20.3 Security, Cybersecurity, Emergency Response Planning and Utility Management
Key Takeaways
Community water systems serving more than 3,300 people must certify a risk and resilience assessment and, within six months, an emergency response plan, then review and recertify both every five years under AWIA.
Cyber incidents at Oldsmar, Florida (2021) and Aliquippa, Pennsylvania (2023) showed why SCADA must be kept off the open internet and protected with unique passwords, multifactor authentication, segmentation and offline backups.
Signs of tampering, such as cut locks, open hatches or unexplained chemical changes, require isolating the facility, notifying law enforcement and the regulator, and sampling before returning to service.
OHA requires water suppliers to follow up on water quality complaints and keep records, and community systems with 300 or more connections or more than 1,000 people need a 20-year master plan.
Asset management ties inventory, condition, criticality and lifecycle cost to capital and O&M budgets; supervisors also handle scheduling, evaluations, discipline and procurement.
Physical Security
Water and wastewater facilities are critical infrastructure. Basic protections are layered:
- Deter and delay: fencing, locked gates and hatches, tamper-evident seals, lighting, and secured chemical storage.
- Detect: intrusion alarms on hatches and doors, cameras, SCADA alarms for unexpected changes in level, pressure or chemical feed.
- Respond: written procedures, after-hours callout, and coordination with local law enforcement.
- Key and access control: track keys and codes, retrieve them when staff leave, and require visitor check-in.
Responding to suspected tampering
- Do not disturb evidence; photograph the scene.
- Isolate the affected facility if contamination is possible. That might mean taking a reservoir offline or closing valves.
- Notify law enforcement and the regulator (OHA for drinking water; DEQ for wastewater permit issues) and follow your emergency response plan.
- Sample, under guidance, before returning facilities to service, and consider public notification or advisories.
- Report through information-sharing channels such as WaterISAC.
America's Water Infrastructure Act (AWIA)
Section 2013 of AWIA amended Safe Drinking Water Act section 1433. Community water systems serving more than 3,300 people must:
- conduct and certify a risk and resilience assessment (RRA) covering natural hazards and malevolent acts; pipes and constructed conveyances; physical barriers; source water; treatment; storage; electronic, computer and other automated systems including cybersecurity; financial infrastructure; chemical handling; and operation and maintenance;
- prepare or revise an emergency response plan (ERP) that incorporates the RRA findings, and certify it within six months after the RRA; and
- review and recertify both every five years.
ERPs cover strategies to improve resilience, emergency plans and procedures, actions to detect and reduce malevolent acts, and coordination with local emergency planning.
Operational Technology (OT) Cybersecurity
Attacks on water systems are real. In 2021 an intruder used remote-access software at the Oldsmar, Florida treatment plant to try to raise the sodium hydroxide setpoint to a dangerous level; an operator saw the cursor move and reversed it. In 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania and other utilities that still had default passwords.
Practical controls recommended by EPA and CISA:
| Control | Why it matters |
|---|---|
| Remove OT devices from direct internet exposure; use secure remote access only | Stops casual scanning and attacks |
| Change default passwords; use unique, strong credentials and multifactor authentication | Blocks the most common intrusion paths |
| Segment OT networks from business IT networks | Limits the spread from phishing or ransomware |
| Keep offline backups of PLC programs, configurations and data; practice manual operation | Allows recovery without paying ransom |
| Patch, inventory assets, log and monitor | Reduces vulnerabilities and detects intrusions |
| Train staff on phishing and reporting | People are the first line of defense |
Engineering safeguards help too: hard-wired high and low limits on chemical feed pumps and alarms that do not depend on the HMI.
Oregon Planning and Customer Rules
- Complaints: water suppliers must follow up on complaints about water quality and keep records of their actions (OAR 333-061-0025(2)(h)). Log the date, location, description, investigation, result and response.
- Master plans: a community water system with 300 or more service connections or serving more than 1,000 people must keep a master plan covering at least 20 years. It includes demand projections, an engineering evaluation of existing facilities, deficiencies and a capital improvement program (OAR 333-061-0060(5)). It addresses water management and conservation planning when a Water Resources Department permit requires it.
- Plans review: OHA must approve plans for new facilities and major modifications before construction (OAR 333-061-0060).
Asset Management and Budgeting
Asset management answers five questions:
- What do we own?
- What condition is it in?
- Which assets are most critical (likelihood times consequence of failure)?
- What is the minimum lifecycle cost to keep the service level?
- How do we fund it long-term?
It feeds the capital improvement plan (CIP) and rate setting.
| Budget | Typical contents |
|---|---|
| Operating (O&M) | Labor, power, chemicals, lab, maintenance parts, insurance, regulatory fees |
| Capital | New or replacement assets with multi-year lives: pipes, pumps, treatment upgrades |
Operators contribute by tracking chemical and power use per million gallons, documenting equipment condition, and justifying replacements with data. Procurement follows local purchasing rules, such as quotes, bids and sole-source justification, and records costs for later grant or disaster reimbursement.
Supervision and Administration
Supervisory tasks on the higher-grade exams include:
- scheduling shifts and assigning work to cover all operating periods;
- enforcing safety rules and SOPs, and keeping SOPs current;
- conducting performance evaluations and documenting coaching and discipline consistently and fairly;
- participating in hiring and training, and tracking staff certifications and CEUs;
- preparing operating reports (daily logs, monthly reports, DMRs, OHA reports) and keeping records for the required periods; and
- giving tours and public presentations, which build community support for rates and projects.
Under America's Water Infrastructure Act, how often must a community water system serving more than 3,300 people review and recertify its risk and resilience assessment and emergency response plan?
Every three years
Only once, when first prepared
Every five years
Every year
Which action best reduces the risk of an Oldsmar-style remote takeover of a plant's HMI?
Removing internet exposure, requiring MFA for remote access, and segmenting OT
Using one shared login for all operators so access is easier to manage
Turning off all SCADA alarms to reduce nuisance after-hours callouts
Posting the remote-access password at the operator console for convenience
A community water system has 2,400 service connections. What planning document does OAR 333-061-0060 require it to maintain?
Only an annual operating budget approved by council
A master plan covering at least a 20-year period
A biosolids management plan approved by DEQ
A recycled water use plan approved by DEQ
Sections you finish are checked off in the contents.
You've completed this section
Continue exploring other exams