AWIA Section 2013/SDWA Section 1433: Risk and Resilience Assessments and Emergency Response Plans
On October 23, 2018, America's Water Infrastructure Act (AWIA) was signed into law. AWIA section 2013, which amended section 1433 of the Safe Drinking Water Act (SDWA), requires community (drinking) water systems (CWSs) serving more than 3,300 people to develop or update risk and resilience assessments (RRAs) and emergency response plans (ERPs). The law specifies the components that the RRAs and ERPs must address, and establishes deadlines by which water systems must certify to EPA completion of the RRA and ERP. The Federal Register Notice for New Risk Assessments and Emergency Response Plans for Community Water Systems is available.
SDWA section 1433 also states that EPA should provide guidance and technical assistance to water systems that serve less than 3,301 people on how to conduct RRAs and ERPs, though these systems are not required to certify completion to EPA.
For more information concerning AWIA section 2013/SDWA section 1433, please see the law text on congress.gov.
On this page:
- Certification Deadlines
- RRA Requirements and Assistance Resources for CWSs that Serve More than 3,300
- ERP Requirements and Assistance Resources for CWSs that Serve More than 3,300
- Recursos de AWIA en Español
- Certification Process
- Compliance Data
- Third-Party Standards
- Resources to Promote RRAs and ERPs for CWSs that Serve Less than 3,301, non-CWSs, and Wastewater Systems
- Final Disposition of Bioterrorism Act Vulnerability Assessments
- Workshops
- Frequently Asked Questions
- Fact Sheet
- Resources for Technical Assistance Providers
- Five-year Review, Revision and Certification Requirements
Certification Deadlines
| Population Served |
Previous RRA Deadline |
Next 5-Year Submission Cycle RRA Deadline |
|---|---|---|
|
≥100,000 |
March 31, 2020 | March 31, 2025 |
|
50,000-99,999 |
December 31, 2020 | December 31, 2025 |
|
3,301-49,999 |
June 30, 2021 | June 30, 2026 |
| Population Served |
Previous ERP Deadline* |
Next 5-Year Submission Cycle ERP Deadline* |
|---|---|---|
| ≥100,000 | September 30, 2020 | September 30, 2025 |
| 50,000-99,999 | June 30, 2021 | June 30, 2026 |
| 3,301-49,999 | December 31, 2021 | December 31, 2026 |
*ERP certifications are due six months from the date of the RRA certification. The dates shown above are certification dates based on a utility submitting a RRA on the final due date.
RRA Requirements and Assistance Resources for CWSs that Serve More than 3,300
Each community water system serving a population of greater than 3,300 persons shall assess the risks to, and resilience of, its system. Such an assessment shall include:
- the risk to the system from malevolent acts and natural hazards;
- the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system;
- the monitoring practices of the system;
- the financial infrastructure of the system;
- the use, storage, or handling of various chemicals by the system; and
- the operation and maintenance of the system.
The assessment may include an evaluation of capital and operational needs for risk and resilience management for the system.
RRA Assistance Resources
-
Baseline Information on Malevolent Acts for Community Water Systems - This resource can help you estimate the threat likelihood of various malevolent acts that could occur at your water system.
-
Vulnerability Self-Assessment Tool - This resource is intended to help you develop a RRA that meets the requirements of SDWA section 1433 (recommended for use by larger community water systems serving over 50,000 people).
-
Small System Risk and Resilience Assessment Checklist - This resource is intended to help you develop a RRA that meets the requirements of SDWA section 1433 (recommended for use by smaller community water systems serving under 50,000 people).
- Resources to help with the cybersecurity component of the RRA
- EPA’s Water Sector Cybersecurity Evaluation Program – EPA’s third-party contractor will conduct a free cybersecurity assessment using EPA’s Cybersecurity Checklist for water and wastewater systems to identify cybersecurity gaps and vulnerabilities. Utilities receive an Assessment Report and a Risk Mitigation Plan template in a secure file.
- Water Cyber Assessment Tool (WCAT) – The tool uses EPA’s Cybersecurity Checklist to provide an easy-to use evaluation of cybersecurity practices at water and wastewater utilities. The Tool includes an assessment workbook, assessment report, and a risk mitigation plan.
ERP Requirements and Assistance Resource for CWSs that Serve More than 3,300
No later than six months after certifying completion of its RRA, each system must prepare or revise, where necessary, an ERP that incorporates the findings of the RRA. The ERP shall include:
- strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system;
- plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water;
- actions, procedures and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes and construction of flood protection barriers; and
- strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.
Community water systems shall to the extent possible coordinate with local emergency planning committees established under the Emergency Planning and Community Right-To-Know Act of 1986 when preparing or revising an RRA or ERP under SDWA section 1433. Further, systems must maintain a copy of the RRA and ERP for five years after certifying the plan to the EPA.
ERP Assistance Resources
-
Emergency Response Plan Template and Instructions - This resource is intended to help you develop an ERP that meets the requirements of SDWA section 1433.
- Resource to help with the cybersecurity component of the ERP
- Cybersecurity Incident Action Checklist – This resource provides on-the-go convenience, to help utilities prepare for, respond to, and recover from a cyber incident through a checklist of activities. The checklist can be added to an ERP to address cybersecurity response.
Recursos de Ley de Infraestructura Hídrica de Estados Unidos (AWIA) en Español
Visite esta página web para obtener recursos en español.
Recursos de Ley de Infraestructura Hídrica de Estados Unidos (AWIA) en Español
Certification Process
Each community water system serving a population of 3,301 people or greater, must certify the completion of its RRA and ERP for every individual PWSID number. Three options are available for RRA and ERP certification submittals:
Certify your Risk and Resilience Assessment and/or Emergency Response Plan
AWIA Section 2013/SDWA Section 1433 Compliance Data
EPA's AWIA Section 2013/SDWA Section 1433 Compliance Data webpage contains data on which community drinking water systems covered by the RRA and ERP certification requirements under SDWA section 1433, as well as data on the community drinking water systems that have complied with the law.
Third-Party Standards
The EPA does not require water systems to use any designated standards, methods, or tools to conduct the RRAs or to prepare the ERPs required under SDWA section 1433. Rather, community water systems must conduct RRAs and ERPs that meet the specific requirements outlined under SDWA section 1433.
Community water systems may use any standards, methods or tools that aid the system in meeting the requirements of SDWA section 1433(a) and (b). However, regardless of the use of any standard, method or tool, the community water system is responsible for ensuring that its RRA and ERP fully address all SDWA section 1433 requirements.
Resources to Promote RRAs and ERPs for CWS that Serve Less than 3,301, non-CWS, and Wastewater Systems
CWSs that serve less than 3,301 people, non-CWSs, and wastewater systems are not required to certify completion of a RRA or ERP to EPA. However, natural disasters and malevolent acts also occur at these facilities, therefore EPA encourages these systems to plan for disasters that could disrupt system operations by conducting RRAs and developing ERPs.
Final Disposition of Bioterrorism Act Vulnerability Assessments
Title IV of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act) amended the Safe Water Drinking Act (SDWA) by adding new sections 1433 through 1435 pertaining to improving the security of the nation’s drinking water infrastructure. Section 1433 of the Bioterrorism Act required each community water system serving a population greater than 3,300 persons to conduct a vulnerability assessment, certify completion of its assessment and submit a written copy of the assessment to the EPA where it would be stored in a secure location. These assessments reached are now greater than 10 years old and therefore pursuant to EPA’s Records Management Policy, the EPA disposed of (destroyed) the certifications and assessments.
Community water systems had the option to have their vulnerability assessments returned to them prior to destruction by making a request to EPA no later than December 31, 2021. The deadline for this action has now passed and EPA has returned all vulnerability assessments for CWSs that requested they be returned. All remaining vulnerability assessments have been destroyed.
AWIA section 2013 amended SDWA section 1433, essentially replacing the old requirements from the Bioterrorist Act with the updated requirements described on this webpage.
Workshops
EPA hosts workshops to help CWSs understand their requirements under SDWA section 1433. Visit EPA’s SDWA Section 1433/AWIA Section 2013 Workshops webpage to find out about upcoming workshops, view recordings of past workshops, and access an overview PowerPoint presentation that can be used to share information with stakeholders.
Frequently Asked Questions
Access the Frequently Asked Questions Document for helpful answers to common questions about SDWA section 1433.
Fact Sheet
For a helpful overview of SDWA section 1433 requirements, access the Risk and Resilience Assessment and Emergency Response Plan Requirements Fact Sheet.
Resources for Technical Assistance Providers
EPA's SDWA section 1433 resources for technical assistance providers include the Technical Assistance Primer and workshop presentation materials. These resources can be used by technical assistance providers to help assist community water systems meet compliance with SDWA section 1433’s requirements to conduct or update a RRA and ERP. In addition, technical assistance providers can, lead their own SDWA section 1433 trainings with the provided workshop presentation materials.
Five-year Review, Revision and Certification Requirements
Each community water system serving more than 3,300 persons must review its RRA at least once every five years to determine if it should be revised. Upon completion of such a review, the system must submit to the EPA a certification that it has reviewed its RRA and revised it, if applicable.
Further, each community water system serving more than 3,300 persons must review and, if necessary, revise its ERP at least once every five years after the system completes the required review of its RRA. The ERP must incorporate any revisions to the RRA. Upon completion of such a review, but not later than six months after certifying the review of its RRA, the system must submit to the EPA a certification that it has reviewed its ERP and revised it, if applicable.