Section 2013 of The America's Water Infrastructure Act (AWIA)
Section 2013 of The America's Water Infrastructure Act (AWIA) amends Sec. 1433 of the Safe Drinking Water Act. To read the language of Section 2013, please see the attached PDF below.
The language can also be found at 42 U.S. Code § 300i–2.
Summary
Drinking water systems have to conduct risk and resilience assessments and revise emergency response plans (ERPs) under the newly enacted America's Water Infrastructure Act. Every five years, utilities would be required to certify to EPA that they have reviewed their assessment and made any necessary revisions. No later than six months after completing their risk assessments, systems must also certify completion of emergency response plans that address how the system would respond to threats addressed in the assessment.
Systems serving 100,000 people or more must submit their initial certifications by March 31, 2020; systems serving 50,000 to 100,000 people, by December 31, 2020; and systems serving between 3,300 and 50,000 people, by June 30, 2021.
To help utilities identify threats to be considered in the assessments, the new law also directs EPA to produce baseline information about malicious acts that could substantially disrupt operations or otherwise present significant public health or economic concerns to the community served. EPA must provide the information by August 1, 2019. EPA will also be providing compliance guidance to utilities, but the agency will not be promulgating regulations.
Webinar
WaterISAC hosted a free webinar on Wednesday, February 13 at 3 p.m. ET on the risk assessment and emergency response plan requirements under the America’s Water Infrastructure Act (AWIA). Attendees learned about these new requirements, U.S. Environmental Protection Agency (EPA) plans for implementation and guidance, and tools that will be available to help utilities.
- David Travers and Dan Schmelling from EPA’s Water Security Division discussed the requirements under the act and describe how EPA will implement them. They also addressed the certification process and described the resources that EPA is developing to help utilities comply with the new requirements.
- Kevin Morley of the American Water Works Association discussed AWWA standards, such as AWWA’s J100 risk assessment standard, and tools available to water utilities.
The webinar recording and slides are available below.
AWIA Compliance Resources
WaterISAC
- 15 Cybersecurity Fundamentals for Water and Wastewater Utilities
- Webinar Series: Conducting Cybersecurity Assessments Under AWIA
-
Webinar #1 – Introduction to the Cybersecurity Assessment Process
-
Webinar #2 – Process Control and SCADA System Risks
-
Webinar #3 – Business System Risks
-
- Webinar Series: Conducting Water Sector Risk and Resilience Assessments
-
Webinar #1: Water System Security Background and AWIA
-
Webinar #2: Risk and Resilience Analysis and Management
-
Webinar #3: Risk and Resilience Analysis and Management (cont'd)
-
EPA
- Occurrence of Releases with the Potential to Impact Sources of Drinking Water
- Baseline Information on Malevolent Acts for Community Water Systems
- EPA AWIA Website
- Risk and Resilience Assessments and Emergency Response Plans: New Requirements for Drinking Water Utilities (Fact Sheet - published April 18, 2019)
- Certification Process
- Electronically Certify Your Water System’s Risk Assessment or ERP (YouTube video)
- Baseline Information on Malevolent Acts for Community Water Systems
- Vulnerability Self-Assessment Tool 2.0
- Emergency Response Plan Template and Instructions
- Hazard Mitigation for Natural Disasters
- Flood Resilience Guide
- Power Resilience Guide
- Emergency Response Plan Guidance for Large Community Water Systems
- Emergency Response Plan Guidance for Small and Medium Community Water Systems
- Incident Action Checklists for Water Utilities
- Guidance for Small Community Water Systems on Risk and Resilience Assessments under America’s Water Infrastructure Act (or Small System Risk and Resilience Assessment Checklist)
- EPA AWIA Trainings:
From March to May 2020, the EPA will host a series of one-day training events that will cover requirements for water systems under the America’s Water Infrastructure Act (AWIA) of 2018. AWIA requires community (drinking) water systems serving more than 3,300 people to develop or update risk assessments and emergency response plans (ERPs) (access more information and resources regarding AWIA at WaterISAC). The training events have options to attend in-person or virtually by webinar. While these events are focused on community water systems serving population sizes 50,000-99,999, EPA has said that it will not exclude water systems of any size. The eight training events will take place in
- Addison, Texas (March 11)
- Elsinore Valley, California (March 24)
- Portland, Oregon (March 26)
- Sanford, North Carolina (April 16)
- Worcester, Massachusetts (April 22)
- Lenexa, Kansas (April 29)
- West Jordan, Utah (May 20)
- Lansing, Michigan (May 27)
DHS
NIST
- Guide for Conducting Risk Assessments
- Cybersecurity Framework Reference Tool
- Cybersecurity Framework
AWWA
- AWWA Utility Risk & Resilience Certificate
- J100-10 (R13) Risk and Resilience Management of Water and Wastewater Systems
- M19 Emergency Planning for Water and Wastewater Utilities, Fifth Edition
- G430-14 Security Practices for Operation and Management
- G440-17 Emergency Preparedness Practices
- Cybersecurity Guidance and Tool
Electric Infrastructure Security Council
- E-Pro Handbook II, Volume II: Water Sector Resilience for Black Sky Events
- E-Pro Handbook III: Black Sky Cross Sector Coordination and Communication
Water Research Foundation