Asset Management - Manage Your System Optimally

As systems prepare to submit their Lead Service Line Inventories (LSLI) this October, it has become abundantly clear that the water sector needs to put more resources into identifying what resources and assets they have and where they are located. Ideally, a bulk of the LSLI should have been completed using documentation. However, many systems lack records for their distribution systems. This gap in asset inventory is making the task of documenting their service line material types more costly and difficult. In the past many systems have taken a reactive approach, - “when it breaks, we fix it”, to manage their system. However, with the changing regulatory requirements, increasing financial hardships, and increasing climate and resource challenges, it has become necessary to plan ahead to ensure the health of public water systems into the future. It is necessary to know what resources you have and maximize their usefulness.  

Asset Management (AM) is a proactive approach to managing a system’s infrastructure and capital assets. AM gives systems tools to optimize output at the lowest possible operating cost. It facilitates both short and long term success by prioritizing assets, estimating useful life, and enables more accurate budgeting. Taking an asset management approach allows systems to hone their operations and maintenance planning by prolonging asset life and improving decisions about asset rehabilitation, repair, and replacement. Systems are able to use resources when and where they are needed most ensuring maintenance on critical assets can be done and there is enough money to do it.

AM is a scalable, thoughtful approach to systems management and can be applicable to any size system. It can help with coordination across an organization to help ensure that the right work is done in the right order at the right time. 

Not sure where to start, feeling intimidated? Come to one of the free training sessions offered by the Local Assistance Unit (LAU). Asset management will be presented this summer during the State Revolving Fund (SRF) Regional Workshops in partnership with the Department of Local Affairs and the Grants and Loans Unit. Additionally, the LAU will be rolling out an asset management course as part of the regular course offerings in 2025. The Asset Management course curriculum will review the 5 core criteria of asset management and demonstrate how to apply each of them to your system. You will learn how to get started and review some tools to assist you in developing an asset management plan. No need to reinvent the wheel when it comes to AM, there are many tools and templates available that fit the needs of every sized system. 

Join us!

Asset Management: A Management Framework and the associated toolkit will be presented as part of the SRF Regional Workshops scheduled for:

• July 11, 2024 - Alamosa, CO - Adams State University 
• Register Here
• July 23, 2024 - Akron, CO - Akron Senior & Community Center 
• Register Here

The workshop will cover topics related to SRF basics, funding options for drinking water and waste water infrastructure, asset management planning and tools, current and upcoming regulations and much more.   

Can’t make a workshop and need assistance with asset management or capacity development?

The Colorado Department of Public Health (CDPHE) Water Quality Control Division (WQCD) has free capacity coaching available for public water systems through the Local Assistance Unit (LAU). A PWS can request assistance by filling out the Coaching Assistance Form. 

➽Angela Green Garcia, Drinking Water Training Specialist 

Questions from Q&A Session during CRWA Annual Conference

The Water Quality Control Division Field Services Section participated in the Colorado Rural Water Conference on March 18th during the WQCD round table discussions and received really great questions and feedback from operators attending the session. We wanted to share some of the questions related to Backflow Prevention and Cross Connection Control and Storage Tanks for those operators that were not participating in the conference. 

Backflow Prevention and Cross Connection Control Rule (BPCCC)

BPCCC Resources 

• Frequently asked questions
• Updated Backflow Guidance Document
• CDPHE Backflow Prevention and Cross Connection Website(opens in new window)

1. Under the new Backflow Rule updates, do I still have 15 months to get 100% of all my devices tested every year?

This question relates to the untested 2-year rule in the 2023 updated regulation as opposed to the 90-day rule from the old BPCCC regulation. With the 2023 regulation update, the “90 day rule” is gone. Under the updated rule, the supplier must achieve a backflow prevention annual compliance ratio of greater than or equal to (≥) 0.90 and with that remaining 0.10, the supplier must ensure that no backflow prevention assembly is present for more than two consecutive calendar years without being tested, service being suspended to the customer, or the cross-connection being removed.

2. What happens if a device fails a test and tests good 7 days later? What if the device fails and is fixed and passes on the same day?

This is a great question and the backflow policy DW007 helps answer this. An assembly that fails testing and is repaired and receives a passing test will be reported in the combined compliance ratio (Report lines 8-10) AND as an uncontrolled cross connection that has been controlled (Report Line 7.A) in the annual report. A violation does not occur for a failed assembly unless the assembly is not repaired within the required timeline. If an assembly fails but is repaired and passes a test on the same calendar day, the supplier may exclude reporting the assembly as having failed in the annual report and only count it in the compliance ratio (Report Lines 8-10) in the annual report. 

3. How do I handle if a place closes and is no longer in use but they had a backflow device?

If it was in use at any time during the year it must be included in the annual report. The supplier can suspend service to the location to remove the cross connection concern for future years while the business is not occupied or using water.

4. Can PWSs have their operators certified as backflow testers? What are the pros/cons?

There are no Colorado state limitations on whether an operator can also be the certified backflow tester. Some utilities administer their backflow program where the operators perform device testing. Other utilities consider it to be a conflict of interest. Each water system can work with their management and legal team to decide the best path for their water system. Some pros to having operators test backflow devices may include having some level of control over the timing of when the assembly is tested, immediate test results, and prioritized testing. However some of the “Cons” of having operators test devices are potential conflicts of interest, it’s another certification to test and maintain.

5. How do I become a certified backflow tester?

Regulation 11 allows for two certification organizations; ASSE and ABPA. They are national organizations with testing/certifications in Colorado. Just google ASSE or ABPA backflow tester and it will bring up testing, schools and how to sign up.

6. Yard hydrants - I installed one with a “Y” adapter with a hose attached to one end with a HBVB installed. Is this ok?

When not in use, the hydrant can be shut down with the non-used side of the “Y” left open to allow for the yard hydrant’s weep hole to work correctly. As long as the non-used side of the “Y” has no hose attached this should be acceptable.

7. Do I have to use your forms?

No, suppliers can develop their own forms as long as they meet the Regulatory requirements and include all the required information.

8. Can I use GIS to track my methods/assemblies?

WQCD does not mandate how suppliers track their methods/assemblies. As long as all required information needed in completing the annual report and maintaining a backflow program are achieved we see no issue with using GIS. One area of concern when using locational software to track assemblies/methods is that one location may have multiple assemblies/methods (isolation versus containment or multiple service connections).

Storage Tank Rule

Storage Tank Rule Resources 

• CDPHE Storage Tank Rule Website
• Storage Tank Guidance Handbook 
• Inspection summary instructions(opens in new window)

1. Overflows - do I need a flap and a screen or are screens banned? Are you going to issue me a significant deficiency during my next sanitary survey for this? 

This highlights the difference between a significant deficiency associated with Sanitary Surveys and changes in the design criteria for designs submitted to the Engineering Section. New or modified water facilities must meet the design criteria, but the Field Services Section does not issue significant deficiencies if an existing tank does not meet the current design requirements unless there is a condition that is a potential threat to public health (flap valve is stuck open, screen is torn or missing). During a sanitary survey, tank overflows with flap valves or screens are fine as long as they are in good operating condition (flap valve functions, seats completely, flap valve is not propped open/submerged; screens are non-corrodible 12-16 Mesh and intact).

2. Do I have to use 24-Mesh non corrodible screen - I can’t find it.

Screens may not have openings that exceed 0.07 inches (typically 12 or 16 mesh) and have to be non-corrodible.

3. Can I use actual plastic window screen to screen my vents, overflows, etc?

Plastic window screen can be easily damaged/torn by rodents and should not be used. Non-corrodible metal screen should be used.

4. My tank is 20 years old and does not meet the current design criteria. Are you going to cite me for a significant deficiency or violation during my next sanitary survey?

New or modified water facilities must meet the design criteria, but your inspector will not issue a significant deficiency if your existing tank does not meet the current design requirements unless there is a condition that is a potential threat to public health (examples include unprotected openings to tanks, missing/damaged screens, unsealed/un-gasketed hatches, etc.).

5. Does the Storage Tank Rule apply to all my tanks?

The storage tank rule applies to finished water storage tank(s). “FINISHED WATER” or “FINISHED DRINKING WATER” means water that is supplied to the distribution system of a public water system and intended for distribution and human consumption without further treatment, including disinfection contact time, except treatment as necessary to maintain water quality in the distribution system (e.g., booster disinfection, addition of corrosion control chemicals). If you need help determining if a tank is considered to be part of the treatment system or part of the distribution system, please email us at: cdphe_wqcd_fss_questions@state.co.us

6. What should I do to maintain my Contact Time tanks that are not part of the distribution system?

We recommend that you consider following the Storage Tank Rule guidelines for Contact Time (CT) tanks to avoid a potential risk to public health but it is not a requirement. Your inspector will be looking at all tanks including the contact time tanks during your next sanitary survey and any potential risks to public health (example: unprotected openings, missing/damaged screens, unprotected overflows, sediment buildup) will be cited as significant deficiencies.

7. When are you going to make me do the Storage Tank Rule for my Contact Time Tanks?

The Division does not have any current plans to re-open the Storage Tank Rule however, the tanks must still be maintained and will be inspected during sanitary surveys.

We hope sharing these questions and answers from the Colorado Rural Water Association helps all operators. If you have any questions please feel free to reach out to us at: cdphe_wqcd_fss_questions@state.co.us.

➽ Tom Valenta Field Services Section Work Group Lead, Unit 3 

➽ Heather Young Field Services Section Manager

PFAS Treatment and Best Available Technologies

As we discussed in the May 8th Aqua Talk article May 8th Aqua Talk article, EPA has released its final PFAS MCLs. The May 8th article summarizes the new rule and gives an overview of what water systems will need to do to come into compliance with the new rule. Today we will talk about typical PFAS removal technologies and  the upcoming update to the Design Criteria for Potable Water Systems, also known as Safe Drinking Water Program Implementation Policy #5, to incorporate PFAS treatment technologies. 

Policy #5 is used as a basis for reviewing design applications for drinking water treatment works in Colorado. The division routinely updates the document to maintain industry standards with input from stakeholders. The division is initiating a stakeholder process in 2024 and asking for feedback on portions of the drinking water design criteria to be updated. If you are interested in participating in this process please visit the Drinking Water Design Criteria stakeholder engagement website Drinking Water Design Criteria stakeholder engagement website. 

The division is aware that there are drinking water systems in Colorado that are looking to implement PFAS removal prior to the completion of the design criteria update. For those systems there are additional resources available. The EPA has released a guidance document for water systems titled Treatment Options for Removing PFAS in Drinking Water. The EPA has identified best available technologies (BAT) for PFAS removal using six criteria: 

• removal efficiency, 
• historical full scale operation, 
• geographic applicability, 
• compatibility with other treatment processes, 
• ability to bring the entire water system into compliance, 
• and a reasonable cost to large as well as medium sized systems

The technologies identified are granular activated carbon (GAC), ion exchange (IX), and reverse osmosis (RO). 

Granular Activated Carbon (GAC) is a process where adsorptive media is contained in pressure vessels or atmospheric filter beds. The PFAS contaminated water passes through the vessel or bed and the dissolved contaminants are pulled from the water and onto the surface of the media. In addition to removing PFAS, GAC can remove other contaminants including taste and odor compounds, volatile organic compounds, disinfection byproduct precursors, and others. For this reason, GAC is great for water systems looking to address multiple concerns at once. GAC will generally not have a significant impact on the corrosivity of the water. After a period of time, the GAC media will not be able to adsorb any more contaminants and will need to be replaced by fresh media and properly disposed of. The EPA has published an Interim Guidance on the Destruction and Disposal of PFAS and Materials Containing PFAS. Disposal methods include landfills and thermal treatment for regeneration or destruction. 

Ion exchange (IX) is similar to GAC where contaminated water is passed through a media, but rather than adsorbing contaminants, the PFAS in the feed water are exchanged for an ion, such as chloride, on resin beads contained in a pressure vessel. The IX process continues until the resin is out of chloride exchange sites. Unlike other IX treatment applications like water softening, the spent resin can not be regenerated by backwashing. The resin will need to be periodically disposed of and replaced with fresh media. This treatment process generally targets PFAS only and will not remove additional contaminants. The IX process tends to require a smaller footprint than GAC. Due to the addition of chloride ions into the IX effluent, this treatment process may impact the corrosivity of the finished water. Spent IX resin must either be landfilled or incinerated. 

There are other PFAS selective media available on the market today. For any of these newer media, GAC or IX resins, pilot testing is recommended to determine what method works best for a specific water quality. Piloting allows the water system to look at factors like comparative costs, treatment efficacy, and secondary impacts to finished water quality whether beneficial or not. 

The third technology that EPA has identified is reverse osmosis (RO). RO is a membrane separation process that physically removes contaminants from drinking water. This process results in two streams of water: the clean effluent and a reject stream that contains concentrated PFAS and other contaminants. The disposal of this continuous waste stream can be a substantial challenge in Colorado. The most common disposal method for land-locked states is deep well injection or evaporation ponds. There are other disposal methods in the research phase. 

There are many factors that should be considered as a water system addresses compliance with the PFAS MCLs. For some systems there may be a non-treatment option that is a better fit. Non-treatment options include adjusting source water blending ratios to prioritize sources with lower PFAS levels, an interconnect into a system with existing PFAS treatment, or consolidation into an existing system. If you would like to talk to us more about what available treatment options and grant funding opportunities, please email us at cdphe_pfas@state.co.us.

Thank you,

➽ Chelsea Cotton, P.E. Lead Drinking Water Engineer

Safe Drinking Water Information Finder Tool

SWIFT Tool expands access to information about public water systems across Colorado

The department has created an online safe drinking water information finder (SWIFT) tool. The tool allows the public to access public drinking water records, system-specific results, and a summary of violations and/or sanitary survey findings along with contact information for public water systems across the state. The tool can be accessed on the department’s drinking water consumer information and data website. The tool expands transparency and access to publicly available information about public water systems across Colorado.

The data and information displayed by the tool are public information. The tool can be filtered by water system name, county, water type, and enforcement status. The tool allows the creation and sharing of individual links for any populated searches and allows the user to select various options per category. The user can download information by table. Tables can be downloaded by clicking the three dots on the upper right-hand corner of the table. Select “Export” and the preferred file format (e.g., Excel or Google Sheets). 

The tool integrates the department’s electronic record system and contains up-to-date information. For example:

• On the Public Water System table, there is a column labeled “PWS ID (Links to Records)”, if you click the link in the column, it will show all the public records related to the specific water system.
• On the Public Water System table, there is a column labeled “Enforcement”. If it shows “Open Order”, the system is currently under enforcement. If you click the link in the “Enforcement” column, it will take you to the enforcement-related records.
• On the Violations and the Inspection and Deficiencies tables, there is a column labeled “Resolved”. If it shows “Yes”, the violation and or finding has been resolved and if it shows “No”, it has not been resolved. If you believe the violation and or finding has been resolved please reach out to your compliance specialist or inspector to discuss the status further. 
• There are other record searches built into the tool, such as Reports and Notices, and Violation & Inspection Records. 

Please direct questions about the information provided on the tool to the assigned compliance specialist. 

Thank you for your partnership and commitment to making sure that Colorado’s water consumers are informed when it comes to their drinking water. 

➽ Jorge Delgado, Drinking Water Compliance Unit Manager

EPA Reallotment of Lead Funds helps Colorado

In order to address the critical need to replace lead service lines across the nation, the Bipartisan Infrastructure Law (BIL) included funding specific to lead service line inventory and removal projects for the State Revolving Fund Program. In 2022, Colorado received over $56 million for lead service line inventory and removal projects. However, in 2023 due to a change in how EPA allotted lead funds, many states including Colorado experienced a drastic cut in lead service line funding. In fact, the 2023 BIL lead service line funding for Colorado was cut by over 40%. This cut in funding is significant and means many Colorado systems may not be able to access this funding to replace lead service lines. However, earlier this year EPA announced that some state SRF programs did not need the lead service line funding allotted to them through the BIL. The states of Alaska, Hawaii, Maine, Nevada, Oregon, South Dakota, and Washington declined a total of $219 million of 2022 BIL lead service line funding. As a result, Colorado was able to apply for a portion of the unused funds, up to $4.86 million. Although it is not enough to make up for the funding cut, these additional funds will help Colorado to continue to meet the high demand for lead service line funding across the state. Colorado utilizes this funding in multiple ways to assist public water systems to inventory, plan, design, and complete removal of lead service lines. The SRF Program provides low interest loans as well as grants for eligible systems to complete construction to remove lead service lines. The Division has utilized the EPA lead service line funding to provide lead service line inventory grants and to develop a robust technical assistance program. The lead service line inventory grant program has awarded over $700,000 in grants. The technical assistance program provides services free of charge to complete lead service line inventory and to plan for lead service line removal. The Division encourages public water systems to contact these programs for assistance in inventory, planning, and removal of lead service lines. The SRF program can be contacted at SRF Program Contacts. Systems interested in the inventory grants and free technical assistance can contact the program at Colorado@LeadRemoval.info. Please note that systems that want free technical assistance need to apply to the program prior to May 15 by completing a service agreement.

➽ Mark Henderson Community Development and Partnership Section Manager

Final PFAS Rule Considerations

CDPHE PFAs Website

On April 8, 2024 EPA announced that it had finalized a new drinking water rule within the Safe Drinking Water Act (SDWA) to address per- and polyfluorinated alkyl substances (PFAS). This has been a long journey, but now there is a definitive timeline for the state to adopt the rule, public water systems to conduct testing, and if necessary make operational changes or install treatment to comply with the newly established Maximum Contaminant Levels (MCLs). We published an Aqua Talk article on June 21, 2023 about the draft rule published in March 2023 for public comment. EPA received over 120,000 comments on the draft rule that they considered when finalizing this PFAS rule. 

There are several differences between the draft and final rules, but EPA did not modify the Maximum Contaminant Level Goals (MCLGs) or the MCLs for PFOA or PFOS, which are the most common PFAS compounds detected in Colorado. PFOA and PFOS are considered carcinogens, and so the MCLGs were set at zero. This is common for drinking water contaminants. EPA is required by SDWA to set MCLs as close to MCLGs as feasible while considering benefits and costs. The final MCLs for PFOA and PFOS remained at 4.0 parts per trillion (ppt) each based on the reliability of laboratory quantification. 

But EPA established more MCLGs and MCLs for individual PFAS compounds in the final rule as compared to the draft rule. Please recall that MCLGs are the maximum allowable concentration of a contaminant at which no adverse health effects are expected, with a margin of safety. Specifically, EPA added MCLGs set at 10 ppt each for PFHxS, PFNA and HFPO-DA (GenX), which are not regarded as carcinogens. The MCLs for these compounds were also set at 10 ppt each. In Colorado, we tend not to find these compounds at levels exceeding the MCLs unless the MCLs for PFOA or PFAS are exceeded. So, this change is not considered likely to be impactful to compliance status, but can impact treatment design and operations. EPA also made some changes to the hazard Index, but that is not likely to be impactful in Colorado considering the profile of PFAS compounds detected in water samples to date. So, to summarize the final MCLs are:

• PFOA and PFOS MCLs = 4.0 ppt each
• PFHxS, PFNA and HFPO-DA MCLs = 10 pt each

In terms of timing, systems are required to complete initial monitoring within three years, and then begin regular monitoring plus reporting results in the annual Consumer Confidence Reports (CCRs). However, in the final rule, the compliance deadline to meet the MCLs was extended an additional two years to allow for capital infrastructure improvements. This would also allow for two more years to complete public notice requirements for MCLs violations. The public notice tier level remained at Tier 2. 

EPA kept the overall structure of the final rule consistent with the draft rule to model other chronic organic contaminants with quarterly monitoring and compliance based on a running annual average of those results. Reduced monitoring options are available, and it is possible to use prior PFAS data to meet initial monitoring requirements. 

A significant need for EPA guidance on this rule remains to address treatment design and conduction pilot studies, residual waste handling and disposal, reduced monitoring and the trigger level, public notice plus communication, and much more. This is very important to foster state implementation and water system compliance. To that end, EPA recently published a draft revised guidance document for PFAS destruction and disposal for a 180-day public comment period.

The above information describes the federal minimum requirements, and states can choose to take a more stringent approach. As always, we will be engaging stakeholders in developing the PFAS rule for Colorado. The final decisions on Colorado’s PFAS rule will be made by the Water Quality Control Commission after the stakeholder process is completed.  

Most systems that need to install new treatment for compliance will need to secure financial assistance. We have significant funding available now from the State Revolving Fund and Bipartisan Infrastructure Law, plus the PFAS cash fund generated by Senate Bill 2020-218. We can help water systems with testing, planning and design grants plus infrastructure funding as well. These funding sources typically have specific eligibility and grant requirements that need to be met, and our staff can help water systems navigate the process. These funding sources help with initial design and construction activities, but do not help with the long-term operating and maintenance costs. It is not certain whether all these funding sources will be available four or five years from now, so we recommend that systems move forward now with their planning for complying with the new PFAS rule. 

Because we have been helping water systems address PFAS contamination for over eight years, we understand the issues and challenges. We want all systems in Colorado to gain compliance with the PFAS MCLs before the required deadline. I advise you to learn about the final PFAS rule and take steps to prepare your water system for it. If you have not yet collected PFAS samples from your system, I advise you to contact us and we will test your water for free. Getting in front of this now while funding is available is the best approach to keeping tap water safe for your customers. 

Thank you.

➽ Ron Falco, P.E. Safe Drinking Water Program Manager

2024 Operator Certification Board Vacancy

The Water and Wastewater Facility Operators Certification Board (WWFOCB) is a 10-member rulemaking body with oversight responsibility for the operator certification program, Regulation 100, and supporting policies. Members are appointed by the governor to serve four-year terms. The board usually meets up to 10 times a year for half-day meetings. There will also be opportunities for day-long training sessions. While board members volunteer their time, they are entitled to reimbursement of travel expenses.

Currently, there is a vacancy on the WWFOCB for a person that meets at least one of these criteria:

• A city manager, manager of a special district, or utility manager in a city, county, or city and county that operates a domestic water or wastewater treatment facility. This board member is not required to be a certified operator. 

The most effective board members have a strong interest in supporting public health and environmental protection through the operator certification program. They are good listeners who can articulate their perspectives in a professional and respectful way. When there is a difference of opinions, effective board members work toward building consensus.

If you are interested in serving on the WWFOCB, and you meet the criteria for the vacancy, please contact the board office at cdphe.wwfocb@state.co.us for more information. 

The application is available online at the Governor’s Office of Boards and Commissions.

➽ Jessica Morgan, Liaison to the WWFOCB

Dear Aqua Answers - Help Update My Risk and Resilience Assessments and Emergency Response Plans

Water Resilience Framework

Dear Aqua Answers,

When I prepared the Risk and Resilience Assessments and Emergency Response Plans for our water system back in 2021 cybersecurity was less of a concern, but now it’s a real big deal. How can I incorporate cybersecurity into my updated documents that are due in 2026? 

Please help. Thanks,

Cy Bersafe

                                                                                                                                                                                

Dear Cy,

You are correct! Cybersecurity is a big concern today. But you don’t need to wait until 2026 to update your Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP). Cybersecurity threats appear to be ever-changing and more threatening. The RRA and ERP are meant to be living documents that are periodically updated and reviewed. But let’s take a step back for a moment, and review the requirements. 

The RRA and ERP requirements were incorporated into the Safe Drinking Water Act in October 2018. All Community Water Systems with populations greater than 3,300 must conduct Risk and Resilience Assessment (RRAs) and develop Emergency Response Plans (ERPs). These documents need to be reviewed and updated at least every five years. The initial RRA certifications were due to EPA from March 2020 to June 2021 depending on systems size, so the first five-year updates are due from March 2025 to June 2026. In general, the idea is to conduct a risk assessment first (the RRA) and then develop an ERP specific to your system. 

Cybersecurity risks fall under the RRA requirements to address risks from malevolent acts and involve the traditional water system infrastructure that involves electronic, computer, or other automated systems (including the security of such systems). One area that has been targeted by cybercriminals is the billing system for water systems. So, cybersecurity also crosses into the financial infrastructure as well. EPA has a Vulnerability Self-Assessment Tool (VSAT) to help water systems complete their RRA. The Cybersecurity and Infrastructure Security Agency (CISA) and the Colorado Information Analysis Center (CIAC) also provide numerous tools to help systems address the cyber components of the RRA. 

Once you follow those steps to complete the cybersecurity portion of the RRA, then the ERP needs to be developed describing the strategies, resources, plans and procedures utilities will use to reduce the risk of cyberattacks and respond to incidents. Our Drinking Water Security Response Toolbox is designed to help you meet these AWIA requirements and keep your water systems safe and protected, including against cybersecurity threats. Specifically, at the bottom of this website, you will see a list of activities that can be part of your ERP. For example, you could launch and implement a policy that specifies how frequently your water system backs up data and start a multi-factor authentication process for all system access. These activities would be part of your ERP. It is recommended to then keep records of system back-ups, etc. Additionally, you could begin an employee training program on how to recognize and respond to phishing emails that can lead to a ransomware attack. This would be a great strategy to include in your ERP, and again remember to establish a method to track and document that the employee training is happening on an ongoing basis. These are examples of low cast actions your water system can take to reduce the risk of cyberattacks. Perhaps a longer-term action to plan for would be to ensure that financial/billing computer systems are separated from the operating system involved with water treatment and delivery.

These are good steps to reduce risks and hopefully prevent a cyberattack. But the ERP also needs to describe how your system would respond to attack. Again the Drinking Water Security Response Toolbox provides helpful tools and guidance. One early action after an attack occurs is reporting. We have reporting guidance to help with that. Reporting the incident will also lead to getting help from state and federal agencies to help you recover from the incident. 

We hope this information helps you get on your way with updating your RRA and ERP.

Sincerely,

➽ Aqua Answers