Fillable Guidance For Small Community Water Systems On Risk And Resilence Assessments Under AWIA

Fill Online, Printable, Fillable, Blank Guidance For Small Community Water Systems On Risk And Resilence Assessments Under AWIA Form

Use Fill to complete blank online OTHERS pdf forms for free. Once completed you can sign your fillable form or send for signing. All forms are printable and downloadable.

Guidance For Small Community Water Systems On Risk And Resilence Assessments Under AWIA

On average this form takes 81 minutes to complete

The Guidance For Small Community Water Systems On Risk And Resilence Assessments Under AWIA form is 54 pages long and contains:

  • 0 signatures
  • 160 check-boxes
  • 249 other fields

Country of origin: OTHERS
File type: PDF

BROWSE OTHERS FORMS

Related forms
Fill has a huge library of thousands of forms all set up to be filled in easily and signed.
Fill in your chosen form
Sign the form using our drawing tool
Send to someone else to fill in and sign.
find another form
 
1
Who Should Use this Guidance?
• This guidance is intended for small community water systems (CWSs) serving greater than 3,300 but less
than 50,000 people to comply with the requirements for risk and resilience assessments under America’s
Water Infrastructure Act of 2018 (AWIA).
• For larger CWSs, EPA recommends the Vulnerability Self-Assessment Tool (VSAT) Web 2.0 or an alternate
risk assessment method.
• CWSs serving 3,300 or fewer people are not required to conduct risk and resilience assessments under
AWIA. EPA recommends, however, that very small CWSs use this or other guidance to learn how to conduct
risk and resilience assessments and address threats from malevolent acts and natural hazards that threaten
safe drinking water.
What is the Purpose of this Guidance?
• This guidance will help small CWSs meet the requirements for risk and resilience assessments in AWIA.
• This guidance does not address emergency response plans (ERPs), which are also required under AWIA for
CWSs serving more than 3,300 people.
• EPA has developed an Emergency Response Plan Template and Instructions for CWSs to comply
with AWIA.
• Further, this guidance does not cover all aspects of water system security and resilience, such as asset
management, climate change, and emergency preparedness and response. Visit EPA’s Drinking Water and
Wastewater Resilience page to nd more information.
What are the Risk and Resilience Assessments Requirements
in AWIA?
AWIA requires CWSs serving more than 3,300 people to assess the risks to and resilience of the system
to malevolent acts and natural hazards. The law species water system assets (e.g., infrastructure) that
the assessment must address. These assets are listed in Tables 1a – 10b in the Risk and Resilience Assessment
Checklist (see llable checklist below on page 4).
Water systems must certify to EPA that the system conducted the assessment not later than the following dates:
• March 31, 2020 for systems serving 100,000 or more
• December 31, 2020 for systems serving 50,000 or more but less than 100,000
Guidance for Small Community Water
Systems on Risk and Resilience Assessments
under America’s Water Infrastructure Act
Guidance for Small Community Water Systems on
Risk and Resilience Assessments under America’s Water Infrastructure Act
2
• June 30, 2021 for systems serving more than 3,300 but less than 50,000
NOTE: Water systems do not submit the actual assessment to EPA. Visit EPA’s informational page on How to
Certify Your Risk and Resilience Assessment or ERP for instructions. Every ve years, CWSs must review the
risk and resilience assessment, revise it as needed, and provide` a new certication to EPA.
What are Risk and Resilience in a Water System?
• Risk to critical infrastructure, including water systems, is a function of threat likelihood, vulnerability,
and consequence.
• Threat can be a malevolent act, like a cyber-attack or process sabotage, or a natural hazard, such as a
ood or hurricane.
• Threat likelihood is the probability that a malevolent act will be carried out against the water system
or that a natural hazard will occur.
• Vulnerability is a weakness that can be exploited by an adversary or impacted by a natural hazard. It is
the probability that if a malevolent act or a natural hazard occurred, then the water system would suer
signicant adverse impacts.
• Consequences are the magnitude of loss that would ensue if a threat had an adverse impact against a
water system. Consequences may include:
• Economic loss to the water system from damage to utility assets;
• Economic loss to the utility service area from a service disruption, and
• Severe illness or deaths that could result from water system contamination, a hazardous gas release,
or other hazard involving the water system.
• Resilience is the capability of a water system to maintain operations or recover when a malevolent act or a
natural hazard occurs.
• Countermeasures are steps that a water system implements to reduce risk and increase resilience. They
may include plans, equipment, procedures, and other measures.
How does a Community Water System Assess Risk and
Resilience Under AWIA?
Tables 1a – 10b in the Risk and Resilience Assessment Checklist (see llable checklist below on page 4) list the
categories of water system assets that you must assess under AWIA. In all tables (i.e., for all asset categories),
do the following:
1. Select only the malevolent acts from those listed in the table that pose a signicant risk to the asset
category at the CWS. You may write-in malevolent acts not listed in the table.
a. Focus the selection of malevolent acts on those that are prevalent in the United States (e.g., cyber-
attacks), can exploit vulnerabilities at the CWS (e.g., known security gaps), and have the potential for
signicant economic or public health consequences (e.g., contamination).
NOTE: EPA’s Baseline Information on Malevolent Acts Relevant to Community Water Systems assists
water systems with estimating the likelihood of these malevolent acts and provides resources for
additional information.
Guidance for Small Community Water Systems on
Risk and Resilience Assessments under America’s Water Infrastructure Act
3
2. For each malevolent act that you identify as a signicant risk, briey describe how the malevolent act could
impact the asset category at the CWS. Include major assets that might be damaged or disabled, water
service restrictions or loss, and public health impacts as applicable.
3. Select only the natural hazards from those listed in the table that may pose a signicant risk to the asset
category at the CWS. You may write-in natural hazards not listed in the table.
a. Focus the selection of natural hazards on those that are prevalent in the area where the water system
is located, may aect vulnerable water system infrastructure, and have the potential for signicant
economic or public health consequences related to the CWS.
4. For each natural hazard that you identify as a signicant risk, briey describe or provide examples of how
the hazard could impact the asset category at the CWS. Include major assets that might be damaged or
disabled, water service restrictions or loss, and public health impacts as applicable.
5. OPTIONAL Table 11 (Risk and Resilience Assessment Checklist, see below): Identify countermeasures
that the CWS could potentially implement to reduce risk from the malevolent acts and natural hazards that
you selected in in this assessment.
a. For malevolent acts, countermeasures are intended to deter, delay, detect, and respond to an attack.
b. For natural hazards, countermeasures are intended to prepare, respond, and recover from an event.
NOTE: A single countermeasure, such as emergency response planning or power resilience, may reduce risk
across multiple malevolent acts, natural hazards and asset categories.
Oce of Water (MC 140)
Complete the Risk and Resilience Assessment
Checklist here
EPA oers the Risk and Resilience Assessment Checklist in two formats. A llable PDF
format is provided on the pages that follow. This format has xed elds and may not
be changed by the user. Alternatively, a Word version may be accessed by clicking on
the icon below. The Word version may be changed by the user. The content of the
PDF and Word versions is the same. To access the Word version, the le must be
downloaded to your computer.
EPA 817-B-20-001 May 2020
Community Water System
Risk and Resilience Assessment
Risk and Resilience Assessment
Please ll in the information below.
Facility Name (if applicable):
PWSID:
Analyst Name(s):
Date of Analysis:
Analysis Notes:
4
Enter Community Water System Name
5
Risk and Resilience Assessment
Table 1a: Physical Barriers (Malevolent Acts)
1
Asset Category: Physical Barriers
Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include
fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access
control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Physical
in the left column that pose
Barriers asset category, briey describe in the right column how the malevolent act
a signicant risk to this
could impact this asset category at the CWS. Include eects on major assets, water
asset category at the CWS.
service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
2
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
1
In a risk assessment, physical barriers are usually treated as countermeasures, which reduce the risk of a threat to an asset, rather than being treated as
assets. However, under AWIA, a CWS must assess the risks to and resilience of physical barriers.
2
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: Physical Barriers
Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include
fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access
control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Physical
Barriers asset category, briey describe in the right column how the malevolent act
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
3
Other(s), enter below:
3
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
6
Enter Community Water System Name
Risk and Resilience Assessment
Table 1b: Physical Barriers (Natural Hazards)
4
Asset Category: Physical Barriers
Examples of Assets in this Category: Encompasses physical security in place at the CWS. Possible examples include
fencing, bollards, and perimeter walls; gates and facility entrances; intrusion detection sensors and alarms; access
control systems (e.g., locks, card reader systems); and hardened doors, security grilles, and equipment cages.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Physical
Barriers asset category, briey describe in the right column how the natural hazard
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
4
In a risk assessment, physical barriers are usually treated as countermeasures, which reduce the risk of a threat to an asset, rather than analyzed as
assets themselves. However, under AWIA, a CWS must assess the risks to and resilience of physical barriers.
7
Enter Community Water System Name
8
Risk and Resilience Assessment
Table 2a: Source Water (Malevolent Acts)
Asset Category: Source Water
Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible
examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Source
Water asset category, briey describe in the right column how the malevolent act
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
5
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
5
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: Source Water
Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible
examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Source
Water asset category, briey describe in the right column how the malevolent act
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
6
Other(s), enter below:
6
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
9
Enter Community Water System Name
10
Risk and Resilience Assessment
Table 2b: Source Water (Natural Hazards)
Asset Category: Source Water
Examples of Assets in this Category: Encompasses all sources that supply water to a water system. Possible
examples include rivers, streams, lakes, source water reservoirs, groundwater, and purchased water.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Source
Water asset category, briey describe in the right column how the natural hazard
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
Enter Community Water System Name
Risk and Resilience Assessment
Table 3a: Pipes and Constructed Conveyances, Water Collection, and Intake (Malevolent Acts)
Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake
Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a
source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and
associated pumps and pipes, aqueducts, and other conveyances.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Pipes
in the left column that pose
and Constructed Conveyances, Water Collection, and Intake asset category,
a signicant risk to this
briey describe in the right column how the malevolent act could impact this asset
asset category at the CWS.
category at the CWS. Include eects on major assets, water service, and public
health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
7
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
7
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
11
Enter Community Water System Name
12
Risk and Resilience Assessment
Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake
Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a
source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and
associated pumps and pipes, aqueducts, and other conveyances.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Pipes
and Constructed Conveyances, Water Collection, and Intake asset category,
briey describe in the right column how the malevolent act could impact this asset
category at the CWS. Include eects on major assets, water service, and public
health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
8
Other(s), enter below:
8
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Table 3b: Pipes and Constructed Conveyances, Water Collection, and Intake (Natural Hazards)
Asset Category: Pipes and Constructed Conveyances, Water Collection, and Intake
Examples of Assets in this Category: Encompasses the infrastructure that collects and transports water from a
source water to treatment or distribution facilities. Possible examples include holding facilities, intake structures and
associated pumps and pipes, aqueducts, and other conveyances.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Pipes
and Constructed Conveyances, Water Collection, and Intake asset category,
briey describe in the right column how the malevolent act could impact this asset
category at the CWS. Include eects on major assets, water service, and public
health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
13
Enter Community Water System Name
1
4
Risk and Resilience Assessment
Table 4a: Pretreatment and Treatment (Malevolent Acts)
Asset Category: Pretreatment and Treatment
Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water
meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples
include sedimentation, ltration, disinfection, and chemical treatment. For the risk assessment, individual treatment
processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk prole.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the
in the left column that pose
Pretreatment and Treatment asset category, briey describe in the right column
a signicant risk to this
how the malevolent act could impact this asset category at the CWS. Include
asset category at the CWS.
eects on major assets, water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
9
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
9
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: Pretreatment and Treatment
Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water
meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples
include sedimentation, ltration, disinfection, and chemical treatment. For the risk assessment, individual treatment
processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk prole.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the
Pretreatment and Treatment asset category, briey describe in the right column
how the malevolent act could impact this asset category at the CWS. Include
eects on major assets, water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
10
Other(s), enter below:
10
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
15
Enter Community Water System Name
16
Risk and Resilience Assessment
Table 4b: Pretreatment and Treatment (Natural Hazards)
Asset Category: Pretreatment and Treatment
Examples of Assets in this Category: Encompasses all unit processes that a water system uses to ensure water
meets regulatory public health and aesthetic standards prior to distribution to customers. Possible examples
include sedimentation, ltration, disinfection, and chemical treatment. For the risk assessment, individual treatment
processes at a facility may be grouped together and analyzed as a single asset if they have a similar risk prole.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a significant risk to the
Pretreatment and Treatment asset category, briefly describe in the right column
how the natural hazard could impact this asset category at the CWS. Include eects
on major assets, water service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
Enter Community Water System Name
Risk and Resilience Assessment
Table 5a: Storage and Distribution Facilities (Malevolent Acts)
Asset Category: Storage and Distribution Facilities
Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain
water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks,
reservoirs, valves, pipes, and meters.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Storage
in the left column that pose
and Distribution Facilities asset category, briey describe in the right column how
a signicant risk to this
the malevolent act could impact this asset category at the CWS. Include eects on
asset category at the CWS.
major assets, water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
11
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
11
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
17
Enter Community Water System Name
18
Risk and Resilience Assessment
Asset Category: Storage and Distribution Facilities
Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain
water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks,
reservoirs, valves, pipes, and meters.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Storage
and Distribution Facilities asset category, briey describe in the right column how
the malevolent act could impact this asset category at the CWS. Include eects on
major assets, water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
12
Other(s), enter below:
12
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Table 5b: Storage and Distribution Facilities (Natural Hazards)
Asset Category: Storage and Distribution Facilities
Examples of Assets in this Category: Encompasses all infrastructure used to store water after treatment, maintain
water quality, and distribute water to customers. Possible examples include residual disinfection, pumps, tanks,
reservoirs, valves, pipes, and meters.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Storage
and Distribution Facilities asset category, briey describe in the right column how
the natural hazard could impact this asset category at the CWS. Include eects on
major assets, water service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
19
Enter Community Water System Name
20
Risk and Resilience Assessment
Table 6a: Electronic, Computer, or Other Automated Systems (including the security of such systems)
(Malevolent Acts)
Asset Category: Electronic, Computer, or Other Automated Systems (including the security of such systems)
Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business
enterprise information technology (IT) and communications systems (other than nancial), and the processes used
to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related
IT hardware and software and communications, used to control water collection, treatment, and distribution. Also
includes IT hardware, software, and communications used in business enterprise operations. The assessment must
account for the security of these systems (e.g., cybersecurity, information security).
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Electronic,
in the left column that pose
Computer, or Other Automated Systems (including the security of such systems)
a signicant risk to this
asset category, briey describe in the right column how the malevolent act could
asset category at the CWS.
impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
13
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
13
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: Electronic, Computer, or Other Automated Systems (including the security of such systems)
Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business
enterprise information technology (IT) and communications systems (other than nancial), and the processes used
to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related
IT hardware and software and communications, used to control water collection, treatment, and distribution. Also
includes IT hardware, software, and communications used in business enterprise operations. The assessment must
account for the security of these systems (e.g., cybersecurity, information security).
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Electronic,
in the left column that pose
Computer, or Other Automated Systems (including the security of such systems)
a signicant risk to this
asset category, briey describe in the right column how the malevolent act could
asset category at the CWS.
impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
14
Other(s), enter below:
14
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
21
Enter Community Water System Name
22
Risk and Resilience Assessment
Table 6b: Electronic, Computer, or Other Automated Systems (including the security of such systems)
(Natural Hazards)
Asset Category: Electronic, Computer, or Other Automated Systems (including the security of such systems)
Examples of Assets in this Category: Encompasses all treatment and distribution process control systems, business
enterprise information technology (IT) and communications systems (other than nancial), and the processes used
to secure such systems. Possible examples include the sensors, controls, monitors and other interfaces, plus related
IT hardware and software and communications, used to control water collection, treatment, and distribution. Also
includes IT hardware, software, and communications used in business enterprise operations. The assessment must
account for the security of these systems (e.g., cybersecurity, information security).
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Electronic,
Computer, or Other Automated Systems (including the security of such systems)
asset category, briey describe in the right column how the natural hazard could
impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
Enter Community Water System Name
Risk and Resilience Assessment
Table 7a: Monitoring Practices (Malevolent Acts)
15
Asset Category: Monitoring Practices
Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and
nished water quality, along with any monitoring systems not captured in other asset categories. Possible examples
include sensors, laboratory resources, sampling capabilities, and data management equipment and systems.
Examples are contamination warning systems for the source water or distribution system.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Monitoring
in the left column that pose
Practices asset category, briey describe in the right column how the malevolent
a signicant risk to this
act could impact this asset category at the CWS. Include eects on major assets,
asset category at the CWS.
water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
16
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
15
Monitoring associated with physical security should be addressed under Physical Barriers; monitoring associated with process controls and
cybersecurity should be addressed under Electronic, Computer or Other Automated Systems; monitoring associated with nancial systems should be
addressed under Financial Infrastructure.
16
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
23
Enter Community Water System Name
24
Risk and Resilience Assessment
Asset Category: Monitoring Practices
Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and
nished water quality, along with any monitoring systems not captured in other asset categories. Possible examples
include sensors, laboratory resources, sampling capabilities, and data management equipment and systems.
Examples are contamination warning systems for the source water or distribution system.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Monitoring
Practices asset category, briey describe in the right column how the malevolent
act could impact this asset category at the CWS. Include eects on major assets,
water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
17
Other(s), enter below:
17
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Table 7b: Monitoring Practices (Natural Hazards)
18
Asset Category: Monitoring Practices
Examples of Assets in this Category: Encompasses the processes and practices used to monitor source water and
nished water quality, along with any monitoring systems not captured in other asset categories. Possible examples
include sensors, laboratory resources, sampling capabilities, and data management equipment and systems.
Examples are contamination warning systems for the source water or distribution system.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Monitoring
Practices asset category, briey describe in the right column how the natural hazard
could impact this asset category at the CWS. Include eects on major assets, water
service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
18
Monitoring associated with physical security should be addressed under Physical Barriers; monitoring associated with process controls and
cybersecurity should be addressed under Electronic, Computer or Other Automated Systems; monitoring associated with nancial systems should be
addressed under Financial Infrastructure.
25
Enter Community Water System Name
26
Risk and Resilience Assessment
Table 8a: Financial Infrastructure (Malevolent Acts)
Asset Category: Financial Infrastructure
Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility
nances. Possible examples include billing, payment, and accounting systems, along with third parties used for these
services. This asset category is not intended to address the nancial “health” of the water utility (e.g., credit rating,
debt-to-equity ratios).
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a signicant risk to the Financial
in the left column that pose
Infrastructure asset category, briey describe in the right column how the
a signicant risk to this
malevolent act could impact this asset category at the CWS. Include eects on
asset category at the CWS.
major assets, water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
19
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
19
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: Financial Infrastructure
Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility
nances. Possible examples include billing, payment, and accounting systems, along with third parties used for these
services. This asset category is not intended to address the nancial “health” of the water utility (e.g., credit rating,
debt-to-equity ratios).
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a signicant risk to the Financial
Infrastructure asset category, briey describe in the right column how the
malevolent act could impact this asset category at the CWS. Include eects on
major assets, water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
20
Other(s), enter below:
20
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
27
Enter Community Water System Name
2
8
Risk and Resilience Assessment
Table 8b: Financial Infrastructure (Natural Hazards)
Asset Category: Financial Infrastructure
Examples of Assets in this Category: Encompasses equipment and systems used to operate and manage utility
nances. Possible examples include billing, payment, and accounting systems, along with third parties used for these
services. This asset category is not intended to address the nancial “health” of the water utility (e.g., credit rating,
debt-to-equity ratios).
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a signicant risk to the Financial
Infrastructure asset category, briey describe in the right column how the natural
hazard could impact this asset category at the CWS. Include eects on major
assets, water service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
Enter Community Water System Name
Risk and Resilience Assessment
Table 9a: The Use, Storage, or Handing of Chemicals (Malevolent Acts)
Asset Category: The Use, Storage, or Handling of Chemicals
Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling
practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the
risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable.
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a significant risk to The Use,
in the left column that pose
Storage, or Handling of Chemicals asset category, briey describe in the right
a signicant risk to this
column how the malevolent act could impact this asset category at the CWS.
asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
21
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
21
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
29
Enter Community Water System Name
30
Risk and Resilience Assessment
Asset Category: The Use, Storage, or Handling of Chemicals
Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling
practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the
risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable.
Malevolent Acts
Select the malevolent acts
in the left column that pose
a signicant risk to this
asset category at the CWS.
Brief Description of Impacts
If you select a malevolent act in the left column as a significant risk to The Use,
Storage, or Handling of Chemicals asset category, briey describe in the right
column how the malevolent act could impact this asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
22
Other(s), enter below:
22
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Table 9b: The Use, Storage, or Handing of Chemicals (Natural Hazards)
Asset Category: The Use, Storage, or Handling of Chemicals
Examples of Assets in this Category: Encompasses the chemicals and associated storage facilities and handling
practices used for chemical disinfection and treatment. Assessments under this asset category should focus on the
risk of uncontrolled release of a potentially dangerous chemical like chlorine where applicable.
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a significant risk to The Use,
Storage, or Handling of Chemicals asset category, briey describe in the right
column how the natural hazard could impact this asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
31
Enter Community Water System Name
32
Risk and Resilience Assessment
Table 10a: The Operation and Maintenance of the System (Malevolent Acts)
Asset Category: The Operation and Maintenance of the System
Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of
the water system that are not captured under other asset categories. Possible examples include equipment, supplies,
and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of
utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g.,
disease outbreak or employee displacement).
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a significant risk to The
in the left column that pose
Operation and Maintenance of the System asset category, briey describe in the
a signicant risk to this
right column how the malevolent act could impact this asset category at the CWS.
asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Assault on Utility –
Physical
Contamination of Finished
Water – Intentional
Contamination of Finished
Water – Accidental
23
Theft or Diversion –
Physical
Cyberattack on Business
Enterprise Systems
23
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
Enter Community Water System Name
Risk and Resilience Assessment
Asset Category: The Operation and Maintenance of the System
Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of
the water system that are not captured under other asset categories. Possible examples include equipment, supplies,
and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of
utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g.,
disease outbreak or employee displacement).
Malevolent Acts
Brief Description of Impacts
Select the malevolent acts
If you select a malevolent act in the left column as a significant risk to The
in the left column that pose
Operation and Maintenance of the System asset category, briey describe in the
a signicant risk to this
right column how the malevolent act could impact this asset category at the CWS.
asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Cyberattack on Process
Control Systems
Sabotage – Physical
Contamination of Source
Water – Intentional
Contamination of Source
Water – Accidental
24
Other(s), enter below:
24
Accidental contamination is not a malevolent act. It is included here due to similar potential consequences and because whether a contamination
incident is intentional or accidental may not be known during initial response.
33
Enter Community Water System Name
3
4
Risk and Resilience Assessment
Table 10b: The Operation and Maintenance of the System (Natural Hazards)
Asset Category: The Operation and Maintenance of the System
Examples of Assets in this Category: Encompasses critical processes required for operation and maintenance of
the water system that are not captured under other asset categories. Possible examples include equipment, supplies,
and key personnel. Assessments may focus on the risk to operations associated with dependency threats like loss of
utilities (e.g., power outage), loss of suppliers (e.g., interruption in chemical delivery), and loss of key employees (e.g.,
disease outbreak or employee displacement).
Natural Hazards
Select the natural hazards in
the left column that pose a
signicant risk to this asset
category at the CWS.
Brief Description of Impacts
If you select a natural hazard in the left column as a significant risk to The
Operation and Maintenance of the System asset category, briey describe in the
right column how the natural hazard could impact this asset category at the CWS.
Include eects on major assets, water service, and public health as applicable.
Flood
Earthquake
Tornado
Ice Storm
Fire
Other(s), enter below:
Enter Community Water System Name
Risk and Resilience Assessment
Table 11: Countermeasures (Optional)
25
Countermeasures
(optional)
List countermeasures in
the left column the CWS
could potentially implement
to reduce risk from the
malevolent acts and natural
hazards that were selected.
Brief Description of Risk Reduction or Increased Resilience
For each countermeasure, in the right column, describe how the countermeasure
could reduce risk or increase resilience for CWS assets from malevolent acts or
natural hazards that were selected in the analysis. A countermeasure may reduce
risk across multiple malevolent acts, natural hazards and asset categories.
1.
2.
3.
4.
5.
25
IMPORTANT NOTE: The assessment does not require a specic number of countermeasures. You may have fewer than ve countermeasures or add
more countermeasures and describe them in a separate document.
35
Enter Community Water System Name
Risk and Resilience Assessment
Change History
Please describe the changes made to this risk and resilience assessment since its original development,
who made the changes, and on what date the changes were incorporated.
Name/Title: Date: Description of Change:
36
Enter Community Water System Name
Download
Save PDF to desktop
Email
Email completed PDF
Send for Signing
Email for others to sign
Print
Print document
Choose a Field
Click on a field and
select the person that should complete it
Want to add a signature?
You can add a signature field
and assign it to someone else
to sign
Choose a Field
Click on a field and
select the person that should complete it

Guidance For Small Community Water Systems On Risk And Resilence Assessments Under AWIA

This document is locked as it has been sent for signing.

You have successfully completed this document.

Other parties need to complete fields in the document. You will recieve an email notification when the document has been completed by all parties.

This document has been signed by all parties.

Completed 22 July 2020

Message

View Audit Log
Print With Audit Log
Duplicate Document