Improving Security through Capacity 

Development: Capacity Self-Assessments

Overview

Security is important for drinking water systems of all sizes. While the mission of public water systems has 

always been to deliver a dependable and safe supply of water, the challenges inherent in achieving that mission 

have expanded to include an increased emphasis on security and emergency response planning. State drinking 

water primacy agencies, along with other state agencies and organizations, are working to support this “all 

hazards” approach and enhance the security and emergency response capabilities of public drinking water 

supplies by:

• providing training and technical assistance; 

• integrating security and emergency response into other drinking water program areas;

• increasing communication among inter-state and intra-state agencies, and 

• improving measures to protect the public from bioterrorism, man-made threats, and natural disasters. 

Integration is one important way state primacy agencies can help to incorporate security into their capacity 

development strategies. For example, capacity self-assessment forms used by many states help small systems 

analyze their technical, managerial, and financial (TMF) capabilities. Adding security and emergency responserelated questions to these forms will help systems consider elements of basic security and enable them to 

explore options that improve performance and enhance security. 

This brochure focuses on the needs of drinking water systems serving 3,300 or fewer persons and illustrates 

how states can use existing tools—such as capacity self-assessments—to help systems address security 

concerns. It also explains why states should encourage systems to assess their vulnerabilities and plan for 

emergencies. 

How Does a Security “All Hazards” Approach Help Capacity Development? 

A well managed, financially sound, and technically proficient water system is better prepared and positioned to 

respond to any type of emergency. Any system that has: identified and assessed its physical, human, and cyber 

vulnerabilities; taken positive steps to reduce its risk to manmade and naturally occurring events; devised a 

strategy to cover improvement costs; and shared strategic decision points with its customers is an excellent 

example of a system that demonstrates TMF capacity.

Assessing vulnerabilities and planning for emergencies are important actions for all systems to take because 

vulnerability assessments help identify and assess the risks posed by both potential attacks and natural disasters. 

They also can help systems plan to reduce risks and respond to emergencies. Some small water systems may 

already have emergency response plans (ERPs) that address such issues as the handling and use of chlorine or 

loss of power. However, most small system ERPs do not address the potential for intentional attacks or the 

consequences of pandemic influenza, so states should consider helping systems design or revise their ERPs to 

address these possibly disastrous situations. Each of these activities also support one or more elements of TMF 

capacity.




Destruction in the wake of Hurricane Katrina

States can use their 

capacity development 

programs to help small 

systems identify and 

implement new security 

measures and strengthen 

existing ones.

How Can State Capacity Development Programs Help Small Systems Improve Security?

Achieving Integration: Bringing Security and Capacity Development to Small Systems

State capacity development programs help drinking water systems acquire and maintain the TMF capabilities 

needed to consistently achieve the Safe Drinking Water Act’s (SDWA’s) public health objectives.The fundamental 

goal of capacity development assistance and oversight is to improve a system’s ability to provide a safe and 

reliable supply of drinking water. Ensuring that a water system has adequate security is an integral part of 

reaching that goal.

States can use their capacity development programs to help 

small systems better position themselves to prepare for, detect, 

deter, respond, and recover from any incident – whether manmade, ranging from vandalism to intentional contamination, or 

natural disasters such as hurricanes, tornadoes, or earthquakes. 

Combining these efforts will enable systems to continue to 

improve TMF capacity while also protecting against threats and 

being better positioned to recover from an event. The capacity 

self-assessments that many states use are excellent tools to 

incorporate security and emergency response activities. Adding 

security-related questions to an existing self-assessment can:

• Help systems consider security and ERP strengths 

and weaknesses;

• Help states and systems coordinate planning and 

response capabilities to further protect public 

health; 

• Help states target technical assistance, training and 

funding opportunities for security enhancements. 

Assessing the vulnerability of a water system can be integrated into systems’ efforts to achieve and maintain TMF 

capacity. Coordinating these efforts will enable systems to improve performance and be better prepared for any 

emergency. The following questions are intended primarily for use with existing capacity self-assessment forms; 

however, the questions can be incorporated into capacity development efforts in other ways to meet the needs 

of individual states. 


Capacity Development and Security Assessment Questions

Technical Capacity

The following questions relate to the technical capabilities of a water system. Ensuring the security of a system’s 

infrastructure, equipment, and water source, and planning for continued operation in the event of an attack or 

natural disaster are important components of TECHNICAL CAPACITY.

1. Does the system have a plan to protect its facilities? Security procedures, including limiting access to 

sensitive sites such as treatment facilities and areas where data (electronic or hard copy) are stored, will help 

protect system facilities. Developing procedures to protect the system (including its physical infrastructure and 

computer and Supervisory Control and Data Acquisition [SCADA] systems) will help reduce the threat posed by 

disgruntled personnel or others. Password control should be a priority.

2. Does the system have basic physical security components, such as door locks and fencing? An effective way to improve technical capacity and protect a public water system against vandalism and other acts of 

destruction is to lock all facilities (e.g., buildings, storage hatches, and access gates) and fenced in infrastructure 

components such as well heads, storage tanks, equipment, and water treatment plants (especially areas where 

chemicals are stored or used). Roads to treatment plants, storage tanks, and other facilities should be properly 

gated, locked, and routinely inspected.

3. Does the system have a policies and procedures manual, and does the manual include securityrelated information? Having a policies and procedures manual will help to ensure that system personnel have 

a plan of action and are equipped to handle emergencies when they arise. An ERP can establish a clear chain of 

command in the event of any security or disaster-related event. It should specify which staff members are responsible for alerting the police, securing facilities, and contacting customers.

Fencing provides security for an impoundment.


Capacity Development and Security Assessment Questions

4. Is there security-related training available to the operator? As 

part of a state’s operator certification or other educational programs, 

operators should be encouraged to participate in security-related training. 

Such training can inform operators about the types of emergencies that may 

occur, the appropriate response procedures, and new tools and security-related information that are available. 

5. Are critical facilities and components inspected as part of the 

operator’s daily routine? Increased frequency of inspections of water 

system components and infrastructure will increase the opportunities to 

identify and address signs of tampering, vandalism, or potential disruption. It may also help identify a time frame when the incident could have 

occurred which will assist in determining the type and level of response 

needed.

6. Does the operator(s) know the location of existing hydrants and 

valves? The operator should routinely exercise valves and make sure there 

are enough valves, in the proper locations, to isolate any contaminated 

parts of the system. Hydrants should be flushed on a regular schedule and 

locked when not in use.

7. Have abandoned wells and intakes been properly removed from 

service? Abandoned wells should be filled completely with grout to prevent accidental or intentional contamination of an aquifer that provides 

drinking water. Such wells and abandoned surface water intakes should all 

be physically disconnected from the system.

8. Are chemicals used for treatment properly stored? Flammable or 

explosive chemicals should be stored in locked areas with proper safety 

equipment. Upon delivery, the operator should review the chain of custody 

sheet or bill of lading, stock numbers to verify chemicals are certified for 

potable water, and material safety data sheets. 

9. Does the water system track chemical usage? The operator should 

make sure that records of water and chemical use are kept and routinely 

updated. A sudden increase in chemical or water use may signal potential 

contamination or tampering with chemical supplies.

10. Is the entire staff properly trained in the location and use of 

safety equipment? Staff should know where the safety equipment is and 

how to use it with confidence during an emergency. Routine safety drills will 

help improve familiarity with safety equipment and operation. Safety equipment should be checked routinely to ensure proper performance.

11. Does the system have a backflow prevention or cross-connection control program in place? Unprotected cross-connections can result in serious chemical or microbiological contamination. Cross-connections 

should be protected in order to prevent backflow, which can be hard to detect. In any distribution system, potential cross-connections, and therefore sources of contamination can be numerous, varied, and unpredictable. 

Having these programs in place can help avoid the costs of responding to a contamination incident.

A sign warns against tampering 

with this hydrant

Public access to storage facilities 

should be restricted


Capacity Development and Security Assessment Questions

Managerial Capacity

Ensuring that procedures are in place to handle a breach of security or a natural disaster is an extension of managerial capacity. The questions below will help systems identify communication gaps and vulnerabilities, as well as 

the security procedures necessary to ensure adequate MANAGERIAL CAPACITY.

1. Has the system taken measures to improve security? To be prepared for a natural disaster or manmade emergency, a system may need to improve existing infrastructure and security-related measures. States 

can encourage small systems to take a variety of measures, including preparing a vulnerability assessment, an ERP, 

or both, to assess their security strengths and weaknesses.

2. Are written procedures for operating the system in place and updated regularly? Written procedures are important for consistent operation and are particularly useful for helping new staff members understand the system. Written procedures are important for facilities operated by SCADA systems so that if the 

SCADA network fails, the water system can be operated manually. Written procedures—plus training—will 

facilitate continued operation of the system before, during, and after an emergency occurs. 

3. Does the system have procedures for handling new and former employees (e.g., collecting keys, 

changing locks and computer passwords)? New personnel and disgruntled or terminated employees may 

present a potential security risk. Limiting access to secure areas using photo identification and developing procedures to protect system components (including physical infrastructure, computer, and 

SCADA systems) will help to reduce potential threats to the system. Systems should 

practice proper hiring procedures and should conduct background checks on all employees. 

4. How does the system receive information about state security programs?

A water system’s knowledge of good security plans and procedures is an indicator of 

managerial capacity. A system that understands SDWA requirements and state-specific 

protocols, knows how to comply with them, and has the capability (e.g., equipment and expertise) to comply will 

also be better prepared to protect public health during an attack, incident, or emergency situation.

5. Does the system communicate regularly with state and local officials, including law enforcement, 

on security matters? Using established communication channels with state agencies and local law enforcement, water systems can improve their security risk management by increasing their awareness of new developments and tools. These channels can also provide state and local officials with up-to-date system contact 

information. One of the most advantageous means of achieving this communication is through participation in a 

mutual aid network.

6. Has the system established a good working relationship with local emergency response and local 

health agencies? Coordinating with local emergency response agencies provides water system personnel with 

information about potential threats. Coordinating with local health officials provides opportunities for information exchange to meeting common public health protection goals. These relationships will enable the system to 

identify other state and local officials who should be notified about breaches of security, natural disasters, and 

other health crises. 


7. Is the system routinely patrolled by local law enforcement, and do the local law enforcement personnel know whom to call at the system in an emergency? Because they are often the first to respond in 

an emergency, local law enforcement should be familiar with public water system facilities. Providing local law 

enforcement with a list of public water system contacts (including home and cellular telephone numbers) and 

their responsibilities will help ensure that facilities and customers are safeguarded in the event of an emergency. 

Systems should be encouraged to invite local law enforcement to tour their facilities and should provide information about important system components, including their locations.

8. Does the operator know whom to contact in the event of an emergency, and does the system 

maintain a written list of contacts? Water system operators should know whom to call in case of natural 

disaster and in response to criminal threats and security breaches. The water system should create and maintain 

a list of contacts that is updated periodically for this purpose. The method of notification and the appropriate 

contact person will depend on the type of threat. 

9. Has the system developed a communication plan to alert customers to a natural or intentional 

threat to public health? A clear communication plan ensures that the public is alerted when a natural disaster 

or criminal attack leads to changes in the water supply. Management must be able to notify and provide instructions to the public quickly and efficiently before, during, and after an emergency occurs.

10. Does the system work with citizens to promote security awareness? Communication between system personnel and customers is an important indicator of managerial capacity. Systems can educate and empower consumers so they can effectively and inexpensively act as security agents to protect system facilities, similar 

to neighborhood watch programs.

11. Has the system conducted or participated in 

tabletop or other practice scenarios for water 

security or taken advantage of available security 

training on topics such as Incident Command System (ICS)? Operators are a small system’s first line 

of defense. It is critical that they have the knowledge 

and understanding to respond appropriately in time 

of crisis. Tabletop exercises, held in coordination with 

first responders, emergency management personnel, 

and law enforcement, can help ensure that any necessary response is appropriate, timely, and well coordinated. Small systems should also be aware of recent 

Federal requirements for compliance with the National 

Incident Management System-Incident Command System as a condition of eligibility for Federal funding.

Capacity Development and Security Assessment Questions

Tabletop exercises are useful for planning coordinated responses to security threats


Having sufficient resources, or access to adequate financial capital, is important when addressing security-related 

matters. Systems need to be prepared financially to deal with emergencies to ensure continued service, protection of public health, and economic stability of the community. The following questions will help determine if a 

system’s current financial situation and planning efforts will ensure adequate FINANCIAL CAPACITY to address security-related matters.

1. Do the rates cover the costs of security planning and response needs, and are the rates reviewed 

at least annually? Annual reviews of water rates should be a part of a system’s financial planning. These reviews help ensure that water rates continue to cover all costs. Anticipating costs early will help the system prepare for necessary improvements and will allow the impacts on system revenues to be spread out over time.

2. Does the system’s budget include resources for assessing vulnerabilities and planning for emergencies? A budget that allows a system to assess vulnerabilities and properly prepare for emergencies will ensure 

that the water it delivers is safe and consumers are not at risk.

3. Does the system’s budget include resources for staff training in 

security matters? Having capable staff on hand in an emergency is the 

first line of defense for a water system. A budget that ensures the system 

has the appropriate staff to handle emergencies is an important part of 

water system financial capacity. Funding for training in security matters 

will prepare system operators and other personnel to deal effectively 

with emergencies.

4. Does the system produce and use a capital improvement plan 

that includes security upgrades and components? A capital improvement plan is an important part of a system’s long-term financial 

future. Security improvements that a system plans to make during the 

next 5-7 years should be accounted for in its capital improvement plan.

5. Does the system have reserve funds available in the event of 

an emergency? In an emergency, a water system may need quick access to capital. An emergency reserve 

fund will help prepare the system to meet the financial obligations that may arise (e.g., pumps, chemicals, renting 

equipment, supplemental staff)

6. Does the system’s budget include funds to communicate with the public to promote security 

awareness? Allocating funds to develop communication materials that promote security awareness will ensure 

that consumers understand potential security threats, know how to help in case of an emergency, and understand the system’s ongoing efforts to improve security. Some systems promote security awareness through 

neighborhood watch programs and other community efforts.

7. Does the system’s budget include funds to develop and implement a communications plan to alert 

customers in an emergency? An emergency may affect a system’s ability to provide safe drinking water to the 

public. Preparing and implementing a communications plan will ensure that staff know how to provide information to the public and partners in an emergency.

Financial Capacity

Capacity Development and Security Assessment Questions


Communication is a key to system security. To help systems improve security, states should encourage them to 

develop and enhance a wide range of communication tools, such as:

Mutual Aid and Assistance Networks

• A mutual aid and assistance agreement is the foundation of the utilities helping utilities concept and 

it outlines the parameters for one utility to provide personnel, equipment, or other resources to 

another utility during an emergency. Throughout the nation, utilities are joining together to form Water/

Wastewater Agency Response Networks (WARNs)—intrastate mutual aid and assistance programs in 

which utilities within the state sign a common mutual aid and assistance agreement. 

Health Network (Pandemic Influenza + Local Health Officials)

• Using existing relationships between water systems and state and local officials ensures that system 

owners or operators are alerted to new security developments and tools for implementing security 

initiatives. It also ensures that the state has up-to-date contact information and knows about system 

security efforts and needs.

Communication: Building and Strengthening Partnerships

Capacity Development and Security Assessment Questions

Destruction in the wake of Hurricane Katrina


Water Security Channel (WaterSC)

• This free electronic newsletter helps water systems keep up-to-date with the latest news and events 

specific to water security. WaterSC sends out bulletins and advisories issued by USEPA and the 

Department of Homeland Security (DHS). The WaterSC also maintains a password-protected Internet 

library of federal advisories. 

Developing new networks. States should encourage water systems to work with community organizations, 

stakeholders, customers, local public safety groups, and public health departments to capitalize on the benefits of 

networking to improve security and response efforts. States should encourage systems to:

• Work with Local Emergency Planning Committees (LEPCs) to coordinate emergency response efforts. 

A typical LEPC is made up of representatives of the municipal government, fire department, hospitals, 

environmental organizations, and citizen groups; law enforcement and other emergency response 

officials; industry; and other interested parties. LEPCs are charged with developing accident prevention 

strategies and improving capabilities to respond to releases of hazardous chemicals. Water systems can 

coordinate with their LEPCs to learn about potential threats, identify emergency response procedures, 

and develop consumer notification protocols.

• Develop relationships with consumers and stakeholders by creating citizen watch groups. By increasing 

communication between consumers, stakeholders, and system personnel, these watch groups can be an 

effective and inexpensive way to improve water system security.

• Work with hospitals and local pharmacies to address patterns of illness that may be associated with 

contaminated drinking water. In many instances, the local medical community (e.g., hospital emergency 

rooms, clinics, and pharmacies) may be the first to discover a potentially widespread public health threat.

Maintaining contact information lists. These lists are important tools for systems to use when developing 

emergency response strategies. States should encourage systems to identify contacts (including names and phone 

numbers, as well as, where appropriate, home and cellular telephone numbers) for these organizations and place 

the information in the system’s O&M manual:

• Local public safety (police, fire, and county sheriff’s department)

• LEPCs

• Neighboring drinking water utilities

• State drinking water officials

• Local and state public heath departments

• Hazardous materials (Hazmat) response teams

• Critical customers, including hospitals, schools, and industries

• Power companies

• Newspapers/Media

• Critical suppliers (chemicals, equipment)

• WARN or mutual aid and assistance network
10

States also may want to encourage the use of many security-related documents, workbooks, and checklists that 

can help small water systems improve security. 

• U. S. Environmental Protection Agency (EPA) 

 . . . http://cfpub.epa.gov/safewater/watersecurity/index.cfm

• American Water Works Association (AWWA), 

• Association of State Drinking Water Administrators (ASDWA), 

• National Rural Water Association (NRWA), 

• Rural Community Assistance Program (RCAP) 

• National Environmental Services Center (NESC)

Additional Information

Technical Capacity 

Infrastructure Adequacy - Source Water Protection - System Operations

• Water Security Research and Technical Support Action Plan 

. . . www.epa.gov/safewater/watersecurity/pubs/action_plan_final.pdf

• Emergency/Incident Planning . . . cfpub.epa.gov/safewater/watersecurity/home.cfm?program_id=8

• Interim Voluntary Security Guidance for Water Utilities (includes Tips for Small Systems)

. . . www.awwa.org/science/wise/report/cover.pdf

• EPA Security Product Guides . . . cfpub.epa.gov/safewater/watersecurity/guide/tableofcontents.cfm 

• EPA Emergency Response Plan for Small and Medium Systems 

 . . . www.epa.gov/safewater/watersecurity/pubs/small_medium_ERP_guidance040704.pdf

Managerial Capacity

Effective External Linkages - Ownership Accountability - Staffing and Organization

• Emergency Response Tabletop Exercises . . . www.epa.gov/safewater/watersecurity/tools/trainingcd/

• Top Ten List for Small Groundwater Suppliers 

. . . www.epa.gov/safewater/watersecurity/pubs/fs_security_smallsuppliers_top10.pdf

• AWWA WARN . . . www.awwa.org/Advocacy/govtaff/issues/Issue07_Water_Response_Networks.cfm

Financial Capacity

Credit Worthiness - Fiscal/Management Controls - Revenue Sufficiency

• EPA Water Security - Grants and Funding . . . cfpub.epa.gov/safewater/watersecurity/financeassist.cfm

• Drinking Water State Revolving Fund (DWSRF) . . . www.epa.gov/safewater/dwsrf/index.html

• NIMS/ICS Training . . . www.nimsonline.com/ics_training/index.htm

Selected TMF Capacity-Specific Information
11

Capacity Development and Security Assessment Questions

Full-size graphic is available online at http://www.epa.gov/ safewater/watersecurity/pubs/brochure_security_top10.pdf

 visit us on the web at:

 http://www.epa.gov/safewater/security/

t printed on 100% recycled paper, with a minimum of 50% post consumer waste, using vegetable based inks

Local water supplier phone #:

TOP TEN LIST

Water Supply Emergency Preparedness

and Security for Law Enforcement

Know the water systems in your jurisdiction

including the location and function of each water supply source and facility.

Conduct walk through familiarization exercises

regularly with water supply personnel. Discuss areas of system vulnerability.

Know the chemicals, at each facility. Be familiar with emergency

response procedures and routine chemical delivery procedures and schedules.

Meet water supply personnel face to face. Know official vehicles

and identification badge or card type.

Work with established community watch groups.

Be sure to include a feedback mechanism for future support.

Respond, investigate and report each and every incident

involving water supply facilities using the appropriate reporting form. Contact the water

supplier about any incident if they are not already present.

Participate in public notification strategies in context

with local emergency response plans. Know the clearly established communications

responsibilities.

Exercise vigilance during patrols for suspicious activity including those

of vehicle movement, fire hydrant incidents or any other unusual incidents near water

supply facilities.

Know the Homeland Security Advisory System

response steps for law enforcement personnel.

Water supply security...for the community and for

your safety! All law enforcement personnel must be cognizant that both

individual and collective efforts for increased water supply security will enhance

community and officer safety.

8

9

3

5

7

6

1

2

10

4

Balancing public health protection, evidence preservation,

public alerts, multi-agency coordination, and the safety of first

responders will be a difficult task. These are ten ideas to help

you achieve that balance:

EPA-901-H-03002

September 2003
12

Office of Water (4606M)

EPA 816-F-05-008

www.epa.gov/safewater

November 2007 Printed on Recycled Paper

Additional Resources

EPA Small Systems Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .www.epa.gov/safewater/smallsys.html

EPA Security Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .cfpub.epa.gov/safewater/watersecurity

EPA Drinking Water Academy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.epa.gov/safewater/dwa.html

EPA Homeland Security Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.epa.gov/ordnhsrc

EPA Emergency Preparedness . . . . . . . . . . . . . . . . . . .www.epa.gov/ebtpages/emeremergencypreparedness.html

EPA Lab Compendium . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.epa.gov/compendium

EPA Water Contaminant Information Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .www.epa.gov/wcit

Water Security Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .www.watersc.org

Center for Disease Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.bt.cdc.gov

Department of Homeland Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.dhs.gov

FEMA Emergency Management Institute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.training.fema.gov/IS/ceus.asp

FEMA National Incident Management System Integration Center . . www.fema.gov/emergency/nims/index.shtm

US National Response Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .www.nrt.org

Water Health Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.waterhealthconnection.org