Overview of the America’s Water Infrastructure Act of 2018 (AWIA)
Kevin Owens
Cyber and Physical Security for Industrial Control Systems (ICS) | Global Cybersecurity Network (30K+)
Why was this act created and signed into law?
Congress examined the condition of drinking water infrastructure as well as technical challenges that water utilities may have to ensure that water is delivered safely and reliably. Several events occurred that included source water contamination, water infrastructure damage from natural hazards, detection of elevated lead levels, the need to repair or replace aging drinking water infrastructure, and the concerns with cyber and physical security. America’s Water Infrastructure Act of 2018 (AWIA; P.L. 115-270) was enacted on October 23, 2018.
AWIA moved from the Post-9/11 concerns of the prior act, the Bioterrorism Preparedness and Response Act of 2002 (P.L. 177-188), to an “all-hazards approach.”
What is in this act?
Title I – Water Resources Development Act of 2018: Authorizes water resource development activities for the U.S. Army Corps of Engineers (USACE).
Title II – Drinking Water System Improvement: Amends the Safe Drinking Water Act (SDWA).
Title III – Energy: Addresses hydropower-related activities of the Federal Energy Regulatory Commission (FERC).
Title IV – Other Matters: Amends the U.S. Environmental Protection Agency (EPA)- administered water infrastructure programs, as well as Clean Water Act authorities.
If we examined Title II further, we would see it:
- Amended SWDA to help communities achieve SDWA compliance
- Revised the Drinking Water State Revolving Fund (DWSRF) program
- Reauthorized appropriations for the DWSRF program
- Increased emphasis on assisting disadvantaged communities
- Revised emergency notification and planning requirements
- Authorized the use of DWSRF funds for the assessment and protection of drinking water sources
- Authorized supplemental DWSRF appropriation for disaster assistance
It also authorized new grant programs to:
- Reduce lead contamination in school drinking water
- Improve drinking water infrastructure for specified Indian tribes
- Respond to contamination of small and disadvantaged communities’ drinking water sources
- Improve the sustainability and resilience of small and disadvantaged communities’ drinking water systems
Section 2018 – Source Water
This section amends the Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA: P.L. 99-499) to enhance awareness among community water systems operators of a:
- Hazardous substance or an extremely hazardous substance released into the drinking source water of the system
- Broader group of hazardous chemicals (EPCRA Tier II data) stored at facilities located near their water system to help facilitate emergency preparedness in the event of a release
Note: These are effective immediately.
Section 2013 – Community Water System Risk and Resilience
This section amends SDWA to address risk and resiliency of community water system serving a population of greater than 3,300 persons. Prior to AWIA, SDWA required water systems to perform a vulnerability assessment of terrorist or other intentional acts and update their emergency response plan.
Now a water utility must assess the risks to, and resilience of, its system considering the:
- Risk to the system from malevolent acts and natural hazards
- Resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system
- Monitoring practices of the system
- Financial infrastructure of the system
- Use, storage, or handling of various chemicals by the system
- Operation and maintenance of the system
This Risk and Resilience Assessment (RRA) may include an evaluation of capital and operational needs for risk and resilience management for the system.
Then within six months of the RRA, the Emergency Response Plan (ERP) must be updated to address the risk and resilience issues discovered in the RRA to “obviate or significantly lessen the impact” on the health, safety, and supply of drinking water. This would include:
- Strategies and resources to improve the resilience of the system, including cyber and physical security
- Plans and procedures that can be implemented in the case of an event
- Actions, procedures, and equipment to lessen the impact of an event
- Strategies that can be used to aid in the detection of events
Compliance Deadlines
* Both documents must be reviewed, updated, and recertified at least every five years.
Note: Wholesalers must use the population of all systems.
Useful Definitions
- Resilience = ability to handle effects of malevolent act or natural hazard without interruption or rapid return to normal operations
- Natural Hazard = natural event that threatens the system function (earthquake, tornado, flood, hurricane, wildfire, and hydrologic change)
- Monitoring Practices of the System = any systems to monitor operations (water quality, security surveillance systems, access control systems, cybersecurity systems, energy management systems, etc.)
- Financial Infrastructure = accounting and financial systems that might be vulnerable to cyber attacks (customer billing and payment systems)
In future articles, I will take a deeper dive into the different standards and how they can help with compliance:
- ANSI/AWWA J100-10, Risk Analysis and Management for Critical Asset Protection (RAMCAP?) Standard for Risk and Resilience Management for Water and Wastewater Systems
- ANSI/AWWA G430-14, Security Practices for Operation and Management
- ANSI/AWWA G440-17, Emergency Preparedness Practices
Then lastly, the recent AWWA Cybersecurity Guidance and Assessment Tool.