New Risk Assessment and Emergency Response Plan Requirements for Community Water Systems

AGENCY:

Environmental Protection Agency (EPA).

ACTION:

Notice of availability.

SUMMARY:

This notice describes the requirements for community water systems serving more than 3,300 persons to complete risk and resilience assessments and emergency response plans under the America's Water Infrastructure Act (AWIA) of 2018. It also outlines how community water systems can certify the completion of these documents to the EPA. Additionally, today's notice informs community water systems of how to request the return of vulnerability assessments submitted in accordance with the Bioterrorism Act of 2002.

DATES:

See the SUPPLEMENTARY INFORMATION section for AWIA compliance dates.

FOR FURTHER INFORMATION CONTACT:

Nushat Dyson, Water Security Division, Office of Ground Water and Drinking Water (MC 4608T), U.S. Environmental Protection Agency, 1200 Pennsylvania Ave. NW, Washington, DC 20460; telephone number: (202) 564-4674; fax number: (202) 564-3753; email address: dyson.nushat@epa.gov.

SUPPLEMENTARY INFORMATION:

A. Does this action apply to me?

This notice applies to all community water systems serving more than 3,300 persons.

B. How can I get copies of this document?

You may access this Federal Register document electronically from the Government Printing Office on the govinfo website for Federal Register listings at: https://www.govinfo.gov/app/collection/FR/. You may also access it on the EPA's website at: https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-plans.

C. Background

On October 23, 2018, the America's Water Infrastructure Act (Pub. L. 115-270) was signed into law. Section 2013 of the AWIA amends section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i-2). This section requires community water systems serving more than 3,300 persons to develop or update risk and resilience assessments and emergency response plans. The law specifies the topics that the risk and resilience assessments and emergency response plans must address. It also establishes deadlines by which community water systems must send certifications of completion of the risk and resilience assessments and emergency response plans to the EPA.

Each community water system serving more than 3,300 persons shall submit to the EPA Administrator a certification that the system has conducted a risk and resilience assessment in accordance with the Act prior to—

• March 31, 2020, in the case of systems serving a population of 100,000 or more;
• December 31, 2020, in the case of systems serving a population of 50,000 or more, but less than 100,000; and
• June 30, 2021, in the case of systems serving a population greater than 3,300, but less than 50,000.

Each community water system serving more than 3,300 persons shall also certify its completion of an emergency response plan as soon as reasonably possible, but no later than six months after certifying completion of its risk and resilience assessment.

For purposes of compliance with the AWIA, the EPA interprets the population served under revised section 1433(a)(3) to mean all persons served by the system directly or indirectly. As a result, community water systems should determine their population served based on the number of people the system serves directly, plus the number of people served by any consecutive community water systems. Accordingly, a community water system that provides drinking water to consecutive community water systems (i.e., a “wholesaler”) must include the population served by those consecutive systems when determining its total population served.

D. Risk and Resilience Assessments

Section 1433(a) of the Safe Drinking Water Act (SDWA) as amended by section 2013 of the AWIA outlines the requirements for risk and resilience assessments as follows: Each community water system serving a population greater than 3,300 persons must assess the risks to, and resilience of, its system. Such an assessment must include—

(1) the risk to the system from malevolent acts and natural hazards;

(2) the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system;

(3) the monitoring practices of the system;

(4) the financial infrastructure of the system;

(5) the use, storage, or handling of various chemicals by the system; and

(6) the operation and maintenance of the system.

The assessment may also include an evaluation of capital and operational needs for risk and resilience management for the system.

To assist utilities, the AWIA directs the EPA to provide baseline information on malevolent acts of relevance to community water systems no later than August 1, 2019. This information must include consideration of acts that may—

(1) substantially disrupt the ability of the system to provide a safe and reliable supply of drinking water; or

(2) otherwise present significant public health or economic concerns to the community served by the system.

E. Emergency Response Plans

No later than six months after certifying completion of its risk and resilience assessment, each system must prepare or revise, where necessary, an emergency response plan that incorporates the findings of the assessment. The plan shall include—

(1) strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system;

(2) plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water;

(3) actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers; and

(4) strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.

Community water systems must, to the extent possible, coordinate with local emergency planning committees established under the Emergency Planning and Community Right-To-Know Act of 1986 (42 U.S.C. 11001 et seq.) when preparing or revising a risk and resilience assessment or emergency response plan under the AWIA. Further, systems must maintain a copy of the assessment and emergency response plan (including any revised assessment or plan) for five years after certifying the plan to the EPA.

F. Submitting Certifications to the EPA

The EPA is currently developing a process for community water systems to certify completion of risk assessments and emergency response plans. Three primary options for risk assessment and emergency response plan certification submittals will be: (1) Regular mail; (2) email; and (3) a user-friendly secure online portal. The online submission portal, yet to be developed, will offer community water systems a receipt of their risk assessment or emergency response plan certification submittal; therefore, the EPA recommends that all community water systems use the online portal.

The EPA plans to publish additional resources and tools to assist community water systems with meeting the requirements of the AWIA prior to August 1, 2019. These will include the following:

• Baseline information on malevolent acts of relevance to community water systems as required by SDWA section 1433(a)(2);
• technical assistance fact sheets that describe AWIA compliance requirements, procedures for submitting risk assessment and emergency response plan certifications to the EPA, and how to use EPA tools and resources; and
• new versions of the EPA's Vulnerability Self-Assessment Tool and Emergency Response Plan guidance to assist systems with developing risk assessments and emergency response plans under the AWIA amendments to the Safe Drinking Water Act.

The EPA recommends that community water systems consider submitting risk and resilience assessment and emergency response plan certifications after publication of the baseline information on malevolent acts document, as well as updated risk assessment tools and other guidance. This timing will reduce the chances that a community water system will need to make corrections to its risk and resilience assessment or emergency response plan after certification.

Community water systems can access https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-emergency-response-plans to get updated information on the implementation of this section of the law, as well as further details on how to submit risk and resilience assessment and emergency response plan certifications.

G. Third-Party Standards

The EPA does not require water systems to use any designated standards, methods, or tools to conduct the risk and resilience assessments required under revised section 1433(a) or to prepare the emergency response plans required under revised section 1433(b). Rather, community water systems must conduct risk and resilience assessments and prepare emergency response plans in accordance with all the requirements of those sections.

Community water systems may use any standards, methods, or tools that aid the system in meeting the requirements of section 1433. However, regardless of the use of any standard, method, or tool, the community water system is responsible for ensuring that its risk and resilience assessment and emergency response plan fully address all requirements of the SDWA, as amended by the AWIA.

H. Five-Year Review, Revision, and Certification Requirement

Each community water system serving more than 3,300 persons must review its risk and resilience assessment at least once every five years to determine if it should be revised. Upon completion of such a review, the system must submit to the EPA a certification that it has reviewed its assessment and revised it, if applicable.

Further, each community water system serving more than 3,300 persons must revise, where necessary, its emergency response plan at least once every five years after the system completes the required review of its risk and resilience assessment. The emergency response plan must incorporate any findings of the risk and resilience assessment. Upon completion of such a review, but not later than six months after certifying the review of its risk and resilience assessment, the system must submit to the EPA a certification that it has completed its corresponding emergency response plan (which, in the context of a revision, means that it has reviewed its emergency response plan and revised it, if applicable).

I. Final Disposition of Bioterrorism Act Vulnerability Assessments

Title IV of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act) amended the Safe Water Drinking Act by adding new sections 1433 through 1435 pertaining to improving the security of the nation's drinking water infrastructure. Section 1433 of the Bioterrorism Act required each community water system serving a population greater than 3,300 persons to conduct a vulnerability assessment, certify completion of its assessment, and submit a written copy to the EPA where it would be stored in a secure location. These assessments are now more than 10 years old and are outdated. Pursuant to the EPA's Records Management Policy, the EPA can retire the certifications and assessments.

The EPA intends to destroy the vulnerability assessments using a process that conforms with the information protection requirements of section 1433 of the Bioterrorism Act. Under AWIA section 2013(b)(2), community water systems may request that the EPA return their vulnerability assessments in lieu of destruction. If utilities wish their vulnerability assessments returned, they may submit a letter to the EPA by email. Please email the request letter to WSD-Outreach@epa.gov on utility letterhead and include the following information: utility name, PWS ID number, address, and point of contact information for the individual who will be responsible for receiving the vulnerability assessment.

To request the return of the vulnerability assessment prior to destruction, the community water system will need to make the request not later than the initial date by which the community water system must certify a risk and resilience assessment to the EPA as required under section 1433(a) of the Safe Drinking Water Act as amended by section 2013 of the AWIA.