Developing a Security Program

1. Developing a Security Program

2. Developing a Security Program Develop/Update Plan Exercise Plan Review/Revisit Plan

3. Developing a Security Program • Understanding One Size Does Not Fit All • The Importance of Being Prepared • Why Communication is the Key • Ten Key Security Program Principals • What Resources Are Available

4. Treatment Distribution & Storage Customer Source water One Size Does Not Fit All • Utility security programs should achieve consistent outcomes using utility-specific strategies. • Implement approaches that are tailored to your utilities’ circumstances and operating conditions.

6. Security Program Scope • Active and effective security programs should address: • protection of public health • public safety (including infrastructure) • and public confidence

8. Significant System Failures • An active and effective security program should consider: • Loss of pressure for significant parts of the system. • Long term loss of supply, treatment, or distribution system. • Adverse impacts to public health or confidence resulting from a contamination threat or incident.

10. Key Threats or Methods of Attack When developing an active and effective security program you should consider: • Physical targeting of core facilities or independent infrastructure • Chemical or biological material used to contaminate water supplies • Cyber attack on technology assets to disrupt services

11. “All hoaxes must be treated as actual events until proven otherwise”

12. A Part of Being Prepared • Commitment to security • Promote security awareness • Up-to-date assessment of vulnerabilities • Dedicate security resources and security implementation priorities • Define security roles and employee expectations

14. Being Prepared Continued • Intrusion detection and access control for the physical plant, and/or at the source(s) • Contamination detection • Information protection and continuity • Design and construction • Threat level-based protocols

16. Communication is the Key • Emergency response and recovery plans should incorporate security considerations and be tested and reviewed regularly. • Internal and external communications. • Partnerships

18. 10 Key Security Principles • Security should be part of your utility’s day-to-day thinking. • A strong commitment to security is key. • There are always ways to improve security. • Prevention is a key aspect of enhancing security. • Movement towards practices that are inherently safer.

19. 10 Key Security Principles • Ongoing management and monitoring, and budget commitment. • Security issues should be a factor in building plans and design. • Security may not be convenient. • Build strong relationships with response partners and the public. • You have to put a price on security.

20. Resources • Technical Assistance Providers • National Environmental Services Center • www.nesc.wvu.edu • National Rural Water Association • www.nrwa.org • Rural Community Assistance Partnership • www.rcap.org • Safe Drinking Water Trust – eBulletin • www.watertrust.org

21. Additional Resources • American Water Works Association • www.awwa.org • Association of State Drinking Water Administrators • www.asdwa.org • National Drinking Water Clearing House • www.ndwc.wvu.edu • U.S. Environmental Protection Agency • www.epa.gov