v>EPA iinhfdSMH Erwonmant*! Protection A .. April 2020 Section 2013 of America's Water Infrastructure Act Frequently Asked Questions This document compiles frequently asked questions (FAQs) about the requirements of America's Water Infrastructure Act (AWIA) Section 2013 and is intended to complement the existing information on the EPA '.v A WIA Section 2013 webyase. On October 23, 2018, America's Water Infrastructure Act was signed into law. This law requires community water systems (CWS) serving more than 3,300 people to conduct risk and resilience assessments, prepare or revise emergency response plans (ERPs), and certify to the Environmental Protection Agency (EPA or Agency) that this work has been completed. A CWSs' risk and resilience assessment (R&RA) certification statement is due to the EPA on specified dates based on population served, see the gi'aphic below, and the ERP certification statement is due to the EPA not later than six months thereafter. Also, CWSs shall review their R&RAs and ERPs at least once every five years after the applicable certification submission deadlines. More information on these A WIA requirements, as well as information on compliance tools and resources are available on the EPA's website. If you have any questions related to Section 2013 of AWIA, please email the EPA at dwresilience(a>epa. sov. The document is divided into six main sections: (1) Community Water Systems Required to Comply Under Section 2013 of A WIA; (2) Community Water System Requirements (3) Community Water System Compliance; (4) Tools and Resources; (5) Funding; and (6) Contacts and Outreach. X / Emergency Response Plan (ERP) Certify your ERP no later than six months after certification of the risk assessment l ------- dEFA April 2020 Community Water Systems Required to Comply Under Section 2013 of AWIA 1. Community water systems (CWS) serving a population of 3,301 or greater are required to certify a risk and resilience assessment. How is the EPA determining a CWS's population served? The EPA is using the population served number that each CWS reported to its respective state for the Safe Drinking Water Information System (SDWIS) database as of the date of AWIA's enactment on October 23, 2018. 2. How does AWIA Section 2013 address small systems that service less than 3,301 people? Part (e) of AWIA Section 2013 states, "the Administrator [of the EPA] shall provide guidance and technical assistance to community water systems serving a population of less than 3,300 persons on how to conduct resilience assessments, prepare emergency response plans, and address threats from malevolent acts and natural hazards that threaten to disrupt the provision of safe drinking water or significantly affect the public health or significantly affect the safety or supply of drinking water provided to communities and individuals." EPA intends to develop guidance for CWSs that serve populations of less than 3,301 people that will be available in late 2020 on the_ )site. 3. How does a CWS that sells water calculate its population served in relationship to the AWIA Section 2013 risk and resilience assessment (R&RA) and emergency response plan (ERP) requirements? When determining population served, CWS wholesalers should account for the community or communities to which they sell or provide water. AWIA Section 2013 requirements also apply to those community water systems with consecutive connections that individually serve less than 3,301 people, but their aggregate population served is greater than 3,300 people. 4. What are the CWS initial R&RA and ERP certification submittal deadlines for a new facility that comes online after a compliance deadline has passed? Each CWS will follow the R&RA and ERP certification submittal deadlines based on the population served in the next five-year reporting cycle. For example, a CWS that comes online after the March 31, 2020 deadline and serves 100,000 people or more, is required to certify the completion of its R&RA no later than March 31, 2025. 2 ------- vvEPA iinhfdSMH Erwonmant*! Protection A .. April 2020 Five Year Recertification Deadlines Population Served Risk and Resilience Assessment Next 5-Year Cycle Submission Date >100,000 March 31, 2020 March 31, 2025 50,000-99,999 December 31, 2020 December 31, 2025 3,301-49,999 June 30, 2021 June 30, 2026 Population Served Emergency Response Plan* Next 5-Year Cycle Submission Date* >100,000 September 30, 2020 September 30, 2025 50,000-99,999 June 30, 2021 June 30, 2026 3,301-49,999 December 31, 2021 December 31, 2026 *ERP certifications are due six months from the date of the R&RA certification. The dates shown above are certification dates based on a utility submitting a R&RA on the final due date. 5. Are transient non-community water systems or non-transient non-community water systems impacted by Section 2013 of AWIA? No, Section 2013 of AWIA only applies to community water systems which are defined as public water systems that supply water to the same population year-round. Transient non-community water systems are public water systems that provide water in a place such as a gas station or campground where people do not remain for long periods of time. A non-transient non-community water system is a public water system that regularly supplies water to at least 25 of the same people for at least six months per year. Some examples are schools, factories, office buildings, and hospitals which have their own water systems. For more information about CWSs please visit this site: https://www.epa.gov/dwreginfo/information-about-public-water-systems 3 ------- dEFA April 2020 6. Should populations served by a CWS's emergency connections be considered when calculating its AWIA compliance service size? No. Emergency connections are defined as a source that is neither part of a public water system's routine or regular operation nor expected to be used on a seasonal or interim basis. An emergency source is available if an unanticipated event or emergency should arise (e.g., maintaining pressure until a water main is repaired or replaced). Both year-round and seasonal systems may have emergency sources. An emergency source is one that would be used for a limited period of time (e.g., maintaining water pressure). Therefore, emergency connections should not be considered when calculating a CWS's population served. Community Water System Requirements 1. How do I and how soon can I submit a community water system (CWS) risk and resilience assessment (R&RA) or emergency response plan (ERP) certification? The EPA strongly recommends that you electronically submit your CWS R&RA and ERP certifications. For information on how to certify, go here. You can also view a video tutorial on how to electronically certify here. You can submit your certification as soon as possible, but no later than the certification deadlines set in Section 2013 of AWIA; see the table above for R&RA and ERP certification submission deadlines. Please note that once a CWS certifies the completion of its R&RA or ERP, they will be unable to electronically recertify for the next five-year R&RA or ERP certification cycle until one year prior to the associated certification deadline date(s). 2. Who is qualified to certify a risk and resilience assessment or emergency response plan on behalf of the CWS? Each CWS determines who the certifying official will be for the risk and resilience assessment and emergency response plan. There are no specific requirements for the utility certifying official, however, the official must be a utility employee. 3. When certifying completion of a R&RA or ERP using the EPA's electronic certification system, can one User ID be used to certify for more than one CWS, as identified by a Public Water System Identification (PWSID) number? For those that own or manage more than one community water system; users of the EPA's electronic certification system can register for, create, and use one User ID and password to certify R&RAs and ERPs for multiple PWSID numbers. 4. What are the mandatory components related to cybersecurity in the ERP? AWIA Section 2013(b) states that ERPs "... shall include strategies and resources to improve the resilience of the system, including...cybersecurity." Thus, while there are no specific cybersecurity requirements outlined in AWIA, CWSs are required to consider cybersecurity 4 ------- dEFA April 2020 resiliency when developing or updating their ERPs. Please access the following EPA cybersecurity resources for more information: ^security Incident Action Checklist to help water utilities prepare for and respond to cyber incidents. ^security Guide for States to help state primacy agencies start a conversation with water systems about cybersecurity threats. nplate and Instructions to develop an ERP in accordance with AWIA Section 2013(b) requirements, including cybersecurity. 5. What specifically is meant by "financial infrastructure" in the risk and resilience assessment in Section 2013 of AWIA? Financial infrastructure of a CWS means utility billing, payment, and financial account management systems, including those operated by a third party on behalf of a utility. It does not include measures of financial stability, such as bond rating or asset and debt ratios. 6. Is the "construction of flood protection barriers" required within the ERP referring to temporary or permanent construction? Flood protection barriers can be either temporary or permanent, depending on the findings and countemieasures identified in the utility's risk and resilience assessment. CWSs whose risk profile, as determined in their risk and resilience assessment, includes flooding should indicate in their ERP that they considered the following specific flood mitigation actions: 1) the development of alternative source water options; 2) the relocation of water intakes; and 3) the construction of flood protection barriers. Community Water System Compliance 1. What is the penalty for a community water system (CWS) that does not comply with the risk and resilience assessment (R&RA) and emergency response plan (ERP) certification deadline defined in the law? If a community water system fails to conduct a R&RA, develop an ERP, and certify those results to the Agency before the statutory deadlines, then the EPA may exercise its enforcement discretion to bring an action to require compliance and may also seek a civil penalty. Note that the EPA exercises its enforcement discretion on a case-by-case basis. Please see Section E, Public water systems regulated under the Safe Drinking Water Act, of EPA's COVID-19 enforcement discretion memorandum for further information. Generally, pursuant to Section 1414 of the Safe Drinking Water Act (SDWA), if the EPA finds that a public water system does not comply with any "applicable requirement," the Agency may issue an order under subsection (g) or commence a civil action under subsection 5 ------- dEFA April 2020 (b) to require the system to comply. Under SDWA Section 1414, the EPA also has the authority to seek a civil penalty not to exceed $57,317 (adjusted annually for inflation) for each day in which such violation occurs. "Applicable requirement" is defined in SDWA Section 1414(i) and includes any requirement of SDWA Section 1433. 2. What is the process for requesting an extension of the compliance deadlines in Section 2013 of AWIA? Please see Section E, Public water systems regulated under the Safe Drinking Water Act, of enforcement discretion memorandum for further information. In general, under SDWA Section 1414, whenever the Administrator of the EPA finds that any public water system does not comply with any applicable requirement, including the schedule for certification of assessments required by Section 1433, the Administrator may commence an enforcement action. For violations of an applicable requirement, the Agency may take enforcement to require the system to return to compliance. The EPA may also seek penalties for such violations under SDWA. In short, the EPA cannot change the statutory deadlines in Section 1433. If a CWS fails to certify it has conducted the required assessment or plan preparation or revisions by the applicable deadline, then it is in noncompliance. The EPA has enforcement discretion in terms of how it responds to such noncompliance. Please see this page for a list of resources and tools that can assist CWSs in complying with AWIA. 3. What is the relationship between AWIA Section 2018 (e.g., chemical storage, release, and notification) and the R&RA and emergency response plan (ERP) requirements under AWIA Section 2013? AWIA Section 2018 amends the Emergency Planning and Community Right to Know Act (EPCRA), specifically Sections 304, Emergency Release Notification, and 312, Hazardous Chemical Reporting. Currently, facilities that handle or store an extremely hazardous substance (EHS) under EPCRA or hazardous substance (HS) under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) at specified threshold planning quantities (listed in regulation) are regulated by EPCRA. Under Section 304, if a facility spills an EHS at or above the reportable quantity (listed in regulation), the owner/operator must notify the State Emergency Response Commission (SERC) and Local Emergency Planning Committee (LEPC) immediately. If a facility spills a CERCLA HS, the owner/operator must also immediately notify the National Response Center in addition to notifying the SERC and LEPC. Under the new EPCRA Section 304 amendments in AWIA, a SERC that is notified must forward the initial notification and subsequent follow-up notification to the state drinking water primacy agency and the primacy agency must forward the notifications to any community water system whose source could be affected by the release. 6 ------- dEFA April 2020 In addition, AWIA Section 2018 amends EPCRA Section 312 to give community water systems the right to hazardous chemical inventory data (referred to a tier II inventory) for any facility subject to annual EPCRA reporting requirements that falls within that community water system's source water protection area. The community water system must make the request to the SERC or LEPC. AWIA Section 2013 also requires water systems to coordinate with their LEPCs to the extent possible when preparing or revising their risk assessment and emergency response plan. This coordination ensures the community ERP includes any chemicals used by the water system and that the water system has access to Tier 2 hazardous chemical inventory data and obtains release notifications required under EPCRA Section 304. Community water systems can use the Tier II chemical inventory information to update their risk assessment. They can also use the notification procedures and results of any potential chemical spill risk to update their ERP. Tools and Resources 1. How do I certify my Section 2013 AWIA-compliant risk and resilience assessment (R&RA) or emergency response plan (ERP)? Please visit the website for more information on how to certify a CWS R&RA and ERP, also please see a PDF document tutorial explanation or a video tutorial. 2. What training or resources does the EPA have available to assist CWSs with meeting the requirements under Section 2013 of AWIA? The EPA has developed several tools and resources to aid in complying with AWIA Section 2013 requirements. For the risk and resilience assessment, the EPA has created the ol and the Baseline Information on Malevolent Acts for CWSs. The EPA has also developed Guidance for Small Community Water Systems on Risk and Resilience Assessments under America's Water Infrastructure Act, which will be available in June 2020. The EPA created the Emergency Response Template and Guidance to support compliance with the Emergency Response Plan requirements. 3. Which standards can a CWS use to comply with the R&RA and/or ERP requirements? Section 2013 of AWIA does not require the use of any standards, methods or tools for the R&RA or ERP. Your utility is responsible for ensuring that the risk and resilience assessment and emergency response plan address all the criteria in AWIA Section 2013(a) and (b), respectively. The EPA recommends the use of standards, including American Water Works Associations' k and Resilience Management of Water and Wastewater Systems. the EPA's ERP guide and template, along with the EPA's Vulnerability Self-Assessment Tool Web 2.0 or Guidance for Small Community Water Systems on Risk and Resilience Assessments under America's Water Infrastructure Act, to facilitate sound risk and resilience assessments and emergency response plans. 7 ------- dEFA April 2020 4. Can the current version (Web 2.0) of the EPA's Vulnerability Self-Assessment Toot (VSAT) be used to conduct a compliant risk and resilience assessment? Yes. VSAT Web 2.0 has been updated to meet the requirements of Section 2013 of AWIA. The EPA recommends using VSAT Web 2.0 as a resource to complete an AWIA-compliant risk and resilience assessment. 5. Can I familiarize myself with VSAT Web 2.0 without being tied to a specific utility, such as remaining anonymous, prior to using the tool for the CWS's risk and resilience assessment? Yes. Any individual can use VSAT Web 2.0 to develop a test utility and familiarize themselves with the tool. 6. Who can I contact for additional questions regarding VSAT Web 2.0 or the Emergency Response Plan Guidance and template? Please email the EPA at dwresi 11 ence@epa.gov. 7. What tools are available for CWSs to meet the cybersecurity assessment component of the risk and resilience assessment and emergency response plan, as required for AWIA Section 2013? Cybersecurity is one of the concerns addressed within the il, and emergency response plan guide and template. In addition, you can use the EPA's cybersecurity incident action checklist for water utilities, and the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency offers a wealth of guidance on cybersecurity. 8. What tools are available to assist in conducting a financial infrastructure assessment, as required by AWIA? The main, high-risk threat on financial infrastructure is "Cyber Attack Business Enterprise Systems," as identified in the EPA's Baseline Information on Malevolent Acts document. This document provides information on estimating the threat likelihood, along with references to additional resources to reduce risk. For additional information, the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency offers more guidance on cybersecurity. 8 ------- dEFA April 2020 Funding Assistance 1. Is there funding available for conducting the risk and resilience assessment (R&RA) to meet the AWIA Section 2013 requirements? Currently, there is not one stream of funding that is designated specifically to address the new risk assessment requirement. However, conducting a risk assessment is considered an eligible project under the EPA's Drinking Water State Revolvi d (DWSRF). The risk assessment may yield a project that the utility may want to invest in to improve the overall system resilience. Each state develops a list of priority projects for funding under the DWSRF, so please check with your state to see if they have set aside funds for this function specifically. 2. Are there grants or funding specifically available to small CWSs in order to meet the requirements under Section 2013 of AWIA? Currently, no funding has been appropriated by Congress. Contacts and Outreach 1. Who can I contact from the EPA for more information? For AWIA Section 2013 or 2018 questions, please email the EPA at dwresilience@epa.gov. For specific questions related to Emergency Planning and Community Right-to-Know Act (EPCRA), reach out to the EPA's Regional EPCRA contacts at: https://www.epa.gov/epcra/epcra-regiorial-coritacts 9 ------- |