Appendix 1 VULNERABILITY ASSESSMENT CERTIFICATION ® PubUc Water System ID number: n t!J 5'7f9(!J3 i System Name: _1C.L.:;;.o..:.l'uo<.Jn'-"-....tJ'-I+---'Mt...:.:;J""'dc:../.....1.....,<-rrJ:.....L..
._______ City where system is 􀁬􀁯􀁣􀁡􀁴􀁥􀁤􀀺􀁟􀀮􀀮􀀡􀁁􀀧􀀭􀀡􀀮􀀺􀁢􀁉􀀮􀀧􀀢􀀧􀁤􀀬􀀧􀀭􀀧􀀡􀀮􀀱􀁌􀀷􀀮􀁊􀀮􀀱􀀮􀁲􀀯􀁙􀁊􀀧􀀭􀀧􀀭􀀧􀀭􀀷􀁟􀁰􀁾􀁡􀁾􀀮􀀼􀀮􀀾􀀻􀀨􀀧􀀭􀀧􀀧􀁩􀀧􀀭􀀧􀁦􀀮􀁌􀀮􀀭____I
State: htl5 Printed Name ofPersoll Authorized to Sign fIJ1 I. mn vJh this Certification Oil behalfofthe System: f /'(J:e //f IA r r r Title: 'lJ1f'ecfc,r of 8do/IL wur!zs Address: ---,&:...:;-=0.'-'�
�􀁬􀀡􀁴􀀳􀀽􀁥􀀺􀁊􀁘􀁾􀁟􀀹􀀮􀁌􀀮􀀮􀀺􀁏􀀺􀀺􀀮􀀮􀀺􀀮􀀮􀀻􀀱0==-----_______ City: flddl$ctY/State and ZIP Code: _..L'I..:::-€-=&:.::ql...,.L5__--'7'----='j:....:C9=--C9=-..I______ I certify
to the Administrator ofthe U.S. Environmental Protection Agency that this community water system has condu.cted a vulnerability assessment that complies with Section 1433(a)(I) of the
Sm Drinking Water Act, as amended by the Public Health Security and Bioterrorism Preparedness and Response Act of2002 (Public Law 107-188, Title lV-Drinking Water Security and Safety).
I further certify that this document and all attachments were prepared under my direction or supervision. I am aware that there are significant penalties for submitting fulse infunnation
(Sa:fu Drinking Water Act (42 U.S.C. 300£ et seq. )). The vulnerability assessment this community water system conducted addresses the fullowing components ofmy system (Check YES ifthe
CWS has the element in its system; cheCk NtA ifthe element is not applicable to the system.): YES NtA pipes and constructed conveyances 􀁾􀁾􀀠physical barriers Appendix 1 Certification
ofConduct ofa VA-Page 1 of2 
o water collection o pretreatment o lreatment storage 􀁾􀀠 disuibution :tacilities electronic, computer or otherautomated systems which are utilized by the public water system the use,
storage, or handling ofvarious chemicals the operation and maintenmee ofsuch system Other components in the CWS that were evaluated under this VA (list those applicable): ® Signed:.d;!f.
􀁾􀀠Primary contact person that EPA can call ifthere are questions about this Certification and VA submission: J /} Name: 1m Tlen:.e-Address (ifdifferent than that ofthe Authorized Representative):
_________ Alternate 􀁾􀁐􀁥􀁲􀁳􀁯􀁮􀀿􀀬􀀠Name: Je.r"--E!I-/L4.V1S Address (ifdifferen{tllan that ofthe Authorized Representative): _________ Appendixl Certification ofConduct ofa VA-Page
2 of2 
HARDENING TARGETSI ASSESSING YOUR VULNERABILITY Teleconference -August 6, 2002 Presented by the USEPA Region 61 Ttmlll Natural Resource Conservation Commission! Texas SeeIion of tbe
American Water Works Association lOa -2p Central TimeJ 9a -lp Mountain Time 1. UNDERSTANDING THE BIO TERRORISM ACTGreg Grover, USEPA Region 6 2. RISK OF BIOLOGICAL/CHEMICAL CONTAMINANTS
AND PHYSICAL RISKS -Anthony Bennett, TNRCC 3. UTILITY:vuLNERABILITY ASSESSMENTSWilliam Adams, CDM a. Understanding the Sandia Model and How it Applies to Medium and Small Systems b.
Performance Based Risk Assessment for Medium and Small Utilities i. The 8 Criteria of an Assessment c. What to Look for in Your Assessment":' Actual Onsite Assessment d. Round Table
Discussion 4. BREAK -CENTRAL TIME ZONE LUNCH -10 Minutes (Approximately 11:55 am Central Time) S. DEVELOPING CREDmILITYTHROUGH COMMUNICATIONS -Wendy Nero, CH2MHill 'a. How to Communicate
with Your Customers 6. BREAK -MOUNTAIN TIME ZONE LUNCH -10 Minutes (Approximately 11:20 am Mountain Time) 7. EMERGENCY RESPONSE PLANS -William Adams, CDM a. How to Prepare a Plan b.
How to Integrate Your Vulnerability Assessment c. Involving First Responders in Your Planning (more) 
8. WHAT HAPPENS IF YOU HAVE AN EVENT? a. The Emergency Response Process i. Just Who is in Charge? a. Simulated Onsite Emergency Response ii. Implementing Your Emergency Response Plan
b. Reporting Protocols 9. RISK COMMUNICATIONS -Wendy Nero, CH2MHill 10. QUESTIONS AND ANSWERS -Panel Discussion 11. OTHER CONSIDERATIONS 12. RESOURCES © 2002 by the Texas Seetlon A WWA
Contact us at: TAWWA P.O. Box 80150 Austin, Texas 78708 512-238-9292 512-238-0496 FAX mikhowe@aol.eom www.tawwa.org 
How to CALL or FAX the Teleconference With Your Question. WHY YOU SHOULD SEND YOUR QUESTION Your participation in today's teleconferenee is important beeause ifyou bave a question, then
most likely one or more oftbe bundreds ofyour colleagues in tbe water profession wbo are watching all over Texas, Oklaboma, Arkansas, Louisiana and New Mexieo wbo wants the answer to
the same question. Our experts cannot possibly think ofevery question, so we need your belp. WHAT TO DO CALLING IN A QUESTION You may call us toll free at 1-888-935-2010. 􀁙􀁯􀁵􀁾􀁥􀁡􀁕􀁷􀁩􀁬􀁬􀀠take
n by a screener wbo will take down your question and otber information and tben pass it on to tbe production team. FAXING IN A QUESTION FAXES can be sent toll free to 1-888-935-2012
Let your site manager know you want to FAX a question. Tbey will show you where the FAX at your site is located ifone is available. IN EITHER CASE, Write your question down as concisely
as possible make it easier for our sereener to copy down your question. QUESTIONS Wll..Wll..L BE ADDRESSED LATER IN THE PROGRAM. WE wn.L TRY TO COVER A MANY AS POSSmLE WITIDN TIME CONSTRAINTS.
YOU CAN WRITE YOUR QUESTION BELOW AND FAX THIS PAGE. NAME ______________ LOCATrON ___􀁾___ 
A\. A.n'II:lric.m Wi!t«r Worb Aucdatiwl New Requirements on Public Water Systems • Conduct a vulnerability assessment • Develop or revise an emergency response plan • Certify its completion
to EPA by a date certain • Send a copy to EPA by a date certain Vulnerability Assessments • Who is required? -Utilities serving mare than 3,300 persons • What is needed? On a one time
basis: • Certify to EPA that an assessment was conducted 'Submit awritten copy to EPA 'Assessments are to include specified items. 
Vulnerability Assessment Deadlines • Submit to EPA. by: .March 31,2003 if serving 100,000 or more people . • December 31, 2003 if serving 50,000 or more, but less than 100,000 people
.June 30, 2004 if serving more than 3,300, but less than 50,000 people. Emergency Response Plans • Who must prepare: Systems > 3,300 people • Certify 10 EPA that plan is complete. •
Main"'in copy of plan for flVS yaam. • Incorporate results 01 vulnerability assessments. • Include specified Items. • Coordinate with I.ocal Emergency Planning Commillees. New Requirements
on EPA • Baseline threat report • Develop protocols to protect VAs .• Provide guidance to water systems < 3,300 for conducting VAs 
New EPA Research and Development • Focus is on methods, means, and equipment to prevent, detect. and respond to: • con1amlnaliOn • supply disruption • Mandatory, but no deadune • Results
to be shared with water community !hrough!he Water Informallon Sharing and Analysis Center (ISAC) New EPA Authorities and PenaHies • If there is a threatened or potential terrorist attack
and the utility or the state aren't responding, EPA can step in • Significantly increases penalties for tampering with a water system New Resources • $160 million authorized for this
year, but not yet ollocated • Money for utilities to conduct VNr., do plans, and address security needs • $ 5 million of that for systems < 3,300 to conduct VNr. • $15 million extra
for EPA research activities 
Risk ofBiological and Chemical Contaminants Chemical Agents • Pulmonary Intoxicants • Blister Agents • Nerve Agents • "Blood" Agents Pulmonary Intoxicants • Inhalation Hazard • Common
Chemicals -Chlorine Gas -Ammonia 
Blister Agents • Topica! Eye, Skin, and Airway Damage • Military Veslcants -Muswd -Lewisite: • Other -Poison Ivy -Industrial Chemicals -ChcmothempeuJies Nerve Agents • Glandular Activity
and Loss ofMuscle Control (SLUD) • Military Agents -Tabun(GA) -Sarin (GB) -vx • Other -Carbamatcs -Orgaoophosph.1e 􀁾􀀠 Blood Agents ; Interferes with cell upllllre of oxygen • Common
Chemicals -Hydrogen Cyanide . -Cyanogeo Chloride Other Cyanides 
List of very toxic Chemicals .. amanitin (mushrooms) 􀁾􀀠fmsulfolhion • sa:xitmin (algae) • eari:K>furan .. sodium lluoroaoetate .. parathion • ""'"' (08) • ,tryclInine .. chloropmnol,
m-• aWiearb • dW<1hl< • _,.uo!\mm .. dicbloropropane,l,a.. .. TEPP .. benzyl aleoltol • aminopyridine. "" .. sulfolane .. cyanides .. telbufos .. hydrogen C)'2Ioide Biological Agents
.. Bacteria • Viruses • Protozoa Most Likely Biological Agents • NATO NBC Handbook Narrows the list to 31 • USAMRIID Criteria Narrow. the list to 6 based on -􀁁􀁾􀁉􀁡􀁢􀀾􀀱􀁩􀁴􀁹􀀠-Ea$eofPtoduction
-Lelhalily -Slability(DcUverabililyj -In_oy 
Most Likely Biological Agents • Anthrax • Smallpox • Plague • Tularemia • Botulism Toxin • Viral Hemorrhagic Fevers CDC Category A Bioterrorism Agents • Smallpox • Anthrax • Plague •
Botulism Toxin • Tularemia • Hemorrhagic Fevers Biological vs Chemical and other agents ofMass Destruction • Inexpensive I relatively easy tu produce • 1970 study cost tu produce SO"Al
casualties in a Isq/lon area -Conventional weapons 􀁾􀀠$2000 -Nuclear -$Soo -Chemical-$600 -Antlnax $1 
Components ofBioi Chemical Terrorism • Capability • Intent • Vulnerability What makes an effective Agent • Easy Method of Delivery • Physical/chemical properties make the delivery effective
• Lethality Drinking Water , • Delivery -Source -dt1ution effects the leIbality • treatm.ent remove.s or Inactivates the ugent -Stnrage Tanks • dilution • ineffective dispmion .. Inactivation
ofAgent (contact time) 
Drinking Water • Physical/Chemical Properties -Military biol.bonncal agents " air delivery .. persislenCO in eom:cIlilation dr:llvered by air 􀁾􀀠thee 􀁰􀁲􀁯􀁰􀁾make 1he a&cnt effective
more than th.t.thalliy -Physical treatment and disinfection effect many potentlal.gents Drinking Water • Lethality -Based on Dose 􀁾Water dilutes the dose Di.,infection inactivation
Source Vulnerability • AgentRisk 􀁾􀀠Massive Dilution -Pbysical Treatment -Chemical Treatment • Physical Disruption Risk -1 
Treatment Vulnerability • AgentRisk -Large Dilution -Phy1!icat Removal -Chemical Treatment • Physical Disruption Risk -High Distribution Vulnerability • Agent Risk -Lack ofdilution -Lack
ofphysico! remoVal -Insufficient contact time for inactivation • Physical Disruption Risk -limited except for large transmission lines Ilnd large pump stations Conclusion • Biological
Agents may be cheaply prodtwed (Anthrax) • Certain Commercially available pesticides have solubility and lethality to cause concern 
Conclusion, • Ineffcctive/missing barriers increase vulnerability -Weaker Disinfectants/oxidants -Nolpostphysical treatment • Dilution reduces lethality 
Vulnerability Assessment A systematic analysis used to determine the malevolent risks posed to the operations of water supply. treatment. and distribution systems! wastewater systems.
Vulnerability Assessment I. De_tion ofwater system objectives by: • Identifying the important missions/functions aftho system to 􀁢􀁥􀁾􀀮􀀠, Identifying the undesirable 􀁾􀁵􀁥􀁮􀁣􀁥􀁳that
oould affect the Il'li.$$lonslfiloction.s, • Determining the assets that need to be protected 10 minimize the impact$ ofthe undesirable , evel'll$k.OIl$equences, • Determining the malevolent
aets that could reasonably cause these eventsloonsequeru::as. Vulnerability Assessment 2. Prioritization ofadve... even1Slconsequ...es affecting lb. water s)'Stem and lb. sun:ounding
communiI)' including: ,. Loss ofcriJk:at function and/or major senrice dimlption. • [nlt::nii'onal al1ack on public safety via water Utility assets. contamina.tion of the water supply.
and ehemieal releases or chemical theft. 1 
Vulnerability Assessment 3. Definition of bow the malevolent aclS might be conducted, such as: • Pbyslcal damage. • CheJnieal. biological, and radiomgicalcontamination, • Cyber attacks
on tru: Supervisory Contml and Data Acquisition (SCADA) or otherprocess coruroI systems, • tnmdependency disruptions 􀀨􀁥􀀬􀁧􀀮􀁾􀀠􀁥􀁬􀁥􀁥􀁴􀁲􀁩􀁣􀁡􀁾􀀠transportation, 01(:.) Vulnerability
Assessment 4. Assessment ofthe likelihood (qualitative probability) ofsuch malevolent acts from defined threat sources (e.g. terrorist, insider, detennined vandal, casual vandal, etc.)
Vulnerability Assessment S. Systematic site clta.mcterization ofthe water system to include the collection of performance damon: • Important facilities. processes. and assets_ • Physical
protection system ft:abm:s of detemnee. detection, delay. and response, • Cyber protection sY'tcm. features.. • Seeuritypolicies and procedures and compliance wIth same 2 
Vulnerability Assessment 6. Tbeapproach to the VIA is "perfonnance-based," meaning that it evaluates the risk to the water system based on the effectiveness ofthe security system against
the specific malevolent acts detennined in the initial step. Vulnerability Assessment 7. The VIA determines the most critical assets (targets) in a water system, details their interrelationships
within other assets in the system, identifies the consequences ofmalevolent acts that could be directed against them, and evaluates the effectiveness ofboth existing and proposed protection
systems. Vulnerability Assessment 8.The VIA identifies a system's vulnerabilities and provides a prioritized plan for security upgrades, modifications ofoperational procedures, and/or
policy changes to mitigate identified risks to critical assets. The VIA also provides a basis for comparing the cost ofprotection against the 􀁲􀁩􀁾􀁫􀁳􀀠posed. 3 
Vulnerability Assessment The overall goal of the VIA is to develop recommendations that lead to a costeffective, balanced security protection system with regards to tbe malevolent acts
identified Goals of Security Measures • Detect -Alarms Systems • Delay -Locks, Gates, Fencing, & Signage • Respond -Law Enforcement -Water System Staff Vulnerability of Water Supply
, Areas Include: -RawWaterSource -Treatment Facilities -Connections to Water Distribution System Pipes -Pump Stations and Valves -Finished Water Tanks and Reservoirs 4 
Hardening of Wafer Supply • PerImeter Intrusion Detection 1ence MoUllt.cd Sys:tcmS DourSwiu:bt$ 􀁖􀁩􀁢􀁾􀀱􀀧􀁬orShoclc SenJors Video Motioo 􀁾􀀠 • AtteSs Control Systems (ACS) 􀁾􀁮􀁡􀁬Loc:!(JOd
Kq EletI.mni<: ACS • Closed Clrcult (CCTV) Syslem, Com",.. Real Time Monitoring • Water Quality Monitoring • System Performance Indicators: • Chlorine • Pressure • Tank Levels • Flow
Metets Training • Awareness Training -AWWA Risk Assessment I Vulnmbility Analysis -BPAIAWWAPJ' • Employ.. -Call Takers -Suspieious Activity Sensitivity -Bmergen:cy Response -SamplIDg
5 
EPA Region 6 Water Security1 July 2002 The Environmental Protection Agency (EPA), Region 6 office is located in Dallas, Texas and includes the states of Arkansas, Louisiana, New Mexico,
Oklahoma and Texas . . The regional drinking water and wastewater programs work with the State agencies in administering the federal drinking water and wastewater rules and regulations.
Security issues are a priority for EPA. In June 2002, the President signed PL 107-188, the Public Health, Security, and Bioterrorism Preparedness and Response Act that includes provisions
to help safeguard the nation's public drinking water and wastewater systems against terrorist and other intentional acts. On a national level, the EPA has been designated as the lead
for water and wastewater infrastructure security so Region 6 has a vested interest in preparing for an incident of catastrophic proportions. Such effects could potentially impact the
water and wastewater infrastructure and/or water quality within Region 6. The events of 9/11 have resulted in new legislation, funds and responsibility for EPA and other federal agencies.
EPA is working with numerous other federal and state agencies in these endeavors as well. The Region 6 office has formed a regional team to deal with drinking water and wastewater issues.
Drinking water and wastewater systems can contact the regional contacts directly for information on security issues; however, in the event of an emergency, remember to first contact
911, then the EPA Regional Emergency Response Center and the appropriate State drinking water and wastewater emergency response contact. Please refer to the following page for important
Regional contact information. EPA encourages drinking water and wastewater systems to take action to protect their assets from tampering. The handouts being provided are inexpensive
steps that can be taken to enhance security and protect our drinking water and wastewater systems. Handouts Security Awareness for Industrial and Municipal Facilities -oveNiewon steps
to take to protect your facility, your products and your community Pipe Hanger -top ten list for emergency preparedness and security for small groundwater suppliers General Security
Checklist -questions to consider for safa security practices at your facility Emergency Contact List -to summarize various contacts needed in an emergency Threat Identification Checklist
-to be used ifyour utility receives a threatening phone call WaterlWastewater System Incident Checklist-to be used to report an actual Incident Guidance for Water Utility, Response,
Recovery &Remediation Actions for Man-made and/or Technological Emergencies -guidance for responding to a catastrophic emergency Vulnerability Self-Assessment Guide -guidance Intended
for systems 3,300 or less and does not include most ofthe 8 essential elements necessary for adequate vulnerability assessment at larger systsms Prepared for EPA, Region 6 and TNRCC
Satellite Downlink, produced by TX A WWA, Augost 6, 2002 I 
In the event of an emergency, always first call 911. EPA Emergency Response Center. National (800 ) 424-8802 Region 6 (866) 372-7745 . _,"--".'" 􀁾􀀢􀀬􀀮􀀢.. -" 􀁾􀀭-""'.'.,' -, ." 􀀭􀁾􀀧􀀮􀀺􀀬􀀺􀀬􀀻
􀀮􀀺􀀺􀀭􀁾􀀮􀀻􀀻􀀺􀀭􀀮􀀭.. 􀁾􀀺􀀬􀀺􀀺􀀮􀀺􀀮􀀬􀀠Agency Phone Email ! Arkansas Department of Health Division of Engineering 501/661-2623 After Hours & Emergencies: 5011661-2136 􀁳􀁡􀁦􀁥􀁷􀁡􀁴􀁥􀁲􀁀􀁨􀁥
􀁡􀁬􀁴􀁨􀁾􀁡􀁲􀁫􀁡􀁮􀁳􀁡􀁳􀀮􀁣􀁯􀁭􀀠Louisiana Department of Health and Hospitals 24·hour Hotline: kirion@dhh.stateJa.y§ ; Safe Drinking Water Program IKaren S. Irion. P.E .• Administrator
! New Mexico Environment Department 800/256-4609 2251765·5046 24-hour Hotline: retta Ilrollhet(/i)nmenv.state.nm.us I ! Drinking Water Bureau ; 505/827-7536 5051827-1400 i Oklahoma Department
of Environmental Quality 24-hour Hotline: mike.harrell(/i)deg.state.ok.us Public Water Supply Section 800/522-0206 405/702-8100 Texas Commission on Environmental Quality 24-hpur Hotline:
MLannen@lnrcc.state.tx.us PUblic Drinking Waler Section 600/832-6224 512/239-4691 ! ; -continued on back page 
I􀁾􀁔AlES􀀨􀁷􀁡􀁳􀁴􀁥􀁬􀁬􀀧􀁬􀁾􀁾􀁥􀁲􀀩􀀱􀀠Agency Area of Expertise Phone Email Arkansas Department of 24-hour Holline: Emegency Management 8001322-4012 -Richard McDuffy Emergency Response
501/682-0716 mcduff@adj!g.state.ar.us -Richard Merritt Emergency Response 501/682-0713 merrlttlaladeo.stale.ar.us Louisiana Department of 24-hour Hotline: Environ mental QualHy 225/342-1234
-Jeff Meyers Emergency Response 2251765-2566 jeff m@deg.§tate.la.us -Chris Roberie Surveillance , 225/765-2953 c roberie@deo.state.la.us , New Mexico Environmental 24-hour Hotline: Division
5051827-9329 -Debbie Brinkerhoff Hazardous Waste 5051428-2528 Emergency Response Oklahoma Department of Environmental Quality 24-hour Hotline: -Lynne Moss Emergency Response 800/522-0206
-Larry Gales Emergency Response 405/702/8142 larrv.oales@deo.state.ok.us Texas Natural Resource Conservation Commission Environmental Response Hotline telephone -Tom Weber Emergency
Response -Buck Henderson Emergency Response EPA (Water QualityProtectiQn .DiYi$iori)··.... 24-hour Hotline: 800/832-8224 I 5121239-2507 , lweber@tnrcc.state.ix.us5121239-6928 ehenders@tnrcc.slate.ix.
us !5121239·0990 , Name Larry Wright Branch Chief Jim Brown Section Chief , Greg Grover Area of Expertise Source Water Protection Drinking Water Drinking Water Phone 2141665-7150 214/665-7155
2141665-2776 Email wrigbt.larr)l@eQa.gov brown,jamesr@e!!a.goY grover.greg@sl2a.gov I Dawn Ison Drinking Water 214/665-2162 IS(lD,gawn@eQa.gov Andy Waite Drinking Water 214/665-7332
' waite,andrew@el2a,gov Blake Atkins Drinking Water -Tribes 2141665-2297 atkins.blake@ef,!a.goY i Mike Tillman Debora Browning Cindy Wolf Wastewater Outreach/PubliC Involvement OutreachlPublic
Involvement I 214/665-7531 !214/665-8025 . 2141665-7291 i t!llman,Michael@ega.gov browning,debora@eQa,gov wolf.cvnttliap@epa,gov I 
Because of the tragic events on 9·11·01, homeland security is one ofthe nation's highest priorities. Each of us can playa role in safeguarding our country from terrorism. The putpOSe
ofthis document is to suggest what steps you may take to protect your facility, your products, and your community. EMERGENCY CONTACTS Local Law Enforcement: ____.________ Local Emergency
Planning Committee: ________􀁾__.____ State Police: ________ EPA National (24-hour) Response Center Hotline for Incidents: ______􀀮􀁟􀀮􀀭􀀮􀀮􀁑􀀸􀀡􀀬􀀡􀀡􀁏􀁏􀀡􀀡􀁬􀀱􀀴􀀺􀀡􀁬􀀲􀀢􀀧􀀴􀁴􀀺􀂷􀀸􀀲􀁊􀀸􀀸􀀰
􀁾􀀲􀁾__ EPA Region 6 (24-hour) Emergency Response Center: 8661372-7745 ___ REPORT SUSPICIOUS· ACTIVITIES TO LAW ENFORCEMENT AUTHORITIES If a breach of security or suspicious activity
does occur. timely cooperation with authorities is crucial. In addition to cooperation with your local police department, it is suggested that you expeditiously report any threats or
suspicious behavior to your local law enforcement office. You should provide the following information: • Description of individual and vehicle. including license plat number; • Any
break-Ins; • Missing chemicals, equipment or blank documentation forms (such as shipping papers). SUSPICIOUS ACTIVITIES Be alert if you observe someone engaging in any of the follOWing
activities, especially ifthe individual is a stranger to the area: • The individual, a non-regular customer. requests to purchage large amounts of chemical, pestiCide. product(s) etc.,
with cash; • The individual is lOitering on your premises or around toxic materials with no legitimate reason for being there; • The individual hesitates or hedges when asked for information
such as name. address. or photo identification; • The indiVidual provides personal identification that appears to have been aHered, or commeroial certification alteretions; • The individual
asks specific questions about toxicity of a chemical or operation of equipment; • You notice a person or persons loitering on or near the chemical storage area; • The individual ask
nervous, avoids eye contact and/or is uneasy. SECURITY SUGGESTIONS • Develop and Implement written security procedures to address potential risks and potential vulnerabilities; • Complete
employee background checks; • Assess overall physical security of the facility and identify potential threats. vulnerabilities. risks and countermeasures; • Develop written plan to ooordinate
with local law enforcement authorities; • Develop written plan to ooordinate with local fire department and to alert them ofthe chemicals that are on-site and their storage location;
• Establish proper authorization for employees who work in sensitive or restricted areas; • Check identification of employees and viSitors; • Review emergency shutdown procedures; •
Limit access to sensitive areas; • Ensure protection of network from intemet hacking; (oontinued...) 
• Umlt removal of hazardous materials or sensitive documents to authM%ed personnel onlYi • Obtain back·up power source(s); • Training for employees and contractors concerningsecurity
awarenesSI operation of emergency equipment, and procedures for emergency response; • Perform periodic unscheduled, undercover securityInspeclions and assessments; make adjustments as
necessary. SITE SECURITY FacUlty security needs may differ for every business, some of the fundamental security control points may include: • Establish perimeter protecllon which uses
fencas, trenches. natural barriers, turnstiles. and security lighting; • Change locks, passwords, etc•• following termination of an employee; • Implement access control measures, such
as signs,security doors and window locks. alarm systems, and 􀁣􀁡􀁲􀁤􀁾􀁢􀁡􀁳􀁥􀁤􀀠access control systems; • Protect and backup critical communications equipmentand uUlllles; . • Remove
securityMsensllive: information from facilityiniemet site; • Periodically analyze computer transaction histories to look far irregularities that mlghtlMlCa1e secunly breaches; • 6ack..up
data and en'tical material at an alternate location; • All hazardous materials and/or deliveries comIng into lhe facilmes should be accompanied by shipping papars and driver photo identification;
• Employee security personnel if necessary to ensure site security. EMERGENCY PREPAREDNESS • Routinely update emergency telephone numbers and post in a prominent location; • Develop
wrltlen communications ptan to coordinate with employees and local hospitals; • Test sirens or other atann systems on a regular basis; • Practice emergency evacuation procedures; • Provide
training to emergency coordinators; • Ensure that firstMaid supplies are on-hand. inventoried. and fully stocked for the number ofemployees at the facility, ADDITIONAL RESOURCES FOR
SITE SECURITY EPA's Drinking Water Website: www.epa.govJsafewaterlsecurity EPA's General Site Securiiy information Website: www.epa.gov/swercepp/p-small.htm EPA's Site Security Fact
Sheet Dn Chemicals: www.epa.gov/ceppo/pubslsecal•.pdf EPA's Local Emergency Planning Committee and Deliberate Releases Fect Sheet www,epa.gavlceppolfactsheetllepcclpdf EPA's Ammonia
Theft Fact Sheet www.epa.govlceppolpubslosalert.pdf EPA's Fact Sheef on Chemical Releases Related to Eleclrical Power Outages: www.epa.gov/ceppalpubs/pawer.pdf American Chemistry CO",lCWS
(ACe's) SIte Security Guidelines and Transportation Security Guidelines for the Chemica/Industry: www.americanchemical.com Homeland Securily Office Website: www.whitehouse.gov!homeJand

u.s. Environmental Protection Agency, Region 6 July 2002 Are all unoccupied buildings always locked and alarms set? Pue "Authorized Personnel Only" signs posted at the entrance to all
fucilities? Are important telepbone numbers posted on the outside ofeach building andlor on the inside of fences, and readily visible for emergency use by the public? Are the facility
grounds randomly and frequcntly patrolled? Are daily security sweeps conducted? Are all parts ofthe facility regnlarly and thoroughly inspeeted, including those portions not readily
visible? Are deliveries inspected, packages X-rayed? Is parking designated or othelWise controlled on the faeility? Is access controlled to ebemical and pesticide produCIli and waste
locked andlor fenced? Are entrance gates adequately protected and access controlled by security personnel? Is protection provided (Le., with concrete harriers) to prevent a speeding
vehiele (including along facility driveway) from hitting plant or other facilities? Are all outside stored chemicals protected from theft and vandalism? Is there a backap or redundant
exterior electrical connection to tbe utility grid? Are fire/smoke alarms provided within all building structures? Are all buildings (including walls, rooll;, windows, etc) constructed
to commercial grade standards? Is there adequate setback from exterior thoroughfures for key facility buildings, tanks, etc.? Are distribution and number ofkeys known and controlled?
Puc all keys labeled as "00 NOT DUPLICATE"? Are local police departments provided with access keys? Puc keys always removed from all unattended equipment? Do entrance barriers and fences
present credible deterrent to unauthorized entry? Are entrance gate(s) kept locked? Is all fencing at least 10' high, with inward-facing bawed wire on top, including on entrance gate(s)?
Is all fencing, including gate(s), seeure to ground to prevent access undar renee? Is fence at least 4' higher than any structure or landscaping located directly outside of fence which
may provide climbing aecess over fenee? Is rence at least 6' away from any structurc or landscaping located directly outside of fenee which may provide climbing access over fenee? 
Is entire perimeter of facility property illuminated with street-type lighting fixtures? Is entire perimeter of faeility illuminated so thaI all shadows and dark areas are eliminated?
Is lighting mounted at approximately a second story level? Are exterior light bulbs of commercial grade and break resistant? Is lighting provided in packing lots and other areas with
limited staffing? Are lights provided over entrance doors? Are all doors: Built ofcommercial grade with me\Ol frame construction? Outside hinges hidden/protected from vandali.m?Fitted tightly and free from mail .lot and excessive air gaps, including at floor/threshold? Provided with commercial grade, one-sided lock? Provided with push ("panic") bar release
on inside of door? Visitor entrances provided with an audible annunciator? Doors and locks in good condition? Electronically controlled so that each employee must use swipe card or enter
a pin number to enter the plant? Is a computer record made of the date, time, and employee who entered the plant? Are all windows (including on doors) covered with metal security mesh?
In case broken or opened, are all windows wired 10 loud audible alarm and 10 automatic telephone dialer or central station alarm? Is entire perimeter offacility installed with infrared
or microwave motion sensors in area between building and fence? Are motion sensors electrically connected to automatic telephone dialer or central station alann company? Is a closed-circuit
television video (CCTV) system provided 10 monilor property perimeter? Is this system monitored by facility security personnel? Is this system always on or activated by connection to
motion sensors? Is a CCTV system provided to monitor all vital parts of the plant, including the main entrance and control room and recorded on a slow speed security VCR (tapes not reusedlrecycled
for predetermined time)? Are emergency telephone numbers (including ambulance, police, FBI, spill response) current and prominently displayed at each telephone? Are MSDS and chemical
response response infonnation present for all stored chemicals? Is a chain ofcommand and emergency call list established, updated annually, and prominently displayed (must include 24n
telephone numbers for system superintendent and chief municipal officer)? Does a written security program plan exist; are employees frequently trained in the plan, and is the plan reevaluated
periodically? Are all employees, including Cuslomer Service staff, trained and checklists provided on how 10 handle a threat or incident ifcalled in? Are practice drills conducted frequently?
Have detection. response, and notification issues been discussed with local public health officials and a 
protocol established? Iffllcility is subject to the Emergency Planning and Act Can operational procedure times be varied so as not to reveal work patterns? Is a daily log used and initialed
by the last person who leaves the plant to verilY that all appropriate doors and windows are locked, appliances are off, night lights are on, and that entlllnce doors are locked and
alann set'! Is access controlled to computer networks and control systems, and passwords changed frequently? Are visitors/delivery vehicles stopped at the gate, signed-in, and authorization
to enter verified befute admission to fllcility? Are vehicles plate numbers recorded? Are police departments (daytime and nighttime coverages) familiar with facility layout and systems;
do they conduct routine patrols offllcilities; and, arc protocols eSlllblished for reporting and responding to threats and other emergencies (and updated annually)? Are staff instrocled
to immediately report to the police and FBI any criminal threat, security breach, suspicious behavior, or attack on their facility? Are copies of opellltional procedures, including contacts
and current telephone numbers, provided to police departments and emergency management personnel? Was a fucility security survey conducled? Does each employec display their sealed photo
ID at all limes? Are background security cheeks conducted on employees at hiring and periodically thereafter? Upon employee termination, are pass codes changed, emergency management
officials have the most tecent emergency plan and information on chemical storage areas? and keys and access cards returned? Is a visitor and contractor policy established for employees
to limit/question/scrutinize stranger(s) to the facility? Are procedures established in the event that an unscheduled visitor or stranger arrives after normal business hours requiring
the person to use the intercom for initial contact, Is access restricted unless the person has the proper eredentials and clearance. Are all chemical and other supply deliverers required
to show proper identification and sign-in? Do facility personnel observe delivery personnel during delivery and until delivery vehicles leaves property? Are non-employees accompanied
andlor observable at all limes? Are there other buildings in the immediate area thai are vulnerable to unauthorized entry? Are there storage tanks or possible sources ofan explosion
in the lnunediate area? Is the area well lighted and adequately patrolled? Are important facility telephone numbers given to neighbors 10 report suspicious activity at the fucility?
Is a formal or informal "Neighborhood Walch" program established around the fucility? 
CONTACT LIST EMERGENCY PLAN INFORMATION PUBLIC WATER SYSTEM INFORMATION PWS Name:_____________ County,..:_________ PWSID#:Address:'----------------Phone:,______ Office_____--'Plant,______Fax,______
Key Personnel (I.e., Mayor, City Manager, President. Owner, etc.) -Mark with' if authorized to spend money. 1. Name Phone: Office Fax Pager Position Home Radio Mobile 2. Name Phone:
Office Fax Pager Position Home Radio Mobile 3. Name Phone: Office Fax Pager Position Home Radio Mobile Operations Personnel: (Manager, Operator, Superintendent, etc.) -Mark with' if
authorized to spend money. 1. Name􀁃􀁾􀁥􀁲􀁴􀁾􀀮􀁾􀁌􀀭􀁥􀁶􀀭􀁾􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭Phone: Office'--__--;::--_ '--__-;:--::-_ Mobile_____ Fax,________ Pager_-:-____ 2. Name 􀁃􀁥􀁾􀁲􀁴􀁾􀀮􀁾􀁌􀁥􀀭􀁶􀁾􀁾􀁾􀀭
􀀭􀀭􀀭􀀭􀀭􀀭􀀭Phone: Office,___--;;::-__ _ __--;;::--;;-_ Mobile_____ Fax'---______ Pager______ 3. Name􀁃􀁾􀁥􀁲􀁴􀁾􀀮􀀷􀁌􀀭􀁥􀁶􀀭􀁥􀁾􀁉􀀭􀀭􀀭􀀭􀀭􀀭􀀭Phone: Office'--__--;::--_ _ __-;::--;;-_
Mobile,________ Fax,_______ Pager______ 4. Back-uplflll-in Operator when Primary Operator Is not available: 1. Prepared by EPA, Region 6 and TNRCC Satellite Downlink, produced by TX
AWWA. August S, 2002 1 
􀁎􀁡􀁭􀁥􀁾_________________ Posltlon,_________ Cert. Level __________ Phone: Office'----_____---Home___________ Mobile__________ Fax._________ Pager________ Radio,______ OTHER RESOURCES
State Emergency Spill Line Phone _________ 􀁆􀁡􀁸􀁾____ Fax,_____State Program Office Phone,______________ Regional State Office Phone,_________ Fax'---___----..,. LOCAL RESOURCES Police:
Phone,_________,Radio,_____...:Other,_____ Fax ____ Fire: Phone _______􀁒􀁡􀁤􀁩􀁯􀁾____ Other______ Fax _____ City/Community Emergency Manager.,_...,..,.. _______􀀮􀀮􀀮􀀬􀀮􀀮􀀬􀀭􀀭􀁾􀀢􀀮􀀮􀀮􀀮􀀭􀀭􀀭�
�􀀠Phone: Office Home'__________MobilelPager_____ County Emergency Manager: ____-:-:_______-:-:-:-:,--=____ Phone: Office Home,______Mobile!Pager______ TV Station Person Phone Fax TV
Station Person Phone Fax Radio Station Person Phone Fax Radio Station Person Phone Fax Newspaper Person Phone Fax Newspaper Person Phone Fax MUTUAL AID AGREEMENTS Other Water Company
Person'__________ 2 
􀁐􀁨􀁯􀁮􀁥􀀮􀁟􀁾______ Fax,______ 􀁏􀁾􀁥􀁲__􀁾􀀭􀀭􀀭􀀭􀂭Summary of Agreement Other Water Company'______________ Peffion'_________ Fax'--____ 􀁏􀁾􀁥􀁲________􀁐􀁨􀁯􀁮􀁥􀀮􀁟􀁾􀀭􀀭􀀭􀀭􀀭􀂭Summary
of Agreement SUPPLIERS (Place if emergency contract is in place) Equipment 1. Equipment Supplied __􀁾􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀮􀀮􀀮􀀬􀀮􀀮􀀬􀂭Company ________Peffion _____􀁾􀀭Position ________
Phone Fax,______Other___________ 2. Equipment Supplied Company _______Person'=-_______::_ Position,_________ Phone Fax Other 3. Equipment Supplied,______________􀁾􀂭Company ________,Person,_______Pos
ition,_______ Phone Fax Other_________ Chemicals Chemicals Supplied,________..."-_______-=c-...,,,_______ Company ________ Peffion,_____ Position,___ Phone Fax Other__ Chemicals Suppliedl________-=-_
_____􀁾􀀽􀀭􀀭􀀺􀀭􀀺􀀺􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀂭Company _______= Peffion'______ Position_ Phone Fax Other,_______ Chemicals Supplied,________=-______---:::--::-:-_______ Company _______ Peffion'____---:
Position __ Phone Fax Other___ Construction List Heavy Equipment Available,____􀀭􀀭􀀭􀀺􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀂭Company ________Peffion,____________ Position ___________ Phone ________
Fax,______ Other_____ Expertise'___________ 3 
List Heavy Equipment Available, ___--:::--_____________ Company ______---'Person Positlon________-::__ Poone ________􀁾􀁆􀁾􀀮______ Ofuer_____ Expertise,___________ Utilities Gas Company
Phone,________ 􀁆􀁡􀁸􀁾______ other_____ Electric Company Poone,__________ 􀁆􀁡􀁸􀁾_____ Ofuer_____ Sewer Phone_________ 􀁆􀁾􀁾_____ other_____ Telephone Company Phone,__________ Fax,______
other_________ A/temative Water Supplies (LIst bottled water suppliers, tank truck owners, etc. Provides Company ______􀁾Person Position Phone_________,Fax other Provides Company _______􀁾Person
PositionPhone__________,Fax other Provides COmpany ______--:Person Position Phone_____--'--____, Fax other Engineering Services Area of ExpertiseCompany _______-:Person____--::.Position_______
Phone Fax other________ Area of ExpertiseCOmpany ______---;Person____--,;;Position_______ , Phone Fax Ofuer_______ Laboratory Services Service Provided Company _________,Person,___________
Position Phone_______􀀭􀀭􀀭􀀧􀁆􀁡􀁸􀁾_____ other____ Service Provided Company ________,Person,__________ 4 
Communications (list mobile phones, pagers, radios) Type_______ Owner_________ Storage Location'--____ Owner Storage Location,_____Type--_._-Type,_____________ Owner Storage Location,_____
Pumps Type _____________ Size _;---;-:---------------Owner__________ Storage Location,________________ 􀁔􀁾􀁥_____________ Size __-:-_-,;-________ OWner________ Storage Location_______________
Generators 􀁔􀁾􀁥􀀠Owner_____________ 􀁓􀁴􀁯􀁲􀁡􀁾􀁧􀀭􀁥􀁾􀁌􀀭􀁯􀀭􀁣􀁾􀁾􀂷􀁾􀁯􀀭􀁮􀁾􀁾􀁾􀁾􀁾􀁾􀁾􀁾􀁾______________ 5 
Type Owner Storage Location Chlorine Response Kit Type Owner Storage Location Type Owner Storage Locallon Other Type Owner Storage Location Type Owner Storage Location Type Owner Storage
Location 6 
Threat Identification Checklist Ifyour utililJlreceives a threalening phone caJl, try to keep the caDer on the line to obtain as much information as possible. Record as much information
as possible, includil1lf. 1. What kind ofthreatis posed? A. Contunination, What kind ofpoison? How much? B. Physical Damage: Whatkind ofdamage? ________􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭WIth whatkindofdevice?
______________________ 􀁾􀁾􀁥􀁲􀁥􀀿____________________________________________________ 3. 􀁾􀀿__________________________________ 􀁾􀁾􀁹􀀿􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭�
�􀀭􀀭􀀭􀀭􀀭􀀭.5. By whom? ______________________________________________ 6. Whatis your (callers) name? ______________________________ 7. 􀁾􀀮􀁴is your (calIer'.) affiliation. ifany?
_______________________ 8. What is your (caller's) address/phone lfF__________________________ 9. What is the exactwordingofthe threati'______________________________ 10. Is the caller
-.male Jemale _wellspoken _illiterare _foul _irrational _incoherent 11. Is the callers voice _calm _ angry _slow _I1lpid _soft _loud _laughing _crying _noqrud _slurred _nasal_clear _lisping.J1lJlteri
ng _deep _hi&h _cracking _",,<ired -young _old -Familiar -who did it sound like?______________ _ accenred -whatnationality, region? ___________ 􀁬􀁾􀀠Is the connection clear? (Could
it have been a wireless or cell phonei') 13. Are there background noises? _streetnoises -what kind?-__________ _ machinery -what 1¥J>e?________________ _ voices 􀀭􀁤􀁥􀁳􀁣􀁲􀁩􀁢􀁥􀁾_________________
_ 􀁣􀁬􀁩􀁬􀁬􀁤􀁲􀁥􀁮􀀭􀁤􀁥􀁳􀁣􀁲􀁩􀁢􀁥􀁾____________________ _ animals-whatkind?____________________ _ computer keyboard/office _moro" -describe________________ _ music -what kind? Name
ofporson receivingca"'Il___________Dare____Tune___ Notify Utility manager I phone'___________ Local FBl/Law Enforcement, l'hone_________ Other'--______________IPhone:_____________ 
i WaterlWastewater System Incident Checklist /VOTE: All eme..r:.gem::ie££hould fiLSLbe rep"orted to 9U thefl-.tSLEPA's /V1Ltlonal ReSDOn!ie Center at• .1:::..800-424-88Q;; 1. Nature
of Incident (explain). a Cyber attack a Brief description of Incident:a Contamination a Bombs, explosives. etc.a Biological' a Wastewater treatment planta Chemical Interference andlor
pass through a Radiological D Other (explain) a Physical Destruction 2. System Nama 3. Party Responsible for Incident (Name and Address) Address: Phone Number (from caller 10): Telephone:
System Contact i Name: I TItle: 4. Location of Incident a Raw DWaler DWaler a Distribution Line a Receiving Stream Water Treatment Storage Source Plant FaCilities a Wastewater Collection
and/or Treatment System a Other (explain): 5. Date and Time of Incident 6. Alternate Water Source Exists. Yes I No Ifyes, give name, type and location. 7. Type(s) of Contaminants, Source
and Quantity: Basis of Infonnation: 8. Cal........ Name, Address, Organization and Telephone Nu
mber 9. Was an emergency crew dispatched (911 called)? 1:1 Ves 1:1 No 1:1 911 1:1 National Response Center 1:1 Regienal Response Center 1:1 other 10. Which of the following are on scene:
1:1 Police Cl Fire Cl Ambulance [lFBI Cl Olher IJ Hazardous Cl FEMA [l EPA [l State Agency Cl Malerials Team (describe) [l Weather conditions at Incident site: ; [l Number and types
of injuries andlor fatalities (if any): 11. Who else has been notilled (LocallState Agencies, Media)? 12. PWS andtOJ' wastewater Resources Status: Cl Additional Monitoring (what Itype?)
Cllntakes (number and location) i [l Wastewater Collectlon andler Treatment SYl'tem Status I Cl Conservation Initialed (describe) ! ;Cl Fire Suppression Capacity Cl Storage Capacity
[l Treatmenl (describe nanna! treatment and Wother has been inltlated) [l CommunicaHon (alerts to public?) [lOther 13. Can Received By; DatelT'.... e Call Received: 
United States Office of Water April 15, 2002 Environmental Protection Water Protection Task Force Agency Guidance for Water Utility Response, Recovery oEPA &Remediation Actions for Man-made
and/or Technological Emergencies 
DISCLAIMER The statements in this document are intended solely as guidance. This document is not intended, nor can it be relied on, to create any rights enforceable by any Pad¥ inlitigation
with the United States. EPA and state officials may decide to follow the guidance provided in this document, or to act in variance with the guidance, based upon an analysis ofsite-specific
ciroumstanoes. This guidance may be revised without public notice to reflect subsequent changes in EPA's policy. This document was prepared bY Michael Baker Jr., Inc. fur the EPA's Water
Protection Thsk Force under contract EMW-2000-CO-OOO2. i 
Thble of Contents Introduction: ............... ....... .......... ........ ....... ....... ........... .......... .......... ........... ............. ...... ..... ...... .... ... I
Background: ................................................................................................................................... I L Incident types ....... .... ......
..... ........ ......... ...... ....... .......... ................. .... ............. ............... .... ....... ... I II. Development ofthe Guidance .............................................
........................................................ 2 ill. Structure •.........•...... ; ..•....•.••..•......•.••....••.•........•..........................••....••••••.•.....•.••.•••.•....•..•.
........ 2 Response Planning: ........................................................................................................................... 2 NotifiCation Considerations:
.............................................................................................................. 2 Sampling: ............................................................................
............................................................ 4 Annexes: ..............................................................................................................................
; ........... 4 I. Sample Collection, Identification and Chain-of-Custody Fonn ................................. Annex I-l 2. Incident-specific Guidance I. Contamination Event: (Articu1ated
Threat with Unspecified Material) .......................... Annex 11-I II. Contamination Threat at a Major Event .......................................................................
Annex 11-3 III. Notification from Health Officials ofPotential Water Contamination ............................ Annex 11-5 rv. Intrusion through Supervisory Control and Data Acquisition
(SCADA)........................ Annex 11-7 V. Significant Structural Damage Resulting from an Intentional Act .................................... Annex 11-9 ii 
Introduction: This document provides unifonn response, recovery and remediation guidance fur water utili1;y actions in response to man-made and/or technological emergencies. The guidance
was developed as an initiative of EPA's Water Protection Thsk Force and has been reviewed with water utiliIies and associations, EPA Regions, EPA Office of Water and other federal agencies.
The intent of this guidance is to provide the minimum actions that EPA recommends be carried out by a water utilil¥ for the evenls descnbed. Emergency response planning is primarily
a local responsibilil¥. Good bnsiness practices suggtlSt that every water utility have an Emergency Operations/Response Plan that is coordinated with state and local emergency response
organizations, regulatory authorities and local govemment officials. Water utilities ought to consider whether the actions contained within this guidance have been thoroughly coordinated
with these entities. The Federal Response Plan (section VI) identifies Federal responsIbilities and capabilities that can support the local response effort dependent upon the l¥Pe and
severity of the incident. Throughout this guidance "water system" includes the "system" elements of source water (ground and surfuce), drinking water treatment, drinking water distribution
and storage, wastewater collection and wastewater trealment. Background: The Environmental Protection Agency (EPA) has been given the responsibiliiy under Presidential Decision Directive
(PDD) 63 fur woiking with the Water Sector (including water and wastewater utilities) to provide for the protection of the nation's critical water infrastructore jlJclnding the systems
used to collect, treat and distribute potable water. The EPA has a similar responsibility fur wastewater operations. These critical infiasiructores are fimdarnental to the public health
and welfilre and are subject to both natwal disasters such as floods and earthquakes, and man-made hazards such as terrorist attacks. Such disasters could place sunounding areas and
populations at significant risk. In October, 2001 the EPA established an intemal Water Protection Task Force to ensure that activities to protect and secure water supply infrastructore
are comprehensive and carried out expeditiously. This guidance supports the Task Force's mission of providing information in an expeditious maaner to public and private water utilities
that can be used to protect public health and critical water infrastructore. L Incident tyJ)es Tbb guidance was developed for five (5) different incident types: • Threat of or Aetual
Intentional Contamination of the Witer System • Threat ofContamination at a Major Event • Notification from Health Officials of Potential Water Contamination • Intrusion through the
Supervisory Control and Data Aequisition (SCADA); and • Significant Structural Damage Resulting from an Intentional Act While this guidance is oriented toward these 5 incident l¥Pes,
it should also serve as a guide for response, recovery and remediation actions fur other threatened or actual intentional acts that would aftect the safety or securil¥ ofthe water system..
1 
II. Development ofthe Gnldance Each incident type was assessed for potential impact on water system operations and public safety to identifY the minimwn actions for each element of the
water system to consider taking in response to the incident, recover from the incident and to remediate the impacts of the . incident Response refers to actions immediately following
awareness of the incident, recovexy refilrs to actions to bring the system back into operation, and remediation refers to longer term restoration actions. Where applicable, each incident
type was assessed as if it had occw:red separately at each of the system elements and the potential impacts were asSessed upstream and downstream of the incident location. Additionally,
the guidance was developed considering the response needs of large, mediwn and small water and wastewater systems. Water utilities should apply the concepts contained in the guidance
to meet their system configuratlon and capabilities. ill. Structure: The guidance provides recommended actions in the categories of Response Actions, Recovery Actions, and Remediation
Actions in separate tables for each incident type. Each of these categories contalo a section on notifications and utiJiIy actions. Where applicable, specific actions for each element
ofthe water system are provided under the utility actions section. The Notification Considerations section recommends standard notifications for any suspicious or threatened intentional
man-made or technological emergency. Supplemental noti.ficatiom are recommended within the incident tables for some events hased on the potential impact ofthe event Response Planning:
This response, recovexy and remediation guidance to intentional acts can be used to supplement existing water utiJiIy emergency operations plans (EOPs) developed to prepare for and respond
to natoraI disasters and emergencies. EPA recommends that established policies and procedures contained in existing plans be used to the maximwn extent while incOIporating the recommendstinns
in in this guidance. A high qualliy water utility BOP clearly delineates the organizational structore within the water system that will be respons!ble fur incident response and mansgement
This structure should identifY specific individual roles and responsibilities for decision-making, logistics, operations, incident response control and finance. The structure could be
based on the Incident Command System, or other similar system, that is compatible with the system(s) used by other elements (Fire, Law Enfurcement, Emergency Management, Emergency Medical
Services (EMS), etc.) of the community's incident response and management structure. It would be helpful to coordinate potential response requirements· and expectations with local response
organizations prior to an incident to ensure that the water utilitys response needs are met. Notification Considerations: Water utilities that have established notification procedures
to meet a regulatory requirement, such as the Emergency Planning and Community Right-to-Know Know Act (EPCRA). should use them as the starting point for developing broader notification
procedures. Utilities that do not have established notification procedures should work with their Local Emergency Plamting 2 
Committee (LEPC) or similar local emergency planning organization, prior to an incident, to coordinate the specific procedures fur contacting local, state and :fi:deral officials when
an incident occurs. You can find the LEPC for your location at hUp:Jlwww.ll1la.goy/Cf!P!Jo/lepclist.htm. EPA expects that the faciIiI,y would first call local law enforoement officials
to initiate local emergency response actions. This may be accomplished by calling 911 or direct call to local law enfun:ement. The local notification coordination effort should determine
which additional emergency response and management agencies (fire, Emergency Medical Services (EMS), the community emergency management organization and state agencies) need to be notified.
For instance, do fire and EMS need to be notified in addition to law enfun:ement for a water-related incident? The notification procedures developed within the local notification coordination
effort should provide agency-specific names and contact numbers for these notifications on a 24-hour basis .and define what infOrmation abont the incident needs to be provided, who will
make the notifications and which anthorities are notified when a call is placed. As a minimum, these notification procedures should include protocols for notifYing local and state health
and environmental authorities, local critical care :fucilities (hospitals, dialysis centers, etc.) and others as identified in state and local requirements. An intentional act to disrupt
the operations of a water utility or to jeopardize public health is a criminal act. T.h.is creates the need for notifications to the appropriate FBI field office, National Response Center
and other entities that may not nonnally be contacted in response to a natural disaster or emergency. Water utilities should work with the LEPC or similar organization, in conjunction
with appropriate state offices, to verifY how these additional notification requirements will be met and who has respons!bility fur the notifications. The procedures developed developed
wi1hin the local notification coordination effort should ensure that all of the entities listed below are notified, identifY who the utility lllllSt contact to initiate the notifications
and identifY who within the organi:zatioll should make the notifications. These organizations are not listed in any particular order ofprefurence. • NotifY local law enfun:ement • NotifY
local FBI Field Office (to begin the !brest assessment process) Your local FBI field Office can be located by visiting htlP:lfwww.ihi.lj'ovfcnnll!ct!fuljnfQ.htmor in the front pages
ofyour local telephone book • NotifY National Response Center 1-800-424-8802 (to notifY pre-determined federal response agencies) for more infOrmation on NRC see htlP:llwww.nrc.usclj'.rnil
• NotifY state/local emergency management organization • NotifY Govemor's office • NotifY local EPA CID Special Agent in Charge (SAC) • NotifY other associated system authorities (wastewater,
water) • 'NOOfY local government official (responsible authority fur the water utility) • NOOfY state/local health, water andfor environmental department • NotifY critical care :fucilities
• NotifY employees • NotifY EMS and Fire Department as deemed necessary • Consider when to notifY customers and what notificatiun to issue 3 
The recommendations provided in this guidance are supplemenllll to regnlatrny or oIher promulgated reporting requirements. Nonna! reportingInotification to state healfu and/or envirenmenllll
agencies, or 1he EPA for states without approved state programs, will still be required when 1he impacts ofan incident result in an inability to meet Water Quality or National PrimaIy
Drinking Water Standards or to meet CERCLA and/or EPCRA requirements. Sampling: The results of sample analysis after a 1hreatened or actnal contamination event can serve a critical role
in detennining response, recovery and remediation actions; assessing 1he potential impacts of 1he contaminant; and, providing data for eventnal prosecution. Sampling requirements 􀀨􀁱􀁵􀁡􀁮􀁴􀁩􀁾􀀠ty
pe of sample container, environmental controls, type of sample, sample locations, etc.) can vary significantly depending upon fue properties of fue contaminant and where 1he contaminant
was introdnced into fue system. This guidance provides recommendatioIlS fOr when sampling might be beneficial but can not provide specific sampling requirements fur every potential contaminant.
It is important to ensure 1het sampling is conducted by trained personnel and lhat fue safety of sampling and o1her personnel is fully considered while conducting sampling activities.
The diversity of sampling capabilities and resources among large and small water utilities makes it difficult to establish standard requirements fur all water utilities. Water utilities
should work with their LEPC and appropriate local, state and federal agencies to develop procedures fur obtaining requirements or recommendations on taking samples, sample control, sample
distribution and use of sample analysis results on an event-by-event basis. The water utility's sampling capabilities and procedures fur obtaining sampling recommendations sbouId be
contained within fue utility's EOP. In 1he event of an incident lhat is ·suspected or confirmed. to be 1he result of an intentional act to disrupt 1he operations of a water utility or
to jeopardize public health, law enfurcement officials may also require/take additional samples for evidence preservation. Annexes: Annex I provides a Sample Collection, Identification
and Chain-of-Custody Form and instructionsfOr its use. The form is an example of fue information needed for recording data on samples taken in response to an intentional act and for maintaining a record fur chain-ofcnstody of1he
sample. Annes II provides incident-specific response, recovery and remediation guidance for each of1he five (5) incideot types. . 4 
Annex I -Sample Collection, Identification and Chain-of-Custody Form Sample Collection, Identification and Chain-of-Custody Form Sample JD # (Place IDLabel Here) Sample DatelTime Sample
Description Sample Location Comments Sampler Signature DateITlme Witness Slll1lature DatelTime Print SampleID Print LooItimt 1. Released by: Si/lllatore DateITime Received by: Siflll8tnre
DateITime PrInt SampleID Prlot L....tion 2. Released by: Slll1latore Date/Time Reeeived by: Slenatore DatelTIme Print SampleID Print Location 3. Released by: 􀁓􀁩􀁾􀁂􀁡􀁴􀁮􀁲􀁥􀀠DatelTime
Received by: Signatnre DatelTime Print SampleID Print Location 4. Released by: Slglllllure DatelTIme Received by: Slglllllure DateITime Print SampleID Print Location Annex! -1 
Instructions for Sample Collection, Identification and Chaln-of-Cnstody Form Whether from an epidemiological or evidentiaIy standpoint, it is critically important that samples taker..
in response to an intentional act against a water system be taken in a systematic 1l1lIII!Iel". Each sample collected should have a separate identifying number (Sample ID If) and the
transfer of each sample should documented. The Sample Collection, Identification and Chain-of-Custody Fonn provides a standardized fonnat for annotating this infonnatinn. Sample Identification
Number (Sample ID If) Each sample should have separate identification nnrober. A unifunn system should be established fur assigning sample identification numbers. Sample DatelIime Annotate
the date and time that the sample was talren. Sample Description Descnbe the type ofsample taken (water, sludge, sediment basin, etc.) Sample Location Anootate as specifically as possible
where the sample was taken so that later samples can be taken (ifnecessary) from the exact same location. Comments Provide any additional COIll.Ille11ts that may assist in sample analysis
(water temperature, bumidit)l how sample was taken or materials used to take sample, etc.). Sampler Identification The person taking the sample should sign hisIher name in the Signature
block, annotate the dakitime of signature in the DatelI'ime block:, print the sampler's name in the Print block and annotate the sample ID number nom the Sample ID# bloCk at the top
ofthe funn. Witness Identification The person witnessing the taking of the sample should sign hisIher name in the Signature block, annotate the date/time of signature in the DatelI'ime
block, print the sampler's name in the Print block and annotate the location of where the sample was taken nom the Sample Location bloCk at the top ofthe form. ChaIn-of-Cnstody 'ftacklng
A record of control for all samples should be maintained. Each person who releases control of the sample should maintain a copy of who the sample was released to. Persons who receive
samples should verifY the sample identification number ON THE SAMPLE before signing for receipt of the sample. The original copy of the funD, with original signatores should remain with
each sample until final disposition. The person releasing the sample should sign hlslher name in the Signature bloCk, annotate the dateltime of release in the DatelIime block, print
the releaser's name in the Print bloCk and annotate the sample ID number from the Sample ID# block at the top ofthe form. Annex 1-2 
The person receiving Ibe sample should sign hi&'ber name in Ibe Signature block, annotate the dateftime of receipt in the DatelTime block, print the receiver's l1I!llle in Ibe Print
block and annotate the location where the sample was received in the Location block Oilier Considerations Photographs When possible a photograph should be taken ofeach collected sample
at the sample location. Ideally, the photograph would show the completed sample ID label and security seals in-place. Photographs should be annotated or dated-stamped with the date and
time that the photo was taken. Annex 1-3 
Evenl Description: This event is oasea on threat ofintentional introduction of a conlaminant into the water system (at any point within the :ontarninant bv ilie • NOtlIy local Law •
NotiJY locallstate • NotilY other • NotilY locallstate • NotiJY employees Enforcement emergency associated system health andlor • Consider when to Initial • NotilY local FBI management
authorities environmental notilY customers and Field Office organization (wastewater, water) department what notification to Notifications: • NotiJ'y National • NotiJY ISAC • NotilY
10c.1 • NoOfY critical care issue Response Center govemmentofficim facilities • Notify GQvernor Source \\\lter Drinking \\\lter Water Distribution Wastewater Wastewater Treatment Facility
I Storage Collection System Treatment • Assess what to do• Increase sampling • Consider whether to • Preserve lalest full at or near system • Preserve latest full hatlery background
isolate the water in with potentimly battery background intakes .test as baseline lest as baselinethe a:a:frected area if contaminated water possible within the system .• Increase sampling
• Consider whether • Increase sampling to isolate the efforts based on efforts water source if contaminant,• Consider whether to • Consider whether to possible contaminantcontioue normal
continue normal RESPONSE concentration,operations (if operations (ifACTIONS potential for system determination is determination is made to reduce or contamination, and made to reduce
or stop water treatment ability to by-pass stop water treatment -provide treatment plant. -provide notification to • If by-passed-notiJY notification to customers/issue local & appropriate
customers/issue alerts) state authorities, & alerts) downstream users . mlemative water • Coordinate Increase monitoring supply of receiving stream. Annexll-l 
RECOVERY ACTIONS Recovery Notifications: Appropriate Utility Elements: REMEDIATION ACTIONS Recovery actiOllll should begin once the conlllminant is through the system. • NotifY Custome.rs
• NotifY Media lSAC • Sample appropriate system elements (storage tanks, filters, sediment basins, solids handling) to detennine if residual contamination exists. • Based on sampling
results -assess need to remediate storage tanks, filters, sediment basins, solids handling. • Flush system based on results of sampling • Monitor health of • Plan for appropriate disposition
of PPE and other equipment • Plan for appropriate disposition ofpersonal protection equipment (PPE) and other equipment • If waste water treatment plant was by-passed sample and establish
monitoring regime for receiving stream and potential remediation based on sampling results. 1. Response, recovery and remediation actions may be tailored to a specified (identified)
material ifthe physical properties for the material are known. AtmexII-2 
􀀮􀀺􀁴􀁜􀁾􀀮􀀡􀀩􀀠􀀺􀂷􀂷􀀻􀁾􀀯􀂷􀀠if .,>,' " <1;, 􀁾􀁾􀀠􀁾􀀮\. IU'J 􀁾􀀠􀁁􀁾􀀠J. flie ttl. Event DescriptioD: This event is based on the threat of; or actual, intenlional introduction
ofa contaminaot into the water system at a convention center or similar • Noti.fY local Law • NotifY [ocal/state • NotifY other • NotifY local/state • Noti.fY emplcyees Enforcement emergency
associated system health andlor • Consider when to management authorities environmentalIni1iaI • Noti.fY local FBI notifY customers and Field Office organi2ation (wastewater, water)
department what notification toNotifications: • NotifY National • NotifY wastewater • NotifY local • Noti.fY critical care issue Response Center facility government official facilities
• NotifY lSAC • NotifY Governor Source Water Drinking \\Bter Water Distribution \\Bstewater \\Bstewater 1i'eatment 1<'....mtv I Collection Theatment • Coordinate acceptance of isolated
water action to take • No recommended • Coordinate isolation• No recommended action to take of water • Monitor accepted water • Assist in plan fur • Assist in plan fur dJ:aining the
contained draining tjle water RESPONSE con1l!ined water · • Assist in developing aplan fur sampling ACfIONS • Assist in water for potential conlmnination based on developing a plan threat
notification fur sampling water fur potenlial contamination based on threat notification • Provide alternate water source Annex II-3 
RECOVERY ACTIONS Recovery Notifications: Water Distribution I REMEDIATION ACTIONS: Recovery actimJs should begin once the contaminant is through the system. • • • area customer.; in
affected area once contaminant-free clean water is re-established down-stream users such as water l!lIPPIiecs. jnigators. electric eeneratine: Plants. etc. • COllBider flusbing system
via bydrants in distribution systerDB Water DistributioniStorage Wastewater Treatment Plant • Assess need to decontaminate/replace distribution system components . • tsasea. on sampling
results -assess need to remediale storage tanks, filters, sediment basins, solids handling. • appropriate disposition of PPE and other equipment • II waste water treatment plant was
by-passed -sample and establish monitoring regime for receiving stream and potential remediation based on sampling results. A.nnex1l-4 
;<;;.':-') :..,,011'-).. 􀁾􀁉􀀠;l, s ""'''&'",\,..<>3 􀁾􀀠􀁾􀀠"" 􀁾􀀬􀀠􀁾􀀠 􀁾􀁾􀁬􀀧􀀧􀀧􀁗􀁉􀁴􀀺􀀮􀁃􀀧􀀧􀀠 Event Description: This event is based on the waterutility being notifiedby
Public Health officials ofpotential C(lT!tamination 00sed on • Ask notUying • NotifY local Law • Notify other associated • Notify 10caVslate • Notify employees official who else Enforcement
system authorities health andlor • Consider when to bas been notified • NotifY local FBI (wastewater, water) environmental notify customers Initial and request Field Office • Notify
local department · and what information on • Notify National government official • Notify critical care notification to issueNotifications: symptoms, Response Center • Notify Governor
mcllities • Notify ISAC potential • Notify locaVstate contaminants and emergency potential area management affected organization Source Water wastewater Treatment Drinking water water
Distribution Wastewater Collection 'D:eatment • Increase sampling at pomps smllons and at or near system • Increase sampling • Preserve latest full • Increase sampling in battery background
the area potentially specitically in the area potentially affected intal<es test result as baseline airected and at • Assess what to do with potentially locations where the contaminated
water within the system based to isolate • Increase sampling • Consider whether contaminant could on contaminant, contaminant concentration, . have migrated to. It is efforts potential
for system contamination, and continue normal • Consider whether to important to consider ability to by-pass treatment plantRESPONSE the time betweenoperations (if • Ifby-passed -notify
local & appropriateACTIONS exposure and onset ofdetermination is to state authorities, downstream users reduce or stop water symptoms to select (especially drinking water treatment treatment
-provide sampling sites facilities) & increase monitoring of notification to • Consider whether to receiving stream customers/issue isolate alerts) • Consider whether to increase residual
• Coordinate alternative water disinfectant levels supply (if needed) AnnexlI-5 
RECOVERY ACTIONS Recovery Appropriate Utility Elements: REMEDIATION ACTIONS RecoveIy actions should begin once the conlrunjnant is through the system. • Assist health department with
notifications to cnstollleIS, media, downstream nsers and other organizations • Sample appropriate system elements (stomge tanks, filters, sediment basins, solids handling) to determine
ifresidual contamination ex.ists. • Based on sampling results assess need to remediate stomge tanks, ftiters, sediment basins, solids handling and drinking water • Flush system based
on results of sampling • Monitor health of • Plan for appropriate disposition of PPE and other equipment contaminants. • Plan for appropriate disposition of personal protection equipment
(PPE) and other equipment • If waste water treatment plant was by-passed sample and establish monitoring regime for =lving stream and potential remediation Annexll-6 
oJ.\<;fo!) 􀀺􀀮􀁩􀀬􀀮􀁬􀁪􀀯􀁾􀀮􀁲􀀠􀁻􀁁􀂷􀁾\ I 􀀮􀁾􀀮􀀬􀀮􀀠􀁾􀀻􀀮􀀠(....<@􀁾􀁾􀀯􀀮􀀠􀁾􀀬􀁣􀁴􀁴􀂷􀀠Event Description: This event is based on internal or extemal intrusion ofthe SCADA
system to disrupt normal water system • NotifY local Law • NotifY National • NotifY other • Ifthe water is Enforcement Infrastructure associated system assessed to be unfit • NotifY
local FBI Protection Center authorities for consumption, Initial Field OffIce (NJPC) at 1-888-585-(wastewater, water) consider when to Notifications: 9078 (or 202-323-• NotifY employees
notifY customers · 3204/5/6) and what notification to issue Source Water Drinking Water Water Distribution Wastewater Wastewater Treatment Facility 1 Collection Treatment • Temporarily
shut down SCADA system and at or near system • Increase sampling • PreselVe latest full • Monitor unmanned battery background components (storage go to manual operation using established
intakes tanks & pumpingtest as baseline protocol stations) • Monitor unmanned componentS (pumping • Consider whether • Increase sampling RESPONSE to isolate stations) -required only
if wastewaterefforts • Consider whether to ACTIONS isolate SCADA system is compromised down SCADA • Temporarily shut • If SCADA intrusion caused release of system and go to improperly
treated water consider whether to manual operation continue normal operations (if detennination using established is made to reduce or stop water treatment protocol provide notification
to customers/issue alerts) • Consider whether to shut down system and provide alternate water Annex ll-1 
.&:<1':"-'<!;,'t, ..••" 􀁾􀀠􀁾􀀠􀁐􀀺􀀱􀂣􀀡􀁾􀀠, RECOVERY RecoveIy ac1ioDs should begin once the intrusion bas been eliminated and the contaminant/unsafe water (ifthisACTIONS occurs)
is through the system. • Recovery • Local law enforcement Notifications: • Notify customers and media ifthe event resulted in contamination and the full nmge (see scenario 1) ofstandard
notificatiollS were made • WIlhFBI • With FBI assistance, check for implanted • Appropriate assistance, make backdoors and other malicious code and SCADA Utility Elements: an image copy
of eliminate them before re-starting SCADA • Bring SCADA system up and monitor system all system logs to system • Assessl'lIIIplement additional protections for • Check for an NIPC water
sector warning based on the intrusion that REMEDIATION SCADA system. may contain additional protective actions to be considered. NIPCACTIONS warnings can be found at www.NIPC.ggy or
at for access Notes: Annexll-8 
􀁾􀁜􀁩􀀮􀁾􀁾􀀧􀀩􀀠""1,.. ." 'att 􀁾􀀠ft .􀁾􀁾􀁩􀀮􀁯􀀺􀀮􀀮􀁾􀀢􀀠':1-;", ./:.sl.. 􀁾􀁗􀁲􀁴􀀮􀁲􀀺􀀮􀀢􀀢􀀠• NotifY local Law • NotifY looallstate • NotifY other • NotifY localIstate • NotifY
employees Enforcement emergency associated system health andIor • Consider when to Initial • NotifY local FBI management authorities environmental notifY customers and Notifications:
Field Office organization (wastewater, water) department what notification to • NotifY National • NotifY Governor • NotifY local • NotUy critical care issue • NotifY !SAC government
officials facilities Source Water I Drinking Water Water Distribution IWastewater Wastewater • Deploy damage assessment teams, ifdamage appears to be intentional then treat as crime
scene -Consult Iocallstate law RESPONSE enforcement and FBI on evidence preservation ACTIONS • infonn law enforcement and FBI of putential hazardous materials • Coordinate alternative
waler supply, as needed • Consider increasing security measures • Based on extent ofdamage. consider alternate treatroent schemes to maintain at least some level of treatment Recovety
damaged :fucility is isolated from the rest ofthe utilityRECOVERY filcilities.ACTIONS • EmployeesRecovery • Law enforcement • NotifY local FBI officeNotifications: • Dependent on the
feedback from damage assessment teams • Implement damage recovery plan • Repair damage. • Assess 􀁮􀁥􀁾􀀠for additiolllli protection/security measures for REMEDIATION damaged 1ilcility,
and nther critical facilities within the ACTIONS AnnexII-9 
Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems i Association of State Drinking Water . Administrators National Rural Water Association Ma 30,2002 
This document contains sensitive information about the security of your water system. Therefore, it should be treated as Confidential Information and should be stored in a secure place
at your water system. A duplicate copy should also be stored in a secure off-site location. Acknowledgments This document is the result ofcollaboration among the Association ofDrinking
Water Administrators (ASDW A), the U.S. EnYironmental Protection Agency (U.S. EPA), the U.S. EPA Drinking Water Academy, and the National Rural Water Association (NRW A). We also thank
NWRA forth. template that was used as the foundation for this project. 2 
Contents SECURITY VULNERABILITY SELF-ASSESSMENT GUIDE FOR SMALL WATER SYSTEMS ................4 INTRODUCTION •.•......••.••.•...••........••..•..•....•.•...........•.••.•••••••.•••.....•••.•••..•••••
•..•••••••.•..••.••••••••.•••••••••••..4 HOWTO USE 1HIS SELF-ASSESSMENT GUIDE .•....•..•••••••......•....••..•..•••••••.••••••.............••••••••.••....•....•••••.4 KEEP 1HIS DOCUMENT..............
.................... , .,............. ,' , •• , ..... , , ............ , •••• ,"., .................... ,' , •• , ....... .4 SECURITY VULNERABILITY SELF-ASSESSMENT, •• , •... , .................
,""',........................ , ................... 5 RECORD OF SECURITY VULNERABilITY SELF-ASSESSMENT COMPLETION .................................................,5 INVENTORY OF SMALL
WATER SYSTEM CRmCAL COMPONENTS.......................... : ..... '" .................. , ........ ,6 SECURITY VULNERABILITY SELF-ASSESSMENT FOR SMALL WATER SYSTEMS ...........................7
GENERAL QUESTIONS FOR 1HE ENTIRE WATERSYSTEM...... ...... , ................. ,",.............................................7 WATER SOURCES ................ ,', ....................................
.................................................................... 10 TREATMENT PLANTANDSUP?UERS ...................................................................................................1
0 DISTRIBUTION .............................. , .................................................. , .............................................. 12 PERSONNel ........ " •• " ••• "
................ , .................................... ', .......................... " ............ , .. , .. ,•. " •••••• 12 INFORMA'TlON STORAGB'COMPUTERSICONTROLSIMAFS .... , ' •••••...
,' , ........... , ••••, .................... , ... ,' , ... , ........ 13 PUBLIC RELATIONS ............. , .........................................................................................
, ................. 14 ATTACHMENT 1. PRIORITIZATION OF NEEDED ACTIONS .............................................................16 ATTACHMENT 2. EMERGENCY CONTACT LlST.. ..........................
.................................................. 17 SECTION 1. SYSTEM IDENTIFICATION ....................................... ; .........................................................
17 SECTION 2. NOTIFICATION/CONTACT INFORMATION..............................................................................18 SECTION 3. COMMUNICATION AND OUTREACH...................................
......................... " ....................... 21 ATTACHMENT 3: THREAT IDENTIFICATION CHECKLISTS ........ , ..................................................... 22 WATER SYSTEM
TelEPHONE THREAT IDENTIFICATION CHECKUST........... ,', ........................... , ................ 22 WATER SYSTEM REPORT OF SUSPICIOUS ACTIVITY,., '................. , .........
,' ............. ,"" , ......... , , ............... 24 CERTIFICATION OF COMPLETION ............. , ........ , ..... " .................. ".,............ , .... , ........ " ..................
27 3 
Security Vulnerability SelfAssessment Guide for Small Water Systems Introduction Water systems are enHcal to every eommunity, Proteetion ofpublic drinking water systems must be a high
priority for loeal officials and water system owners and operators to ensure an uninterrupted water 􀁳􀁵􀁰􀁰􀁬􀁹􀁾􀀠whi<:h is essential for the proteetion ofpublic health (safe drinking
water and sanitation) and safety (fire fighting), Adequate security measures will help prevent loss ofservice through terrorist aelS, vandalism, or pranks, Ifyour system is prepared,
such aetions may even be prevented. The appropriate level ofsecurity is best determined by the water system at the 10calleve1. This Seeurity Vulnerability Self-Assessment Guide is designed
to help small water systems determine possible wlnerable eomponenlS and identify security measures that should be considered, A "vulnerability assessment" is the identification ofweaknesses
in water system security. focusing on defined threats that could compromise its ability to to provide adequate potable water, andlor water for firefighting. This doeument is designed
particularly for systems that serve populations of3,300 or tess. Thisdoeument is meant to encourage smaner systems to review their system vulnerabilities, but it may not take the place
ofa comprehensive review by security experts. The Self-Assessment Guide has a simple design. Answers to assessment questions are "yesn or "no." and there is space to identify needed
actions and actions you have taken to improve security. For any 4'no" answer, refer to the "comment" column and/orcontactyour state drinking water primacy agency. How to Use this Self-Assessment
Guide This document is designed for use by water system personnel. Physieal facHities pose a high degree of exposure to any security threat. This self-assessment should be conducted
on all components ofyour system (wellhead or surface water intake. treatment plant, storage tank{s). pumps. distribution system. and other important components ofyour system). The Assessment
includes an emergency contact list for your use. This list will help you identifY who you need to contact in the event ofan emergency or threat and will help you develop communication
and outreach procedures. Filling out the Emergency Contact List is an important step toward developing an Emergency Response Plan, which provides detailed procedures on how to respond
to an emergency. You may be able to obtain.sample Emergency Response Plans from your state drinking water primacy agency, Security is everyone's responsibility. We hope this document
helps you to increase the awareness ofall your employees, governing 􀁯􀁦􀁦􀁩􀁣􀁩􀁡􀁊􀁳􀁾􀀠and customers about security issues. Once you have completed this. document, review the actions
you need to take to improve your system's security. Make sure to prioritize your actions based on the most likely threats, Please complete the Certificate ofCompletion on page 27 and
return only the certificate to your state drinking water primacy agency, Do not include a full copy of your self-assessment. Keep this Document This is a working document. Its purpose
is to start your process ofsecurity vulnerability assessment and security enhancements. Security is not an end point. but a goal that can be achieved only through continued efforts to
assess and upgrade your system. Don)t forget that this is a sensitive document. It should be stored separately in a secure place at your water system. A duplicate copy should also be
retained at a sccure off-site location. Access to this document should be limited to key water system personnel and local officials as well as the state drinking water primacy agency
and others on a nced -to-know basis. 4 
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------Security Vulnerability Self-Assessment Record ofSecurity Vulnerability Self-Assessment Completion The following information should be completed by
the individual conducting the self-assessment andlor any additional revisions. Name:· Title: Area of Responsibility. Water System Name: Water System PWSID, Address:-----------------------------------
-------------City: County,State: --------...............􀁾..... Zip Code: Telephone: 􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭Fax: E-mail: Date Completed: Date Revised:
Signature. Date Revised: Signature: -----Date Revised: Signature: ----Date Revised: Signature: ----Date Revised: Signature: -----5 
Inventory ofSmall Water System Critical Components '& (if, I 􀁾􀀠",.,',':,.;" :.'c,;,,:';; .',: 􀁾􀀻􀀧􀀺􀁾􀀧􀀺􀀢􀀧􀀺􀀠.",' l,:(({",:ec":;' c;'''::}t',> ' '. ::' .' ',-," ""':i':::';,';""':
,-,;' -.: ',':.<':""""'" I Water , Water cT: ' 􀂷􀀬􀀬􀀬􀀬􀀬􀀺􀀬􀀧􀀬􀀬􀀺􀁹􀀼􀁾􀀺􀀬􀀺􀀩􀀺􀀺􀀬􀀧􀀺􀀧􀀺􀀧􀀬􀀱􀀯􀀺􀀺􀀺􀀠.";"::':":{':""," ..,,:,'\';',􀁩􀁾',:i; :::.({'ii:, /< Pumps I : (e,g"
basin, filter) fOIS I 􀁾􀀠and t( "Y Ci I and ", 􀁾􀁾􀀠p 􀀮􀁾􀀠t,::, ;pQWef I ;Power , " " .. :, ....' .. , .Xi.':-,' " 􀁾􀀧􀀠,':'.,'; ': Pumps PiPeS "'VaiVeS , (e.a., Hush blher ;pojiijS
,tJ;,': 􀀬􀀬􀀺􀀧􀀮􀀨􀀺􀀬􀀬􀀺􀀺􀀢􀀧􀀯􀀺􀀬􀀺􀁾􀀠,:'J": '/":􀁾􀀧􀀺􀀡􀁗􀀺􀁾􀀬􀀠""'","'",, , FileS T . ; 􀁾􀀠/';,\' ',"Wi.'!:; 􀁾􀀠Cell Phone Radio 􀁾􀁕􀁩􀀡􀀻􀁲􀁾􀁾􀁾􀁦􀀠"Ulllf" 􀁾􀀱􀀠 6

Security Vulnerability Self-Assessment for Small Water Systems General Questions for the Water System The first 13 questions in this vulnerability self-assessmant are general questions
designed to apply to all components ofyour system (wellhead Or surface water intake, treatment plant, storage tank(s), pumps, distribution system, and offices). These are fOllowed by
mora specific questions that look at individual system components in greater deta you have an access components of the water system (i.e .. a part of the physicslinfrastructure of the
system that is essential for water flow andlor water quality) restricted to authonzed personnel only? can obtain a sample from yourAs a first step in developing your I::.f'\' I yvu ;::'UUUIU
Emergency Contact List (see Attachment 2). A plan Is vital In case there is an Incident that requires immediate response. Your plan should be reviewed at least annually (or more frequently
if necessary) to ensure It is up·to-date and addresses security emergencies. You should designate someone to be contacted in case of emergency regardless of the day of the week or time
of day. This contact Information should be kept up·to-date and made available to all water system personnel and local officials (if applicable). Share this ERP with police, emergency
personnel, and your state primacy agency. Posting contact information is a good idea only if authorized personnel are the only ones seeing the information. These signs could pose a security
risk if posted for public viewing since It gives people information that could be used against the system. water system to authorized personnel security enhancement for your water system.
• Issue water system photo identification cards for employees, and require them to be displayed within the restricted area at all times. • Post signs restrlcllng entry to authorized
personnel and ensure that assigned staff escort people without proper ID. 7 
wellhouses and pump pits, of entry other pOints of entry to prevent access by unauthorized personnel. such as ta"nk and roof Check locks regularly. Dead bolt locks and lock guards provide
a hatches and vents kept high level of security for the cost. closed and locked? A daily check of critical system components enhances security and ensures that an unauthorized entry
has not taken place. Doors and hinges to critical facilities should be constructed of heavyduty reinforced material. Hinges on all outside doors should be located on the inside. To limit
access to water systems, all windows should be locked and reinforced with wire mesh or iron bars, and bolted on the inside. Systems should ensure that this type of security meets with
the requirements of any fire codes. Alarms can also be installed on windows, doors, and other points of entry. Adequale lighling of the exterior of water systems' critical 5. Is there
extemallighting I Ves' No' components is a good deterrent to unauthorized access and mayaround the critical result in the detection or deterrence oftrespassers. Motioncomponents of your water detectors that activate switches that turn lights on or trigger alarms system? also enhance security. !\re warning signs are an means access.
(tampering. unauthorized ·Warning -Tampering with this facility is a federal offense" should beaccess, etc.) posted on all posted on all water facilities. These are available from your
statecritical components of your rural water association. well houses and storage water system? (For example, "Authorized Personnel Only," ·Unauthorized Access Prohibited," andtanks.)
you patrol and inspect IVes' No' your source intake, buildings, storage tanks, equipment, and other critical components? Consider asking your local law enforcement agencies to conduct
patrols of your water system. Advise them of your critical components and explain why they are important. and are gates locked where appropriate? The fence perimeter should be walked
periodically to check for breaches and maintenance needs. All gates should be locked with chains ant:! a tamper-proof padlock that at a minimum protects the shank. Other barriers such
as concrete "jersey" barriers should be considered to guard certain critical components from accidental or intentional vehicle intrusion. of other siQns that mav be useful. 8 
---Yes· No' When assessing the area around your water system's critical componenls, look for objecls that could be used 10 gain entry (e.g., large rocks, cement blocks, pieces of wood,
ladders, valve keys, and other Iools). Yes • 􀁾au should clear fence lines of all vegetation. Overhanging or 8. Is the area around the critical componenls of your water system free of
objects that may be used for breaking and enlering? 9. Are the entry poinls to your water system easily seen? 10. 00 you have an alaom system that will detect unauthorized entry or attempted
entry at critical components? Yes· No· 11. Do you have a key control No·IYes' and accountability policy? 12. Are entry codes and 􀁾Yes· No' limited to water system personnel only? 13.
Do you have a neighborhood watCh program for your water system? Yes-No' nearby trees may also provide easy access. Avoid landscaping that will permit trespassers to hide or conduct unnoticed
suspicious activities. Trim trees and shrubs to enhance the vfsibility of your water system's critical components. If possible, park vehicles and equipment in places where they do not
black the view of your water system's crItical Consider Installing an alarm system that notifies the proper authorities or your water system's deSignated contact for emergencies when
there has been a breach of security" Inexpensive systems are available. An alarm system should be considered whenever possible for tanks, pump houses, and treatment facilities. You should
also have an audible alarm at the site as a deterrent and to notify neighbors of a potential threat. Keep a record of locks and associated keys, and to whom the keys have baen assigned.
This record will facilitate lock replacement and key management (e.g., after employee turnover or loss of keys). Vehicle and building keys should be kept in a lockbox when not in use.
You should have all keys stamped (engraved) "DO NOT DUPLICATE: Suppliers and personnel from co·located organizations (e.g., organizations using your facility for telecommunications)
should be denied access 10 codes andior keys. Codes should be changed frequently If possible. Entry into any building should always be under the direct WatChful neighbors can be very
hetpful to a security program. Make sure they know whom to call in the event of an emergency or suspicious activity. 9 
Water Sources In addition to the above genera/checklist for your entire water system (questions 1-13), you should give special attention to the following issues, presented In separat1J
tables, related 10 various water system components. Your water sources (surface water intakes or wells) should be secured. Surface water supplies present the greatest challenge. Typically
they encompass large land areas. Where areas cannot be secured, steps should be taken to Initiate or increase law enforcement patrols. Pay particuiar atlention to surface water intakes.
Ask the public to be vigilant and report suspicious activity. A property sealed introduction of contaminants. If you are not sure whether your wellhead is properly sealed, contact your
well drilling/maintenance company, your Slate drinking water primacy agency, your slate rural water association, or other technical assislance providers. caps can ofa into the water
supply. Ensur. that vents and caps serve their purpose, and cannot be or removed. No' Treatment Plant and Suppliers Some small systems provida easy access to their water system for suppliers
ofequipment, chemicais, and other mat1Jrials for the convenience ofboth parties. This practice should be discontinued. 􀁾􀁾􀁾􀁾􀁾􀁾􀀧􀁾􀁍􀁉􀁾􀁾􀁾􀀱􀁾􀁾􀁬􀁦􀀪􀁾􀀴􀁾􀁾􀁾􀀱􀀢􀀢􀁾􀂥􀀧􀀢􀀱􀀢􀀧􀀷􀁦􀁾􀀢􀁾􀀢
􀁯􀀼􀀬􀀬􀀢􀀬􀀭􀀮􀀬􀀢􀁃􀀢􀀧􀀡􀀮􀀧',"", "·--",i."18. Are delivenes of Chemical .. . reviewed. You should InS!?oct supplies at the time of delivery to verify they are sealed and in unopened
containers. Match all delivered goods with purchase orders to ensure that they were, in fact, ordered by yourwater s)Stem. You should keep a log orjoumal of deliveries. It should include
the driver's name (laken from Ihe driver's photo I.D.), date, time, material delivered. and the supplier's name. 10 
those that are potentially hazardous or flammable, properly stored in a secure area? raw water so that you you tank from the rest of the can may allow you to know If there has been a
contamination Incident. . If you have towers, consider putting physical bamers on the legs to unauthorized waler in storage heavy-duly screens and/or grates. operation or drain its storage
tank(s) if there is Install shul-off or bypass valves to allow you to isolate the storage tank in the case of a contamination problem or structural damage. Consider installing a sampling
tap on the storage tank outlet 10 test L-___________-l______-l_w.ater in the tank for possible contamination. 11 can detect changes In water quality? system? Some parameters for raw
water include pH, turbldily, total and fecal coliform, Iotal organic carbon, specifiC conductivily, ultraviOlet adsorption, color, and odor. Routine parameters for finished water and
distribution systems include free and total chlorine residual, heterotrophic plate count (HPC), Iota I and fecal coliform, pH, specific conductlvlly, color, laste. odor, and system pressure.
Chlorine demand patterns can help you identify potential problems with your water. A sudden change in demand may be a good indicator of contamination in your syslem. For Ihose systems
Ihat use chlonne, absence of a chlorine residual may indicate possible contamination. Chlorine residuals provide protection agains! becterial and viral contamination that may enler the
water problem or structural damage. 
Distribution Hydrants are highly visible and convenient entry points into the distribution system. Maintaining and monitoring positive pressure in your system is important to provide
fire protection and prevent introduction of contaminants. 􀁾􀁾􀁧􀀺􀁾􀁾􀁣􀁾􀀡􀁬􀁾􀁾􀁩􀁝􀁩􀁊􀁩􀁲􀁩􀀻􀀬􀁪􀀧􀀻􀁗􀁩􀀡􀀭􀀰􀀰􀀻􀁦􀀺􀁦􀁀􀁬􀁊􀀺􀁨􀀠􀁴􀁾􀁾􀁾􀁾􀀡􀀡􀀡􀀻􀀺􀁾􀁴􀁩􀁩􀂣􀁩􀀨􀀠􀁾􀁐􀀻􀁾􀀺􀁍􀀱􀀳􀀺􀀡􀀬􀀡�
�􀁉􀁜􀁜􀀱􀁾􀀡􀁩􀁩􀂥􀁾􀀧􀁩􀁩􀁊􀀮􀂮􀁭􀁩􀁦􀁽􀁅􀁣􀀧􀀧􀀧􀂧􀁢􀀻􀁦􀁩􀀺􀀡􀀧􀁩􀁦􀀡􀀬􀀻􀀻􀁧􀁢􀁩􀀻􀀺􀀻􀀺􀁗􀀻􀁊􀀻􀁾􀀻􀁜􀀻􀁇􀁾􀁩􀀲􀁗􀁛􀀰􀁽􀁆􀀬􀀧􀀻􀀲􀀡􀀻􀀬􀀬􀀧􀀬􀀠􀂣􀀴􀁣􀀻􀁴􀀨􀁃􀀺􀁴􀁾􀁾􀁦􀀡􀁾􀀬􀀡􀀡􀀡􀂢􀁾􀁦􀁴􀀴􀀧􀁾
􀀡􀁴􀁪􀀶􀀱􀁩􀀡􀀻􀁩􀀺􀁩􀀧􀀻􀁆􀀧􀀺􀁩􀀠25. Do you control the use of hydrants and valves? Yes· No· 26. Does your system monitor for, and maintain, positive pressure? I Yes· No· 27. Has
your system implemented a backflow prevention program? I Yes· No· Personnel Your water system should have a policy that regulates the authorized use of hydrants for purposes other than
fire protection. Require authorization and backflow devices jf a hydrant is used for any purpose other than fire fighting. Consider deSignating specific hydrants for use as filling station(s)
with proper backflow prevention (e.g., to meet the needs of construction firms), Then, notify local law enforcement officials and the public that these are the only sites deSignated
for this use. Flush hydrants should be kept locked to prevent contaminants from being introduced into the distribution system, and to prevent improper use. Positive pressure is essential
for fire fighting and for preventing backsiphonage that may contaminate finished water in the distribution system. Refer to your state primacy agency for minimum drinking water pressure
requirements. . In addition to maintaining positive pressure, backflow prevention programs provide an added margin of safety by helping to prevent the intentional introduction of contaminants.
If you need infonnation on backflow prevention programs, contact your state drinking water primacy agency. you request that local police perfonn a criminal background check, and do conducted
during the employee-related security issues. you verify employment eligibility (as required by the Immigration and Naturalization Service, If you use contract personnel, check on the
personnel practices of all providers to ensure that their hiring practices are consistent with good security practices. Form 1-9)? 12 
photo-Identification cards and be required to display them at times. Pholo identification will also facilitate identification of authorlzed I I water system personnel in the event of
an h3"'o".-"W"'h::-:e:::n"'t"'e::rm=ir.::n=at"in"'g;----1 Yes 􀁾􀁉􀁏􀀧􀁾􀁆􀁯􀁲􀁭􀁥􀁲or disgruntled employees have kn _ 􀁥􀁭􀁰􀁬􀁯􀁹􀁭􀁥􀁮􀁾􀀠do you require operation of your water system,
and could have both Ihe Intent and employees to turn In photo physical capability 10 harm your system. Requiring employees who ,--,-.. -----􀀭􀁾􀁾􀀭􀀭will no longer be working at your
water syslem to turn In their IDs, Yes' report suspicious keys, and access codes helps limtt Ihese types of securily breaches. issues at your facility, what to look for, and how 10 report
any suspicious events or activity. Periodic meetings of aulhorized personnel should be held to discuss issues. or Simple checklist can be used to information. Calls should be reported
immediately to appropriate law enforcement officials, Checklists should be available at every lelephone. Sample checklists are Included in Attachment 3. Also consider installing caDer
10 on your telephone system to keep a record of 􀁩􀁮􀁣􀁯􀁭􀁩􀁮􀁾􀀠calls. Information storage/computers/contro/s/maps Security of the system, including computerized controls like a Supervisory
Control ant;! Data Acquisition (SCADA) system, goes beyond the physical aspects of·operation. It a/so includes records and critical information that could be used by someone planning
to disrupt or contaminate your water Also consider contacting a virus protection company and subscribing to a virus update program to protect your records. computers regularly will help
prevent the loss of data in :r is damaged or breaks. Backup copies made routinely and storad at a secure you have Internet access should be changed every 90 days and (as needed) follOWing
employee turnover. When poSSible, each individual should have a unique password that ther do not share with others. If you have Intemet access, a firewal protection program should be
installed on your computer. software Installed on your computer? Do you have a plan to back up your computers? 13 
Web that can be used to disrupt your system or contaminate your water? secured at all times? Public Relations may You should make back-up copies of all data and sensitive documents.
These should be stored in a secure 􀁯􀁦􀁦􀁾􀁦􀁴􀁥􀀠location on a reaular basis. specifications) recorded and recovered after use. You safeguard your documents with bidders and system
secure. uses should be discuss measures to new projects. Water system vehicles should be locked when they are not in use or left unallended. Remove any critical information about the
system before parking vehicles for the night. Vehicles also usually contain tools (e.g., valve wrenches) that could be used to access critical com ponents of your water system. These
tools should be secured and accounted for You should educate your customers about your system. You should encourage them to be alert and to report any suspicious activity to law enforcement
authorities. 14 
place to 01 a suspected outbreak 01 a disease immediately after discovery by local health agencies? 4:CDo you have ii procedure in IYes place to advise the community of contamination
Immediately after discovery? No' Your personnel should be advised notto speak to the media on behall olthe water system. ()nly one person should be designated as the spokesperson lor
the water system. Only that person should . • You should establish a process lor customers and the problems with the water at any time and respond to them quickly. Procedures should
be developed in advance with )'Our state drinking water primacy agency, local health agenCIes, and your local emergency planning committee. you _ . • 􀁾􀀠􀁾􀀠􀁾􀀮􀀠􀁾􀀮􀀠the incident.
In outbreaks caused by microbial contaminants, it Is critical to discover the type 01 contaminant and its method 01 transport (water, lood, ato.). Active testing 01 your water supply
will enable your laboratory,working in conjunction with public health offiCials, to determine il there are any unique (and possibly lethal) disease organiSms in your water supply. It
is crilical to be able to get the word out to your customers as soon as possible after discovering a health hazard in your water supply. In addition to your responsibility to protect
public health, you must also comply with the requirements of the Public NotificatIon Rule. Some simple methods include announcements via radio or television, door-to-door notiftcatlon,
a phone tree, and posting notices In public places. The announcement should include accepted uses lor the water and advice on where to obtain safe drinking water. Call large laC/litres
that have large populations 01 people who 􀁭􀁩􀁾􀁨􀁴􀀠be particularly threatened by the outbreak: hospitals, nursIng homes, the schaal district, jails, large public bUildings, and large
companies. Enlist the support olloeal to assist in the effort. water quality problems reported by customers: be developed in advance to investigate and identify the causa of the problem,
as well .s to alert local health agenCies, your state drinking water primacy agency, and your local emergency planning committee Wyou discover a problem. Now that you have completed
the "Security Vulnerability Self-Assessment Guide for Small Water Systems," review your needed actions and then prioritize them based on the most likely threats. A Table to assist you
In prioritizing actions Is provided In Attachment 1. 15 
Attachment 1. Prioritization of Needed Actions Once you have completed the "Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems," review the actions you need
to take to improve your system's security. Note the questions to which you answered uno" on this worksheet. You can use it to summarize the areas where your system has vulnerability
concerns. It can also help you prioritize the actions you should take to protect your system from vulnerabilities. Make sure to prioritize your actions based on the most likely threats
to your water system. 16 
Attachment 2. Emergency Contact List We urge .11 public water systems to adopt an emergency response plan (ERP). Emergency plans are action steps to foHow if a primary source ofdrinking
water becomes eontaminated or ifthe flow afwater is disrupted. You can obtain sample ERPs from your state drinking water administrator, or from your state primacy agency. This sample
document is an "Emergency Contact Ust." It is an essential part ofyour ERP. It contains the names and telephone numbers of people you might need to cali in the event of an emergency.
This is a critical document to have at your disposal at all times. It gives you a quick reference to all names and telephone numbers that you need for support in the case ofan emergency.
Filling out this Emergency Contact Ust reminds you to think about all ofth. people you might need to contact in an emergency. It also may encourage you to talk with these people .bout
what you and they would do ifan emergency were to occur. Section 1. System Identification Public Water System (PWS) 10 Number , System Name Town/City : Telephone Numbers System Telephone
Evening/Weekend Telephone , Other Contact Information Population Served and Number of Service Connections System Fax People Served Email I , Connections System Owner (The owner must
be listed as a person's name) : Name, title, and telephone number of person responsible for maintaining this emergency contact list Name and lIt1e Telephone 17 
Section 2. Notification/Contact Information Local Notification List Fire Department Police Department FBI Field Office Health Department Primacy Agency Dislrict Office Local Hospital
Local Emergency Planning Committee EMS Local Pharmacy 􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁾􀀭􀀭􀁾􀀠Local Nursing Homes Local Schools Local Prisons Local Government Official Local Hazmat
Team Water System Operator Neighboring Water System Neighboring Waler System 􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀫􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁲􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀫􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁲􀀭􀀭􀀭􀀭􀁾
􀀠Other 18 
Service/Repair Notification List 􀀧􀁾􀀬􀁩􀁩􀁾􀁩􀀨􀁈􀁾􀀧􀁡􀁴􀁩􀁂􀁾􀁾􀁾􀁾􀂣􀁾􀁲􀁾􀁾􀁧􀁾􀁾􀁾􀀻􀁾􀁾􀀥􀁾􀁻􀂣􀁾􀀻􀁾􀀺􀁾􀁬􀁾􀁾􀀠􀁩􀁬􀁡􀁴􀁩􀁾􀁭􀁾􀁾􀁾􀁾􀁾􀁾􀀭Electrician Electric Utility Company
Gas Utility Company Sewer Utility Company I-Telephone Utility Company Plumber Pump Specialist "Dig Safe" or local equivalent Soil Excavator/Backhoe Operator Equipment Rental (Power Generators)
Equipment Rental (Chlorinators) Equipment Rental (Portable Fencing) Equipment Repairman RadiolTelemetry Repair Service Bottled Water Source Bulk Water Hauler Pump Supplier Well Drillers
Pipe Supplier􀁣􀁨􀁥􀁭􀁩􀁣􀁡􀁬􀁳􀁵􀁰􀀭􀀭􀁰􀀭􀁬􀁩􀀭􀁥􀁲􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁾􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁾􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭
􀀫􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀽􀀱􀀠Local/Regional Analytical Laboratory 19 
State Notification List Drinking Water Primacy Agency Department of Environmental Protection {or stale Department of Heallh Emergency Agency Hazmat Hotline Media Notification List Designated
Spokesperson Newspaper -Local Newspaper -Regional/Slate Radio Radio Radio Television Television Television 20 
Section 3. Communication and Outreach Communication Communications during an emergency poses some special problems. A standard response might be to call «911" for local fire and police
departments. But what if your emergency had disrupted telephone lines and over-loaded cell phone lines? Talk with your S1.te drinking water primacy agency about local emergency preparedness
and solutions to these problems. Increasingly, state emergency agencies are establishing secure lines of communication with limited access. Learn how you can access those lines of communication
ifall others fail. Outreach Ifthere is an incident ofcontamination in your water supply, you will need to notify the publie and make public health recommendations (e.g., boil water,
or use bottled water). To do this,You need a plan. How will you reach all customers in the firsl24 hours ofan emergency? Appoint. media spokesperson-a single person in your water system
who will be authorized to make all public statements to the media. • Make arrangements for contacting institutions with large numbers ofpeople, some ofwhom may be immuno..comprom ised:
Nursing homes Hospitals Schools Prisons 21 
Attachment 3: Threat Identification Checklists Water System Telephone Threat Identification Checklist In tne event your water system receives a threatening pnone cali, remain calm and
try to keep the caller on tne line. Use the following checklist to collect as much detail as possible about the nature of the threat and the description of the caller. 1. Types ofTampering/Threat:
·Contamination ·Threat to tamper • Biological · Bombs, explosives, etc. ·Chemical ·Other (explain) 2. Water System Identification: Name: Address: Telephone: . PWS Owner or Manager's
Name: 3. Alternate Water Source Available: Yes/No if yes, give name and location: 4. Location of Tampering: ·Distribution .Water Storage • Treatment • Raw Water Source • Treatment Chemicals
Line Facililies Plant · Other (explain): 5. Contaminant Source and Quantity: 7. Date and Time ofTamperlngrrhreat: B. Caller's Name/Alias, Address, and Telephone Number: 9. Is the Caller
(check all that apply): • Male • Female • Foul -Illiterate • Well Spoken • Irrational • Incoherent 22 
i 10. Is the Caller's Voice (check all that apply): • Soft ·Calm • Slurred ·Loud ·Deep • Nasal ·Old ·High ? Familiar (who did it sound like?) • Angry ·Laughing • Clear · Cracking • Slow
·Crying • Lisping • Excited ·Rapid ·Normal · Stuttering • Young ? Accented (which nationality or region?) 11. Is the Connection Clear? (Could it have been a wireless or cell phone?)
12. Are There Background Noises? • Street noises (what kind?) ! • Machinery (what type?) • Voices (describe) i I · • Children (describe) Animals (whal kind?) • Computer Keyboard, Office
· • Motors (describe) Music (what kind?) Other· 13. Call Received By (Name, Address, and Telephone Number): Date Call Received: Time of Call: 14. Call Reported to: Dat.mme 15. Actlon(s)
Taken Following Receipt of Call: i i 23 
Water System Report ofSuspicious Activity In the event personnel from your water system (or neighbors of your water system) observe suspicious activity, use the following checklis! to
collect as much detail about the nature of the actiVity. 1. Types of Suspicious Activity: • Breach of security systems (e.g., lock cut, door forced open) .. Unauthonzed personnel on
water system property. Presence of personnel at the water system al unusual hours Changes in water quality noticed by customers (e.g., change in color, odor. taste) that were not planned
or announced by the water system Other (explain) 2. Water Syslem Identification: Name: Address: Telsphone: PWS OWner or Manager's Name: 3. Alternate Water Source Available: Yes/No If
yes, give name and location: 4. Location of Suspicious Activity: • Distribution Line • Water Storage Facilities • Treatment Plant • Raw Water Source • Treatment Chemicals 24 
5. IfBreach of Security, What was the Nature ofthe Breach? Lock was cut or broken, permitting unauthorized entry. Specify location • Lock was lampered with, but not sufficiently to allow
unauthorized entry. Specify location • Door, gate, wipdow, or any other point ofenlry (vent, hatch, elc.) was open and unsecured Specify location Other Specify nature and localion 6,
Unauthorized personnel on site? Where were Ihese people? Specify location What made them suspicious? Nol wearing waler system uniforms Somelhlng else? (Specify) What were they doing?
7. Please dest'l"ibe these personnel (height, weight, hair color, cmarks): lothes, facial hair, any distinguishing 8. Call Received By (Name, Address, and Telephone Number): Date Call
Received: Time of Call: : 9. DatefTIme:Call Reported to: 10. Action(s} Taken following Receipt of Call: 25 
26 
----------------------------------------------------Certification of Completion A fmal step in completing the "Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems"
is to notify the state drinking water primacy agency thallhe assessment has been conducted. Please fill in the following information and send this page only to the appropriate state
drinking water primacy agency contact so that this certification can be included in the records that the state maintains on your water system. Public Water System (PWS) ID: SvstemName:
_____________________________________________ Address: __________________________------------------Town/City: ________________ State: ZIPCode: __________________________ Phone: __________________
Fax: ______________ Email: Person Name: ______________________________________________ _ Title: __________________________________ Addressl _______________________________ Town/City:
State: ZIPCode: ___________________________ Phone: ____________________ Fax: Email: I certify thallhe information in this vulnerability assessment has been completed to the best of my
knowledge and that the appropriate parties have been notified ofthe assessment and recommended steps to be taken to enhance the security ofthe water system. Furthermore, a copy ofthe
completed assessment wilt be retained at the pubic water system. in a secure location, for state review as requested. 􀁓􀁩􀁧􀁮􀁥􀁤􀁾_______________________________________ Date_________________
Please send this page only to the attention of the State Drinking Waler Primacy Agency. 27 
ft 􀁅􀁁􀁾􀀠United States Office of Solid Waste EPA SSO·F-Oi·OOS ....􀁾􀀠Environmental Protection and Emergency Response Augusl2001 􀁾􀁾􀀠􀁾􀁟􀁁􀁾􀁧􀁾􀁏􀁏􀁟􀁾􀁾______________􀁾􀁾􀁾􀁩􀁾􀀰􀀴􀁾􀀩________
_________􀁷􀁷􀁷􀁾􀁾􀁾􀁾􀁰􀀽􀁡􀁾􀁾􀁾􀁯􀁶􀁾􀁬􀁣􀁥􀁾􀁰􀁾􀁰􀁯􀁾___ CEP. LEPCs and Deliberate Releases: Addressing Terrorist Activities in the Local Emergency Plan In recent years, the threat
of terrorist incidents Involving chemical and biological materials has increased. Local emergency planning committees (LEPCs) should consider the possibility of terrorist events as they
review existing plans and consider how to incorporate counter-terrorism (CT) measures Into their plans. CT planning and preparedness Is often an extension of existing activities, rather
than a totally new efforL This factsheet discusses how LEPCs can incorporate CT Issues when they review and update their local plans. This factsheet builds on the National Response Team's
Hazardous Materials Emergency Planning Guide (NRT1) and supersedes "Thinking Thinking abut Deliberate Releases: Steps Your Community Can Take." BUILD ON CURRENT ACTIVITIES Local emergency
planning committees (LEPCs), established under the Emergency Planning and Connnunity Right-to-Know Act (EPCRA), prepare and maintain comprehensive emergency plans. These plans address
the extremely hazardous suhstances listed under EPCRA as well as thousands of hazardous chemicals for which OSHA requires Material Safety Data Sheets. Many LEPCs are already addressing
CT, even if they do not use the word "terrorism." Ifyou have developed a plan for possible accidental releases of chemicals in your community, you can use the sarne general planning
principles for deliberate releases caused by terrorists. Vou may need to spend some time considering biological agents. This factsbeet includes some suggestions for how you can modify
your current activities to include deliberate cnemical and biological releases. MAINTAlN BROAD-BASED MEMBERSHIP LEPC membership includes a wide variety of stakeholders, such as as elected
State and local officials; police; fire, civil defense, public health, environmental, hospital, and transportation officials; representatives offacilities where chemicals are stored
or used; conununity groups; public works departments; and the media. Identify any specific roles each of these groups might have in the event of a terrorist attack. In addition, you
might add a few new members who would bring specific expertise during a release involving biological agents (e.g., the coroner, morticians, chemistry and biology labs, university experts).
UPDATE AND REVISE YOUR PLANS LEPCs should review their emergency response plans annually. Before you begin specific consideration of CT issues. ensure . that your emergency plan is up·to-date.
Simply adding CT materials to an outdated plan will not create an effective emergency plan. For example, review your plan for outdated contact information, unique hazards presented by
facilities that may have been constructed after the emergency response plan was first written, or new public works facilities. Also review the annual inventory reports filed under EPCRA
Section 312 to detennine ifnew chemicals or hazards are present in your conununity . Chemical Emergency PreparednC13S alld PnMlJltioll OiPce 
Page 2 LEPCs and Deliberate Releases August 2001 In addition, check rusk Management Plans submitted by facilities in your cornmUllity to ensure that you address the specific hazards
identified by each facility. After you have generally updated your plan, consider adding information and procedures related to potential terrorist incidents involving weapons of mass
destruction (WMD). Table I (page 6) defines each ,type ofWMD and explains the consequencesand response difficulties associated with each type. , One overall difference in dealing with a WMD incident is that law enforcement officials will be involved in the response as investigators.
Officials from local, State, and 􀁆􀁥􀁤􀁥􀁾􀁡􀁬􀀠agencies will be on the scene of an incident to collect evidence and interview survivors. Their priorities may create emergency response
coordination challenges that your LEPC should address in its plan, This portion of the factsheet suggests changes you can make to specific sections ofyour emergency plan. Emergellcy
Contact In/ormation In the event ofa terrorist inCident, rapid and secure communications will be crucial to ensure a prompt and coordinated response. Your plans should include current
contact infurmation for frre, emergency medical services (EMS), law enforcement, medical, and other local departments and supporting organizations, Contact information for State officials,
including those at public health agencies, the State Emergency Response Commission (SERe), State Police, and emergency management agencies also should be included. The emergency assistance
telephone roster in your emergency response plan should include regular phone numbers, cell phone nwnbers, pager numbers, and other emergency contact information for those individuals
(Federal, State, local, and private sector) who have specific CT functions. The National Response Center (NRC) continues to be the sole Federal point ofcontact for reporting oil and
chemical spills, and now provides the service of the Chemical and Biological Hotline. The NRC telephone number (800-424-8802) should be part of your emergency plan. NRC Duty Officers
take reports ofactual or potential domestic terrorism and link emergency calls with the Department of Defense (DOD) for technical advice on dealing with weapons of mass destruction and
with the FBI to initiate the Federal response actions. The NRC also provides reports and notifications to other Federal agencies as necessary, AI[ local plans should also include contact
information for the local FBI Field Office. Response Functions Incident ConnnandlUnified Command. Your emergency plan should address direction and control of responders in the event
of terrorist attack. Local responders respond to an incident scene and should notify local, Slate, and Federal authorities ifterrorism appears to be involved. Local response authorities
(such as a senior fire or law enforcement official) should establish control ofthe incident scene. The Incident Command System (lCS) that is initially established will likely transition
into a Unified Command (UC). The UC structure used at the scene will expand as mutual-aid partners, and Slate and Federal responders arrive to assist with response operations. The FBI
is the overall Lead Federal Agency (LFA) for a domestic terrorist incident involving WMD and will lead the crisis management activities (including law enfurcement activities) ofthe response.
The Federal Emergency Management Agency (FEMA) is the lead agency for coordination of Federal support 10 Slate and local responders during consequence management activities of the response.
Although the FBI is always involved in response to a credible terrorist threat or attack, FEMA support is provided only after a Presidential declaration, typically after State and local
agencies request their assistance. Consequence management includes measures to protect public health and safety after an explosion or release; reslore essential government services;
and provide emergency relief to governments, business, and individuals. When crisis management activities have been completed, the U.S. Attorney General may transfer the overall Lead
Federal Agency role to FEMA. EPA, the Department ofHealth and Human Services (DHHS), and DOD also have specific CTrelated functions. EPA's role in counter-terrorism activities is descnbed
in a factsheet by that name. available at www.epa.gov/ceppolct-publ.htm#factsheet. 􀀰􀀱􀁾􀁜􀀠Printed on recycledpcrpel'''= 
Page 3 LEPCs and Deliberate Releases AUgust 2001 Public Infonnation. Rapid and secure communications help to ensure a.prompt and coordinated response to terrorist activities. Therefore,
strengthening communications among emergency responders, law enforcement officials, clinicians, emergency rooms, hospitals, and mass care providers is extremely important Your emergency
plan should include the use ofaccurate and timely public notification measures and warning systems in the event ofa terrorist attack. Work in advance with local news media representatives
to ensure their cooperation at the time of an incident. Ongoing communication ofaccurate and up-to-date information will help calm fears and limit the effects of the attack. The FBI
will establish a Joint Information Center (JIC) to coordinate the collection and dissemination ofpublic information. EPA's Role in the Federal Response Plan The mUlti-agency disaster
response program that helps states during and after a disaster is the Federal Response Plan (FRP), which groups Federal assistance into 12 functional areas called Emergency Support Functions
(ESFs). EPA is the primary agency for ESF 10, Hazardous Materials, which provides for a coordinated response to large-scale releases of hazardous materials by incorporating the response
mechanisms of the National Contingency Plan (NCP). EPA assists in determining what sort of hazardous snbstance may be, or has been, released in a tertorist incident, and follows up with
response to the incident, assisting with environmental monitoring, decontamination, and long-term site cleanup. Activities ofhuman services organizations, such as the Red Cross, should
be included in the emergency plan. Among other activities, these organizations may use public infonnation systems to provide human services information to the community, perform crisis
counseling, provide insurance information and assistance, and provide translation services. Public and First Resoonder Health and Safetv. Your emergency plan should address public health
and medical issues as they relate to terrorist events. The plan should include rrocedures to identifY and treat victims, store and distribute antidotes, and bandle fatalities. Mass care
issues that llllIy be different during a terrorist WMD event include decontsmination, multihazardlmultiagent triage, mortuary services, and notifYing and working with families of any
fatalities. The emergency plan should also consider the personal safety ofemergency responders in the event ofa terrorist attack. A terrorist chemical, biological, or radiological release
may not be immediately known or apparent. Caregivers, emergency response and law enforcement persOImel, and other first responders are in danger of becoming casualties before anyone
realizes that a crime has occurred. Incidents could escalate quickly from one scene to multiple locations and jurisdictions. The emergency plan should be flexible enough to accommodate
evacuation or in-place sheltering. Evacuation may be required outside the perimeter of the scene to to guard against further casualties from contamination by a released agent or from
the possibility ofadditional WMD. In-place shelteriog may be required if the area must be quarantined or if people are safer in a particular location. Hazards Analysis The hazards analysis
section of an emergency plan should identify potential hazards, determine the vulnerability of an area as a result ofhazards, and assess the risk ofa hazardous materials release or spill.
In the identification step, you should consider explosive, chemical, biological, and nuclear WMD as potential hazards. As you conduct your hazards analysis, identifY potential targets
and review their vuInerability to attack. Consider the population, accessibility, impact on daily life, economic iropact, and symbolic value of areas at risk. Terrorists and criminals
who want to attack a particular group based on a conflict with their personal beliefS might target Federal, State, or local govenunent offices and facilities, health clinics, or religious
structures. Those who want to cause maximum casualties might target public gathering places (such as sports and entertainment complexes or tourist attractions), modes of transportation
(such as buses and trains -including subways), routes of transportation(including bridges), or transportation facilities (such as airport terminals). In order to damage infrastructure
and interrupt day-to-day functions, a terrorist might target utilities or water and wastewater treatment plants. LEPCs should also consider emergency procedures in the event of Chemical
Emergency PI"epanulne55 and Preventi(m Office @Printed OIl r7Jc.;-c1e.d paper 
Page 4 LEPCs and Deliberate Releases August 2001 multiple, or simultaneous, terrorist attacks. Terrorists might target first responders (e.g., fire houses, police department offices,
response vehicles, and individuals) to hinder them from responding to another terrorist incident. A terrorist may seek to transfonn a target into a weapon by focusing on facilities that
handle explosive, toxic, or volatile chemicals. Because most public buildings and public areas must be accessible to everyone, they are highly vuinerable to attack. Other facilities,
such as water treatment plants and industrial facilities, especially those with chemical or explosives storage, should have site security measures in place. You may want to discuss site
security measures with these facilities to ensure that they are adequately protected. You may want to ask the facility the following questions: • Is the facility or critical equipment
and chemicals protected by fences or buildings? • Are there systems to detect intruders (e.g., patrols, video surveillance)7 • Are there alarm systems? • Is access to the critical areas
controlled? Do not, however, include details of the security systems in your emergency plan, because it is available to the general public. Public works facilities and workers will assume
a support role, ifsO requested by State and local agencies. This support role might include damage assessment, debris clearance, search and rescue, traffic control, restoration oflifeline
systems, building inspection, provision ofpotable water and sanitation services, and flood control. For more information on site secority, read CEPPO's Chemical Safety Alerts Chemical
Accident Prevention: Site Security (EPA K-550-FOO-002) and Anhydrous Ammonia Theft (EPA-F-OO-OO5), available at www.epa.gov/ceppo/p-smaILhtm#alerts. Mitigation Procedures and Ongoing
Assessment Mitigation procedures and ongoing assessment involve consequence management activities to assess and protect the public from further exposure to hazards presented by terrorist
activities. Pnblic health officials, hazmat teams, coroners and/or medical examiners, and criminal investigators should work together to mitigate residual hazards as well as identifY
potentially large numbers offatalities. Federal assistance should be available to support this task. Ongoing assessment activities may include enviromnental sampling ofair, water, and
soil, and insect and animal screening for chemical, biological, or radiological agents. The criminal investigation of a terrorist attack will be a joint effort that includes many agencies.
In the event of a biological attack, an epidemiological investigation may also be performed to assess the distribution of cases and sources ofoutbreak. The emergency plan could include
a checklist ofbasic questions to ask when conducting interviews with victims in hospitals, sick officers, and other individuals in affected population groups. (It may be necessary to
train people in how to ask such questions appropriately in stressful circumstances.) Equipment Your emergency response plan should include standard operating procedures on when to use
specialized WMD response equipment. Local responders should he trained to use, maintain, and calibrate this specialized equipment. The Department ofJustice's Office for State and Local
Domestic Preparedness Support (OSLDPS) provides equipment grants and technical assistance to eligible communities. Visit their website at hltp:llwww.ojp.usdoj.gov/terrorismlfunding.htm
for more information and grant application kits. Training The 1996 Nunn-Lugar-Domenici (NLD) legislation authorized funding to fonn a Domestic Preparedness (DP) training initiative.
This initiative was recently transferred from DOD to the Department ofJustice (DO]), and includes a range ofspecialized courses, from basic awareness to discipiine-specific advanced
level training and exercises. Training is available for identified cities and is directed at a broad spectrum of emergency responders from a variety of response disciplines, including
fire, hazardous materials, law enforcement, emergency medical services, public health, emergency management, and public works. Additional advanced level courses involving the use of
real-time experiences, live agents, and explosives are taught at cutting edge training facilities. Chemical Emergency Preparedlless QlJdPreYi'mljoll Office @Printed 011 recycled􀁰􀁡􀁰􀁣􀁾􀀠
Page 5 LEPCs and Deliberate Releases August 2001 The NLD DP Program also inclndes three exercises: a chemical weapons tabletop. a biological weapons tabletop, and a chemical weapons
full-scale exercise. Both types of exercises allow participants to test their knowledge and training, as well as increase the overall preparedness of responders across the jurisdiction.
FEMA independently offers the following: • Course materials on WMD and preparedness and response for terrorist incidents that can be dnwnloaded from www.fema.gov/erni/termng.htm. • A
terrorism consequence management course at their Mount Weather Emergency Assistance Center. Contact the training officer in your State Training Office ofEmergency Services for information
on course schedules and application procedures. A list ofoffices and contact information is located at www.fema.gov/erni/sttrgo.htm. • Information on the Incident Command System (lCS)
training conducted by each State TraiuIng Office of Emergency Services. Visit www.fema.gov/erni/nrcrs.htm for more details. • In conjunction with the National Fire Academy, an independent
study course in emergency response to terrorism, located at www.fema.gov/emilcrslist.htm. RESOURCES LEPCs seeking assistance in terrorism-related emergency planning should begin with
their SERCs. The SERC can direct LEPCs to appropriate assistance at the national and State level, and may be able to facilitate LEPCs in a given region working together to address possible
terrorist activities. There are currently many Federal agencies involved in some aspect ofcounter-terrorism. Many of these agencies support websites. Because of the continual changes
in the world ofCT, however, many websites become outdated or are even discontinued without warning. Therefore, we recommend that LEPCs consult EPA's Chemical Emergency Preparedness and
Prevention Office (CEPPO) website at www.epa.gov/ceppnlcntr-ter.htmI.This address is updated every two months and includes the latest links tu the following types ofinformation: Federal
departments and agencies, health and medical, technical information and resources, and international sources. For More Information: Contact the EPCRA Hotline at: (800) 424-9346 or (703)
412-9810 TDD (800) 553-7672 Monday. Friday, 9 AM to 6 PM, EST Visit the CEPPO Home Page at: www.epa.gov/ceppnl Chemical Emmgl!lJc)I Pn?paredm}ss andProvelftJon Offia @Printed on recycled
pape" 
Page 6 LEPCs and Deliberate Releases August 2001 Table 1 Weapons of Mass Destruction (WMD) Definitions, Consequences, and Response Difficulties Type of Definition (aCCflrding to Title
18, Consequences Response Difficulties WMD USC 2332a) Explosives Any explosive, incendiary, or Deaths, injuries. damaged Similar to that of other explosions poison gas bomb. grenade.
rocket structures and lerge fires ... missile ... mine or device similar to the above Chemical Poison gas, blister gas Biological Any weapon involving a disease organism Nuclear Any
weapon that is designed to release radiation or radioactivity at iflevel dangerous to human life Deaths. injuries, possible contamination, possible long-term effects Deaths, injuries,
contamination, long"term, 􀁦􀁡􀁲􀁾􀀠reaching geographic effects Deaths, injuries. contamination, possible long-term, far-reaching effects Similar to accidents planned for in current
LEPC emergency response plan, but could be more extensive in effect (e.g., VX release in a crowded convention center or school) Agents may be unknown; Locations may vary and multiply
as people travel Similar to that ofother explosions and large fires plus radiation; could have long-term far-reaching effects i ChemicalEmlfl'gl!lIcJ' PreparedJJess Gild PrevemioJJ Office

DRINKING WATER SYSTEM EMERGENCY RESPONSE GUIDEBOOK August 2001 Kim Dyches Emergency Response Coordinator Division of Drinking Water 
TABLE OF CONTENTS Page INTRODUCTION 3 NORMAL PROBLEMS 4 ORGANIZATION Lines of Authority Classification of the Emergency or Disaster Facility Damage Assessment Map of the Drinking Water
System and Facilities 4 IMPLEMENTATION General Information Emergency Medical Facilities Emergency Assignments Emergency Personnel Roster Fire Fighting /Law Enforcement Agencies 9 PRIORITIZE
WORI</REPAIR NEEDED General Information Possible Emergency Equipment and Material Rosters Maps of Critical Water Needs by Service Areas 11 DISPATCHING PERSONNEL AND EQUIPMENT Emergency
Assignments Emergency Personnel Roster 13 REQUESTS/RESPONSE FOR EMERGENCY AID Authorization to Request and to Provide Assistance Commercial Suppliers of Equipment and Materials Neighboring
Agencies and Agreements 14 PUBLIC NOTIFICATION/PRESS RELEASES General Information News Media Contacts 14 2 
16 RECOVERY CHECKLIST 3 
INTRODUCTION The purpose of this guidebook is to assist the drinking water system management prepare a disaster andjor emergency response plan. Itis not meant to be a guide for routine
complaints or system maintenance problems. These issues should be dealt with by policy established by the drinking water system management. A disaster or emergency can strike any drinking
water system at any time. In preparing your response plan keep in mind that when, not it an emergency or disaster occurs, drinking water will become one of the top priorities in emergency
medical services, fire fighting, sanitation, and general recovery of the emergency or disaster. In designing your response plan keep it as simple and practical as possible. A complicated
plan will only add to the confusion, and that's exactly what you don't want to happen! After you have designed your drinking water system's "Emergency Response Plan," train the system
personnel. Mistakes made during training and rehearsals don't cost much, butmistakes made during the "real thing" could easily cost lives! Re-training or rehearsing the emergency response
plan every 6 months will help new personnel become familiar with their role in the emergency plan, and will remind the experienced personnel of their role and perhaps identify areas
of the plan that need improvement. Tabletop exercises are excellent ways to rehearse each individual role. There are excellent training resources available to assist you in developing
your emergency response plan. The American Water Works Association publishes a manual entitled, Emergency Planningfor Water Utility Management (M19), which is available as well as an
excellent video entitled, Emergency Planning: The Big Picturefor Water Utilities. These and other helpful publications are available by contacting the American Water Works Association
at 1-800-926-7337. The Rural Water Association of Utah, the Intermountain Section of the American Water Works Association, and the Division of Drinking Water can provide additional assistance.
assistance. 4 
NORMAL PROBLEMS During the course of normal operations a drinking water system will have problemssome minor, some major. Take, for example, a major backflow incident: • What should I
do? Should I notify the public? If yes, do I just notify the area that is contaminated or everyone on the whole system? And how do I go about putting out an emergency notice to my consumers?
• Should I flush the system now, or isolate it, or get sample results first? Should I let anyone know about the problem (Local and/or State Health Departments), or should I keep it to
myself? . These are the questions that should be thought out now! And a plan must be drawn up and used when a problem occurs that will directly affect the safety of the drinking water
system. This booklet will help design such a pIan, and help you plan for a major emergency or disaster. ORGANIZATION Lines ofAuthority Initial reaction to any emergency or disaster will
be confusion. Therefore, a preplarmed line of authority, including alternates in case the key people are unavailable, must be designed and ready for immediate implementation, with those
individuals in these positions being aware of their deSignated authority during an emergency operation. An office or area should be set aside and designated as an Emergency Command Center.
The Command Center should be equipped with telephones, radios, drinking water system maps and records and any other emergency equipment, which may be needed. During any emergency situation
the Emergency Command Center would be activated and the personnel listed below would report for duty to the Command Center rather than their individual offices. 5 
. Types of authority positions could include: 1. Emergency Coordinator: This individual would coordinate all emergency actions, water system personnel and equipment within the drinking
water system. The Emergency Coordinator will also coordinate with the law enforcement, fire fighting, medical personnel, and any other requests for aid, volunteer efforts, mutual assistance
(other neighboring water system personnel or equipment and any contracted private assistance) (the Emergency Coordinator is usually the Water Superintendent or equal). 2. Public Relations
Coordinator: This individual would be responsible for news releases to the media, issuing emergency information bulletins to the public, and act as liaison between the drinking water
system and general public in answering questions and addressing concerns (the Public Relations Coordinator is usually the Mayor or Public Relations Specialist). It is essential that
the Emergency Coordinator and the Public Relations Coordinator work closely together. It is also important that they be separate individuals because at the onset of any emergency a lot
of people need to be mobilized in a coordinated effort (directed by the Emergency Coordinator) and the press and public need answers to their questions. Initially the Public Relations
Coordinator will probably only be able to say, "This event has occurred, and we are taking the following actions, (list the actions), and we will report more as we know more". The Emergency
Coordinator will then feed information from the field to the Public Relations Coordinator, who then responds to the questions and concerns of the public and news media. 3. Assessment
Coordinator: This individual would coordinate the inspection of . all drinking water system physical facilities to determine the degree of damage to the facility and in coordination
with the Emergency Coordinator, prioritize the repair, replacement or abandonment of any system physical facilities. 4. Crew Foreman: This individual would coordinate, supervise and
schedule personnel, equipment and materials to facilitate the repair or replacement of critical drinking water system facilities which have been identified and prioritized by the Assessment
and Emergency Coordinators. There may be several Crew Foremen ifthere are multiple sites of concern, or multiple crews working in the field. For some very small water systems, all ofthese
functions may be the responsibility of 6 
one individual. In those situations, Board or Council members, clerical staff or even other interested volunteers must be trained and knowledgeable about the system and the response
plan in the event that the operator is unavailable to respond during an emergency. Classification ofthe Emergency or Disaster Classifying the degree of the emergency or disaster will
help in properly prioritizing activities and speeding the response time to implement the response plan. The classification phase, conducted during a training exercise will also be helpful
in designing the training of the drinking water system personnel in their part of the emergency plan. Remember that mistakes made during the training don't cost much, but mistakes made
during the "real thing" could cost lives! The classification of the emergency or disaster will be the decision of the Emergency Coordinator, which will be communicated by radio and/or
telephone to the other personnel of the drinking water system: LEVEL I -NORMAL (ROUTINE): Personnel and equipment presently on duty can handle system problems. The "Emergency Command
Center" not activated or manned. LEVEL II -ALERT (MINOR EMERGENCy): Personnel and equipment presently on duty can handle system problems, but may require off duty or additional personnel
to be put on alert, be re-routed to other than their normal working areas, or work additional shifts. The "Emergency Command Center" activated and manned. LEVEL ill-MAJOR EMERGENCY:
Problems somewhat beyond the capabilities of the drinking water system personnel and equipment, and may require a "Declaration of Emergency" to authorize shortcut procedures. Requires
employees to work additional shifts and may need additional assistance of personnel and equipment, either by mutual aid or private contracts. The "Emergency Command Center" activated
and manned. LEVEL IV -DISASTER: Problems clearly and immediately beyond the capability of the drinking water system. Recovery time will exceed one week, costs will be great, 7 
large amounts of assistance of personnel and equipment by mutual aid or private contracts will be required, extended shifts will be needed for at least one week. A "Declaration of Emergency"
will be required; the "Emergency Command Center" activated and manned. Facility Damage Assessments The "Assessment Coordinator" will determine the preliminary damage assessment priorities.
The physical status of all physical facilities must be assessed. The need to repair, replace, or abandon drinking water physical facilities is required at this point. Be sure to include
an estimate of cost, including manpower and equipment, to restore the facility in order to help prioritize the repair work. The Assessment Coordinator must consider the possible after
effects ofthe repairs or replacement ofthe facilities, on the integrity ofthe drinking water system itself after the emergency. For example, a structural repair to a water storage tank
may introduce chemical or bacteriological contamination into the drinking water. Reservoirs: Check for seepage, leaks, cracks or problems with the reservoir itself. Landslides, embankment
slumps, broken inlet-outlet pipes or underdrains could effect the stability of the reservoir itself. Estimate the remaining amount of water in the reservoir. Deep Wells and Booster Pumps:
Check power supplies, pump or motor failures, physical damage to piping or electrical controls. Check the building or structure for integrity of pump operations. Distribution and Transmission
pipelines: Check all air vacuum relief valves. Check for visible leaks, cracks, breaks, and pressure loss in pressure zones. Check automatic valve failure (pressure reducing, pressure
sustaining, pressure relief, high altitude, solenoid controlled, etc) and all other facilities that would be useful in gauging the integrity of underground piping, including fire hydrants.
Identify pressure zone valves and isolation valves in order to supply, divert, or isolate drinking water in the system. Drinking Water Treatment Plant: Check the quality quality of the
influent and surrounding water shed for signs of chemical spills or releases, and any changes in the raw 8 
water quality, dosage rates of chemicals, disinfection levels and all equipment. Also check for any structural damage within the facility along with the power supply, electrical equipment
and the condition of the mechanical equipment. After the completion of the preliminary damage assessment the Assessment Coordinator and the Emergency Coordinator will then decide which
damaged drinking water facility receives priority repair or replacement. This process of assessment and responsecoordination is usually quite informal and is facilitated by the nature of the emergency. For example, a staff member is informed of, or discovers a situation; he then reports it to
his supervisor (the Emergency Coordinator) who then agrees with or expands the assessment and directs the employee to do some action. The Emergency Coordinator then works on mobilizing
additional resources and sets up the command center. The determination of priorities should be based on: 1. The unique design of the drinking water system. 2. Medicaljemergency care
requirements. 3. Drinking water and sanitation needs of the public. 4. Fire fighting requirements. 5. How much good drinking water is remaining in the system reservoirs? 6. How to transport
that water to where it is needed the most. Pre-planning in this area could save the Assessment and Emergency Coordinators a lot of worry and hassle. Ifthe situation is thought through
clearly now, rather than during an emergency, much better decisions will be made. MAP OF THE DRINKING WAlER SYSTEM AND FACILITIES Inyour emergency response plan, inventory your system
and identify the elements that would be most susceptible to damage in any emergency situation. Consider the different types of emergencies such as earthquakes, floods, explosions, traffic
accidents, sabotage, and fires. Also consider susceptible facilities such as: underground storage tanks, booster pump stations, high pressure zones or areas, or any other facilities
that are readily susceptible to damage and are also of a high repair priority. Also identify pressure zone valves and isolation valves to be used to divert, supply or isolate drinking
water. IMPLEMENTATION 9 
General Information Announce to employees the activation of the Emergency plan, using radio, telephone, or by any other means and have employees meet at their designated staging areas.
Maintain a written log of messages and directives given during the emergency. This will help reduce confusion in the Emergency Operation Center and will also help in preparing the "After
Emergency Follow-up Report", particularly if outside aid and assistance were requested. Plans should be in place for the use of volunteers who may show up to help. Water system personnel
should supervise volunteer work so that it can be done safely. Document the cost for supplies and equipment. Tracking all of the labor performed by system personnel and volunteers is
essential in the event an emergency is declared a disaster. This will help in receiving reimbursement money from State and Federal agencies. Individuals responding to telephone and other
contacts must be briefed on the proper response to give customers and concerned callers. All information released must be coordinated through the Emergency Coordinator. Everyone contacting
the agency should receive the same information. Ensure that radio communication is limited to vital messages only. Direct and control radio channels by stating call number and announcing
an emergency message is to be sent. Liaison personnel should report to the proper Emergency Operation Center (City, County, District). Maintain communication with the EOC by making status
reports at least once per hour during the emergency, however, some emergencies may require more frequent reporting. Emergenr;y Medical Facilities Maintain a roster of emergency medical
treatment facilities in your area for ease of maintaining drinking water supplies, transporting drinking water from another source, or transporting injured personnel. A source of drinking
water (even bottled water) will be critical to emergency medical centers. 10 
EmergenCJJ Assignments Ensure all personnel are aware of the drinking water system emergency response plan, and their part in it. Personnel must be aware of the level of the emergency,
staging areas, lines of authority, and their direct place within the organization. In the event of an emergency or disaster, the employees will naturally take care of their families
first. Provisions should be made to assure water system personnel that their immediate family members have been accounted for. Plans should include assisting employee's families in getting
food, water, shelter and clothing. Employees will be better focused once their families have been taken care of. Staging areas should be set up so all personnel know where to report
to work when they are able. Alternate areas should be assigned in the event a staging area is unsafe. EmergenCJJ Personnel Roster Maintain a roster of personnel within the drinking water
system for emergency response notification. This list must be updated with the individual's name, name, address, phone number, emergency job assignment, and primary staging area. Issue
identification cards to those employees who may reqUire access to private property, cross police or fire lines, or who are authorized to request or grant mutual aid. This roster will
ensure proper lines of authority and communication is being used. During the emergency, be sure ALL personnel working in the drinking water system are placed on a duty roster, and appropriately
tracked. This will ensure that they are being rotated for rest and food, and to keep track of where they are within the drinking water system should they be needed elsewhere, or should
they get injured and need help. Fire Fighting/Law Enforcement Agencies Maintain an updated listing of contacts within the local and neighboring fire fighting and law enforcement agencies,
including their phone numbers and Emergency Operation Center personnel, radio frequency, radio call signs and the EOC phone numbers. This listing and coordination will be critical for
cooperation of the limited facilities and materials, particularly personnel, during the emergency. 11 
••• Maintain a currentState and County Emergency Operation Center listing withinyour area. These agencies can help provide technical expertise, personnel, equipmentand laboratory liaison.
PRIORITIZE WORIV'REPAIR NEEDED General Information Be aware that fire-fighting activities will seriously deplete drinking water supplies. This may mean that drinking water will have
to be imported from other systems into your area. It can also mean that contamination could be drawn into the drinking water system due to low or negative pressures. Consequently, the
drinking water system management should consider this situation and plan for contingencies. As a worse case scenario, preserve the remaining water in storagel If need be, limit fire
fighting capabilities in critical water shortage areas. The fire fighters won't like it, but drinking water is top priority. Isolate areas that will take the longest to restore service
and arrange for emergency water distribution: •••• • Establish drinking water distribution points and and ration remaining water. • Locate bottled water distribution points to serve
immediate water needs. • Arrange for trucks and trailers with water tanks (National Guard Units) for water distribution. Identify the areas that canbe served with a minimum ofrepair
and then prioritize the other service areas that will need more extensive repair. Every area has its own general type of emergency or disaster, earthquake, periodic flooding and etc.
Therefore, you can identify areas that will be more susceptible to damage and even, to an extent, what type of damage the area will have. Set priorities on the repair work. In so doing,
consider the follOWing: • Prepare a plan to restore each service area. • Planto restore the service areas one by one, not the entire system at once. 12 
• Get input and advice from other agencies (local, county and state) on essential uses. • Take into account the condition of the transmission lines from the water sources. • Keep in
mind the need for fire fighting (even ifit will be limited). • Determine if imported water is available and how to distribute it. • When the repairs exceeds the capabilities of your
water system, notify the County or State Emergency Operation Center for assistance and coordination of assistance. Possible Emergency Materials and Equipment Maintain a current listing
of those agencies, private companies or manufactures within your local area that can provide assistance during an emergency. This assistance can be in materials, equipment, vehicles
and/or trained personnel. Maintain emergency agreements or contracts with these private companies so they are aware of their part of your emergency 􀁰􀁬􀁾and that basic costs of materials
or equipment have been agreed upon, and who is authorized to activate those agreements or contracts. Maintain these agreements and contracts at the E.mergency Operation Center for quick
access. Willingly agree to assist neighboring water utilities in the event they have an emergency. Maps ofCritical Water Needs by Service Areas Maintain an updated map of critical water
needs within each service area and maintain the maps at the Emergency Operations Center. The maps should include the locations of fire fighting equipment, medical facilities, preplanned
imported water distribution pOints, pressure zones, booster pumps stations, and drinking water sources. 13 
DISPATCHING PERSONNEL AND EQUIPMENT Emergency Assignments Ensure every affected individual is aware of the drinking water system's emergency response plan and their part in it. Personnel
must be aware of the level of emergency, staging areas, lines of authority, and their direct involvement within the emergency organization. The Emergency Coordinator will advise the
Crew Foremen as to the work assigrunents. The Crew Foremen will assign additional personnel (including volunteers) to the work crews, as needed. Emergency Personnel Roster Maintain a
list of personnel within the drinking water system's emergency response plan and their slot within the emergency organization. This list must be kept updated with the individuals home
phone number, address, and primary and alternate staging areas. Issue identification cards to those employees who may require access to private property, cross fire or police lines,
or those who are authorized to request or grant mutual aid and assistance. This procedure ensures proper proper lines of authority are being used. Ensure that every person working within
the drinking water system, including all volunteers, are placed on a personnel roster which is organized by work crews, and maintained at the Emergency Operation Center. This will help
ensure all personnel are being rotated for rest, food, and to keep track of where they are within the system should they be needed elsewhere, or ifthey get injured. 14 
REQUESTS/RESPONSE FOR EMERGENCY AID Authorization to Request and to Provide Assistance Pre-authorization of the position to request or to provide emergency assistance within the drinking
water system would enable the Emergency Coordinator the latitude to ensure all possible areas of assistance have been involved within the response effort. . The elected officials of
the drinking water system should do this pre-authorization, with advice from legal council. Itshould be passed as an ordinance or policy so that the designated person has the authority
in writing for confirmation ifneeded. Commercial Suppliers ofEquipment Materials A listing of commercial suppliers of equipment and materials within your local area should be kept up-to-date
and available to the Emergency Coordinator. NeighboringAgencies and Agreements A listing of neighboring drinking water systems and government agencies and contact people within them
should be kept at the Emergency Operation Center. This list should include the types of specialized equipment, vehicles and trained crews that would be available if needed during an
emergency. A bilateral agreement of Emergency Aid and Mutual Assistance should be negotiated with these systems and agencies. PUBLIC NOTIFlCATION/pRESS RELEASES General Information •
The release of information to the public and news media must be accurate and issued through the Public Relations Coordinator. The type of information given will vary with the drinking
water system and the type ofemergency, but a generalized list must include: • Centralized New Releases and statements to avoid contradictory or confusing statements. • When responding
to questions make only factual responses, never guess, speculate orexaggerate. Ifyou don't know the answer to a question, tell the reporters "I don't know", and then give them an indication
of when 15 
you might know or an explanation as to why the answer is unknowable. ,. Inform the public of any possible contamination of the drinking water and resulting boil orders. • Inform the
public of the availability and location of alternate sources of drinking water. • Implement drinking water rationing. • Arrange for an escorted news media tour. Only those media representatives
who have proper identification should be allowed within the work areas or facilities, and only with an escort. These tours must be pre-authorized by the Emergency Coordinator and Public
Relations Coordinator. For safety reasons, do not allow the news media to wander around the work sites. 16 
• RECOVERY CHECKLIST Designate a Post Emergency Coordinator The Post Emergency Coordinator's duties would include the following: • Document all contracts, agreements and emergency work
or materials used during the emergency to ensure proper payments and reimbursements. • Conduct a detailed safety inspection of the drinking water system facilities. • Coordinate the
completion of all emergency repairs and schedule permanent repairs to the service area. • Notify key agencies (local and state health departments) of emergency repair status and the
scheduled completion of the system repairs. • Release repaired facilities and equipment for normal usage. • Replace or authorize replacement of materials and supplies used during the
emergency. • Complete permanent repairs and replacements of the system facilities. 17 
This emergency response guidebook was written as a guide for the drinking water system personnel to help them prepare and maintain their own emergency/disaster response plan. Because
each drinking water system is so unique, it does not cover every aspect of a response plan; therefore, a response plan must be designed by those individuals who are directly involved
in maintaining that particular drinking water system. If we can be of any service or assistance, either in the design of the emergency response plan or the implementation of it please
call us any time. Our emergency phone number is: (801) 536-4200 or 536-4123 Good luck, and let's hope we never have to implement a response plan, but let's be prepared just in case!
Department of Environmental Quality Division of Drinking Water 150 North 1950 West Salt Lake City, Utah 84114-4830 (801) 536-4200 18 
_____-'N'-'.a:::ti"'·o""n=al Infrastructure Protection Center Swarming Attacks: Infrastructure Attacks for Destruction and Disruption July 2002 Summary The potential for compound cyber
and physical attacks, referred to as swarming attacks, is an emerging threat to U.S. critical infrastructure. Trends in activity of both terrorist groups and protest groups indicate
that this type of attack may be used to augment either destructive or disruptive actions, respectively. Introduction Political protests and terrorist attacks over the past year have
mised the serious possibility ofattacks directed at disrupting specific sectors ofthe U.S. infrastructure. Protests around the world against globalization, Western corporations and governments,
and U.S. policies have become increasingly organized, violent, and disruptive. Terrorist attacks, especially those of September II, 2001, have demonstrated an increasing level of complexity
and destructiveness. Both of these trends indicate a natural progression to swarming attacks: coordinated attacks using different methods against a target and the snrrounding infrastructure
to cause multiplied or cascading effects. I A likely form of swarming attack is one in which an attacker uses cyber means to enhance the effects created by a traditional physical attack,
such as a bomb. Terrorists or violent protestors may initiate the cyber component of a swarming attack well before the physical component and may execute it simultaneously with the physical
attack or as a follow-up to a physical attack. Understanding swarming attacks requires knowledge of recent trends in terrorism and protests that has lead to this phenomenon, the potential
effects of such attacks, and the probability ofthese types of attacks. I The tenn swarming was used by William B. Scott, ''Nation's 'infosec gaps' given new scrutiny postSeptember II,"
Aviation Week & Space Technology, 156(4):59. Scott describes "swarming" as • cyber attack conducted simultaneously with other kinds ofattscks. 
SWARMING ATTACKS: INFRASTRUCTURE ATTACKS FOR DESTRUCTION AND DISRUPTION The Foundation of Swarming Attacks Terrorist groups and global protestors have displayed parallel trends in recent
years that could lead both to engaging in swanning attacks. Both have become more sophisticated in their activities, more familiar with technology, and more innovative in their targeting.
Although terrorists have not yet conducted cyber attacks and protestors have not directly targeted infrastructure, trends indicate that attacks on cyber components of the infrastructure
are likely. Trends in Terrorism Increased Complexity The last decade has witnessed a natural progression in the complexity of how terrorist organizations have coordinated and carried
out attacks. • The first level of complexity is where a group uses the same attack method (e.g., a bomb or hijacking) at the same location but with the phases of the attack timed sequentially.
For example, in 1996 the Irish Republican Army (IRA) detonated a car bomb inside the British Army Headquarters installation at Lisburn, Northern Ireland. Between 5 and J0 minutes after
the first bomb exploded a second car bomb exploded outside the base medical center (targeting existing victims and emergency services), • The next level is represented by the ability
to coordinate the ahnost simultaneous use ofthe same attack method (e.g" a bomb) at geographically dispersed locations. In 1998, terrorists detonated bombs within minutes of each other
at the U,S. embassies in Tanzania and Kenya. • The complexity of terrorist attacks reached a new level in the attacks of September 11, 2001. Terrorists used the same method (civil aircraft),
launched from different points nearly simultaneously and converged on two geographically separated target sets. In addition, they may have planned to attack in sequence within each target
set (i.e., first one tower ofthe World Trade Center and then the second). Furthering this natural progression, several terrorist organizations will likely develop the capability to carry
out coordinated attacks that do not use the same method, Instead, the attackers will nse different methods that support or complement each other, In addition, these methods may be used
at different times and cause direct effects in different geographic locations. -2
SWARMING ATTACKS: INFRASTRUCTIJRE ATTACKS FOR DESTRUCTION AND DISRUPTION Interest in New Forms ofAttack Terrorists have already demonstrated a willingness to use chemical and biological
agents, and if used in conjunction with other attack types, they could have devastating effects. Even so, these may not be the most likely tools in swarming attacks, as they require
specialized knowledge and special handling facilities. They may also be easier to track. In contrast, the development of a cyber attack capability does not have readily identifiable
physical and logistical signatures like those found in the development of a chemical, biological, or nuclear attack capability. Moreover, a cyber attack capability does not require special
academic research centers or even an indigenous training facility. The skill to develop a cyber attack capability, unlike the skills needed to develop a chemical, biological, or nuclear
capability, can be openly acquired can even be selftaught. Importantly, cyber components can be attacked in other ways, including small explosives or radio-frequency (RF) weapons. Awareness
ofInfrastructure as II Target Several recent terrorist events indicate an awareness of the effects of attacks on the components of infrastructure sectors. • In 1996 six members ofthe
IRA planned to destroy six electrical sub-stations in the London area. The attack would have disrupted the electrical supply to London and substantial parts of Southeast Britain for
months, blacking out homes, businesses, and industries as well as rail and underground travel and traffic lights." • Rebels in Nepal have destroyed more than 50 repeater stations of
the Nepal Telecommunications Corporation in an attempt to disrupt communications to rural areas. However, attacks on the infrastructure do not necessarily involve kinetic energy weapons
but may involve other physical or cyber means. • On April 25, 2002, burglars stole 17 computers that coordinated the traffic lights in Santiago, Chile, resulting in traffic gridlock.
The municipal authorities in Santiago estimated that it would take three days to reestablish the system and restore traffic to normal' Recent cyber activity, including the BAT 911 virus,
the Code Red worm, and the NIMDA worm also demonstrate the disruptive potential for attacks on the infrastructure. The potential for such cyber attacks to disrupt a sector of the national
infrastructure, and have cascading effects into' other sectors, is as great as the potential from physical attacks. I. Bennetto, "How IRA plotted to switch offLondon," The Independent,
April 12, 1997, p. I , The Southland Times (New Zealand), April 29, 2002, p.l -3l 
SWARMING A'ITACKS: INFRASTRUCTURE A'ITACKS FOR DESTRUCTION AND DISRUPTION Trends in Protests A similar progression is taking place in protests around the world. Although the press has
labeled most recent protests as "anti-globalization" it is more accurate to describe them as "anti-corporation.,,4 Seemingly divergent groups protesting the power of corporations, environmental
degradation, exploitation of labor, as well as the policies of the World Bank and International Monetary Fund that are blamed for these ills, converged at the World Trade Organization
summit in Seattle (1999). This gave rise to the "Blue-Green" coalition-a new alliance between labor activists and environmentalists. With subsequent events such as those at Quebec (April
2001), Barcelona (June 2001), and Genoa (July 2001), repeat protestors became more familiar with each other and began to form informal partnerships as they refined their common theme.
Use o/Techno/()gy The use of technology by protestors is also becoming more common and refined. Due in part to their familiarity, protestors have begun using the Internet to communicate,
coordinate activities, and exchange protest techniques. Often, ideas are exchanged in chat rooms until there are enough activists to start an e-mail list and establish a web page.s •
During a January 2002 meeting of the World Economic Forum in New York, cyber protestors created a virtnal "sit-in," in the form of a denial-of-service (DoS) attack, against several web
sites including the home page for the forum. This was accomplished through a tool posted on web that was a simple point-and-click graphical user interface . • Members of Raisethefistcom,
an anarchist site, electronically discussed choosing a corporate target for a month-long cyber protest. The group was focusing on companies they perceive as having a history ofenvironmental
abuses or exploitation ofworkers" Protestors have already demonstrated the propensity to use information technology to expand their target set. The Internet allows protestors to build
a profile of a target corporation, organization, or even sector of the infrastructure and to target it in depth. This means that protestors could disrupt target corporations or organizations
by attacking their suppliers, investors, creditors, and employees. A recent example concerns the attacks of animal-rights activists on a major drug-testing firm. While engaging in traditional
protest activities, the group used its web site to publish the names and addresses of the firm's employees as well as details on other physical attack tactics used by similar groups.
This action led to an increase in violence by the group against the targeted firm; including beatings and vandalism. The activist group also targeted the firm's investors and bankers.7
• P. KiTby. "Genoa pTOtesroTs signal earning of age in global politics," The Irish Times, August 4, 2001, p. 12. , 1. D. Harder, '''Renl-a-mobs' descend on D,C.," Insight on the News,
February 12,2001, p. I. 6 iDerense, Inc., iDerense Daily Alert, RaiseTheFist.com contemplates month-long cyber attack," April 12, 2002. , M. Satchell, ''Terrorize people, Save animals,"
U.S. News & World ReparI132(11);24. 
SWARMING ATIACKS: INFRASTRUCTIJRE A TIACKS FOR DESTRUCTION AND DISRUPTION Use ofV"wlence This ability to coordinate electronically, as well as protestors becoming bolder as they coalesce
around a common theme, has given rise to an escalation of violence dnring protests. The level of violence during protests has progressed from minor property damage in Seattle (1999)
to deliberate attacks on law enforcement, the use of firebombs, and $100 million in damages in Genoa (2001). Infrastructure is a natural target for these types ofprotestors. • As they
come in conflict with police forces and attempt to disrupt political or symbolic events, protestors have obstructed local law enforcement, blocked traffic, and interrupted mass transit
• Local utilities, even if privately owned, may represent the local government to protestors and; therefore, may also be targeted. • Shifting the focus of their cyber attacks from web
page defacements or DoS attacks to more potent attacks against local government communication or the the local area's infonnation infrastructure could be an easy transition. Cyber attacks
may also be attractive because they can be perceived as non-violent attacks and therefore construed as peaceful protests or simple civil disobedience. Similarly, as govemments improve
measures to physically separate protestors from important events, such as the June 2002 Group of Eight (G-S) summit held at a remote location in Canada, the protestors might look for
means to disrupt the event remotely. A cyber attack, in conjunction with a physical protest, could create a greater disruption and, therefore, enhance the protestor's goal of attracting
attention to their cause. Cyber attacks, that include various fonns of malicious code designed to cripple a network or delay official response, may become part of a swarming attack when
coordinated with confrontational, disruptive, or violent activity. Coordination of Swarming Attacks As terrorists and protestors become more technologically skilled, or purchase the
expertise from from cyber mercenaries, they will be able to conduct network reconnaissance with some degree ofstealth. The growing cyber competency of these attackers also gives them
other advantages when initiating the cyber component of a swarming attack. An attacker may begin the cyber element of a swarming attack well in advance of the physical portion. This
inhibits the detection of a swarming attack by making the cyber activities seem coincidental and not directly linked to physical threats. For example, a virus that disrupts the 9 I I
system or a wonn that shuts down the pumps in a water system may not be readily linked to a threat of violence during an upcoming protest. Attackers can also disguise the cyber attack
by including it in the normal stream of cyber incidents. In addition, they can also avoid creating patterns that will draw the attention of network security personnel by including the
intended target in a long-tenn series of attacks against disparate targets that are not related to the developing swarming attack. In some cases, even -$
SWARMING ATIACKS: INFRASTRUCTURE ATIACKS FOR DESTRUCTION AND DISRUPTION after a physical attack has taken place, investigators may not recognize prior or ongoing cyber activity as a
component in a swarming attack. Current methods available to attackers include: • Placing a virus or Trojan horse that can reside on a system until activated; • Creating a back door
in the targeted system 'that can be accessed when needed; • Developing, over a period of several weeks or months prior to a physical attack, a network large enough for a crippling distributed
DoS attack and executingit as part ofa swarming attack. Effects of Swarming Attacks The three principal effects of swarming attacks are separately described below. In addition, a swarming attack may also cause
greater public panic than a physical attack alone. People not located in the vicinity ofa physical attack may still believe that they are under attack and cut off when their vital or
expected services are interrupted. This feeling can be perpetuated through an interruption in official information, the deliberate placement of false information on official or reputable
news sites, or the rapid spreading of rumor-all a result offurther cyber activity. Effects that Complicate Response One of the most likely uses of the cyber component of a swarming attack
would be to slow or complicate the response to a physical attack. This can be done by delaying notification of emergency services, delaying the arrival of emergency services to the scene,
and denying the resources needed to manage the consequences. • Instances of attacks on 911 services have already occurred. For example, in 1996, a hacker managed to break into a U.s.
regional telephone network. Using his computer connection, he was able to generate multiple, simultaneous telephone calls to a single public safety answering point (pSAP) and tie up
the 9Il systems of eleven Florida counties, thereby blocking any legitimate callers. , • Malicious code has also been used with this same effect. The 911 virus (BAT 911), fIrSt detected
in Apri12000, was designed to delete all data in a system on a given day ofthe month. However, the virus also obstructed the 911 system by generating multiple false emergency calls.
To Hlustrate, a eyber-hased disruption of the 911 telephone system, carried out in conjunction with the early morning truck bombing of the Alfred P. Murrah Building in Oklahoma City,
may have complicated the response by delaying emergency aid to the victims. • The actual progress ofemergency services to the site ofa physical attack can be slowed by a cyber attack
that disrupts the traffic light network and creates traffic jams that block emergency services. • With the advent of automated building control systems, fire alarms, environmental controls,
and lighting can all be controlled from offsite using a dial-in system. If -6
SWARMING ATTACKS: INFRAsTRUCTURE ATTACKS fOR DESTRUCTION AND DISRUPTION these systems were to be manipulated in several buildings at once, forcing people to evacuate, the crowds in the
street and the demands on emergency services to address numerous alarms would delay the response of the emergency services to an actual attack. A similar effect of complicating the response
to an attack (while possibly widening and worsening the effects of the attack) could be achieved through a cyber attack that disables the water supply just prior to a violent prolest,
or the disabling of the electrical system in conjunction with a physical attack. This would deny emergency services the necessary resources to manage the consequences such as controlling
fires, coordinating actions, and creating light for operating at night. Effects that Widen Destruction or Disruption The physical and psychological effects of an attack or protest can
be widened using a synchronized cyber attack. Therefore, a swarming attack, even one as narrowly focused as the above example, could greatly widen the span of disruption for that protest
or attack from a single geographic location to numerous cyber locations. This widening effect could disrupt a sector of the infrastructure and even cause cascading effects into other
sectors. In addition, the psychological effect on a populace from a swarming attack may be greater than the effect from a physical attack alone. This is especially true if the effects
ofthe cyber portion ofthe attack last for several days or weeks . • Although horrific, the effects of the September IIth attacks on the populace of Manhattan would have been far greater
ifa cyber attack had simultaneously disabled the New York City water or electrical system through disruption of their computer-based process control systems. This type ofattack on the
critical infrastructure of the city would have affected far more citizens than the actnal attack on the World Trade Center and turned many spectators into victims. Such an attack would
also have the effect of overburdening public utilities and emergency services as they attempted to restore vital daily services to a wide populace while managing the consequences of
a lerge physical attack. Effects that Worsen Destruction or Disruption A cyber attack may also worsen the effects of a physical attack by either increasing the destructiveness of the
attack or by placing more people at the site of the attack:, thus increasing casualties. Although there are no instances of a cyber attack worsening the effect of a physical attack,
possibilities exist throughout the critical infrastructure. • A cyber attack on a natural gas distribution pipeline that opens safety valves and releases fuel or gas in the area of a
planned physical attack would enhance the force ofthe physical attack. -7
SWARMING ATIACKS: INFRASTRUCTURE ATIACKS FOR DESTRUCTION AND DISRUPTION • An additional example may be extrapolated from an historical event. The effects ofthe bomb detonated in the
parking garage ofthe World Trade Center, in February 1993, would have been worse if a cyber attack on the Port Authority Trans-Hudson (PATB) railroad was synchronized with the physical
attack. The PATH station was on level B4. An attack on the railroad's computerized signaling and safety system could be designed to force trains to stop at the World Trade Center station
and passengers to detrain. The bomb actually did collapse part of the station's ceiling and the effect of this would have been greater with scores ofpeople gathered on the platforms.
In addition, the evacuation routes from the station would have teken the passengers upward toward level B-3 and closer to the bomb that was detonated on level B-2. Conclusion Recent
trends in terrorist attacks and political protests demonstrate a progression toward swarming attacks: coordinated attacks using different methods (cyber and physical) against a target
and the surrounding infrastructure to cause multiplied or cascading effects. Swarming attacks will allow terrorists or protestors to enhance the desired effects of disruptive or destructive
activities by using cyber means to worsen or widen the effects, or to complicate emergency response. Although not a swarming attack, the September 11 attack on the World Trade Center
provides a glimpse of the potential consequences of a swarming attack. As a result of the attack, extensive damage to the local telephone company's hub next to the World Trade Center
eliminated 4.5 million data circuits and 300,000 phone lines; 30 percent of [ower Manhattan's capacity'l. Although much of the disrupted service has been restored, the effects remained
for several weeks. A cyber attack in conjunction with a physical attack has the potential to do this amount of disruption or more; possibly for a longer period. A swarming attack will
be difficult to recognize and interdict. The cyber portion of the attack may begin long befure the physical attack tekes place and culminate bef()re, simultaneous with, or even after
the physical attack. This variance in timing will make it difficult for law enforcement and counterterrorism specialists to link the cyber activity with a physical threat. In addition,
the cyber portion of the attack can be launched and controlled from a location well removed from the site ofthe physical portion. The preparation for the cyber portion can be hidden
amongst normal Internet activity and network reconnaissance can appear to security personnel as the work of unrelated hackers. Another factor that may inhibit intelligence collection
concerning swarming attacks is the availability of the skills and tools necessary to conduct the cyber portion. Unlike weapons of mass destruction, cyber attacks require virtually no
special training, handling procedures, equipment, or development facilities. In addition, a cyber attack gives off no signature that is readily detected by the usual intelligence collection
means. A swarming attack can have a localized or national impact on a sector of the critical national infrastructure. This impact may not remain in one sector but cascade into other
sectors causing widespread disruption of the critical national infrastructure. Awareness of the trend toward • S. Young, "Terror attack highlights problem in telecom seelor's monopoly
legacy,» Wall Street Journal, October 19, 2001, p.1. -8
SWARMING ATTACKS: INFRASTRUCTURE ATTACKS FOR DESTRUCTION AND DISRUPTION swarming attacks is the first step in being able to recognize and counter such an attack. Analysts and investigators
need to look for cyber clues that may uncover future physical threats that the cyber activity may be meant to compliment. A more significant step, however, is to integrate physical and
cyber protective measures within the national infrastructure to counter the potential disruption and destruction from swarming attacks. This product was completed with support from the
CRUCIAL PLAYER project. CRUCIAL PLAYER is an interagency project initiated in 1999 by the Deputy i Secretary of the Department of Defense (DoD), the Deputy Director of the : Federal
Bureau ofInvestigation (FBI), and the Deputy Director of the Central Intelligence Agency, and funded by DoD and FBI. The project is managed by the National Infrastructure Protection
Center, Washington D.C. Major contributors to this product were Scott Curthoys and Geoffrey French. French. Forward , comments or questions to NlPC at 202-324-2084. -9
Recognizing VYaterborne Disease and the Health Effects of Water Contamination What Every Physician In Your Community Needs To Know Funded by American Water Works Association and Arnot
Ogden Medical Center Author: Patricia L. Meinhardt, MD, MPH, MA Maintaining water quality and securing the safety of water supplies in the United States requires a collaborative partnership
between the medical community and water utility practitioners. The importance of this collaboration has been underscored by the growing threat to the security of our nation's infrastructure
that includes the possibility of Intentional contamination of US water reserves by covert terrorism. Practicing physicians are likely to be the first to observe unusual illness patterns
or disease trends resulting from intentional biological or chemical contamination of water supplies and must understand their critical role in detecting water-related disease and in
cooperating with water utilities to protect their community's public health. A new medical medical website has been launched to assisl heallhcare providers recognize and manage waterborne
disease and the health effects of waler pollution resulling from either natural OR intentional contamination of water. The contents of this medical websile, Recognizing Waterborne Disease
and the Health Effects of Water Pollution: A Physician On-Line Reference Guide, are posted on the menu bar to Ihe left and are accessible at www.WaterHealthConnection.aomc.org. Unique
features of this medical website include: • "24[7" availability with free access 10 366 webpages of comprehensive information • Clinically relevanl information detailing detection and
management of water-related disease from both waterborne pathogen and chemical contaminant exposure • Repository of physician anti-terrorism preparedness and readiness resources • Special
risk communication and patient risk evaluation guidelines for both healthy and susceptible populations regarding water-related disease • "Ease of use" technology tools and website support
for busy physician users • Targeted search engines providing quick and easy access to 200 websites covering a diverse array of waterborne disease and water contamination issues • Peer-reviewed
content by leading medical and public health experts from medical academia and public health agencies including CDC, ATSDR, and EPA • CME accreditation for credits toward AMA Physician's
Recognition Award Please share this important resource with your medical, public health, and water utility colleagues! Safedrinkingwater.com News describes WaterHealthConnectlon.aomc.org
as: "New website on drinking water-related diseases co-sponsored by AWWA makes excellent info user-friendly for healthcare providers: Filling a long-existing void, this outstanding website
will help fill the gaps in the knowledge of primary care physicians about a variety of Illnesses that may (or may not) be related to drinking water. Utilities may want to consider how
they can make the medical community in their service area aware of this service," (April 10, 2002) 
·WATER SYSTEM SECURITY: ARan GUIDE Water System Security: A Field Guide Managers and operations personnel of small to medium-size water utilities will find this guidebook very helpful
as they assess and upgrade the physical and operational security of their systems. This guide emphasizes measures a water utility can take for better security against man-made threats.
It covers the emergency preparedness plan; vulnerability assessments; mitigation measures for critical components; emergency response and recovery; and crisis communications. Supplied
forms include security checklist, system component list, potential biological and chemical threats, emergency contacts, and more. Forms are provided in print and on diskette. Spiral-bound.
ISBN 1-58321-193-4. 2002. Catalog No. 20501 Non-member Price: $85.00 Member Price: $55.00 Mail AWWABookstore 6666 W. Quincy Ave. Denver. CO 80235 ·OR· Csll 1·800·926·7337 
DRINKING WATER PROGRAM CONTACTS EPA REGION 6 Drinking Water Section James BroWll 214-665-7155 broWll.james@epa.gov TEXAS Texas Commission on Environmental Quality (formerly TNRCC) Public
Drinking Water Section 24-hour: 800-832-8224 512-239-4691 Mlannen@turcc.state.tx.us LOUISIANA Louisiana Department of Health and Hospitals Safe Drinking Water Program Ms. Karen Irion,
Administrator Center for Environmental and Health Services 24-hour: 800-256-4609 E-mail: Kirion@dhh.state.la.us ARKANSAS Arkansas Department ofHealth-Division ofEngineering After Hours
& Emergencies: 501-661-2136 501-661-2623 safewater@healthyarkansas OKLAHOMA Oklahoma Department ofEnvironmental Quality Public Water Supply Section 24-hour: 800-522-0206 405-702-8100
Mike.Harrell@deg.state.ok.us NEW MEXICO New Mexico Environment Department Drinking Water Bureau 24-hour: 505-827-7536 505-827-1400 Toll Free: 877-654-8720 retta prophet@nmenv.state.nm.us

Developing Credibility Through Communications Powerful trends are shaping the water profession .. Competition .. rucreasing regulations .. Scientific uncertainty It Politieal intervention
.. Public expectation Qual-Serv found better performing utilities share conunon characteristics • Sound fiscal policies and asset management • Highly skilled/trained staff • Customer
focus/satisfaction • Willingness to take risks • High Level ofcredibility in the community 1 
Credibility according to Webster's Credibility -that can be believed; reliable Cred.bility Gap -a disparity between a statement and the true filets -inability to have one's truthfulness
or honesty aeoopted Editorial: Distrusting the tap Weariness over water refietfs pubUc's mood "".Only 1\ ;:p.I3.rta' ofCal!romWls ti)Utintly dtiAA Ihe water thou eom:s Item n lap. In
Lot Angel¢s __ ._ only 18 ptrr.tf'It tms,ub¢tup.AnodICl' 32pamlt take il fiheml rutd 4& pcn::.eru Slid: 10 w4Icrnut¢f1'l boule..... ",_public sl:ep!1i:mn can be a poJitivl: mrce for
􀁾􀁴10 tetp pl't$$ins ahead on challengd." Thill uid.,li1W: appoe;:ut 10 be 11 gap betwtcn Iilel and 1Ca:. paniculnrlywt.en it oomtS cownler." S01J;l'@: SrunmenlO Bee, July 23, 2002
"Gatorade Declares War on Tap Water" (AP Headline) "When welre done, tap water wut be relegated to sbowers and washing dishes." "We're not against wafer· 'tJust bas Its plate. We think
It's good for Irrigation and «)Oking,fI (Quaker Oats, US .President ofBtverage Oivislon) 2 
----'-----..-------------------b Fort Worth Water Main Breaks lor Second Time In Three Days 􀀭􀀮􀁲􀁴􀀬􀁾􀁵􀀮􀀱􀁴􀁕􀀠􀁔􀀱􀁬􀁣􀀨􀁜􀁮􀁴􀁬􀁋􀁯􀁫􀁾􀀠_ .....•'_ 􀁾􀀠􀁟􀁾􀁟􀀮􀀠􀀬􀀮􀁾.•. ,.
,". __ • ", arotlIIiiIOp.m. 'f'I'IImby. : 􀁯􀀢􀀢􀀢􀀢􀀧􀀢􀀢􀀢􀀢􀀢􀁾􀀢􀀢􀀠Water Main Break In Loop Area;􀁨􀁯􀁬􀁗􀀻􀁬􀁖􀁣􀀮􀁑􀁹􀁬􀁱􀀺􀁩􀁴􀁾􀀠•==:,:;!':. May HiSaveDamaged LTrack 􀁾􀀢􀀢􀀢􀀧􀁙􀀢􀀧􀀧􀀧􀀧􀀧
􀀧􀀧􀀧􀀧􀀧􀀧􀀧􀀧􀀠􀁾􀀠F ' "_ __ 􀀭􀁾􀀠. " . '"'-_. . -. Broken main leaves150 customers without water The public expects to be involved. '" 52% f 411 § .l! J<> 211 ,. I 15%1 Percent
of public Pereentof that Utility managers think want to be Public who wantmOfa • Involved fnvofvoment 3 
Managers must make a paradigm shift • Public lnvoive'llenl in utility decisions is essential to building and maintaining credibility • -which must be managed as a crucial asset to the
longevity and ultimate success of the utility Credibility is evaluated through honest self-evaluation. • There may be places in your organization where you have poor credibility. • Ask
questions internally and externally to determine credibility. • Credibility may differ between groups Assess the Utilities Readiness to invest in public trust • What is the leadership
style ofthe utility? .. Does the utility embrace a team-based environment or separation between functions • Does the utility value stakeholder input? Is there a successful history ofpubJic
involvement? 4 
Corporate culture determines public involvement success How to determine what people care about • Ask • Provide avenues for two way communication • Professional market research/surveys
• Talk to employees • Callioea! reporter or talk show host • Consult with olher utilities in the area Establishing tmst and credibility • Keep commitments • State purpose/issue clearly
and restate often • Don't promise 􀁾􀁮􀁹􀁴􀁨􀁩􀁮􀁧􀀠you cannot deliver • Don't speculate aboul things you do not know • Be patient and stick to purpose and goals • 􀁄􀁯􀁮􀁾􀁴􀀠be defensive
5 
What to do when trust is low • Maintain businesslike relationship and treat all participants with respect • Summarize goals cJelIrly and frequently • Keep the public updated • Train
spokespersons to handle inquiries Additional steps toward building trust and credibility • Admit mistakes • Remain impartial and hear all opinions • Use recognized, credible experts
to help communicate • Make data available to interested parties 6 
· Strong credibility will help utilities with tough decisions NewWatet 􀁾􀀾􀁅􀁮􀁶􀁬􀀢􀀧􀁮􀁭􀁥􀁮􀁴􀁡􀁬􀁬􀁭􀁰􀁡􀁡􀁬􀁓􀀯Suppll.. "No Growthu Water Qualityl l'reatment :=:>"Hea/thy Water'Wiales
Requirements Vulnerability 􀀱􀁾􀁬􀁮􀁶􀁥􀁳􀁴􀁭􀁥􀁮􀁴􀁳and Crlsts and Security -, Communications 7 
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 
Developing a Concept of Emergency Operations l> Define emergency operations goals l> Create plans, policies and procedures l> Identify legal requirements l>Develop a strategy .Research
l> Past Emergencies and Responses l> Current Planning Framework l> Analyze Risk Vulnerability Assessment l> Identity hazards l> Resources l> Characterization ofFacilities "'_..'" -Review
'" Legislation & Federal, State, and local mandates '" Existing Plans and Plans of Neighboring Water Utilities '" Outside Agencie. Response Capability 1 
Outside Agencies . >Community »Government agencies }> State and local organizations -Healtb pr(lfcssfoub -State LlbaratDtW 􀁾􀀠Emcqellcy RlClpondcn -Voivakf:n -!UtOptn«!n Resources Resources
should be: »Applicable to your needs » Available upon request » Listed in order of relevance »Quantified » Identified before an incident Plan Exercises » Drills » Functional exercises
» Tabletop exercises »FuJI-scale exercises :0.1 ._ 2 
Emergency Operations Plan Outline u.s __.._ Part 1: Introduction » Purpose and Scope » Policies » Assumptions w_.,..IIIP Part 2: Water System Overview )-General deSt'ription of entire
water system }> 􀁓􀁹􀁳􀁴􀁥􀁭􀁾􀁷􀁩􀁤􀁥􀀠overview » Organization > Location » Faellltles » Se",rity » Interdependencies 3 
Facility Annexes »Organization »Operations »Maps »Distribution diagrams »Facility floor plans -m--Part 3: Risk Assessment »Natural disasters »Technological disasters » Manmade disasters
Part 4: Organization & Coordination » Organizational needs to respond to emergencies :> How coordination of resources enhances response )0 The organization oCtile Incident Command System
(ICS) » Special considerations that Deed to be addressed 4 
Overall Structure of the Organization » InternaYexternal coordination requirements »System-level » Linkages to bigber autborities »Organizational cbart »Position responsibilities InternallExternal
Organizations » Utility organizational structure » External contacts & organizations »Checklists ..Incident Command System » Adopted external response system »Critleal d ..lsion-making
involvement 5 
--Part 5: Activation, Notification, and Mobilization }> Activation }> Notilication }> Mobilization w_",..lQII Activation }> Key personnel }> Organizational unUs }> Responselevels Notification
);. [otemal Management 􀁾􀀠Safety Personnel -Laboratory personnel -Response personllet 􀁾􀀠External -Law enforument 􀁾􀀠State and Federal agentles .. Customers .. Other 6 
Mobilization 􀁾􀀠Individuals or groups 􀁾􀀠Anticipated vs. surprise events 􀁾􀀠Alert stains 􀁾􀀠Resource staging u..;_",.._ Part 6: Communications 􀁾􀀠Modes ofcommunication -Internal
-ExternaF 􀁾􀀠Redundant communication capability -CD -Cell-phones 􀁾􀀠Landlines U3_",..(m ._Part 7: Incident Management 􀁾􀀠Assessing the situation 􀁾􀀠Operations 􀁾􀀠Resource management
􀁾􀀠Damage assessment 􀁾􀀠RecoverylRestoration 􀁾􀀠Deactivation 􀁾􀀠Post-Incident Review .u_.r_.110 -7 
Part 8: Public Affairs and Communications » Distribution of Information to: -employees .. public .. media » Customer action »Community protection ,Part 9: Plan Maintenance & Training
» Plan Reviews .. Periodic -Post-incidfnt -post-exercise » Training » Exercises -Tabletops -Functional exercises -Full"scale exercises Hazard-Specific Annexes >Waler »Earthquake Contamination
)0 Sewer Overnow »Flooding »Landslides! A valanebe »Severe Weather »Hazardous Material Release at a Facility »Drought »Wildfire )0 Dam Failure »Crirninal Activity »Special Eyents »WMD
»SCADA Intrusion »Other 8 
Appendices )0> Contact Listings: » Team Rosters )0 Emergency Shelters and Family Care Centers " Ch..kll,ts )0 Resource Lists » Forms » Definitions/Glossary -9 
Risk Communications "If I had eight hours to chop down a tree, I'd spend six sharpening my axe." Abraham Lincoln What is a Crisis? .. "Unexpected" • Major incident with negative outcome
• Disrupts normal business, threatens credibility of organization • More serious than a "problem" • Every crisis is different, presenting different obstacles 1 
Collapse results in complete loss of natural creek bed and $1.875 million in mitigation costs $700,000 enforcement action results from South Sacramento water main break Warner Bros.
lot soaked by broken main March 13, 2000 2 
1899 sewer collapse requires $500 appropriation for property damage The Seven Stages ofCrisis Communication 1-4 DysfuncliOllllI 5·7 Mature, highly evolved organizations 1liI1l1oc,,,,w..KaoW
RqwoWl..􀁾􀁾􀁍􀀢􀀢􀁑􀁬􀁊􀀮􀁪􀁲􀁩􀁬􀁊􀀡􀀱􀀹􀀷􀀠Time Magazine -"Coping with Catastrophe" 'The worst part ofa crisis is being unprepared. By removing the unexpected quality, you are removing
that which is most unnerving." Steven Fink. President i.eKjcon Communications 3 
Some Common Excuses ... .. It's too soon to act • It's just an isolated incident • We need more time .. Let's not overreact • We can't say anything; we'll be sued • It will trigger copy
cats • If we say something, people will find out Crisis Communications Approach • Preparing for a crisis • Implementing your Plan During a Crisis • Assessment After a Crisis Make as
many decisions in advance as possible 4 
Elements ofa Crisis Communications Plan Introduction Communication MissionIVision Statement outlets/tools Background Communications Objectives protoco1 • KeyM ....g.. Drill Plan • Crisis
Team Evaluation ., Target Audiences Prior to a Crisis Develop and Tes!; a Crisis Plan Create list ofpotential crises Assemble crisis response team IdentiJY spokespernon(.) Develop key
messages Determine key audiences Establish crisis communications center Prior to a Crisis, continued IdentiJY needed technical .upport Establish communications protocol Build relationships
with agencies and organizations thatyou'Jt involve Develop media tist and get to know reporters! • Create fact sheets • Test your plan 5 
, Crisis Response Team Crisis Tools • Telephone log • Media roster • Communications calling tree • Check list • Situation analysis summary and update template • List ofcaterers, AN vendors
During a Crisis Locate Spo/respersou -I1Ivoll1e ill All Aspects 01 Situation Step I: Assess the situation Step 2: Address concerns Step 3: Activate crisis control center Step 4: Assign
responsibilities Step 5: Establish On-site sourCe 6 
During a Crisis, continued • Step 6: Detenn'ne keyaud'ences • Step 7: Detennine information to be communicated • Step 8: Notifykey audiences • Step 9: Establish system for continual
updates • Step 10: Record and Track Inquiries Employing Key Principles Improves Success • Principles • Outcomes -Accurate -Reduced tension by stating -Consistent the facts and the actions
-Timely being taken to correct it -Clear -Demonstrated commitment -Complete -Control the information -Responsive -Secure credibility Effective Media Relations are Key to Telling "Your"
Story • Be prepared -Define (and communicate!) organizational standards -Proving training • Develop a mdi. relations plan -Key messages -Use appropriate tools and [onnats -Outlets 7

Credibility can be Built or Lost • Building Credibility -Proactive open communications -Know who needs to hear what, when -Seek external expertise; create advisory board -Reveal what
infonnation is needed BEFORE being asked -Cooperate with the media Credibility can be Built or Lost, cont. • Losing Credibility -Blaming -Nomttl. follow-up with victims or impacted parties
-Technica! justification for failure, rather than owning it -Hiding from the truth "No secrets in a crisis. Everything comes out eventually. " 8 
Tips for Spokesperson • Be warm and sympathetic -sincerity is important • APOLOGIZE! • Make statements that are worth being heard 􀁡􀁮􀁤􀁲􀁥􀁰􀁥􀁡􀁾􀀠• Never get mad or defensive • Don'l
stray-stick to the situation at hand • Don't give personal opinion or speculate After the Crisis Provide Closure atld ReuisitYonr PIau • Final update to key audiences • Recognize participants
• Recover and rebuild • Evaluate actions • Update Crisis Communications Plan Thoroughly Evaluate the Crisis and Response • Establish timeline of events • IdentifY any issues or gaps
related to implementation -strategy or tactics • Assess historical patterns for similar events • IdentifY surprises -positive orneg.tive 9 
"Companies that behave appropriately and solve problems promptly are neither newsworthy or sueable" James Lukaszewski Seven Dimensions of'Ctisis Commu.nkalions Managemenl. 1998 10 
American Water Works Association Crisis Communications Temp!ate Dedicated to Safe Drinking Waler CRISIS COMMUNICATIONS PLAN TEMPLATE PRIOR TO A CRISIS Create List of Potential Crises
Detennine what crises could strike your utility, and gather or create simple background infonnation for those that would be more likely or more complex to address. Infonnation to gather
could include experts within your utility, similar incidents at other utilities, and regulations. Example crises include: • Contamination • Major main break • Chlorine spills • Boil
water notices • Fuel/Oil spills • Construction accident • Violence in the workplace • Natural disasters (flooding, hurricane, tornado, fuel Select candidates to serve as spokesperson
during a crisis The public infonnation officer is a natural, ifyou have one; if you do not, consider who has the best skills for the task:, whether it be the general manager or public
relations specialist. Assure that you have a backup individual, in the event that your top choice is unavailable or involved in remedying the crisis event. At the onset of a crisis situation,
ensure this individual is immediately involved and infonned. Remember that communication is a full-time job during a crisis and a dedicated spokesperson is usually necessary. Name Title
Phone number work!home 
American Water Works Association Dedicated to Safe Drinking Waler Determine the keyaudiences you will need to communicate with in a crisis Create a roster that includes contact names, telephone numbers, fax numbers, and email addresses. Some possible audiences might
include: Board Members Local Businesses City Officials (mayor, city council, city manager) Medical Facilities/Doctors County Officials Media (television, print, radio) Employee Families
Police Fire Department Regional Utilities Genera! Public RIlgulatory Authorities Groceries Schools Health Officials Utility customers Legal representations Utility employees Determine
your available communication channels Create contact rosters that include contact names for each applicable item, as well as telephone numbers, tax numbers, and eroail addresses. The
best tool to apply will depend on the nature of your community, audience, time available, and the crisis at hand. College Stations" Door Hangers Emergency Flyers Emergency Phone Bank
(automated phone message to specific area) Government Access Cable* Ham Radio Groups" Homeowner Associations* Hotline *warrants roster Internet Sites" Newspapers" On-hold Messages Personal
Phone Calls Press Conferences Press Releases Television Stations" Volunteer Emergency Management Groups" Your Own Web Site Property Management Groups* Radio (particularly talk format)"
Schools* Telephone Trees" 
American Wafer Works Association Dadlcslaci /0 Sa'" DIinking Waler Determine possible locations for a crisis communications center Consider locations within your utility, as well as
off-site possibilities, where media, officials and residents can assemble to gather information, obtain updates, and take care of their own work needs. Possibilities include churches,
civic centers and community centers. Keep in mind that your crisis communications center may not be in the vicinity ofthe actual crisis, and will depend on the specifics ofthe situation.
Determine necessary technological support needed for crisis communications and store or ensure you'll have ready access to it Consider that the crisis communications center could be
anywhere, and power may not be available depending on the specific crisis. Battery-powered televisions, radios Extension cords Maps (service area, etc) Cellular phones Fax machines Paper/office
supplies Contact rosters Flashlights Specific phones/phone lines Copiers Hard hats Two-way radios" Crisis Plan Internet connection VCR Easels/markers/newsprint Lap-top computers/printer
*Keep in mind that often times the media will intercept radio communications. EstabHsh a "protocol for handHng inquiries Create a utility policy on how media calls and other inquiries
will be addressed and how information will be transmitted, both internally and externally. Determine who will be responsible for responding to a significant increase in telephone calls
and other inquiries, and how the calls and inquiries will be logged. Also, make sure your phone system and internet are capable of handling the increased amount of calls and e-mails
that coincide with a crisis, and that a "hold" system is available to avoid having callers receive a busy signal. Create Key Messages Prepare key messages to be the foundation fur communication
during a crisis. It's important to have key messages in writing, so they are easily accessible at the onset of a crisis. Ideas to include: • Dedication to providing safe water • Commitment
to public health • Safety record (both in terms of service to the public and operations) 
American Water Works Association DedIcated to Safe Drinking Water Create fact sheets If not already in existence, create fact sheets that include information on: • Source Ofwater supply
• Water treatment methods employed at utility • General information about the utility (number of treatment plants, number ofemployees, years in operation, etc)*AWWA's web site provides
fact sheets ou most water-related issues, such as arsenic and cryptosporidium. Information can be found at http://www.awwa.org/pressroom Train Spokesperson on how to address the pubHc
and media Once you have identified the spokesperson that will handle media inquiries, review the basics of public and media interviews and conduct practice interviews. Tips to keep in
mind: • There is n(l "off the record" • Statements should be succinct • Speak visually; offer analogies • Avoid technical jargon; translate to "lay language" (8th grade level) • Show
compassion • Show confidence • Do not comment on personal opinions or provide your own • Never say "no comment" • It's okay to say "1 don't know" but be willing to find the information
• Be honest Test Your Plan Many organizations conduct 'crisis drills' to ensure the crisis communications plan addresses relevant issues, such as distributing information internally.

American WalerWorl<s Associatioo Dedicated to Safe Drinking Water DURING A CRISIS At the onset of a crisis, ensure your spokesperson is immediately briefed on the situation. As you proceed
through these steps, keep in mind that you need to move to Step 8, "Notify Key Audiences," as soon as possible. It's better to start getting some information out rather than waiting
until all of the facts are in. Step 1: . Assess the Situation Ensure that you are informed of the basic elements ofthe situation: • What happened? • Where did it happen? • How did this
happen? • Who is involved? • Who is affected? • When did it happen? Step 2: Once You Get the Facts, Address the Following Issues • What are the specific elements of the situation that
make it a "crisis?" • Are immediate needs being handled? • How serious is the situation? • Whilt measures are being taken to correct the situation? • Is the situstion under control?
• Are emergency provisions being made? • When will the situstion be corrected? • Have all of the facts been gathered? • What is the position of the utility? Step 3: Determine Location
of Crisis Control Center Depending on the natore of the crisis, select a location that is convenient for your audiences and the media. The specific situstion and magnitude of the crisis
may lend itself to creating a separate crisis control center, as well as a crisis communications center. The command center may serve as the central location for residents, customers,
and those directly affected by the crisis, while the communications center may be where the media gathers for updates. 
American Water Works Association􀀮􀁾􀀠Dedicated to Safe Drinldng Water Step 4: Assign Responsibilities Determine available personnel and assign responsibilities, such as answering phones,
responding to the media, monitoring media coverage, updating information to phone responders, etc. Be open to involving utility personnel in numerous roles during a crisis situation,
whatever their usual responsibilities may be. Step 5: Establish an On-site Source Ensure that a utility communications representative is continuously on-site at the crisis location to
monitor the situation and provide continuous updates of the most recent developments and information. The on-site representative can also provide any needed assistance to the media and
other audiences. Step 6: Determine Key Audiences Given the specific crisis at hand, determine your key audiences. Review the list ofpossible audiences you developed during the planning
phase and identifY those who are directly impacted by the crisis, as well as those who will have questions andlor should be kept in the loop. Step 7: Determine Information to be Communicated
Based on the specific situation and applicable key audiences, determine what infurmation should be communicated, and make sure to continually include your key messages. Keep in mind
that even though you want to provide as much information as possible, not all information needs to be communicated. If filets are missing, it may not be a good idea to relay that information.
Step 8: Notify Key Audiences Determine which communication channels are appropriate tu notifY your key audiences. Consider what information these separate audiences most need and want.
In communicating with key audiences, it is important to be able to offer them information in writing, as well. Be sure to continuslly update your different audiences as new information
becomes available. Step 9: Establish System for Continual Updates As the situation progresses, determine the best method for providing continuous updates to your different audiences.
Periodically review and reprioritize your audiences, information and communication channels as the situation changes. If you are working with the media, help them to get the story right.
Continue to work with your different audiences throughout the crisis situation-from the moment the story breaks, until the situation is over. Some tips include: • Use one spokesperson,
to be consistent • Be accessible and ready to be available at all times (24n) • Back-up verbal information with written information • Use written information, where possible (copies
of spokesperson comments; data; etc.) 
􀁾􀀬􀀠American Water Works Assodation ••\.\. Dedicated to Safe Drinking Water o Use graphics o Explain technical issues; translate to lay tenns o Provide continuous updates, even ifthere
is no new infonnation • Get back in touch, in anticipation of key news timeslbroadcasts • Separate media from central command station • Provide access to subject matter experts, both
within your utility and in the water profession. However, ensure that they are capable of explaining the situation in non-technical tenns. o Facilitate media interviews and photographs
Step 10: Record and Track All Inquiries Continually track interactions with your different audiences, including: o Who you've spoken with • Generally, what infonnation you provided •
What is their particular interest (if media) • When do they need to be called back • Media interviews given and by whom Establish a fIle to accumulate all communications, both internally
and outgoing. Include infonnation used by phone responders, news releases, internal memos, key messages, talking points. For each communication, note the date and time it was issued.
Create a 'clip notebook' with all coverage, rosters of interviews and media coverage, and keep letters and comments received from customers/general public. 
American Water Wor1<s Association Dedicated to Safe Drinking waler AFTER THE CRISIS Final Update to Key Audiences Provide a closing update and cover what happened, why, how, when, where,
what was done to remedy the situation, and if available, what measures have been taken to avoid future difficulties. Recognize Participants Thank and recognize individuals and organizations
that provided assistance during the crisis, particularly employees who rallied for the effort. As appropriate, apologize for the difficulties for those affected and thank them for their
patience. Re-establisb Credibility Communicate to your diffurent audiences the preventative steps that are being taken to ensure another crisis does not arise. Also, explain exactly
what happened and why it happened. Evaluate Actions Conduct a team meeting to de-brief, once the crisis is completely over. Determine your effectiveness in terms of: • Response time
• Media portrayal-how did your utility look to the public? • Accuracy-what did varied communications outlets get right and wrong? • Consistent Key Messages • Communication Tools-how
did each tool work; what else could you have used? • Prompt notification ofkey audiences • Sufficient equipment • Communications control center • Communication to key audiences • Internal
communication -did employees and responders know what they needed to, and promptly? Update Crisis Communications Plan Add any lists or audiences that you deemed necessary during the
crisis, and make any necessary improvements. -Compiled by the A WWA Public Affairs Committee 
(303) 794-7711 Fax (303) 794-7310 www.awwa.org.A. American Water Works Association Dedicated to Sofe Drinking Water 6666 W. QuincyAvenue Denver, CO 80235 MEDIA INTERVIEW TIps Preparing
for an interview 1. Gather all the information about the situation: Who, What, Where, When, Why, How 2. Write a summary statement to describe the incident, then rewrite it using half
the words. 3. Write a sentence or two to describe how it affects the conurnmity and what you're doing to inform, protect, correct, and repair the situation. Describe the record of your
utility in serving the public responsibly and safely (including statistics, if appropriate). Rewrite this in the form oftwo to five main CONCISE points you can emphasize. These are your
"Key Messages." Memorize them and practice speaking them, so you can feed them back easily during the interview. Rework the language, ifneed be, to fit your speaking style. 4. Think
ofsome questions you may be asked about the situation. What sorts ofthings have you heard the media ask in similar situations? As a viewer or consumer, what would you want to know? Practice
answering these until you are comfortable with your answer. 5. Ask a couple ofcoworkers to listen to you and help you practice responding to questions. 
(303) 794·7711 Fox (303) 794·7310 www.awwa.org.AAmerican Water Works Association Dedicated to Safe Drinking Water 6666 W, Quincy Avenue Denver. CO 80235 During an interview • There is
no "off the record" -Anything you say is fair game. • Statements should be brier, and to the point-Your interview will likely end up being only 10 to 30 seconds ofair time. Make yourselfthe
"editor" ofyour comments, rather than leaving it in the hands ofthe news director. • Show CGmpassion -Articulate your concern for the impacts on those affected by the crisis. Ensure
you do not appear cold, uncaring or bureaucratic in your attitude. Meter your level of concern and empathy to the particular situation. • Show confidence -Do not appear nervous or unsure
ofwhat you are saying. Reflect certainty and commitment that your utility will resolve the issue. • Do not provide personal opinions. conjecture, or respond to hypotheticals--Ifa reporter
asks what you think oftbe situation or proposes a hypothetical, bring the point back to the the situation at hand. • Never say "no comment" -This often leads to speculation that you
know information you do not want to reveal or are trying to hide something. • It's okay to say "I don't know" -Do not try to provide information you are not certain about or guess at
a response. Inform the reporter Ihat you will find that information and get back to them. • Be bonest -Do not lie to the media. • Act 􀁮􀁡􀁴􀁵􀁲􀁡􀁊􀁬􀁹􀁾􀀠Sincerity is important You
donlt want to seem tense or in any way out ofcontrol. • Appearanc. is important. Consider what you are wearing. Do you look like the person you would want to be relying on in an emergency?
• Beware of becoming, or even seeming, defensive-Your best response to an apparent negative or "goading" question is to reiterate the positives, as you prepared in your talking points.
-Compiledby the AWWA Public Affairs Committee 
(303) 794-7711 Fox (303) 794-7310 www.awwB.org.AAmerican Water Works Association Dedicated to Sofe Drinking Woter 6666 W. Quincy Avenue Denver. CO 80235 MEDIA RELATIONS CHECKLIST (J
Understand How tbe Media Works -In order to do their jobs1 media representatives must gather as much information about a given topic as possible in a short amount oftime. and then craft
a story on that topic that is interesting, 􀁩􀁮􀁦􀁯􀁲􀁲􀁮􀁡􀁴􀁩􀁶􀁥􀁾􀀠and accurate, It is their JOB to be objective and report all sides ofthe story, CI Respect tbe Media as Proresslonals
-From time to time your professional perspeclive and obligations will nol coincide with those ofthe media; they understand this, and so should you, Don't overreact ifthey challenge you
or the information you have presented, Interviews are opportunities to tell your story and get the correct information out there. CI Develop Credibility; Be Open and Honest -Credibility
is built on trust and may take awhile to develop. Be open and honest with the media. Don'lleave out important fucts and DON'T misrepresent what is true, even if this may force you to
provide less favorable explanations for your organization. CI Be Prepared -Com.nunicate with employees throughout your organization and encourage them to calland infonn you ofany crisis
or unusual, potentially newsworthy occurrence -positive or negative. Ifyou know ahead of time that amain Une has ruptured and water is rushing down the street, you have time to find
out the facts and what's being done to repair it BEFORE the media contacts you. Similarly, establish a protocol within your utility regarding the appropriate people or persons to speak
with the media. CI Be Proaetive -Ifyou know something newsworthy is occurring, tell the media before they need to call you. Bring them "into the loop" from the start. Develop a relationship
with local reporters. Reporters are always looking for good stories -offer them ideas of ongoing and emerging occurrences and initiatives in your organization. CI Return Media Calls
and Be Responsive -Reporters work under tight deadlines. Ifsomeone calls to ask a question or get "your side of the story," get back to them promptly. Ifthey are seeking a subject matter
expert Or need to speak with someone else within the utility, be certain that person responds promptly, If you don't, the reporter will likely find someone else and it may not work to
your benefit. CI Be Falr-When a reporter writes a good, well-balanced story, call or e-mail them to say you liked it and express your appreciation. Ifthere is an error, consider the
magnitude and the potential impact before reacting. Some mistakes can simply be let go. Ifone is particularly damaging, respectfully point out the error and offer the correet information.
Being accusatory to the media -particularly in a public forum -is rarely beneficial in the long tenn. CI Read the Paper, Listen to the RadiO, Watch Television News -Become familiar with
the media representatives in your area. The more you know about the person you're talking with, the easier it will be to tailor your message so it will be received effectively. -Compiled
by the AWWA Public Affairs Committee 
TRAINING and OTHER RESOURCES AWWA Seminars www.awwa.org Vulnembility Assessments fur Water Utilities Course material is licensed from AwwaRF and Sandia National Laboratories US Environmental
Protection Agency USEPA WA1ER PROTECTION TASK FORCE http://www.eoa.gov/safewater/securitvl EPA's Water Protection Task Force with assistance from EPA Regions and external partners are
taking many actions to improve the security ofthe nation's drinking water and wastewarer infrastrucrute. The actions fall in six major categories. Tools, Training, Information Sharing,
Research, and Networking. New Vulnerability Assessment Tool for Wastewater utilities Introducing VSAfTMwastewater http://www.vsatusers.netl The Vulnerability Self Assessment Software
Tool (VSAT"') provides a comprehensive, intuitive system for wastewater utilities seeking to anal,.,., their vulnerability to both intentional threats and natuml disasters. VSA'[I'M
organizes data, supports vulnerability analyses, documents the analyses, and presents complex information in an easy·to·understand format for the full suite ofpotential utility assets
including physical plant, employees, knowledge base, information technology, and customers. This invaluable software tool includes reference libraries ofboth potential threats and countermeasures,
and provides an enduring method for managing the information generated by security vulnerability assessments. 􀁾􀁾􀁯􀁬􀁬􀁊􀁬􀁩􀁟􀁬􀁩􀁬􀁡􀁮􀁷􀁡􀁩􀀻􀀬􀁲􀀩􀀨􀁧􀁥􀁮􀁣􀁩􀀮􀀢􀀢􀀢􀀧􀀭􀀭􀀭􀂷􀀠http://www.amwa
.netl Water Infonnation Sharing and Analysis Center (Water ISAC) Voluntary reporting by water sector utilities will contribute to the security ofthe nation's water infrastructure by
enabling an early alert system. Water and wastewater utiHties are encouraged to report malicious incident inlbrmation so that data may be analyzed to establish trends and identify imminent
or ongoing threats for the purpose of issuing timely and actionable warnings. The Water Sector and the National Infrastructure Protection Center (NIPC) have developed criteria and thresholds
for reporting incidents ofmaHcious or unknown origin. When the Water Information Sharing and Analysis Center (Water ISAC) is fully functional, incidents will be reported through the
Water lSAC web site. Until that time, water and wastewater utilities can voluntarily send incident information electronically from this site by completing the online fonn. FBIINIPC Offices
and Contacts • FBI Field Offices. http://www.fhLgov!contactlfuiinfu.hlm Go here to find the agency field office closest to you. The site has contact names and phone numhers listed by
city. • National Infrastructure Protection Center (NIPC). http://www.nipe.gov! The NIPC is the national critical infrastrucrute threat 􀁡􀁳􀁳􀁥􀁳􀁳􀁭􀁥􀁮􀁾􀀠warning, vulnerability, and
law enforcement investigation and response entity. The NIPC provides timely warnings of international threats, comprehensive analysis and law enforcement investigation and response,
International Association ofEmergency Managers http://www.iaem.comllndex.html 
__________________________ ___ AMERICAN WATERWORKS ASSOCIATION For AWWA U&G 0ZII1. INDIVIDUAL MEMBERSHIP APPLICATION J.." FAX (303) 347-0804 Phone 1-800-926.7337/303-794-7711 ®.􀁾􀀠6666
W. Quincy Avenue/Denver, CO 80235 Hayoyou evorbeon 0 member of AWWIO__ WWW.8wv.ra.org Who'" MembarNo. Pfaase fumishYDlJrpmforrecf mailing address below Qnd1ca!9 Whether bUlIlMSS orhome):
Oetls!n!)$$ Q Home OMr. a Mrs. FIlS1 Name Mlddlo JnlllaJOMs, o Or, Exact Street Address (P,o.. Bel( qr Mail $fQp) City Stele CIt Pmvinoo Company Name Homo ?Ilona Busil'lou Fax Applicant's
Si'gnalum """ SllInalum of AWWA Mambor Endorsing AppHcaUcn (OpUonal} III your COn'lPBtI)' .fI CUff..", member ofAW!.YA7__1fnot. plean pnwIde yoUr company's main eddreS$ Ii<I1ffemnt from
above: City Zip or Postal Code ANNUAL DUES: ANNUAl. DUES $ $99-Active Grade Code 02 Section Assassmant* Multl·Section Opliont TOTA!.OOE $ "Seelion Assessment * AWWA has: 43 local secUons.
Voo; section is delermIned by your address. However. some sections require additional Moosl tees 10 beUer seM theIr local members. SacUon 􀁡􀀤􀁾􀁾􀀤􀁲􀁲􀁬􀁥􀁮􀁬􀀤3ro mandatory for applicants
wItIl addresses as shown: Phl8$8 find yoorSoc/lQrJ A$$8$$men! ffl6in Ilw table at lighlend anJar the totolon /he line reeding ·Section A$$$'$$mont.• $5O-QperatlonsJAdmlnlstrative Grade
Code 06 (For 􀁾or admlnlstTati';e1e'Al1 pe($(lMfII or omPioyaQ of small utilities. WiIIIlOt receive Jouma1 AWWA) Make dledtpayabletG AWWA (U.S. fUnds Ot'lty), a MasterCard a VISA a Satld
ItlI/O!Cf a Amenean Expte$$ $32-Student $145-lnternational Grade Code 14 Grade Code 03 PREPAYMENT OF ONE VEAr{'S DUES REQUIREO No action can be takan on this applicaUon until payment
is received. Dues amounlgual'8ntoed lhrough Dllcemb,r 31, 2002 Exp. Dale _________ ACTIVE (02l OPERATIONS (06) STUDENT (14) Alabama.. MIsslSslJ)pl $11' Albarta, Manitoba, N,W. Territories,
saskatchewan $1. ,,, Canromla, Nevada Connfdicut, New Jernay .,.". '20 Florida. Minnesota, South 􀁃􀁡􀁭􀁾􀁮􀁥􀀬Tous $1' $1' 􀁇􀁡􀁯􀁾􀁩􀁡􀀠$118 $118 55 Idaho (western), Oregon, Oregon,
W'ashingtor! $10 illinois $8 $4 Meine, MassatfluS&11s, Nt!w Hampshlre, Rhoda Island, Vermont $50 $2' Mis$ouli se .. NewVork $1' $8 P9IInsyivania: .,. $5 ALL APPUCANTS SHOULD COMPLETE
THIS SECTION: Circle the descriptions below that best describe you, The infonnalion is used in audits or AWNA readership. CIrcle only ONE in each group, BUSINESS AND INDUSTRY A. Public
Water Supply utmty-Munlcipalty Owned B. Public water Supply UtUlty-llWaslor Owned C. Gove.rnmental-Federaf. Stata, Local D. Consullant E. Contractor F. Privata Industrial Syslerns or
Water Wholesaler Q, Manufecturer of EqUipment & Supplies fncluding Representatives H. Olalrlbutors of equipment & Supplies including Representatives I. Educalionallnstltutions. Facufty
and Studerns. Libraries. and Other Relaled Organlzalfons J. Fully Re11t'$d K. R_ch Labs !.... Unreported CHECK FlEIJl(S) SeRVED: so Wa!erSupplyOnly 7Q Wastewater Only 9 Q 60th 3 Q Oth",
JOB T1TLE A. ExecuUve-Gan'i Mgr., Commissioner, Board Member. City Mgr•• Mayor. President. VlcePresident. Owner, Partnor, Dlraclor. etc. e, Management-Olvlslon Head. Section Haao, Mgr.,
Chief Engineer, Comptroller. etc. C. Engineeringlnon-managelial-CMl Engr'., Mach. Engr. Envir. Engr •• Plannlng Mgr., Field Engr•• S)'$tems Designer, etc. D. ScierniflClnon-manageria1-ChemfSl,
Blcloglsf.. Biophysicist. Researcher, Analyst, etc. E. Purcllasing-Purchasing Agent, Procumtnent Speefallst. Buyer. etc. F. Operations-Foraman. Operator. Malntenanca, Crewman, Service
Rep., etc. G. Marketing & Saleslnoo-managenal·Mkt. Analyst, Mkl Rep., Salesman. Sales Rep., ele. H. Olher (de,,,;be) I. Professorial 􀁾􀀠Teacher. Educator, eic. Completion of1I1is Infonnation
Is optional. AVNlA maintains profile data for use in developing additional programs and servkes to meet the diverse needs of our members. BIr1h Dale , '-:-:--:---Race/Elhnlc Idanlificatlon:
(check one) a 1 American Indian/Alaskan Nallve a 2 AslanlPacffio-lslande' Q 3 African American Q 4 Hispanic Q 5 Whil. (Non-Hispanio) Q 6 Olher Gender: (oheok one) Q F Female Q M Male
t MUlTr..seCTION MEMBERSHIP OPTION In addlUon 10 your own section membership. you may also jOin otherAWWA secUon(s). This atrows you to receive information on events and adMI.ies (rom
olherlocal sectlon$. If thi:; Is ofln!eresl to you, call1-iOO-926--7337 fotrnUHI-seclian Inrormalion anCffees, Theftllltw.ing IlIl'CImIUitm is lor USPS Sland$td cbw: 􀁾􀁮􀁧􀁲􀁥􀁱􀁵􀀱􀁲􀁮􀁭􀁥􀁮􀁬􀀤ONL
.Y; In $(ImeAWWA sections. e penlon oflhe $eCIion allolmant equal to SI) pereanl or mote of lhedollUtslie sub$eriplbn rate charged for Ihe l'iacl.foo perlodleaJwm be allocated IOWIIJ#
a IlIbKription .,flhBt periodical. Dues all0!21ed for eBch pubDcaUon rnembel1: nloo;,,!}; okJuma1 $30 MaiastJ'flam $6 Op/klw $5 
, 
􀀶􀁾􀀠I CERTIFICATE OF COMPLETION ISSUED TO IN RECOGNITION OF SATISFACTORY COMPLETION OF THE August 6,2002 Satellite Teleconference: "Hardening Targets: Assessing Your Vulnerability
" SPONSORED BY THE TEXAS SECTION OF THE AMERICAN WATER WORKS ASSOCIATION Approved for _ Professional Development Hours OR 4 Contact Hours Credit OR _ Continuing Education Units Mike
Howe Executive Director 
.....