Security Vulnerability

Self-Assessment Guide for Small Drinking Water Systems

 

 

 

 

 

 

 

 

 

Association of State Drinking Water Administrators

 

National Rural Water Association

 

Wyoming Association of Rural Water Systems

 

May 30, 2002

class=Section2>

 

 


 

 

A Note about Security for this Document

                 

 

This document contains sensitive information about the security of your water system.  Therefore, it should be treated as Confidential Information and should be stored in a secure place at your water system.  A duplicate copy should also be stored in a secure off-site location.

 

 

 

 

Acknowledgments

 

 

This document is the result of collaboration among the Association of Drinking Water Administrators (ASDWA), the U.S. Environmental Protection Agency (U.S. EPA), the U.S. EPA Drinking Water Academy, and the National Rural Water Association (NRWA).  We also thank NRWA for the template that was used as the foundation for this project. 

 

 

 


 

 

Contents   

 

Security Vulnerability Self-Assessment Guide for Small Water Systems. 4

Introduction. 4

How to Use this Self-Assessment Guide. 4

Keep this Document. 4

Security Vulnerability Self-Assessment. 5

Record of Security Vulnerability Self-Assessment Completion. 5

Inventory of Small Water System Critical Components. 6

Security Vulnerability Self-Assessment for Small Water Systems. 7

General Questions for the Entire Water System. 7

Water Sources. 10

Treatment Plant and Suppliers. 10

Distribution. 12

Personnel. 12

Information storage/computers/controls/maps. 13

Public Relations. 14

Attachment 1. Prioritization of Needed Actions. 16

Attachment 2. Emergency Contact List. 17

Section 1. System Identification. 17

Section 2. Notification/Contact Information. 18

Section 3. Communication and Outreach. 21

Attachment 3: Threat Identification Checklists. 22

Water System Telephone Threat Identification Checklist. 22

Water System Report of Suspicious Activity. 24

Certification of Completion. 27

 

class=Section4>

 


 


 

Security Vulnerability Self-Assessment Guide for Small Water Systems

 

Introduction

 

Water systems are critical to every community. Protection of public drinking water systems must be a high priority for local officials and water system owners and operators to ensure an uninterrupted water supply, which is essential for the protection of public health (safe drinking water and sanitation) and safety (fire fighting).

 

Adequate security measures will help prevent loss of service through terrorist acts, vandalism, or pranks. If your system is prepared, such actions may even be prevented. The appropriate level of security is best determined by the water system at the local level.

 

This Security Vulnerability Self-Assessment Guide is designed to help small water systems determine possible vulnerable components and identify security measures that should be considered. A “vulnerability assessment” is the identification of weaknesses in water system security, focusing on defined threats that could compromise its ability to provide adequate potable water, and/or water for firefighting. This document is designed particularly for systems that serve populations of 3,300 or less.  This document is meant to encourage smaller systems to review their system vulnerabilities, but it may not take the place of a comprehensive review by security experts.

 

The Self-Assessment Guide has a simple design.  Answers to assessment questions are “yes” or “no,” and there is space to identify needed actions and actions you have taken to improve security. For any “no” answer, refer to the “comment” column and/or contact your state drinking water primacy agency.

How to Use this Self-Assessment Guide

 

This document is designed for use by water system personnel. Physical facilities pose a high degree of exposure to any security threat.  This self-assessment should be conducted on all components of your system (wellhead or surface water intake, treatment plant, storage tank(s), pumps, distribution system, and other important components of your system).

 

The Assessment includes an emergency contact list for your use. This list will help you identify who you need to contact in the event of an emergency or threat and will help you develop communication and outreach procedures. Filling out the Emergency Contact List is an important step toward developing an Emergency Response Plan, which provides detailed procedures on how to respond to an emergency.

 

You may be able to obtain sample Emergency Response Plans from your state drinking water primacy agency.

 

Security is everyone’s responsibility.  We hope this document helps you to increase the awareness of all your employees, governing officials, and customers about security issues.

 

Once you have completed this document, review the actions you need to take to improve your system’s security.  Make sure to prioritize your actions based on the most likely threats.  Please complete the Certificate of Completion on page 27 and return only the certificate to your state drinking water primacy agency.  Do not include a full copy of your self-assessment.

 

Keep this Document

 

This is a working document. Its purpose is to start your process of security vulnerability assessment and security enhancements.  Security is not an end point, but a goal that can be achieved only through continued efforts to assess and upgrade your system.

 

Don’t forget that this is a sensitive document. It should be stored separately in a secure place at your water system.  A duplicate copy should also be retained at a secure off-site location.

 

Access to this document should be limited to key water system personnel and local officials as well as the state drinking water primacy agency and others on a need-to-know basis.

class=Section6>

 

Security Vulnerability Self-Assessment

 

Record of Security Vulnerability Self-Assessment Completion

 

The following information should be completed by the individual conducting the self-assessment and/or any additional revisions. 

Name:

 

 

 

Title:

 

 

 

Area of Responsibility:

 

 

 

Water System Name:

 

 

 

Water System PWSID:

 

 

 

Address:

 

 

 

City:

 

 

 

County:

 

 

 

State:

 

 

 

Zip Code:

 

 

 

Telephone:

 

 

 

Fax:

 

 

 

E-mail:

 

 

 

Date Completed:

 

 

 

 

 

 

 

Date Revised:

 

Signature:

 

Date Revised:

 

Signature:

 

Date Revised:

 

Signature:

 

Date Revised:

 

Signature:

 

Date Revised:

 

Signature:

 


 

 

Inventory of Small Water System Critical Components

 

Component

Number & Location (if applicable)

Description

Source Water Type

    Ground Water

 

 

    Surface Water

 

 

Purchased

 

 

Treatment Plant

Buildings

 

 

Pumps

 

 

Treatment Equipment (e.g., basin, clearwell, filter)

 

 

 

 

 

 

 

 

Process Controls

 

 

Treatment Chemicals and Storage

 

 

Laboratory Chemicals and Storage

 

 

Storage

    Storage Tanks

 

 

     Pressure Tanks

 

 

Power

Primary Power

 

 

Auxiliary Power

 

 

Distribution System

Pumps

 

 

Pipes

 

 

Valves

 

 

Appurtenances (e.g., flush hydrants, backflow preventers, meters)

 

 

Other Vulnerable Points

 

 

Offices

Buildings

 

 

Computers

 

 

Files

 

 

Transportation/

Work Vehicles

 

 

Communications

Telephone

 

 

Cell Phone

 

 

Radio

 

 

Computer Control Systems (SCADA)

 

 

 


 

 

Security Vulnerability Self-Assessment for Small Water Systems

 

General Questions for the Entire Water System

The first 13 questions in this vulnerability self-assessment are general questions designed to apply to all components of your system (wellhead or surface water intake, treatment plant, storage tank(s), pumps, distribution system, and offices).  These are followed by more specific questions that look at individual system components in greater detail.

QUESTION

ANSWER

COMMENT

ACTION NEEDED/TAKEN

1.    Do you have a written emergency response plan (ERP)?

Yes ?     No ?

It is essential that you have an ERP. If you do not have an ERP, you can obtain a sample from your state drinking water primacy agency.  As a first step in developing your ERP, you should develop your Emergency Contact List (see Attachment 2).

 

A plan is vital in case there is an incident that requires immediate response.  Your plan should be reviewed at least annually (or more frequently if necessary) to ensure it is up-to-date and addresses security emergencies.

 

You should designate someone to be contacted in case of emergency regardless of the day of the week or time of day.  This contact information should be kept up-to-date and made available to all water system personnel and local officials (if applicable).

 

Share this ERP with police, emergency personnel, and your state primacy agency.  Posting contact information is a good idea only if authorized personnel are the only ones seeing the information.  These signs could pose a security risk if posted for public viewing since it gives people information that could be used against the system.

 

2.     Is access to the critical components of the water system (i.e., a part of the physical infrastructure of the system that is essential for water flow and/or water quality) restricted to authorized personnel only?

Yes  ?     No ?

You should restrict or limit access to the critical components of your water system to authorized personnel only. This is the first step in security enhancement for your water system. Consider the following:

 

w Issue water system photo identification cards for employees, and require them to be displayed within the restricted area at all times.

 

w Post signs restricting entry to authorized personnel and ensure that assigned staff escort people without proper ID.

 

 


 

 

QUESTION

ANSWER

COMMENT

ACTION NEEDED/TAKEN

3.   Are facilities fenced, including wellhouses and pump pits, and are gates locked where appropriate?

Yes ?     No ?

Ideally, all facilities should have a security fence around the perimeter.

 

The fence perimeter should be walked periodically to check for breaches and maintenance needs.  All gates should be locked with chains and a tamper-proof padlock that at a minimum protects the shank.  Other barriers such as concrete "jersey" barriers should be considered to guard certain critical components from accidental or intentional vehicle intrusion.

 

4.  Are your doors, windows, and other points of entry such as tank and roof hatches and vents kept closed and locked?