S-EPA Guidance for Small Community Water Systems on Risk and Resilience Assessments under America's Water Infrastructure Act Who Should Use this Guidance? This guidance is intended for small community water systems (CWSs) serving greater than 3,300 but less than 50,000 people to comply with the requirements for risk and resilience assessments under America's Water Infrastructure Act of 2018 (AWIA). For larger CWSs, EPA recommends the Vulnerability Self-Assessment Tool (VSAT) Web 2.0 or an alternate risk assessment method. CWSs serving 3,300 or fewer people are not required to conduct risk and resilience assessments under AWIA. EPA recommends, however, that very small CWSs use this or other guidance to learn how to conduct risk and resilience assessments and address threats from malevolent acts and natural hazards that threaten safe drinking water. What is the Purpose of this Guidance? This guidance will help small CWSs meet the requirements for risk and resilience assessments in AWIA. This guidance does not address emergency response plans (ERPs), which are also required under AWIA for CWSs serving more than 3,300 people. EPA has developed an Emergency Response Plan Template and Instructions for CWSs to comply with AWIA. Further, this guidance does not cover all aspects of water system security and resilience, such as asset management, climate change, and emergency preparedness and response. Visit EPA's Drinking Water and Wastewater Resilience page to find more information. What are the Risk and Resilience Assessments Requirements in AWIA? AWIA reguires CWSs serving more than 3,300 people to assess the risks to and resilience of the system to malevolent acts and natural hazards. The law specifies water system assets (e.g., infrastructure) that the assessment must address. These assets are listed in Tables 1a - 10b in the Risk and Resilience Assessment Checklist (see tillable checklist below on page 4). Water systems must certify to EPA that the system conducted the assessment not later than the following dates: March 31,2020 for systems serving 100,000 or more December 31, 2020 for systems serving 50,000 or more but less than 100,000 1 ------- Guidance for Small Community Water Systems on Risk and Resilience Assessments under America's Water Infrastructure Act June 30,2021 for systems serving more than 3,300 but less than 50,000 NOTE: Water systems do not submit the actual assessment to EPA. Visit EPA's informational page on How to Certify Your Risk and Resilience Assessment or ERP for instructions. Every five years, CWSs must review the risk and resilience assessment, revise it as needed, and provide^ a new certification to EPA. What are Risk and Resilience in a Water System? Risk to critical infrastructure, including water systems, is a function of threat likelihood, vulnerability, and consequence. Threat can be a malevolent act, like a cyber-attack or process sabotage, or a natural hazard, such as a flood or hurricane. Threat likelihood is the probability that a malevolent act will be carried out against the water system or that a natural hazard will occur. Vulnerability is a weakness that can be exploited by an adversary or impacted by a natural hazard. It is the probability that if a malevolent act or a natural hazard occurred, then the water system would suffer significant adverse impacts. Consequences are the magnitude of loss that would ensue if a threat had an adverse impact against a water system. Consequences may include: Economic loss to the water system from damage to utility assets; Economic loss to the utility service area from a service disruption, and Severe illness or deaths that could result from water system contamination, a hazardous gas release, or other hazard involving the water system. Resilience is the capability of a water system to maintain operations or recover when a malevolent act or a natural hazard occurs. Countermeasures are steps that a water system implements to reduce risk and increase resilience. They may include plans, equipment, procedures, and other measures. How does a Community Water System Assess Risk and Resilience Under AWIA? Tables 1a - 10b in the Risk and Resilience Assessment Checklist (see tillable checklist below on page 4) list the categories of water system assets that you must assess under AWIA. In all tables (i.e., for all asset categories), do the following: 1. Select only the malevolent acts from those listed in the table that pose a significant risk to the asset category at the CWS. You may write-in malevolent acts not listed in the table. a. Focus the selection of malevolent acts on those that are prevalent in the United States (e.g., cyber- attacks), can exploit vulnerabilities at the CWS (e.g., known security gaps), and have the potential for significant economic or public health consequences (e.g., contamination). NOTE: EPA's Baseline Information on Malevolent Acts Relevant to Community Water Systems assists water systems with estimating the likelihood of these malevolent acts and provides resources for additional information. 2 ------- Guidance for Small Community Water Systems on Risk and Resilience Assessments under America's Water Infrastructure Act 2. For each malevolent act that you identify as a significant risk, briefly describe how the malevolent act could impact the asset category at the CWS. Include major assets that might be damaged or disabled, water service restrictions or loss, and public health impacts as applicable. 3. Select only the natural hazards from those listed in the table that may pose a significant risk to the asset category at the CWS. You may write-in natural hazards not listed in the table. a. Focus the selection of natural hazards on those that are prevalent in the area where the water system is located, may affect vulnerable water system infrastructure, and have the potential for significant economic or public health consequences related to the CWS. 4. For each natural hazard that you identify as a significant risk, briefly describe or provide examples of how the hazard could impact the asset category at the CWS. Include major assets that might be damaged or disabled, water service restrictions or loss, and public health impacts as applicable. 5. OPTIONAL Table 11 (Risk and Resilience Assessment Checklist, see below): Identify countermeasures that the CWS could potentially implement to reduce risk from the malevolent acts and natural hazards that you selected in in this assessment. a. For malevolent acts, countermeasures are intended to deter, delay, detect, and respond to an attack. b. For natural hazards, countermeasures are intended to prepare, respond, and recover from an event. NOTE: A single countermeasure, such as emergency response planning or power resilience, may reduce risk across multiple malevolent acts, natural hazards and asset categories. Complete the Risk and R Checklist here EPA offers the Risk and Resilience Assessment Checklist in two formats. A fillable PDF format is provided on the pages that follow. This format has fixed fields and may not be changed by the user. Alternatively a Word version may be accessed by clicking on the icon below. The Word version may be changed by the user. The content of the PDF and Word versions is the same. To access the Word version, the file must be downloaded to your computer. Risk and Resilience Assessment Checklist Office of Water (MC 140) EPA 817-B-20-001 May 2020 3 ------- Community Water System Risk and Resilience Assessment Enter Community Water System Name Risk and Resilience Assessment Please fill in the information below. Facility Name (if applicable): PWSID: Analyst Name(s): Date of Analysis: Analysis Notes: 4 ------- Enter Community Water System Name Risk and Resilience Assessment Table 1a: Physical Barriers (Malevolent Acts)1 Asset Category: Physical Barriers Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Physical Barriers asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. | | Assault on Utility - Physical | | Contamination of Finished Water - Intentional I | Contamination of Finished Water - Accidental2 I I Theft or Diversion - Physical I I Cyberattack on Business Enterprise Systems 11n a risk assessment, physical barriers are usually treated as countermeasures, which reduce the risk of a threat to an asset, rather than being treated as assets. However, under AWIA, a CWS must assess the risks to and resilience of physical barriers. 2 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 5 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Physical Barriers Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Physical Barriers asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems I | Sabotage - Physical I | Contamination of Source Water - Intentional 1 1 Contamination of Source Water - Accidental3 1 1 Other(s), enter below: 3 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 6 ------- Enter Community Water System Name Risk and Resilience Assessment Table 1b: Physical Barriers (Natural Hazards)4 Asset Category: Physical Barriers Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Physical Barriers asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Flood I I Earthquake I | Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 4ln a risk assessment, physical barriers are usually treated as countermeasures, which reduce the risk of a threat to an asset, rather than analyzed as assets themselves. However, under AWIA, a CWS must assess the risks to and resilience of physical barriers. 7 ------- Enter Community Water System Name Risk and Resilience Assessment Table 2a: Source Water (Malevolent Acts) Asset Category: Source Water Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Source Water asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~1 Assault on Utility - Physical |~1 Contamination of Finished Water - Intentional |~1 Contamination of Finished Water - Accidental5 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 5 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 8 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Source Water Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Source Water asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. 1 1 Cyberattack on Process Control Systems 1 1 Sabotage - Physical 1 1 Contamination of Source Water - Intentional 1 1 Contamination of Source Water - Accidental6 1 1 Other(s), enter below: 6 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 9 ------- Enter Community Water System Name Risk and Resilience Assessment Table 2b: Source Water (Natural Hazards) Asset Category: Source Water Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Source Water asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 10 ------- Enter Community Water System Name Risk and Resilience Assessment Table 3a: Pipes and Constructed Conveyances, Water Collection, and Intake (Malevolent Acts) Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and associated pumps and pipes, aqueducts, and other conveyances. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Pipes and Constructed Conveyances, Water Collection, and Intake asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~| Assault on Utility - Physical l~l Contamination of Finished Water - Intentional I~1 Contamination of Finished Water - Accidental7 I~1 Theft or Diversion - Physical l~l Cyberattack on Business Enterprise Systems 7 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 11 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and associated pumps and pipes, aqueducts, and other conveyances. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Pipes and Constructed Conveyances, Water Collection, and Intake asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems I I Sabotage - Physical I | Contamination of Source Water - Intentional I | Contamination of Source Water - Accidental8 I I Other(s), enter below: 8 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 12 ------- Enter Community Water System Name Risk and Resilience Assessment Table 3b: Pipes and Constructed Conveyances, Water Collection, and Intake (Natural Hazards) Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and associated pumps and pipes, aqueducts, and other conveyances. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Pipes and Constructed Conveyances, Water Collection, and Intake asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 13 ------- Enter Community Water System Name Risk and Resilience Assessment Table 4a: Pretreatment and Treatment (Malevolent Acts) Asset Category: Pretreatment and Treatment Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples include sedimentation, filtration, disinfection, and chemical treatment. For the risk assessment, individual treatment processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk profile. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Pretreatment and Treatment asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Assault on Utility - Physical I I Contamination of Finished Water - Intentional | | Contamination of Finished Water - Accidental9 | | Theft or Diversion - Physical | | Cyberattack on Business Enterprise Systems 9 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 14 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Pretreatment and Treatment Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples include sedimentation, filtration, disinfection, and chemical treatment. For the risk assessment, individual treatment processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk profile. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Pretreatment and Treatment asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems I | Sabotage - Physical I | Contamination of Source Water - Intentional I I Contamination of Source Water - Accidental10 I I Other(s), enter below: 10 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 15 ------- Enter Community Water System Name Risk and Resilience Assessment Table 4b: Pretreatment and Treatment (Natural Hazards) Asset Category: Pretreatment and Treatment Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples include sedimentation, filtration, disinfection, and chemical treatment. For the risk assessment, individual treatment processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk profile. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Pretreatment and Treatment asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 16 ------- Enter Community Water System Name Risk and Resilience Assessment Table 5a: Storage and Distribution Facilities (Malevolent Acts) Asset Category: Storage and Distribution Facilities Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks, reservoirs, valves, pipes, and meters. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Storage and Distribution Facilities asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~l Assault on Utility - Physical |~l Contamination of Finished Water - Intentional |~l Contamination of Finished Water - Accidental11 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 11 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 17 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Storage and Distribution Facilities Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks, reservoirs, valves, pipes, and meters. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Storage and Distribution Facilities asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems I | Sabotage - Physical I | Contamination of Source Water - Intentional I | Contamination of Source Water - Accidental12 I I Other(s), enter below: 12 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 18 ------- Enter Community Water System Name Risk and Resilience Assessment Table 5b: Storage and Distribution Facilities (Natural Hazards) Asset Category: Storage and Distribution Facilities Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks, reservoirs, valves, pipes, and meters. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Storage and Distribution Facilities asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 19 ------- Enter Community Water System Name Risk and Resilience Assessment Table 6a: Electronic, Computer, or Other Automated Systems (including the security of such systems) (Malevolent Acts) Asset Category: Electronic, Computer; or Other Automated Systems (including the security of such systems) Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business enterprise information technology (IT) and communications systems (other than financial), and the processes used to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related IT hardware and software and communications, used to control water collection, treatment, and distribution. Also includes IT hardware, software, and communications used in business enterprise operations. The assessment must account for the security of these systems (e.g., cybersecurity, information security). Malevolent Acts Select the malevolent acts in the left column that pose a significant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Electronic, Computer, or Other Automated Systems (including the security of such systems) asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~l Assault on Utility - Physical |~l Contamination of Finished Water - Intentional |~l Contamination of Finished Water - Accidental13 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 13 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 20 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Electronic, Computer; or Other Automated Systems (including the security of such systems) Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business enterprise information technology (IT) and communications systems (other than financial), and the processes used to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related IT hardware and software and communications, used to control water collection, treatment, and distribution. Also includes IT hardware, software, and communications used in business enterprise operations. The assessment must account for the security of these systems (e.g., cybersecurity, information security). Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Electronic, Computer, or Other Automated Systems (including the security of such systems) asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Cyberattack on Process Control Systems I I Sabotage - Physical I I Contamination of Source Water - Intentional I I Contamination of Source Water - Accidental14 I I Other(s), enter below: 14 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 21 ------- Enter Community Water System Name Risk and Resilience Assessment Table 6b: Electronic, Computer, or Other Automated Systems (including the security of such systems) (Natural Hazards) Asset Category: Electronic, Computer; or Other Automated Systems (including the security of such systems) Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business enterprise information technology (IT) and communications systems (other than financial), and the processes used to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related IT hardware and software and communications, used to control water collection, treatment, and distribution. Also includes IT hardware, software, and communications used in business enterprise operations. The assessment must account for the security of these systems (e.g., cybersecurity, information security). Natural Hazards Select the natural hazards in the left column that pose a significant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Electronic, Computer, or Other Automated Systems (including the security of such systems) asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. | | Flood I | Earthquake | | Tornado 1 I Ice Storm ~ Fire I | Other(s), enter below: 22 ------- Enter Community Water System Name Risk and Resilience Assessment Table 7a: Monitoring Practices (Malevolent Acts)15 Asset Category: Monitoring Practices Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and finished water quality, along with any monitoring systems not captured in other asset categories. Possible examples include sensors, laboratory resources, sampling capabilities, and data management equipment and systems. Examples are contamination warning systems for the source water or distribution system. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Monitoring Practices asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~l Assault on Utility - Physical |~l Contamination of Finished Water - Intentional |~l Contamination of Finished Water - Accidental16 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 15 Monitoring associated with physical security should be addressed under Physical Barriers; monitoring associated with process controls and cybersecurity should be addressed under Electronic, Computer or Other Automated Systems; monitoring associated with financial systems should be addressed under Financial Infrastructure. 16 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 23 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Monitoring Practices Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and finished water quality, along with any monitoring systems not captured in other asset categories. Possible examples include sensors, laboratory resources, sampling capabilities, and data management equipment and systems. Examples are contamination warning systems for the source water or distribution system. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Monitoring Practices asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Cyberattack on Process Control Systems I I Sabotage - Physical I I Contamination of Source Water - Intentional I I Contamination of Source Water - Accidental17 I I Other(s), enter below: 17 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 24 ------- Enter Community Water System Name Risk and Resilience Assessment Table 7b: Monitoring Practices (Natural Hazards)18 Asset Category: Monitoring Practices Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and finished water quality, along with any monitoring systems not captured in other asset categories. Possible examples include sensors, laboratory resources, sampling capabilities, and data management equipment and systems. Examples are contamination warning systems for the source water or distribution system. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Monitoring Practices asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 18 Monitoring associated with physical security should be addressed under Physical Barriers; monitoring associated with process controls and cybersecurity should be addressed under Electronic, Computer or Other Automated Systems; monitoring associated with financial systems should be addressed under Financial Infrastructure. 25 ------- Enter Community Water System Name Risk and Resilience Assessment Table 8a: Financial Infrastructure (Malevolent Acts) Asset Category: Financial Infrastructure Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility finances. Possible examples include billing, payment, and accounting systems, along with third parties used for these services. This asset category is not intended to address the financial "health" of the water utility (e.g., credit rating, debt-to-equity ratios). Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Financial Infrastructure asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~l Assault on Utility - Physical |~l Contamination of Finished Water - Intentional |~l Contamination of Finished Water - Accidental19 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 19 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 26 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: Financial Infrastructure Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility finances. Possible examples include billing, payment, and accounting systems, along with third parties used for these services. This asset category is not intended to address the financial "health" of the water utility (e.g., credit rating, debt-to-equity ratios). Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to the Financial Infrastructure asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. 1 1 Cyberattack on Process Control Systems 1 1 Sabotage - Physical 1 1 Contamination of Source Water - Intentional 1 1 Contamination of Source Water - Accidental20 1 1 Other(s), enter below: 20 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 27 ------- Enter Community Water System Name Risk and Resilience Assessment Table 8b: Financial Infrastructure (Natural Hazards) Asset Category: Financial Infrastructure Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility finances. Possible examples include billing, payment, and accounting systems, along with third parties used for these services. This asset category is not intended to address the financial "health" of the water utility (e.g., credit rating, debt-to-equity ratios). Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to the Financial Infrastructure asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. 1 I Flood 1 1 Earthquake 1 I Tornado 1 1 Ice Storm ~ Fire 1 1 Other(s), enter below: 28 ------- Enter Community Water System Name Risk and Resilience Assessment Table 9a: The Use, Storage, or Handing of Chemicals (Malevolent Acts) Asset Category: The Use, Storage, or Handling of Chemicals Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to The Use, Storage, or Handling of Chemicals asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. |~l Assault on Utility - Physical |~l Contamination of Finished Water - Intentional |~l Contamination of Finished Water - Accidental21 |~1 Theft or Diversion - Physical |~1 Cyberattack on Business Enterprise Systems 21 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 29 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: The Use, Storage, or Handling of Chemicals Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable. Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to The Use, Storage, or Handling of Chemicals asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems I | Sabotage - Physical I | Contamination of Source Water - Intentional I | Contamination of Source Water - Accidental22 1 1 Other(s), enter below: 22 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 30 ------- Enter Community Water System Name Risk and Resilience Assessment Table 9b: The Use, Storage, or Handing of Chemicals (Natural Hazards) Asset Category: The Use, Storage, or Handling of Chemicals Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable. Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to The Use, Storage, or Handling of Chemicals asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 31 ------- Enter Community Water System Name Risk and Resilience Assessment Table 10a: The Operation and Maintenance of the System (Malevolent Acts) Asset Category: The Operation and Maintenance of the System Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of the water system that are not captured under other asset categories. Possible examples include equipment, supplies, and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g., disease outbreak or employee displacement). Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to The Operation and Maintenance of the System asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I~l Assault on Utility - Physical l~l Contamination of Finished Water - Intentional l~l Contamination of Finished Water - Accidental23 l~l Theft or Diversion - Physical l~l Cyberattack on Business Enterprise Systems 23 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 32 ------- Enter Community Water System Name Risk and Resilience Assessment Asset Category: The Operation and Maintenance of the System Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of the water system that are not captured under other asset categories. Possible examples include equipment, supplies, and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g., disease outbreak or employee displacement). Malevolent Acts Select the malevolent acts in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a malevolent act in the left column as a significant risk to The Operation and Maintenance of the System asset category, briefly describe in the right column how the malevolent act could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I | Cyberattack on Process Control Systems 1 1 Sabotage - Physical 1 1 Contamination of Source Water - Intentional 1 1 Contamination of Source Water - Accidental24 1 1 Other(s), enter below: 24 Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination incident is intentional or accidental may not be known during initial response. 33 ------- Enter Community Water System Name Risk and Resilience Assessment Table 10b: The Operation and Maintenance of the System (Natural Hazards) Asset Category: The Operation and Maintenance of the System Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of the water system that are not captured under other asset categories. Possible examples include equipment, supplies, and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g., disease outbreak or employee displacement). Natural Hazards Select the natural hazards in the left column that pose a siqnificant risk to this asset category at the CWS. Brief Description of Impacts If you select a natural hazard in the left column as a significant risk to The Operation and Maintenance of the System asset category, briefly describe in the right column how the natural hazard could impact this asset category at the CWS. Include effects on major assets, water service, and public health as applicable. I I Flood I I Earthquake I I Tornado I I Ice Storm ~ Fire I I Other(s), enter below: 34 ------- Enter Community Water System Name Risk and Resilience Assessment Table 11: Countermeasures (Optional)25 Countermeasures (optional) List countermeasures in the left column the CWS could potentially implement to reduce risk from the malevolent acts and natural hazards that were selected. Brief Description of Risk Reduction or Increased Resilience For each countermeasure, in the right column, describe how the countermeasure could reduce risk or increase resilience for CWS assets from malevolent acts or natural hazards that were selected in the analysis. A countermeasure may reduce risk across multiple malevolent acts, natural hazards and asset categories. 25 IMPORTANT NOTE: The assessment does not require a specific number of countermeasures. You may have fewer than five countermeasures or add more countermeasures and describe them in a separate document. 35 ------- Enter Community Water System Name Risk and Resilience Assessment Change History Please describe the changes made to this risk and resilience assessment since its original development, who made the changes, and on what date the changes were incorporated. Name/Title: Date: Description of Change: 36 ------- |