Drinking Water Security for 

Small Systems Serving 3,300 or Fewer Persons One of the Simple Tools for Effective Performance (STEP) Guide Series 
Printed on recycled paper 

ii 
Disclaimer 

e made based on the applicable statutes and regulations. Therefore, interested parties are free to raise 

ions and objections about the appropriateness of the application of this guide to a particular situation, and 

ed this guide or to obtain additional copies, contact the Safe Drinking Water Hotline at (800) 426-4791. 

U.S. Environmental Protection Agency (EPA) prepared this guide to help you enhance the security of your 

 system. This document does not impose legally binding requirements on EPA, states, tribes, or the 

ated community, and it may or may not be applicable to a particular situation depending on the 

mstances. EPA and state decision makers retain the discretion to adopt approaches on a case-by-case basis 

may differ from this guidance where appropriate. Any decisions regarding a particular community water system 

will consider whether the recommendations or interpretations in this guide are appropriate in that situation 

d on the law and regulations. EPA may change this guidance in the future. To determine whether EPA has 

iii
Contents

Me? ................................................................................................................................. 1

 ........................................................................................................................................ 2

t to Improve Security and Prepare for Emergencies? ........................................... 3

bility Assessment? ....................................................................................................... 4

rovements Can I Make Immediately? ..................................................................... 12

ency Response Plan? ................................................................................................ 16

 and Upgrade Security in the Long Run? ............................................................... 27

mmunicate with My Customers? ............................................................................... 30

Additional Help? ......................................................................................................... 34

Drinking Water Act Primacy Agencies .................................................................... 37

Regional Contacts ...................................................................................................... 42

r STEP Documents .................................................................................................... 43

iv 
Guide for Me?

ned for community water systems (CWSs) serving 3,300 or fewer persons. CWSs include all publicly and privately owned systems 

water to at least 25 year-round residential customers or 15 year-round service connections. This guide may be useful for: 

wn systems z Homeowners’ associations 

ater districts z Small private systems 

ystems z Public Service Districts (PSDs) 

ctured home communities 

s basic information and steps you can take to improve security and emergency preparedness at your water system. It explains why 

ents are important and discusses Vulnerability Assessments (VAs) and Emergency Response Plans (ERPs) – tools that you can 

urity at your system. 

f this guide may be obtained by calling the Safe Drinking Water Hotline at (800) 426-4791. You may also download the guide from 

ty Web site at http://epa.gov/safewater/watersecurity. 

 below) can provide additional security-related material and help you implement appropriate security measures at your water 

act information can be found in Appendix A. Drinking water industry associations and technical assistance providers also are 

th water security issues. See “Where Can I Find Additional Help?” on page 34 for their contact information. 

1 

ase note that the term “state” is used in this guide to refer to your Drinking Water Primacy Agency. The Primacy 

ncy for most systems is the State Drinking Water Agency. However, the Primacy Agency for systems located in the 

ajo Nation is the tribal office. The Primacy Agency for systems located on other tribal lands, in the State of 

ming, or in the District of Columbia is the EPA regional office. 
Learn?

g water is protecting your system from various threats and preparing for emergencies. Everyone involved in water system 

d operation – owners, operators, board members, and local officials – has a responsibility for water system security. If you 

ps, this guide will help you by: 

nerability Assessments (VA) and Emergency Response Plans (ERP) are 

activities and steps involved in completing VAs and ERPs 

dly tools, templates, software, and checklists that can help you work through your VA and ERP 

bout drinking water security initiatives and how to take practical actions to improve security at your system. You will also 

t your system is prepared to handle an emergency. 

2 

e capabilities. 

mergency preparedness at your water system. 

What Are Systems Serving More than 3,300 Persons Doing? 

rrorist attacks, Congress passed the Public Health Security and Bioterrorism Preparedness and Response Act (Public 

s law requires that a CWS serving more than 3,300 persons conduct a VA. A copy of the VA must be sent to EPA 

pecified in the law. CWSs serving more than 3,300 persons must also prepare or revise an ERP and certify to the EPA 

 has been completed within 6 months of completing the VA. The ERP should incorporate the results of the VA and 

ons a system will take to respond to an emergency. 

ments do not apply to systems serving 3,300 or fewer persons, it is important for systems of all sizes to understand their 

 emergencies. Systems serving 3,300 or fewer persons should consider completing a VA and an ERP to improve their 

some states have their own VA and ERP requirements. Be sure to check with your state to determine if there are 

nsider. 

Building a Team 

veryone involved with your water system’s ownership, management, and operations to improve security and emergency 

em. Build a team made up of water system operators, board members, and owners and make a team commitment to 
mportant to Improve Security and Prepare for 

cies? 

that may put at risk your ability to provide a reliable and safe supply of water to your customers. Your system may face various 

 intentional and accidental, such as: 

e.g., construction, traffic) 

z Hazardous material releasesz Terrorismz Vandalism

m could be the target of terrorism may seem far-fetched to you. Man

are only some of many potential causes of emergencies at water 

ers that might cause an emergency at your system include: 

s 

z Severe cold weather/ice stormsz Tornadoes

brush fires 

z Waterborne disease outbreaks

protect your customers from the negative outcomes of these threats. 

nclude: 

of drinking water

 deaths

c and fear of drinking the water from your system

habilitating, rebuilding, or decontaminating your water system

contamination of your water supply

 of firefighting capability

 of sanitary services

g water to your customers, you should have appropriate security measures in place, and you should know how to 

ncy. If your system is vulnerable to any threat, the health of your customers is at risk. If you are not prepared to 

e negative effects of the emergency will be magnified. Ignoring vulnerabilities and failing to properly plan for 

zes the safety of the water you deliver and the health of the people who depend on it. On the other hand, if you act 

stomers will have more confidence and peace of mind knowing that you are improving your system’s security and 

capability. 

3 

critical information for you and your system. You will see this key throughout the guide. Pay special attention to these “key points,” which highlight 
ulnerability Assessment?

ation of your system and its operations that assesses your ability to reduce the risk of different threats. A VA identifies 

s security and focuses on the types of possible threats that could keep you from providing a safe and reliable supply of 

ce your VA is completed, you should know which of your system’s components might be vulnerable, and you will have 

ze the security upgrades and operational changes that will reduce risks to your system. 

A VULNERABILITY ASSESSMENT? 

 threats and completing a VA might seem like an overwhelming challenge. You might think that you need an expert to 

m’s security. This section, however, outlines a few basic steps that will allow YOU to examine the risks facing your system. 

with available tools, you can evaluate your system’s security and begin to address any problems or needed improvements – 

onsultants or security experts. Build a team made up of the water system operator, board members, and owners. This team 

lete VA. 

me states have their own VA requirements. Be sure to check with your state to determine if there are requirements you 

n also be a good source of assistance if you have questions about VAs. 

completely up to you and should reflect the needs and characteristics of your system. That said, there are six basic steps 

when conducting a VA of their system (see the figure below).1 The steps described in this section offer a general overview 

 the activities necessary for an effective VA. Completing these steps will help you take a thorough look at the security risks 

s are listed in “Where Can I Find Additional Help?” on page 34. 

3: Consider Consequences 4: Assess Likelihood 6: Plan Action

 VA, follow the six steps on the following pages. The graphic below will help you track the steps as you move from 

ere are a number of worksheets, checklists, and other aids that can help you conduct a VA and accomplish these six basic 

2: Identify Threats 5: Evaluate Measures 

based on the six basic elements listed in Vulnerability Assessment Factsheet, EPA Office of Water (EPA 816-F-02-005); November 

4 
VA Step 1

D ITS COMPONENTS – KNOWING AND EVALUATING CRITICAL RELATIONSHIPS 

hink about your entire water system, including your primary goals, the customers you serve, and your system’s components. To 

uld: 

ma 

lim

ili

l i

g n os p u or g 

r i e ht r e di s n o c d 

. s d e e n 

e du cn s r eo 

e r f , s a t psoh , c 

a t e r dna , yr t su 

m

 ii 

tmiy l la is ime 

mi liii f 

i 

i t i v i tl a i 

ii

. s l a o g e tsys yrami r p r u oy yf i t ne dI 

na gn r u d ec v r es r e taw f I 

n a t r o pceps e ycnegre

, . g. e( spu o r g es eht f o yna o t 

t aht os eht t hg h g h , )s r e t hg fer 

yn a r e d snoc o t e r us eb n ac u oy 

o t dedeen s e ca c e ps 

. ec v r es r eht t ce torp 

+ + 

wo h d n a s e i t i l i ca f r u o y t u o ba k n i h T 

. s e t are p o me tsys r u o y 

 n o it amr o f n ie du lcn io t t n aw l l' uoY 

, e c r u os re taw r uoy t uoba 

esu lac imehc , e g a r o t s , t n emt a e r t 

lo r t noc yr os iv r e pus , e g a r o t sdna 

) A D A C S( n o i t i s iu qc a a t a d dna 

r uoy dna , sme t sys r e t u pmoc dna 

.m e t sys no i tu b is r t id 

 dn a se i t i l ica f lac i t ir c t h g i lh g iH 

r o ", e r u l ia f f o n s t io p e lgn i s" 

y l l a ic e pse era taht s t n en o pmoc 

dn a e f as agn i divorp o t t n a t r o pmi 

dn a , re t aw fo y lppu s e lb a i ler 

sme lb o r p la ic e ps yn a e b ir csed 

ycn e dn eped , . g. e( ec a f t hg imyeht 

pu-kc a b f o kc a l, y t i c i r t c e leno 

. ) . c t e , y t ic a pac 

5 

2: Identify Threats 3: Consider Consequences 4: Assess Likelihood 5: Evaluate Measures 6: Plan Action

may feel that you already are familiar with your system and how it works, evaluating each system component (including 

nnel and water source) both independently and as part of overall system operations is the key to identifying its possible 

t is important to identify “single points of failure” in the system, or system components or processes that, if they failed, 

t the system’s ability to supply reliable, safe water. It is also especially important for you to identify your critical customers 

s, fire departments), services, and components to help you prioritize your activities. It is important to provide yourself with an 

re of your system in this step. The rest of the VA process relies on this information! 
VA Step 2

THREATS TO YOUR SYSTEM 

gives you the chance to identify the types of threats that could disrupt your system’s ability to provide a reliable and safe 

 this step, you should: 

m s e i t i l ic a f d n a oc m s t n e n o p

p e t S 1 k n i ht d n a t u o b a 

y l la c i t s i l a 

mra h hcae e ht f o .m 

d

o l l of e ht r e di s n oc g n i w 

sse

m : t ne

n o iss 

s e p ip 

d e t amo 

) A D A C S , . g. e( sme t sys 

ega

imehc fo s lac 

me t sys r e taw )ro t ar e p o 

ecn an 

sec it car p 

C hca e re dis n o f o ) s ( t ra p h c i h wd n a t a er ht e l bi s s o p 

C se pyt l la re dis n o . tce f f a dl u o wt i me t s y s e ht f o 

: g n i d u l c n i , s t a er ht 

 me t sys eht o t e g ama d lac isyh P  me t sy s eht n it n iop yn a ta re taw fo n o it an ima t n o C  s lac imehc fo es a e leR  y t i c ir t ce le f o no it pur r e t n I  n e lo t s , . g. e( n o itamr or fn i lac i t ir c fo n o it cur t s e d r o ssoL 

)sc it amehcs me t sys 

 sme t sys A D A C S ro s r e t u pmoc f o ssoL 

essary to think through all of the potential threats that could affect your system. Work with law enforcement officials to 

f the threats you may face. By coming up with the most complete list you can, you will ensure that your VA considers 

possible. Making sure you really understand where and how your system is vulnerable will help you tackle VA Step 3. 

2: Identify Threats 3: Consider Consequences 4: Assess Likelihood 5: Evaluate Measures 6: Plan Action

6 
VA Step 3

BLE CONSEQUENCES 

gative outcomes that can result from threats against your system, and it’s important for you to understand the possibilities. To 

should: 

sta er h

t n e di u oy d e i f i 

y

:r e di s n oc 

, e g ama d lac isyh p , . g. e 

)n

e lgn i s" r o )s ( tnen 

tc e f f a d lu oc 

C re dis n o wo h t n e di u o y t a er ht hca e d e i f i 

e ht mor f ,m et s y s r u oy tc ef f a dl u oc 

e s a c-t sr o we ht ot t c a pmi e l biss o p t s e l lams 

r u oy ni sr ot c af e s e ht e d ul c nI . oi ra necs 

: g ni k ni ht 

 r o f dn a d e t c e f fa e b l l iwohw s r emo t su C 

gno lwoh 

 shtaed ro s essen l l ir o f l a i tn e top ehT  ycn e gr emeeht fo t s oc l a i tn e top ehT 

r o , n o itan ima t noc e d , r ia p e r gn idu lcn i ( 

d e g ama d r o f s t s oc t n emeca lper 

agn ir u d t so leun ev e r dn a s t n en o pmoc 

) e g a t uo ec iv res 

 c i lbup n o ycn e gr emeeht fo t c a pmiehT 

me t sys r u oy n iecn e d i fn oc 

 eht mor f gn i t lus e r sme lborp mr e t -gn o lehT 

ycnegreme 

7 

3: Consider Consequences 4: Assess Likelihood 6: Plan Action

event or reduce the likelihood of these consequences. The more thorough you are, the better your plan will be. 

2: Identify Threats 5: Evaluate Measures 

 threats that would most harm your system’s ability to provide a reliable and safe supply of water. You should be as 

possible in thinking about the possible consequences of any threat. The plans that you make to reduce risk in VA Step 6 
VA Step 4

HOOD OF NEGATIVE CONSEQUENCES 

t because often there is too little information to make a good assessment. To help you do the best job you can, you should: 

d

n 

+ 

w 

w 

r et a y brae n t cat n o C 

f o s e p yt t a h ees ot sei t i l i t u 

e va h t h gim y e ht st a er ht 

. decaf + 

nwow 

m w

dnu 

sm 

.m 

t n e di c ni r u oy ei v e R 

ef t s a p e ht or f st r o p er 

n at sr e d r et t e b ot sraey 

t a el b or p yt i r uces tsa p 

et s y s r u oy 

lihood of specific intentional acts (as opposed to natural or accidental events) and their consequences will be 

emember that figuring out which threats are most likely will determine how your system will reduce risk and plan for 

e advantage of all of the information you have and make sure you continuously re-evaluate the likelihood of specific 

sequences. Additional tools for gathering information are discussed in “Where Can I Find Additional Help?” beginning 

2: Identify Threats 3: Consider Consequences 4: Assess Likelihood 5: Evaluate Measures 6: Plan Action

8 
VA Step 5

NG MEASURES 

hat additional measures need to be taken, you should evaluate the effectiveness of what you already do to protect your system. 

ou should answer the following questions: 

y

?

:e 

y

h

+ 

t net nI , st aer ht l a n oi 

,msi la d nav s a hc us 

,m s i r or r et d n a , n o sra 

ts ome ht er i u q er 

yt i r u c e s evis netxe 

m b , s er u sae e s e ht t u 

o s l a dl u o c s er usaem 

r u oy tcet or p pl e h 

l ar uta n ts nia ga metsys 

. staer ht l at n e di c c a r o 

er a s er u s a emt a hW 

ot e c a l p ni yl t n er r uc 

t s ni a g a st a er ht ya l e d 

ese h T ?met s y s r u o y 

: e d ul c ni dl u oc 

 o r t noc -y ek dn a skc o L l 

s e i c i lo p 

 r ehto dn a gn icn e F 

f o n o i tce t o r p r e p o r p 

me t sys lac i t ir c 

s t n en o pmoc 

 no i tc ennoc -ssor C 

lo r t noc 

+

d n a s e i c i l o p t a hW 

r u o y s e o ds er u d e c or p 

e v a h yl t n er r uc metsys 

ot d n o p s er ot eca l p ni 

? st aer ht f o tac i d ni s n oi 

sr e bmemf f at s e v a H 

n o g ni ni ar t dev i e c er 

sr otac i d ni taer h T ?me ht 

: e d ulc ni 

 smr a l ano isu r t n I  n o i tcnu f lamme t sy S 

smr a la 

 s t a e r ht en oh P  y t i lW auq re t a

s ro t ac idn i 

+ 

s e ici l o p yt i r u c e s t a hW 

u o y o d s er u d e c or p d na 

l l e wwo h d na wo n eva h 

?me ht wol l of u o y o d 

s e i c i l o p e va h t h gim u oY 

s er u d e c or p d na 

: g ni rev oc 

 y te fa s lenn os r e P  seey o lpmewen gn i r iH 

gn imr o f r e p dna 

skc ehc dnu o r gkcab 

 eht f o y t ir u c e S 

dna se i t i l ic a f lac isyhp 

s t n en o pmoc 

 ssecc a dna y e K 

lo r t n oc egdab 

 , s e ir ev i le d lac imeh C 

egaro t sdn a , gn i ldn ah 

 gn i n iar t y t ir u c e S  n i-den oh p gn i ldn aH 

s taer ht 

9 

hese questions, you probably found that some system components are already adequately protected, while others are 

xecuted and well maintained and those that provide little or no protection because they are poorly executed or 

es and procedures. 

4: Assess Likelihood 6: Plan Action

mation will help you prioritize the steps you take to protect your system. Be sure to distinguish between measures that 

is important that you do not overlook vulnerabilities caused by inadequate security measures or lack of knowledge about 

2: Identify Threats 3: Consider Consequences 5: Evaluate Measures 
l VA Step 6 

SKS 

ou’ve worked through in VA Steps 1 through 5, you can now develop a plan to reduce the risks facing your system. The 

ould allow you to identify your most urgent security needs and develop a plan that addresses these needs first. To develop 

C r o h s re dis n o t- -g n o l d na 

ta 

mr e t ot s n o i t u l o s hca e e ht f o

s s e i t i l i b ar e n l u v d e i f i t n e di u o y

n i s s e s s a r u oy m . t n e

n i  s s o P ible t rohs - mr e t 

. e 

n I ca tiviti s e e r a di des sucs in

" r uce S t a hW yt i l 

mI e v or p m s t n e M I na C e k a mI m ? y le ta i de " no e g a p 2 1

, s e

 s s o P ible l -gn o mr e t c a tiviti s e

dn

era di d essucs in " How D I o M n ia t n ia d n a e dar g p U yf i t n e di ot yrT t a ht s n o i t c a 

r u c e S e ht n i yt i g n o L e c u d or p l l i w m e l pi t l u s t i f e n e b 

d

i gn R ? n u " n o egap 72 e tsy s r u o y r of m n a c t a ht r o 

e ht k n a R s n o i t c a e ht y b e b m e da sa ra p r e ht o f o t y c n e gr u e ht f o t a ht dee n 

uoy y 

d e n na l p e t s y s m , se dar g p u hcae n o i tca . s e s s er d da 

a x e r of m : e l p

 D s e o i sserdda t taer ht a

du i gn  mI mtaer t dev o r p n e t taht is yr ev li ek ly ?erev es ro 

r uo

s essecorp ecu d e r n ac 

r o 

 D s e o i sserdda t n a sys e t m uv l b a r en iliti s e dn a 

r u 

i e t au q e d an ub r c t iti ac l eht ecn ahne y a d - -o t y a d

xe isti gn r uc es i y t m ? e r us ae tarepo i n o sys r u oy f o e t m 

vulnerabilities. One final word of caution: keep it 

p a second copy in a safe offsite location. 

eview the work you did in VA Steps 1 through 5. This will help to ensure that your plan considers all possible 

your VA contains a lot of important and sensitive information —

2: Identify Threats 3: Consider Consequences 4: Assess Likelihood 5: Evaluate Measures 

10 

6: Plan Action 
s Next?

ntified a number of system vulnerabilities, and you have begun to address those vulnerabilities with a plan to reduce risk. The 

s of this guide provide more details on the two methods you can use to reduce risk: 

 enhance your system’s security by taking direct measures that improve your ability to detect, deter, or delay threats to your 

 The next section briefly describes these concepts and offers basic security improvements that can address vulnerabilities. 

ults of a VA should be included in your system’s ERP so that you can respond effectively should vulnerable parts of your system 

tened. “What Is an Emergency Response Plan?” on page 16 describes an ERP and takes you through a step-by-step process for 

g one. 

11 
rity Improvements Can I Make Immediately?

velop a prioritized list of improvements that will reduce your system’s vulnerability to threats. Although security 

exity and cost, you will see in this section relatively inexpensive, practical changes that can be implemented immediately. 

nsultants or invest in top-of-the-line technology to act right now and increase the protection of your customers at a very 

s described in this section will help improve your ability to DETECT, DETER, and DELAY security threats (see circles below). 

ms share common vulnerabilities, 

ons that most systems should 

ecurity actions are described on 

 security actions tend to focus on 

ut some improvements can 

d make your system more secure 

ccidents, natural disasters) as 

Detect 

Know your water system and 

keep an eye on your facilities so you 

know when your security has been 

breached (e.g., patrol your water 

other points of entry for signs of 

tampering, establish a 

neighborhood 

watch program). 

Deter 

Make it very clear that your 

facilities are secure and closely 

watched and that the penalty for 

trespass is severe (e.g., require staff 

to display photo IDs at all times, post 

signs restricting entry to authorized 

personnel). 

Delay 

Have multiple security measures 

in place to slow down anyone who is 

trying to harm your system (e.g., lock 

“Jersey barriers,” install security 

fences around facilities). Delaying an 

intruder gives you more time to 

detect a problem and more 

time to respond. 

system perimeter, check locks and 

and alarm all points of entry, install 

ome of the measures 

 following pages may 

your system. Some 

mplex than you need; 

ess vulnerabilities 

y remedied. Look at 

em’s highest priority 

se the actions that 

12 
w l ac i t 

e t s y s r e t a m o c m ot s t ne n o p r o ht u a de z i :y l n o l e n n o sr e p 

sy aw ev isn e px e t s a e ld

1 . semi t l la t a s DI o toh p t n e r r uc y a lps i do t f fa t se r iu q eR . 

r u oy f o y t ir uc es eht e

lennos r e p d ez iroh

2 . . lenn os r e p d ez iroht ua o t yr t ne gn i t c ir t s e r sng is t s o P 

dn a s t n en o pmoc m

s t s eug des iv repu S "

3 . .ETA CI L PU D TON O D " sy ek pma t sdn a sy ek s ah ohw dr oc eR " 

d e t ivn inu r o d es iv r e pus

f in eve , sme lborp r o 

4 . y lr a luger s e d oc ss ecca dn a skco le gn ah C . 

, r e bmemer dn 

5 . .gn iht o l cgn iy f i tn e d ir ehto ro smr o f inu r a ew o t lennos r e p e r iu q eR 

d e g a tobas ev ah s e eyo 

6 . y l tn en imorp s e l c ih ev me t sys l lay f i tned I . 

7 . semi t l la t a d ekco le b o t se l c ihev e r iu q eR . 

. 8 ero feb s e l c ih ev mor f )sn a lp , s p amr e t aw ec r uos , . g. e ( n o itamr o f n i lac i t ir c ev omeR 

.t h g in r evo meht gn ikr a p 

. 9 . smr o f inu dn a , sedoc ss ecc a , sy ek , s DI o tohp n r u ter o t s e eyo l pmed e t an imr e t e r iu q eR 

1 . 0 se i t i l ic a f dnu o r a s ecne f y t ir uc es l la t sn I . 

. 11 dn a , s t n ev , s ehc tah , sw o dn iw, s rood : yr t ne f o n s t iop l lagn imr a la r e d isn o c dn a kc o L 

. s e t a g 

. 2 1 d ennamr o d ekco lan iht iwes oht nev e , r e taw d ehs i n if o t s t n iop ss ecc a l lakc o L 

. gn id l iu b 

. 3 1 . s e i t i l ic a f me t sys o t ssecc a e l c ih ev kc o lbo t " s re ir ra B y es r eJ "gn i l la t sn ir e d isno C 

. 4 1 nw o r gr ev o , s redd a ls a hcus , re du r t n in a di ao t d esu e b d luoc t aht s t c e jbo ev omeR 

. yr t n e f o n s t io p r ehto dn a sw o dn iwr a en , skc o r e gr a ldn a , s bur h s 

. 5 1 . s t rop pus dnu o r a s r e ir r a b lac isyh p gn i t t u p yb s kn a t egaro t sd e t av e l eo t ss ecca k c o lB 

13 
dg

c iim

i i l l

i t i l i t

l lAi

m

w

lii t

mil y l liim lm

l n i i .im

mmli t i ll

l l ii li mli t i

i llC i i

oD l c i mli t iwe ilbl l iw

illilm mi

iai l iwm i

iC miimi w

l li lan in iamlD im

.m

: t h gi sr e v o n a n

dn a d e t r t s e r s e t sys r u 

dna gn or tap y b y t r uc es 

c e t e d nac u oy taht os se 

e t sys r e t aw . sno su r 

se or r eht ec c a r p dn a on

.me t sy

. 1 . )y o dnar dna a c d o r e p( e t sys re taw eht dn a s r e ter e p ecne f o r t a P 

2 . gn repa t f o ecn e d ve r o f yr t ne fo s t op reht o dn a sk c o kc eh C 

3 . y r a u g e r s t n en o poc e t sys ac r c kc eh C . 

4 . st n enopoc ac r c dnuora gn t hg r o r e t xe e t au q e d a a t sn I . 

5 . sehcn a r b gn gnahr evo dna n o t a tegev f o sen ecn e f r a e . 

. 6 . s t nen o poc ac r c fo v r u oy kc o y eht erehw s e h ev krap t on 

7 . se t sys y t r uc es fo n o t au av e e du cn o t aunaM &O r u oy e t a d pU . 

8 . sr o bhg en ybraen ht a r g o r p hc t aw doohr o bh g en hs ba t s E . 

. 9 , . g. e( r e taw d e t a e r t dn a ar r o f s r e t ea r a p gn ro t n ogn dn a pxe red sn o 

d e r o t n oh c a e r o f eu av en es a b a t dn a p o eve . ) r o d o , r o oc ,Hp 

r e tearap 

d w m

tmias i t

md l 

ii lmt

i t i l im

im

i

ii liG iwmii l imm

. tmpi 

s lc ii i t i l i i l

i t i v i ti c i l pl

s i le l pmi t i v i ts l li c imD 

emn ilii t i v i ts l li c ii tm

"n il d " 

: t n ee cr of ne al l a c ol ht i w eta ni dr o oc 

n a t r o pyr ev n e

r uoy ekao t esu u oh

s rec f fo ec o p t sou b , e 

ro s e c a f e t sys re taw h

r e ted t h g ecn e s e r p e

.m e t sys r u oy gn n e t a 

. 1 y ek ht eht ez r a a f o t e t sys r e taw r uoy f o r uo t a s r ec f fo ec o p ev 

n eu q e dn a sess ec o r p 

2 . ht t uoba e c o p e tacu d E . s e c a f r uoy f o o r t a p d o rep r o f egn a r r A e

re taw eht t u ohgu o r ht eca ek a t d u oc t aht s e ca su o psus fo s e py t 

.m e t sys 

. 3 r o f smr o f dn a s t kc ehc a S . s e ca dn a ac suo psus t n euc o 

eht fo os dedu cn era s e ca dn a ac suo psus gn neuc o d 

dnuo f s oo t ? ple H l a n oi t i d dA ni F I n a C er e hW . 43 egap n o 

14 
w

i

i ll

l a i t

i ls lim

m la i

i

y lmi f ic i l

ll l iw

i i l i t i

im

imii ll l m . l

.li la 

an is liml la i l

mpis l me .i

.n ilii ll 

ii i -w

i l pmemiimm y l

s n iam i . tmpil

: sre i l p p us d n a sr o d nev ht i w g ni l a e d ne h yt i r uces d na n oi t a c 

r uoy t a y t r uces eht 

dna s r e p pus ac 

f o s ec r uos ne t o p 

dn a d e r ev e d ac e

c e ps ev res e d 

esop y eht t aht ks r eht f

r e p o r pbup eht 

y a ed s dr au g e fa S . 

su o r e gn a d eseht 

. 1 ton e r a s t cu d o r p r eht e r usn e o t sn o uacerp ek a t s re p pus r uoy t aht y f reV 

. d e t an a t n oc 

. 2 enn o s r e p e t sys re taw fo ecn eserp eht n e d aera s e r ev e d a taht e r usn E 

3 . go yr ev ed p e e K 

4 . y n o e gar o t s r o f d e t ang s e d a e r a e r uces ac ehc e r o tS . 

5 . et sno ycnegren a o t dnops e r o t d e d e en t n euqe dn a oo t p e e K 

6 . ecn av d a d e u d ehcs s e r ev e d y n o t p ecc A 

7 . DI deu ss r o dnev ohs o t s r ev rd er u q eR . 

. 8 p pus re t aw o t ss ecc a ev ah ohw s e eyo yn a poc no t ac nuoc f o s DI y f reV 

neu q e d e ta e r dn a s ann e t n a fo r aper dn a ecnan e t ro f s e r u t cu r t 

:yt i r uces s dr o c er d na r 

r o f s r e t u pmoc sesu 

ev i t isn es e r 

eseht f o emos ek a t d lu 

s in o it amro f n it aht 

gn idrau g e f as y B . pu -d e

uoy , s dr ocer repap 

. e g a t o b as fo s t ca e 

. 1 

2 . 

. 3 

. 4 

. 5 . 6 . 7 

e t a d pu dna s dr ows s a p e gnah C . s re t u pmoc l la t ce t o r p-su r i vdn a t ce t o r p-drows s a P 

. y lra lu g e r smargorp n o i tce t o r p su r i v 

y lra lu g e r s r e t u pmoc dna , sma r g o r p , se l if pu-k c a B . 

. s e t i sW b eno e lb a l iav a s ime t sys r u oy t u o b a n o itamr o f n iev i t isn es on t aht e r usn E 

. n o it aco ler uc es an is t nemucod t n a t r o pmireht o dn a , sdroc e r , s p amero tS 

, e r uc es an is t n emucod t n a t r o pmireht o dna , s dr oc e r , spamf o s e ip oc pukcab ero tS 

. n o it aco le t i s -f fo 

e r a s t c e jo r p r e t fa n r u t e r s t ier iu q e r dn a " la i tn e d i fnoc "n o it amr o f n iev i t isnes l lalebaL 

. de t e l pmoc 

n o se t a d eht dna n o it amro f n iev i t isnes d essecc a ohw s e ey o l pme fo droc e r a p e e K 

. no it amr o f n ieht d essecc a y eht hc ihw 

15 

tect the health of your customers. By detecting, deterring, and delaying threats, you are reducing your system’s 

n the next section. 

imidated by the length of these lists. Any security improvements you make will decrease the risks your system faces 

es. Any risks you can’t minimize through security measures should be addressed as part of your ERP, which is 
Emergency Response Plan?

ught-out series of planned actions that help you respond to emergencies of all 

a small drinking water system makes use of the system’s VA (see “What Is a 

?” on page 4) by addressing possible consequences of vulnerabilities identified 

clear and logical steps to take in response to possible emergencies, 

ble for specific actions, provides for training and planned practice exercises, 

nation with first responders, law enforcement, and health officials. 

t have an ERP, you should prepare one. An ERP will help you organize your 

fore they happen. An emergency can happen at any time, and any problem 

y will become a top priority for you and the affected members of your 

ould generate tremendous and immediate pressures on system operators, 

sionals, law enforcement, local health officials, and the public. A system that 

ed organized emergency response exercises will have a much better chance of 

ergencies. Therefore, having a well-planned system response to foreseeable 

ense. 

some effort. You should build an internal team of water system operators, board 

velop a complete ERP. The steps below can help you prepare a new ERP (or 

Keep in mind that the most effective ERP for your system will build on the 

ember that your state can be a good source of assistance should you have 

veloping your ERP. Finally, because every system is different, you may need to 

t process described below to make it work for you. 

me states may have their own ERP requirements. Make sure you check with 

has established specific requirements that you must address. 

hat follow offer only a general overview of the activities you should undertake to 

 a number of resources that offer detailed worksheets or other tools to help you. 

an I Find Additional Help?” on page 34. 

16 

on 2: Core Elements 4: Action Plans 5: Next Steps

ge to page. 

3: Putting it Together 

your ERP, follow the five steps listed on the following pages. The graphic below will help you track the steps as you 
ERP Step 1

N 

ou should identify and form partnerships with the people and organizations whose help your system will need in an emergency, 

olice and fire departments z Nearby water utilities (for developing interconnections and 

ealth officials mutual aid agreements) 

mergency Planning Committees z Health care providers 

overnment/city managers z Equipment suppliers 

d federal agencies z News media 

rships with these organizations and individuals will help you better develop the core elements of your ERP and better coordinate 

en the ERP is put into action. The partnerships also will help everyone become better prepared for emergency response. 

 Local Emergency Planning Committees (LEPCs). A typical LEPC is made up of representatives of the municipal government, 

s, environmental organizations, citizen groups, law enforcement and other emergency response officials, industry, and other 

maintains a database of over 3,000 LEPCs and their contact information. Visit http://www.epa.gov/ceppo/lepclist.htm to see 

y has an LEPC. If it does, you should work especially closely with the LEPC when developing your ERP. Doing so will help 

se to any emergency is coordinated as efficiently as possible. 

erstand your goals and including your partners in the development of your ERP will improve your plan and help you develop 

e relationships with your partners. 

potential partners, describe your plans and objectives to them, and solicit their input and assistance. Helping your 

ration 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

17 
ERP Step 2

SPONSE PLAN – CORE ELEMENTS 

hould be included in any ERP, including yours. These elements will help ensure that your ERP and emergency response 

spond to any kind of emergency or threat. At the same time, the elements are flexible enough to ensure that your ERP 

your system. The core elements are discussed below. 

pecific Information 

 be able to provide basic technical information to personnel who will provide emergency assistance. In most cases, the 

stance will be those with which you formed partnerships under ERP Step 1. To ensure that you can provide the necessary 

quickly and accurately, it is important that you include it as an easily accessible part of your ERP. 

mation that you should include in this section of your ERP is: 

tion served and number of service connections 

ution system) 

 isolate parts of your system when the need arises 

 name, operator name(s), and Public Water System Identification (PWSID) number, which identifies your system to 

ate and to EPA 

ormation about critical system components (e.g., source water, treatment plant, water and chemical storage, and 

n 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

18 
ERP Step 2 (Continued)

 and Responsibilities 

 and responsibilities for yourself and for your partners from outside of your system. First, you should designate an Emergency 

a back-up) who will be the main point of contact and the primary decision maker during an emergency. Other system personnel 

hould understand their roles, responsibilities, and place in the chain of command. While it is important not to get bogged down 

 it is also important that you and your Emergency Response Leader make sure all parties are clear about their roles. 

 familiar with what is known as “command structure language.” The Federal Emergency Management Agency (FEMA) and other 

ng the National Incident Management System (NIMS) to coordinate emergency efforts. Your state and local government may 

S. The NIMS Incident Command System (ICS) is the standard organizational structure for all major domestic incidents. It helps to 

many emergency responders. NIMS will enable responders at all levels to work together more effectively to manage domestic 

t the cause, size, or complexity. You can obtain more information on NIMS and the NIMS ICS from FEMA at http:// 

m, your ERP should include the following basic information for your Emergency Response Leader and one back-up 

act: 

emember to communicate this information to your partners verbally and in writing. 

z Home telephone number z Address 

e 

phone number (if applicable) 

z Work telephone number z Pager number (if applicable) 

so identify other key individuals and partners and describe their roles, responsibilities, and places in the chain of 

aration 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

19 
ERP Step 2 (Continued)

cation Procedures - Who, What, and When 

a variety of audiences is an essential component of your ERP. You should plan to notify three groups of people: system 

nse partners, and the public/news media. 

Your Emergency Response Leader or backup should be the first person notified of an emergency. Other appropriate 

en be contacted. 

 – These are the partners you identified in ERP Step 1. They should be contacted as necessary depending on the type of 

dia – You should designate in advance a spokesperson who will handle public and media communications during an 

okesperson should not be the Emergency Response Leader. You should also develop a plan that your spokesperson can 

ting with the media and the public. This plan will help your spokesperson maintain a message that is clear, accurate, and 

y your audience. For more information about communicating with your water consumers, see “How Should I Communicate 

?” on page 30. 

st templates you can use. 

include contact information for all individuals and organizations that fall into the groups discussed above. The list 

ntact names, addresses, and all phone numbers for each contact. Update this list regularly to ensure that information 

anize it to ensure that the highest priority calls are made first. States and technical assistance providers may have 

on 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

20 
ERP Step 2 (Continued)

4: Personnel Safety 

ealth and safety of your personnel is an important part of your ERP. In your ERP, you should write out basic safety precautions, 

ion of first aid supplies, and identify locations where personnel should meet in the event of an emergency. You should also 

your personnel are regularly trained in all of your safety procedures. 

el safety section of your ERP should, at a minimum, include the following: 

tions for proper first aid and medical treatment 

edures for using and maintaining emergency response equipment 

fication of evacuation routes and evacuation procedures 

fication of assembly areas and procedures for locating all personnel 

tion 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

21 
ERP Step 2 (Continued)

tion of Alternate Sources of Water 

ernate sources of water that can address short-term (hours to days) and long-term (weeks to months) outages. There are a 

or short-term and long-term water supplies. Short-term options include bottled water from outside sources or retailers and 

ources. Long-term options may include connecting your distribution system to a neighboring system. These alternate 

entified in your ERP, and the agreements or arrangements for accessing the alternate sources should be clearly spelled out. 

ements with these sources should be kept up to date. 

mpact of various public health notifications, including “boil water,” “do not drink,” and “do not use” notices. The different 

to deal with each of these notifications should be addressed clearly in your ERP. See “How Should I Communicate with 

0 for guidance on notifying your customers and providing them with instructions on how to protect themselves. 

ng to remember is to identify short-term and long-term alternate water sources in your ERP and to establish 

these partners before an emergency occurs. Your ERP should list your alternate water sources, along with the 

nformation. You should also file copies of your agreements with your ERP. 

nt and Chemical Supplies 

tem’s VA, you should identify in your ERP where to find the equipment, repair parts, and chemicals needed in the event of 

ERP should include an updated list of: 

pment 

 

pplies 

 with nearby systems to share portable generators and spare parts 

rmation for any partners who can assist you with equipment and chemical supplies 

on 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

22 
ERP Step 2 (Continued)

rty Protection 

 equipment, and records is very important for getting your system running again after an emergency. Your ERP should clearly 

secure and protect important assets. 

 the steps you will take to protect other crucial property and records. 

n of your ERP, you should consider describing how you will lock down your facilities, how you will control access to your 

r Sampling 

termining whether the water your system produces is safe for your customers to drink and use. In your ERP, you should 

 and monitoring issues that could arise during an emergency. Water sampling and analysis is critical during the detection of an 

very from an incident. When developing your ERP, you should consult with your state on water sampling and monitoring 

responsibility for water quality monitoring, during an emergency. Make sure you know what to do in an emergency before an 

er sampling procedures 

ocation and number of required samples 

is responsible for taking samples 

act information for laboratories or partners who will help analyze the samples and explain the results 

clude the following information in this section of your ERP: 

ration

23 

2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps
ERP Step 3

TOGETHER AND KNOWING WHEN TO PUT IT INTO ACTION 

he core elements of your ERP, you should organize and document that information in a useful way. If you have an 

ency management documents, now is the time to update all of them with the work you’ve done in ERP Steps 1 and 

produce a single, complete ERP that is accessible and easy to use. How you organize and document your ERP is 

the specific needs of your system; however, you should check with your state to see whether it has any 

ct your finished ERP. 

also develop procedures for deciding when to put your ERP into action. Knowing when to use your ERP is as 

documenting it. In a natural emergency such as a tornado, earthquake, or flood, the decision to put your ERP into 

of emergency is easy to confirm. 

when to put your ERP into action when it comes to intentional acts. Here, the decision is critically important. While 

tention to any threat, you need to carefully think through and document a process to screen out hoaxes and avoid 

reat incident, it is critical that you or your Emergency Response Leader consider three key questions: 

e? 

? 

n confirmed? 

cific threat. More information about assessing threats is offered in some of the tools listed in “Where Can I Find 

?” on page 34. 

nswers to these questions will most likely differ with each incident and will probably determine what parts of your 

mplemented. You or your Emergency Response Leader should exercise judgment when determining how to 

on 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

24 
ERP Step 4

RESPONDING TO DIFFERENT TYPES OF EMERGENCIES 

your system with quick approaches for responding to specific types of emergencies. The Action Plans that you develop should 

 activities outlined in the core elements of your ERP and should be tailored to specific events (e.g., floods, tornadoes). Action 

nd concise “rip and run” documents that can be detached from your ERP and taken into the field by emergency responders. The 

ion Plans should complement actions already initiated under your ERP. You should develop Action Plans for intentional acts 

 and other significant events. 

er the following incidents and threats of such incidents (e.g., hoaxes): 

nation z Intentional hazardous chemical release

al damage/physical attack z SCADA, computer, or cyber attack

Other Significant Events 

rate or modify existing plans to deal with a variety of natural disasters and other significant events. If you don’t have existing 

 develop new plans to cover such events that may affect your system, including: 

z Earthquake z Accidental hazardous spill/release z Electrical power outage z Construction accidents 

e and tornado z Mechanical failure z Personnel problems (loss of operator, 

weather (snow, ice, z Water supply interruption medical emergencies) 

ture, lightning, drought) z Contaminated water treatment chemicals 

zz

specific type of emergency 

z Recovery actions to bring your system 

back into operation 

z Remediation actions needed to make 

sure your system is fully restored 

your Action Plans should be clear, concise, and accessible. They should be well organized to make sure that the proper 

can be found quickly by the staff members who need it. Your Action Plans should include the following basic information: 

Special notification requirements Special response steps necessary for the 

ration 2: Core Elements 3: Putting it Together 4: Action Plans 5: Next Steps

25 
ERP Step 5

P is only the first step in making sure that your system is prepared to deal with an emergency. Your ERP should be a “living” 

nd update regularly to make sure that all of your information is correct and up to date. Training in how to use your ERP is 

ng and updating it; even the best ERP will be difficult to implement during an emergency if people do not know their 

egularly practice implementing your ERP. Orientation exercises, table-top workshops, functional exercises, and full-scale 

ou can help to make sure that your well-planned ERP is executed properly and efficiently when a real emergency arises. 

on about these training exercises in the tools listed in “Where Can I Find Additional Help?” on page 34. 

tion 2: Core Elements 3: Putting it Together 4: Action Plans

26 

5: Next Steps 
Maintain and Upgrade Security in the Long Run?

 ERP does not mean you have reached the finish line; a lapse in security and preparedness can be disastrous. You should 

weaknesses, upgrade your system’s security, and plan for unforeseen events. You should regularly reassess your vulnerabilities 

threats and personnel change. Remember to regularly practice implementing your ERP, especially if you make changes to it. 

ulnerabilities 

ecurity strategy should be to re-evaluate your vulnerabilities. Ask your state if it has changed any of its security requirements. 

 resource for finding the latest information available on system vulnerability and security. Perhaps a new threat has emerged in 

y measure is available, or new funding programs have been created. In addition, you should continue to train staff members so 

tem’s vulnerabilities and their roles in keeping the system secure. 

arMet Recruits Customers for Community Watch Program,” Wilson County News, February 12, 2003: 

.” 

Neighborhood Watch Program 

y 2003, The Bexar Metropolitan Water District (BexarMet) in Texas began asking customers who live near water facilities to 

chful eye on any unusual activity. Participants were asked to call BexarMet any time of the day or night if they observed 

 activity around a water facility. 

s of BexarMet who live near water facilities received a letter requesting their assistance. The letters outlined the program and 

ituations when residents should call 911 or BexarMet dispatchers. In addition, volunteers were given magnets with the phone 

BexarMet dispatchers. Pablo and Angelita Gallegos were the first volunteers. They live near a water storage tank and see 

m as a good step forward. “We’re here all the time,” said Pablo Gallegos, “and whenever I see something, I’ll call because we 

27 
y 

standing of your system’s vulnerabilities 

o reduce risks by implementing security 

ly or take more time to put in place. As your 

might need new security upgrades. The table 

curity measures that can detect, deter, and 

our security may also benefit other areas of 

xample, properly sealed wells provide source 

evention programs improve the quality of water 

s, and increased knowledge of your system 

al, financial, and managerial capacity. 

: s 

no it ac i lp p a b o jahgu o r ht seey o lpme

, 

. k c ehc dnu o r gkcab adn a , secn 

st s euqer n o it amr o f n ic i lbu p ht iwlaed o t er 

. 

et cepsus fo sn o itac i f it on ev iecer o t er 

d 

lac o lyb yr evocs id r ieht re t f a y le t a id emm

oit an ima t n oc fo y t inummoc eht es iv d a o t 

n 

. yr ev ocs i ds 

emo t suc o t y le ta idemmidnops e r o t e r u d e

r 

e lb a t c e t e d r ehto r o , ro loc , rodo , e t s a t w en 

. y t i la

no itamro f n i lac i t ir c o t ss ecca gn idr a g e r 

. 

se i c i lo p y t ir uc es re t u pmoc t n em

. 

, la r e d e f , e t a t s y b d e d ivorp sn it e l lu b dna s g

. sn o it az in a gr o r o s e icn e g a la t 

: yt i r u c e S lac i s y h P e dar g p U 

. 1 f o d e t cur t sn oc t ' n e r a t aht s e gn i hdn a s r o o d lac i t ir c ec a lp eR 

. l a ir e tamde c r o f n ier y t ud-yvaeh 

. 2 e d isn ieht no de t ac o lera s roo d ro ir e t xe n o s e gn i her us M eka

. gn id l iu b eht f o 

. 3 hs eme r iwht iwd ec r o f n ie r dn a d e t lob era swodn iwer us M eka

. s rab n or ir o 

. 4 a f is e i lbmessa no i tn ev e r p wo lf kcab dn a n o itaz ir oht u a e r iu q eR 

. gn it h g if er if n aht reht o es o pr up yna r o f desu s i tn a r dyh 

. 5 .m a r g o r p no i tn everp wo lf kc a b a t n eme lpmI . 6 . s d a eh l lew la es y lr e p o r P . 7 t onn ac dna de l la t sn iy lreporp era s p ac dna s t n ev er us M eka

. d evomer e b 

. 8 . s l lew d en o dnaba l laC p a . 9 . )s ( ec r uos r e t aw ec a f r us r u oy dnu o r a gn icn e f l la t sn I 

. 0 1 . kn a t egaro t s r u oy e t a los io t u oy wo l la t aht s ev lav l la t sn I 

. 11 e b d lu ohs ( no it an ima t n oc r e ted o t s t n a r dyh e r if y t ir o ir p kco L 

t . ) n emt r a p ed er if ht iwn o ita t lusn o c n ieno d 

. 2 1 tc e ted o t kn a t egaro t shcae n o p a t gn i lpmas al la t sn I 

. n o itan ima t noc 

. 3 1 n o iu b tis r t id r uoy n ier u ss e r p ev i t isop n ia t n iamdn a r o t inoM 

.me t sys 

. 4 1 . tnempiu q e r e t upmo c r u oy t c e torp y lr e p o r P 

. 5 1 . d e tan imu l l ime t sys r uoy p e e K 

28 
 the risks posed to your customers, you should continue to prepare for emergencies. You should re-examine your ERP, 

m and its vulnerabilities change, so that you can respond to a crisis. Make sure that you do not let the relationships and 

s that you’ve built deteriorate over time. If possible, you should conduct drills regularly to make certain that your system is as 

 an emergency. 

29 

Threat Response 

, November 23, 2003: 

mber 2003, system managers at Las Cruces Water Utilities (TX) emptied a city water tank after an alarm 

 a break-in. Lacking a means to quickly determine if the water was contaminated, operators elected to drain the 

orage tank. 

anks to supply users. 

more quickly in the future.” The system was able to isolate the problem to the tank, and its customers were not 

niel Borunda, “Utilities Take Steps to Protect Water Supplies,” El Paso Times

em flushed and refilled the tank, returning it to service the following day. In the meantime, the system used 

em worked very well,” Water Resources Administrator Gilbert Morales said. “There were a couple of areas that 

 where our system could have been better, but this helped us identify those shortcomings and will help us 

at your VA and ERP contain sensitive information and should be stored in a safe place. In addition, copies should be 

re off-site location. Access to your security information should be limited to staff members and to local and state 

eed-to-know basis only. 
d I Communicate with My Customers?

ur customers is an important part of your emergency response efforts. The people who depend on you for drinking water will 

onest information during an emergency. Without this information, your customers may erroneously assume your water is 

ven worse, your customers may continue to drink contaminated tap water because they have not received the message 

velop a plan for communicating with your customers during an emergency or other crisis. There are several steps. The first 

l customers, the customers who could be most affected by a problem with their water supply. The second step is to 

ifferent groups in your community that could help you get your message out when you need to. The third step is to prepare 

omers during an emergency. The relationships you built during the second step will help you do so quickly and efficiently. 

RS 

y, your critical customers will need to be alerted quickly and may require an alternate supply of water. Critical customers are 

r-quality water and insufficient quantities of water. Among them are children, the elderly, and the sick, as well as important 

rtments, hospitals, and power plants. You should establish communication channels with these customers now so they 

n of an emergency. 

30 
ONSHIPS FOR EFFECTIVE COMMUNICATION

and whom you need to notify, you should build relationships and 

ute critical public health information during an emergency or other 

an and should be made long before you face an emergency so that 

quickly and effectively. Your emergency communication will only be 

ships you build before a crisis. 

ships with local media outlets, including radio stations, television 

rs. Your local media are important because they may be the easiest 

ur system to notify the public. They are also less likely to exaggerate 

hey understand the issues ahead of time. You should designate a 

e who will handle media relations during an emergency. This 

OT be the Emergency Response Leader. Even before an emergency 

sperson should meet with local media representatives to determine 

 they will need, how best to get it to them, and when they will need it 

Using this input, you should develop a plan for communicating with 

esperson can follow during an emergency. 

works, such as homeowners’ associations, can also help you 

stomers during an emergency. It is important that you identify and 

re a threat or other emergency occurs. You might want to consider 

tribution list or a calling chain so that you can notify the lead contact 

kly as possible. 

the Media 

z At the top of the press release, write 

“PRESS RELEASE FOR PUBLIC SAFETY” to emphasize its importance. 

z Answer questions as well as you can, and 

don’t be defensive or afraid to say that you need to check on something if there is a 

z Be sensitive to the fact that media 

representatives may have tight deadlines and other pressing needs. 

z Monitor local media to check whether 

they are reporting the information 

z Don’t be upset if media coverage is not 

exactly as you would want. Politely inform the media outlet if important information is wrong or missing. 

z If a media outlet will not publish or air your 

warning, you might need to buy ad space. 

Helpful Tips for Working with 

question you cannot answer. accurately. 

31 

Hotline at (800) 426-4791. 

 in this section is taken from EPA’s “Public Notification Handbook” (EPA 816-R-00-010-2000). You can find more 

ublic notification in the handbook, available for downloading at http://www.epa.gov/safewater/pn.html or from the Safe 
GENCY NOTIFICATION 

ationships discussed to this point are important because they allow you to communicate quickly and effectively with your 

ency. Don’t forget that you might be communicating with your customers to minimize overreaction by reassuring them that 

espite the crisis. Here are some practical rules you should keep in mind when communicating with your customers: 

nt 

e that everyone can understand 

hort and sweet” 

on-English speakers 

ame of your system and your service area, especially if your community is served by more than one water system 

ture of the emergency, the population at risk, actions that consumers should take, and alternative sources of water (if 

number for more information

s to one page designed to catch your customers’ attention (bright colors and large text)

an communicate with your customers. The method you choose depends on which of your customers you are trying to reach, 

d the urgency of the threat. Keep in mind that you will probably need to use a mixture of communication tools, since you 

stomers using only one method (e.g., some customers may not listen to the radio, watch TV, or read a newspaper). The 

e it that much more important that you plan ahead so that you are not overwhelmed during an emergency. A partial list of 

hat you might use is found on page 33. 

NING: When communicating with customers, keep in mind that you want to provide enough information 

eed to be informed of that facility’s particular vulnerabilities.

! 

able them to act appropriately, but not so much that you increase the system’s vulnerability to a threat. 

stance, most customers will know if they live down the street from a water treatment facility, but they do 

32 
ON OUTLETS

– Television and radio, if available in your community, may be the quickest way to inform the most customers. Check with 

 whether you can broadcast an alert over the federal Weather Radio alert system. See the box on page 31 for more tips on 

 

ending on the urgency of the situation, you might want to work with the local paper. This outlet can be especially helpful 

 customers updated during a prolonged crisis. 

n be delivered to each business and residence or posted in public places. For instance, a campground may post signs in 

entrances. If you have the time and staff, you can combine postings with word of mouth by trying to talk to customers as 

ember to make the notices from materials that will hold up against wind and rain. 

ATION – Word of mouth is the oldest and potentially most time-consuming method. You may call, e-mail, and go door-to

s. E-mail might be particularly effective in a university or office park, while calling may be the quickest method to notify a 

on. Some systems may use an automatic dialing service to systematically call every customer and play a recorded 

e time-consuming, going door-to-door might be the best way to make sure that all your customers receive the alert. 

se any other methods of communicating with your customers that you think will work well for your system. For example, 

alth warning from moving vehicles (such as a police vehicle) can be effective if your customers are at home or in a concentrated 

You should use whatever means you need to communicate with all your customers as quickly as possible. 

33 
 I Find Additional Help?

 and preparedness of your system takes a lot of work, it’s an important step in protecting your system and your customers. 

 are available to help you accomplish the activities outlined in this STEP Guide. This section provides an overview of some 

ce. They include your state, EPA, drinking water associations, and technical assistance providers. 

ok for help is your state (see Appendix A for contact information). States and EPA have been working together to identify 

ss their security vulnerabilities and implement ERPs. Many state efforts, such as sanitary surveys, optimization programs, 

vities, and capacity development, enable the state to provide you with security technical assistance and possibly even 

ate inspector conducting a sanitary survey of your system might be able to help you identify some of your system’s 

tates consider security an essential part of technical and managerial capacity, you might also be able to take advantage of 

assistance programs. 

 information and assistance. The Agency has established a water system security page on its Web site 

tersecurity). EPA provides an updated, comprehensive list of publications, information, and other resources for small and 

s. In addition, the Web site includes security resources geared specifically towards small system security, public 

 security, and information sharing between water systems and public and private sector organizations. 

ciations and technical assistance providers can be very important partners in efforts to improve system security and 

everal organizations have produced valuable security tools, ranging from simple how-to books to sophisticated software. In 

s are valuable sources of information on the experiences (both positive and negative) of other water systems, and they may 

n on and evaluations of various security technologies. These organizations also offer training opportunities, as well as 

forums where you can find the latest information on water system security. 

v 

sr e di a c i n h c eT f o s sA l o t e c n a t s i r D g n i k n i W e t s y S r e t a ms

n o it a icoss A 

skr o

/gro . awwa. www/ /: pt t h 

7337-629 )008( 

n o ita ic oss A r 

/gr o . awr n . www/ /: pt t h 

9260-252 )085( 

pihs r en t ra P ecn a t s iss 

lmt h. tca t n oc /gro . pa c r . www/ /: pt t h 

7227-123 )888( 

r e t ne Cs ec iv r e S la t n

_csen /csen /ude . uvw. csen . www/ /: pt t h mt h. tu o b a 

1038-426 )008( 

ts and Bulletins” sections that follow are good starting points for identifying the resources available to help you understand 

reduce your risks, and prepare for an emergency. You may also find it useful to hire a consultant to evaluate your system, 

abilities, or assist you in developing an ERP. Contact your state or technical assistance provider for a referral to someone 

34 
 provides links to a number of security tools, training opportunities, outreach materials, and other information. Visit http:// 

rsecurity and click on the appropriate links for a list of all materials available. The following paragraphs list some of the materials 

 Web site: 

nerability Assessments”) 

nt Guide for Very Small (Serving Fewer than 3,300 Persons) Systems. Developed by the Association of State Drinking Water 

ASDWA) and NRWA in consultation with EPA, this document is available from ASDWA’s Web site (www.asdwa.org). Scroll down 

he page to view this document. 

 Vulnerability Assessment for Water Systems. EPA’s Drinking Water Academy and the National Environmental, Safety, and 

Association (NESHTA) have produced a video for water systems serving fewer than 3,300 persons to aid in assessment of their 

 can obtain the video using the order form available at http://www.neshta.org/PDFs/orderform.pdf. 

Water Works Association (NEWWA) Automated Security Survey and Evaluation Tool (ASSET). The ASSET VA software is 

EWWA by visiting http://www.newwa.org/asset_software/index.php. 

mergency Management System (SEMS). Contact an NRWA affiliate in your area for more information on this combination VA 

re package. 

mergency/Incident Planning”) 

ncy Response Plan for Water Systems Serving 3,301 – 10,000 persons. NESHTA has developed a video for small water 

 populations between 3,301 and 10,000 persons, although smaller systems may also find the video helpful. The video highlights 

between VA results and ERP development. You can download an order form at http://neshta.org/Publications/Security.htm or call 

o place your order. 

sponse Tabletop CD-ROM Exercises for Drinking Water and Wastewater Systems (EPA-817-C-05-001). This CD-based tool 

p exercises to help train water and wastewater utility workers in preparing and carrying out ERPs. The exercises provided on the 

ngthen relationships between a water supplier and its emergency response team. 

ms with EPA document numbers can be ordered through the Safe Drinking Water Hotline, (800) 426-4791. 

35 
on “Publications” and then on “Outreach Materials”) 

e’re All in This Together (EPA 810-F-03-006). This brochure for residents describes how they can help local 

e water utilities in their communities. 

r Supply Emergency Preparedness and Security for Law Enforcement (EPA 901-H-03-002). This list is also 

 (11" x 17") for display in local municipal facilities to help in coordinating the efforts of law enforcement, the water 

public health officials. 

ters. EPA has developed a number of posters to help alert and educate communities about water security. In 

en List poster, “Report Suspicious Activity at Reservoirs, at Utilities, and at Water Mains” (EPA 810-F-03-001) and 

Activity - Watch Out! Help Out! Report It!” (EPA 810-F-03-002, 003, or 004), are available. 

TINS 

plementing alert or bulletin systems to provide water systems with critical security information. Regular alerts and 

 e-mail or fax. Contact your state to see whether an alert or bulletin is available and to find out how you can join the 

r Security Channel (WaterSC) provides alerts and vital security information to key personnel at drinking water 

C is a free e-mail notification system that can send notices to mobile devices configured to receive e-mail. 

e Web site that contains an archive of federal alerts, advisories, and bulletins. The service is free and systems can 

or by calling 1-888-H2O-SC4U. 

 free Rural Water Alert System (RWAS) to share security information with rural water systems. NRWA expects to 

2005. The system will provide security information to rural water systems who may not subscribe to the WaterSC. 

 the WaterSC in the type of information provided and will be accessible via the Internet. However, RWAS is not a 

rmation on RWAS is available through state NRWA affiliates. 

36 
A: Safe Drinking Water Act Primacy Agencies

e t i s W b e r e bmuNe n o h P 

W p pu S r e t a: t n em

e g an a

hcna r B y l mt h. o f n n I i aMW D/gn ikn ir D/no i s i v iW Dr e t a/su . l a. e ta t s.meda . www 0077-172 )433( 

W a r g o r P re t agn ikn ir D : n o it av resn o 

m

wd/h e /ced/su . k a . e t a t s. www 7467-962 )709( 

yc

mt h. gs a . ape /s e icnega /moc . v o g-gsa . www 4032-336 )486( 

W a rgo r P r e t agn ikn ir D e f a S : y t i lau

m lmt h. x edn i /wd/r e t aw/n o r ivn e /v o g . q e dza . www 0032-177 )206( 

gn ireen ign E f o 

/gn e /moc . s asna kr ayht la eh. www 3262-166 )105( 

W dn a r e t agn ikn ir D f o no i s i v iD 

mno r ivn E 

n e la t mt h. x e dn ipw d/pw d/ lac inhc e t /mew d d/sp /vog. ac . shd. www 7 7 55-944 )619( 

W a r g o r P r e t agn ikn ir D : t n emno r ivn E d

m

_r e t aw _gn ikn ir d/r e t aw _gn ikn ir d/qw/su . o c . e t a t s. eh p dc . www 

mt h. emoh_ma rg o rp 0053-296 )303( 

n o i s i v iDW re t agn ikn ir 

mt h. dw d/r e t aw/SR B/su . t c. e ta t s. hpd. www 3337-905 )068( 

ht la eH c i lbu P f o no i s i 

lmt h. tu o b a /h p d/ssh d/su . e d. e t a t s. www 0 0 74-447 )203( 

37 
et i s b eW r e bmu N e n o h P 

3n o ig eR 

re tawgn ikn ir d/3 ger dpaw /v o g. a p e . www 32-41 8 )5 1 2( 00

margor P r e t aW gn ikn ir D : n o i tce t 

mt h. xedn i /r e t aw gn ikn ir d/r e taw/su . l f. e ta t s. p e d. www 533 8-54 2 )0 5 8( 

hcnar B s ec r u os eR W re t a:

/gr o . d p e a g. www 749 5-7 5 6 )4 0 4( 

no i s i v iDsmargor P r e taW 

r e t aw/smarg orp/t en .mau gvog. a p emau g. www 8561-57 4 )1 7 6( 

n o i s i v iDht la eH la t n 

. x e dn i /ds bw /r e t aw/ la t nemn o r ivn e /ht la eh/v o g. i iaw ah. www mt h l 852 4-6 8 5 )8 0 8( 

n o i s i v iDy t i lauQ r e taW : y t i la

/re taw/su . d i. e ta t s. q e d. www 49 1 0-3 7 3 ) 8 0 2( 

r e t aW f o uaer u B 

lmt h. sw p-xe dn i /r e taw/su . l i. e ta t s. a p e . www 356 8-58 7 )71 2( 

hcn a r B r e taW gn ikn ir D : t nem

e g an 

/d bw/re t aw/me d i /v o g. n i. www 306 8-2 3 2 )71 3( 

W p pu S r e t a:

margor P y l lmt h. xedn i /gn ikn ir d/r e taw/moc .r ndaw o i. www 572 0-52 7 )51 5( 

r e taW f o u a e r u B : t nemn 

/swp/su . sk . e t a t s. eh dk . www 30 5 5-6 9 2 )587( 

re taW f o n o i s i v iD : n o i tc e t o 

wd/v o g. yk .re taw. www 014 3-4 6 5 ) 2 0 5( 

ma r g o r P W re t agn ik

/re t awe fas /ec iv r es r e en ign e /v o g. an a i s iu o l. hh d. h p o . www 83 0 5-5 6 7 )522( 

ma r g o r P r e t aW gn ikn ir D : s ec iv r e S n amuH 

/r e taw/gn e /shd/su . em. e t a t s. www 07 0 2-7 8 2 )70 2( 

38 
e t i s W b e r e bmuNe n o h P 

margor P y lp pu S r e t aW : t n

_W re t a/smargor Pr e taW/sma r g o r p/su . dm. e ta t s. e dm. www 

psa . x e dn i /y lppu S 0 0 0 3-7 3 5 )0 1 4( 

margor P r e t aW gn ikn ir D : n o i tce t o r P 

mt h. emd ohsw /sw d/prb/ped/vog. ss am. www 0 7 7 5-2 9 2 ) 7 1 6( 

u aer u B r e t aW : y t i lauQ 

q e d/v o g. n ag ih c im. www 7 1 9 7-3 7 3 ) 7 1 5( 

n o i tce S no i tc e t o r P r e t aW g

lmt h. x e dn i /re t aw/h e /sv i d/su . nm. e t a t s. ht la eh. www 0 7 7 0-5 1 2 ) 1 5 6( 

n o i s i v iDy lppu S 

lmt h, 67, 0, 4 4/mf c. xedn i /e t ish dsm/su . sm. e t a t s. h dsm. www 8 1 5 7-6 7 5 ) 1 0 6( 

n o it av re sn o Cl io S dn a n o i tc e t o r P W re t a:s ec r 

lmt h. x e dn i /pc pw/dcs pw/su . om. e t a t s .r n d. www 0 0 3 1-1 5 7 ) 3 7 5( 

margor P y lp pu S W re t ac i lbu P : y t i lauQ 

psa . x e dn i /swp/o f n iqw/su .tm. e ta t s. q e d. www 1 7 0 4-4 4 4 ) 6 0 4( 

ma r g o r P y lppu S r e taW c i lbu P : sec iv r e S n am

mt h. x e dn isw p/hne /su . en . e t a t s. shh. www 1 2 5 0-1 7 4 ) 2 0 4( 

ma r g o r P re taW gn ikn ir 

mt h. xedn i /wd s b/v o g. vn . p e dn / /: pt t h 3 5 3 6-7 8 6 ) 5 7 7( 

no i s i v iDr e taW :s ec iv r e S 

/b e sw/su . hn . e ta t s. s e d. www 3 5 1 2-1 7 2 ) 3 0 6( 

no it a r t s i n imd A y lppu S r e taW :n o i tce t o r P 

/y lppu s r e t aw/p e d/su . jn. e t a t s. www 0 5 5 5-2 9 2 ) 9 0 6( 

u a e r u B r e t aW gn ikn 

lmt hd . p o t bw/d bw/su .mn. e t a t s. vn emn. www 0 0 4 1-7 2 8 ) 5 0 5( 

39 
et is b eW r e bmuNe n o h P 

n o i tc e t o r P y lppu S re taW f o u a e r u B : ht la 

mt h. n i am/r e taw/h o dsyn /su . yn . e t a t s. ht laeh. www 0 5 6 7-2 0 4 ) 8 1 5( 

y lp pu S r e t aW c i lbu P : s ec r u os eR la r u taN 

/swp/su . cn . e t a t s .r n e . h e d. www 1 2 3 2-3 3 7 ) 9 1 9( 

y t i lauQ r e t aW 

/fm/su . dn . e t a t s. ht laeh. www 11 2 5-8 2 3 )1 0 7( 

r e t aW dnu o rG dna gn ikn ir D f o no i s i v iD 

/wgadd/su . h o . e t a t s. a p e . www 25 7 2-4 4 6 ) 4 1 6( 

no i s i v iDy t i lauQ r e t aW : y t i l

mt h. x e dn i /wen DQW/su . k o . e t a t s. q e d. www 0 0 1 8-2 0 7 ) 5 0 4( 

ma r g o r P r e t aW gn ikn ir D 

lmt hs . x e dn i /d pw /h p/SH D/vog. n o g e r o / /: pt t h 5 0 4 0-3 7 6 ) 1 7 9( 

tn emM e g anaW re t af o ec if fO : n o i tce t

/msw/tgmre t aw/e t a t uped/p e d/su . a p. e t a t s. p e d. www 

mt h.M SW 8 1 0 4-2 7 7 ) 7 1 7( 

ma r g o r P n o i s iv r e pu S y lppu S 

re 

mt h. kn i lrp/d p ec /2 0no ig e r /vog. a p e . www 0 7 8 5-7 7 9 ) 7 8 7( 

y t i lauQ r e taW gn ikn ir 

php. x e dn i /d qw/ tn emn o r ivne /vog. ir . ht laeh. www 7 6 8 6-2 2 2 ) 1 0 4( 

ma r g o r P r e taW gn ikn ir D : lor t n o Cla t n em

lmt h.r e t aw d/ lmt h/re taw/c q e /t en . c eh dcs . www 0 0 3 4-8 9 8 ) 3 0 8( 

margor P r e t aW gn ikn ir D : s ec r u os eR la r u taN 

mt hd . gr pw/gn ikn ir d/s e d/r n e d/su . d s . e t a t s. www 4 5 7 3-3 7 7 ) 5 0 6( 

40 
et is b eW re bmu N e n o h P 

y lp pu S r e t aW fo n o i s i v iD : no it av resn o Cdn 

lmt h. x e dn i /swd/ tn emn o r ivne /su . n t . e t a t s. www 1 9 1 0-2 35 ) 5 16( 

y t i lauQ la t nemn 

/r e t aw _ l i t u /van /su . x t . e ta t s. q ec t . www 1 9 6 4-9 32 ) 2 15( 

r e t aW gn ikn ir D f o n o i s i v iD : y t i lauQ 

vog. h a t u .r e t aw gn ikn ir d. www 0 0 2 4-6 3 5 ) 1 0 8( 

sec r u ose

mt h. d sw/pus re taw/c e d/su . t v. e ta t s .r na . www 0 0 4 3-1 4 2 ) 2 0 8( 

la t n emnor ivn E f o no i s i v iD : s ec r u os eR la r u taN 

mt h. emoh/ped/ i v. v o g.r n p d/ /: pt t h 2 8 0 1-3 7 7 ) 0 4 3( 

W re t agn ikn ir D fo 

psa . x e dn i /wd/su . av . e t a t s. h dv . www 0 0 5 7-4 6 8 ) 4 0 8( 

re taW gn ikn ir D f o ec if fO : ht la

/wd/phe /vog. aw. ho d. www 0 0 1 3-6 3 2 ) 0 6 3( 

sec r u os eR n amuH dna ht la eH f o t ne

mt r a p 

/dee /sheo /gro .r hhdvw. www 5 1 7 6-8 5 5 ) 4 0 3( 

dnu o rG dn a r e t aW gn ikn ir D f o u a e r u B : sec r 

/d gw/re t aw/gr o /su . iw. e ta t s .r n d. www 1 2 8 0-6 62 ) 8 0 6( 

ma r g o r P W re tagn ikn 

lmt h. n ocyw/n ocyw/emd ohw /r e taw/80n o ig e r /vog. ap e . www 2 1 8 6-2 1 3 ) 3 0 3( 

41 
B: EPA Regional Contacts

our state is in, visit http://cfpub.epa.gov/watersecurity/stateinfo.cfm. 

s t c 

lmt h t . y ir uces -w d /r e t awkn ir d /o c e /EN/v o g . a p e . www/ /: p t t h 496 1-8 1 9 )71 6( 

/r e t aw/2no ige r /v o g . a p e . www/ /: p t t h 9 783-7 3 6 )21 2( 

/d p aw 3 ge r /v o g . a p e . www/ /: p t t h 866 5-4 1 8 )51 2( 

/r e t aw/4no ige r /v o g . a p e . www/ /: p t t h 644 9-2 6 5 )40 4( 

/r e t aw/5no ige r /v o g . a p e . www/ /: p t t h 0 910-68 8 )21 3( 

/ y t ir uc es /pws /qw 6 /s asn ak r A/v o g . a p e . www/ /: p t t h 6 772-5 6 6 )41 2( 

mt h . x e dn i / y t ir uc es /7no ige r /v o g . a p e . www/ /: p t t h 5 857-15 5 )31 9( 

lmt h . e r uc es / y t ir uc es /e cn a i l pmoc /8no ige r /v o g . a p e . www/ /: p t t h 1 207-21 3 )30 3( 

/r e t aw/9no ige r /v o g . a p e . www/ /: p t t h 165 3-7 4 9 )51 4( 

0 1+n o ig eR+n i+seuss I + r e t aW/e g apb ew/F SN. R ETAW/0 1R/v o g . a p e . e t imes oy / /: p t t h 9 831-35 5 )60 2( 

42 
x C: Other STEP Documents

series of Simple Tools for Effective Performance (STEP) documents for small drinking water systems. The STEP 

tained from EPA by calling the Safe Drinking Water Hotline at (800) 426-4791 and requesting the document by its 

he documents can also be found at www.epa.gov/safewater/smallsys/ssinfo.htm. Other titles in the series are: 

ms Guide to the Total Coliform Rule (TCR) 

z Asset Management Workbook 

mber: EPA 816-R-01-017A Publication number: EPA 816-R-03-016

ne 2001 Published: September 2003

 Water Act (SDWA) Regulation Overview

Small Systems

mber: EPA 816-R-03-017

ptember 2003

z Strategic Planning Workbook 

Publication number: EPA 816-R-03-015 Published: September 2003 

ith the Revised Drinking Water Standard for

ll Entity Compliance Guide

mber: EPA 816-R-02-008A

gust 2002

z Taking Stock of your Water System: A Simple Asset Inventory for Very 

Small Systems Publication number: EPA 816-K-03-002 Published: October 2004 

43