17.3 Security, Hurricane Preparedness & Contingency Planning (Florida)

17.3 Security, Hurricane Preparedness & Contingency Planning (Florida)

Quick Answer: Protect critical assets with fencing, lighting, access control, and SCADA cyber hygiene; complete vulnerability assessment thinking; and for Florida storms pre-stage fuel, generators, chemicals, staff, and mutual aid while planning for flood and SSO risk. Use the emergency/contingency plan to communicate with FDEP, emergency management, and the public—including boil-water notices when pressure or contamination is compromised.

Florida’s operator job is inseparable from disasters and security. Hurricanes, tropical storms, tornadoes, flooding, and cyber incidents all threaten treatment continuity. Class C safety/security expectations and real utility practice both require you to keep bad actors out, keep power and chemicals in, and tell the public the truth when water may be unsafe.

---

1. Plant Security Fundamentals

Drinking-water and wastewater facilities are critical infrastructure. A hostile person or careless trespasser can vandalize equipment, contaminate finished water, steal chemicals, or disable power. Security is layered:

1.1 Physical security checklist

• Perimeter fencing intact; gates closed and locked when unattended
• Lighting on chemical areas, entries, clearwells, and parking
• Access control — visitor logs, employee badges, contractor escorts
• Hatches and vaults locked; ladder guards in place
• Chemical storage secured (chlorine, hypochlorite, fluoride, fuel)
• Vehicles and boats (for coastal plants) inventoried and fueled
• Deliveries verified—know who is authorized to drop chemicals

If someone you do not recognize is photographing clearwells or asking detailed questions about residual levels and access points, treat it as a security concern and notify supervision per policy—not as a casual tour.

1.2 Cyber and SCADA awareness

Modern plants use SCADA, remote telemetry, VFDs, and networked analyzers. Cyber events can:

• Stop pumps or change setpoints without a valid process reason
• Hide alarms or falsify residual/turbidity readings
• Lock operators out of HMI screens

Operator-level cyber hygiene:

• Use unique credentials; never share passwords on sticky notes at the HMI.
• Do not plug unknown USB drives into control computers.
• Be suspicious of phishing emails about “urgent password resets.”
• Report anomalous setpoint changes, unexplained PLC faults, or remote logins.
• Keep corporate IT/OT staff in the loop; do not disable firewalls “to make the radio work.”

You do not need to be a cybersecurity engineer for the exam—you need to know that SCADA is a security surface and that unusual automation behavior can be malicious or accidental but must be investigated.

---

2. Vulnerability Assessment Concept

A vulnerability assessment (VA) systematically asks:

1. What are our critical assets (wells, treatment trains, clearwells, high-service pumps, generators, chemical systems, key mains)?
2. What threats exist (vandalism, terrorism, insider threat, cyber, natural disaster)?
3. How vulnerable is each asset (open access, single points of failure)?
4. What are the consequences if the asset fails (boil water for 50,000 people, raw sewage into a bay)?
5. What countermeasures reduce risk (redundancy, hardening, cameras, training)?

Drinking-water systems in the United States have long been expected to assess vulnerabilities and maintain emergency response capability (including post-9/11 security frameworks and ongoing EPA/state expectations). For exam purposes: know why VAs exist (protect public health by reducing high-consequence failures) and that findings should feed both capital security projects and the emergency response plan (ERP).

Wastewater plants use similar logic: loss of power or flooded headworks can create sanitary sewer overflows (SSOs) and environmental damage—Florida’s coastal and low-lying plants are especially exposed.

---

3. Florida Hurricane Preparedness

Hurricane season (traditionally June 1–November 30) is not theoretical for Florida operators. Storms threaten:

• Electric grid collapse for days
• Flooding of low electrical gear, wet wells, and plants in surge zones
• Wind damage to buildings, tanks, and chemical facilities
• Staffing shortages when employees evacuate or roads close
• Supply chain breaks for fuel, chemicals, and parts
• Distribution main breaks and pressure loss after debris and washouts
• Collection system SSOs when lift stations fail

3.1 Pre-storm operational priorities

3.2 Generators and fuel—exam and field critical

If the utility cannot run high-service pumps, well pumps, or blowers, public health fails quickly. Operators should know:

• Generator nameplate capacity vs essential load (not every building load is essential).
• Automatic transfer vs manual procedures.
• Runtime hours at expected load and fuel burn rates.
• Cooling, oil pressure, and alarm response during multi-day runs.
• That wet or overloaded generators fail—maintenance before the storm is non-negotiable.

Coastal plants may need to shut down and evacuate under emergency management orders; inland plants may run islanded for a week. Both scenarios belong in the written plan.

3.3 Flooding and SSO risk

Florida’s flat topography and high water tables mean:

• Lift stations without power overflow to streets and waterways.
• Infiltration/inflow spikes during torrential rain.
• Treatment plants in floodplains can lose electrical rooms first.

Mitigations include portable generators on quick-connects, bypass pumping plans, raised control panels, and pre-emptive reduction of wet-well levels where strategies allow. After the storm, SSO reporting and cleanup follow state/local rules—safety first (live wires, contaminated water, structural damage).

3.4 Distribution system after the storm

Expect:

• Pressure loss from power outages or massive leaks
• Main breaks from uprooted trees and washouts
• Cross-connection risk if pressures go negative
• Need for boil-water notices, flushing, and bacteriological clearance before rescinding notices

Operators coordinate with distribution crews, labs, and public information officers—not alone in a vacuum.

---

4. Contingency and Emergency Response Plans

A contingency plan / ERP is the utility’s playbook for abnormal conditions. Core contents typically include:

1. Goals — protect public health, safety, environment, and critical service
2. Organization — incident command roles, succession of authority
3. Risk scenarios — hurricane, tornado, flood, contamination, cyber, malevolent act, major main break, treatment failure
4. Immediate actions — shutdown criteria, isolation valves, alternate sources
5. Communications — internal, FDEP, DOH/county health, emergency management, customers, media
6. Resources — equipment lists, mutual aid, contractors, laboratories
7. Recovery — sampling, disinfection, after-action reviews

Operator exam angle: You may not rewrite the ERP on test day, but you must know that plans exist, that roles are pre-assigned, and that improvisation without communication causes conflicting public messages.

Practice makes plans real: tabletop exercises and annual hurricane drills surface missing fuel contracts and dead radio batteries before landfall.

---

5. Communicating with FDEP and the Public

5.1 Regulatory and emergency partners

During significant events, utilities commonly coordinate with:

• Local emergency management / EOC for storm operations and public messaging
• FDEP for drinking-water and wastewater incident reporting, permit exceedances, and recovery expectations
• County health departments on boil-water and epidemiological concerns
• Mutual aid networks for shared resources

Know your utility’s who notifies whom matrix. Unauthorized social-media posts by individual operators can contradict official notices—use approved channels.

5.2 Boil water and public notice concepts

Boil-water notices (or advisories/orders, terminology varies by jurisdiction) protect consumers when finished water may be microbially unsafe—classic triggers include:

• Loss of system pressure / widespread outages
• Main breaks with possible contamination
• Treatment failures (e.g., inadequate disinfection)
• Confirmed or suspected pathogen contamination

Public notice themes (aligned with SDWA public notification concepts):

Important distinctions

• Microbial risk → boiling often appropriate when pressure/pathogen concerns dominate.
• Chemical contamination (fuel spill into a well, etc.) → boiling may concentrate some chemicals or be irrelevant; “do not drink/do not use” may be required instead.
• Rescind notices only after corrective action and satisfactory coliform (or other required) sampling per state/utility protocol—not because “the water looks clear.”

Consumer Confidence Reports and Tiered public notices for MCL violations are related compliance tools; storm boil-water actions are often the acute version of the same public-health communication duty.

---

6. Putting Security and Storm Prep Together

A well-run Florida utility treats security and hurricane prep as one continuity program:

• Hardened gates keep looters out of a dark plant after evacuation.
• Cyber backups survive building damage.
• VA-identified single points of failure get portable generator taps before June.
• ERP call trees reach FDEP and the county EOC without hunting for phone numbers in a flooded office.

Operators who only memorize process chemistry but cannot explain generator fuel, boil-water triggers, or upwind chlorine response are only half-prepared for Class C realities—and for the night the hurricane actually comes.

---

Memory Hooks

• Deter–detect–delay–respond–recover for physical security.
• SCADA passwords and USB discipline are operator security tools.
• VA finds critical assets and weak points; ERP uses the findings.
• Florida storms: fuel, gensets, chemicals, people, mutual aid, flood/SSO.
• FDEP + EOC + public messaging run through the plan.
• Boil water for microbial/pressure events; don’t assume boiling fixes chemical contamination; sample before lifting notices.