their ERP. Utilities must meet the ERP requirements specified in AWIA to certify completion. TA providers should also recommend utilities check with their primacy agency regarding any additional requirements mandated by the state. AWIA does not supersede state law. Emergency Response Plans Frequently Asked Questions What are the benefits of working with the LEPC? ¦ Under the Emergency Planning and Community Right-to-Know Act (EPCRA), LEPCs must develop an ERP and review it annually. The information contained in these plans may be beneficial to water utilities. In addition, water utilities can participate in training exercises led by their LEPCs. How are the 2002 mandated ERPs and the newly required ERPs different? ¦ Like the vulnerability assessment, the Bioterrorism Act required utilities to develop a one-time ERP. AWIA requires that ERPs be reviewed and recertified every five years. Utilities must also consider additional factors including resilience strategies, emergency plans and procedures, mitigation actions and detection strategies under AWIA. Can a utility use an existing ERP to comply with the AWIA requirement? ¦ Yes, however, utilities must ensure that the ERP addresses all criteria outlined in AWIA Section 2013. Additionally, utilities must ensure that the plan incorporates the findings from the Risk and Resilience Assessment required under AWIA. Do utilities have to use U.S. EPA guidance to meet the ERP certification requirements under AWIA? ¦ No. Utilities are not required to follow any specific standards, methods or tools to prepare their ERP. However, they must ensure their plan meets all the AWIA criteria. Still have questions about the new AWIA requirements? Contact the U.S. EPA at dwresilience@eDa.gov. Office of Water (4608T) EPA 821-F-19-003 September 2019 ------- |