Monitoring Plans: Develop and Maintain this Crucial Document

What is a monitoring plan?

The monitoring plan is an important tool for your system that helps you capture an accurate inventory of your system and communicate that inventory to the division. The division then uses this information to develop your monitoring schedule and your compliance requirements. All public water systems are required to have a monitoring plan per regulation 11. The plan is required to be current, complete, and any new changes need to be reflected in your monitoring plan within 30 calendar days after the change is effective. During a sanitary survey, the inspector will ask to see your monitoring plan; they will confirm that the monitoring plan reflects the on-site review of your system.  

The monitoring plan includes:

• System contact information.
• Inventory of facilities.
• Process flow diagrams detailing treatment and entry point sampling. 
• Source, treatment and distribution details.
• Maps of your distribution system detailing sample locations.
• Individual rules sampling/monitoring plans (e.g. nitrate rule).

Our colleagues in the field services section have cited the following monitoring plan issues most commonly during sanitary surveys:

• Changes in treatment or distribution not reflected in the monitoring plan - thus missing from division records. 
• Lack of process flow diagram or a diagram that does not accurately capture compliance sampling locations - Entry Point, Raw Water Tap etc.  
• Lack of a map of the distribution system detailing sampling locations for Revised Total Coliform Rule, and Disinfection Byproduct Rule. Please note that these sample sites may be managed in the drinking water portal. But, the division recommends that you also have a map detailing where to find these sample sites in your distribution system. 
• RTCR sites that are not representative of the entire distribution system - missing zones or branches in distribution.

How do I create or update my monitoring plan?

The division has created an online tool to help you update your monitoring plan, we call it the monitoring plan wizard. This tool will help you to generate and update your monitoring plan. It is a google form that you fill out based on the sections that you need to generate or update for your system. You then receive an email with a pre-populated google document for the section(s) that you selected. You then download the pre-populated sections as a word document or a similar file. You will fill out any information that is lacking, review the pre-populated information to ensure that it is correct, and then submit the plan to the division. The best way to submit is through the drinking water portal. Paper forms are available if you choose not to use the wizard. 

If it has been some years since you have updated your monitoring plan it may be beneficial to create a new monitoring plan. To do this you will need to take the following steps: 

1. Evaluate what sections of the plan are required for your system. On the division’s monitoring plan website there is the below chart that details the monitoring plan requirements based on the type of system you have. If you are unsure as to your system type you can look at your drinking water monitoring schedule under system details. 
2. Now you will go to the monitoring plan wizard and select the sections that are required for your system. 
3. The division will send you a Monitoring Plan template that is filled in with the information we have on file for your system. Note: The google doc link that is sent in the email will be automatically deleted after 10 days. We recommend that you make a copy or download the template as a Microsoft Word document to avoid losing work.
4. Review the generated monitoring plan. Be sure to update any pertinent information and describe the changes you are making. This will help your compliance specialist as they review your submitted plan.  
5. Submit the new monitoring plan through the drinking water portal. 

Why would I need to update my monitoring plan?

There are several changes to a system that could result in a change to your monitoring plan. The below list details some but not all of these possible changes. Please note: Systems must contact their compliance specialist before making system changes. Changes in infrastructure (construction) or treatment often require design approval:

• Change to operator or administrative contact 
• Change in population
• New customers added to the system
• New sources or sources going off-line
• Sample sites must be reviewed and updated to account for system changes 

Why diagrams and maps?

There are several mechanisms for generating these often missed items for your monitoring plan. The process flow diagram is a section of the Monitoring Plan that folks often have questions about. The diagram is a way for you to accurately capture your system’s treatment inventory. It is also a good way to conceptualize your facility when training new employees, working to solve issues, or identifying potential improvements. This diagram will begin with your water source(s), go through treatment, and then into the distribution system. The diagram needs to include identification of compliance sampling locations. For groundwater plants this would include raw water tap and entry point tap. For surface water or groundwater under the direct influence of surface water systems this would include raw water sample, CFE turbidity sample, microbial inactivation sample, and entry point sample sites. The diagram can be hand drawn or from a visio drawing or other means to show the process.

The distribution system map is a useful tool to ensure that your RTCR and DBP plans meet regulatory requirements. Specifically, the RTCR sites need to represent your entire distribution system including any branches and segmentation of different zones. The DPB sample site(s) need to be located at the longest representative residence time of drinking water in your distribution system. Often, systems use chlorine residuals to determine these sample sites, where the chlorine residual is lowest in the distribution system. Using a map can also help you identify the points farthest from your treatment in distribution. The map can be taken from google maps, google earth, any maps of your distribution system you may have and can scan. Simple programs like Microsoft paint, word processors, and PowerPoint generators can be used to generate sample site locations. 

Resources

• Division’s monitoring plan website 
• Monitoring plan wizard 
• Monitoring plan wizard videos
• Drinking water portal 

➽ Kyra Gregory, Drinking Water Training Specialist

Takeaways from the Unitronics Cyber Attacks

Colorado Information Analysis Center (CIAC) Situational Awareness bulletin 23-26340

Many of you may have heard about the December 2023 Unitronics programmable logic controllers (PLCs) hack by the Iranian backed hacktivist group “CyberAv3ngers” or have read the Colorado Information Analysis Center (CIAC) Situational Awareness bulletin. The hackers targeted water and wastewater utilities and other industries using the Unitronics PLCs, freezing the units and posting the message pictured below:

Colorado Information Analysis Center (CIAC) Situational Awareness bulletin 23-26340

A water facility in Aliquippa, PA with a unitronics PLC was targeted in late November 2023, forcing the system to operate in manual mode. So, how can you protect yourself from cyber attacks like this? Some easy steps to take include:

• Change the password from the factory default password. In the case of the Unitronics PLC hack, some of the default passwords consisting of “1111” were still in use.
• Disconnect the PLC from the internet. If remote access is needed, use a firewall/VPN with multi factor authentication. 
• Backup the logic and configuration of any PLCs in case you need to reset them. 
• Keep your software updated with the latest version from the vendor.

Action to take if your system experiences a Cyberattack 

The department has created a guidance document to help drinking water systems respond and report Cyberattacks. Here are some highlights of actions to take if you experience a cyberattack at your facility:

1. Notify the department as soon as possible (contact info below), but no later than 10 a.m. of the calendar day following any cybersecurity event (see regulation 11 for details).
2. Disconnect (e.g. unplug) compromised computers from the network. Do not turn off or reboot systems.
3. Assess the scope of the compromise and isolate all affected IT systems.
4. Connect with your antivirus software customer care team or security service vendor.
5. Assess any potential damage, including impacts to treatment processes or service disruptions.
6. Initiate manual operation of equipment if control systems have been compromised.
7. Distribute any advisories or alerts to customers as needed, including customers whose records may have been compromised.
8. Identify methods to scan all IT assets to eradicate malicious code. Assess and implement recovery procedures.
9. Assess the status of assets: valves, pumps, tanks, water, and chemical flows. 

Incident Reporting - Reg 11  Requirements

Per Regulation 11.2(1), tampering events, suspected tampering, or receipt of a tampering threat must be reported to the Colorado Department of Public Health and Environment (department). The supplier must notify the department as soon as possible but no later than 10 a.m. of the next calendar day and notify the department in writing no later than 5 days after any attempted, confirmed, or suspected tampering, or receipt of a tampering threat. Failure to report attempted, suspected, or confirmed tampering in a timely manner may result in a violation of Regulation 11. Please refer to the department’s Guidance: Report and Respond to Tampering Events or Security Threats for more information on the required information. For ease of reporting, the department has created the Tampering Threat and Incident Report Form. If you have issues accessing the form please fill out the pdf version of the form and submit it to cdphe.wqacutes@state.co.us. Please refer to the recent CDPHE Aqua Talk article for more information on security event reporting requirements and the department’s role in helping you protect public health during a security breach. 

Incident Reporting - Partnering Institutions

Please note, when you report a cybersecurity incident to the CDPHE, the department will report the incident to the below federal parties on your behalf:

• Colorado local FBI Field Office, 
• Cyber Watch (CyWatch) at (855) 292-3937 or CyWatch@fbi.gov
• The Internet Crime Complaint Center (IC3). 
• CISA at report@cisa.gov or (888) 282-0870
• WaterISAC encourages members to share information by emailing analyst@waterisac.org, calling 866-H2O-ISAC, or using the online incident reporting form. 

The Colorado Department of Public Health and Environment’s (department) Water Quality Control Division is sending out the below notification as have state and federal water security partners, including the Water Information Sharing & Analysis Center, Colorado Department of Homeland Security and Emergency Management, and the Cybersecurity and Infrastructure Security Agency (CISA). 

Resources 

• CISA’s free Cyber Vulnerability Scanning (VS) services
• CDPHE water/wastewater security toolbox 

➽ Heather Young, PE, CWP, Field Services Section Manager

➽ Kyra Gregory, Drinking Water Training Specialist 

New Act to Test Drinking Water Quality in Mobile Home Parks

Governor Polis signed the Mobile Home Park Water Quality Act in June 2023. The law creates a drinking water testing program for Colorado's mobile home parks. The goal is to test all parks for primary and secondary contaminants. Secondary contaminants are often related to an adverse smell, taste, and color. Mobile home parks are a vital source of relatively  affordable housing for many people. While some parks are regulated and meet the current drinking water standards, many residents feel that their drinking water is unsafe. As a result of these concerns and potential problems created with secondary contaminants, some residents feel compelled to buy bottled water for drinking and cooking. The testing will check if there is a water quality issue at each park. Remediation is required if there is a water quality issue that impacts the welfare and safety of the residents.

The department will test 750 parks across the state over a four year period. Each year, 25% of the parks must be tested. Testing will start in July 2024 and end in July 2028. The department is responsible for developing the overall testing plan, prioritizing the sampling, conducting stakeholder outreach, reviewing results, and requiring remediation. An independent contractor will conduct the testing. We will also interview park community members about water quality concerns. This will ensure representative testing in each park. 

Testing may include:

• Primary contaminants: Testing will be conducted if the park is:
• Not regulated as a public water system; or 
• Does not receive its drinking water from another regulated public water system.
• All parks will be tested for secondary contaminants (e.g., hardness, total dissolved solids, iron, odor, and manganese). 
• All parks will be tested for “forever chemicals” (per- and polyfluoroalkyl substances (PFAS)) unless:
• The park has already participated in recent PFAS voluntary efforts; or 
• The system they purchase water from has participated in recent PFAS voluntary efforts.  

All testing results will be posted on our website. We will notify the following entities within 10 days of receiving results:

• The mobile home park owner.
• The county health department and/or city government.
• The Mobile Home Park Oversight Program (MHPOP) in the Department of Local Affairs.
• The mobile home park’s water supplier.
• The CDPHE Environmental Justice Ombudsperson.

Once notified, park owners must notify residents of results within five days. If the department identifies a water quality issue, the park owner must:

• Include information about the issue in the notice
• Prepare and submit a remediation plan within 120 days
• Comply with any orders issued
• Not pass the cost of compliance on the Park residents

The department is developing resources for both residents and park residents. This includes lists or websites for: 

1. Professional translation vendors
2. Certified contract operators
3. Certified labs
4. Colorado’s Water/Wastewater Agency Response Network
5. Water haulers

What does this mean for water suppliers and operators?

Park owners or residents may ask about testing. If your water system sells water to a park, you may be contacted for additional information. Here is a list of Colorado’s registered parks across the state. Parks may want to tap into the local utility if testing identifies a water quality issue.

We anticipate that some parks may meet the definition of a public water system and be regulated. These systems will need to hire a certified operator, develop monitoring plans, and start testing the water. They may reach out to neighboring systems for operator referrals or questions about treatment. For example, if the park identified high levels of manganese, they might ask other systems what type of treatment they are using. 

 For more information, please visit our Mobile Home Park website.

➽ Stephanie Hosie, Drinking Water Compliance Assurance

OpCert Program: Updated TU Matrix

The previous version of the TU Topic Matrix (“the matrix”) had not been updated since 2018 and was due for a refresher. The Water Wastewater Operator Certification Board’s current contractor, Colorado Certified Water Professionals (CCWP) sought and obtained board approval to update the matrix with two goals in mind: 

1. To update and streamline the tool to make it easier for operators and trainers to use and to ensure it aligns with Regulation 100; and
2. To encourage further education on topics specific to an operator’s discipline. 

There are two categories for TU topics: Core and Flexible (“Flex”) 

• Core TUs are those course materials that cover topics that are directly applicable to aspects of water and wastewater facility operations that may affect public health and the environment, or the need to maintain compliance with established requirements. A few examples are physical, chemical, or biological treatment, disinfection, and hydraulics. 
• Flex TUs are training that is not essential for an operator to perform their routine job duties but is useful in the performance of those duties. A few examples of these are safety courses (OSHA), natural and manmade disasters, and technical writing.

The updated matrix reduces the Flex TU topics down to these 3 categories: 

1. Administrative Related Topics - including but not limited to planning, customer service, computer software, technical writing
2. Emergency Preparedness and Response - including but not limited to National Incident Management System (NIMS), Incident Command System (ICS), natural and manmade disasters, threat and vulnerability assessments
3. Safety Program Topics - including but not limited to Occupational Safety and Health Administration (OSHA) topics, Personal Protective Equipment (PPE), risk management

Effective January 1, 2024, all safety, management, and emergency management courses are now approved for Flex TUs instead of Core TUs. 

Please note that all TUs earned prior to January 1, 2024, will retain the 2023-approved TU classification and values. For example, if an operator completed a PPE class in 2023, he or she will be able to use those 2023 TUs to meet the core training unit requirement for upcoming renewals.

This update to the matrix will be rolled out in three phases. The emergency management and safety courses were the first to be updated, the next phase will be general maintenance and equipment operators courses, and lastly, the final phase will be for those courses covering each individual discipline (water treatment/distribution; wastewater treatment/collections). The target for completion of all updates is October 1, 2024. 

For questions on the updates to the TU matrix, feel free to contact CCWP info@coloradocwp.com or Jessica Morgan cdphe.facilityoperator@state.co.us. 

➽ Jessica Morgan, Facility and Operator Outreach and Certification Board Liaison