Division of Environmental Health Drinking Water Program

If your utility would like to review how to create/update a RA/ERP, refer to the steps below. If you are simply interested in AWIA requirements, please refer to the Components of RA/ERP tab for a list of items to include within the RA/ERP.

Step 1: Review Vulnerability Assessment (a.k.a. Risk and Resilience Assessment )

• To begin, the CWS must conduct a Risk and Resilience Assessment (RA). (NOTE: An RA is similar to a Vulnerability Assessment (VA) systems had to conduct in 2012). Through the RA, systems are able to identify the major risks and reduce vulnerabilities of critical assets, and mitigate the potential consequences of incidents that do occur. It also guides CWS' with countermeasures that reduce the risk from a threat to the utility’s assets, like security measures, equipment backup power, training and exercises on emergency response plans.

• • The Baseline Threat Document: Helps CWS' identify malevolent acts to include in their RA and identify threat likelihood.

• Next, EPA has identified 6 distinct asset categories. These categories (specified below) are the physical and cyber elements that systems are required to evaluate in conducting the RA under AWIA.

• Once the CWS has identified malevolent acts that could impact their system, they should use VSAT Web 2.0 to conduct the RA. VSAT is a user-friendly tool that can help CWS' conduct a RA. For additional questions regarding VSAT Web 2.0 please email dwresilience@epa.gov

• • Vulnerability Self-Assessment Tool 2.0 - VSAT Web 2.0: Helps CWS' identify the highest risk to mission-critical operations and find the most cost-effective measures to reduce those risks..

Step 2: Review/Update Emergency Response Plan (ERP)

• Once systems have completed the RA, use this information to create a document (or update your existing document) that describes the strategies a CWS can take to aid in the detection of malevolent acts or natural hazards. This Emergency Response Plan (ERP) must describe a systems strategies, resources, plans, and procedures to prepare for and respond to an incident, natural or man-made, that threatens life, property, or the environment.
• The AWIA-developed document (link below) contains instructions with an imbedded ERP template that will assist CWS develop an ERP that is in accordance with AWIA Section 2013 requirements. We have provided a separate link to the ERP template below. Additionally, within this document, EPA has identified 4 distinct criteria. This criteria (specified in table below) is the information that must be included in an ERP under AWIA.

• • Community Water System ERP Instructions and Template (PDF)
  • AWIA ERP Template (MS Word)

Step 3: Submit Certification to EPA

• Once you have completed the RA and ERP, CWS' must certify the documents were completed. 3 options are available to CWS' so they can submit the certification statement to EPA. Refer to the Certification tab for additional details on these 3 options.

Step 4: Update ERP every 5 years

• Each CWS must review and update (if applicable) their ERP once every 5 years after the system completes their initial certification. Think of the ERP as a "living document" with established routine updates. The ERP must include any revisions to the RA. Upon completion of that review, the CWS must certify to EPA the RA/ERP are complete.

Comparison of State Regulation 18 AAC 80.055 to AWIA Section 2013

All CWS' serving 1,000 or more individuals were required to conduct a Vulnerability Assessment and complete an Emergency Response Plan in 2012. With the new AWIA requirement, Vulnerability Assessments (VA) are now referred to as Risk Assessments (RA). NOTE: The existing VA/ERP templates generated by the Drinking Water Program are not compliant with the AWIA regulation. As such, CWS' must ensure all AWIA requirements (indicated below) are included in the RA/ERP. The items in bold indicate new requirements.

AWIA Section 2013 Requirements

Risk and Resilience Assessment Requirements

1. The risk to the system from malevolent acts and natural hazards.

2. The resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system.

3. The monitoring practices of the system.

4. The financial infrastructure of the system.

5. The use, storage, or handling of various chemicals by the system.

6. The operation and maintenance of the system.

Emergency Response Plan Requirements

1. Strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system.

2. Plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water.

3. Actions, procedures and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes and construction of flood protection barriers.

4. Strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.

Refer to the Resources tab for additional tools available for CWS' that help ensure compliance with these requirements.

CWS' are required to review and/or create the RA/ERP and submit a certification to the EPA that the assessment has been reviewed and, if necessary, revised. There are three ways systems can submit their certifications, as specified below:

Please note, CWS' are also required to submit a recertification to the EPA that the assessment has been reviewed and, if necessary, revised every 5 years.

• Online Certification: This is the preferred method for certifying the RA and ERP are complete. By certifying online, the CWS will receive an acknowledgment of receipt CWS owners can keep for their records. They will also be able to certify the RA and ERP at the same time. Additionally, the CWS will be given the option choose if the VA (submitted under the Bioterrorism Act of 2002) should be returned to the system or destroyed.
  CWS will receive notification emails when the CWS must re-certify the RA/ERP in 5 years. To certify online, the CWS must either create a new EPA CDX account, or use an existing CDX account.

• • Electronic Certification Process for Completion
• Email: Systems can choose to complete the Risk and Resilience Assessment or Emergency Response Plan certification statement pdf form (below) and email a signed copy to: awiasupport@epacdx.net. In the email subject line, please state "Risk and Resilience Assessment certification statement" or "Emergency Response Plan certification statement," along with your PWSID number.
• Mail: Systems can choose to print, and sign the Risk and Resilience Assessment or Emergency Response Plan certification statement pdf form (below) and mail this version to the following address:

• U.S. EPA Data Process Center
• ATTN: AWIA
• C/O CGI Federal
• 12601 Fair Lakes Circle
• Fairfax, VA 220033

• Risk and Resilience Assessment Certification Statement
• Emergency Response Plan Certification Statement

• For AWIA Second 2013 or 2018 questions, (including questions regarding VSAT Web 2.0 or the Emergency Response Plan Guidance and template) please email EPA at dwresilience@epa.gov. For specific questions related to Emergency Planning and Community Right-to-Know Act (EPCRA), reach out to EPA's Regional EPCRA contacts at: https://www.epa.gov/epcra/epcra-regional-contacts

• No, AWIA does not require the use of any standards, methods or tools for development of the RA and ERP. That being said, the resulting RA and ERP must contain/address all the items identified within the AWIA Section 2013 requirements. Refer to the Components of RA/ERP tab for a complete list of items to include.

• No, the existing VA/ERP templates generated by the Drinking Water Program are not compliant with the AWIA regulation. Refer to the Components of RA/ERP tab for a complete list of items to include.

• Any designated representative can conduct the Risk Assessment and complete the Emergency Response Plan.

• No, the CWS is not required to submit their certification to the Drinking Water Program. However, we ,at the state, ask that you notify us (via email) when you have submitted your certification to EPA.

• No, you do not have to submit your written ERP to EPA. You are only required to submit a certification form verifying you have completed a RA and ERP (available under the Certification tab).

• The EPA intends to destroy VAs submitted in response to the Bioterrorism Act of 2002. However, if utilities would like to have their VA and certification documents mailed to them, contact WSD-Outreach@epa.gov, and on utility letterhead, include the utility name, PWSID, address, and point of contact as an attachment to the email. Or, when you submit your certification online, users will be asked if they want the VA returned or destroyed.

Trainings

Overview Webinars: EPA has provided recorded versions of AWIA workshops held since 2019, click on Workshops.

Tools

• The Baseline Threat Document: Helps CWS' identify malevolent acts to include in their risk assessments and identify threat likelihood.
• Vulnerability Self-Assessment Tool 2.0 - VSAT Web 2.0: Will guide CWS' through a risk and resilience assessment that complies with AWIA Section 2013.
• ERP Template and Instructions: A single PDF document provides guidance on what information should be provided in each section of the ERP template.
• Incident Action Checklists for Water Utilities: Drinking water and wastewater utilities can use these twelve "rip & run" style checklists to help with emergency preparedness, response and recovery activities.
• Emergency Response Plan Certification Statement: Used by CWS' to certify completion of the Risk and Resilience Assessment and Emergency Response Plan.
• America’s Water Infrastructure Act: Risk Assessments and Emergency Response Plans: Webpage for more information.
• AWIA Risk Assessment and Emergency Response Plan Fact Sheet