Risk and Resiliency Assessments for the Water Sector

Review, Assessment, Update, and Certify

It has been a busy few months here at Risk Resiliency, supporting water utilities as they prepare for the 2025/2026 submission of their America’s Water Infrastructure Act (AWIA) of 2018 five-year resubmissions. We work with utilities of various sizes, each with different treatment and distribution operations. However, we have noticed several consistent themes that we wanted to share with other utilities to help them better prepare for the recertification of their Risk and Resilience Assessments (RRA) and Emergency Response Plans (ERP).

Submission Timelines and Upcoming Deadlines

Here is where we stand with our current submission timelines and the upcoming deadlines for recertification:

The goal is to keep water supplies resilient and safe by assessing each system’s vulnerability to risks from natural and man-made threats with a goal to review, assess, and develop comprehensive plans that support efficient, timely, and effective response to those threats.

What should utilities be doing now?

If you are a utility serving more than 100,000 people, time is running out. You only have about 30 days to complete the reassessment and update prior to recertification. If this is you then contact Risk Resiliency today to discuss what you can do to get into compliance. We have a team of experts and engineers who can help.

Dig out your 2020 RRA report and, J100 or VSAT file download (please note EPA cannot reset passwords for VSAT). If you don’t have the password from the 2020/2021 VSAT assessment the whole assessment will need to be redone.

Review and assess the RRA and focus on the following:

• Are the assets prioritized in order of criticality? If there are new assets, where do they rank in the order of criticality?
• What recommendations from 2020 have been implemented and what recommendations are still in development (ensure you update deliverable dates).
• Are there any new threats that need to be considered in your assessment? What countermeasures are in place to mitigate those threats?
• Have any cybersecurity threats impacted systems in the last five years, or have new countermeasures been implemented to mitigate those threats?
• Have any new alternate power generation systems been deployed to mitigate the impacts of grid power outages?
• Is your standby generator list updated and accurate?
• Identify your certification deadlines and submit your updated compliance certification to EPA.

Even though the ERP submittal is due in six months’ time for the 2025/2026 certification, you should seriously consider doing the RRA and ERP reassessment and updates in unison together to ensure alignment with the two documents.

Review and assess the ERP and focus on the following:

• Review all contact information and update to reflect any changes, do not forget external stakeholders and governmental support agencies.
• Do you have any new threats? Do the existing threat specific response plans address these new threats? If you take an all-hazards approach to response, it is a good idea to ensure new threats are added to the risk register.
• Review all roles and identify any new positions that may have to be added. Does the current response organization meet the utility's needs?
• Are there any resource updates that need to be considered? New generators, HAZMAT response equipment, specialty vehicles, etc.

While you are reviewing and updating the RRA and ERP. It is a good idea to create a workgroup and discuss total system loss and recharge. Using the asset criticality list from the RRA, have operations describe why each asset is critical and how you would systemically bring these assets back online. Document the restoration priority (and why it is important), the steps needed for restoration, and identify the personnel who would be needed. This activity can help with identifying redundancy needs, cross training opportunities, and areas where there may be additional redundancy needed.

Don’t forget your cyber assessments on your SCADA and IT networks. Change happens quickly in the world of electronics, and it is critical to ensure that this component is not overlooked and any changes from 2020 are included in the RRA report and the ERP updates.

Risk Resiliency has water and wastewater experts and engineers across the United States that can help utilities with all of their resiliency needs. We are committed to supporting systems in working toward resilience.

• We can assist utilities to complete recertification of the 2025/2026 RRA and ERP.
• Our team has extensive experience developing Safety and Security Assessments, Business Impact Assessments, and implementing Organizational Resilience Programs for water and wastewater utilities.
• If you have not done your RRA or your ERP is incomplete, we can work with you to get you into compliance
• We can assist you with your Crisis Communications needs. We have developed comprehensive Crisis Communication programs for many water and wastewater utilities across the United States.

Please don’t hesitate to reach out because at Risk Resiliency, “Your resiliency is our reality.”