Today, the EPA released a new resource, "Small System Risk and Resilience Assessment Checklist." This product is designed to assist and wastewater utilities in systematically evaluating threats posed by malevolent acts and natural disasters that could endanger their services. This guidance targets small water or wastewater systems that serve fewer than 50,000 residents. For larger systems, the EPA suggests using the Vulnerability Self Assessment Tool (VSAT) Web 3.0 or another risk assessment alternative. Two versions of this guidance are available: one for drinking water utilities and another for wastewater utilities, with the relevant checklist accessible on the EPA website.

Small System Risk and Resilience Assessment Checklist for Drinking Water and Wastewater Utilities

The Small System Risk and Resilience Assessment (RRA) Checklist aids community water systems (CWSs) serving over 3,300 people in developing an RRA as mandated by the Safe Drinking Water Act (SDWA) and the America’s Water Infrastructure Act (AWIA). While CWSs serving fewer than 3,300 are not required to perform RRAs, the EPA encourages their voluntary participation to enhance resilience against threats. Under the SDWA, larger CWSs must certify completion of their RRA and Emergency Response Plan (ERP) without submitting the documents to the EPA.

Updated in July 2024, the checklist reflects enhancements to the understanding of cyber threats, combining previous separate categories of cyberattacks into a single threat model. It also removes accidental contamination threats and updates definitions in line with cybersecurity terminology. Additionally, a new table has been introduced to assess cybersecurity practices as per CISA guidelines. These revisions aim to support CWSs in meeting certification deadlines effectively.

Small System Risk and Resilience Assessment Checklist for Wastewater Utilities

This checklist will aid wastewater utilities in creating a Risk and Resilience Assessment (RRA). While wastewater systems are not mandated to perform RRAs according to SDWA section 1433, the EPA encourages these systems to voluntarily utilize this checklist or other resources to better understand how to conduct RRAs and tackle potential threats from both malicious actions and natural disasters they might encounter.

For more information and for both a PDF and Microsoft Word download of the respective checklists, visit epa.gov.