A Water Security Handbook: 

Planning for and Responding to 

Drinking Water Contamination 

Threats and Incidents

Threats

Incidents

Security

Water
Printed on Recycled Paper
Water Security Handbook i

Note to Readers: The U.S. Environmental Protection Agency (EPA) prepared this 

guide to help you enhance the security of your water system. This document does not 

impose legally binding requirements on EPA, states, tribes, or the regulated community, 

and it may or may not apply to a particular situation, depending on the circumstances. 

EPA and state decision-makers retain the discretion to adopt approaches on a case-bycase basis that may differ from this guide where appropriate. Any decisions regarding a 

particular community water system should be made based on the applicable statutes and 

regulations. Therefore, interested parties are free to raise questions and objections about 

the appropriateness of the application of this guide to a particular situation, and EPA will 

consider whether the recommendations or interpretations in this guide are appropriate in 

that situation based on the law and regulations. EPA may change this guide in the future. 

To determine whether EPA has revised this guide or to obtain additional copies, contact 

the Safe Drinking Water Hotline at 1-800-426-4791 or visit the EPA’s Water Security 

website at www.epa.gov/watersecurity www.epa.gov/watersecurity.
ii Water Security Handbook

List of Acronyms and Abbreviations ist of Acronyms and Abbreviations ......................................................................................v

Overview ............................................................................................................................... ...............................................................................................................................1

What is the Water Security Handbook? ........................................................................................1

Why Is This Handbook Important? ..............................................................................................2

How Can This Handbook Help Me? ............................................................................................2

Who Should Read This Handbook? ..............................................................................................3

1. Water Utility Planning Guide .........................................................................................4

Introduction .................................................................................................................................4

Why is Water Security Planning Important? .................................................................................4

What Are Contamination Threats and Contamination Incidents? ................................................4

Should We Be Concerned About Contamination Threats and Contamination Incidents? .............5

Is Intentional Contamination Possible or Probable? ......................................................................6

How Serious Could Intentional Water Contamination Be? ...........................................................6

What is Due Diligence? ................................................................................................................7

How Do I Prepare For A Contamination Threat or Incident? .......................................................7

2. Contamination Threat Management Guide ..................................................................10

Introduction ...............................................................................................................................10

Roles and Responsibilities ...........................................................................................................11

Federal Roles: The National Response Plan (NRP) ....................................................................11

Federal, State and Local Roles: The National Incident Management System (NIMS) ................12

Federal, State and Local Roles: The Incident Command System (ICS) ......................................12

Local Role: Incident Command at the Water Utility .................................................................. ..................................................................13

Federal, State and Local Roles: Unifi ed Command ....................................................................14

Your Role and Responsibilities ....................................................................................................15

A General Plan for Threat Response and Threat Management ....................................................18

 Step 1: Decide if the Threat is ‘Possible’ ............................................................................19

 Step 2: Determine if the Threat is ‘Credible’ and Protect Public Health ............................21

 Step 3: ‘Confi rm’ the Threat ..............................................................................................23

 Step 4: Remediate the Affected Water System .....................................................................24

 Step 5: Recovery of the System ...........................................................................................25

Table of Contents
Water Security Handbook iii

3. Site Characterization and Sampling Guide ...................................................................26

Introduction ...............................................................................................................................26

Investigating the Site ...................................................................................................................26

Who Does the Site Characterization and Sampling? ...................................................................27

Ensuring Safety and Protection for Personnel ..............................................................................27

What Does Site Characterization Involve? ..................................................................................27

Initial Hazard Assessment Before Entering the Site .....................................................................28

Approaching the Site and Doing a Field Safety Screening ........................................................... ...........................................................29

Characterizing the Site ................................................................................................................30

Collecting Samples .....................................................................................................................31

Exiting the Site ...........................................................................................................................31

4. Analytical Guide ............................................................................................................32

Introduction .................................................................................................................................32

What Do I Need to Know About Laboratory Analyses? ................................................................32

Safety Considerations for Water Utilities and Others ....................................................................33

Types of Labs and Analyses Performed .........................................................................................33

Non-Utility Laboratories That Perform Chemical Analyses ..........................................................34

Non-Utility Laboratories That Perform Biological Analyses ..........................................................35

Obtaining High-Quality Lab Results ...........................................................................................35

Approaches to Analytical Screening For Unknown Contaminants ................................................36

Why Analytical Laboratories Should Plan for Threat Response ....................................................38

5. Public Health Response Guide ......................................................................................39

Introduction ...............................................................................................................................39

Response Planning for Protection of Public Health .....................................................................39

 Step 1. Plan the Public Health Response Before a Threat Occurs .......................................39

 Step 2. When a Threat or Incident Occurs, Determine the Public Health Consequences ...41

 Step 3. Carry Out Operational Response Actions ...............................................................42

 Step 4. Notify the Public ....................................................................................................43

 Step 5. Provide an Alternate Water Supply for the Short Term ............................................44
iv Water Security Handbook

6. Remediation and Recovery Guide .................................................................................45

Introduction ...............................................................................................................................45

Who is Responsible? ...................................................................................................................45

Remediation and Recovery ......................................................................................................... .........................................................................................................46

 Step 1. Find an Alternate Water Supply for the Long Term ................................................46

 Step 2. Do a System Characterization and Feasibility Study ............................................... ...............................................46

 Step 3. Do a Risk Assessment .............................................................................................46

 Step 4. Evaluate Remediation and Rehabilitation Alternatives ............................................46

 Step 5. Choose the Right Remediation Technology ............................................................ ............................................................47

 Step 6. Design the Remediation .........................................................................................47

 Step 7. Do the Remediation ...............................................................................................47

 Step 8. Do Post-Remediation Monitoring .......................................................................... ..........................................................................47

 Step 9. Communicate With the Public to Restore Confi dence ...........................................47

The Final Step – Full Recovery ................................................................................................... ...................................................................................................47

Final Thoughts .....................................................................................................................48

Glossary of Terms ................................................................................................................49

Additional Resources dditional Resources ...........................................................................................................54

List of Contacts for States, Commonwealths, and Territories ist of Contacts for States, Commonwealths, and Territories ..............................................58

List of EPA Regional Contacts ist of EPA Regional Contacts .............................................................................................61
Water Security Handbook v

ATSDR Agency for Toxic Substances and Disease Registry Agency for Toxic Substances and Disease Registry

CDC Centers for Disease Control and Prevention

CWC Chemical Weapons Convention 

DHS U.S. Department of Homeland Security

DOE U.S. Department of Energy

EOC Emergency Operations Center

EPA U.S. Environmental Protection Agency U.S. Environmental Protection Agency

ERP Emergency Response Plan

ETV Environmental Technology Verifi cation Program

FBI Federal Bureau of Investigation

FEMA Federal Emergency Management Agency Federal Emergency Management Agency

FOIA Freedom of Information Act

FRMAC Federal Radiological Monitoring and Assessment Center

Handbook this Water Security Handbook

HazMat Hazardous materials specialists, including specialists from government agencies and Hazardous materials specialists, including specialists from government agencies and

private contractors

HHS U.S. Department of Health and Human Services

HSIN-CS Homeland Security Information Network for Critical Sectors

ICS Incident Command System

LEPC Local Emergency Planning Committee

LRN Laboratory Response Network

MOU Memorandum of Understanding

NEMI National Environmental Methods Index

NEMI-CBR National Environmental Methods Index for Chemical, Biological and Radiological 

Contaminants

NHSRC National Homeland Security Research Center

NIC National Incident Management System (NIMS) Integration Center

NIH National Institutes of Health

NIMS National Incident Management System

NRC National Response Center

NRP National Response Plan

NRT National Response Team

QA/QC Quality Assurance and Quality Control

Toolbox Response Protocol Toolbox: Planning For and Responding to Drinking Water Contamination 

Threats and Incidents

TSWG Technical Support Working Group

TTEP Technology Testing and Evaluation Program

USAMRIID U.S. Army Medical Research Institute for Infectious Diseases

USCG United States Coast Guard

WaterISAC Water Information Sharing and Analysis Center

WaterSC Water Security Channel

WCIT Water Contaminant Information Tool

WMD Weapons of Mass Destruction

WUERM Water Utility Emergency Response Manager

List of Acronyms and Abbreviations

Overview

Water Security Handbook 1

Overview

As a water utility manager, your role in s a water utility manager, your role in water security planning and threat response water security planning and threat response 

is critically important. This Water Security 

Handbook was developed by the U.S. EPA to was developed by the U.S. EPA to 

help you, the water utility offi cial, protect your 

water system and respond effectively to threats 

and contamination incidents involving your 

water system.

EPA also wrote this Handbook in response 

to calls for a short, simplifi ed document that 

summarizes the comprehensive document 

entitled Response Protocol Toolbox: Planning For 

and Responding to Drinking Water Contamination 

Threats and Incidents (also known as the (also known as the Response 

Protocol Toolbox). 

The Handbook is also intended to be a 

companion to EPA’s Response Protocol Toolbox: 

Planning For and Responding to Drinking Water 

Contamination Threats and Incidents: Response 

Guidelines. The Response Guidelines provides provides 

many forms and checklists to help you organize 

and carry out your emergency response and 

planning efforts. This Handbook describes the 

basic concepts and procedures involved in water 

security planning and threat response. Together, 

the Handbook and Response Guidelines provide provide 

succinct recommendations concerning water 

security planning and response actions. 

While the Response Protocol Toolbox is aimed at 

all utilities, agencies and other organizations that 

may be involved in responding to drinking water 

threats and incidents, this Handbook is aimed 

primarily at water utility managers and staff. 

This Handbook should help you to:

• Understand the “basics” of responding to 

contamination threats and incidents;

• Plan for responding to water contamination 

threats and contamination incidents;

• Learn about key concepts of water security 

covered in the Response Protocol Toolbox; and

• Learn how to use the Response Protocol 

Toolbox, the Response Guidelines, and other 

available tools to help you provide water 

security.

What is the Water Security Handbook?

You can use this Handbook as a guide to the Response Protocol Toolbox, because chapters 

in this Handbook correspond to modules in the Toolbox:

Handbook Toolbox

Chapter Module

1 1. Water Utility Planning Guide

2 2. Contamination Threat Management Guide

3 3. Site Characterization and Sampling Guide

4 4. Analytical Guide

5 5. Public Health Response Guide

6 6. Remediation and Recovery Guide
2 Water Security Handbook

Overview

Why Is This Handbook Important?

Contamination of a drinking water system 

can cause illness, disease, or even death. A 

water system can be contaminated, damaged 

or disrupted through intentional terrorist or 

criminal actions or by an accident. Intentional 

contamination poses one of the most serious 

threats to a water system because of the intent 

to harm human health or cause damage. When 

a contamination threat is received or a 

contamination incident happens, it is critical 

that you act quickly and effectively to protect 

public health and the environment. 

This Handbook should help you to develop 

your own utility’s plan for quickly and 

effectively responding to contamination threats 

or contamination incidents, even in situations 

where information may be limited. 

How Can This Handbook Help Me?

This Handbook should help you in the following 

ways:

• Help you to plan for unforeseen emergencies 

involving your water system; 

• Help you to review and improve your water 

utility’s Emergency Response Plan (ERP) on 

an ongoing basis to address contamination 

threats and intentional incidents. Federal 

law required that drinking water systems 

serving more than 3,300 customers develop 

an ERP (see the “Public Health Security and 

Bioterrorism Preparedness and Response Act 

of 2002”, also known as the Bioterrorism 

Act of 2002). Although the deadlines for 

certifying ERPs for approval have passed, 

all utilities should continue to review and 

improve their plans as their water system 

infrastructure, staff, technology and 

capabilities change.

• Provide pointers on how to respond to 

contamination threats and incidents; and

• Introduces and summarizes the more 

comprehensive Response Protocol Toolbox. 

Please note that this Handbook provides 

general advice and general procedures for 

responding to a water system contamination 

threat or contamination incident. Because 

every water system and incident will be 

different, it would be impossible to develop a 

one-size-fi ts-all emergency response template. 

The steps described in this Handbook are 

recommendations, not rules. 

Although this Handbook is not a regulatory 

document nor is it a template for an Emergency 

Response Plan, it can help you to review, 

update and implement your own ERP, because 

it describes the planning you would do to 

create such a plan. For example, in your ERP, 

you should provide answers to the following 

questions:
Overview

Water Security Handbook 3

• Who will respond?

• What level of personal protection do 

responders need in order to protect their 

health and safety?

• Who can I call for help and advice?

• When and where should samples be 

collected? 

• Who will collect samples?

• Who will analyze water samples to identify 

the contaminant(s)?

• Who will make public health decisions? 

• Who will manage remediation and recovery 

activities?

Addressing these kinds of questions should help 

you to update your own ERP for responding 

to a water contamination threat or incident. 

Utilities may also want to share their ERPs with 

local response partners in order to improve 

coordination when an incident or emergency 

actually occurs.

Who Should Read This Handbook?

This Handbook was written for water system 

owners and managers, water utility emergency 

response managers (WUERMs), and utility staff 

who maintain public and private drinking water 

systems, regardless of their size. In addition, anyone 

who may be involved in an emergency response 

concerning drinking water, such as public health 

offi cials, emergency responders, law enforcement 

offi cials, environmental protection offi cials and other 

government offi cials should read this Handbook. 

Utility managers in the wastewater sector may fi nd 

this Handbook useful because it describes a general 

process for threat and incident response.

In the next chapter, water security planning is 

discussed.

Where To Get More Information:

For more information 

on a specifi c topic, 

please refer to the 

full Response Protocol 

Toolbox. You can 

download the 

entire Toolbox, this 

Handbook, the 

Response Guidelines,

and other water 

security documents 

from the EPA Water Security website at www.

epa.gov/watersecurity epa.gov/watersecurity v/watersecurity. This frequently updated . This frequently updated 

website also contains other useful information 

on water security planning, requirements and 

training opportunities. You can also request a 

copy of these documents by calling EPA’s Safe 

Drinking Water Hotline at 1-800-426-4791 or 

by sending a request to the Hotline via e-mail 

at www.epa.gov/safewater/hotline. Finally, the 

section on “Additional Resources” at the end 

of this Handbook describes many useful water 

security resources.

Emergency Response Plans (ERPs):

For more information on ERPs, see EPA’s 

document entitled Emergency Response Plan 

Guidance for Small and Medium Systems 

to Comply with the Public Health Security 

and Bioterrorism Preparedness and Response 

Act of 2002, the Emergency Response 

Plan Outline, and other emergency 

response planning documents. These 

documents can be downloaded from 

EPA’s water security website at www.epa.

gov/watersecurity gov/watersecurity v/watersecurity. You may also obtain a . You may also obtain a 

copy by calling EPA’s Safe Drinking Water 

Hotline at 1-800-426-4791 or by sending 

a request to the Hotline via e-mail at www.

epa.gov/safewater/hotline. 
4 Water Security Handbook

1Water Utility Planning Guide

Introduction

This chapter discusses why you, as a water utility manager or offi cer, should know 

about water security planning for effective 

response to contamination threats and incidents. 

This chapter also defi nes water contamination 

threats and incidents and describes how 

water security planning is done. Chapter 

1 corresponds to Module 1 of the Response 

Protocol Toolbox. See EPA’s Water Security 

website at www.epa.gov/watersecurity for more for more 

information.

The fi rst water security planning step is to 

designate an individual to be the lead emergency 

response manager for your utility, as well as an 

alternate. At a small utility, you may be this 

individual. The second step is to plan your 

utility’s response to a contamination threat 

or contamination incident. In responding, 

you should decide if the threat or incident 

is ‘possible’, ‘credible’, or ‘confi rmed’. If 

the threat is ‘confi rmed’, then it becomes a 

contamination incident, requiring remediation 

(cleanup). Following successful remediation, 

the system is returned to normal safe operations 

(recovery).

Why is Water Security Planning 

Important?

Water security planning is critical because of 

the increased threat of terrorism and other 

intentional attacks since 9/11. There are 

many ways in which water systems can be 

threatened by contamination or be intentionally 

contaminated. Responding to contamination 

threats and contamination incidents requires 

careful planning and preparation. 

Water Utility Planning Guide

What Are Contamination Threats 

and Contamination Incidents?

There are two kinds of water contamination 

problems that you may have to deal 

with: contamination threats and actual 

contamination incidents. 

Here are some examples of contamination 

threats:

1) A suspicious empty container with an 

unknown residue is left next to a reservoir. This 

is a contamination threat. In this case, there is 

physical evidence that suggests something has 

potentially been added to the water supply, but 

contamination has not yet been ‘confi rmed’

through testing or other conclusive evidence. 

2) Someone phones to say that they observed 

someone adding something to the water 

reservoir. As before, you have become aware of 

a threat and there is not yet any proof that the 

contamination has actually occurred. 

A contamination incident has occurred if you 

analyze water from the reservoir, distribution 

system or another part of your water system and 

fi nd that the water contains levels of a harmful 

A contamination threat is a suggestion 

or an indication that water has been or 

will be contaminated, but no conclusive 

proof has been collected yet to confi rm that 

contamination has actually occurred. A 

threat may be written, verbal, or based on 

observations or other evidence.
Water Utility Planning Guide

1

Water Security Handbook 5

contaminant above baseline or background 

levels. This is no longer a contamination threat, 

but an actual contamination incident. In 

short, a contamination threat has not yet been 

proven (or ‘confi rmed’), while a contamination 

incident has already occurred. Be alert to 

the possibility that fi eld or lab testing may 

not be comprehensive enough to detect the 

contaminant that may be present; for example, 

a Microtox® analysis should tell you whether 

or not there is a toxin present, but it does not 

measure radioactive materials or metals.

To protect your water system, you should 

be ready to respond to both contamination 

threats and contamination incidents. You 

might not know whether a threat constitutes 

a contamination incident until you get more 

information. However, if you ignore a threat 

and it turns out to be a contamination incident, 

public health and/or the water system might be 

harmed. You should always investigate a threat 

and determine whether or not a contamination 

incident has occurred. 

Should We Be Concerned About 

Contamination Threats and 

Contamination Incidents?

Contamination threats and contamination 

incidents could impact the public in the 

following ways:

• Cause harm to public health (illness, disease, 

or death);

• Cause fear or loss of public confi dence;

• Disrupt the water system or cause long-term 

shortage of clean, safe water to customers 

or prevent use of the water supply for fi re 

fi ghting;

• Disrupt businesses and services that depend 

on a safe water supply;

• Cause damage to the water system 

infrastructure (e.g., water plant, pumps, 

pipes, wells, treatment system, distribution 

system, electrical system or computer 

network) resulting in contamination or 

interference with treatment or delivery;

• Create a need to remediate and replace 

portions of the water system to make it safe, 

which could in turn create water shortages or 

outages;

• Result in signifi cant costs for remediation or 

replacement; and

• Impact other critical infrastructures that 

rely on safe water, due to interdependencies 

(e.g., food processing and refi neries, among 

others). 

Since any one of these impacts could have 

serious consequences, you should be concerned 

about contamination threats and incidents.

A drinking water contamination incident 

occurs when the presence of a harmful 

contaminant has been ‘confi rmed’; that is, 

verifi ed. 
6 Water Security Handbook

1Water Utility Planning Guide

Is Intentional Contamination 

Possible or Probable?

How likely is intentional contamination of the 

drinking water system? Could it happen again? 

How serious would it be? These are the kinds 

of questions you should consider when planning 

for water security. 

It is possible to intentionally contaminate a 

water supply in many ways. However, “possible” 

and “probable” are two different cases. It is 

always possible that intentional contamination 

could be carried out, but the probability of this 

actually happening should be determined at each 

individual water system. 

Security experts have warned that terrorist 

organizations may be considering water 

systems as possible targets for weapons of mass 

destruction, known as WMD. WMD include 

some chemical, biological and radiological 

contaminants whose purpose is to cause harm. 

It has always been possible to intentionally 

contaminate a water system, but 9/11 and other 

recent events have suggested that the likelihood 

that an intentional contamination incident will 

happen has increased. This is why we all should 

plan and prepare to protect our drinking water.

How Serious Could Intentional 

Water Contamination Be?

There are many ways in which water can be 

intentionally contaminated, just as there are 

many different contaminants. Each contaminant 

has different effects on humans, animals and the 

environment, depending on its concentration 

(level) and toxicity (harmfulness).

A few contaminants are so dangerous that very 

small amounts could sicken or kill many humans 

or animals. These include certain pathogenic 

bacteria and viruses, some biotoxins, and some 

highly toxic chemicals that can persist in water 

for a long time before they break down into 

Question: Compared with other 

possible terrorist targets, how likely is 

an intentional contamination incident 

involving a water system? 

Answer: The likelihood of an 

intentional contamination incident 

occurring may be low, but the likelihood 

that a contamination threat will occur is 

high. In fact, such threats have occurred 

often and are well documented.

Examples of Possible Contaminants:

Pathogens are harmful microorganisms that 

can impact human health, such as E. coli, 

Cryptosporidium, polio virus, Hanta virus, 

smallpox virus, and the microorganisms 

responsible for anthrax, bubonic plague, 

cholera and other illnesses;

Toxic metals such as arsenic, cadmium, 

mercury, osmium, and others;

Toxic organic compounds such as biotoxins 

(Ricin), pesticides, chlorinated compounds 

such as dioxin, or volatile organic compounds 

such as mustard gas; and 

Radioactive materials such as radioactive 

isotopes used in hospitals, research labs, 

universities and nuclear reactor fuels.
Water Utility Planning Guide

1

Water Security Handbook 7

less harmful chemicals. Other contaminants 

could cause death or illness in people who are 

especially at risk, such as children, the elderly, 

those who are already ill due to other causes or 

others who are particularly sensitive. There are 

hundreds of contaminants that could disrupt 

normal operations and cause the public to lose 

confi dence in the water system, but which 

would not cause illness or death. 

What is Due Diligence?

How will you know when you have done enough 

to evaluate and respond to a contamination 

threat or incident? This is where due diligence

comes in. Due diligence involves a careful 

evaluation of any contamination threat and an 

appropriate response based on the evaluation. 

The response fl ow chart on the back cover of 

this Handbook shows what steps to take when 

a threat or incident occurs. Carrying out each 

of these steps in a responsible, careful, effi cient 

and timely manner should help to ensure due 

diligence. 

Due diligence should be determined locally, and 

local authorities should decide what level of risk 

is reasonable in a threat situation. If the threat 

is ‘possible’, appropriate responses to a threat 

could include immediate operational response 

actions and site characterization. If the threat is 

‘credible’, more signifi cant response actions may 

be needed, such as restrictions on water use. For 

a ‘confi rmed’ incident, authorities may be faced 

with a potential public health crisis, and response 

actions should include all steps necessary to 

protect public health, supply an alternate source 

of drinking water, and begin remediation of the 

system. 

It is up to you and your response partners to 

decide when due diligence has been exercised, 

because response capabilities vary. As part of this 

decision, you should decide how much risk is 

acceptable. You may also want to ask for help in 

responding to a threat. Keep in mind, however, 

that over-responding to a threat may cause 

problems too, especially if it is a false alarm. 

How Do I Prepare For A 

Contamination Threat or Incident?

You can prepare for contamination threats and 

incidents by taking these steps:

❏ Develop your own guidelines for dealing 

with intentional contamination at your 

utility. Make these guidelines easy to use. 

Emphasize action items. Know your roles 

and responsibilities. Include all necessary 

forms and checklists, as well as contact 

information for important people. Be sure 

to keep this information up-to-date. The 

Response Guidelines provide short summaries provide short summaries 

of specifi c responses that can be taken to 

specifi c threats. 

❏ Set up your Incident Command structure 

ahead of time so everyone knows who will 

be in charge during an emergency and 

everyone knows what to do. Again, know 

your roles and responsibilities in advance. 

The structure should be based on the 

Incident Command System (ICS), which is 

Due diligence means that you have done 

everything suitable, sensible and responsible 

to evaluate a contamination threat or incident 

and respond appropriately.
8 Water Security Handbook

1Water Utility Planning Guide

used throughout the nation for responding 

to natural disasters or emergencies. See 

Chapter 2 for further discussion of ICS.

❏ Establish partnerships and clarify roles 

with local emergency responders, such as 

your state drinking water primacy agency, 

law enforcement, public health agencies, 

HazMat, fi re and your local emergency 

response network. Coordinate closely with 

your local fi rst responders as a preparedness 

step.

❏ Develop a communication plan that includes 

a communication and notifi cation system for 

threats and incidents and a plan for public 

communication and outreach. Keep contact 

information up-to-date. 

❏ Develop contingency plans for alternate 

water supplies in advance, through 

such means as mutual aid agreements, 

Memoranda of Understanding (MOUs) and 

intermunicipal agreements, for example.

❏ Be familiar with your water system from 

top to bottom. Know its construction, 

operation, maintenance, hydraulics, 

chemicals used, distribution system, 

employees, customers, nearby roads, 

buildings, and other features.

❏ Maintain accurate, up-to-date information, 

plans and other records concerning your 

water system. This should help prepare you 

and your response partners to deal with a 

threat or incident.

❏ Keep accurate records concerning any 

contamination threat or incident. See the 

Response Guidelines for an example of a 

“Security Incident Report Form”, “Threat 

Evaluation Worksheet”, and other forms and 

checklists that can help you to document 

a threat or incident and track evaluation, 

remediation, and recovery.

❏ Conduct baseline water quality monitoring 

during “normal”, non-threat times to 

monitor the quality of water entering, passing 

through and leaving the system to customers. 

Baseline monitoring is done in order to 

establish “normal” water quality values.

❏ Prepare for contamination threats and 

intentional contamination incidents by 

including possible contamination scenarios 

in your Emergency Response Plan. Discuss 

these scenarios and possible responses with 

your staff.

❏ Practice emergency response by conducting 

training workshops, tabletop exercises, drills 

and fi eld exercises.
Water Utility Planning Guide

1

Water Security Handbook 9

❏ Information on drinking water protection 

from services such as WaterISAC, WaterSC, 

InfraGard, and from other utilities and 

agencies can help you to prepare for a 

contamination threat or incident. See the 

section on “Additional Resources” at the end 

of this Handbook.

❏ Seek out support and training by contacting 

your state drinking water primacy agency 

and technical assistance providers (e.g., state 

rural water association).

The next chapter describes a general game plan 

for managing the response to a contamination 

threat or intentional incident. 

The diagram below shows the intended audience for each module of the Toolbox.
10 Water Security Handbook

2Contamination Threat Management Guide

Introduction

I

f a contamination threat or incident occurs, 

you should act quickly to protect public 

health and limit the spread of the contaminant, 

based on the best information you have at the 

time. You should also avoid over-reaction or 

false alarms that might inconvenience your 

customers and harm your credibility. You 

may not have all the information needed 

to determine whether the water has been 

contaminated or not, because this may require 

water testing, which takes time. As new 

information becomes available, however, you 

might change the way in which you are dealing 

with the threat or incident. 

In this chapter, you will learn about a general, 

yet systematic approach for evaluating 

contamination threats and managing the 

overall response to a contamination threat 

or incident. You will learn how to manage a 

threat response in a timely manner to protect 

public health, using due diligence. For effective 

contamination threat management, this 

systematic approach or general game plan for 

threat response is perhaps the most important 

planning tool covered in this Handbook.

Contamination Threat Management Guide

Chapter 2 covers the following topics:

• Roles and responsibilities;

• A general plan for responding to 

contamination threats and incidents;

• How to evaluate a water contamination 

threat;

• How to make the right decisions and when;

• Types of information needed to evaluate 

threats;

• Response actions to protect public health; 

and

• Exercising care in response actions.

Chapter 2 summarizes Module 2 of the 

Toolbox, which can be obtained at EPA’s Water 

Security website at www.epa.gov/watersecurity.
Contamination Threat Management Guide 2

Water Security Handbook 11

Roles and Responsibilities

The vast majority of threats and incidents will 

likely be handled by individual utilities working 

together with their local responder network. 

Some incidents may be elevated to the federal 

level, especially incidents involving terrorism 

or an incident of national signifi cance, such as 

a severe hurricane. This section of Chapter 2 

briefl y outlines roles and responsibilities from the 

federal level down to the utility level.

Federal Roles:

The National Response Plan (NRP)

The National Response Plan, or NRP, 

establishes a comprehensive all-hazards 

approach to manage domestic incidents. The 

NRP brings together individual federal agency 

response plans, the Concept of Operations 

Plan, the Federal Response Plan and the Federal 

Radiological Emergency Response Plan into a 

single, comprehensive approach. 

The NRP includes the best practices and 

procedures from several incident management 

disciplines (e.g., homeland security, emergency 

management, law enforcement, fi re fi ghting, 

public works, public health, responder and 

recovery worker health and safety, emergency 

medical services, and the private sector) and 

combines them into one. The NRP outlines 

how federal departments and agencies should 

work together and how the federal government 

should coordinate with state, local, and tribal 

governments and the private sector during 

incidents. 

As an example, the NRP designates the U.S. 

Department of Health and Human Services 

(HHS) as the lead federal agency in response 

to a disease outbreak (which could be the 

result of intentional water contamination) 

requiring federal assistance. The NRP 

recognizes, however, that state, local, and tribal 

governments are primarily responsible for 

detecting and responding to disease outbreaks 

and implementing measures to minimize the 

health, social and economic consequences of 

such an outbreak. Coordination between HHS 

and local authorities would occur as necessary 

to determine current medical and public health 

assistance requirements. 

EPA supports HHS by providing technical and 

policy assistance in matters involving drinking 

water supplies. To learn more about the NRP, 

visit the Department of Homeland Security 

website at www.dhs.gov. 
12 Water Security Handbook

2Contamination Threat Management Guide

Federal, State and Local Roles:

The National Incident Management System 

(NIMS)

During an incident, the National Incident 

Management System, or NIMS, further defi nes 

roles and responsibilities. NIMS has established 

standardized incident management processes, 

protocols, and procedures that all responders 

(federal, state, tribal, and local) should use to 

coordinate and conduct response actions. The 

use of standardized procedures should enable 

you and other responders to 

focus on incident management 

when a water security incident 

occurs. These standardized 

procedures apply whether the 

incident is related to terrorism, 

an accident or a natural 

disaster. 

NIMS is maintained by the 

NIMS Integration Center 

(NIC) that, under the direction 

of DHS, provides strategic direction and 

oversight for NIMS. One function of the NIC 

is to help establish general training requirements 

and to develop national-level training standards 

and course materials associated with NIMS.

The overwhelming majority of emergency 

incidents will be handled on a daily basis by a 

single jurisdiction at the local level. However, 

there will be some instances, such as terrorist 

attacks, accidents or nationally signifi cant 

natural disasters, in which successful incident 

management requires the involvement 

of emergency responders from multiple 

jurisdictions, as well as personnel and equipment 

from other states and the federal government. 

These instances require effective and effi cient 

coordination across many organizations 

and activities. The Incident Command 

System (ICS), as described below, provides 

the management framework to achieve this 

coordination. 

To ensure further coordination during incidents 

involving multiple jurisdictions or agencies, the 

principle of Unifi ed Command (defi ned below) 

has also been incorporated into NIMS via the 

ICS.

To learn more about NIMS and training 

opportunities, visit the FEMA website at www.

fema.gov/nims/.

Federal, State and 

Local Roles:

The Incident Command System 

(ICS)

Under NIMS, the Incident 

Command System (ICS)

is the national standard for 

the command, control, and 

coordination of a response. The 

fl exible nature of the ICS structure allows for 

the numbers and types of people on the response 

team to change over time as the need for 

resources and skills changes. 

The ICS organization can expand or contract to 

address a particular incident, but all incidents, 

regardless of their size or complexity, will 

initially have a single Incident Commander. 

The Incident Commander is the individual 

responsible for managing the overall response 

to the crisis. The Incident Commander 

frequently oversees a group of people, often 

from his or her own organization as well as other 

agencies or organizations, who are responsible 

for responding with due diligence to the 

contamination threat or incident. 

To learn more about NIMS and ICS training 

opportunities, visit the FEMA website at www.

fema.gov/nims/.
Contamination Threat Management Guide 2

Water Security Handbook 13

Local Role:

Incident Command at the Water Utility

If a threat or incident is discovered fi rst by 

water utility personnel, you or an appropriate 

designated person should be the Incident 

Commander, at least initially. As additional 

responders arrive in response to your 

notifi cations, command may transfer to an 

agency that has primary authority for overall 

control of the threat or incident or to a more 

senior or better qualifi ed fi rst responder. At 

the transfer of command, you should give the 

incoming Incident Commander a full briefi ng 

and notify all staff of the change in command. 

Organizations that may provide an Incident 

Commander include:

Water Utility: Every water system should 

designate a lead emergency response coordinator 

and an alternate. This point person can be 

known as the Water Utility Emergency 

Response Manager (WUERM) or by some 

other title as defi ned by the utility. This 

individual (which may be you) is responsible 

for managing the water utility’s internal 

emergency response procedures and may 

initially be responsible for Incident Command.

Drinking Water Primacy Agency: If the utility 

does not have all the resources needed to manage 

the threat, the drinking water primacy agency 

may take the lead after being notifi ed by the 

water utility. The roles of the utility and the 

drinking water primacy agency should be defi ned 

during the planning stage.

Public Health Agency (state or local): This 

agency may take the lead in Incident Command 

if there is a public health crisis and no criminal 

act is involved or at least not initially suspected. 

Local Law Enforcement: May take on Incident 

Command if the site of an incident is a crime 

scene. 

HazMat/Fire Department: If the incident 

involves a hazardous material or spill, an 

individual from one of these organizations may 

assume Incident Command.

FBI: The FBI may assume Incident Command 

if the FBI determines that a federal crime (e.g., 

terrorism or an incident crossing state lines) has 

been committed.

How does the ICS organization grow or shrink to fi t the incident?

The Incident Commander ncident Commander ncident Commander has overall contr erall control over the incident. I er the incident. In a small n a small 

incident, he or she may be the only person needed to manage an incident. In larger or more complex incidents, the Incident Commander may assign 

other members of the Command Staff, including a Public Information 

Officer (vital in assuring that an accurate, consistent message is giv (vital in assuring that an accurate, consistent message is given to the en to the 

public), a Safety O afety O afety Officer (responsible for the safety of incident personnel esponsible for the safety of incident personnel 

and operations) and/or a Liaison O Liaison O Liaison Officer (who coor (who coordinates betw dinates between 

incident command and the various response agencies). The Incident 

Commander also may assign General Staff, who serve as Section Chiefs

for the Operations, Planning, Logistics and Finance/Administration 

Sections. The Section Chiefs have the authority to expand or contract 

their sections as the resource (people and equipment) 

demands of the incident increase or decrease.
14 Water Security Handbook

2Contamination Threat Management Guide

Federal, State and Local Roles:

Unifi ed Command

In most cases, more than one organization or 

agency has jurisdiction or statutory authority 

in managing a response, and a Unifi ed 

Command may be established. Unifi ed may be established. Unified 

Command is a team effort that allows all 

agencies with responsibility for the incident, 

either geographic or functional, to manage an 

incident together by establishing a common 

set of incident goals and strategies. Unifi ed 

Command not only coordinates the efforts of 

many jurisdictions, but provides for and ensures 

joint decisions on plans, priorities and public 

communications. Unifi ed Command does not 

have a single Incident Commander; instead, 

representatives from several responding agencies 

contribute to the command process. Unifi ed 

Command does not mean losing or giving 

up any of your individual agency’s authority, 

responsibility, or accountability.

FEMA offers free online training courses to help you become familiar with NIMS, the NRP, offers free online training courses to help you become familiar with NIMS, the NRP, 

ICS, and the duties of being an Incident Commander. Examples of courses include:

National Incident Management System: NIMS is now the nationwide standard for incident 

management, and NIMS certifi cation (by September 30, 2006) is required in order to be eligible 

for federal preparedness grants. FEMA’s online courses include IS-700 National Incident 

Management System and others. 

National Response Plan: The NRP is based on NIMS; together, they provide a template 

for effective threat prevention and response. FEMA’s online courses include IS-800 National 

Response Plan and others.

Incident Command System: Use of ICS is recommended under NIMS. FEMA’s online 

courses on ICS include IS-100 (Introduction to the Incident Command System), and IS-200 

(Basic Incident Command System). There is also IS-100.PW (Introduction to the Incident 

Command System for Public Works).

To enroll in these courses, visit FEMA’s website at http://training.fema.gov/EMIWeb/IS. 

Free Online Training in NIMS, NRP and ICS:
Contamination Threat Management Guide 2

Water Security Handbook 15

Your Role and Responsibilities

As the utility emergency response manager or 

utility manager, you should make decisions 

and carry out your utility’s pre-existing plans 

for responding to an incident. Depending on 

the situation, you may also assume the role 

of Incident Commander. As each incident is 

unique, your role in the ICS may change. In one 

incident, you may provide information to the 

Incident Commander from another agency to 

carry out a response. In another incident, your 

input may be included as part of the Unifi ed 

Command decision-making process. 

Figure 1 shows how your role may change 

at various stages during an incident. At the 

‘possible’ threat stage, you will most likely be the 

Incident Commander. At the ‘credible’ threat 

stage, the fi gure shows that Incident Command 

will be dictated by the situation and that 

command may shift as more becomes known 

about the situation. It is highly likely that any 

‘confi rmed’ contamination threat (especially 

if terrorism related) will be managed by a 

Unifi ed Command, and you may be in Unifi ed 

Command or in a supporting role.

The textbox on the following two pages 

provides an example that shows how your role 

may change throughout the process of threat 

evaluation and response.

Figure 1. How Your Role May Change
16 Water Security Handbook

2Contamination Threat Management Guide

Example of How Your Role May Change 

During Threat Evaluation and Response: 

You have just received a phone call from 

an unknown individual claiming to have 

contaminated one of your water tanks. Once 

you decide that this threat is ‘possible’ based 

on the details of the threat warning and your 

knowledge of the water tank in question, you 

should next determine if the threat is ‘credible’. 

You may also consider initiating operational 

response actions, such as isolating the suspect 

water tank, if feasible. You may wish to 

consult with outside resources, such as your 

state primacy agency or police, to help you 

determine if the threat is ‘credible’.

Next, you or one of your staff and another 

employee may drive to the water tank to begin 

an initial site characterization to see if there 

is anything unusual (see Figure 2 on page 18 

describing threat evaluation and response). 

Other employees may be sent to collect water 

samples from the distribution system. On 

arrival at the water tank, you discover that the 

fence is cut, ripped-open bags with a white 

powdery residue are scattered about, protective 

suits and latex gloves are piled in a heap, and the 

tank hatch is open. 

Recognizing that this is potentially a crime 

scene and not knowing how dangerous the 

powder is, you may decide to call the police 

to the scene of what now appears to be a 

‘credible’ threat. Once the police arrive, 

you may decide to relinquish incident 

command to the responding law enforcement 

offi cer, who is probably better qualifi ed to 

address the potential criminal and HazMat 

issues. However, you should assist law 

enforcement offi cials in the ensuing response 

and investigation. You should also continue 

to direct your own staff within your utility’s 

internal ICS structure.

As the situation unfolds, you might receive a 

call from the local public health agency, which 

informs you that people in the area of the 

water tank are reporting to the local hospital 

complaining of similar illness symptoms. You 

should instruct the public health agency to 

notify the Incident Commander via the Liaison 

Offi cer. 

Meanwhile, the Incident Commander has 

already called the National Response Center, a 

single point of contact for all pollution incident 

reporting, and a regional HazMat team to do a 

more intensive site characterization that includes 

rapid fi eld screening of the white powder. 

Preliminary indications are that the powder is 

some form of poison. Although you or Incident 

Command do not yet have any lab results from 

water samples to ‘confi rm’ that this potential 

poison is in the water, the Incident Commander 

decides that a preponderance of evidence now 

exists to determine that the threat is ‘credible’. 

At this point, having determined that the threat is 

‘credible’, the Incident Commander notifi es the 

public, through the Public Information Offi cer, 

that they should not drink the water. The 

Incident Commander also informs the public of 

what is being done to provide an alternate supply 

of safe drinking water. He or she may also notify 

the FBI and activate the Emergency Operations 

Center (EOC) to support the response. 

What is an Emergency Operations Center?

The Emergency Operations Center, or 

EOC, is a pre-designated facility established 

by an agency or jurisdiction to coordinate the 

overall agency or jurisdictional response to an 

emergency. It is not a part of on-scene incident 

management, but rather supports the on-scene 

Incident Commander or Unifi ed Command by 

arranging for needed resources.
Contamination Threat Management Guide 2

Water Security Handbook 17

By now, many more agencies have been 

notifi ed by the Incident Commander or 

the EOC, and a Unifi ed Command may 

be formed to lead the response. In this 

situation, Unifi ed Command may have 

members from the police, FBI, HazMat, 

state, EPA and other agencies having 

jurisdiction over the incident. At this 

point, you may report to the EOC to 

assist in their response efforts. However, 

someone should be designated as the 

utility’s internal Incident Commander, 

who will undertake operational 

responses at your utility in support of 

Unifi ed Command. 

In this example, Unifi ed Command 

will continue to work with appropriate 

laboratories, including laboratories only 

accessible by federal agencies such as the 

FBI, to ‘confi rm’ the contamination 

incident. Once the white powder has 

been positively identifi ed and detected 

in the water system and the threat 

or incident has been ‘confi rmed’,

Unifi ed Command will update or revise 

their public notifi cations. Unifi ed 

Command will most likely direct you to 

undertake appropriate operational and 

remediation and recovery remediation and recovery activities at activities at

your utility. 

Even if the contaminant is never 

positively identifi ed in the water, 

Unifi ed Command, in consultation 

with public health, may still determine 

that the contaminant was introduced 

into the water system, based on a 

preponderance of evidence.

Keep in mind that ICS is a fl exible system and 

will be uniquely established by the Incident 

Commander (which may be you or someone 

from another agency) or Unifi ed Command 

for each incident. The example given above is 

only one of the many ways in which ICS may 

be used to effectively manage a water supply 

incident. Your local and state policies and 

procedures may require different actions than 

those described in the example given above. 

This is why it is important for you to include 

your local fi rst responders, local emergency 

planning committee (LEPC), public health 

and state primacy agencies in your emergency 

response planning efforts.

Tip: Your local emergency plans may 

differ from the example presented here. 

This is why it is very important for you 

to talk with other fi rst responders in your 

area so that you will understand where you 

“fi t in” in various emergency scenarios.

Remember: Regardless of the organization 

responsible for incident command, the 

utility has an ongoing responsibility to 

serve as a technical advisor to the Incident 

Commander or Unifi ed Command for 

issues related to the operation of the water 

system and ensuring water quality.
18 Water Security Handbook

2Contamination Threat Management Guide

A General Plan for Threat Response and Threat Management

The goals of threat response and threat 

management are to: 1) evaluate the threat, 

2) take necessary steps to protect public 

health while the threat is being evaluated, 

3) ‘confi rm’ the threat, 4) remediate the 

water system if necessary, and 5) return the 

system to safe, normal operation as soon as 

possible. 

To achieve these goals, the response to a 

contamination threat or incident should 

be effi ciently managed. Threat response 

and management involves a number of 

steps, actions and decision points. The 

most important lesson of this chapter 

is to understand these key elements 

and how to proceed from one decision 

point to the next to achieve these goals. 

The key elements of threat response are 

summarized below and in Figure 2, with 

key terms in bold:

Step 1. Decide if a threat is ‘possible’,

take appropriate preliminary response 

actions to protect public health, and 

proceed to Step 2.

Step 2. Determine if a ‘possible’ threat 

is ‘credible’ through consultation with 

other utilities, the drinking water primacy 

agency, public health and other agencies. If it 

is ‘credible’, notify the necessary agencies and 

the public, take appropriate response actions to 

further protect public health, and proceed to 

Step 3.

Step 3. ‘Confi rm’ a ‘credible’ threat (which 

results in a ‘confi rmed’ contamination incident), 

take appropriate public health and other 

response actions, and proceed to Step 4.

Step 4. Remediate the water system; and

Step 5. Return the water system to normal, safe 

operation (recovery).

Each of these steps is described in more detail 

below and in Module 2 of the Toolbox.

Please note that your responsibility, as the 

water utility manager (or emergency response 

manager), is to operate and maintain a safe 

water system, ensure a safe water supply 

Figure 2. Process of Threat Evaluation and 

Response
Contamination Threat Management Guide 2

Water Security Handbook 19

and provide public notifi cation regarding 

impaired drinking water quality. In a threat 

situation or contamination incident, a different 

Incident Commander or Unifi ed Command 

structure may be in charge of Steps 2 through 

5, as explained previously. You can serve an 

important role by providing technical advice on 

your water system to the Incident Commander 

or Unifi ed Command. 

Step 1: Decide if the Threat is ‘Possible’

After receiving a threat, the fi rst step is to 

decide if the threat is ‘possible’. This is the fi rst 

decision-point and the lowest threat level.

A water contamination threat is ‘possible’ if 

the circumstances suggest that contamination 

could have occurred. If the threat is found to 

be impossible, then the investigation is closed, 

the incident is documented, and operations 

are returned to normal. However, if the 

contamination threat is ‘possible’, then further 

investigation is needed. It is likely that most 

contamination threats will be classifi ed as 

‘possible’. 

To decide whether a threat is ‘possible’ or not, 

you need reliable information in the one hour 

you have to make a decision. Often, the threat 

warning itself can provide much information. 

If the threat warning is ‘possible’, then go on 

to Step 2 (see below). However, if the threat 

warning is not believable because it comes from 

an unreliable source or the situation does not 

lend itself to such contamination, you may 

decide that contamination is not ‘possible’. If 

the threat warning is not ‘possible’, then your 

response actions are to note the incident and 

the reasons for the decision to return to normal 

operations.

A detailed Decision Tree for responding to a 

contamination threat or incident is available 

in Module 2 of the Response Protocol Toolbox.

How much time do I have to decide if a threat is 

‘possible’ or not?

Speed is critical for protecting public health. Once a threat 

warning is received, you should act with due diligence 

to manage the threat. You should decide quickly if a 

contamination threat is ‘possible’ within one (1) hour from 

the time you receive the threat warning. You may have to 

make a decision based on the limited information available at 

the time.
20 Water Security Handbook

2Contamination Threat Management Guide

A threat warning is an indication that something may be 

wrong. Examples of different threat warnings that may be 

classifi ed as ‘possible’ are: 

• Security breach – evidence of an unauthorized entry into a 

secured facility, such as an alarm, cut fence, etc.

• Witness account – someone directly witnesses suspicious – someone directly witnesses suspicious 

activity and notifi es the utility.

• Direct notifi cation by perpetrator – the perpetrator sends a 

verbal or written threat to the utility.

• Notifi cation by news media – a threat is sent to the media, 

or the media may learn of a threat and pass it on to the 

utility.

• Notifi cation by law enforcement – a law enforcement 

agency may pass along information about a threat to a utility.

• Unusual water quality – on-line monitoring, grab sampling 

or an early warning system indicate unusual water quality 

results. 

• Consumer complaints – an unusual or unexplained increase 

in consumer complaints may indicate contamination.

• Notifi cation by public health agencies – health agencies 

or health care providers observe increased illness, disease or 

death rates, which may indicate a contaminated water supply.

Remember:

• Use due diligence at all times. 

• Encourage staff to immediately 

report any and all threat warnings 

to you, 24 hours a day, 7 days a 

week, 365 days a year. 

• Within one (1) hour of receiving 

the threat warning, you should 

decide whether the incident is 

‘possible’ or not. 

• Practice notifi cation and reporting 

procedures ahead of time to be 

prepared for a real emergency. 

• Most threats will end up being 

‘possible’, unless you are able to 

absolutely rule out the possibility 

of contamination. 

Who Do I Notify 

Once A Threat is 

‘Possible’?

Once you decide that 

a threat is ‘possible’, 

you should notify other 

utility staff. You may 

also want to consult 

with or notify your 

local law enforcement 

agency and drinking 

water primacy agency, 

depending on the nature 

of the threat. Be aware 

of your state’s reporting 

requirements.
Contamination Threat Management Guide 2

Water Security Handbook 21

Step 2: Determine if the Threat is ‘Credible’ 

and Protect Public Health

Once you have decided that the threat is 

‘possible’, you should immediately do two 

things:

• Determine if the threat is ‘credible’ or not; 

and if it is ‘credible’, then

• Protect public health through operational 

responses.

These two actions should be carried out 

together, because your fi rst and highest priority 

is to protect public health, so you should move 

quickly to determine if the threat is ‘credible’ or 

not.

The word ‘credible’ means believable, plausible 

or reliable. A contamination threat is ‘credible’

if the threat is both ‘possible’ and other reliable 

information shows that there is reason to 

believe that the threat warning is real and that 

contamination is likely. A ‘credible’ threat is 

a much higher threat level than a ‘possible’ 

threat. 

It is crucial to make this assessment quickly, 

because if the threat does turn out to be 

‘credible’, public health and safety are at stake. 

Here are some actions you can take to determine 

if a threat is ‘credible’ or not:

How much time do I have to decide if a 

threat is ‘credible’ or not?

As a general rule, once you have decided 

that the threat is ‘possible’, you should 

determine within 2 to 8 hours whether 

the threat is also ‘credible’, based on site 

information, the nature of the threat, 

the circumstances and other reliable 

information.

1) Conduct a site characterization by 

collecting more information about the 

site of the ‘possible’ contamination to 

help decide if the ‘possible’ threat is 

also a ‘credible’ threat. This step should 

probably involve sample collection to fi nd 

out if contaminants are present and to 

help ‘confi rm’ the threat. Proper sample 

collection should help to ensure that 

lab analyses provide useable data. Law 

enforcement agencies may be investigating 

the site as well, and you should assist them 

in protecting a crime scene. See Chapter 3 

of this Handbook to learn more about site 

characterization. 

2) Check to see if there have been previous 

security incidents similar to the current 

‘possible’ threat, including previous 

incidents at your utility and/or elsewhere. 

3) Consult early with other agencies and 

organizations to get information to help 

you evaluate the threat. Some useful 

sources of information are listed below 

(Note that not all of these may be relevant, 

depending on your locality and the threat 

or incident under investigation):
22 Water Security Handbook

2Contamination Threat Management Guide

• Your state drinking water primacy agency;

• EPA Regional Offi ce;

• The National Response Center;

• Law enforcement agencies and your regional 

FBI Joint Terrorism Task Force;

• Neighboring utilities;

• Public health agencies (local, state, and 

federal – the latter includes the CDC, 

ATSDR, and NIH);

• 911 call centers;

• Homeland Security Warnings and Alerts (see 

the DHS website at www.dhs.gov);

• Water Information Sharing and Analysis 

Center, or WaterISAC, which can assist in 

threat evaluation (see the WaterISAC website 

at www.waterisac.org); 

• Contaminant information from EPA’s Water 

Contaminant Information Tool (WCIT) at 

www.epa.gov/wcit; 

• Use the Contamination Threat Management 

Matrices (see Module 2, p.54 of the Toolbox) 

and the Response Guidelines to help you to help you 

collect and organize information and 

evaluate the threat; and

• Other resources listed in the “Additional 

Resources” section of this Handbook.

You should now decide if the threat warning is 

‘credible’ or not. However, because of the types 

of information needed, the determination of 

credibility of the threat will most likely involve 

more parties than your utility alone. 

If the threat warning is not ‘credible’, then the 

investigation is closed, the incident is documented 

and water system operations are returned to normal. 

If you determine that the threat warning is 

‘credible’, then you should notify appropriate 

agencies and the public, undertake suitable 

response actions to protect public health and 

‘confi rm’ the threat (see below).

To protect public health, provide immediate 

operational responses to prevent or limit public 

exposure to the (potentially) contaminated 

water. See Chapter 5 for examples of operational 

responses that may include isolating suspect 

water or increasing levels of disinfection. For a 

‘credible’ threat warning, the public health goal 

is to minimize public exposure to the suspected 

contaminated water. If it is not possible to provide 

an operational response that effectively reduces the 

possibility that the public will be exposed to the 

suspected contaminant, then you should speed up 

your assessment of the credibility of the threat. 

Collecting and Organizing Information 

For Threat Evaluation:

“Contamination Threat Management 

Matrices”

To help you collect and organize the 

information to help determine if a threat 

is ‘possible’, ‘credible’, or ‘confi rmed’,

see Module 2 of the Toolbox for the 

“Contamination Threat Management 

Matrices”. Each matrix covers:

• Information and factors considered in 

assessing a threat;

• Possible notifi cations; and

• Possible response actions.

These generalized matrices can be customized 

to your utility or to specifi c incidents. 

Customized matrices can be used in your 

utility’s Emergency Response Plan. 

Response Guidelines

The Response Guidelines is a companion to 

this Handbook and contains emergency 

response planning checklists, standard report 

forms and other forms to help you manage 

and organize your emergency response. Visit 

www.epa.gov/watersecurity to download this to download this 

document.
Contamination Threat Management Guide 2

Water Security Handbook 23

Step 3. ‘Confi rm’ the Threat

Once you decide 

that a threat 

warning is 

‘credible’, you 

should work with 

your drinking 

water primacy 

agency, public 

health agencies and law enforcement agencies 

to ‘confi rm’ the threat. Here are some steps in 

confi rming the threat:

1) Send water samples collected during 

site characterization to a laboratory 

for analysis and identifi cation of 

unknown or suspected contaminants 

in the water. The best way to ‘confi rm’

contamination is to provide factual 

evidence of contamination by measuring 

contaminants through laboratory analyses 

of water samples. Laboratory analysis 

can potentially identify and/or ‘confi rm’

contaminants(s), although it is important 

to keep in mind that not all contaminants 

can be identifi ed and/or ‘confi rmed’ by 

every laboratory (see Chapter 4 of this 

Handbook). Lab data can also be useful in 

planning and implementing remediation 

activities (see Chapter 6). However, 

if laboratory analysis of samples is not 

possible for some reason, the standard for 

‘confi rming’ a ‘credible’ threat is that 

a “preponderance of evidence exists” to 

confi rm an incident. A preponderance of 

evidence means that most of the evidence 

available points in this direction.

2) Conduct additional site characterization 

and sampling if needed to ‘confi rm’ 

a contamination incident. You may 

need more information after your initial 

site characterization to ‘confi rm’ the 

incident. For example, your initial 

site characterization and sampling may 

indicate that the contaminant was 

introduced somewhere outside the area 

where you fi rst sampled. (Note: If the 

‘credible’ contamination threat cannot 

be ‘confi rmed’, then the additional site 

characterization and water sampling is 

done to make sure the water is safe and to 

support the decision to return to normal 

operations).

3) Notify law enforcement agencies in the 

event that criminal activity is involved, 

if you have not done so already. Law 

enforcement agencies may need to collect 

evidence and samples to determine whether 

or not criminal activity occurred. You 

should continue to 

help ensure a safe 

water supply and 

work together with 

law enforcement 

agencies to obtain 

evidence that 

could help to 

‘confi rm’ whether 

contamination 

occurred or not. 

Who Do I Notify Once the Threat is 

‘Credible’?

Once you decide that the threat is ‘credible,’

you should report the threat to your drinking 

water primacy agency, public health agencies, 

law enforcement agencies and others, if you 

have not done so already. They will need 

some basic information, such as your name, 

contact information, a description of the 

threat, incident or event, and its location. 

You may also need to notify the public. Be 

aware of your state’s reporting requirements. 
24 Water Security Handbook

2Contamination Threat Management Guide

Once you have lab results and other information, 

you should decide whether the threat can be 

‘confi rmed’ or not. When a threat is ‘confi rmed’, 

you should immediately notify appropriate public 

health agencies (if you have not done so already). 

This sets the stage for public health agencies to 

make public health recommendations. Review 

the public health protection measures that may 

already have been provided (when the threat was 

found to be ‘credible’), and provide additional 

protection measures if needed. You may also be 

required to notify the public. See Chapter 5 of 

this Handbook for more information on public 

health. 

Public notifi cation may be required at any 

stage of the threat evaluation process under the 

National Primary Drinking Water Regulations: 

Public Notifi cation Rule, which says that 

the public should be notifi ed when there is a 

“situation with signifi cant potential to have serious 

side effects on human health as a result of short term 

exposure.” exposure.” (seewww.epa.gov/safewater/pn.html).

Public health advisories may be issued, such as:

• “Boil water”;

• “Do not drink the water”;

• “Do not use water” (including no fl ushing of 

toilets and no use of water for fi re fi ghting).

Remember, ‘confi rming’ a ‘credible’ threat 

represents an important and necessary decisionmaking step. Once a threat is ‘confi rmed’ 

and it becomes a contamination incident, 

decisions should be made concerning public 

health responses, and remediation and recovery. 

Keep in mind that it may take several rounds 

of information collection and evaluation to 

‘confi rm’ a threat. 

If the threat cannot be ‘confi rmed’ because 

there is not enough information, the process of 

collecting information should be continued until 

a preponderance of evidence indicates that the 

threat either can be ‘confi rmed’ or, alternatively, 

the threat cannot be ‘confi rmed’ because it is an 

empty threat. 

Step 4. Remediate the Affected Water System

In this step, the goal is to remediate the 

contaminated water system to remove or 

inactivate the contaminant and test the water 

to make sure that the remediation has worked. 

Remediation is discussed in more detail in 

Chapter 6.

By this time, if the threat has been ‘confi rmed’

to be a contamination incident, a Unifi ed 

Command structure will probably be established 

and other agencies and organizations will be 

responsible for overseeing the response and 

remediation. During remediation, your role 

as water utility manager will most likely be to 

work with the remediation team and Unifi ed 

Command to help ensure recovery of the water 

system.

Why should I ‘confi rm’ a ‘credible’ 

threat? 

You should ‘confi rm’ a ‘credible’ threat 

because responding to a ‘credible’ ‘credible’ threat is an 

important decision that could affect public 

health, affect your water system, involve 

different agencies and require resources. To 

‘confi rm’ a ‘credible’ threat, you should be 

certain, based on defi nitive lab results or a 

“preponderance of evidence” that the threat 

is plausible and believable. Once a threat is 

‘confi rmed’, it becomes a contamination 

incident.
Contamination Threat Management Guide 2

Water Security Handbook 25

Step 5. Recovery of the System 

In this step, the goal is to return your water system 

to safe, normal operation, which is also called 

recovery. Recovery of your water system can begin 

as soon as remediation is complete. If a portion 

of your water system is remediated, you may be 

able to resume normal operation of that portion 

provided that it does not affect remediation of 

other affected parts of the system. Keep in mind 

that your customers may still be experiencing 

residual contamination from within their home 

or business plumbing. As the water system is 

remediated and returned to normal, it is important 

to keep your water utility customers informed. 

Recovery is discussed in more detail in Chapter 6.

Now that the general process of threat response 

has been described, the following chapters will 

describe site characterization, sample analysis, 

the public health response, and remediation and 

recovery in more detail.

Remember, successful response 

involves:

• Planning before an incident occurs;

• Responding in a timely manner and 

using due diligence;

• Protecting public health;

• Investigating and documenting the 

incident;

• Identifying the contaminant;

• Basing your decisions on a 

“preponderance of evidence” if 

sample analyses are not conclusive;

• Choosing the right remediation in 

collaboration with others; and

• Returning the system to normal, 

safe operation (recovery).
26 Water Security Handbook

3Site Characterization and Sampling Guide

Site Characterization And Sampling Guide

Introduction

I

n this chapter, you will learn about site 

characterization and sampling to obtain 

the information needed to decide whether a 

threat is ‘credible’ and/or ‘confi rmed’. Site 

characterization involves investigating the site to 

fi nd out the what, where, when, who, why and 

how of the contamination threat. A site could of the contamination threat. A site could 

be your entire water system or a component 

of it, such as the distribution system, source 

water, treatment facility, storage tanks or some 

other area that may have been contaminated. 

Site characterization activities include site 

investigation, fi eld safety screening, rapid fi eld 

testing of the water and sampling. 

Chapter 3 summarizes Module 3 of the Toolbox, 

which can be obtained at EPA’s Water Security 

website at www.epa.gov/watersecurity.

Investigating the Site

To determine if a threat is ‘credible’ and to 

‘confi rm’ a ‘credible’ threat, you will need 

factual evidence concerning the nature of the 

threat, what the contaminant is, and how serious 

the contaminant may be in terms of public 

health. Site characterization and sampling are 

done to help you get this factual information.

Site characterization results are important to get, 

but it is just as important to make sure that the 

site is safe to enter. You should decide if it is safe 

to proceed with site characterization, whether 

other equipment or specially trained personnel 

are needed, whether another approach is needed 

and many other issues.

Because a utility probably will not have staff 

trained to deal with all hazards, you should 

decide ahead of time what you can and cannot 

do and whether you may need help from other 

organizations or agencies. For example, you may 

be able to do visual inspections and test basic 

water quality at low hazard sites, but you may 

not have the equipment and/or training to test 

for more hazardous substances. You may need 

to call a HazMat team which has the equipment 

and training to safely deal with hazardous 

materials. 

Good planning calls for your utility to make 

prior arrangements with a laboratory to provide 

sample kits with appropriate, clean sample 

containers, before any threat or incident occurs. 

Utilities should keep pre-staged sample kits on 

hand. Refer to Chapter 4 for more information. 

You should then be better prepared if a threat 

warning is received or an emergency occurs. 

Arrangements with other organizations 

should be made ahead of time to respond 

effectively to a threat. The best way to 

prepare is to communicate, plan, and practice. 
Site Characterization and Sampling Guide

3

Water Security Handbook 27

Who Does the Site 

Characterization and Sampling?

The answer to this question depends on what 

stage of site characterization and sampling 

you are in. You or another designated utility 

emergency response lead may carry out the fi rst 

steps of site characterization and sampling. Or, 

an Incident Commander from another agency 

may oversee the threat response, beginning with 

site characterization and sampling. 

The Site Characterization Team is the group 

that actually performs site characterization and 

sampling activities. This team may include 

people from the water utility, police and fi re, 

HazMat specialists, environmental response 

teams from government agencies, public health 

offi cials, FBI and EPA criminal investigators, 

civil support teams and other agencies. 

Ensuring Safety and Protection for 

Personnel

Protecting the safety of the Site Characterization 

Team during site characterization is critical. 

Team members must have the proper training, 

protective gear, clothing and other equipment 

needed to safely inspect and sample the site. 

If there is a threat to safety, then the team 

should stop until the proper gear, personnel, or 

equipment can be obtained. 

What Does Site Characterization 

Involve?

First, the Site Characterization Team develops 

and uses a customized site characterization plan 

as a set of guidelines for investigating the threat. 

Each threat or incident will be different, so 

every site characterization plan will be different. 

However, all plans will share certain features in 

common. You may already have a generic site 

characterization plan which should contain the 

following fi ve elements:

1) Hazard evaluation (including an initial 

hazard assessment before entering the site 

and ongoing reassessment of the hazard as 

you collect more information);

2) Approaching the site and doing a fi eld 

safety screening;

3) Characterizing (investigating) the site;

4) Collecting samples; and

5) Leaving the site.

Each of these elements is described below. 

The Incident Commander or 

the WUERM manages the site 

characterization and sampling. The site 

characterization team carries out the 

investigation. The utility remains involved 

at all times, but its role may change as a 

particular investigation progresses.
28 Water Security Handbook

3Site Characterization and Sampling Guide

Initial Hazard Assessment Before 

Entering the Site

The fi rst step 

in developing 

a specifi c site 

characterization 

plan is to decide 

if the site is safe 

to enter and 

investigate further. 

This is done by making an initial hazard 

assessment before the team is sent to the site. before the team is sent to the site. 

You or the Incident Commander (which may be 

you) should make this initial hazard assessment, 

based on the available data and initial threat 

evaluation. A decision is made regarding the 

potential need for special hazardous material 

handling techniques or equipment. This is a 

very important step that protects the safety of 

anyone who enters the site. People should not 

be sent into a dangerous area without protection. 

Response plans should document who would be 

called to respond to contamination threats under 

different hazard conditions. 

Some possible hazard categories are described in 

the textbox. Although these hazard categories 

are based upon tentative identifi cation of the 

particular type of contaminant at the site, 

there may be enough information in a threat 

warning to allow you to judge that a particular 

hazard category may apply to the situation, thus 

helping you to make an initial hazard assessment. 

As you get more information from the site 

characterization and sampling, you may want to 

revise your initial hazard assessment (and take 

appropriate precautions). Hazard evaluation is 

an ongoing and iterative process.

Possible hazard categories:

Low Hazard – there are no obvious – there are no obvious 

signs of radiological, chemical, or 

biological contaminants at the site, in 

the air, or on surfaces. Contaminants 

that may be present in the water are 

assumed to be dilute and confi ned to 

the water.

Radiological Hazard – radiological 

isotopes or emitters are identifi ed at the 

site or in the water (i.e., through the use 

of a fi eld radiation detector). 

Chemical Hazard – presence of highly – presence of highly 

toxic chemicals (e.g., chemical weapons 

or biotoxins) or volatile toxic industrial 

chemicals is potentially identifi ed at 

the site or in the water, with a possible 

risk of exposure through dermal or 

inhalation routes. 

Biological Hazard – presence of – presence of 

pathogens is potentially identifi ed at 

the site, with a possible risk of exposure 

through dermal or inhalation routes.
Site Characterization and Sampling Guide

3

Water Security Handbook 29

The initial hazard assessment is also important 

for deciding who should be on the Site 

Characterization Team, because the team should 

have the skills, experience and equipment needed 

to deal with the hazards that may exist on the 

site. Some suggestions for possible staff are given 

below:

• If the site appears to be a “Low Hazard” 

site, the water utility staff may do the site 

characterization. 

• If there are clear signs of greater hazard 

(radiological, chemical, or biological 

hazard), then HazMat professionals 

trained in hazardous materials safety and 

handling techniques may need to do the 

initial hazard assessment and the entire site 

characterization as well. 

• The HazMat team may do the initial hazard 

assessment, fi nd that the site is safe enough 

for others to enter, and allow the utility 

staff or other agency staff to enter the site to 

continue the site characterization.

The threat warning itself may suggest what the 

hazard is. Be alert to the possibility of “red 

herrings”, where the threat warning suggests 

one type of hazard, yet the site actually contains 

a different hazard. Another example would 

be misleading clues designed to confuse the 

investigation. If this occurs, the contamination 

threat or incident is most likely intentional.

Approaching the Site and Doing a 

Field Safety Screening

In this step following the initial hazard 

assessment, the Site Characterization Team 

approaches the site and conducts a fi eld safety 

screening. Field safety screening is done to 

observe site conditions and, in particular, to 

detect any immediate threats to the response 

team from contaminants in the atmosphere 

or on surfaces. Field safety screening might 

include fi eld testing for radioactivity, chemical 

and biological agents. The site characterization 

team should already have been trained in the 

use of safety screening equipment. Because 

such equipment can be expensive, you may 

have to call in a HazMat specialist with the 

proper equipment and training to conduct such 

screening. Consider due diligence in all of your 

decisions and actions. 

The fi rst step in a fi eld safety screening is to defi ne 

the perimeter of the site before approaching it. 

The site perimeter should include the immediate 

area of the incident as well as a buffer zone for 

safety. Beginning at some distance outside the 

site perimeter, the Site Characterization Team 

carefully proceeds towards the site perimeter with 

appropriate personal protective equipment and 

fi eld monitoring equipment and notes anything 

out of the ordinary. Signs of contamination could 

include dead or sick animals, discarded chemical 

containers, or other indicators. 
30 Water Security Handbook

3Site Characterization and Sampling Guide

If there are signs of hazards, the team should 

stop their investigation and immediately contact 

the Incident Commander (who may be you). 

You should then decide how to proceed. It 

is recommended that the site be evacuated 

immediately and that a properly trained and 

equipped HazMat team be brought in to 

investigate.

If there are no obvious signs of hazards, the team 

should still contact the Incident Commander 

(who may be you) before crossing the site 

perimeter and entering the site. In most cases, 

you should be able to tell the team to enter the 

site and proceed with site characterization and 

collection of water samples to determine the 

nature of the threat or incident. 

Characterizing the Site

After the fi eld safety screening has been 

completed and if it appears safe to proceed, the 

team may continue the site characterization. 

The team should also do a detailed visual 

inspection of the site. They should perform 

rapid fi eld testing of the water suspected of 

being contaminated. Recommended core fi eld 

testing consists of monitoring for radiation, 

cyanide, chlorine residual, conductivity and pH 

of the suspect water.

Minimize risks by following commonsense safety practices, such as:

• Approach the site from upwind;

• Do not eat, drink or smoke at the site;

• Do not drink, smell, touch or taste the 

suspect water;

• Use appropriate personal protective 

gear (e.g., splash-proof goggles, 

respirator, disposable gloves, 

disposable shoe covers, and a 

disposable lab coat);

• Avoid skin contact with suspect water;

• Fill sample containers slowly to 

avoid splashing or creating spray or 

droplets of water that could spread the 

contamination; and

• Do not spend any more time than 

needed to characterize the site and get 

samples.

Rapid Field Testing and EPA’s 

Technology Testing and Evaluation 

Program (TTEP)

Rapid fi eld testing of water suspected of 

being contaminated is done to try to identify 

the type of contaminant, so that the right 

laboratory analyses can be done. Equipment 

and instruments for rapid fi eld testing are 

described on pages 27-30 of Module 3 of the 

Toolbox. 

Information on fi eld testing technologies 

is also available from the EPA’s National 

Homeland Security Research Center 

(NHSRC), through its Technology 

Testing and Evaluation Program (TTEP). 

The TTEP is an outgrowth of EPA’s 

successful and internationally recognized 

Environmental Technology Verifi cation 

(ETV) Program. TTEP rigorously tests 

technologies for detection, monitoring, 

treatment, decontamination, computer 

modeling, and other tools for protecting 

water infrastructure and decontaminating 

structures and the environment. 

For more information on TTEP, visit the 

NHSRC website at www.epa.gov/nhsrc/tte.

htm.
Site Characterization and Sampling Guide

3

Water Security Handbook 31

There is no single fi eld testing kit that tests for 

all possible radiological, chemical or biological 

contaminants. Because there is no way to test 

for everything, fi eld testing should be used only 

as a guide, not as the fi nal answer. A negative 

result during fi eld testing may mean that there is 

no contaminant, or it may mean that your fi eld 

screening kit is not sensitive enough to detect the 

contaminant or was not designed to measure the 

particular contaminant that is present. 

Collecting Samples

After rapid fi eld testing of the water, samples of 

the suspect water may be collected in case they 

are needed for later laboratory analysis. (Note 

that if a serious hazard is apparent, a HazMat 

responder may be needed to collect samples). 

Depending on the outcome of the threat 

evaluation, the Incident Commander (who 

may be you) may decide to send the samples to 

a laboratory or not. If the threat is ‘credible’, 

then the samples should be sent immediately 

to a laboratory for analysis. But if the threat 

is not ‘credible’, then the samples should be 

stored in a safe place for a specifi c period of time 

in case it later becomes necessary to analyze 

them. Keep in mind that sample holding 

times for radiological, biological and chemical 

contaminants can vary widely. 

Exiting the Site

After fi nishing the site characterization, the team 

should prepare to leave the site. Before leaving, 

the team should make sure that they have:

• Documented their fi ndings;

• Collected all samples needed;

• Collected all equipment; and

• Re-secured the site (lock doors, hatches, 

gates, etc.).

There may be other actions to take before 

leaving the site. If the site is a possible crime 

scene, follow guidelines from law enforcement 

agencies to restrict or block access to the site and 

to protect any evidence from disturbance. If 

the site contains hazardous materials, it may be 

necessary to decontaminate the entire team and 

their equipment. 

In the next chapter, you will learn about 

analyzing samples for contaminants, types 

of contaminants, and types of analytical 

laboratories.

Remember: To conclusively prove 

(or ‘confi rm’) that water is either safe or 

contaminated, you must have water samples 

analyzed by a laboratory that is qualifi ed to 

do such testing. Water samples should always 

be collected if there is any question that the 

water might be contaminated. These samples 

can be analyzed later by a laboratory.

More information on sample collection, 

packaging and transporting can be found 

on pages 20-27 of Module 3 of the Toolbox. 
32 Water Security Handbook

4Analytical Guide

Analytical Guide

Introduction

Chapter 4 is aimed at water utility staff who will plan, order and interpret laboratory 

analyses of water samples collected from the site 

of a suspected incident. In this chapter, you will 

learn how to plan for sample analyses before a 

contamination threat or incident happens, what 

to ask the lab to analyze for, how to set data 

quality goals and what precautions to take when 

handling or shipping samples. The following 

topics are covered:

1) What you should know about laboratory 

analyses and testing;

2) Safety considerations for handling 

suspected contaminated water samples;

3) Types of laboratories, the analyses they 

perform and how to access labs;

4) Making sure that analyses are conducted in 

a manner that ensures high-quality, useable 

results;

5) Screening approaches to determine if 

contaminants are present in a sample; and

6) Threat response planning for analytical 

laboratories.

Chapter 4 summarizes Module 4 of the Toolbox, 

which can be obtained at EPA’s Water Security 

website at www.epa.gov/watersecurity.

What Do I Need to Know About 

Laboratory Analyses?

To plan effectively for threat response, you 

need to be familiar with the general types of 

contaminants, how samples are analyzed, what 

laboratories can perform such analyses, what to 

look for in the data and how to use the results 

in decision-making. It is not enough for you to 

simply “leave it up to the lab to decide what to 

analyze” because:

• The threat warning, the circumstances 

surrounding the threat, or information 

collected during site characterization or fi eld 

safety screening may provide clues to the 

nature of the contaminant or compound. 

You should pass on such information to 

the laboratory so the right analyses can be 

performed.

• Different contaminants may need different 

sampling, preservation, handling or shipping 

methods, otherwise the samples may be 

compromised, resulting in poor quality 

data or useless data. You should be familiar 

with these differences so that your samples 

arrive at the laboratory in useable condition. 

Refer to Module 4 of the Response Protocol 

Toolbox for more information on sampling, for more information on sampling, 

preserving samples and shipping.

• In response planning and decision-making, 

you should take into account the time 

needed by a laboratory to analyze the sample 

for contaminants. This time will vary 

depending on the analyses and the nature of 

the contaminant and other factors. 
Analytical Guide

4

Water Security Handbook 33

• You should work with the laboratory to 

choose the analyses to be done, determine if 

the lab can do the analyses and specify the 

data quality goals (e.g., accuracy, precision, 

range). 

Most importantly, you should work together 

with the laboratory to understand what the 

analytical results mean and the limitations of the 

data. 

Safety Considerations for Water 

Utilities and Others 

Contact with contaminated water, soil or other 

materials may pose serious threats to your health 

or safety and that of 

other water utility 

staff, emergency 

responders, Site 

Characterization 

Team members, 

transport staff, 

laboratory staff or 

others. Anyone 

who may be 

collecting, handling 

or analyzing 

samples that may 

contain unknown contaminants should plan 

ahead of time to ensure their own safety and that 

of their staff. 

Utilities and laboratories should develop and 

routinely use Health and Safety plans ahead of 

time. You, the Site Characterization Team and 

the laboratory should discuss and clearly identify 

any potential risks associated with the suspect 

water to allow all parties to take appropriate 

safety measures. The laboratory should also 

have an internal hazard communication plan to 

ensure that everyone handling suspect samples is 

aware of the potential danger and takes adequate 

precautions. 

Types of Labs and Analyses 

Performed

There are several ways to classify analytical 

testing laboratories in the U.S. Labs can be 

classifi ed by sector, such as:

• Utility labs, such as your water utility’s own 

lab, which may be the fi rst to respond to 

most contamination threats;

• Non-utility labs, such as commercial labs 

that can analyze many kinds of contaminants 

in water, tissue, soil or air; specialized 

labs such as commercial, government or 

university labs that do highly specialized 

analyses; and government labs run by cities, 

counties, states, the EPA, 

FBI, Centers for Disease 

Control and Prevention 

(CDC) and other public 

agencies.

If your utility has a lab 

for testing water quality, 

then your lab will probably 

be the fi rst lab to analyze 

samples suspected of being 

contaminated. Other nonutility labs can provide 

support by confi rming your lab’s analysis or by 

performing analyses that your lab may not be 

able to perform.

Sometimes your utility lab may not be able 

to analyze the samples, especially if site 

characterization suggests that the samples do not 

fall in the “Low Hazard” category described in 

Chapter 3. You may therefore decide that the 

samples should not be analyzed by your utility 

lab but should instead be analyzed by a nonutility lab that is certifi ed to handle and analyze 

hazardous samples. 
34 Water Security Handbook

4Analytical Guide

You should also keep in mind that certain 

contaminants may potentially contaminate lab 

equipment, which could cause contamination 

of future tests. For this reason, it is important 

to get as much information concerning the 

possible contaminant as is feasible from the 

threat warning, the fi eld safety screening and site 

characterization. This information should be 

shared with the laboratory staff in order to plan 

for analyses and to ensure both safety and good 

results. 

Non-utility analytical laboratories can be 

classifi ed according to the kinds of analyses 

they perform (Figure 3). Different analytical 

capabilities are briefl y described below. 

Non-Utility Laboratories That 

Perform Chemical Analyses

Radiological Labs: Radiological labs analyze 

and identify radioactive substances and 

contaminants such as radioactive isotopes 

(also known as radioisotopes), radionuclides, 

radiochemical compounds and radiological 

weapons. The EPA, Department of Energy 

(DOE), states and some commercial fi rms have 

labs that can analyze radioactive materials. The 

Federal Radiological Monitoring and Assessment 

Center (FRMAC), maintained by DOE, can 

provide information on analyzing radioactive 

materials.

Environmental Chemistry Labs: This group 

includes many EPA, state and commercial labs 

that test water samples to see if they meet federal 

and state drinking water standards under the 

Safe Drinking Water Act, Clean Water Act or 

other relevant environmental laws. Under these 

regulations, government-certifi ed labs should 

use certain analytical methods that have been 

standardized and approved for use. 

Figure 3. Non-Utility Laboratories by Contaminant Class. From Module 4, Response 

Protocol Toolbox.
Analytical Guide

4

Water Security Handbook 35

Specialty Labs: Specialty labs include both 

chemical weapons labs and biotoxin labs. 

Chemical weapons, defi ned by the Chemical 

Weapons Convention (CWC), can only be 

analyzed by labs that have the appropriate 

capability and legal authority. Nationwide, there 

are only a few of these labs, and analyses should 

usually be arranged by the proper authorities, 

such as the FBI or certain other federal agencies. 

Few laboratories currently exist which can 

perform chemical weapons analyses. Biotoxins, 

produced by animals or plants, can be analyzed 

by certain government or university labs. Some 

commercial environmental chemistry labs may 

also be able to perform certain biotoxin analyses. 

Non-Utility Laboratories That 

Perform Biological Analyses

Laboratory Response Network (LRN) Labs: 

The Laboratory Response Network (LRN) was 

specifi cally developed to address bioterrorism 

threats. The LRN was set up by the CDC, the 

Association of Public Health Laboratories and 

the FBI. LRN labs include certain city, county, 

state and federal public health labs. Some labs 

that are part of the LRN can perform analyses of 

pathogens, some biotoxins and a “Select List” of 

particularly dangerous pathogens. During the 

planning stage, a utility should partner with such 

labs in order to jointly plan for threat or incident 

response; this should make it easier to quickly 

access lab services during an actual incident. 

Environmental Microbiology Labs: These labs 

test for microbiological pathogens such as diseasecausing bacteria, certain protozoans, viruses, fungi 

and other microorganisms. An environmental 

microbiology lab, state water quality lab, hospital 

lab, medical lab, public health lab or a lab that 

belongs to the LRN will probably be able to 

analyze pathogens in water samples. However, 

not all of these labs may be able to analyze 

contaminants resulting from bioterrorism, 

depending on what the contaminant is.

Obtaining High-Quality Lab Results

Laboratory analyses of samples are performed 

to get accurate factual information on whether 

samples are contaminated or not. This factual 

information is needed to make important 

decisions which can affect many people. It is 

crucial that the analyses be performed in a manner 

that is credible, accurate and repeatable and that 

the results are of suffi cient quality to be useful for 

decision-making. 

Diagrammatic Representation of the 

Laboratory Response Network

The LRN membership is organized 

into “Sentinel Labs” which recognize a 

contaminant, rule it out and/or refer the 

sample to the next level for confirmatory 

testing by “Reference Labs”. At the top 

of the pyramid are “National Labs” (such 

as the CDC and the U.S. Army Medical 

Research Institute for Infectious Diseases, 

or USAMRIID), which are capable of 

definitive characterization of even the 

most hazardous biological agents. See 

Module 4, Response Protocol Toolbox.
36 Water Security Handbook

4Analytical Guide

(If the data will be used for a criminal 

investigation, refer to Section 3.5 of Module 4 of 

the Toolbox for further information).

Some steps to obtain high-quality analytical 

results include the following:

• Plan for analyses before a threat or incident 

occurs. Some labs may be able to run certain 

analyses with little or no advance notice. 

However, many labs should be contacted 

well before the analysis is done so they can 

prepare for the analysis; 

• Choose a reputable, experienced and certifi ed 

laboratory;

• Maintain communication with the Incident 

Commander, public health offi cials and the 

laboratory to ensure that the right analyses 

are performed;

• Use standard protocols for sample collection, 

storage, transport and processing; 

• Use analytical methods which have been 

standardized to the greatest extent possible 

(e.g., EPA methods and other standardized 

methods);

• Work with the lab and drinking water 

primacy agency to defi ne both data quality 

goals to ensure good, accurate results and 

suitable detection limits that can measure 

both background and harmful, elevated 

concentrations of the compound;

• Collect enough samples from appropriate 

locations to obtain meaningful, 

representative results; and

• Maintain good records, such as the chainof-custody, sample locations, date and 

time of sampling, who sampled, shipping 

information, lab contact information, types 

of analyses requested and any observations. 

Approaches to Analytical 

Screening For Unknown 

Contaminants 

What should you ask the lab to analyze for when 

the contaminant is not known? Screening 

is a systematic scientifi c approach to try to 

identify unknown contaminants that may 

be present in a sample. Screening involves 

progressively analyzing a sample to try to 

identify an unknown contaminant(s) through 

skilled, systematic laboratory analysis. This can 

be very diffi cult when there may be thousands 

of possible contaminants. Contaminant 

identifi cation may be even more diffi cult if there 

is no information from the threat warning, 

site characterization or fi eld safety screening to 

indicate the nature of the contaminant, if any.

EPA’s Compendium of Environmental 

Testing Laboratories

This database of laboratories describes 

lab analytical capacities and capabilities. 

The database is designed to assist EPA and 

other users to identify qualifi ed and appropriate laboratories that analyze chemical, 

biological, and radiological agents. Users 

must be registered to access the database. 

To log on, visit the website at www.epa.

gov/compendium or contact your regional 

EPA laboratory.
Analytical Guide

4

Water Security Handbook 37

Unfortunately, there is no one screening process 

that can detect all known contaminants or 

compounds. In addition, different laboratories 

may have slightly different approaches to 

screening. Thus, the judgment and experience 

of an individual emergency response planner, 

Incident Commander or public health offi cial 

can be extremely important in helping the lab 

to plan and/or implement the right screening 

approach that will result in identifying the 

contaminant(s) present, if any. This is another 

reason why everyone involved in emergency 

planning and response should understand at least 

the basics of laboratory analyses of samples. 

Screening a sample that may contain 

contaminants involves sifting through evidence 

to narrow the list of unknowns down to a few 

suspected contaminants. Screening is done in 

two steps. The fi rst step is the Basic Screen and 

the second step is the Expanded Screen. 

The Basic Screen is a broad-spectrum screen 

for common chemical contaminants (“the usual 

suspects”). The Basic Screen uses widely-used 

methods to analyze the sample for a variety 

of contaminants of concern. However, these 

methods do not cover all contaminants that 

may potentially be used to contaminate water; 

for example, there are no standard tests for 

all biotoxins in water. Make sure that the 

laboratory has all the information from fi eld 

screening before it undertakes a basic screen.

Basic screening for radiological contaminants is 

done by measuring radioactivity; for example, 

by using a Geiger counter. A Geiger counter 

can be used as a fi eld screening tool, or it can be 

used in the lab. If radioactivity is detected, the 

chemical identity of the radionuclide should be 

determined through further analysis. 

To cover the shortfalls of the Basic Screen, 

the Expanded Screen tests for more unusual 

chemical or biological contaminants. The 

Expanded Screen “explores” to fi nd out what 

might be in the water sample and looks for 

contaminants that the Basic Screen may have 

missed.

Microbiological screening is similar to screening 

for chemical contaminants or biotoxins, except 

that it targets pathogenic microorganisms. It 

involves four steps:

1) Rapid fi eld testing. The sample is tested in 

the fi eld to see if the pathogen is present. 

Keep in mind that rapid fi eld testing 

equipment for pathogens may be limited.

2) Sample concentration and recovery in the 

fi eld. Large volumes of suspect water are 

collected and the sample is concentrated 

down to a smaller volume to improve the 

chances of fi nding a pathogen;

3) Testing at a “Sentinel Laboratory”, which is 

a laboratory certifi ed for analysis of certain 

pathogens; and

4) Testing at a “Reference Laboratory”, 

if necessary, to compare the pathogen 

to known pathogens kept in “reference 

collections” (much as reference books are 

kept in a library). 
38 Water Security Handbook

4Analytical Guide

Although laboratory analyses may seem complex, 

it is crucial for threat response managers to be 

aware of analytical capabilities and limitations 

so that you can use the information to make 

important decisions. If laboratory testing 

‘confi rms’ the presence of a contaminant in the 

water system, public health response actions 

should be initiated. These are discussed in the 

next chapter. 

Why Analytical Laboratories 

Should Plan for Threat Response 

Laboratories are a key part of our nation’s 

response to water contamination threats and 

incidents. Like water utilities and public 

agencies, laboratories should be ready to 

respond to an emergency by quickly and 

accurately analyzing samples suspected of being 

contaminated and producing reliable results. 

These results should be used by you, the Incident 

Commander, Unifi ed Command, public health 

agencies and others to make important decisions 

that could have far-ranging effects.

Labs that may someday be involved in analyzing 

samples during a water contamination threat 

emergency should develop their own Laboratory 

Response Plans. A Laboratory Response Plan is 

a plan prepared by a laboratory detailing their 

approach and capabilities for the 24/7 processing 

of emergency water samples. Such a plan should 

always be tailored to local needs, facilities and 

skills, and it should be reviewed and accepted 

before use. Module 4 of the Toolbox describes 

laboratory response planning in detail. The 

“model screening procedure”, for example, can 

help labs plan for screening samples. 

In the next chapter, public health response 

activities are described.
Public Health Response Guide

5

Water Security Handbook 39

Public Health Response Guide

Introduction

A primary goal of threat response planning is primary goal of threat response planning is to protect public health and safety to the to protect public health and safety to the 

greatest extent possible. This chapter describes 

public health response planning and public 

notifi cation in the event of a contamination 

threat or incident. This chapter discusses:

• Who is responsible for undertaking public 

health response actions;

• The role of the water utility; and

• The need for cooperation and interaction 

between public health offi cials, utilities, 

drinking water primacy agencies and others 

to protect public health and deliver good 

information to the public. 

As a water utility manager or emergency response 

manager, you should read this chapter to ensure 

that you understand how to help protect public 

health and safety in the event of a contamination 

threat or incident. 

Chapter 5 summarizes Module 5 of the Toolbox, 

which can be obtained at EPA’s Water Security 

website at www.epa.gov/watersecurity. 

Response Planning for Protection 

of Public Health

Water utilities, public health agencies and other 

threat response managers should plan together 

for protection of public health. Such mutual 

planning is crucial. 

There are fi ve steps to consider in planning for 

effective public health response:

1) Plan the public health response to a 

contamination threat or incident before a 

threat or incident occurs;

2) When a threat or incident occurs, 

determine the public health consequences;

3) Carry out operational response actions to 

contain the contaminant and protect public 

health;

4) Communicate effectively with other 

agencies, utilities and the public through a 

communication and notifi cation plan; and

5) Provide an alternate short-term water 

supply (your utility’s ERP should provide 

options for an alternate water supply). 

Each of these steps is summarized below.

Step 1. Plan the Public Health Response 

Before A Threat Occurs

Long before a threat is received, your utility, 

together with local public health agencies, 

should plan and coordinate the public health 

response. State and local public health agencies 

typically develop Public Health Response Plans 

that cover responses to all kinds of public health 

emergencies, including water emergencies. 

Examples of response planning are provided 

below, modifi ed for water utilities.
40 Water Security Handbook

5Public Health Response Guide

Use public health planning in your own 

utility’s Emergency Response Plan (ERP): 

Each utility should examine how public health 

response plans of local and state health agencies 

address water contamination. Utilities should 

use relevant parts of the public health response 

plans in their own ERPs. 

Know which agencies will be involved in 

the public health response: Water utility 

emergency response planners should know 

which agencies will be involved in the public 

health response and what these agencies will be 

doing. The appropriate responsible agencies 

can vary signifi cantly by locality. You should 

coordinate your emergency response planning 

with appropriate agencies and take advantage of 

training offered by others. 

Develop a communication and notifi cation 

plan for your utility: Fast, reliable 

communication is the key to success in 

coordinating the public health response. Before 

an incident occurs, water utilities should 

develop a communication and notifi cation 

plan. Communication and notifi cation plans 

should include other agencies, utility staff, utility 

customers and the public. For example, you 

should report a contamination threat to the 

appropriate drinking water primacy agency and 

public health agencies. Public health agencies 

may in turn alert doctors, clinics and hospitals 

to be on the lookout for public health symptoms 

and to report these to the public health agency. 

Public health agencies should report symptoms 

of contaminated drinking water to utilities. 

Identify possible operational response actions 

during the planning process: During the 

planning process, your utility should identify 

possible operational response actions to respond 

to possible public health threats. During an 

actual contamination threat or incident, you 

should act quickly to protect public health 

and prevent the contaminant from spreading. 

Agencies that may be involved in the 

public health response to a water 

contamination incident include:

• Water and wastewater utilities;

• Drinking water primacy agency;

• Local, state and federal public health 

and environmental agencies;

• Hospitals, clinics, doctors and poison 

control centers;

• Local, state and federal emergency 

services;

• U.S. Environmental Protection 

Agency;

• Centers for Disease Control and 

Prevention;

• Agency for Toxic Substances and 

Disease Registry;

• Federal Emergency Management 

Agency; and

• U.S. Army Corps of Engineers, 

National Guard and/or other military 

organizations.

Your utility’s communication and 

notifi cation plan should specify: 

• Agencies, organizations and 

individuals to contact or notify;

• Who will send and receive 

information; 

• Contact information;

• The kinds of information to be 

communicated;

• When and how to notify your staff, 

drinking water primacy agency and 

other agencies and organizations; 

• When and how to notify the public; 

and

• A backup communication and 

notifi cation system. 
Public Health Response Guide

5

Water Security Handbook 41

Operational response actions are described below 

in Step 3. 

Step 2. When a Threat or Incident Occurs, 

Determine the Public Health Consequences 

Once a contamination incident has been 

‘confi rmed’, you should fi nd out more about 

the contaminant and its health effects in order 

to choose the right course of action to keep the 

contaminant from spreading and to protect 

public health. EPA’s Water Contaminant 

Information Tool (WCIT) can provide useful 

information to help you make these decisions.

As the utility manager, you should work with 

public health agencies to determine how fast 

the contaminant can spread throughout the 

water system, whether there are points at which 

the spread of contaminants can be stopped 

and what public health response actions to 

take. For example, you should have up-to-date 

information on your water distribution system, 

such as water fl ow volumes and fl ow rates, 

locations of shutoff valves and access points and 

so on, so that you can determine where and 

how fast contaminated water might spread in 

the event of a contamination incident. Getting 

this information and keeping it up to date may 

be challenging, but the benefi t should be an 

improved ability to protect public health.

If it is possible, the public health agency should 

also try to estimate how much contaminant 

remains after a given period of time has passed, 

how dangerous this amount is, what health 

precautions to take, and when and where these 

precautions apply. 

Water Contaminant Information Tool 

(WCIT)

The Water Contaminant Information 

Tool is a secure, on-line database 

developed by the U.S. EPA that provides 

information on contaminants of concern 

for water security. WCIT contains the 

most up-to-date, reliable information on 

water contaminants, such as contaminant 

names, fate and transport, health effects 

and toxicity, medical information, 

drinking water treatment effectiveness, 

potential water quality and environmental 

indicators, sampling and analysis, helpful 

response activities for utilities and other 

useful information. 

To learn more about WCIT, download 

the WCIT Fact Sheet from EPA’s water 

security publications website at cfpub.

epa.gov/safewater/watersecurity/tools.

cfm , or connect to the WCIT website at 

www.epa.gov/wcit. Access to the WCIT 

database is controlled.

What You Need To Know To Make The 

Right Public Health Decision:

• Potential acute (severe short-term) 

health effects of the contaminant;

• Potential chronic (less severe but 

longer-lasting) health effects of the 

contaminant;

• Contaminant concentrations that can 

cause these effects;

• Exposure pathways (ingestion, 

inhalation or skin contact); and

• How long the contaminant will 

remain in water, what causes the 

contaminant to break down, what the 

breakdown product is and how toxic 

this breakdown product is compared 

to the original substance. 
42 Water Security Handbook

5Public Health Response Guide

Step 3. Carry Out Operational Response 

Actions

Operational response actions are actions that 

protect public health by reducing exposure to 

the suspect water. Operational response actions 

are often carried out while more information 

is being collected to determine whether or not 

the threat is ‘credible’. It is critical to work 

with local agencies and elected offi cials when 

initiating operational response actions. 

Example: The Mayor receives a call that a water 

tank has been contaminated. The Mayor then 

phones you at the water utility and you decide, as 

the water utility manager, that contamination of 

a particular water tank is ‘possible’ because that 

tank is on-line and the fence around the tank is 

old and decrepit. Your immediate operational 

response is to shut the valves on pipes leading 

into and out of the water tank to isolate the 

water tank from the rest of the water system (if 

feasible), thus preventing any contaminant from 

spreading to the rest of the system. You may 

need to notify your state drinking water primacy 

agency immediately. Also, in addition to the 

federal Public Notifi cation Rule, local notifi cation 

rules can vary by locality and all other appropriate 

parties should be notifi ed (e.g., public health 

agency, law enforcement, and others).

Containment of suspect water should be done 

as soon as possible, ideally during the fi rst stage 

of threat evaluation when you are determining 

if the threat is ‘possible’ or not. If you cannot 

contain the suspect water quickly, then you 

should accelerate the determination of whether 

or not the contamination threat is ‘credible’. 

Deciding on operational responses can be tricky, 

because there could be unforeseen consequences 

of the action taken. For example, restricting 

water use or water delivery could result in 

portions of the service area, including hospitals 

and schools, being deprived of water. This could 

lead to poor sanitation or a host of other effects. 

To deal with these other effects, you should plan 

well in advance of a contamination threat or 

incident. 

Estimating Terrorist Impacts on Water 

Systems:

EPA and others have developed tools, such 

as hydraulic models, to help utilities estimate 

the effects of a terrorist incident on drinking 

water systems. If your utility decides to use 

such tools, you should be aware that such 

models may involve costs and require training 

and time to apply them. Practice using such 

tools before an incident occurs so that you 

can act quickly and with due diligence when 

a real incident occurs.

For Water Utilities: Possible Operational 

Response Actions to Protect Public Health

❏ Isolate and contain the suspect water so 

it doesn’t spread and contaminate other 

parts of the water system;

❏ Increase levels of disinfection; for 

example, by using a mobile disinfection 

unit to treat a part of the water system or 

by adding more chlorine to the system;

❏ Notify the public to take precautions, 

such as “Boil water”, “Do not drink”, 

or “Do not use” in coordination with 

your state primacy agency, public 

health offi cials and other offi cials, as 

appropriate. 

❏ Distribute bottled water or water from 

neighboring utilities as a safe alternative 

to the contaminated or suspect water.
Public Health Response Guide

5

Water Security Handbook 43

Step 4. Notify the Public 

If the contamination threat is ‘credible’, then 

you should coordinate with your drinking water 

primacy agency and public health agencies to 

decide whether to issue a public notice or not. It 

is critical to work with local agencies and elected 

offi cials when planning public notifi cation.

One way to help the public minimize their 

exposure to contaminated water is to issue a 

public notice to avoid drinking or using the 

water. The Federal Public Notifi cation Rule 

under the National Primary Drinking Water 

Regulations requires public notifi cation when 

there is a “situation with signifi cant potential to 

have serious adverse effects on human health as a 

result of short term exposure” (40 CFR § 141.202). 

Once you have decided to notify the public to 

reduce their exposure, you should decide what 

type of notifi cation to issue, based on the threat 

or incident and the contaminant potentially 

involved. Examples of public notices are 

described in the table on page 44.

Public Notifi cation Procedure under 

the National Primary Drinking 

Water Regulations, Federal Public 

Notifi cation Rule (Tier 1, 40 CFR 

141.202):

❏ Notify the public as soon as 

practical, but no later than 24 

hours after you learn of the water 

quality violation or credible 

contamination threat;

❏ Discuss the threat with your 

drinking water primacy agency as 

soon as practical, but no later than 

24 hours after you learn of the 

situation, in order to fi nd out if 

any additional public notifi cation 

is required; and

❏ Provide any additional public 

notifi cation as required by your 

drinking water primacy agency. 

Examples might be repeat notices, 

providing direction on how long 

the notices are in effect, how often 

the notices are to be issued, the 

form and timing of public notices, 

and other actions to reach all your 

water system users. Requirements 

may vary by state. (see www.epa.

gov/safewater/pn.html). 
44 Water Security Handbook

5Public Health Response Guide

Type of Notice When To Use This Notice Relative Burden on Public

Boil Water 

Before Use

Use if boiling will make the water 

safe to drink and boiling does 

not create other health problems, 

particularly through routes of 

exposure other than drinking (e.g., 

inhalation or skin contact with water 

vapor).

Least burden. Facilities which use large 

amounts of water for drinking or food 

preparation will be most affected.

Do Not Drink

Use if boiling is not an option and if 

water vapor and skin contact do not 

pose risks.

More burden – an alternate water 

supply for drinking and food 

preparation will be needed.

Do Not Use 

Use if the contaminant is unknown, 

if treatment is not possible at the 

moment or if the contaminant poses 

a health risk through inhalation of 

water vapor or through skin contact 

with affected water.

Greatest burden – an alternate water 

supply for all uses, including fi re 

fi ghting and fl ushing toilets, will be 

needed.

Examples of Public Notices About Drinking Water 

Because water use restrictions can have 

unintended health consequences, you should 

weigh the potential public health consequences 

of restricting water use against the public health 

threat posed by the contaminant. 

Step 5. Provide an Alternate Water Supply for 

the Short Term 

If the decision is made to issue a “Do Not 

Drink” or “Do Not Use” order, utilities should 

be prepared to provide alternate safe sources 

of water such as bottled water, potable water 

trucked to distribution points, or water provided 

by an interconnection. You may need assistance 

from federal, state and/or local emergency 

responders to distribute water. Keep in mind 

that providing an alternate water supply can pose 

a signifi cant logistical challenge and should be 

planned in advance. Consider the use of mutual 

aid agreements to provide backup water from 

other municipalities or sources, a memorandum 

of understanding (MOU) with other water 

suppliers, and/or contracted services to provide 

alternate water. 

In the next 

chapter, you 

will learn about 

the key issues 

involved in 

remediation and 

recovery of a 

water system.
Remediation and Recovery Guide

6

Water Security Handbook 45

Remediation and Recovery Guide

Introduction

I

n this chapter, you will learn about 

the key issues involved in remediation 

of a contaminated water system and 

how to return the system to normal, safe 

operation. Understanding the remediation 

process is important because, although 

you may not necessarily be responsible 

for overseeing remediation, you should be 

seeking ways to provide safe water while 

remediation is ongoing. Other parties 

involved in remediation should include 

public health agencies and drinking water 

agencies that will monitor water quality 

and the remediation, and remediation 

specialists who will conduct the technical 

work of contaminant cleanup. 

Once a contamination threat or incident 

has been ‘confi rmed’, the contamination 

must be cleaned up, or remediated. 

Remedial response actions are 

actions that reduce or eliminate the 

contaminant. By this time, remediation 

experts should be on hand to clean up the 

contaminant. 

When the remediation is completed and the 

water system is demonstrated to be safe, your 

responsibility should be to return the water 

system to normal, safe operation as quickly 

as possible. Recovery refers to the return to 

normal operations after remediation.

Chapter 6 summarizes Module 6 of the Toolbox, 

which can be obtained at EPA’s Water Security 

website at www.epa.gov/watersecurity. 

Who is Responsible?

Once a contamination threat is ‘confi rmed’ and 

the contamination has been contained, it is likely 

that a Unifi ed Command structure will oversee 

remediation and recovery actions. Unifi ed 

Command will manage a team of specialists from 

different agencies and organizations who know 

how to remediate the particular contaminant 

involved. Specialists should be able to tell you 

when it is safe to return to normal operations. 
46 Water Security Handbook

6Remediation and Recovery Guide

Refer to Chapter 2 for information on the 

National Response Plan, National Incident 

Management System, Incident Command and 

Unifi ed Command.

You should be working to support Unifi ed 

Command to provide technical assistance and 

to help in recovery. It is possible that your 

utility may be more involved in protecting the 

remaining unaffected water system and ensuring 

safe water from another source than in the actual 

remediation activities.

Remediation and Recovery

There are nine steps in the remediation and 

recovery process. Each of these steps is briefl y 

described below. Keep in mind that it is 

critically important to keep the public informed 

throughout the entire remediation and recovery 

process.

Step 1. Find an Alternate Water Supply for 

the Long Term

If remediation 

and recovery 

actions are 

going to take 

some time, safe 

water should 

be provided for 

the public in 

the meantime. 

An alternate safe water supply should be 

identifi ed during the planning process, before 

a contamination incident happens. If your 

utility, working with local agencies, cannot 

provide a long-term alternate water supply, then 

you should request help from state and federal 

emergency planning agencies such as EPA, 

FEMA, or the Army Corps of Engineers. Be 

aware of the challenges and planning details that 

may be involved.

Step 2. Do a System Characterization and 

Feasibility Study

After the contamination has been contained, 

Unifi ed Command will most likely need more 

information to choose the right remediation 

method, such as the identity of the contaminant 

involved and how much of the water system is 

contaminated. Command should also identify 

possible remediation options and fi nd out how 

effective and feasible those options are. Doing 

a System Characterization and Feasibility Study 

should provide this information. Because no 

single agency is likely to have all the resources 

needed to carry out remediation and recovery, 

it is likely that several agencies will be involved 

in remediation and recovery. Under Unifi ed 

Command, the utility should coordinate with 

their drinking water primacy agency, public 

health agencies and other agencies involved in 

protecting public health and drinking water.

Step 3. Do a Risk Assessment

It is important to fi nd out how risky 

the incident site is to workers and the 

public. Unifi ed Command should do a 

quick risk assessment. This quick risk 

assessment should also be useful for 

deciding what response actions to take 

and setting remediation goals. Any risk, 

together with risk reduction measures, 

should be communicated by the Incident 

Commander or Unifi ed Command to your 

utility, public health agencies, drinking water 

primacy agency and the public. 

Step 4. Evaluate Remediation and 

Rehabilitation Alternatives

Once a System Characterization and Feasibility 

Study (Step 2 above) has been carried out, 

Unifi ed Command can begin to evaluate and 

compare possible remedial actions, remediation 

technologies and rehabilitation methods to 
Remediation and Recovery Guide

6

Water Security Handbook 47

restore the water system to normal. Remediation 

can also be done in stages, such as emergency 

short-term remediation to reduce dangerous 

levels of a contaminant to a safer level, followed 

by long-term remediation to remove any 

remaining low levels of the contaminant.

Step 5. Choose the Right Remediation 

Technology

Unifi ed Command should select a remediation 

technology that will:

• Protect human health and the environment;

• Comply with all applicable regulations (such 

as the Safe Drinking Water Act); and

• Be feasible, affordable and cost-effective to 

the extent possible.

Step 6. Design the Remediation

After remediation actions and technology are 

selected, the engineering design, planning and 

documentation of the remediation begins. 

Your water utility and other technical support 

staff should be involved in providing technical 

assistance in the design of the remediation 

to help prevent unforeseen impacts on the 

remaining unaffected water system.

Step 7. Do the Remediation

Once the remedial design has been approved, the 

remediation and rehabilitation 

of the contaminated parts of 

the water system are carried 

out. Contractors may assist 

in these procedures. Your 

expertise in the normal 

operation of the water system 

will be essential during this 

step to avoid unforeseen 

impacts on the water system.

Step 8. Do Post-Remediation Monitoring

After remediation is completed, both water 

quality and the water system should be 

monitored to ensure that the remediation was 

effective. If the remediation was not effective, 

the problem should be fi xed and the water tested 

again. 

Step 9. Communicate with the Public to 

Restore Confi dence

During all stages of remediation, you and 

Unifi ed Command should keep the community 

informed about the remediation process, who 

is in charge, how it could affect human health, 

what is being done to restore safe water, and 

when things are expected to return to normal. 

Otherwise, the public may continue to use 

unsafe water, hoard water, or act in other ways 

that could cause unforeseen problems and even 

interfere with remediation. 

The Final Step – Full 

Recovery

The fi nal step is the resumption 

of safe, normal system 

operations and the provision of 

safe water to the public. With 

full recovery of your water 

system, you have achieved a key 

goal of effective response. 
48 Water Security Handbook

Final Thoughts

Final Thoughts

Planning for water security and emergency response may seem overwhelmingly complex. 

However, several key points can help you deal 

effectively with a contamination threat or 

incident:

1) Your fi rst priority is protecting public 

health and safety;

2) There are many resources for assistance. 

These should be identifi ed as part of 

the planning process, before a threat or 

incident occurs;

3) Always use due diligence in planning for 

and responding to a threat;

4) For a successful response, it is critical to 

have cooperation and good communication 

between your utility and other agencies and 

response organizations;

5) Plan and practice emergency response 

procedures ahead of time to ensure that 

an actual emergency response will go as 

quickly and smoothly as possible;

6) You should make decisions in a timely 

manner, based on the best information 

available to you at the time; and

7) You can help to ensure legally defensible 

decisions through organization, timeliness, 

quality control and good record-keeping.

Remember, if you manage a utility or its 

emergency response program, you are 

responsible for protecting public health and the 

environment. However, you are not alone in 

this mission. Establish communications now 

with the agencies that can help you during an 

emergency, and begin to plan and train for 

contamination threats and incidents. 

www.epa.gov/watersecurity
Water Security Handbook

Glossary of Terms

49

Glossary of Terms

Basic Screen - A broad-spectrum screen to 

identify common chemical contaminants that 

may be present in a suspect water sample. The 

Basic Screen employs widely-used methods to 

analyze the sample for a variety of contaminants 

of concern. See Chapter 4.

Commercial labs - Labs that perform 

testing and analyses of samples as a business. 

Commercial labs may be able to analyze many 

kinds of contaminants in water, tissue, soil and 

air. See Chapter 4.

‘Confi rmed’ - A ‘confi rmed’ threat is a 

‘credible’ threat that has been verifi ed through 

sample analyses that prove that the water 

is contaminated with a harmful substance. 

Alternatively, in the absence of analytical data, 

a threat is ‘confi rmed’ when a preponderance of 

evidence indicates that a contamination incident 

has occurred. A ‘confi rmed’ threat becomes a 

contamination incident. See Chapter 2. 

Contamination threat - A suggestion or 

an indication that water has been or will be 

contaminated, but no conclusive proof has been 

collected yet to confi rm that contamination 

has actually occurred. A threat may be written, 

verbal, or based on observations or other 

evidence. See Chapters 1 and 2.

Contamination incident - A contamination 

incident has occurred when the presence of 

a harmful contaminant or other substance in 

drinking water has been ‘confi rmed’ (i.e., verifi ed 

through sample testing or by a preponderance of 

evidence). See defi nition of ‘confi rmed’ (above) 

and Chapters 1 and 2.

Contamination Threat Management Matrices

- Module 2 of the Response Protocol Toolbox

contains these matrices to assist in collecting 

and organizing the information needed to help 

determine if a threat is ‘possible’, ‘credible’ or 

‘confi rmed’. Each matrix covers: 1) Information 

and factors to be considered in assessing a threat; 

2) Possible notifi cations to make; and 3) Possible 

response actions. These generalized matrices can 

be customized to a specifi c utility or incident. 

See Chapter 2. 

Core fi eld testing - The minimal recommended - The minimal recommended 

monitoring activities to perform when 

conducting a site characterization, including 

monitoring for radiation, cyanide, chlorine 

residual, conductivity and pH of the suspect 

water. See Chapter 3.

‘Credible’ - A ‘credible’ threat is a ‘possible’ 

threat that is believable and plausible, based on 

reliable information that shows there is reason 

to believe that the threat warning is real and 

that contamination is likely to have happened. 

A ‘credible’ threat is a much higher threat level 

than a ‘possible’ threat. See Chapter 2.

Due diligence - Due diligence has been 

exercised when all suitable, sensible and 

responsible actions have been taken to evaluate 

a contamination threat or incident and respond 

appropriately. See Chapter 1.

Emergency Operations Center (EOC) - A 

pre-designated facility established by an agency 

or jurisdiction to coordinate the overall agency 

or jurisdictional response to an emergency. It 

is not a part of on-scene incident management, 

but supports the on-scene Incident Commander 

or Unifi ed Command by arranging for needed 

resources. See Chapter 2.
Water Security Handbook

Glossary of Terms

50

Emergency Response Plans (ERPs) - The 

2002 Public Health Security and Bioterrorism 

Preparedness and Response Act required water 

systems serving more than 3,300 customers to 

develop and maintain Emergency Response 

Plans (ERPs) to prepare for responding 

to contamination threats and intentional 

contamination incidents. See Overview. 

Environmental chemistry labs - Labs that 

analyze environmental samples to see if they 

contain chemical contaminants of concern or 

meet federal and state regulations for quality and 

safety. Many EPA, state and commercial labs 

perform environmental chemistry analyses. Labs 

performing such analyses should be governmentcertifi ed to use standardized, pre-approved 

analytical procedures. See Chapter 4.

Environmental microbiology labs - Labs 

that analyze environmental samples (usually 

water, soil or food) to determine if pathogenic 

microorganisms are present, such as diseasecausing bacteria, protozoans, fungi, viruses or 

others. See Chapter 4.

Expanded Screen - To address the limitations of 

the Basic Screen (see above), an Expanded Screen 

tests for more unusual chemical or biological 

contaminants or contaminants that may have 

been missed by the Basic Screen. See Chapter 4.

FEMA (Federal Emergency Management 

Agency) - The national agency that coordinates 

emergency and disaster relief responses. 

FEMA is one of several agencies included in 

the Department of Homeland Security. See 

“Additional Resources”.

Field safety screening - A safety screening - A safety screening 

procedure that is performed by the Site 

Characterization Team in the fi eld, before 

entering the site of a possible threat or 

contamination incident. The fi eld safety 

screening is done to observe site conditions and 

to detect any immediate threats to the team from 

contaminants. It may include fi eld testing for 

radioactivity, chemical agents and/or biological 

agents. See Chapter 3.

Government labs - Laboratories that are 

operated by government agencies at the city, 

county, state or federal level. Examples of the 

latter include labs operated by the EPA, FBI, 

and Centers for Disease Control and Prevention 

(CDC). A common role of government labs 

is to test samples to determine if regulatory 

standards are met. See Chapter 4. 

Hazard categories (Low Hazard, Radiological 

Hazard, Chemical Hazard, Biological Hazard)

- The hazard posed by a contamination threat or 

incident may be classifi ed according to the type 

of hazard, the cause of the hazard, and the risks 

posed. Examples of hazard categories include 

Low Hazard (no obvious signs of contaminants; 

contaminants are probably diluted and not 

widespread), Radiological Hazard (radiation is 

tentatively identifi ed at the site or in the water, 

posing potential risk), Chemical Hazard (highly 

toxic chemicals such as WMD or volatile toxic 

industrial chemicals are tentatively identifi ed 

at the site or in the water, posing potential 

risk), and Biological Hazard (pathogenic 

microorganisms are tentatively identifi ed, posing 

potential risk). See Chapter 3.

Incident Command System (ICS) - This is 

the national standard for the command, control 

and coordination of a response to a threat, 

incident or emergency of any kind. It requires 

that an individual Incident Commander, from 

an agency that is responsible for responding to 

the emergency or threat, manage the response 

activities. See Chapter 2.

Incident Commander - In the Incident - In the Incident 

Command System, the Incident Commander is 

the individual who is responsible for managing 

the overall response to the emergency. See 

Chapter 2. 
Water Security Handbook

Glossary of Terms

51

Initial hazard assessment - Before the Site - Before the Site 

Characterization Team is sent to investigate the 

site of a threat or contamination incident, the 

Incident Commander should make an initial 

hazard assessment to evaluate potential risks and 

the need for special protective gear or equipment 

for handling hazardous materials or sampling. 

This initial assessment should be based on 

available information and an initial evaluation 

of the threat (i.e., is the threat ‘possible’ or 

‘credible’, or not). See Chapter 3.

Laboratory Response Network (LRN) Labs

- A network of labs that was specifi cally set up 

to address bioterrorism threats. The LRN was 

created by the Centers for Disease Control 

and Prevention (CDC), the Association of 

Public Health Laboratories, and the FBI. LRN 

labs include certain city, county, state and 

federal public health labs that can perform 

analyses of pathogens, some biotoxins, and 

other particularly dangerous pathogens. In 

order to have samples analyzed by an LRN 

lab, arrangements should be made during the 

response planning stage. See Chapter 4. 

Non-utility labs - Laboratories that are not 

run by water or wastewater utilities. Examples 

include government labs, commercial labs, 

university or research labs, specialty labs and 

other types of labs. See Chapter 4.

National Response Plan (NRP) - The NRP 

provides a comprehensive, all-hazards approach 

to managing the response to domestic incidents 

or emergencies. It provides the basis for federal 

agency coordination with state, local and tribal 

governments and with the private sector to 

address incidents or emergencies. The NRP is 

based on the National Incident Management 

System (NIMS) for managing incident response 

(see below); together they provide a template for 

effective threat prevention and response. See 

Chapter 2 and “Additional Resources”.

National Incident Management System 

(NIMS) - NIMS provides a comprehensive 

national framework and standard for incident 

management. NIMS incorporates the Incident 

Command System as the management system to 

deal with threats, emergencies and incidents. See 

Chapter 2 and “Additional Resources”.

Operational response actions (also known as 

immediate operational responses) - Actions 

that protect public health by reducing exposure 

to the suspect water. Operational response 

actions are often carried out while a threat is 

being evaluated in order to protect public health 

in the event that the threat is confi rmed to 

be an incident. Examples include preventing 

the spread of suspected contaminated water, 

increasing disinfection, notifying the public to 

take precautions, or distributing bottled water. 

See Chapters 2 and 5. 

‘Possible’ - After a threat is received, the fi rst step 

in evaluating the credibility of a threat is to decide 

if it is ‘possible’. A ‘possible’ threat is one where 

the circumstances suggest that contamination 

could have occurred and that further investigation 

is needed. If the threat is found to be not 

‘possible’, then the investigation is closed, the 

threat is documented, and operations are returned 

to normal. See Chapter 2.

Preponderance of evidence - Most of the 

available evidence points in a certain direction. 

See Chapter 2.

 

Public notifi cation procedures - Procedures 

for notifying the public in the event that a 

water contamination threat or incident has 

occurred where there is “signifi cant potential 

to have serious adverse effects on human 

health as a result of short-term exposure” 

(40 CFR § 141.202, known as the Federal 

Public Notifi cation Rule under the National 

Primary Drinking Water Regulations). Public 

notifi cation procedures include issuing a public 
Water Security Handbook

Glossary of Terms

52

notice identifying the potential contaminant and 

providing directions for avoiding drinking or 

using the water. See Chapter 5.

Radiological labs - Labs that analyze and 

identify radioactive substances and contaminants 

such as radioactive isotopes, radionuclides, 

radiochemical compounds and radiological 

weapons. The EPA, Department of Energy 

(DOE), states and some commercial fi rms have 

radiological labs. FEMA operates the Federal 

Radiological Management Center (FRMAC) 

which can provide information on analyzing 

samples for radioactive materials. See Chapter 4.

Rapid fi eld testing - Testing that is done in the - Testing that is done in the 

fi eld by the Site Characterization Team to try 

to identify the type of contaminant that may 

be present so that the right laboratory analyses 

can be done. Field testing is done to obtain 

preliminary information, and should be followed 

up by laboratory testing to ‘confi rm’ whether 

contamination is present or not. See Chapter 3 

and the EPA’s Technology Testing and Evaluation 

Program (TTEP) in “Additional Resources” 

(under EPA NHSRC) to learn about equipment 

for rapid fi eld testing. 

Recovery Recovery - The return to normal operations after - The return to normal operations after 

remediation of a contaminated water system or 

site has been completed. See Chapter 6.

Remediation, remedial response actions 

- Response actions that reduce or eliminate the 

contaminant from the affected water system 

or site. Remediation is usually performed by 

remedial specialists overseen by agencies with 

remediation oversight responsibilities. See 

Chapter 6.

Response Guidelines - An EPA document - An EPA document 

that contains all of the forms, checklists, and 

report formats from the comprehensive Response 

Protocol Toolbox: Planning For and Responding 

to Drinking Water Contamination Threats 

and Incidents. The Response Guidelines and 

this Handbook were designed as companion 

documents to be used together for response 

planning. See “Overview” and “Additional 

Resources”. 

Response Protocol Toolbox: Planning For and 

Responding to Drinking Water Contamination 

Threats and Incidents (Toolbox, or RPTB) (Toolbox, or RPTB) - A 

comprehensive guidance document developed 

by the EPA for the water sector, the Toolbox 

describes planning measures to prepare for and 

respond to drinking water contamination threats 

and incidents. The chapters in this Handbook 

correspond to modules in the Toolbox. See 

“Overview” and “Additional Resources”.

Site characterization - Site characterization 

involves the investigation of the site of a threat 

or incident to fi nd out the “what, where, 

when, who, why and how” of the threat or 

incident. After the initial hazard assessment, 

site characterization activities include fi eld safety 

screening, site investigation, rapid fi eld testing 

of the water, and sampling. A site could be an 

entire water system or a component, such as 

the distribution system, source water, treatment 

facility, storage tanks or some other area that 

may have been contaminated. See Chapter 3. 

Site characterization team - The group of 

individuals that performs site characterization 

and sampling activities following receipt of 

a threat or incident report. The team may 

include people from the water utility, police, 

fi re, HazMat specialists, environmental response 

teams from government agencies, public health 

offi cials, FBI and EPA criminal investigators, 

civil support teams and representatives of other 

agencies. See Chapter 3. 

Specialized or specialty labs - Commercial, 

government or university labs that perform 

highly specialized analyses that are not 

commonly performed by other labs. Examples 
Water Security Handbook

Glossary of Terms

53

include chemical weapons labs and biotoxin 

labs. Nationwide, there are only a few chemical 

weapons or biotoxin labs, and analyses should 

usually be arranged by the proper authorities, 

such as the FBI or certain other federal agencies. 

See Chapter 4.

Threat warning - An indication that something 

may be wrong with water quality or the drinking 

water system. Threat warnings may include 

any, some or all of the following: security 

breach, witness account, direct notifi cation 

by the perpetrator, notifi cation by the news 

media, notifi cation by law enforcement, unusual 

water quality, consumer complaints, and/or 

notifi cation by public health agencies. See 

Chapter 2.

Unifi ed Command Unifi ed Command - In ICS, Unifi ed Command - In ICS, Unified Command 

is a unifi ed team effort which allows all agencies 

with responsibility for the incident, either 

geographic or functional, to manage the incident 

by establishing a common set of goals and 

strategies. This is accomplished without losing 

or giving up agency authority, responsibility, or 

accountability. See Chapter 2. 

Utility labs - Labs that are run by water utilities. 

Utility labs routinely perform water quality 

monitoring to ensure that drinking water is safe 

for customers. See Chapter 4.

Water Utility Emergency Response Manager 

(WUERM) - An individual who is responsible 

for managing the water utility’s internal 

emergency response procedures (also known 

as the water utility’s emergency response 

coordinator). This individual may also serve 

as the utility’s Incident Commander during 

emergencies. See Chapter 2.
54 Water Security Handbook

Additional Resources

Additional Resources

This section provides information on resources 

that may help you in planning and responding 

to contamination threats and incidents. 

Information was current at the time of 

publication of this Handbook. 

Agency for Toxic Substances and Disease 

Registry (ATSDR): ATSDR is a national public 

health agency which compiles information on 

contaminants and disease-causing agents. See 

their website at www.atsdr.cdc.gov/.

Centers for Disease Control and Prevention 

(CDC): See the CDC website at www.cdc.gov/ 

or call the CDC Hotline at 1-800-CDC-INFO. 

CDC compiles and tracks information on 

diseases, illness, outbreaks, contaminants, health 

effects, emergency preparedness and response, 

the national Laboratory Response Network 

(LRN), bioterrorism agents and other topics.

Compendium of Environmental Testing 

Laboratories: This laboratory compendium is a 

database of laboratories, developed by the EPA, 

which describes the analytical capabilities and 

capacities of labs nationwide. The database was 

designed to assist EPA and other users to identify 

qualifi ed and appropriate laboratories to analyze 

chemical, biological and radiological agents. 

To register on-line or to obtain additional 

information, visit www.epa.gov/compendium. 

Access to the laboratory compendium is 

controlled.

Department of Homeland Security (DHS): 

See the DHS website at www.dhs.gov/. The 

website provides extensive information 

concerning threats and posts threat levels and 

other bulletins. It also contains links to the 

National Incident Management System (NIMS), 

Homeland Security Information Networks for 

Critical Sectors or HSIN-CS, and information 

regarding the Freedom of Information Act 

(FOIA). 

EPA National Homeland Security Research 

Center (NHSRC): The NHSRC provides 

technical information on methods, tools and 

technologies to assist in protecting public 

health and safety in the event of a terrorist 

attack. Examples include the EPA’s Technology 

Testing and Evaluation Program (TTEP), the 

Standardized Analytical Methods for Use During 

Homeland Security Events and the Security 

Information Collaborative – A Guide for Water 

Utilities, described elsewhere in this section. 

See the EPA NHSRC website at www.epa.gov/

nhsrc/.

EPA Safe Drinking Water Hotline: This 

hotline is a service of the Offi ce of Ground 

Water and Drinking Water. It provides the 

general public, regulators, medical and water 

professionals, academia and media with 

information about drinking water and ground 

water programs authorized under the Safe 

Drinking Water Act. You can reach the hotline 

at 1-800-426-4791 or ask a question at the 

Hotline’s website at www.epa.gov/safewater/

hotline.

EPA Water Security Division: See EPA’s 

website at www.epa.gov/watersecurity for 

information on emergency response planning, 

training workshops, tools and useful links. 

The website includes links to information on 

Emergency Response Plans (ERPs), the Response 

Protocol Toolbox, this Handbook, and many other 

water security resources. 
Additional Resources

Water Security Handbook 55

Emergency Response Plan Guidance for Small 

and Medium Systems, Emergency Response 

Plan Outline, and other emergency response 

planning documents can be downloaded from 

EPA’s water security website at www.epa.gov/

watersecurity or by calling EPA’s Safe Drinking or by calling EPA’s Safe Drinking 

Water Hotline at 1-800-426-4791 or by sending 

an e-mail via the Hotline’s website at www.epa.

gov/safewater/hotline.

Emergency Response Tabletop Exercises for 

Drinking Water and Wastewater Systems 

CD: This CD, developed by the EPA, 

contains tabletop exercises to help train water 

and wastewater utility workers in preparing 

and carrying out emergency response plans. 

The exercises provided on the CD can help 

strengthen relationships between a water supplier 

and their emergency response team (e.g., health 

offi cials, laboratories, fi re, police, emergency 

medical services, and local, state and federal 

offi cials). Users can also adapt the materials for 

their own needs. Explore the CD at www.epa.

gov/watersecurity. 

Federal Emergency Management Agency 

(FEMA): See the FEMA website at www.fema.

gov/ or call 1-800-621-FEMA. This national 

agency coordinates emergency and disaster relief 

response. Their website contains links to the 

National Response Plan, the National Incident 

Management System (NIMS), the Federal 

Radiological Emergency Response Plan and 

many other useful emergency response links.

InfraGard: This is an FBI-sponsored 

information sharing and analysis effort serving 

the interests and combining the knowledge base 

of a wide range of members. At its most basic 

level, InfraGard is a partnership between the FBI 

and the private sector. InfraGard is an association 

of businesses, academic institutions, state 

and local law enforcement agencies and other 

participants dedicated to sharing information 

and intelligence to prevent hostile acts against the 

United States. Learn more at www.infragard.net. 

National Response Center (NRC) and 

National Response Team (NRT): The NRC 

is the federal point of contact for reporting 

incidents related to oil, hazardous material 

discharges, suspicious activity, security 

breaches or terrorism occurring in the United 

States. The NRT is an organization of 16 

Federal departments and agencies responsible 

for coordinating emergency preparedness 

and response to oil and hazardous substance 

pollution incidents. The Environmental 

Protection Agency (EPA) and the U.S. Coast 

Guard (USCG) serve as Chair and Vice Chair, 

respectively. Call the NRC at 1-800-424-8802 

or 1-202-267-2675 or see the NRT’s website at 

www.nrt.org.

National Incident Management System 

(NIMS): The NIMS integrates effective 

practices in emergency preparedness and 

response into a comprehensive national 

framework for incident management. The 

NIMS will enable responders at all levels to work 

together more effectively to manage domestic 

incidents no matter what the cause, size or 

complexity. See the DHS website at http://www.

dhs.gov/interweb/assetlibrary/NIMS-90-web.pdf 

for the full NIMS document.

National Response Plan (NRP): The NRP 

establishes a comprehensive all-hazards approach 

to enhance the ability of the United States to 

manage domestic incidents. It provides the 

basis for federal government coordination with 

state, local and tribal governments and the 

private sector during incidents. The NRP can 

be downloaded from DHS’s website at www.dhs.

gov/dhspublic/interapp/editorial/editorial_0566.

xml.
56 Water Security Handbook

Additional Resources

National Environmental Methods Index 

for Chemical, Biological and Radiological 

Contaminants (NEMI-CBR): NEMI and 

CBR Methods Advisor are two tools which will 

provide information on chemical, biological 

and radiological contaminants and analytical 

methods of detection, analysis and identifi cation. 

These tools are being developed by the U.S. 

EPA. The National Environmental Methods 

Index (NEMI) is a free, searchable Internetbased database of environmental methods that 

allows comparison of methods, performance, 

cost and other information. NEMI is already 

available on the Internet at www.nemi.gov. 

NEMI-CBR incorporates the CBR Methods 

Advisor, which can help a user to quickly assess 

a threat, evaluate the site of the incident, collect 

samples and choose the best method for a given 

situation when there is limited information 

available regarding the possible identity of a 

contaminant. 

Physician On-Line Reference Guide for 

Waterborne Disease: This on-line reference 

provides information on water-related diseases 

and other medical and health emergency 

response information. See the website at www.

WaterHealthConnection.org/index.asp. 

Public Health Security and Bioterrorism 

Preparedness and Response Act of 2002 (also 

known as the Bioterrorism Act of 2002): Title 

IV of the Act addresses drinking water security 

and safety, and required drinking water systems 

serving more than 3,300 persons to develop 

response measures to incidents that could disrupt 

safe water supplies. To learn more, visit the 

EPA website on water security legislation and 

directives at http://cfpub.epa.gov/safewater/

watersecurity/legislation.cfm.

Response Guidelines (Response Protocol 

Toolbox: Planning For and Responding to 

Drinking Water Contamination Threats and 

Incidents: Response Guidelines): This EPA 

document is a companion to this Handbook 

and contains many forms, checklists and 

report formats to help a water system organize 

information for emergency response planning. 

These documents can be downloaded from 

EPA’s Water Security website at www.epa.gov/

watersecurity.

Response Protocol Toolbox: Planning For and 

Responding to Drinking Water Contamination 

Threats and Incidents: The EPA developed and 

wrote the Toolbox, building on the experience 

and expertise of several drinking water utilities, 

particularly the Metropolitan Water District of 

Southern California. Organized in modular 

format, the Toolbox assists with emergency 

response preparedness and will be of value to 

drinking water utilities, laboratories, emergency 

responders, state drinking water programs, 

technical assistance providers and public 

health and law enforcement offi cials. It can be 

downloaded at www.epa.gov/watersecurity. 

Security Information Collaborative – A Guide 

for Water Utilities: for Water Utilities: This short (40-page) This short (40-page)

booklet, developed by the EPA, describes how 

water and wastewater utilities can form benefi cial 

collaboratives to share information on water 

security. Case studies are combined with step-bystep suggestions for utilities to coordinate with 

key water security partners. The booklet may be 

downloaded from the EPA’s National Homeland 

Security Research Center’s publications website at 

www.epa.gov/nhsrc/pubs.htm.

Standardized Analytical Methods for Use 

During Homeland Security Events: This 

comprehensive compendium of analytical 

methods was developed by the EPA for 

use during an intentional contamination 

event. The document, EPA Publication No. 

EPA/600/R-04/126, is available from the EPA 

NHSRC website at: www.epa.gov/nhsrc/pubs/

reportSAM092904.pdf. 
Additional Resources

Water Security Handbook 57

U.S. Army Medical Research Institute of 

Infectious Diseases (USAMRIID): This Army 

lab conducts research on infectious diseases. For 

more information, visit their website at www.

usamriid.army.mil/ or write to: Commander, 

USAMRIID, 1425 Porter Street, Frederick, MD 

21702-5011.

U.S. Technical Support Working Group 

(TSWG): The TSWG is a federal working 

group that provides information on security 

products and tools, such as the U.S. Department 

of Energy’s 21 Steps to Improve Cyber Security of 

SCADA Networks. This document and other 

useful products can be downloaded from the 

TSWG’s website at www.tswg.gov/tswg.

Water Contaminant Information Tool 

(WCIT): EPA developed WCIT, which is a 

secure on-line database that provides information 

on contaminants of concern for water security. 

To learn more about WCIT, download the 

WCIT Fact Sheet from EPA’s water security 

publications website at http://cfpub.epa.gov/

safewater/watersecurity/tools.cfm or connect to 

the WCIT website at www.epa.gov/wcit. Access 

to the WCIT database is controlled. 

Water Information Sharing and Analysis 

Center (WaterISAC): This is a water security 

information-sharing system which is accessible 

via a website at www.waterisac.org. The 

WaterISAC website has a public portion and 

a secure membership-only portion available to 

subscribing utility personnel. WaterISAC is 

designed for disseminating alerts and warnings, 

receiving incident reports and sharing waterrelated information among water and wastewater 

utilities. 

Water Security Channel (WaterSC): WaterSC 

is a free service of the WaterISAC which 

was designed to disseminate basic security 

information, as developed by the federal 

government, via e-mail and a secure website. To 

sign up, visit www.watersc.org. 
Water Security Handbook

Contacts

58

List of Contacts for States, Commonwealths, and Territories

State Drinking Water Program Website Phone 

Number

Alabama Department of Environmental Management: Water Supply Branch 

http://www.adem.state.al.us/WaterDivision/Drinking/DWMainInfo.htm (334) 271-7700

Alaska Department of Environmental Conservation: Drinking Water Program

http://www.state.ak.us/dec/eh/dw/ (907) 269-7647

American 

Samoa

Environmental Protection Agency

http://www.epa.gov/Region9/cross_pr/islands/samoa.html (684) 633-2304

Arizona Department of Environmental Quality: Safe Drinking Water Program

http://www.azdeq.gov/environ/water/dw/index.html

(602) 771-2300

(800) 234-5677

Arkansas Department of Health: Division of Engineering

http://www.healthyarkansas.com/eng/ (501) 661-2623

California

Department of Health Services: Division of Drinking Water and 

Environmental Managementhttp://www.dhs.ca.gov/ps/ddwem/

technical/dwp/dwpindex.htm

(916) 449-5577

Colorado

Department of Public Health and Environment: Drinking Water Program

http://www.cdphe.state.co.us/wq/Drinking_Water/Drinking_Water_

Program_Home.htm

(303) 692-3500

Connecticut Department of Public Health: Drinking Water Section

http://www.dph.state.ct.us/BRS/Water/DWD.htm (860) 509-7333

Delaware Department of Health and Social Services: Division of Public Health

http://www.dhss.delaware.gov/dhss/dph/about.html

(888) 459-2943

(302) 744-4700

District of 

Columbia

Environmental Protection Agency, Region 3

http://www.epa.gov/reg3wapd/drinkingwater/DCdrinking/index.htm (215) 814-5781

Florida Department of Environmental Protection: Drinking Water Program

http://www.dep.state.fl .us/water/drinkingwater/index.htm

(850) 245-8336

Georgia Department of Natural Resources: Water Resources Branch

http://www.gaepd.org/Documents/index_water_wrb.html

(404) 657-5947

(888) 373-5947

Guam Environmental Protection Agency: Water Programs Division

http://www.guamepa.govguam.net/programs/water/sdw.html (671) 475-1638

Hawaii

Department of Health: Environmental Health Division, Safe Drinking 

Water Branch http://www.hawaii.gov/health/environmental/water/

sdwb/index.html

(808) 586-4258

Idaho

Department of Environmental Quality: Drinking Water Program, Water 

Quality Division http://www.deq.state.id.us/water/prog_issues/

drinking_water/overview.cfm

(208) 373-0289

Illinois Environmental Protection Agency: Bureau of Water, Division of Public 

Water Supplies http://www.epa.state.il.us/water/index.html (217) 785-8653

Indiana Department of Environmental Management: Drinking Water Branch

http://www.in.gov/idem/water/dwb/

(317) 232-8603

(800) 451-6027

Iowa Department of Natural Resources: Water Supply Program

http://www.iowadnr.com/water/drinking/index.html (515) 725-0282

Kansas Department of Health and Environment: Bureau of Water, Public Water 

Supply Section http://www.kdhe.state.ks.us/pws/ (785) 296-5503

Kentucky Department for Environmental Protection: Division of Water

http://www.water.ky.gov/dw/ (502) 564-3410
Contacts

Water Security Handbook 59

State Drinking Water Program Website Phone 

Number

Louisiana Offi ce of Public Health: Safe Drinking Water Program

http://www.oph.dhh.louisiana.gov/engineerservice/safewater/ (225) 765-5038

Maine Maine Department of Health and Human Services: Drinking Water 

Program http://www.state.me.us/dhs/eng/water/ (207) 287-2070

Maryland

Department of the Environment: Water Supply Program

http://www.mde.state.md.us/Programs/WaterPrograms/Water_

Supply/index.asp

(410) 537-3000

(800) 633-6101

Massachusetts Department of Environmental Protection: Drinking Water Program

http://www.mass.gov/dep/water/drinking.htm (617) 292-5500

Michigan Department of Environmental Quality: Water Bureau

http://www.michigan.gov/deq/0,1607,7-135-3313_3675---,00.html (517) 335-4176

Minnesota Department of Health: Drinking Water Protection Section

http://www.health.state.mn.us/divs/eh/water/index.html (651) 201-4700

Mississippi Department of Health: Water Supply Division

http://www.msdh.state.ms.us/msdhsite/_static/44,0,76.html (601) 576-7518

Missouri Department of Natural Resources: Water Protection Program

http://www.dnr.mo.gov/wpscd/wpcp/index.html

(573) 751-1300

(800) 361-4827

Montana Department of Environmental Quality: Public Water Supply Program

http://www.deq.state.mt.us/wqinfo/Index.asp (406) 444-4071

Nebraska Department of Health and Human Services: Public Water Supply 

Program http://www.hhs.state.ne.us/enh/pwsindex.htm

(402) 471-0521

(402) 471-2541

Nevada State Health Division: Safe Drinking Water Program

http://ndep.nv.gov/bsdw/index.htm (775) 687-9515

New 

Hampshire

Department of Environmental Services: Water Division

http://www.des.state.nh.us/wseb/ (603) 271-2513

New Jersey Department of Environmental Protection: Water Supply Administration

http://www.state.nj.us/dep/watersupply/ (609) 292-5550

New Mexico Environment Department: Drinking Water Bureau:

http://www.nmenv.state.nm.us/dwb/dwbtop.html

(505) 476-8625

(877) 654-8720

New York New York State Department of Health: Drinking Water Protection 

Program http://www.health.state.ny.us/nysdoh/water/main.htm (518) 402-7650

North 

Carolina

Department of Environment and Natural Resources: Public Water 

Supply Section http://www.deh.enr.state.nc.us/pws/ (919) 733-2321

North Dakota Department of Health: Division of Municipal Facilities, Drinking 

Water Program http://www.health.state.nd.us/MF/index.html (701) 328-5257

Ohio Environmental Protection Agency: Division of Drinking and Ground 

Water http://www.epa.state.oh.us/ddagw/ (614) 644-2752

Oklahoma Department of Environmental Quality: Water Quality Division

http://www.deq.state.ok.us/WQDnew/index.htm (405) 702-8100

Oregon Department of Human Services: Drinking Water Program

http://oregon.gov/DHS/ph/dwp/index.shtml (971) 673-0405

Pennsylvania Department of Environmental Protection: Offi ce of Water Management

http://www.depweb.state.pa.us/watermgmt/site/default.asp (717) 772-4018

Puerto Rico

Department of Health: Public Water Supply Supervision Program

http://www.epa.gov/safewater/dwinfo/pr.htm (787) 754-6010

Rhode Island

Department of Health: Offi ce of Drinking Water Quality

http://www.health.ri.gov/environment/dwq/index.php (401) 222-6867
Water Security Handbook

Contacts

60

State Drinking Water Program Website Phone 

Number

South 

Carolina

Department of Health and Environmental Control: Drinking Water 

Program http://www.scdhec.net/eqc/water/

(803) 898-4300

(888) 481-0125

South 

Dakota

Department of Environment and Natural Resources: Drinking Water 

Program http://www.state.sd.us/denr/des/drinking/dwprg.htm (605) 773-3754

Tennessee Department of Environment and Conservation: Division of Water Supply

http://www.state.tn.us/environment/dws/

(615) 532-0191

Texas Texas Commission on Environmental Quality

http://www.tceq.state.tx.us/nav/util_water/

(512) 239-4691

Utah Department of Environmental Quality: Division of Drinking Water

http://www.drinkingwater.utah.gov/ (801) 536-4200

Vermont Vermont Agency of Natural Resources, Water Supply Division

http://www.anr.state.vt.us/dec/watersup/wsd.htm

(802) 241-3400

(800) 823-6500

Virginia Department of Health: Offi ce of Drinking Water

http://www.vdh.state.va.us/dw/ (804) 864-7500

Virgin 

Islands 

(U.S.)

Department of Planning and Natural Resources: Division of 

Environmental Protection http://dpnr.gov.vi/dep/PublicWaterSup.htm

(340) 774-3320

(340) 773-1082

Washington Division of Environmental Health: Offi ce of Drinking Water

http://www.doh.wa.gov/ehp/dw/

(360) 236-3100

West Virginia Bureau for Public Health: Department of Health and Human Resources

http://www.wvdhhr.org/oehs/eed/ (304) 558-6715

Wisconsin Department of Natural Resources: Bureau of Drinking Water and 

Ground Water http://www.dnr.state.wi.us/org/water/dwg/index.htm (608) 266-0821

Wyoming EPA Region 8: Wyoming Drinking Water Program

http://www.epa.gov/region08/water/dwhome/wycon/wycon.html (307) 777-7072
Contacts

Water Security Handbook 61

List of EPA Regional Contacts

EPA Region EPA Region Website Phone 

Number

EPA Region 1 http://www.epa.gov/NE/eco/drinkwater/dw-security.html (617) 918-1694

EPA Region 2 http://www.epa.gov/region2/water/ (212) 637-3879

EPA Region 3 http://www.epa.gov/reg3wapd/ (215) 814-5668

EPA Region 4 http://www.epa.gov/region4/water/ (404) 562-9446

EPA Region 5 http://www.epa.gov/region5/water/ (312) 886-0190

EPA Region 6 http://www.epa.gov/Arkansas/6wq/swp/security/ (214) 665-2776

EPA Region 7 http://www.epa.gov/region7/security/index.htm (913) 551-7585

EPA Region 8 http://www.epa.gov/region8/compliance/security/secure.html (303) 312-7021

EPA Region 9 http://www.epa.gov/region9/water/ (415) 947-8707

EPA Region 10 http://yosemite.epa.gov/R10/WATER.NSF/webpage/Water+Issue

s+in+Region+10 (206) 553-1389


U.S. Environmental Protection Agency

Offi ce of Ground Water and Drinking Water

Washington, D.C. 20460

EPA Publication No. 817-B-06-001

www.epa.gov/watersecurity

April, 2006