Pages

Wednesday, March 27, 2024

Recent Cyber Attacks: What is Phishing and Steps to Protect Your System

What is phishing?

Cybercriminals use various tools to commit crimes against the public and private sectors. One of the main avenues of cybercrime is through phishing. Phishing occurs when criminals try to get users to open harmful links, emails, or attachments that could request personal  information or infect devices. Phishing messages or “bait” usually come in the form of an email, text, direct message on social media, or phone call. These messages are often designed to look like they come from a trusted person or organization, to prompt a response. They use urgent, emotional, or threatening language to encourage recipients to take quick action 

- This paragraph adapted from CISA “Recognize and Report Phishing” webpage.

How have phishing attacks affected the water sector?

In recent the past year a cyber attack was attempted against a public water system through phishing messages. The cybercriminals pulled information from a state public health agency's public facing website that included water system operator's email addresses. The cybercriminal then created an email that appeared to come from the state health department claiming issues with the operator's license or public water system information. The attacker utilized state logos and health department titles in the email subject line and header to give the email the appearance of legitimacy. The recipients were urged to click on a link to "correct" the issue. Immediately upon discovery, the state issued communication that the email was a phishing attempt. The phishing attempt was not successful as nobody clicked the link. 

How can you avoid phishing attacks?

1. Train and Recognize. 

Take advantage of the various state and federal training resources to help your staff look for these common signs:

  • Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately
  • Requests to send personal and financial information
  • Untrusted, shortened URLs
  • Incorrect email addresses or links, like “amazan.com”
  • A common sign used to be poor grammar or misspellings although in the era of artificial intelligence (AI), some emails will now have perfect grammar and spellings, so look out for the other signs.

Phishing Training Resources: 

2. Resist

If you suspect phishing, resist the temptation to click on links or attachments that seem too good to be true and may be trying to access your personal information. Instead, report the phish to protect yourself and others. Typically, you’ll find options to report near the person’s email address or username. You can also report via the “report spam” button in the toolbar or settings.

3. Delete

Delete the message. Don’t reply or click on any attachment or link, including any “unsubscribe” link. Just delete.

4. Report 

Reporting phishing if there is no action taken and/or no impact to the system

  • Use reporting features that are built into Microsoft Outlook and other cloud email platforms, as well as report spam directly to Microsoft, Apple, and Google, as applicable. Reporting suspicious phishing activity is one of the most efficient methods for protecting organizations as it helps email service providers identify new or trending phishing attacks.
  • Report any suspicious emails or emails from unknown addresses asking you to click on links to your IT group/person (as applicable).

Reporting phishing emails if employee clicks on link and your system experiences impact 

  • CISA urges organizations to promptly report phishing incidents to CISA at report@cisa.gov or call the 24/7 response line at (888) 282-0870.
  • To report spoofing or phishing attempts (or to report that you've been a victim), file a complaint with the FBI’s Internet Crime Complaint Center (IC3), or contact your local FBI Field Office to report an incident.
  • State, local, tribal, and territorial (SLTT) government entities can report to the Multi-State Information Sharing and Analysis Center (MS-ISAC) by emailing SOC@cisecurity.org or calling (866) 787-4722
  • Please note: if the phishing email results in a cyberattack that affects your water system’s ability to bill customers or operate. Please follow the division’s Guidance: Respond and Report Cyberattacks

How can you identify a CO state email?

The CDPHE wants to encourage you and your facility to engage in the above four actions to avoid phishing attempts. And the division wants to supply you with  information on how to recognize a real CO state email from a fake phishing email. 




➽ Kyra Gregory Drinking Water Training Specialist 



Spring Training: Stormwater Management, Protecting Our Source Waters

The spring thaw is a perfect time to consider getting in shape for healthy drinking water sources through effective stormwater management. Stormwater runoff, generated from rain and snowmelt that flows over land or impervious surfaces, such as paved streets, parking lots, and building rooftops, does not soak into the ground. Runoff picks up and deposits harmful pollutants like trash, chemicals, and dirt/sediment into streams, lakes, and groundwater, that can pollute our drinking water sources if not properly managed. From construction and management professionals to municipalities to local communities to youth leadership, Colorado spring training has something for you.

Water Quality Improvement Fund (WQIF)

The Water Quality Improvement Fund (WQIF) is a Colorado state grant program funded by civil penalties collected for water quality violations. It is part of the Water Quality Control Commission’s Regulation 55 - State Funded Water and Wastewater Infrastructure Programs. The WQIF supports the Colorado Water Control Division’s (WQCD) culture of health by providing grant funds for water quality improvement projects and stormwater management training and best management practices (BMP). Projects offering stormwater management training and best management practices fall under Category 1. Over the years, grantees have offered educational opportunities for a variety of projects, including stormwater management training and experience for youth leadership for the South Platte by Lincoln Hill Cares. Both the Associated General Contractors of Colorado (AGC) and the Stormwater Center of Colorado State University (CSU) have been constants in providing training and certifications. Under the most recent 2022-2023 Request for Applications for Category 1, WQIF funding is supporting programs by AGC, CSU, and newcomer, the Home Builders Association of Metro Denver (HBA).

Stormwater Training Resources

American General Contractors, Colorado

The Colorado Stormwater Excellence Program is a CDPHE partnership with AGC for compliance assistance and recognition of demonstrated excellence. It offers an agency recognized, industry  self-policing stormwater compliance management system. 

An integral part of the program, AGC’s Basic Stormwater Training and Advanced Stormwater Training courses are specifically designed for sediment and erosion control in Colorado and to meet CDPHE General Construction Management to prevent pollution of surface waters. AGC partners with Stormwater Risk Management to conduct the training classes each month.

The Basic Stormwater Course covers conventional topics while preparing trainees with a foundation of stormwater knowledge needed for the Advanced Stormwater managers course. The Advanced course teaches the Uniform Stormwater Management System (USMS) 6-Step Preplanning and Budgeting method, USMS Design and Jobsite Binder Set-up, and the USMS 4-Step Field Compliance method. The Advanced course also provides trainees with all of the standardized, step-by-step processes and forms that support these management systems, including Municipal separate storm sewer systems (MS4) permit requirements.

The Home Builders Association of Metro Denver (HBA)

Proper training and education of stormwater compliance along with BMP during the homebuilding construction process assists in reducing the pollution of state waters.

HBA’s Home Building Stormwater Excellence Program (HSEP) offers the first residential homebuilding stormwater course ever implemented in Colorado. The training offered through the program focuses on stormwater compliance and Best Management Practices (BMPs) unique to each stage of the homebuilding construction process, from land development through vertical construction. Through examples and phasing of BMPs the program fosters relationship building between permit holders and regulators.

Topics include land sub phases 1-3, vertical sub phases, history of the Clean Water Act, state & local MS4s, land and vertical construction, and ponds and sediment basins.

Colorado State University - Colorado Stormwater Center

The Colorado Stormwater Center is housed in the Department of Civil and Environmental Engineering at Colorado State University (CSU) under the One Water Solutions Institute. Education and training events are conducted by a variety of experienced professionals that work with non-profit organizations, private industry/consulting firms, and government agencies to bridge the gap between academia and practice. 

The most recent WQIF grant projects focus on the Colorado MS4 permits - Construction Stormwater Discharge Permit and the Statewide Standard MS4 General Permit. Permits are issued to reduce and eliminate the stormwater discharge of pollutants that occur from construction activities. Due to the acute risk for pollutant discharge that construction activities pose to receiving water bodies, the CDPHE MS4 permit requires local agencies to have a level of oversite for construction activities, especially as relating to municipal capital improvement projects. 

The Center is developing and implementing a  professional training course, Colorado Construction Stormwater permits Training and Certification Course. It will be offered online and translated and offered in Spanish, and in person at the 2024 Symposium.

The 2024 Symposium, a stormwater professionals meeting, focuses on water quality control in stormwater and MS4 systems. It will be hosted at the CSU spur campus and available via videoconferencing, and recorded in English and Spanish. All 2024 Colorado Stormwater Symposium presentations will be recorded and those recordings and presentation materials will be available on the Center website which is hosted and maintained by the CSU One Water Solutions Institute (OWSI).

Two other certification programs targeting industry professionals are offered through the Center -    Stormwater Control Measure Inspection and Maintenance Certification; and Stormwater Control Measure Design/Design Review Certification. The Stormwater Education Series has included community outreach and residential-scale stormwater control measures (English and Spanish) virtually and in person. 

Additional Resources

➽ Margaret Bauer, Project Manager CDPHE WQCD Local Assistance Unit

Wednesday, March 13, 2024

Coming Down the Pipe: Lead and Copper Rule Revisions Components Effective October 2024

Image: lead goosenecks 
We recently published this article about the proposed Lead and Copper Rule Improvements (LCRI). In general, LCRI is intended to improve upon the requirements promulgated in early 2021 in the Lead and Copper Rule Revisions (LCRR). EPA is planning to finalize the LCRI in October 2024 and extend the compliance dates for most of the requirements that were initially placed in LCRR. However, EPA plans to retain the October 16, 2024 compliance date for several requirements associated including: submitting the initial Lead Service Line Inventory (LSLI), Tier 1 public notice after a lead Action Level Exceedance (ALE), and notification of service line material. Let’s take a closer look at what is Coming Down the Pipe (pardon the pun) in 2024 with respect to these key provisions.

Colorado is one of just a handful of states that adopted LCRR into its primary drinking water regulations. Collectively, the department and stakeholders learned a lot about the rule during that process, so we are well-positioned to tackle LCRI after it becomes final later this year. The Water Quality Control Commission replaced the Lead and Copper Rule in Section 11.26 with the Lead and Copper Rule Revisions in Section 11.17 in the Colorado Primary Drinking Water Regulations (Regulation 11). The department carefully structured LCRR so that different elements of the rule will have effective dates that align with LCRI. The requirement to complete an initial lead service line inventory by October 16, 2024 will go into effect immediately, whereas requirements that may be modified by LCRI, such as tap sampling requirements, could have a delayed effective date.

The requirements associated with the initial LSLI can be found in Section 11.17(2) and these cover inventory development, public availability, and consumer notification and reporting. The LCRI includes enhanced requirements for the LSLI including more regular updates and adding service line connectors (e.g., pigtails and goosenecks) to the inventory, plus additional requirements to confirm non-lead status. These enhanced requirements will likely need to be included in a “baseline inventory” due in 2027. Water systems can still complete their initial LSLI under the requirements specified in LCRR.  To help water systems meet LSLI requirements, the department (in consultation with stakeholders and the help of contract support) developed drinking water Policy 018 to guide that process. Additionally, the department has a grant program in place to help larger systems serving 7,500 people or more with inventory efforts and has already awarded about $550,000 to help water systems. Systems serving 15,000 people or less can request LSLI technical assistance from the department's contractor, WSP and Sunrise Engineering, at no cost to the system.. While the LCRI is not fully effective, we recommend that systems keep the draft rule in mind as they develop their inventories. If opportunities arise to collect information on connectors, for example, we believe that it would be a good idea to gather and retain that information.

A key aspect of LCRR that will become effective in October 2024 is the requirement for 24-hour Tier 1 public notification of a lead ALE, outlined in section 11.17(3)(k). Water systems must notify the department of the exceedance as soon as possible but no later than 24 hours after the exceedance occurs, and distribute Tier 1 public notice as specified in 11.33. The LCRI is also proposing to reduce the lead action level from 15 to 10 parts per billion (ppb), but it is not entirely certain when the effective date for that change will be. However, the provision in 11.17(3)(k) will apply to whatever action level is in effect at the time of the exceedance. We recommend that systems prepare for this possibility even if they do not have lead service lines as about half of the ALEs in Colorado occur at systems without lead service lines. Additionally, taking steps to improve corrosion control can improve public health protection and lower the risk of an ALE. Talk to your compliance specialist to determine if any planned modifications necessitate a design review by the department. 

Another element of the LCRR that will become effective in October 2024 is the requirement for water systems to notify consumers with a lead, galvanized requiring replacement, or unknown service line of the material type, ways to reduce lead exposure from drinking water, and opportunities for replacement or identification of the line (see section 11.17(2)(c)). The department encourages water systems to notify consumers of their service line material as soon as possible after the material is identified. 

Navigating the complicated landscape established by LCRR and then LCRI will be challenging for all of us. By working together, we can do our best to protect public health by lowering lead levels in tap water. 

Thank you.

➽ Ron Falco, P.E. Safe Drinking Water Program Manager 

➽ Haley Orahood Regulatory Development and Implementation Specialist

Wednesday, February 28, 2024

Monitoring Plans: Develop and Maintain this Crucial Document

What is a monitoring plan?

The monitoring plan is an important tool for your system that helps you capture an accurate inventory of your system and communicate that inventory to the division. The division then uses this information to develop your monitoring schedule and your compliance requirements. All public water systems are required to have a monitoring plan per regulation 11. The plan is required to be current, complete, and any new changes need to be reflected in your monitoring plan within 30 calendar days after the change is effective. During a sanitary survey, the inspector will ask to see your monitoring plan; they will confirm that the monitoring plan reflects the on-site review of your system.  

The monitoring plan includes:

  • System contact information.
  • Inventory of facilities.
  • Process flow diagrams detailing treatment and entry point sampling. 
  • Source, treatment and distribution details.
  • Maps of your distribution system detailing sample locations.
  • Individual rules sampling/monitoring plans (e.g. nitrate rule).

Our colleagues in the field services section have cited the following monitoring plan issues most commonly during sanitary surveys:

  • Changes in treatment or distribution not reflected in the monitoring plan - thus missing from division records. 
  • Lack of process flow diagram or a diagram that does not accurately capture compliance sampling locations - Entry Point, Raw Water Tap etc.  
  • Lack of a map of the distribution system detailing sampling locations for Revised Total Coliform Rule, and Disinfection Byproduct Rule. Please note that these sample sites may be managed in the drinking water portal. But, the division recommends that you also have a map detailing where to find these sample sites in your distribution system. 
  • RTCR sites that are not representative of the entire distribution system - missing zones or branches in distribution.

How do I create or update my monitoring plan?

The division has created an online tool to help you update your monitoring plan, we call it the monitoring plan wizard. This tool will help you to generate and update your monitoring plan. It is a google form that you fill out based on the sections that you need to generate or update for your system. You then receive an email with a pre-populated google document for the section(s) that you selected. You then download the pre-populated sections as a word document or a similar file. You will fill out any information that is lacking, review the pre-populated information to ensure that it is correct, and then submit the plan to the division. The best way to submit is through the drinking water portal. Paper forms are available if you choose not to use the wizard. 

If it has been some years since you have updated your monitoring plan it may be beneficial to create a new monitoring plan. To do this you will need to take the following steps: 

  1. Evaluate what sections of the plan are required for your system. On the division’s monitoring plan website there is the below chart that details the monitoring plan requirements based on the type of system you have. If you are unsure as to your system type you can look at your drinking water monitoring schedule under system details. 
  2. Now you will go to the monitoring plan wizard and select the sections that are required for your system. 
  3. The division will send you a Monitoring Plan template that is filled in with the information we have on file for your system. Note: The google doc link that is sent in the email will be automatically deleted after 10 days. We recommend that you make a copy or download the template as a Microsoft Word document to avoid losing work.
  4. Review the generated monitoring plan. Be sure to update any pertinent information and describe the changes you are making. This will help your compliance specialist as they review your submitted plan.  
  5. Submit the new monitoring plan through the drinking water portal. 

Why would I need to update my monitoring plan?

There are several changes to a system that could result in a change to your monitoring plan. The below list details some but not all of these possible changes. Please note: Systems must contact their compliance specialist before making system changes. Changes in infrastructure (construction) or treatment often require design approval:

  • Change to operator or administrative contact 
  • Change in population
  • New customers added to the system
  • New sources or sources going off-line
  • Sample sites must be reviewed and updated to account for system changes 

Why diagrams and maps?

There are several mechanisms for generating these often missed items for your monitoring plan. The process flow diagram is a section of the Monitoring Plan that folks often have questions about. The diagram is a way for you to accurately capture your system’s treatment inventory. It is also a good way to conceptualize your facility when training new employees, working to solve issues, or identifying potential improvements. This diagram will begin with your water source(s), go through treatment, and then into the distribution system. The diagram needs to include identification of compliance sampling locations. For groundwater plants this would include raw water tap and entry point tap. For surface water or groundwater under the direct influence of surface water systems this would include raw water sample, CFE turbidity sample, microbial inactivation sample, and entry point sample sites. The diagram can be hand drawn or from a visio drawing or other means to show the process.

The distribution system map is a useful tool to ensure that your RTCR and DBP plans meet regulatory requirements. Specifically, the RTCR sites need to represent your entire distribution system including any branches and segmentation of different zones. The DPB sample site(s) need to be located at the longest representative residence time of drinking water in your distribution system. Often, systems use chlorine residuals to determine these sample sites, where the chlorine residual is lowest in the distribution system. Using a map can also help you identify the points farthest from your treatment in distribution. The map can be taken from google maps, google earth, any maps of your distribution system you may have and can scan. Simple programs like Microsoft paint, word processors, and PowerPoint generators can be used to generate sample site locations. 

Resources

➽ Kyra Gregory, Drinking Water Training Specialist


Wednesday, February 14, 2024

Takeaways from the Unitronics Cyber Attacks


Colorado Information Analysis Center (CIAC) Situational Awareness bulletin 23-26340

Many of you may have heard about the December 2023 Unitronics programmable logic controllers (PLCs) hack by the Iranian backed hacktivist group “CyberAv3ngers” or have read the Colorado Information Analysis Center (CIAC) Situational Awareness bulletin. The hackers targeted water and wastewater utilities and other industries using the Unitronics PLCs, freezing the units and posting the message pictured below:

Colorado Information Analysis Center (CIAC) Situational Awareness bulletin 23-26340

A water facility in Aliquippa, PA with a unitronics PLC was targeted in late November 2023, forcing the system to operate in manual mode. So, how can you protect yourself from cyber attacks like this? Some easy steps to take include:

  • Change the password from the factory default password. In the case of the Unitronics PLC hack, some of the default passwords consisting of “1111” were still in use.
  • Disconnect the PLC from the internet. If remote access is needed, use a firewall/VPN with multi factor authentication. 
  • Backup the logic and configuration of any PLCs in case you need to reset them. 
  • Keep your software updated with the latest version from the vendor.

Action to take if your system experiences a Cyberattack 

The department has created a guidance document to help drinking water systems respond and report Cyberattacks. Here are some highlights of actions to take if you experience a cyberattack at your facility:

  1. Notify the department as soon as possible (contact info below), but no later than 10 a.m. of the calendar day following any cybersecurity event (see regulation 11 for details).
  2. Disconnect (e.g. unplug) compromised computers from the network. Do not turn off or reboot systems.
  3. Assess the scope of the compromise and isolate all affected IT systems.
  4. Connect with your antivirus software customer care team or security service vendor.
  5. Assess any potential damage, including impacts to treatment processes or service disruptions.
  6. Initiate manual operation of equipment if control systems have been compromised.
  7. Distribute any advisories or alerts to customers as needed, including customers whose records may have been compromised.
  8. Identify methods to scan all IT assets to eradicate malicious code. Assess and implement recovery procedures.
  9. Assess the status of assets: valves, pumps, tanks, water, and chemical flows. 

Incident Reporting - Reg 11  Requirements

Per Regulation 11.2(1), tampering events, suspected tampering, or receipt of a tampering threat must be reported to the Colorado Department of Public Health and Environment (department). The supplier must notify the department as soon as possible but no later than 10 a.m. of the next calendar day and notify the department in writing no later than 5 days after any attempted, confirmed, or suspected tampering, or receipt of a tampering threat. Failure to report attempted, suspected, or confirmed tampering in a timely manner may result in a violation of Regulation 11. Please refer to the department’s Guidance: Report and Respond to Tampering Events or Security Threats for more information on the required information. For ease of reporting, the department has created the Tampering Threat and Incident Report Form. If you have issues accessing the form please fill out the pdf version of the form and submit it to cdphe.wqacutes@state.co.us. Please refer to the recent CDPHE Aqua Talk article for more information on security event reporting requirements and the department’s role in helping you protect public health during a security breach. 

Incident Reporting - Partnering Institutions

Please note, when you report a cybersecurity incident to the CDPHE, the department will report the incident to the below federal parties on your behalf:

The Colorado Department of Public Health and Environment’s (department) Water Quality Control Division is sending out the below notification as have state and federal water security partners, including the Water Information Sharing & Analysis Center, Colorado Department of Homeland Security and Emergency Management, and the Cybersecurity and Infrastructure Security Agency (CISA). 

Resources 

➽ Heather Young, PE, CWP, Field Services Section Manager

➽ Kyra Gregory, Drinking Water Training Specialist 


New Act to Test Drinking Water Quality in Mobile Home Parks

Governor Polis signed the Mobile Home Park Water Quality Act in June 2023. The law creates a drinking water testing program for Colorado's mobile home parks. The goal is to test all parks for primary and secondary contaminants. Secondary contaminants are often related to an adverse smell, taste, and color. Mobile home parks are a vital source of relatively  affordable housing for many people. While some parks are regulated and meet the current drinking water standards, many residents feel that their drinking water is unsafe. As a result of these concerns and potential problems created with secondary contaminants, some residents feel compelled to buy bottled water for drinking and cooking. The testing will check if there is a water quality issue at each park. Remediation is required if there is a water quality issue that impacts the welfare and safety of the residents.

The department will test 750 parks across the state over a four year period. Each year, 25% of the parks must be tested. Testing will start in July 2024 and end in July 2028. The department is responsible for developing the overall testing plan, prioritizing the sampling, conducting stakeholder outreach, reviewing results, and requiring remediation. An independent contractor will conduct the testing. We will also interview park community members about water quality concerns. This will ensure representative testing in each park. 

Testing may include:

  • Primary contaminants: Testing will be conducted if the park is:
    • Not regulated as a public water system; or 
    • Does not receive its drinking water from another regulated public water system.
  • All parks will be tested for secondary contaminants (e.g., hardness, total dissolved solids, iron, odor, and manganese). 
  • All parks will be tested for “forever chemicals” (per- and polyfluoroalkyl substances (PFAS)) unless:
    • The park has already participated in recent PFAS voluntary efforts; or 
    • The system they purchase water from has participated in recent PFAS voluntary efforts.  

All testing results will be posted on our website. We will notify the following entities within 10 days of receiving results:

Once notified, park owners must notify residents of results within five days. If the department identifies a water quality issue, the park owner must:

  • Include information about the issue in the notice
  • Prepare and submit a remediation plan within 120 days
  • Comply with any orders issued
  • Not pass the cost of compliance on the Park residents

The department is developing resources for both residents and park residents. This includes lists or websites for: 

  1. Professional translation vendors
  2. Certified contract operators
  3. Certified labs
  4. Colorado’s Water/Wastewater Agency Response Network
  5. Water haulers

What does this mean for water suppliers and operators?

Park owners or residents may ask about testing. If your water system sells water to a park, you may be contacted for additional information. Here is a list of Colorado’s registered parks across the state. Parks may want to tap into the local utility if testing identifies a water quality issue.

We anticipate that some parks may meet the definition of a public water system and be regulated. These systems will need to hire a certified operator, develop monitoring plans, and start testing the water. They may reach out to neighboring systems for operator referrals or questions about treatment. For example, if the park identified high levels of manganese, they might ask other systems what type of treatment they are using. 

 For more information, please visit our Mobile Home Park website.

➽ Stephanie Hosie, Drinking Water Compliance Assurance

Wednesday, February 7, 2024

OpCert Program: Updated TU Matrix



The previous version of the TU Topic Matrix (“the matrix”) had not been updated since 2018 and was due for a refresher. The Water Wastewater Operator Certification Board’s current contractor, Colorado Certified Water Professionals (CCWP) sought and obtained board approval to update the matrix with two goals in mind: 

  1. To update and streamline the tool to make it easier for operators and trainers to use and to ensure it aligns with Regulation 100; and
  2. To encourage further education on topics specific to an operator’s discipline. 

There are two categories for TU topics: Core and Flexible (“Flex”) 

  • Core TUs are those course materials that cover topics that are directly applicable to aspects of water and wastewater facility operations that may affect public health and the environment, or the need to maintain compliance with established requirements. A few examples are physical, chemical, or biological treatment, disinfection, and hydraulics. 
  • Flex TUs are training that is not essential for an operator to perform their routine job duties but is useful in the performance of those duties. A few examples of these are safety courses (OSHA), natural and manmade disasters, and technical writing.

The updated matrix reduces the Flex TU topics down to these 3 categories: 

  1. Administrative Related Topics - including but not limited to planning, customer service, computer software, technical writing
  2. Emergency Preparedness and Response - including but not limited to National Incident Management System (NIMS), Incident Command System (ICS), natural and manmade disasters, threat and vulnerability assessments
  3. Safety Program Topics - including but not limited to Occupational Safety and Health Administration (OSHA) topics, Personal Protective Equipment (PPE), risk management

Effective January 1, 2024, all safety, management, and emergency management courses are now approved for Flex TUs instead of Core TUs. 

Please note that all TUs earned prior to January 1, 2024, will retain the 2023-approved TU classification and values. For example, if an operator completed a PPE class in 2023, he or she will be able to use those 2023 TUs to meet the core training unit requirement for upcoming renewals.

This update to the matrix will be rolled out in three phases. The emergency management and safety courses were the first to be updated, the next phase will be general maintenance and equipment operators courses, and lastly, the final phase will be for those courses covering each individual discipline (water treatment/distribution; wastewater treatment/collections). The target for completion of all updates is October 1, 2024. 

For questions on the updates to the TU matrix, feel free to contact CCWP info@coloradocwp.com or Jessica Morgan cdphe.facilityoperator@state.co.us

➽ Jessica Morgan, Facility and Operator Outreach and Certification Board Liaison