Roadmap to a Secure and Resilient Water and Wastewater Sector DEVELOPED BY: Water and Wastewater Sector Strategic Roadmap Work Group January 2024 EPA 810-R-24-002 ------- Table of Contents Acknowledgments 1 Introduction 2 How the Roadmap is Used 3 2024 Updates 3 Water and Wastewater Sector Partnerships 3 Threats Addressed 4 Supply Chain Risk Management 4 Extreme Weather and Natural Disasters 4 Physical and Workforce Security 4 Contamination Incidents 5 Infrastructure Degradation 5 Cybersecurity and Cyber Risk Management 5 2024 Priority Activity Areas 6 Emerging Priority Activity Areas 9 Continuing Priority Activity Areas 12 Appendix A: Roadmap Update Process 18 Appendix B: Acronyms 19 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Acknowledgments As directed by the Water Sector Coordinating Council and the Government Coordinating Council, the Water and Wastewater Sector Strategic Roadmap Work Group updated the May 2017 Roadmap to a Secure and Resilient Water and Wastewater Sector to reflect sector progress and changes in conditions since 2017. The Work Group members listed below devoted a significant amount of time, energy, and effort to the creation of the 2024 Roadmap. Roadmap Work Group Membership Carol Adams, Allegheny County Sanitary Authority John DeGour, U.S. Environmental Protection Agency, Work Group Co-Chair Anthony DeRosa, Association of State Drinking Water Administrators Cynthia Lane, Platte Canyon Water and Sanitation District, Work Group Co-Chair Dusti Lowndes, DC Water Latisha Mapp, U.S. Environmental Protection Agency Lisa McFadden, Water Environment Federation Kevin Morley, American Water Works Association Brian Pickard, U.S. Environmental Protection Agency Nicholas Santillo Jr., American Water John Sullivan, Boston Water and Sewer Commission Jeff Szabo, U.S. Environmental Protection Agency Nushat Thomas, U.S. Environmental Protection Agency David Travers, U.S. Environmental Protection Agency Robert Walters, Davidson Water, Inc. Lauren Wisniewski, Cybersecurity and Infrastructure Security Agency Roadmap to a Secure and Resilient Water and Wastewater Sector 1 ------- Introduction The Water and Wastewater Systems Sector, commonly known as the Water and Wastewater Sector, has engaged in a considerable effort to expand mutual aid and assistance, develop critical Water and Wastewater Sector security standards, enhance local, state, and federal partnerships, address cybersecurity concerns, provide research and studies, and release new risk assessment tools designed to enhance sector preparedness and resilience. The Water and Wastewater Sector has approached these risk reduction and response preparedness activities through a partnership that spans the full range of sector participants, including federal and state governments, individual drinking water and wastewater utilities, and national water associations. These partners assist in improving resilience by identifying joint priorities and engaging in coordinated action. As the understanding of risk and the sector's preparedness and resilience capabilities continue to evolve, the Water and Wastewater Sector partnership must regularly review progress and revise its priorities to reflect the current environment. This 2024 Roadmap to a Secure and Resilient Water and Wastewater Sector updates priority activity areas for the partnership based on a five-year outlook. In 2009, the Water Sector Coordinating Council (WSCC) and Water Government Coordinating Council (WGCC) released the first Roadmap to a Secure and Resilient Water Sector, which identified thejoint priority activity areas needed to improve Water and Wastewater Sector resilience and meet the sector's shared vision: The Water and Wastewater Sector's vision is a secure and resilient drinking water and wastewater infrastructure that provides clean and safe water as an integral part of daily life, ensuring the economic vitality of and public confidence in the Nation's drinking water and wastewater services through a layered defense of effective preparedness and security practices in the sector. The WSCC and WGCC produced updated Roadmaps in 2013 and 2017 that provided a review of major Water and Wastewater Sector accomplishments since the publication of the original Roadmap in 2009 and identified Priority Activity Areas and associated near-term and mid-term actions in support of a more resilient Water and Wastewater Sector. In May of 2023, the WSCC and WGCC chartered the Strategic Roadmap Work Group to undertake an update of the 2017 Roadmap. This 2024 Roadmap reflects the Work Group's efforts to review key threats and vulnerabilities of the Water and Wastewater Sector, identify gaps in Water and Wastewater Sector capabilities relative to the key threats and vulnerabilities, and formulate Priority Activity Areas and associated near-term and mid-term actions to address those gaps. The Roadmap Work Group convened on July 31 and August 1,2023, for a two-day meeting to review progress, identify evolving threat areas and Priority Activity Areas, and formulate necessary actions. This 2024 Roadmap update describes those Priority Activity Areas and related recommended actions. 2 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Purpose The purpose of the Roadmap is to establish a strategic framework that achieves the following: Articulates the priorities of industry and government in the Water and Wastewater Sector to manage and reduce risk. Produces an actionable path forward for the WGCC, WSCC, and security and response partners to improve the security and resilience of the Water and Wastewater Sector over the near- term (within two years) and mid-term (within five years). Guides sector partners in developing new products and services and formulating budgets. Creates a shared understanding of and collectively advocate for sector priorities, while recognizing sector partners'institutional constraints and different accountabilities. Encourages extensive engagement among all key stakeholders to strengthen public-private partnerships and reduce risk throughout the Water and Wastewater Sector. How the Roadmap is Used The Roadmap was developed primarily for the WSCC and WGCC to support collaboration and leverage resources among the sector's partners, as well as ensure that joint activities contribute to a common vision. Water and wastewater utility owners and operators, associations, and government agencies can also use the Roadmap as a reference to support their planning processes. The Priority Activity Areas contain actions that address key gaps in the Water and Wastewater Sector's capabilities relative to key threats to the operation of Water and Wastewater Sector utilities. These actions should ultimately serve to improve the Water and Wastewater Sector's resilience not only to the highest priority threats, but also to any hazard that jeopardizes the environmental and public health mission of the sector. 2024 Updates The 2024 Roadmap was revised using a similar process and format to its predecessors, the 2009,2013, and 2017 Roadmaps. The most notable changes in the 2024 update include the revision of the priority threat areas and the Priority Activity Areas. The 2024 Roadmap maintains the Top Activity Areas from the 2017 Roadmap, while also adding three new activity areas. Water and Wastewater Sector Partnerships The Water and Wastewater Sector coordinates planning and response among a broad scope of partners, including primary actors, such as the WSCC, WGCC, local partners to water and wastewater utilities, along with federal, state, and regional partners that regularly engage in one or more facets of the Water and Wastewater Sector. Other Water and Wastewater Sector partners, such as manufacturers and vendors, also play an important role in the sector. Over the past 15 years, the Water and Wastewater Sector has worked to include and engage all stakeholders. Water & Wastewater Sector Partnership The Water Government Coordinating Council (WGCC) is chaired by the U.S. Environmental Protection Agency (EPA) with the U.S. Department of Homeland Security (DHS) as a vice-chair; it consists of representatives from federal, regional, state, local, and tribal government programs. The Water Sector Coordinating Council (WSCC) members include municipal and investor-owned water and wastewater utilities, associations, and regional organizations. Together, these coordinating councils form the public-private Water and Wastewater Sector partnership through which security partners collaborate to plan and implement programs aimed at achieving a common vision. Roadmap to a Secure and Resilient Water and Wastewater Sector 3 ------- Threats Addressed The 2024 Roadmap Work Group identified six categories of threats: Supply Chain Risk Management Extreme Weather and Natural Disasters Physical and Workforce Security Contamination Incidents Infrastructure Degradation Cybersecurity and Cyber Risk Management These six threat categories together drive consideration of Priority Activity Areas for the Water and Wastewater Sector over the next two to five years. Supply Chain Risk Management The supply chain crisis became prominent during the COVID-19 pandemic due to a combination of factors, including labor shortages, shipping issues, and changes in supply and demand. Geopolitical factors continue to put pressure on supply chains, including those serving the Water and Wastewater Sector. Building awareness of the worldwide issues creating market conditions that impact treatment chemicals and equipment manufacturing is critically important in anticipating potential supply chain disruptions. Extreme Weather and Natural Disasters Both acute and chronic extreme weather events and natural disasters are identified as a significant risk in this Roadmap. The focus remains on "acute" events such as floods, hurricanes, and earthquakes and is expanded to include "chronic" hazards such as drought and sea level rise. This approach reflects the Work Group's interest in building long-term strategic considerations into the sector's thinking. The Roadmap stresses the importance of incorporating projections for hydrologic change and extreme weather into risk and resilience planning and pursuing funding opportunities for increasing resilience to these events when they occur. Physical and Workforce Security The Water and Wastewater Sector is vulnerable to an evolving range of security threats and must remain flexible and adaptable to defend against these threats. Developing a security culture involves effective training, exercises, guidance, and commitment from utility leadership and employees. The Work Group expressed the importance of expanding security initiatives to include workforce safety and physical security both within the confines of the utility and in the field. Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Contamination Incidents The Work Group identified contamination incidents as a continuing critical priority threat area. High-profile contamination incidents including Elk River, West Virginia; Corpus Christi, Texas; Toledo, Ohio; Potomac River, National Capital Region (Virginia, Maryland, and Washington, DC); and Philadelphia, Pennsylvania have diminished and challenged public confidence in the safety of drinking water and have highlighted gaps in capabilities in both source water protection/preparedness and the emergency response and recovery framework. Infrastructure Degradation The Work Group identified infrastructure degradation and its implications as a significant risk. The focus of addressing this threat is on the water quality and operational reliability aspects of aging and failing infrastructure, as well as reflecting the effects that economic pressures within a community (e.g., loss of economic base, an aging population) can have on the operational capacity of utilities. The Work Group acknowledges this is an endemic sector problem, not specific to water security considerations. Cybersecurity and Cyber Risk Management Cyber events continue to be identified as a significant risk due to the increasing use of and reliance on technology systems including process control systems, industrial internet, cloud services, and other connected technology. As a result, the sector has experienced a related increase in cyber threats, cyber vulnerabilities, and capabilities of malicious actors. This Roadmap emphasizes the importance of established technology systems while also recognizing that the adoption of new technologies (e.g., Artificial Intelligence (Al)) represents both benefits and increasing challenges to the sector. Roadmap to a Secure and Resilient Water and Wastewater Sector 5 ------- 2024 Priority Activity Areas The Strategic Roadmap Work Group identified seven Priority Activity Areas based on a review of the 2017 Roadmap and related accomplishments, as well as the consideration of recent Water and Wastewater Sector incidents. These Priority Activity Areas: Support the Water and Wastewater Sector's vision and goals as stated in the 2015 Sector-Specific Plan (SSP). Reflect a cohesive, near-term (within two years) and mid-term (within five years) approach to advance the capabilities and resilience of the Water and Wastewater Sector. Identify practical efforts that, if implemented, will meaningfully address the key threat areas. Fall within the capabilities of WSCC and WGCC associations and agencies (e.g., resources, authorities, span of control). In addition to three emerging Priority Activity Areas identified by the Work Group, the four Priority Activity Areas from the 2017 Roadmap remain relevant to the 2024 Roadmap. The Work Group agreed that these Priority Activity Areas must be pursued to enhance the resilience of the Water and Wastewater Sector. Priority Activity Areas are listed in the table below and summarized in the following discussion. A series of tables is then provided that includes more detailed descriptions of each activity, along with the recommended near-term and mid-term actions to improve capabilities in these areas. Priority Activity Areas for the Water and Wastewater Sector Emerging Promote planning and resilience of Water and Wastewater Sector supply chain risk management. Mitigate the effects of hydrologic change and extreme weather. Improve training on physical and workforce security for utility operations. Continuing Establish the critical lifeline status of the Water and Wastewater Sector and translate that definition into strong support for the sector's needs and capabilities. Improve detection of, response to, and recovery from contamination incidents. Advance preparedness and improve capabilities of the Water and Wastewater Sector for area-wide loss of water and power. Advance recognition of vulnerabilities and adopt response measures related to cyber risk management. 6 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Emerging Priority Activity Areas These areas were identified as emerging because they are new to the Roadmap since the 2017 update. The three areas detailed below represent a response to significant incidents that the Water and Wastewater Sector have recently experienced. Promote planning and resilience of Water and Wastewater Sector supply chain risk management. This activity area addresses strategies to recognize, prepare for, and mitigate treatment chemical and equipment supply chain disruptions. Actions in this activity area are intended to promote awareness of supply chain management actions that can be deployed at the utility level. The Work Group discussed the importance of situational awareness and market knowledge of commodities used in the production of treatment chemicals. Planning for supply chain resilience, including identifying alternative treatment chemicals and suppliers, paired with awareness of market conditions better positions utilities to respond to potential supply chain disruptions. In addition to coordination with federal partners, actions for this activity area include evaluating options to improve data availability to support awareness of market conditions. The Work Group also discussed the importance of preparedness for supply chain issues related to critical parts and equipment, including related integrity of technology and cybersecurity risks. Mitigate the effects of hydrologic change and extreme weather. Severe storms, anticipated to become more frequent and intense due to climate change, can lead to greater pollutant runoff and adversely affect the quality of source water. Drought can negatively affect the quality and availability of source water and concentrate existing pollutants. The Work Group discussed incorporating future hydrologic change projections into Water and Wastewater Sector risk and resilience planning. Actions for this activity area include making tools and resources available to utilities, sharing information and success stories, facilitating access to funding opportunities, and promoting the value of building resilience to extreme weather. Improvements in this area will proactively increase the sector's resilience to potential extreme weather events and changing environmental conditions. Improve training on physical and workforce security for utility operations. The Work Group emphasized the importance of fostering a security culture and maintaining awareness of a diverse and dynamic threat environment. Actions in this area are related to expanding the focus of physical security to include new and evolving threats, protection of critical infrastructure, workplace violence, and risk to employees working in the field. Leadership and employee commitment, asset protection guidance, training, and exercises are keys to success in this activity area. Continuing Priority Activity Areas These areas were identified as continuing because they were identified in the 2017 update. The Work Group strongly believes that these areas are important actions to be expanded upon and robustly accomplished. Promote the critical lifeline status of the Water and Wastewater Sector and translate that definition into strong support for the sector's needs and capabilities. The Federal Emergency Management Agency (FEMA) implemented a new'Water Systems' Community Lifeline on August 1,2023, representing significant progress in this activity area. Highlighting the Water and Wastewater Sector as critical to the needs and economic vitality of the broader community resilience and recovery is an important component of this initiative. Actions in this activity area are designed to enhance the Water and Wastewater Sector's ability to develop meaningful partnerships with other emergency response actorsfrom the local to federal levelsas well as attract the needed resources to ensure adequate response and recovery capabilities. The Work Group discussed improvements to site access, the desire to improve the efficiency and efficacy of Emergency Support Functions (ESFs), and the importance of conducting tabletop and other exercises to underscore cross-sector interdependencies. Improvements in this area will increase the sector's resilience relative to natural disasters, contamination incidents, technology failures, and infrastructure degradation. Improve detection, response, and recovery to contamination incidents. This activity area is designed specifically to address the Contamination Incidents threat. Near- and mid-term actions identified for this area include a focus on clarifying and clearly communicating (e.g., through training, quick guides, tools and resources) incident response decision structures, access to information on potential sources of contamination, and research and development related to decontamination procedures, as well as priority and unknown contaminants. Roadmap to a Secure and Resilient Water and Wastewater Sector 7 ------- Advance preparedness and improve capabilities of the Water and Wastewater Sector for area-wide loss of water and power. This activity area seeks to address the Work Group's concerns that extreme events and natural disasters such as severe weather and catastrophic earthquakes, as well as man-made threats such as coordinated cyber and/or physical attacks, can create a wide-scale outage of water and power. Both types of threats may be beyond the scope and scale of conventional response and recovery planning. The Work Group focused actions in this area on establishing an understanding of current capabilities at local, state, and federal levels to respond to an area-wide loss of water and power, integrating area-wide loss of water into planning exercises, and highlighting public preparedness needs. Additionally, the sector should continue to promote examples of successful water and power integration. Advance recognition of vulnerabilities and response needs related to cyber risk management. As the Water and Wastewater Sector increasingly relies on technology in all aspects of its operations, cybersecurity should no longer be considered a single threat area. Cybersecurity should be a consideration in all areas where technology is used. Increasing use of Al in the Water and Wastewater Sector also represents an emerging and evolving threat involving a range of risks. Actions in this area reflect a focus on implementing procedures to support full manual operation at a utility, promoting cybersecurity guides and tools, and developing a more robust cybersecurity culture at utilities of all sizes. The Work Group also acknowledges the unique challenges faced by small and medium utilities in addressing cybersecurity. These utilities in particular do not have specialized staff to implement a robust cybersecurity program. An important action identified by the Work Group includes increasing the capacity of these utilities, particularly in rural and underserved communities, to address increasingly prevalent and sophisticated cyber threats. New actions that benefit utilities of all sizes include promoting objective incident reporting, developing guidance on how to read and use reporting data, and studying the impact of interoperability on the cybersecurity landscape. The Roadmap's Priority Activity Areas share many common challenges to implementation, particularly overcoming limited resources. Resilience projects may be left out of increasingly lean utility budgets. The Work Group emphasized the critical need to enable utilities to more easily identify and access grant funding opportunities to implement Roadmap actions. One new and very important Roadmap priority is engaging with small and medium utilities in rural and underserved communities to assist them in pursuing funding for projects and initiatives that cut across all Priority Activity Areas. Roadmap contributors defined the following roles and responsibilities for implementing each Priority Activity Area: Coordination Lead: The WSCC and WGCC are responsible for providing direction and guidance to keep the activity on track, establishing work groups when needed, and bringing in other organizations and experts to help implement the activity. Principal Partner: Sector associations and government agencies are responsible for initiating and managing activity plans, contributing the necessary financial and technical resources, encouraging active stakeholder participation, collaborating with Coordination Leads to stay on track, and delivering tangible results. 8 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Emerging Priority Activity Areas Priority Activity: Promote planning and resilience of Water and Wastewater Sector supply chain risk management. Opportunity Identify the critical supply chain needs of the Water and Wastewater Sector and establish sector-wide awareness of market conditions that may limit availability of critical treatment chemicals and equipment. Ensure that tools and information are available to utilities to develop supply chain resilience strategies, including early assessment of disruptions and identification of alternative treatment chemicals and suppliers. Exercise authorities of Section 1441 of the Safe Drinking water Act (SDWA) that authorize EPA to issue a certification of need to the Department of Commerce to ensure provision of treatment chemicals to utilities during emergencies. As the Sector Risk Management Agency (SRMA) for the Water and Wastewater Sector, EPA can sponsor a water system request for a priority rating under the Defense Production Act (DPA). While Section 1441 of SDWA is limited to chemicals, the DPA can be used for a wide range of items. Description/Application: The Water and Wastewater Sector depends on reliable supply chains to operate, including the chemical and critical manufacturing sectors. The COVID-19 pandemic caused widespread supply chain disruptions. Geopolitical factors are factoring in continued supply chain issues. Additionally, a wide range of threats such as natural disasters, transportation and logistics problems, and malicious acts (e.g., cyberattacks) can impact the Water and Wastewater Sector's ability to receive critical chemicals and equipment needed to treat water and wastewater. Opportunities and programs are available to enhance supply chain preparedness. Actions within this activity area include the following: Near-Term Actions (within two years): Promote awareness of supply chain management actions that can be deployed at the utility level. Enhance EPA's Water Treatment Chemical Suppliers and Manufacturers Locator Tool by expanding chemicals covered and identifying the chlor-alkali manufacturing locations that serve the merchant market. Evaluate options to improve data availability and collection to support situational awareness of "reasonable availability" under SDWA Section 1441. Develop a playbook for essential water treatment chemicals in coordination with Chemical Sector Coordinating Council, including delivery/order prioritization for essential lifeline sectors. Evaluate options to improve applicability of SDWA Section 1441 under emergency conditions to expedite decision processes. Conduct exercises to assess capacity of public-private collaboration to overcome treatment chemical supply shortages. Challenges to Implementation: Limited knowledge and situational awareness of treatment chemical market conditions and projections. Administrative and technical barriers to the use of alternative treatment chemicals in the event of a shortage. Lack of sector-wide inventory of water treatment chemical usage. Lengthy delays for obtaining parts and equipment (e.g., backup generators). Ensuring integrity of equipment and technology from third- party manufacturers. Timeline of Section 1441 administrative process during emergencies. Most Aligned with SSP goals: Goal 2: Recognize and Reduce Risk Roadmap to a Secure and Resilient Water and Wastewater Sector 9 ------- Priority Activity: Mitigate the effects of hydrologic change and extreme weather. Opportunity Increase Water and Wastewater Sector resilience to extreme weather events by sharing information and case studies, providing technical assistance and risk assessment tools, and facilitating access to grant funding to improve infrastructure. Description/Application: Water utility infrastructure may be vulnerable to more frequent and intense storms and sea level rise. Storms can cause flooding and storm surges that can overwhelm or damage infrastructure and cut power. Sea level rise may worsen storm surges and threaten to inundate infrastructure over time. These changes may also complicate the operational capabilities of water utilities. Extreme events like tornadoes and extreme cold can damage utility infrastructure. Hydrologic changes, such as drought, sea level rise and saltwater intrusion may threaten source water quality and complicate water utility operations. Severe storms, anticipated to become more frequent and intense due to climate change, can lead to greater pollutant runoff and adversely affect the quality of source water. Drought can negatively affect the quality and availability of source water and concentrate existing pollutants. Actions within this activity area include the following: Near-Term (within two years): Incorporate future climate projections into risk and resilience planning. Promote resource sharing networks and local Water/Wastewater Agency Response Networks (WARNs) as opportunities to collaborate when significant events occur. Ensure hydrologic change and extreme weather factors are included in all resources, tools, and communications developed by federal partner agencies for water utilities. Promote available tools/resources, guidance, standards, and best practices from EPA, American Water Works Association (AWWA), the Water Environment Federation (WEF), the Water Research Foundation (WaterRF), and other organizations. Identify opportunities for integration of this activity area with initiatives related to loss of water and power. Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. Mid-Term (within five years) Develop case studies of utility lessons learned from responses to extreme weather events and mitigating and implementing hydrologic change measures (e.g., flooding in California, extreme cold in Texas). Develop messaging for utilities to promote these efforts and provide situational awareness for utility leadership. Develop scenario planning tools for small and medium utilities. Provide updated climate projections and ensure data collection supports long-term forecasting. Challenges to Implementation: Lack of preparedness for and uncertainty related to extreme weather events. Conveying the value of integrating future scenarios into risk assessments. Circumstances beyond the control of the Water and Wastewater Sector create conditions that compound the pressure on utilities (e.g., housing). Reluctance to recognize the impacts of hydrologic change. Most Aligned with SSP goals: Goal 2: Recognize and Reduce Risk Goal 3: Maintain a Resilient Infrastructure Goal 4: Increase Communication, Outreach, and Public Confidence 10 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Priority Activity: Improve training on physical and workforce security for utility and operations. Opportunity Provide the Water and Wastewater Sector with the necessary tools and information to adapt to a rapidly changing physical and workforce security landscape with a range of diverse threats, including threats to utility employees, physical infrastructure, and operations. Leverage lessons learned in workforce security to enhance emergency response planning and training. Challenges to Implementation: Because it has been a priority for many years, enhancing security may be seen as less important than other threats to the Water and Wastewater Sector. Existing funding levels for security initiatives, including training, may not be sufficient. Security may be viewed as a one-dimensional concept related to access control while a diverse and dynamic threat environment exists. Converging the overlap with cybersecurity and physical security. Establishing and maintaining a security culture to ensure that utility employees recognize where security threats exist and the importance of being vigilant. Mitigation of risks outside of a utility's facilities may be out of the utility's control. Most Aligned with SSP goals: Goal 2: Recognize and Reduce Risk Goal 3: Maintain a Resilient Infrastructure Description/Application: The Water and Wastewater Sector faces an increasingly complex security threat environment that has expanded beyond physical security of facilities and infrastructure to include workplace violence, attacks on personnel working in the field, and cyberattacks and other malicious threats. The sector should invest in promoting and revitalizing physical security guidance, training, and exercises to develop and maintain a security culture that emphasizes the need to recognize and deter threats to all aspects of utility operations and to personnel. Actions within this activity area include the following: Near-Term (within two years): Continue to promote and maintain a strong physical security posture through assessments, training, and exercises. Continue to promote information sharing and awareness of existing guidance. Build relationships and promote coordination/information sharing with frontline emergency responders and intelligence communities. Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. Mid-Term (within five years): Update products, plans, training, education, guidance, best practices, resources, and funding to maintain physical security awareness and protective measures. Develop physical security strategies that consider risks to personnel and assets outside of the facility, such as hazard recognition, de-escalation, and active shooter. Understand how to work with first responders to safely conduct necessary field operations during routine and emergency situations. Ensure first responders acknowledge the importance of water operations and coordinate with field staff during emergencies. Assess and evaluate if additional guidance is needed due to technological advancements and emerging threats. Roadmap to a Secure and Resilient Water and Wastewater Sector 11 ------- Continuing Priority Activity Areas Priority Activity: Promote the critical lifeline status of the Water and Wastewater Sector and translate that definition into strong support for the sector's needs and capabilities. Opportunity Promote a clear understanding of the benefits of a secure and resilient Water and Wastewater Sector to local, state, and federal emergency planners, regulators, and water utility customers. This understanding will enable decision makers to make well-informed choices about Water and Wastewater Sector priority needs in resilience and emergency response planning. Water utilities and response agencies can leverage FEMA's Water Systems Community Lifeline to improve the effectiveness of emergency management through increased coordination and engagement. Description/Application: Lifeline sectorsincluding the Water and Wastewater Sectorensure the resilience, safety, prosperity, and rapid recovery of the communities they serve. Defined priorities and ongoing support for resource requests from drinking water and wastewater utilities can help mitigate or avoid public health and environmental impacts during and following emergencies. For example, the WARN's Hurricanes Harvey and Irma After-Action Report recommended that given critical lifeline functions provided for fire protection and public health and safety, community water systems should likewise have top priority status when power supply is at risk. Furthering awareness of the priority status of the Water and Wastewater Sector should include the following actions: Near-Term Actions (within two years): Promote awareness of the Water Systems Community Lifeline to water utilities and encourage water utilities to use this lifeline designation as an opportunity to (re)engage with their local response agencies. Continue to prioritize the restoration of critical support services, such as power, to rapidly recover or sustain continuity of Water and Wastewater Sector services. Improve the efficiency and efficacy of response under the National Response Framework where current practice segments water response needs into multiple ESFs (primarily 3, 4,6, and 8).1 Continue to support and advocate for Water and Wastewater Sector needs at FEMA's National Response Coordination Center during major disasters, as requested by the U.S. Army Corps of Engineers (USACE). Promote established site access protocols, such as the Crisis Event Response and Recovery Access (CERRA) Framework, for critical lifeline services through coordination with FEMA and other emergency response agencies. Continue to develop resources that communicate the benefit of infrastructure investment to overall community economic vitality and resilience. Conduct state and local tabletop and functional exercises or workshops to improve understanding of Water and Wastewater Sector interdependencies with other sectors, impacts of loss of service during a disaster, and use this information to raise awareness of Water and Wastewater Sector criticality. 1 National Infrastructure Advisory Council Water Sector Resilience: Final Report and Recommendations (20161 and Framework for Dealing with Disasters and Related Interdependencies (2009) Challenges to Implementation: The concept of a lifeline sector is not commonly understood among all levels of government, critical infrastructure sectors, and the communities they serve. The failure to include the Water and Wastewater Sector as a key priority increases the risk of cascading consequences during a catastrophic event. Institutional knowledge loss resulting from staff turnover requires an ongoing commitment to education and training to maintain recognition of and responsiveness to Water and Wastewater Sector needs. Most Aligned with SSP goals: Goal 3: Maintain a Resilient Infrastructure Goal 4: Increase Communication, Outreach, and Public Confidence 12 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Seek alignment on public messaging to increase household preparedness in addition to local, state, and federal support for pre-disaster risk reduction and resilience activities. Promote eligibility criteria for various financial assistance programs to support Water and Wastewater Sector preparedness and hazard mitigation. Improve engagement with state, local, tribal, and territorial governments to raise awareness of Water and Wastewater Sector criticality at the state and local levels. Perform after-action analyses for incidents and events that evaluate emergency response effectiveness for the Water and Wastewater Sector. Provide support for state drinking water/wastewater (DW/WW) programs to implement security/emergency planning programs. Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. Priority Activity: Improve detection, response, and recovery to contamination incidents. Opportunity Provide the Water and Wastewater Sector with a clear set of guidelines for establishing protocols with key emergency response partners and enable a more timely, coordinated, and effective approach to detection, response, and recovery actions that hold the potential to substantially reduce the consequences of contamination incidents. Description/Application: Since 2013, the Water and Wastewater Sector has experienced several high-profile contamination events including: Elk River, West Virginia; Corpus Christi, Texas; Toledo, Ohio (Lake Erie); the Potomac River, National Capital Region; and Philadelphia, Pennsylvania (the Delaware River). These events have placed pressure on public confidence in the safety of drinking water and have pointed to weaknesses in decision protocols that support rapid emergency response and recovery. An array of contamination threats to both source and distributed water (e.g., chemical storage tanks, outfalls, cross-connections) and the paucity of accessible information about these threats, present utilities and state partners with a challenge to identify and characterize the specific contamination threats in their areas. Water utilities also have a need for rapid notification of contamination incidents in sufficient time to initiate an effective response. Although research has filled some knowledge gaps, certain deficiencies identified in the 2008 Critical Infrastructure Partnership Advisory Council (CIPAC) report, "Recommendations and Proposed Strategic Plan: Water Sector Decontamination Priorities,"remain unaddressed. Taken together, these pressures point to a compelling need for the Water and Wastewater Sector to revisit current approaches to source and distributed water preparedness/protection and the response/recovery framework, including decontamination, as it applies to both acute and chronic contamination events. Actions that need to be taken include the following: Near-Term (within two years): Continue to conduct exercises and trainings using recent contamination events as case studies and engage stakeholders involved in incident response and recovery (e.g., local, city, state, fed era I). Challenges to Implementation: Recent incidents have challenged public confidence in the safety of drinking water. Weaknesses in decision protocols that support a rapid emergency response and recovery framework. Gaps in knowledge relative to location and type of potential contamination sources, as well as gaps relative to key decontamination needs. Gaps in technological capabilities for detecting specific types of contaminants in real-time (e.g., pathogens or low levels of almost any contaminant). Low likelihood of a contamination incident occurring at any specific utility presents a challenge for building a business case to address the threat. Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Most Aligned with SSP goals: Goal 2: Recognize and Reduce Risk Goal 3: Maintain a Resilient Infrastructure Goal 4: Increase Communication, Outreach, and Public Confidence Continue to evaluate and promote contamination incident response plan templates (Quick Guides) that detail the roles and responsibility of key stakeholderswho makes what decisions. Outline and promote an incident response decision-making structure for multi-jurisdictional events to ensure there is proper planning and partnership relationships and decision protocols established in advance of emergency conditions. Assist state agencies and local communities to improve source water assessments and protection plans by providing information on the nature and quantity of potential contaminant sources (e.g., such as EPA's approach under the Toxic Substances Control Act for considering chemical storage near significant sources of drinking water). Expand electronic data sharing among federal offices and agencies to bring the most current and complete datasets possible to bear on source water assessments and protection plans. Evaluate accessibility of information for including water utilities as a "need to know" stakeholder for Emergency Planning and Community Right-to-Know Act (EPRCA) Tier 2 pipeline and railroad data to facilitate information sharing and data access associated with chemical storage in source water areas. Update Center for Disease Control's (CDC's) Patient Waste Handling Protocol to prevent risk transfer to water utility personnel and operations to align with industry best practices. Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. Mid-Term (within five years) Form an advisory team of state and federal subject matter experts to assist in decision- making. Building on existing resources, develop an advisory team to assist decision- makers regarding public health protection. Continue to conduct research and develop pilot and field-scale testbeds to inform and facilitate decontamination procedures, emergency response, and cross-sector collaboration. Continue to conduct research and development relative response protocols for priority and unknown contaminants (e.g., Ebola, non-traditional agents (NTAs)). Conduct research and development for response to contaminants that have little available data to inform response and return to service (e.g., Charleston, West Virginia scenario). Develop a contaminant treatment technology testing, certification, and verification database for use by states. Consider developing a three-tiered certification system based on basic containerized treatment systems (e.g., pathogen removal, inactivation, select contaminant removal) plus energy requirements, residuals production, costs, and operational requirements.2 2 Planning for an Fmernenrv Drinkinn Water Supply (FPA 600/R-11/054. Iiine 70111 14 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Priority Activity: Advance preparedness and improve capabilities of the Water and Wastewater Sector for area-wide loss of water and power. Opportunity Provide the Water and Wastewater Sector with the building blocks to develop emergency drinking water and wastewater plans to expedite community recovery in the event of an area-wide loss of water and/or power services in which the scope, duration, and/or scale exceed those addressed in conventional response and recovery planning. Challenges to Implementation: The magnitude of such an event surpasses response and recovery infrastructure as it currently exists. The low-probability nature of and potential cost of up- front investments to address such events makes proactive engagement difficult. Most Aligned with SSP goals: Goal 3: Maintain a Resilient Infrastructure Description/Application: Disasters such as Hurricane Katrina, Hurricane Maria, Winter Storm Uri, and earthquakes in Haiti, Chile, Pakistan, and Morocco demonstrate that large-scale disasters can quickly move communities beyond the realm where conventional planning for water and power outage events are adequate. The Water and Wastewater Sector has not sufficiently planned for scenarios in which the scope, duration, and/or scale exceed conventional response and recovery planning (e.g., the need to meet all forms of water and sewer needs over an entire region and over an extended period of time), leaving residents as well as critical services and activities, such as hospitals, fire departments, and industrial production, vulnerable to a complete collapse of water and/or wastewater services. Actions needed to address this Priority Activity Area include the following: WATER: Near-Term (within two years): Identify the gap between projected needs, local capacity, and available state- federal and non-governmental organization (NGO) resources to better plan for post-disaster emergency water supply. Research options for alternate supplies of bulk water production and delivery, including a certification database for containerized treatment units. Aggregate gaps identified at local and state levels to assess existing and supplemental resources for emergency water supply and integrate the substantial and long-term loss of water into planning exercises. Research and develop guidance for pre-approval of alternate water supplies and portable treatment units in terms of certification, operation, monitoring, siting, and water utility system interface. Provide guidance on procurement considerations in local, state, and federal planning exercises. Develop an approved vendor database and prepare contracting strategies to allow vendors to be more responsive to fulfilling rapid mobilization (e.g., multi-year contracts, price premiums). Identify and evaluate bulk sludge transport and disposal options. Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. POWER: Near-Term (within 2 years): Continue to institutionalize prioritization for power restoration for DW/WW assets, including sustaining fuel for generators. Roadmap to a Secure and Resilient Water and Wastewater Sector 15 ------- Assess DW/WW backup power needs and availability. Mid-Term (within five years): Address the policy-regulatory limits under the Federal Clean Air Act that constrain return on investment (ROI) for generators, specifically National Emission Standards for Hazardous Air Pollutants (NESHAP) for Reciprocating Internal Combustion Engines. Explore the efficacy of resource recovery technologies for power generation at wastewater utilities. Priority Activity: Advance recognition of vulnerabilities and needed responses related to cyber risk management. Opportunity Signal and reinforce the need for an understanding of cyber vulnerabilities created by the increased use of technology systems and automated operations. Draw on the development since 2013 of an array of cybersecurity resources and trainings to enhance Water and Wastewater Sector capabilities and better strengthen cybersecurity culture through cybersecurity education and awareness. Overall, increase the potential for better preparedness and resilience of water and wastewater infrastructure during a cyber or other technology- related failure or disruption event. Description/Application: Since 2013, the Water and Wastewater Sector has worked to develop (at times with its cross- sector partners) a range of cybersecurity tools, guides, and other resources to motivate and enable attentiveness to cyber vulnerabilities. The sector has made progress addressing cyber threats. At the same time, cybersecurity education, tools, and resources remain an on-going and evolving need for the sector. Compounding this need is the continued uptake of automation and information technology dependent advancements that, while improving business and operational performance, can impart additional sector vulnerabilities. Maintaining focus on cybersecurity and automated process control dependencies and recognizing the differing impacts of cyberattacks to business and operational systems remain critical aspects of helping the Water and Wastewater Sector withstand a cyberattack or other technology failure. Actions to enhance Water and Wastewater Sector cybersecurity and other technology resilience include the following: Near-Term (within 2 years): Develop resources that communicate the prospective economic and operational risks of cyber-related attacks to support continued cyber investments. Continue to educate regarding the obligations of utility management and boards/ councils to include cybersecurity in overall risk management activities. Continue to identify and promote basic effective practices for responding to technology failures (e.g., manual operation exercises, consequence-driven cyber-informed engineering (CCE)). Continue to enhance practices and resources to strengthen and maintain a culture of cybersecurity among utilities and stakeholder groups. Promote enrollment in vulnerability scanning within the Water and Wastewater Sector. Continue education on cyber reporting, particularly with respect to new requirements under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. Challenges to Implementation: Complex and evolving cyber vulnerabilities are time-and resource-intensive to mitigate. The Water and Wastewater Sector continues to automate all aspects of business and operational functions increasing the risk of technology failures, while "old school" manual operational skills and equipment are fading. The voluntary nature of cybersecurity, competing with other regulated priorities, resulting in minimal or no investment in cybersecurity. It is difficult to keep up with increasingly sophisticated, fast- changing cyber threats. Most Aligned with SSP Goals: Goal 1: Sustain Protection of Public Health and the Environment Goal 2: Recognize and Reduce Risk 16 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Continue to conduct cyber event exercises and training for the Water and Wastewater Sector. Improve the deployment of cybersecurity resources throughout the sector, including addressing the resource challenges faced by small and medium utilities in this activity area. Maintain and expand focus on promoting basic practices and, for higher capacity systems, establish a system to move beyond "minimum practices" for cybersecurity implementation. Develop a culture of maintaining cybersecurity protocols and following emergency frameworks during an incident. Research and evaluate the impact of cyber breaches on operations (e.g., business enterprise systems, treatment operations). Promote manual operationsand installation of manual overrides/equipment to mitigate technology failures or interruptions. Build water sector awareness of Hardware and Software Bill of Materials frameworks to support supply chain risk management. This may inform water utility procurement to support secure-by-design principles for cyber and physical security. Assess the implication of incorporating Al models into operation, especially in areas of higher risk (e.g., chemical dosing). Identify and actively promote the availability of local, state, and federal funding resources for resiliency measures and technical assistance to help water systems access these funds. Roadmap to a Secure and Resilient Water and Wastewater Sector 17 ------- Appendix A: Roadmap Update Process The 2024 Roadmap to a Secure and Resilient Water and Wastewater Sector was developed according to the process shown in theaccompanying figure and described below. Water and Wastewater Sector Strategic Roadmap Work Group Formed In May 2023, the Water Sector Coordinating Council (WSCC) and the Water Government Coordinating Council (WGCC) chartered the Water and Wastewater Sector Strategic Roadmap Work Group. Finalize Charter and Work Plan On July 19,2023, the Work Group held a conference call to review the charter and develop a work plan for updating the 2017 Roadmap to a Secure and Resilient Water and Wastewater Sector. Understand Threats, Vulnerabilities, and Priority Needs Individual interviews were conducted with available Work Group members to assess sector progress, identify threats and vulnerabilities, and understand priority needs. Information from these interviews assisted in guiding discussion at the in-person Work Group meeting. Establish Priority Activity Areas and Related Actions On July 31 and August 1,2023, the Work Group held an in-person meeting to discuss threats and vulnerabilities identified in the individual interviews. At this meeting, the Work Group identified the seven Priority Activity Areas and actions needed to address gaps in capabilities. Refine Implementation Strategy The 2024 Roadmap was drafted and circulated among Work Group members for review and clarification. Prepare, Review, and Publish Roadmap Following initial Work Group review, a final draft of the 2024 Roadmap was submitted to the Work Group Co-Chairs for their final review and acceptance of the document. The comments of all reviewers have been integrated into this final Roadmap document. Water and Wastewater Sector Strategic Roadmap Work Group Formed Finalize Charter and Work Plan Understand Threats, Vulnerabilities, and Priority Options (Assess Progress) Establish Priority Activity Areas and Related Actions Refine Implementation Strategy Prepare, Review, and Publish Roadmap 18 Roadmap to a Secure and Resilient Water and Wastewater Sector ------- Appendix B: Acronyms Al Artificial Intelligence AWWA American Water Works Association CCE Consequence-driven Cyber-informed Engineering CERRA Crisis Event Response and Recovery Access CDC Centers for Disease Control and Prevention CIPAC Critical Infrastructure Partnership Advisory Council CIRCIA Cyber Incident Reporting for Critical Infrastructure Act CISA Cybersecurity and Infrastructure Security Agency DHS U.S. Department of Homeland Security DW/WW Drinking Water/Wastewater EPA U.S. Environmental Protection Agency EPRCA Emergency Planning and Community Right-to-Know Act ERP Emergency Response Plan ESF Emergency Support Function FEMA Federal Emergency Management Agency NESHAP National Emission Standards for Hazardous Air Pollutants NGO Non-Governmental Organization NTA Non-traditional Agent ROI Return on Investment SDWA Safe Drinking Water Act SRMA Sector Risk Management Agency SSP Sector-Specific Plan USACE U.S. Army Corps of Engineers WARN Water/Wastewater Agency Response Network WaterRF Water Research Foundation WEF Water Environment Federation WGCC Water Government Coordinating Council WSCC Water Sector Coordinating Council Roadmap to a Secure and Resilient Water and Wastewater Sector ------- ------- ------- |