Vulnerability Self Assessment Tool: New Requirements for Drinking Water Utilities Tutorial

Risk and Resilience Assessment Tutorial

New Requirements for Drinking Water Utilities
Review the tutorial below to learn more about new requirements under America’s Water Infrastructure
Act of 2018 (AWIA) for community water systems to conduct risk and resilience assessments. Please
note that this tutorial does not address other AWIA requirements, such as developing Emergency
Response Plans.

What does AWIA require for Risk and Resilience Assessments?

Each community water system serving more than 3,300 people must assess the risks to and resilience of
its system from malevolent acts and natural hazards.

The assessment must include:

• The resilience of the pipes and constructed

conveyances, physical barriers, source water,
water collection and intake, pretreatment,
treatment, storage and distribution facilities, and
electronic, computer, or other automated systems
(including the security of such systems);
• The monitoring practices of the system;
• The financial infrastructure of the system;
• The use, storage, or handling of various chemicals
by the system; and
• The operation and maintenance of the system; and
• May include an evaluation of capital and
operational needs for risk and resilience
management for the system.

The Asset Categories in VSAT Web 2.0 have been aligned to include all the system parameters required
under AWIA. The VSAT Threat Categories include both malevolent acts and natural hazards.

What deadlines apply to the Risk and Resilience Assessments?

Each community water system must submit a certification to the U.S. EPA that the system conducted
the risk and resilience assessment (systems do not send the assessment to U.S. EPA). The deadlines for
submitting the certification are as follows:

• March 31, 2020 if serving ≥100,000 people.

• December 31, 2020 if serving 50,000 to 99,999 people.
• June 30, 2021 if serving 3,301 to 49,999 people.

Every five years, each community water system must review and, if necessary, revise the risk and
resilience assessment and submit a recertification to the U.S. EPA.
 Vulnerability Self Assessment Tool: New Requirements for Drinking Water Utilities Tutorial

Are there approved methods for the AWIA risk and resilience assessment?
AWIA does not require the use of any standards, methods or tools for the risk and resilience
assessment. Each community water system is responsible for ensuring that the risk and resilience
assessment addresses all the system parameters listed in the law (as shown earlier in this tutorial).

The U.S. EPA recommends the use of standards, including the American Water Works Association’s
J100-10 Risk and Resilience Management of Water and Wastewater Systems, along with tools from the
U.S. EPA (e.g., VSAT) and other organizations, to facilitate sound risk and resilience assessments.

How is the certification for the risk and resilience assessment submitted to U.S. EPA?
Community water systems self-certify their risk and resilience assessments (i.e., no approval of the risk
assessment by the State or U.S. EPA is required under AWIA). The U.S. EPA is providing three options for
submittal of the certification: regular mail, email, and a secure online portal. The online submission
portal will provide drinking water systems with a receipt of submittal. The U.S. EPA recommends using
this method. More information on each of these options is available at:
https://www.epa.gov/waterresilience/americas-water-infrastructure-act-2018-risk-assessments-and-
emergency-response-plans

Can an older risk and resilience assessment be used to comply with AWIA?
AWIA does not prohibit the use of an older risk and resilience assessment to comply with the law.
However, water systems should consider the following when deciding whether to use an older risk
assessment:

• Does the risk assessment omit any water system components that must be addressed under
AWIA?
• Since conducting the risk assessment, has the water system made modifications, including a
change in operation or maintenance, to any components that must be addressed under AWIA?
• Since conducting the risk assessment, has the water system added any components that must
be addressed under AWIA?

If the water system has omitted, modified, or added components that must be addressed under AWIA,
then the water system must assess the risk to and resilience of the omitted, modified, or added
components before certifying the assessment.