17.5 Emergency Response Planning, Risk & Resilience & Security
Key Takeaways
- Emergency Response Planning and Safety Plan are named sub-topics in the SWRCB distribution Expected Range of Knowledge, and the T5 oral exam devotes two of six questions to management and emergency situations.
- The America's Water Infrastructure Act requires community water systems serving more than 3,300 people to complete risk and resilience assessments and emergency response plans and to recertify them every five years.
- An emergency response plan must be prepared within six months of certifying the corresponding risk and resilience assessment.
- California hazards that drive water utility planning include earthquake, wildfire, drought, flood, power shutoff, and cyber intrusion.
- A precautionary boil water notice is lifted on the basis of coliform-negative sample results plus restored pressure and residual, not on completion of the repair.
The Statutory Framework
The America's Water Infrastructure Act (AWIA) of 2018 requires every community water system serving more than 3,300 people to:
- Conduct a Risk and Resilience Assessment (RRA) and certify its completion to EPA
- Prepare or revise an Emergency Response Plan (ERP) within six months of certifying the RRA
- Review and recertify both every five years
The RRA must evaluate risk from malevolent acts and natural hazards to: the physical barriers; the source water; the pipes, conveyances, storage, treatment, and distribution facilities; the electronic, computer, and other automated systems including the use of those systems (this is the cybersecurity hook); the monitoring practices; the financial infrastructure; the chemical storage and handling; and the operation and maintenance of the system.
The ERP must include strategies and resources to improve resilience, plans and procedures for responses including alternative source water, relocation of intakes, and flushing, actions and equipment to lessen the impact including automated shutoffs and backup power, and strategies for detecting malevolent acts and natural hazards.
[!IMPORTANT] The RRA and ERP are not documents you write and file. The recertification cycle exists because systems, staffing, hazards, and technology change. A plan whose callout list has three retired people on it and whose SCADA section describes a system replaced four years ago is worse than no plan, because it creates false confidence.
California-Specific Hazards
| Hazard | Water system consequence | Planning response |
|---|---|---|
| Earthquake | Main breaks by the hundreds, tank failures, source loss, power loss, treatment plant damage, fire following earthquake with no water to fight it | Seismic-resistant pipe (restrained joint or HDPE) in fault and liquefaction zones, flexible tank connections, automatic seismic shutoff valves on tanks to preserve storage, emergency interties, portable pumps and generators, staged repair materials, potable water distribution points |
| Wildfire | Loss of power and pumping, structures burning cause simultaneous open services that collapse system pressure, benzene and VOC contamination of melted plastic pipe and service lines in burn areas, watershed damage causing post-fire turbidity and debris flow | Isolation valves to segment burned areas, pressure monitoring, post-fire flushing and VOC sampling protocol, source turbidity contingency, watershed sanitary survey updates |
| Drought | Source loss, water quality degradation in low reservoirs, groundwater level decline, revenue loss | Water Shortage Contingency Plan, alternate sources, interties, conservation stages |
| Flood | Well and vault inundation, treatment plant flooding, turbidity spikes, sewer overflow | Elevate or seal wellheads, watertight vaults, sandbag plans, backup power above flood elevation |
| Public Safety Power Shutoff (PSPS) | Planned multi-day utility power outage | Backup generation at every critical facility, fuel contracts, portable generator quick-connects, staffing plan for extended manual operation |
| Cyber intrusion | Loss of SCADA, manipulated setpoints, ransomware on the historian and business systems | Network segmentation, MFA, offline backups, documented ability to operate in local/manual mode, incident reporting |
| Contamination / malevolent act | Intentional introduction, cross-connection, vandalism | Site security, intrusion alarms, sampling capability, customer complaint surveillance |
| Sanitary sewer overflow | On the wastewater side, a reportable spill with public health and enforcement consequences | SSMP, spill response kit, CIWQS reporting |
Incident Command
California operates under the Standardized Emergency Management System (SEMS) and the National Incident Management System (NIMS), both built on the Incident Command System (ICS). Operators should know the structure well enough to plug into it:
| ICS function | Role |
|---|---|
| Incident Commander | Overall authority; sets objectives |
| Operations | Executes the tactical response - where most utility field staff work |
| Planning | Situation status, resource tracking, the incident action plan |
| Logistics | Materials, equipment, fuel, food, contractors |
| Finance/Administration | Cost tracking - critical for FEMA and Cal OES reimbursement, which requires documented labor, equipment, and material costs from hour one |
| Public Information Officer | Single voice to the public and press |
| Safety Officer | Authority to stop unsafe operations |
Unity of command, span of control, and a single incident action plan are the concepts most likely to appear on an exam.
Boil Water Notices
The decision that most often falls to an operator at 2 a.m.
When to consider one:
- Loss of pressure below 20 psi in a portion of the distribution system
- A confirmed or suspected backflow event of a health hazard
- Loss of disinfection at the plant, or an extended period with no detectable residual
- E. coli-positive results
- A treatment failure delivering inadequately treated surface water
- Physical evidence of contamination - a flooded well, a broken main in a sewage-saturated trench
The process:
- Consult the Division of Drinking Water as early as possible; DDW may direct the notice.
- Define the affected area precisely using the hydraulic model and valve records - notifying too broadly destroys credibility, and too narrowly is a public health failure.
- Issue the notice with the required content and by a Tier 1 method if it accompanies an acute violation - broadcast media, hand delivery, posting, phone or text, all within 24 hours.
- Notify special populations directly - hospitals, dialysis centers, schools, food service, day care, and large employers.
- Correct the cause, flush, disinfect per AWWA C651, and restore pressure and residual.
- Sample - typically two consecutive sets of coliform-negative samples 24 hours apart from the affected area.
- Lift the notice only with DDW concurrence, and communicate the lift by the same channels used to issue it, with instructions for customers to flush their plumbing and ice makers.
[!WARNING] The notice is not lifted because the repair is done. It is lifted on coliform-negative results plus restored pressure and residual, with regulator concurrence. Lifting early and then having to re-issue is the fastest way for a utility to lose the public trust it will need in the next event.
Mutual Aid
CalWARN - the California Water/Wastewater Agency Response Network - is the mutual aid framework through which California utilities share personnel, equipment, and materials during emergencies, under a pre-executed agreement that handles liability, reimbursement, and workers' compensation. Joining before an emergency is the entire point; a utility that tries to arrange aid during the event has already lost days.
Practical pre-staging: emergency interties with neighboring systems (with backflow protection and metering), agreements with bottled water suppliers and bulk hauling, contracts with generator and pump rental vendors, stocked repair clamps and pipe in the common sizes, and fuel supply agreements.
Security
| Layer | Measures |
|---|---|
| Deter | Fencing, lighting, signage, visible patrols |
| Detect | Intrusion alarms on tanks, wells, vaults, and chemical storage; camera coverage; SCADA alarms on abnormal conditions |
| Delay | Locks, hatch security, ladder guards, bollards |
| Respond | Alarm callout with confirmed receipt, law enforcement coordination, documented response procedures |
Chemical storage deserves specific attention: chlorine, ammonia, and sulfur dioxide are both operational hazards and potential targets, and facilities holding threshold quantities carry CalARP and Risk Management Plan obligations plus a Hazardous Materials Business Plan filed with the local CUPA.
Cybersecurity is now an explicit RRA element. The baseline expectations are the ones in Section 13.4: no internet-exposed remote access with default or shared credentials, multifactor authentication, network segmentation, patching, offline tested backups, and a demonstrated ability to run the plant in local/manual mode without SCADA - which is not only a security control but a resilience control, since it is also the answer to a failed communications link or a lightning-damaged PLC.
Under the America's Water Infrastructure Act, what is the deadline for preparing or revising an emergency response plan?
A main break drops pressure below 20 psi across a neighborhood, and a precautionary boil water notice is issued. The main is repaired and pressure is restored the same afternoon. When may the notice be lifted?
A wildfire burns through part of a service area. Beyond restoring pressure, what water quality hazard specific to burn areas must the utility address?