U.S. EPA Updated Risk Assessment and Emergency Response Plan Tools

1. U.S. EPA Updated Risk Assessment and Emergency Response Plan Tools August 14, 2019 2:00 – 3:30pm EDT

2. Speakers • Nushat Dyson, Team Leader • Dan Schmelling, Environmental Engineer • Brian Pickard, Environmental Engineer • Dawn Ison, Geologist

3. Agenda • AWIA Section 2013 Overview • Risk and Resilience Assessment Requirements • Vulnerability Self-Assessment Tool • Emergency Response Plan Requirements • Emergency Response Plan Guidance and Template • Online Certification System • In-Person Training Opportunities • AWIA Section 2018 • Q/A Session This Photo by Unknown Author is licensed under CC BY-NC-ND

4. Overview

5. Certification Due Dates Risk Assessment Emergency Response Plan (ERP) Certify ERP not later than 6 months after completion of the risk assessment

6. Risk and Resilience Assessments

7. Risk and Resilience Assessments

8. Use of Previous Risk Assessment and ERP • A CWS may use a risk assessment or ERP developed prior to enactment of the AWIA. • To meet certification requirements, a previous risk assessment or ERP must: • Include all assessment or response components listed in the law. • Reflect the current condition of the CWS. • If required assessment or response components have been omitted, the CWS may add those components. • If the CWS has undergone modifications, the CWS may update the risk assessment or ERP where needed.

9. Baseline Information on Malevolent Acts Relevant to CWS • What is the purpose of this document? (1) Help water systems identify malevolent acts to include in their risk assessments • AWIA risk assessments must include both natural hazards and malevolent acts (2) Help water systems estimate the threat likelihood for malevolent acts • Why is this document needed? • Assessing risk from a malevolent act to a water system asset requires estimating three parameters: • Threat likelihood: the annual probability that a perpetrator will attempt to carry out the malevolent act against the facility; • Vulnerability: the probability that the malevolent act will have an adverse impact on the facility; and • Consequences: the public health and economic consequences resulting from the impact of the malevolent act on the facility. • Threat likelihood for a malevolent act is the most difficult risk parameter to estimate because it requires projecting the actions of a perpetrator. • For water systems, the difficulty of estimating malevolent threat likelihood can be a barrier to including malevolent threats in risk assessments.

10. How The Baseline Threat Document Helps You? • Combines many specific reference attacks from J100-10 Standard into a smaller number of broader threat categories • The analyst can define more specific threats within an assessment • New Approach!Provides order-of-magnitude likelihood estimates for malevolent acts • These optional threat likelihood values can be a starting point to help water systems estimate site-specific values • The estimates are based on the national frequency of reported incidents and public intelligence information, which can indicate the likelihood of different malevolent acts. • Identifies factors that may increase or decrease the likelihood of malevolent acts at a specific facility • Will assist CWSs with evaluating the application of the provided threat likelihood values to their facilities and with identifying potential areas for security improvements • Lists resources for additional information about malevolent acts that may impact CWS facilities Document is available at https://www.epa.gov/waterriskassessment/baseline-information-malevolent-acts-community-water-systems.

11. Vulnerability Self-Assessment Tool Web 2.0 • VSAT Web 2.0 can guide you through a risk and resilience assessment that complies with AWIA Section 2013. • Designed for mobile devices like tablets and iPads as well as PCs. • Includes embedded tools that assist with estimating risk assessment parameters and resilience. New Version Available

12. How Does VSAT Web 2.0 Help You? • Provides a step-by-step process with embedded tools and values to guide you through an AWIA-compliant risk assessment. • A VSAT risk assessment can be tailored to be simple or complex depending on the needs and resources of the analyst • Helps you identify the malevolent acts and natural hazards that present the highest risk to critical water system assets • Utility risk-reduction efforts can be targeted to address the greatest threats • Supports an optional cost-benefit analysis of additional countermeasures to reduce risk and enhance resilience • Results can target security expenditures to provide the greatest risk-reduction benefit, as well as justify the allocation of new security resources

13. EmergencyResponse Plans

14. Emergency Response Plans

15. Preparing for ERP Development • Conduct a risk and resilience assessment. • Identify state regulatory requirements. • Identify and integrate local plans. • Coordinate with Local Emergency Planning Committees (LEPCs) and response partners. • Plan for resources.

16. Emergency Response Plan Template and Instructions • The ERP template and instructions assists water utilities with developing an ERP in accordance with AWIA Section 2013(b).  • A single PDF document provides guidance on what information should be provided in each section of the ERP template. • Includes useful links for additional information and guidance. • A blank ERP template in Word format is embedded in the PDF document and can be easily accessed and modified to meet your own utilities needs.  • The user-friendly template features fillable tables, checklists and charts to use as a starting point for utilities to develop their own plans.

17. ERP Template Outline • Utility Information • Resilience Strategies • Emergency Plans and Procedures • Mitigation Actions • Detection Strategies

18. Utility Information • During an incident, you need to have system information about your water utility readily available for your personnel, first responders, repair contractors/vendors, the media, and other response partner agencies, including: • Utility Overview • Personnel Information • Primary Utility Components • Industry Chemical Handling & Storage Facilities • Safety • Response Resources • Key Local Services

19. Utility Information-Template Example (1)

20. Resilience Strategies • This section of your ERP should contain strategies and resources to improve the resilience of your system, including: • Emergency Response Roles • Incident Command System (ICS) Roles • Communication (e.g., internal, external, critical customers, equipment) • Media Outreach & Risk Communication • Public Notification Resilience strategies incorporate how you will assign roles and responsibilities, how you will work with response partners, and how you intend to communicate during an incident.

21. Resilience Strategies-Template Example

22. Emergency Plans & Procedures • This section of your ERP should contain plans, procedures, and equipment that can be used in the event of a malevolent act or natural hazard that threatens your utility’s ability to deliver safe drinking water. • Two types of emergency response plans and procedures should be considered as part of your ERP: • Core Response Procedures • Incident-Specific Response Procedures (ISRPs)

23. Core Response Procedures • Core procedures are the “building blocks” for incident-specific procedures, since they apply across a broad variety of incidents (e.g., hurricane, earthquake, flood). • Core procedures include: • Access • Physical Security • Cybersecurity • Power Loss • Emergency Alternate Drinking Water Supplies • Sampling & Analysis • Family and Utility Personnel Well Being

24. Core Procedures-Template Example

25. ISRPs • ISRPs are specialized procedures tailored to a particular type of incident and typically align with those vulnerabilities identified in your risk assessment. • They provide a quick approach for responding to a specific incident and complement actions already initiated under your ERP.

26. ISRPs-Template Example https://www.epa.gov/waterutilityresponse/incident-action-checklists-water-utilities

27. Mitigation Actions • This section of your ERP should include actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to your community and individuals, including: • Development of alternative source water options • Relocation of water intakes • Construction of flood protection barriers • These mitigation actions, procedures, and equipment help your utility to better withstand and rapidly recover from incidents (e.g., flooding, earthquake), thereby increasing overall resilience.

28. Mitigation Actions-Template Example

29. Detection Strategies • This section of your ERP should contain strategies that can aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of your utility. • These detection strategies can be almost no-cost (e.g., instituting a “See Something, Say Something” campaign at your utility) or require more resources (e.g., installing motion sensors and video cameras to monitor for facility break-ins or tampering) to implement. • Effective response to an emergency requires timely detection, which allows your utility to implement its ERP as soon as possible.

30. Detection Strategies (cont.) • Examples of effective strategies for detecting common threats include: • Unauthorized Entry • Water Contamination • Cyber Intrusion •  Hazardous Chemical Release • Natural Hazards • Power Outages

31. Certify Your Risk Assessment/Emergency Response Plan

32. Three Ways to Certify • Electronic Submission (preferred method) • Email • Regular Mail

33. Electronic SubmissionEasy-to use, reminders provided • STEP 1: Account Registration • New users will need to establish username and password. • Previous users will go to the next step. • STEP 2: Enter PWSID Number • STEP 3: Accept Terms and Conditions • STEP 4: Build Account Profile  • STEP 5: Confirm and Select Organization/Community Water System Information • Select listed water system. • Search for your system or enter a new organization.

34. Electronic Submission • STEP 6: Validate Your Email.  • STEP 7: Select the certification that you are about to complete Certify Your Risk and Resilience AssessmentORCertify Your Emergency Response Plan. • STEP 8: Read certification statement and select Certify Now. • You can print this page as record for your files. • You will receive an email acknowledgement from U.S. EPA that your certification is complete. • STEP 9: Choose final disposition of Vulnerability Assessments submitted to US EPA under the Bioterrorism Act of 2002. • Permanent disposal by EPA, returned to your or not applicable. • STEP 10: Future login with username and password to certify remaining document or recertify in 5 years. 

35. Email Submission • Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www.epa.gov/waterresilience.  • Email statement to awiasupport@epacdx.net.

36. Mail Submission • Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www.epa.gov/waterresilience.  • Mail statement to the following address: U.S. EPA Data Process Center ATTN: AWIA C/O CGI Federal 12601 Fair Lakes Circle Fairfax, VA 22033

37. https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-planshttps://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-plans

38. Compliance Resources

39. Outreach and Communications Efforts

40. TechnicalAssistance Primer

42. FAQs 1. Can another standard such as PARRE or a state standard be used to comply with the risk assessment requirements? AWIA does not require the use of any standards, methods or tools for the risk and resilience assessment or emergency response plan. Your utility is responsible for ensuring that the risk and resilience assessment and emergency response plan address all the criteria in AWIA Section 2013(a) and (b), respectively. The U.S. EPA recommends the use of standards, including AWWA J100-10 Risk and Resilience Management of Water and Wastewater Systems, along with the U.S. EPA Vulnerability Self-Assessment Tool and other organizations, to facilitate sound risk and resilience assessments and emergency response plans. 2. How soon can I submit a certification? We are asking utilities to conduct their certification no earlier than August 1, 2019, when the online certification process is available. 3. Will USEPA still be providing explicit guidance for increased resiliency to these smaller water systems? (e) Guidance To Small Public Water Systems.—The Administrator shall provide guidance and technical assistance to community water systems serving a population of less than 3,300 persons on how to conduct resilience assessments, prepare emergency response plans, and address threats from malevolent acts and natural hazards that threaten to disrupt the provision of safe drinking water or significantly affect the public health or significantly affect the safety or supply of drinking water provided to communities and individuals.

43. FAQs 4. Is there funding available for conducting the risk assessment? Currently, there is not one stream of funding that is designated specifically to address the new risk assessment requirement. However, the Drinking Water State Revolving Fund program can be used to conduct a risk assessment since it addresses resilience of the system and the risk assessment may yield a project that the utility may want to invest in to improve the overall system resilience. Both parts of the program can be used. Each state will manage this differently. Please check with your state to see if they have set aside funds for this function specifically either with direct contractor or with reimbursements. 5. Who is qualified to certify a risk assessment or emergency response plan? Any designated utility representative. 6. How are you determining the population sizes for utilities? U.S. EPA is using the SDWIS database to determine the population size served by each utility and the corresponding deadline.

44. AWIA Section 2013 In-Person & Web Accessible Training Visit https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-plans#TNG to access registration links. • EPA Region 1 – 11/5/2019 Location: Chelsea, MA • EPA Region 2 – 10/18/2019 Location: New York, NY • EPA Region 3 – 10/16/2019 & 11/1/2019 Location: Pittsburgh, PA & Annapolis, MD • EPA Region 4 – 11/15/2019 Location: Atlanta, GA • EPA Region 5 – 10/29/2019 Location: Chicago, IL • EPA Region 6 – 10/8/2019 Location: Addison, TX • EPA Region 7 – 11/7/2019 Location: Lenexa, KS • EPA Region 8 – 10/10/2019 Location: Denver, CO • EPA Region 9 – 9/12/2019 Location: San Francisco, CA • EPA Region 10 – 9/11/2019 Location: Seattle, WA

45. AWIA Section 2018

46. EmergencyNotification

47. SERC (or TERC) Notification Requirements Promptly, the State or Tribal Emergency Response Commission (SERC or TERC) shall: • Notify the applicable State agency (i.e., the drinking water primacy agency) of any reportable release of an EPCRA extremely hazardous substance (Appendices A and B of 40 CFR Part 355) or a CERCLA hazardous substance (40 CFR Part 302.4(a)). • Reportable release: releases that exceed established reportable quantities within a 24-hour period.

48. SERC (or TERC) Notification Requirements The SERC or TERC will provide the drinking water primacy agency with the following information: • The chemical name or identity of any substance involved. • An indication of whether the substance is on the EHS list. • An estimate of the quantity of any such substance that was released into the environment. • The time and duration of the release. • The medium or media into which the release occurred. • Any known or anticipated acute or chronic health risks associated with the emergency and advice regarding medical attention necessary for exposed individuals. • Proper precautions to take, including evacuation. • The name and telephone number of the person or persons to be contacted for further information.

49. SERC (or TERC) Notification Requirements As soon a practicable, the SERC (or TERC) shall provide the drinking water primacy agency a written follow-up notice: • The written notice shall provide updates to the information provided in the original notification, as well as additional information with respect to: • Actions taken to respond to and contain the release; • Any known or anticipated acute or chronic health risks; and • Where appropriate, advice regarding medical attention necessary for exposed individuals.

50. Primacy Agency Notification Requirements Notice to Community Water Systems The drinking water primacy agency receiving notice from a SERC (or TERC) shall: • Promptly forward the initial notice, and all information provided, to any community water systems whose source waters are affected by the release. • Forward the written follow-up emergency notice provided to the affected community water systems.