U S EPA Updated Risk Assessment and Emergency

U. S. EPA Updated Risk Assessment and Emergency Response Plan Tools August 14, 2019 2: 00 – 3: 30 pm EDT 1

Speakers • Nushat Dyson, Team Leader • Dan Schmelling, Environmental Engineer • Brian Pickard, Environmental Engineer • Dawn Ison, Geologist 2

Agenda • AWIA Section 2013 Overview • • • Risk and Resilience Assessment Requirements Vulnerability Self-Assessment Tool Emergency Response Plan Requirements Emergency Response Plan Guidance and Template Online Certification System In-Person Training Opportunities • AWIA Section 2018 • Q/A Session 3 This Photo by Unknown Author is licensed under CC BY-NC-ND

Overview AWIA Section 2013 (a) – (f) Replaces SDWA Section 1433 (from 2002 Bioterrorism Act) Applies to all community water systems serving more than 3, 300 people Conduct Risk and Resilience Assessments and update Emergency Response Plans Submit certifications to EPA by specified deadlines Review risk assessments and ERPs every five years Coordinate with local emergency planning committees Maintain records 4

Certification Due Dates Risk Assessment Population served ≥ 100, 000 March 31, 2020 Population served 50, 00099, 999 December 31, 2020 Population served 3, 301 -49, 999 June 30, 2021 Emergency Response Plan (ERP) Certify ERP not later than 6 months after completion of the risk assessment 5

Risk and Resilience Assessments 6

Risk and Resilience Assessments Consider risks from malevolent acts and natural hazards Pipes/conveyances, source water, water collection/intake, pretreatment, storage and distribution, electronic, computer, or other automated systems (including security) 7 Include: Monitoring practices Financial infrastructure May include capital and Use, storage Operation and operational or handling of maintenance needs for risk chemicals management

Use of Previous Risk Assessment and ERP • A CWS may use a risk assessment or ERP developed prior to enactment of the AWIA. • To meet certification requirements, a previous risk assessment or ERP must: • Include all assessment or response components listed in the law. • Reflect the current condition of the CWS. • If required assessment or response components have been omitted, the CWS may add those components. • If the CWS has undergone modifications, the CWS may update the risk assessment or ERP where needed. 8

Baseline Information on Malevolent Acts Relevant to CWS • What is the purpose of this document? (1) Help water systems identify malevolent acts to include in their risk assessments • AWIA risk assessments must include both natural hazards and malevolent acts (2) Help water systems estimate threat likelihood for malevolent acts • Why is this document needed? • Assessing risk from a malevolent act to a water system asset requires estimating three parameters: (1) Threat likelihood: the annual probability that a perpetrator will attempt to carry out the malevolent act against the facility; (2) Vulnerability: the probability that the malevolent act will have an adverse impact on the facility; and (3) Consequences: the public health and economic consequences resulting from the impact of the malevolent act on the facility. • Threat likelihood for a malevolent act is the most difficult risk parameter to estimate because it requires projecting the actions of a perpetrator. • For water systems, the difficulty of estimating malevolent threat likelihood can be a barrier to including malevolent threats in risk assessments. 9

How The Baseline Threat Document Helps You? • Combines many specific reference attacks from J 100 -10 Standard into a smaller number of broader threat categories • The analyst can define more specific threats within an assessment • New Approach! Provides order-of-magnitude likelihood estimates for malevolent acts • These optional threat likelihood values can be a starting point to help water systems estimate site-specific values • The estimates are based on the national frequency of reported incidents and public intelligence information, which can indicate the likelihood of different malevolent acts. • Identifies factors that may increase or decrease the likelihood of malevolent acts at a specific facility • Will assist CWSs with evaluating the application of the provided threat likelihood values to their facilities and with identifying potential areas for security improvements • Lists resources for additional information about malevolent acts that may impact CWS facilities Document is available at https: //www. epa. gov/waterriskassessment/baselineinformation-malevolent-acts-community-water-systems. 10

Vulnerability Self-Assessment Tool Web 2. 0 • VSAT Web 2. 0 can guide you through a risk and resilience assessment that complies with AWIA Section 2013. • Designed for mobile devices like tablets and i. Pads as well as PCs. • Includes embedded tools that assist with estimating risk assessment parameters and resilience. 11

How Does VSAT Web 2. 0 Help You? • Provides a step-by-step process with embedded tools and values to guide you through an AWIA-compliant risk assessment. • A VSAT risk assessment can be tailored to be simple or complex depending on the needs and resources of the analyst • Helps you identify the malevolent acts and natural hazards that present the highest risk to critical water system assets • Utility risk-reduction efforts can be targeted to address the greatest threats • Supports an optional cost-benefit analysis of additional countermeasures to reduce risk and enhance resilience • Results can target security expenditures to provide the greatest risk-reduction benefit, as well as justify the allocation of new security resources 12

Emergency Response Plans 13

Emergency Response Plans Prepare or revise an ERP that incorporates findings from the risk assessment Include: Strategies and resources to improve resilience, including physical security and cybersecurity 14 Plans, procedures, and equipment for responding to a malevolent act or natural hazard Actions, procedures, and equipment to lessen the impact of a malevolent act or natural hazard, including alternative source water, relocation of intakes, and flood protection barriers Strategies to detect malevolent acts or natural hazards

Preparing for ERP Development 1. Conduct a risk and resilience assessment. 2. Identify state regulatory requirements. 3. Identify and integrate local plans. 4. Coordinate with Local Emergency Planning Committees (LEPCs) and response partners. 5. Plan for resources. 15

Emergency Response Plan Template and Instructions • The ERP template and instructions assists water utilities with developing an ERP in accordance with AWIA Section 2013(b). • A single PDF document provides guidance on what information should be provided in each section of the ERP template. • Includes useful links for additional information and guidance. • A blank ERP template in Word format is embedded in the PDF document and can be easily accessed and modified to meet your own utilities needs. • The user-friendly template features fillable tables, checklists and charts to use as a starting point for utilities to develop their own plans. 16

ERP Template Outline • Utility Information • Resilience Strategies • Emergency Plans and Procedures • Mitigation Actions • Detection Strategies 17

Utility Information • During an incident, you need to have system information about your water utility readily available for your personnel, first responders, repair contractors/vendors, the media, and other response partner agencies, including: • • 18 Utility Overview Personnel Information Primary Utility Components Industry Chemical Handling & Storage Facilities Safety Response Resources Key Local Services

Utility Information-Template Example (1) 19

Resilience Strategies • This section of your ERP should contain strategies and resources to improve the resilience of your system, including: • Emergency Response Roles • Incident Command System (ICS) Roles • Communication (e. g. , internal, external, critical customers, equipment) • Media Outreach & Risk Communication • Public Notification Resilience strategies incorporate how you will assign roles and responsibilities, how you will work with response partners, and how you intend to communicate during an incident. 20

Resilience Strategies-Template Example 21

Emergency Plans & Procedures • This section of your ERP should contain plans, procedures, and equipment that can be used in the event of a malevolent act or natural hazard that threatens your utility’s ability to deliver safe drinking water. • Two types of emergency response plans and procedures should be considered as part of your ERP: • Core Response Procedures • Incident-Specific Response Procedures (ISRPs) 22

Core Response Procedures • Core procedures are the “building blocks” for incident-specific procedures, since they apply across a broad variety of incidents (e. g. , hurricane, earthquake, flood). • Core procedures include: • • 23 Access Physical Security Cybersecurity Power Loss Emergency Alternate Drinking Water Supplies Sampling & Analysis Family and Utility Personnel Well Being

Core Procedures-Template Example 24

ISRPs • ISRPs are specialized procedures tailored to a particular type of incident and typically align with those vulnerabilities identified in your risk assessment. • They provide a quick approach for responding to a specific incident and complement actions already initiated under your ERP. 25 Cyber-Attack Hurricane Drought Tornado Earthquake Tsunami Extreme Cold/Winter Storms Volcanic Activity Extreme Heat Wildfire Flooding Source Water Contamination Harmful Algal Blooms Distribution System Contamination

ISRPs-Template Example https: //www. epa. gov/waterutilityresponse/incident-action-checklistswater-utilities 26

Mitigation Actions • This section of your ERP should include actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to your community and individuals, including: • Development of alternative source water options • Relocation of water intakes • Construction of flood protection barriers • These mitigation actions, procedures, and equipment help your utility to better withstand rapidly recover from incidents (e. g. , flooding, earthquake), thereby increasing overall resilience. 27

Mitigation Actions-Template Example 28

Detection Strategies • This section of your ERP should contain strategies that can aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of your utility. • These detection strategies can be almost no-cost (e. g. , instituting a “See Something, Say Something” campaign at your utility) or require more resources (e. g. , installing motion sensors and video cameras to monitor facility break-ins or tampering) to implement. • Effective response to an emergency requires timely detection, which allows your utility to implement its ERP as soon as possible. 29

Detection Strategies (cont. ) • Examples of effective strategies for detecting common threats include: Unauthorized Entry Water Contamination Cyber Intrusion Hazardous Chemical Release • Natural Hazards • Power Outages • • 30

Certify Your Risk Assessment/Emergency Response Plan 31

Three Ways to Certify 1. Electronic Submission (preferred method) 2. Email 3. Regular Mail 32

Electronic Submission Easy-to use, reminders provided • STEP 1: Account Registration • New users will need to establish username and password. • Previous users will go to the next step. • • STEP 2: Enter PWSID Number STEP 3: Accept Terms and Conditions STEP 4: Build Account Profile STEP 5: Confirm and Select Organization/Community Water System Information • Select listed water system. • Search for your system or enter a new organization. 33

Electronic Submission • STEP 6: Validate Your Email. • STEP 7: Select the certification that you are about to complete Certify Your Risk and Resilience Assessment OR Certify Your Emergency Response Plan. • STEP 8: Read certification statement and select Certify Now. • You can print this page as record for your files. • You will receive an email acknowledgement from U. S. EPA that your certification is complete. • STEP 9: Choose final disposition of Vulnerability Assessments submitted to US EPA under the Bioterrorism Act of 2002. • Permanent disposal by EPA, returned to your or not applicable. • STEP 10: Future login with username and password to certify remaining document or recertify in 5 years. 34

Email Submission • Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www. epa. gov/waterresilience. • Email statement to awiasupport@epacdx. net. 35

Mail Submission • Complete the Risk and Resilience Assessment Certification Statement or Emergency Response Plan Certification Statement fillable pdf provided online at www. epa. gov/waterresilience. • Mail statement to the following address: U. S. EPA Data Process Center ATTN: AWIA C/O CGI Federal 12601 Fair Lakes Circle Fairfax, VA 22033 36

https: //www. epa. gov/waterresilience/americas-water-infrastructure-act-2018 -riskassessments-and-emergency-response-plans 37

Compliance Resources 38 Baseline Threat Guidance Document Vulnerability-Self Assessment Tool (update) Emergency Response Plan Guidance & Template (update) Technical Assistance Primer (new resource for technical assistance providers)

Outreach and Communications Efforts Overview Webinars - 8/22/2019 - 9/5/2019 Registration open @ https: //www. epa. gov/waterresilience/americas-waterinfrastructure-act-2018 -risk-assessments-and-emergency-response-plans#TNG Fact Sheet Posted @ https: //www. epa. gov/waterresilience/overview-new-risk-assessment-andemergency-response-plan-requirements-community Video Available in Fall 2019 Training Requirements overview presentation available online now Detailed in-person and web-accessible full-day training registration now open 39

Technical Assistance Primer 40

41

FAQs 1. Can another standard such as PARRE or a state standard be used to comply with the risk assessment requirements? AWIA does not require the use of any standards, methods or tools for the risk and resilience assessment or emergency response plan. Your utility is responsible for ensuring that the risk and resilience assessment and emergency response plan address all the criteria in AWIA Section 2013(a) and (b), respectively. The U. S. EPA recommends the use of standards, including AWWA J 100 -10 Risk and Resilience Management of Water and Wastewater Systems, along with the U. S. EPA Vulnerability Self. Assessment Tool and other organizations, to facilitate sound risk and resilience assessments and emergency response plans. 2. How soon can I submit a certification? We are asking utilities to conduct their certification no earlier than August 1, 2019, when the online certification process is available. 3. Will USEPA still be providing explicit guidance for increased resiliency to these smaller water systems? (e) Guidance To Small Public Water Systems. —The Administrator shall provide guidance and technical assistance to community water systems serving a population of less than 3, 300 persons on how to conduct resilience assessments, prepare emergency response plans, and address threats from malevolent acts and natural hazards that threaten to disrupt the provision of safe drinking water or significantly affect the public health or significantly affect the safety or supply of drinking water provided to communities and individuals. 42

FAQs 4. Is there funding available for conducting the risk assessment? Currently, there is not one stream of funding that is designated specifically to address the new risk assessment requirement. However, the Drinking Water State Revolving Fund program can be used to conduct a risk assessment since it addresses resilience of the system and the risk assessment may yield a project that the utility may want to invest in to improve the overall system resilience. Both parts of the program can be used. Each state will manage this differently. Please check with your state to see if they have set aside funds for this function specifically either with direct contractor or with reimbursements. 5. Who is qualified to certify a risk assessment or emergency response plan? Any designated utility representative. 6. How are you determining the population sizes for utilities? U. S. EPA is using the SDWIS database to determine the population size served by each utility and the corresponding deadline. 43

AWIA Section 2013 In-Person & Web Accessible Training • EPA Region 1 – 11/5/2019 Location: Chelsea, MA • EPA Region 6 – 10/8/2019 Location: Addison, TX • EPA Region 2 – 10/18/2019 Location: New York, NY • EPA Region 7 – 11/7/2019 Location: Lenexa, KS • EPA Region 3 – 10/16/2019 & 11/1/2019 • EPA Region 8 – 10/10/2019 Location: Pittsburgh, PA & Annapolis, MD Location: Denver, CO • EPA Region 4 – 11/15/2019 Location: Atlanta, GA • EPA Region 9 – 9/12/2019 Location: San Francisco, CA • EPA Region 5 – 10/29/2019 Location: Chicago, IL • EPA Region 10 – 9/11/2019 Location: Seattle, WA Visit https: //www. epa. gov/waterresilience/americas-water-infrastructure-act-2018 -risk-assessments-andemergency-response-plans#TNG to access registration links. 44

AWIA Section 2018 45

Emergency Notification Amends Emergency Planning and Community Right-to-Know Act (EPCRA) Section 304 to add: (e)(1) Applicable State Agency Notification (e)(2) Community Water System Notification 46

SERC (or TERC) Notification Requirements Promptly, the State or Tribal Emergency Response Commission (SERC or TERC) shall: • Notify the applicable State agency (i. e. , the drinking water primacy agency) of any reportable release of an EPCRA extremely hazardous substance (Appendices A and B of 40 CFR Part 355) or a CERCLA hazardous substance (40 CFR Part 302. 4(a)). • Reportable release: releases that exceed established reportable quantities within a 24 -hour period. 47

SERC (or TERC) Notification Requirements The SERC or TERC will provide the drinking water primacy agency with the following information: • • 48 The chemical name or identity of any substance involved. An indication of whether the substance is on the EHS list. An estimate of the quantity of any such substance that was released into the environment. The time and duration of the release. The medium or media into which the release occurred. Any known or anticipated acute or chronic health risks associated with the emergency and advice regarding medical attention necessary for exposed individuals. Proper precautions to take, including evacuation. The name and telephone number of the person or persons to be contacted for further information.

SERC (or TERC) Notification Requirements As soon a practicable, the SERC (or TERC) shall provide the drinking water primacy agency a written follow-up notice: • The written notice shall provide updates to the information provided in the original notification, as well as additional information with respect to: • Actions taken to respond to and contain the release; • Any known or anticipated acute or chronic health risks; and • Where appropriate, advice regarding medical attention necessary for exposed individuals. 49

Primacy Agency Notification Requirements Notice to Community Water Systems The drinking water primacy agency receiving notice from a SERC (or TERC) shall: • Promptly forward the initial notice, and all information provided, to any community water systems whose source waters are affected by the release. • Forward the written follow-up emergency notice provided to the affected community water systems. 50

Direct Notification: Notice to Community Water Systems If a state does not have a drinking water primacy agency: • The SERC (or TERC) shall provide the required notices and information to the community water systems affected by the release. 51

Chemical Inventory Data Availability Amends EPCRA Section 312(e) to add Community Water Systems 52

Chemical Inventory Data Availability AWIA Sec 2018(b) amends EPCRA Sec 312 • Requires SERCs (or TERCs) and LEPCs (or TEPCs) to provide affected* community water systems with chemical inventory data submitted under Tier 2 of EPCRA for their source water area, upon request from the system. * One or more community water systems (as defined in SDWA Section 1401(15)) that receives supplies of drinking water from a source water protection area delineated under SDWA Section 1453, in which a facility that is required to prepare and submit an inventory form under EPCRA Section 312 is located. 53

Questions? 54

Post Webinar Action Items üJoin the EPA Water Security Division mailing list to receive updates and other information. üConduct your risk and resilience assessment. üUpdate or develop your emergency response plan. üRegister for one of our in-person/web-accessible trainings to learn more about the AWIA Section 2013 and 2018 requirements. 55

Thank you! Nushat Dyson Dan Schmelling dyson. nushat@epa. gov schmelling. dan@epa. gov Jeffrey Fencil Curt Baranowski fencil. Jeffrey@epa. gov baranowski. curt@epa. gov Dawn Ison ison. dawn@epa. gov Visit www. epa. gov/waterresilience for more information. 56