Offi ce of Water (4601M)

EPA 817-F-08-005www.epa.gov/watersecurityOctober 2008

Features of an and Effective PProgram for WWastewater Ut

 
Recycled/Recyclable • Printed with Vegetable Oil Based Inks on

100% Postconsumer, Process Chlorine Free Recycled Paper

Offi ce of Water (4601M)

EPA 817-F-08-005

www.epa.gov/watersecurity

October 2008

8. Does your utility receive screened, v

to inform decisions or take action) thof the following sources (Y/N)?

 WaterISAC FBI Local police DHS

9. Do you have a plan in place to incre

threat (Y/N)?

10. Do you have a written business cont11. Do you:

 Have an emergency response pl Conduct training on the ERP (Y Carry out exercises on the ERP  If so, which type:

Table top (Y/N)?

 Functional (Y/N)? Full fi eld (Y/N)?

Review and update ERP on a pe

12. Has your utility adopted National In

as part of its emergency response pla

Is the Incident Command System zation to manage incidents and/

13. Is your utility a signatory to written 

assistance, such as an MOU for mutWastewater Agency Response Netw

If no, are you in the process of c

14. Has your utility responded to an eme

aid and assistance (Y/N)?

15. Do you have a crisis communication 16. Do you engage in networking activit

ness and collaborative response in th

More information on the measures and afor utilities, is available at: cfpub.epa.govsures.cfm.
16

WaterISAC, www.waterisac.orgState and Local Fusion Centers,www.dhs.gov/xinfoshare/programs/gc_1156877184684.shtmCDC Health Alert Network, www.phppo.cdc.gov/han/

Example Self-Assessment MeasuresThe Features establish the expectation that utilities should self-assess to measure progress and adjust their protective program based on performance data.The water sector has developed measures of utility activities that roughly correspond with the activities described in the Features. These measures are provided as examples for utilities to consider as a starting point as they develop their own self-assessment measures. 1. Have you integrated security and preparedness into budgeting, training, 

and manpower responsibilities (Y/N)?

2. Have you incorporated security into planning and design protocols applying to all assets and facilities (Y/N)?3. Do you routinely conduct supplemental monitoring or more in-depth 

analysis beyond what is required to identify abnormal water quality conditions (Y/N)?

4. Have you established relationships with public health networks to interpret public health anomalies for the purposes of identifying waterborne 

public health impacts (Y/N)? 

5. Do you monitor and evaluate customer complaints for possible indications of water quality or other security threats (Y/N)?6. Have you established protocols (i.e., consequence management plans) 

for interpreting and responding to indications of water quality anomalies (Y/N)? 

7. Do you review your vulnerability assessment (VA) annually (Y/N)?

 How frequently do you update your VA to adjust for changes in 

your system that may alter the risk profi le of your utility? (never 

update; annually; every 2-3 years; every 3-5 years; every 5-10 years; no defi ned cycle)? 

Features of an Active Protective Program foWastewater UtilitiesIntroductionThe water sector has developed the FeatuProtective Program to assist owners and wastewater utilities (water sector) in prevand recovering from adverse effects of altacks and natural disasters. The Features originated as an outcome osory Council workgroup in 2005 and hav

and objectives of the Sector Specifi c Plan The Features use the terms “protective program,” “protection,” and “protective” to describe activities that enhance resiliency and promote continuity of service, regardless of the exact type of hazard or adverse effect a utility might experience.The 10 features describe the basic elements of a “protective program” for owners/operators of utilities to consider as they develop utility-specifi c approacheber, and human elements of prevention, dThe 10 features:

 Are suffi ciently fl exible to apply to a Are consistent with the management 

provement. 

Water utilities can differ in many ways in

 Source of water (ground or surface) Number of sources Treatment capacity
2

 Operational risk Locational risk  Protective program budget Spending priorities Political and public support Legal barriers Public vs. private ownership

The goal in identifying common features of active and effective protective programs is to achieve consistency in protective program outcomes among water utilities, while allowing for, and encouraging, utilities to develop utility-speci

fi c protective program approaches and tactics. The Features are 

based on an integrated approach that incorporates a combination of public involvement and awareness, partnerships, and physical, chemical, operational, and design controls to increase overall program performance. 

The FeaturesFeature 1. Encourage awareness and integration of a comprehensive protective posture into daily business operations to foster a protective culture throughout the organization and ensure continuity of utility services. The objective of Feature 1 is to make protection a normal part of day-to-day operations. Utility-speci

fi c efforts that help incorporate protection concepts into organizational culture might include: 

 Senior leadership makes an explicit, easily communicated commitment 

to a program that incorporates the full spectrum of protection activities. 

 Foster attentiveness to protection among front line workers and encourage them to bring potential issues and concerns to the attention of others; establish a process for employees to make suggestions for protection improvements. 

Feature 10. Monitor incidents and avescalate procedures in response to rMonitoring threat information should be gram manager’s job, and utility-, facilityand information should be shared with thgrams. As part of their planning efforts, uassess threat information and procedures of increased threat levels. Utilities should dures in place immediately so that adjustlaw enforcement and FBI is critical.Utilities should investigate what networks and information sources might be available to them locally, and at the state and regional level (e.g. fusion centers). If a utility cannot gain access to some information networks, attempts should be made to align with those who can and will provide effective information to the utility on a timely basis. Utility-speci

fi c efforts might include:

 Develop standard operating procedu

in a timely way and establish inciden

 In the speci

fi c context of intenti

can distinguish between normal site) and know how to notify ma

 Develop systems to access threat inf

determine the speci

fi c responses to t

 Investigate available informatio

regional level (e.g., FBI Infragu

 Where barriers to accessing info

align with those who can, and wto the utility.

 Make monitoring threat information 

program designee’s job and share thkey staff and those responsible for p

Feature 10 Resources

Guarding Against Terrorist and Secufor Drinking Water and Wastewater U
14

Feature 9. Develop and implement strategies for regular, ongoing communication about protective programs with employees, customers, and the general public to increase overall awareness and preparedness for response to an incident.Effective communication considers key messages; who is best equipped/trusted to deliver the key messages; the need for message consistency, particularly during an emergency; and the best mechanisms for delivering messages and for receiving information and feedback from key partners. The key audiences to consider are utility employees, response organizations, and customers.Utility specifi c efforts might include:

 Establish public communications protocols, including prepared public 

announcement templates. 

 Public communication strategies should: 

 Identify means to reach customers and the general public with 

incident information; 

 Provide a mechanism for customers and the public to communicate 

with appropriate personnel about unusual or suspicious events;

 Inform customers about appropriate actions to enhance their 

preparedness for potential incidents that may impact services (e.g., reverse 911); and 

 Internal communication strategies should:

 Increase employee awareness of your protective program; Motivate staff to support your protective program; Provide ways for staff to notify appropriate personnel about unusual or suspicious activities;  Inform employees about the nature of, and restrictions on, access 

to security sensitive information and/or facilities; and

 Ensure employee safety during an event or incident and enable 

effective employee participation during response and recovery efforts. 

 Evaluate effectiveness of communication mechanisms over time. 

Feature 9 Resources

Security Risk Communication Training, www.epa.gov/safewater/dwa/course-genint.htmlEffective Risk and Crisis Communication during Water Security Emergencies, www.epa.gov/ordnhsrc/pubs/600r07027.pdfEmergency Communications with your Local Government and Community | WERF Project 03-CTS-5SCO, www.werf.org

 Identify employees responsible for i

ties and establish expectations in job mance reviews.

 Designate a single manager (even if 

sible for protective programs. Establensure protection is given managemfor line supervisors and staff. 

 Keep current on improvements and g

by other utilities.

 Monitor incidents and available thre

cedures in response to relevant threa

Feature 1 Resources

Seattle/King County Case Study, USChicagoland Case Study, USEPAWater Security Training Courses, MeUSEPA, cfpub.epa.gov/safewater/wa

Feature 2. Annually identify protectivsources needed, support priorities wiand self-assess using these measureprogram progress. Dedicated resources are important to ensprograms. Investment should be reasonab

circumstances. In some circumstances, increasing the amount of time and attention to protective programs. Where threat potgreater, increased fi nancial investment is This feature establishes the expectation tannual capital, operations and maintenanidentify and set aside resources consisten

protective program needs. Priorities shoureviewed with utility executives at least oing process.This feature also encourages utilities to usure progress and to adjust their protectivdata. Metrics should measure progress in personnel and process changes. Utilities specifi c metrics relevant to their specifi c 
4

point, utilities can consider metrics that were developed at the national level, provided as examples in this brochure.Utility specifi c efforts might include:

 Annually identify and dedicate resources to protective programs in 

capital, operations, and maintenance budgets; and/or staff resource plans.

 Tailor protective approaches and tactics to utility-specifi c circumstances and operating conditions; balance resource allocations and other 

organizational priorities. 

 Annually review protection commitments and improvement priorities 

with top executives, rate setters, and water boards/commissions.

 Develop measures appropriate to utility-specifi c circumstances and 

operating conditions. 

 Self-assess against performance measures to understand program progress and make necessary changes to improve effectiveness.

Feature 2 Resources

Grants and Funding, cfpub.epa.gov/safewater/watersecurity/fi nanceassist.cfmNational Metrics and Self Assessment Questions for Utilities, cfpub.epa.gov/safewater/watersecurity/measures.cfmVSATTM Asset Management Module | WERF Project 03-CTS-6S, www.werf.org

national public health, county health agesuch as hospitals.Utility specifi c efforts might include:

 Forging partnerships in advance of a

and key partners are better prepared should occur. 

 Join or help create a mutual aid and 

and Wastewater Agency Response N

 Network with partners to stay aware 

available protective program-related 

 Establish relationships with critical c

ing, etc.) to identify interdependency resiliency and continuity of business 

 Participate in joint exercises with ide

Feature 8 Resources

Security Information Collaboratives Gwww.epa.gov/nhsrc/pubs/brochureSWaterand Wastewater Agency Respwww.nationalwarn.orgMutual Aid and Assistance Resourcecfpub.epa.gov/safewater/watersecur
12

Feature 7 Resources

Emergency Response Tabletop Exercises for Drinking Water and Wastewater Systems, cfpub.epa.gov/safewater/watersecurity/trainingcd.cfmResponse Protocol Toolbox: Response Guidelines, www.epa.gov/safewater/watersecurity/pubs/rptb_response_guidelines.pdfEPA guidance documents on how to develop an ERP,cfpub.epa.gov/safewater/watersecurity/home.cfm?program_id=8National Incident Management System (NIMS), www.fema.gov/emergency/nims/2007 National Fire Protection Association (NFPA) 1600 standard on Standard on Management and Business Continuity Programs, www.nfpa.org/assets/fi les/PDF/NFPA1600.pdf

Feature 8. Forge reliable and collaborative partnerships with fi rst responders, managers of critical interdependent infrastructure, other utilities, and response organizations to maintain a resilient infrastructure.Effective partnerships build collaborative working relationships and clearly defi ne roles and responsibilities so that people can work together seamlessly if an emergency should occur. It is important for utilities within a region, and within neighboring regions, to collaborate and establish a mutual aid program with one another and with neighboring response organizations, as well as, with interdependent sectors, such as the power sector, on which utilities rely or which they impact. Mutual aid agreements provide for help from other organizations that is prearranged and can be accessed quickly and effi ciently in the event of an emergency. Developing reliable and collaborative partnerships involves reaching out to managers and key staff in other organizations to build reciprocal understanding and to share information about the utility’s concerns and planning. Such efforts will maximize the effi ciency and effectiveness of a mutual aid 

program during an emergency response effort, as the organizations will be familiar with each others’ circumstances and therefore, will be better able to serve each other. Utilities and public health organizations should also establish formal agreements on coordination to ensure the regular exchange of information between utilities and public health organizations, and outline roles and responsibilities during response to, and recovery from, an emergency. Coordination is important at all levels of the public health community—

Feature 3. Employ protocols for deterecognizing limitations in current contand public health surveillance methoUntil progress can be made in developmonline contaminant monitoring and survemust use more traditional approaches, susidual. Water quality monitoring, samplinmonitoring, consumer complaint surveillsurveillance are different, but related, elewarning system. Water quality monitoring include monitocal contamination surrogates, pressure chchlorine residual, temperature, dissolved utilities already measure these parameteroperations and confi rm water quality. Moeters may also create operational benefi ts 

protective programs, such as reducing opUtilities also should thoughtfully monitoprove connections with local public healanomalies (“public health syndromic surand public health anomalies are importannation problems and other water quality Utility specifi c efforts might include:

 Establish sampling and testing proto

events) and understand availability o
6

cialized laboratory capabilities that can handle both typical and atypical contaminants.

 Track, characterize, and consider customer complaints to identify potential contamination events.  Use security monitoring methods (e.g., intrusion detection devices such 

as alarms or closed circuit television) to aid in determining whether a suspected contamination event is the result of an intentional act (Also see Feature 5). 

 Establish working relationship with local, state, and public health 

communities to detect public health anomalies and evaluate them for contamination implications.

Feature 3 Resources

The State of the Science in Monitoring Drinking Water Quality, www.epa.gov/ordnhsrc/pubs/reportEWS120105.pdfWater Security Initiative, cfpub.epa.gov/safewater/watersecurity/initiative.cfmGuidelines for Designing an Online Contaminant Monitoring System, www.asce.org/wise

Feature 4. Assess risks and periodically review (and update) vulnerability assessments to refl ect changes in potential threats, vulnerabilities, and consequences.

Utilities should maintain their understanding and assessment of vulnerabilities as a “living document,” and continually adjust their protective program enhancement and maintenance priorities. Utilities should consider their individual circumstances and establish and implement a schedule for review of their vulnerabilities.

Steps for reviewing vulnerability assessments 

The emergency response and recovery pland updated as needed. Utilities should tresponse and recovery plans regularly.Utility specifi c efforts might include:

 Understand the NIMS guidelines est

munity and state response plans and dures); and incident command systemresponse and recovery planning shou

 Coordinate emergency plans with co

partners: 

 Establish interoperable commun

to maintain contact with police, 

ties. 

 Establish internal protocols to m

ployees to ensure safety and to c

 Implement backup plans and strateg

water supply and treatment (to mitigronmental, and economic consequenkey components.

 Know how to run your system manu Maintain plans that are exercised at 

stances that prompt implementation, sible for implementation. 

 Provide employees with approp

training and education opportun

 At least annually, review plans a

a range of threats relevant to the 

 Update plans, as necessary, to in

exercises, and incident response

 Ensure plans identify critical and tim

records, processes, and functions thapersonnel and procedures necessary At a minimum, plans should include dress need for power, communicatiosupport, facilities, information techntion-related functions, including necaccess to backup systems and cash r
10

 Design and construction speci

fi cations should address both physical 

hardening of sensitive infrastructure and adoption of inherently lower risk technologies and approaches where feasible.

 Design choices should consider ability to rapidly recover and continue 

services following an incident. 

Feature 6 Resources

EPA Security Product Guides, epa.gov/watersecurity/guideVSATTM Asset Management Module | WERF Project 03-CTS-6S, www.werf.orgPhysical Security Guidance for Drinking Water and Wastewater Utilities, www.asce.org/wise

Feature 7. Prepare emergency response, recovery, and business continuity plan(s); test and review plan(s) regularly update plan(s) as necessary to ensure NIMS compliance and to refl ect changes in potential threats, vulnerabilities, consequences, physical infrastructure, utility operations, critical interdependencies, and response protocols in partner organizations. Utilities should maintain response and recovery plans as “living documents.” In incorporating protective program considerations into their emergency response and recovery plans, utilities also should be aware of the National Incident Management System (NIMS) guidelines, established by the Federal Emergency Management Agency (FEMA) within the Department of Homeland Security (DHS), and of regional and local incident management commands and systems, which tend to 

fl ow from the national 

guidelines. Adoption of NIMS is required to qualify for protective program funds dispersed through EPA, FEMA and DHS.Utilities should consider their individual circumstances and implement a schedule for review of emergency response and recovery plans. Utility plans should be thoroughly coordinated with emergency response and recovery planning in the larger community. 

Utility speci

fi c efforts might include:

 Maintain current understanding and 

ties, and consequences. 

 Adjust continually to respond to cha

consequences.

 Establish and implement a schedule 

ties, consequences, and their impact at least every three to 

fi ve years to a

expansion/upgrades and community 

 Reassess threats, vulnerabilities, and 

incorporate lessons into protective p

 Ensure individuals who are knowled

duct the reviews. Include an executivan ongoing conduit of information to

 Use a methodology that best suits ut

operating conditions; however, ensucriteria outlined in the National Infra

Feature 4 Resources

EPA Vulnerability Assessment Tools, cfpub.epa.gov/safewater/watersecurVSATTM Asset Management Module www.werf.org

Feature 5. Establish physical and process only to authorized individuals ancal and cyber intrusions.Physical access controls include fencing doors, and installing barriers at site accesintrusion can include maintaining well-limotion detectors, and utilizing intrusion regular employee rounds, and arrangemepartments can support identifying unusuaties.Procedural access controls include invencodes regularly, and requiring security paareas. In addition, utilities should establiemployees, including contractors and temaccess to facilities.
8

Protecting cyber systems involves using physical hardening and procedural steps to limit the number of individuals with authorized access and prevent access by unauthorized individuals. Examples of physical steps to harden Supervisory Control and Data Aquisition (SCADA) and IT networks include installing and maintaining fi re walls, and screening the network for 

viruses. Examples of procedural steps include restricting remote access to data networks and safeguarding critical data through backups and storage in safe places.Utility specifi c efforts might include:

 Identify and protect critical facilities, operations, components, and 

cyber systems (such as SCADA). 

 Develop and implement physical and cyber intrusion detection and 

access control tactics that enable timely and effective detection and response.

 Utilize both physical and procedural means to restrict access to sensitive facilities, operations, and components including treatment facilities 

and supply/distribution/collection networks.

 Defi ne, identify, and restrict access to security-sensitive information 

(both electronic and hard copy) on utility operations and technical details. 

 Establish means to readily identify all employees (e.g., ID badges).  Verify identity of all employees, contractors and temporary workers 

with access to facilities through background checks, as appropriate, per local/state law and/or labor contract and other agreements. 

 Test physical and procedural access controls to ensure performance. 

Feature 5 Resources

EPA Security Product Guides,epa.gov/watersecurity/guideProtecting Water System Security Inwww.epa.gov/safewater/watersecuriPhysical Security Guidance for Drinkwww.asce.org/wiseControl System Self Assessment Too03-CTS-3SCO, www.werf.org

Feature 6. Incorporate protective procurement, repair, maintenance, and rstructure decisions. Prevention is a key aspect of enhancing protective programs. Consideration of protective issues should begin as early as possible in facility construction (i.e., it should be a factor in facility plans and designs). However, to incorporate protective considerations into design choices, utilities need information about the types of protective design approaches and equipment that are available and the performance of these designs and equipment. For example, utilities should evaluate not just the way a particular design might contriblook at how that design would affect the operations and worker safety. Numerous information for designers and owners/opapproaches and upgrades that improve prUtility specifi c efforts might include:

 Raise protective program considerat

and budgeting processes to mitigate sequences and improve resiliency ov