6.7 Utility Security, Emergency Response & Boil Water Advisories
Key Takeaways
- America's Water Infrastructure Act requires community water systems serving more than 3,300 people to conduct risk and resilience assessments and to prepare or revise emergency response plans, recertifying on a recurring schedule.
- Physical security basics — locked and alarmed hatches, fenced and lit sites, controlled chemical storage, and visitor control — remain the highest-value protection for most systems.
- Cyber protection of SCADA requires unique credentials, multifactor remote access, segmentation from business networks, tested offline backups, and a written procedure for operating in manual.
- Loss of pressure below 20 psi, a distribution system intrusion, or a treatment failure are the classic triggers for a precautionary boil water advisory, which is issued in coordination with the Public Water Supply Section.
- An emergency response plan must name who does what, where isolation valves and interconnections are, how to reach the regional office and the public, and how the system will provide water if the plant is unavailable.
6.7 Utility Security, Emergency Response & Boil Water Advisories
1. Risk assessments and emergency response plans
Under America's Water Infrastructure Act (AWIA) Section 2013, community water systems serving more than 3,300 people must conduct a risk and resilience assessment — covering natural hazards, malevolent acts, physical barriers, source water, treatment, storage and distribution, electronic and computer systems, chemical storage and handling, and financial infrastructure — and then prepare or revise an emergency response plan within six months of certifying the assessment. Both must be recertified on the recurring schedule in the statute.
Even for systems below that threshold, the same outline is the right framework, and North Carolina systems need it regardless: hurricanes and inland flooding are the state's defining water utility emergency.
A usable ERP contains:
- Call list — operators, management, the DEQ regional office, local emergency management, public health, the lab, and mutual aid contacts.
- Critical asset list with isolation valves, interconnections with neighboring systems, and bypass points.
- Alternate water supply — interconnections, bulk hauling, bottled water plans for critical users.
- Power contingency — generator locations, fuel plans, quick-connect receptacles.
- Communication templates — boil water advisory, do-not-drink, and rescind notices ready to fill in.
- Recovery procedures — flushing, disinfection, sampling, and the criteria for lifting an advisory.
2. Physical security
The highest-value measures are unglamorous:
- Fencing, gates, and lighting at plants, tanks, and pump stations; intrusion alarms on doors and tank hatches.
- Tank hatches locked and gasketed, vents and overflows screened, ladders guarded against casual climbing.
- Chemical storage locked, ventilated, separated by incompatibility, with inventory reconciled — an unexplained chemical loss is a security event.
- Access control: keys and codes tracked, contractors escorted, and a visitor log.
- Vehicles and equipment secured; utility uniforms and IDs verified by customers — impersonation is a real vector.
- Public education: neighbors reporting unusual activity at a remote tank site are, in practice, a system's best sensor.
3. Cyber security for SCADA
| Control | Practice |
|---|---|
| Identity | Unique named accounts; no shared or default passwords; prompt removal of departed staff |
| Remote access | Managed VPN with multifactor authentication; no direct internet exposure of HMIs or PLCs |
| Segmentation | Control network separated from the business network and from guest wireless |
| Backups | Offline, tested backups of PLC logic, HMI projects, and historian data |
| Patching | Vendor-approved updates on a maintained schedule |
| Manual operation | A written, practiced procedure for running the plant and distribution system without SCADA |
The last row matters most to an operator: if the control system is unavailable, the plant still has to make water. Knowing which valves to open, which pumps to start in hand, and how to dose chemicals manually is an operational competency, not an IT issue.
4. Contamination and intrusion response
Signs that warrant immediate investigation: unusual taste, odor, or color complaints clustered in one area; a sudden unexplained loss of disinfectant residual; evidence of tampering at a tank, hydrant, or wellhead; a broken or bypassed backflow assembly at a high-hazard site; and any report of illness clustered geographically.
The response sequence is isolate, notify, sample, and communicate: isolate the affected zone to prevent spread, notify the regional office and public health immediately, collect samples before flushing where practicable so the cause can be identified, and issue public notice appropriate to the hazard.
5. Boil water advisories
A precautionary boil water advisory is issued when the system cannot demonstrate that water reaching customers is safe. Classic triggers:
- Pressure loss below 20 psi in part of the system — a main break, a large fire flow, a pump station failure, or a power outage.
- Positive bacteriological results or an E. coli MCL violation (an acute violation requiring Tier 1 notice within 24 hours).
- Loss of disinfection or a treatment failure such as a filter breakthrough.
- Suspected intrusion or contamination.
Working the advisory:
- Define the affected area precisely using valve and pressure information.
- Coordinate the wording and extent with the Public Water Supply Section; use the State's approved language.
- Deliver notice by the fastest means that reaches everyone affected — door hangers, reverse-911, media, social media, and direct contact with critical users such as hospitals, dialysis centers, schools, and food service.
- Restore and verify: repair, flush, restore residual, and collect the bacteriological samples the State requires — typically satisfactory results on consecutive days — before rescinding.
- Rescind in writing to everyone who received the advisory, and document the entire sequence in the operating record.
[!WARNING] Do not rescind early. Lifting an advisory before the required sample results are in hand is both a violation and a genuine public health risk, and it is the decision most likely to be second-guessed later. The cost of an extra day of bottled water is trivial next to the cost of a waterborne outbreak.
Under America's Water Infrastructure Act Section 2013, which systems must complete a risk and resilience assessment and an emergency response plan?
A main break drops pressure below 20 psi in a neighborhood for several hours. What is the appropriate operational response?
Which cyber security practice most directly protects a utility's ability to keep operating during a control system outage?