Drinking Water System Risk Assessments and Emergency Response Plans Required Under America's Water Infrastructure Act (AWIA)

Section 2013 of The America's Water Infrastructure Act (AWIA)

Section 2013 of The America's Water Infrastructure Act (AWIA) amends Sec. 1433 of the Safe Drinking Water Act. To read the language of Section 2013, please see the attached PDF below.
The language can also be found at 42 U.S. Code § 300i–2.

Summary

Drinking water systems have to conduct risk and resilience assessments and revise emergency response plans (ERPs) under the newly enacted America's Water Infrastructure Act. Every five years, utilities would be required to certify to EPA that they have reviewed their assessment and made any necessary revisions. No later than six months after completing their risk assessments, systems must also certify completion of emergency response plans that address how the system would respond to threats addressed in the assessment.

Systems serving 100,000 people or more must submit their initial certifications by March 31, 2020; systems serving 50,000 to 100,000 people, by December 31, 2020; and systems serving between 3,300 and 50,000 people, by June 30, 2021.

To help utilities identify threats to be considered in the assessments, the new law also directs EPA to produce baseline information about malicious acts that could substantially disrupt operations or otherwise present significant public health or economic concerns to the community served. EPA must provide the information by August 1, 2019. EPA will also be providing compliance guidance to utilities, but the agency will not be promulgating regulations.

Webinar

WaterISAC hosted a free webinar on Wednesday, February 13 at 3 p.m. ET on the risk assessment and emergency response plan requirements under the America’s Water Infrastructure Act (AWIA). Attendees learned about these new requirements, U.S. Environmental Protection Agency (EPA) plans for implementation and guidance, and tools that will be available to help utilities.

David Travers and Dan Schmelling from EPA’s Water Security Division discussed the requirements under the act and describe how EPA will implement them. They also addressed the certification process and described the resources that EPA is developing to help utilities comply with the new requirements.
Kevin Morley of the American Water Works Association discussed AWWA standards, such as AWWA’s J100 risk assessment standard, and tools available to water utilities.

The webinar recording and slides are available below.

AWIA Compliance Resources

WaterISAC

15 Cybersecurity Fundamentals for Water and Wastewater Utilities
Webinar Series: Conducting Cybersecurity Assessments Under AWIA
- Webinar #1 – Introduction to the Cybersecurity Assessment Process
- Webinar #2 – Process Control and SCADA System Risks
- Webinar #3 – Business System Risks
Webinar Series: Conducting Water Sector Risk and Resilience Assessments
- Webinar #1: Water System Security Background and AWIA
- Webinar #2: Risk and Resilience Analysis and Management
- Webinar #3: Risk and Resilience Analysis and Management (cont'd)

EPA

From March to May 2020, the EPA will host a series of one-day training events that will cover requirements for water systems under the America’s Water Infrastructure Act (AWIA) of 2018. AWIA requires community (drinking) water systems serving more than 3,300 people to develop or update risk assessments and emergency response plans (ERPs) (access more information and resources regarding AWIA at WaterISAC). The training events have options to attend in-person or virtually by webinar. While these events are focused on community water systems serving population sizes 50,000-99,999, EPA has said that it will not exclude water systems of any size. The eight training events will take place in