1.6 Utility Administration: SOPs, Records, Security, Cybersecurity, Emergency Planning & Supervision

1.6 Utility Administration: SOPs, Records, Security, Cybersecurity, Emergency Planning & Supervision

Operators are judged by more than plant performance. Every WPI Need-to-Know Criteria includes a Security, Safety and Administrative Procedures area with tasks such as "establish and/or update SOPs," "complete required regulatory reports," "conduct routine security checks," "respond to customer complaints" and "review and update facility emergency response plans." The Water Treatment Class 4 exam (Alabama Water Grade IV) adds budgets, procurement, contract and project management, and supervision.

Standard Operating Procedures (SOPs)

An SOP is a written, step-by-step procedure for a task that must be done the same safe way every time. Good SOPs:

• State the purpose, scope and responsible position.
• List safety precautions and required PPE before the steps.
• Give numbered steps with the set points, valve positions and readings to record.
• Say what to do when a reading is out of range, and who to notify.
• Carry a revision date and approval and are reviewed on a schedule and after any incident, process change or equipment change.

SOPs are also training documents. New operators learn a task by following the SOP under supervision, and the supervisor signs off when the operator can perform it alone.

Operating Records and Regulatory Reports

• Daily logs and bench sheets record readings, chemical feeds, pump run times, lab results and every process change with the time and the operator's initials. Corrections use a single line through the error, with initials and date.
• Water systems submit the ADEM monthly operating report by the 10th of the next month, signed by a certified operator (Section 1.5).
• Wastewater facilities submit Discharge Monitoring Reports electronically so ADEM receives them by the 28th of the following month, and keep monitoring records for at least three years (Section 1.3).
• Maintenance records document work orders, preventive maintenance, parts, labor and equipment history. They support budgets and asset management decisions.

Customer Complaints and Public Contact

Every complaint gets a record of date, location, type of complaint and action taken; ADEM requires water systems to keep that file for three years (Rule 335-7-10-.05(d)). Good practice is to respond quickly, test at the site when the complaint involves taste, odor, color, pressure or illness, explain findings in plain language and look for patterns that reveal a system problem. Customers must also be told in advance about planned shutdowns and flushing that may cause discolored water.

Physical Security

• Lock gates, hatches, wellhouses, chemical rooms and tank access ladders; use intrusion alarms and lighting.
• Conduct and record routine security checks of fences, locks, vents and hatches; investigate any sign of tampering and report it to law enforcement and ADEM when water quality could be affected.
• Control keys, badges and visitor access; never let contractors work unescorted in critical areas without authorization.

Cybersecurity for Control Systems

SCADA systems, PLCs and remote access tools are targets. EPA and the water sector emphasize basic measures:

1. Change default passwords and use strong, unique passwords.
2. Require multifactor authentication for any remote access.
3. Separate the control network (OT) from the business network (IT) and the internet.
4. Keep an inventory of control-system devices and apply security updates.
5. Maintain offline backups and a tested incident response plan, including manual operation if SCADA is lost.
6. Train staff to recognize phishing and to report anything unusual.

ADEM's OpCert web pages include a cybersecurity resource page for public water systems.

Risk and Resilience Assessments and Emergency Response Plans

Section 1433 of the Safe Drinking Water Act, as amended by America's Water Infrastructure Act of 2018 (AWIA), requires every community water system serving more than 3,300 people to:

• Conduct a risk and resilience assessment (RRA) covering malevolent acts and natural hazards, including source water, pipes, treatment, storage, electronic and computer systems, chemicals, and operation and maintenance, and certify it to EPA.
• Prepare an emergency response plan (ERP) and certify it within six months after certifying the RRA.
• Review and recertify both every five years. The original RRA deadlines were March 31, 2020 for systems serving 100,000 or more, December 31, 2020 for 50,000 to 99,999 and June 30, 2021 for 3,301 to 49,999, so the five-year recertifications fell in 2025 and 2026.

An ERP lists emergency contacts, chain of command, alternate water sources, procedures for loss of power or treatment, chemical releases, contamination events, boil-water notices and communication with customers and agencies. Drills and after-action reviews keep it current.

Chemical Accident Prevention and Spill Planning

• EPA's Risk Management Program (RMP) applies when a process holds more than a threshold quantity of a regulated substance; for chlorine the threshold is 2,500 pounds (about two full ton containers). ADEM's groundwater rule (335-7-5-.16) tells treatment facilities with more than 2,500 pounds of chlorine to contact ADEM's Air Division about their RMP responsibilities.
• Facilities storing oil above EPA's thresholds, such as more than 1,320 gallons of aboveground oil storage (counting containers of 55 gallons or more), need a Spill Prevention, Control and Countermeasure (SPCC) plan for fuel tanks and generators.

Supervision, Budgets and Procurement

Chief operators and supervisors:

• Schedule staff so every shift meets ADEM staffing rules (Section 1.1) and certified coverage.
• Enforce safety rules and SOPs, train new operators and document training.
• Conduct performance evaluations, apply progressive discipline consistently (verbal warning, written warning, suspension, termination) and document every step.
• Prepare the operating budget (labor, power, chemicals, lab costs, maintenance and contract services) and propose capital improvements with justification, costs and priority.
• Follow the utility's procurement rules: written specifications, quotes or competitive bids as required by policy and Alabama public-works and bid laws, and verification that delivered chemicals meet specifications and certificates of analysis.
• Track energy and chemical use per million gallons treated to find savings.