This presentation will provide an overview of Risk and Resilience Assessments performed by community water systems in the United States since 2020, in response to a new regulatory requirement. Ahmet and Jim have completed 50 such assessments in 12 states and will share their experience on the requirements, assessment methodology and tools used, common findings and recommendations, and lessons learned from the process.  

In October 2018, the America’s Water Infrastructure Act of 2018 (AWIA) introduced several amendments to the Safe Drinking Water Act, strengthening resilience requirements for community water systems. As a result, systems serving more than 3,300 people must complete a Risk and Resilience Assessment (RRA) and develop or update an Emergency Response Plan (ERP), incorporating findings and recommendations from the RRA.

Although not specifically required by the regulatory body, USEPA, the AWWA’s J100 methodology has been commonly used for risk and resilience assessments. The J100-21 standard titled ‘Risk and Resilience Management of Water and Wastewater Systems’ provides a framework to prepare the required risk and resilience assessments, including consideration of actions that reduce risk or enhance resilience.

The requirement applies to approximately 9,800 water systems in the US. Since early 2020, the regulation has spurred a closer look by water utilities at their vulnerabilities against natural hazards and human-caused threats, especially in the area of cybersecurity of operational technology (OT) systems, and utilization of modern assessment tools such as the EPA Water Cybersecurity Assessment Tool (WCAT), the AWWA Water Sector Cybersecurity Risk Management Tool, and the NIST Cybersecurity Framework. This presentation will discuss cybersecurity including common recommendations, the co-dependence of cybersecurity and physical security, and a look at other critical infrastructure sector requirements as source of new inspiration regarding solutions. We’ll also discuss developing needs for cybersecurity with topics such as artificial intelligence and post-quantum cryptography.

This is a virtual webinar. Links will be sent to registered attendees prior to the event.