Pages

Thursday, October 9, 2025

Acute Health Risks - Can it happen to you?

The below article is a re-run and update from an article published in the 2007 Summer Aqua Talk newsletter. Since then, the water sector has navigated many acute and emergency situations in partnership with the WQCD. We value your continued partnership and vigilance as you protect the public health and environment for our communities. 

We could all learn a little something from the Boy Scouts, especially when it comes to acute health risks in drinking water systems. Acute health risks that must be reported can be caused by events such as:

  • Acute total coliform maximum contaminant level violations (when fecal or E. Coli is present);
  • Failure to collect repeat samples after a fecal or E. Coli positive sample;
  • Failure to test for fecal or E. Coli in a total coliform positive repeat sample;
  • Nitrate, nitrite or total nitrate nitrite maximum contaminant level violations;
  • Failure to take nitrate or nitrite confirmation sample within 24 hours after receipt of the first sample showing exceedance of the maximum contaminant level;
  • Surface water treatment rule violations, such as not using a filter cartridge, not feeding coagulant, or a single exceedance of the maximum allowable turbidity limit or failure to maintain chlorine level entering the distribution system; etc).
  • Suspected waterborne disease outbreak;
  • Situations such as depressurization of a distribution system due to a line break or loss of power;
  • Uncontrolled cross connections that contaminate the water supply;
  • A treatment or supply emergency (for example, failure or significant interruption of key water treatment processes, a natural disaster that disrupts water supply, chemical spill or unexpected loading of pathogens);
  • Tampering or vandalism that could have contaminated the water supply

Preparing for these situations can save lives, not to mention save you time and money. To help you keep your cool in a stressful situation, consider preparation measures such as:

  • Plan: Gather necessary forms and phone numbers, including the 24-Hour incident reporting hotline (877) 518-5608. 
  • Be familiar with the Public Notice wizard to create public notice templates and think through possible acute situations.
  • Designate people responsible for specific activities, make sure your Operator Delegation Plan is up to date.
  • Practice with benchtop exercises/drills. Use this coaching request form to request a  Local Assistance Unit benchtop exercise for your facility.

If your system has experienced tampering or suspected tampering, including a cyber attack, you are required to notify the Colorado Department of Public Health and Environment immediately. For details, see section 11.2(1) of the Colorado Primary Drinking Water Regulations and visit the Drinking Water Security Response Toolbox. Report physical and cyber security incidents to the WQCD Tampering Threat and Incident Report Form

For more information about acute procedures, please check Drinking Water Policy DW-0001 Response to Acute Health Threats from Public Water Systems, the Pressure Loss and Main Break Guidance and the Drinking Water Emergency information website.

CoWarn, the statewide Water/Wastewater Agency Response Network (CoWARN) of utilities helping utilities to prepare for the next natural or human-caused emergency is also a resource to help public water systems.

By being prepared, water suppliers can effectively handle emergency situations and potential acute situations to protect public health. 

➽ Heather Young, PE, CWP, Field Services Section Section Manager 

➽ Emily Clark, Drinking Water Enforcement Unit Manager

Wednesday, October 1, 2025

Legionella Bacteria and Drinking Water Disease Outbreaks


I attended the American Water Works Association’s (AWWA’s) Annual Conference and Exposition (ACE) in Denver, Colorado, earlier this year. There were some excellent sessions on a wide variety of topics. However, the session that stood out the most to me covered Legionnaires'  Disease and drinking water. Presenters include Dr. Mark Lechavellier, Dr. Chad Seidel, Sheldon Masters, and Julie Kennedy. The session covered some of the latest research into Legionella and drinking water, plus a case study regarding an outbreak in Grand Rapids, Minnesota, that occurred from 2023 to 2024.

Although there are over fifty Legionella species and about half can cause disease, Legionella pneumophila is the most important because it causes most Legionnaires' disease cases and occurs naturally in aquatic environments. The species can infect free-living Amoeba, where the amoeba can act as a host for Legionella. The 1989 drinking water Surface Water Treatment Rule (SWTR) set a treatment technique for Legionella and established a Maximum Contaminant Level Goal (MCLG) equal to zero. Groundwater systems have no such treatment technique requirements, but one-third of the outbreaks occur in groundwater systems. Partly due to better reporting and testing, Legionella cases rose 10-fold from 1990 to 2021. Legionnaires’ outbreaks often occur in buildings such as hotels, medical facilities, and offices. People catch Legionnaires’ disease by inhaling small droplets of water suspended in the air containing Legionella. Legionnaires’ disease does not spread from person to person.

Dr. Lechavallier reported on a Legionella occurrence study that involved water testing 57 utilities. Overall, 9,118 samples were collected, and 1.2% (109) were positive. Thirty-two percent of utilities had detections. A chlorine residual of at least 0.4 mg/L dramatically reduced the positive detection frequency. Dead-end water lines, low water usage, and tank sediment raised the risk of finding Legionella. Flushing can be effective in reducing Legionella levels. Optimum Corrosion Control Treatment (OCCT) reduces pipe corrosion, which reduces the habitat where Legionella can grow. The study concluded that while eliminating Legionella is impossible, testing and management are feasible. Communicating with commercial and industrial customers about Legionella can also be beneficial. 

Unfortunately, Grand Rapids, Minnesota, experienced a severe Legionella outbreak from 2023 to 2024. Grand Rapids has a population of 11,000 and uses groundwater from five wells. The community did not disinfect and had three storage tanks (0.5 million-gallons each) and 81 miles of distribution system. Increased disease incidence began in mid-2023, but water was not believed to be the cause at that time. Legionella were not found in the water system, but the bacteria were found in the water in buildings with Legionnaires’ Disease cases. Over the next year, there were 34 total cases with 30 people hospitalized and two fatalities. After a complete assessment and expert assistance, including Dr. Seidel, chloramination started in June 2024. There have been no Legionella cases in Grand Rapids since then. Considerable effort also involved working with building owners in the town. Generally, buildings that maintain and actively implement water quality management plans do not have outbreaks.

EPA is in the process of updating its rules addressing Microbial Pathogens/Disinfection Byproducts (M/DBPs). It will be a few years before the update is finalized, and these rules will still not apply to groundwater systems. The updated rules are likely to improve the treatment technique requirements for Legionella at surface water systems. While we believe that Colorado is well-positioned to implement improvements due to our rules covering disinfectant residual, storage tanks, and cross connection control (backflow prevention), the occurrence data in this study are concerning. Additionally, even with solid operations by water utilities, important work involving water quality management plans within buildings is not part of our oversight. We encourage utilities to learn more about Legionella and consider partnering with their commercial and industrial customers, especially health facilities like hospitals and nursing homes, to take steps that could reduce the likelihood of a Legionnaires’ Disease outbreak in Colorado.  


As always, thank you for keeping our drinking water safe.

➽ Ron Falco, P.E. Safe Drinking Water Program Manager 

➽ Co-Author Chelsea Cotton, P.E. Lead Drinking Water Engineer



Monday, September 29, 2025

EPA Cyber Alerts: Cisco Products and SonicWall Cyber Incidents

The Colorado Department of Public Health and Environment (CDPHE) is posting the following cyber alerts in partnership with the Environmental Protection Agency (EPA). Please reach out to EPA with any questions about this or any additional Cyber concerns  watercyberta@epa.gov.

Alert: Identify and Mitigate Potential Compromise of Cisco Devices

The United States Environmental Protection Agency (EPA) is issuing this alert to inform water and wastewater systems about Emergency Directive (ED) 25-03 issued by the Cybersecurity and Infrastructure Security Agency (CISA). This directive highlights an ongoing exploitation campaign by an advanced threat actor targeting Cisco Adaptive Security Appliances (ASA). The campaign is widespread and involves exploiting zero-day vulnerabilities to achieve unauthenticated remote code execution on Cisco ASAs. Additionally, it includes the manipulation of read-only memory (ROM), enabling threat actors to maintain access even through reboots and system upgrades.

Link to Emergency Directive 25-03

Mitigations

Although Emergency Directive 25-03 is directed at federal agencies, EPA strongly recommends that water and wastewater systems review the Emergency Directive and follow the mitigation steps. The Emergency Directive includes a detailed step-by-step guide along with resources to assist in implementing each mitigation. Systems that outsource technology support should consult with their service providers for assistance with these steps.

Important: Water and wastewater systems are not required to report their activities to CISA, including those outlined in mitigation steps 2, 3, and 6 in the Emergency Directive. This requirement applies only to federal agencies; however, systems may choose to report voluntarily and are encouraged to do so if a compromise is detected.

Conclusion

If you have questions about any of the information in this alert, including assistance with the mitigation steps included in the Emergency Directive, please submit a request to EPA’s Cybersecurity Technical Assistance Program for the Water Sector.

Additionally, CISA has provided the following contact information specific to this Emergency Directive:

Wednesday, September 24, 2025

PFAS Grant Program Over the Past 5 Years


Click here for more information about the PFAS Grant Program.

PFAS are man-made chemicals with unique properties that make them useful for many consumer and industrial uses (e.g., waterproofing, non-stick surfaces). But those properties also make them persistent in the environment. PFAS chemicals from firefighting foam, personal products, and other substances are toxic and may get into the groundwater and surface water, potentially contaminating Colorado’s drinking water supplies. There is evidence that exposure to PFAS can lead to adverse human health effects including low infant birth weights, cancer and negative effects on the immune system. 

The state continues to address PFAS issues through legislative-directed funding from Senate Bill 20-218. The Colorado Department of Public Health and Environment Hazardous Substances Response Act (SB20-218) was signed into law on June 29, 2020 ( C.R.S. 8-20-206.5(7)). 

The act created fees on the transportation of fuel products, which will be collected between September 1, 2020, and September 30, 2031, when the available balance in the fund is less than nine million dollars. The collected fees are placed in the PFAS Cash Fund established by the legislative bill. The funding is managed by the Water Quality Control Division and can be used for the PFAS grant program, PFAS takeback program, and PFAS technical assistance to impacted communities.

The PFAS Grant Program provides funding opportunities to eligible entities through three (3) primary project categories: 

  1. Sampling - standard sampling and Independent Environmental Studies;
  2. Emergency Assistance - to communities and water systems affected by PFAS; and 
  3. Infrastructure -water system infrastructure for the treatment of PFAS and prevention strategies for upstream sources of PFAS.

The PFAS grant program has awarded over 19 million dollars in grant funds to help communities across Colorado identify and mitigate PFAS in water. Some current and past projects include:

  • Determining the impacts of firefighting foam, ski wax, and septic systems on source water. 
  • Piloting PFAS treatment for drinking water systems and landfill leachate.
  • Installation of filtered drinking water stations in schools.
  • Several fish tissue sampling efforts.
  • Over $3.5 million to identify and assess PFAS in drinking water, source water, and groundwater. 
  • ~$12 million used to implement PFAS treatment for clean drinking water.

A full list of awarded projects can be found on the PFAS Grant Summaries webpage.  In addition, our annual legislative reports on the program progress can be found on the PFAS Laws webpage.

Any questions may be directed towards the cdphe_wqcd_pfas_grant@state.co.us email. Please use the subject line “Grant Program Questions.”

➽ Sierra Mitchell, PFAS Program Coordinator


Wednesday, September 17, 2025

Equipping Operators with Skills to Manage and Overcome Testing Anxiety!


As coaches, one thing we often hear is that sitting for water and wastewater operator certification exams is a dreaded experience. While this apprehension is completely understandable, it is not insurmountable. We are re-publishing the below article that will help you understand where this anxiety comes from, steps you can take to overcome your testing anxiety, and tangible tools to help you succeed when you take your next operator certification exam. Thank you for all the work you do to protect the environment and public health of your communities. Keep calm and test on! 

➽ Kyra Gregory, Drinking Water Training Specialist 

Note: This article has been reposted with permission from the author, Tom Healy, Director of Certification Services for The Association of Boards of Certification. Original article published Summer 2021 Arkansas Drinking Water Update

                                                                                                                                         

We have all experienced it, that feeling of dread and foreboding before taking an exam; a myriad of scenarios running through your head outlining the worst possible outcomes.

These feelings of testing anxiety are very real and can have detrimental effects on an operator’s exam performance. In fact, a recent survey of operators conducted by the Ohio Water Environment Association found that nearly 30 percent of respondents cited testing anxiety as a main cause for not passing the exam.

To examine why testing anxiety is such a prevalent phenomenon, especially in high stakes vocational testing such as an operator certification exam, I spoke with Dr. Ian MacFarlane of Elizabethtown College. Dr. MacFarlane is an Assistant Professor of Psychology, as well as a clinical psychologist. With more than 1,000 hours of therapy work with college students and adults, he has helped countless individuals recognize and overcome testing anxiety.

Why do Operators worry?

Taking a certification exam is different from a high school biology or chemistry final: the stakes are exponentially higher. Psychologically, operators may feel that taking an exam related to their everyday job duties raises a question about their professional competence. This spark of anxiety will be fanned further if a passing score on the exam is mandated for their current job or required for promotion potential.

When asked how test anxiety manifests, Dr. MacFarlane pointed to both cognitive and physical (or somatic) symptoms stating, “The most detrimental effects of anxiety are cognitive. The human brain is limited to a certain amount of processing power at one time. The more your brain is occupied with the anxiety of the exam, the less ability it has to process the exam content. It would be akin to going into a wrestling match with one hand tied behind your back. Anxiety is a ‘mental suck’ or leech draining your brain power and limiting your ability to recall information or facts that might be as familiar to you as the names of your parents.”

One particularly common manifestation of testing anxiety Dr. MacFarlane cited is detachment–an operator is likely to avoid the discomfort of test anxiety by simply not thinking about the exam. Just as your body will pass out instead of coping with a lack of oxygen, you are likely to avoid the discomfort of test anxiety by simply not thinking about the exam.  He noted, “This can be quite detrimental as this avoidance loop can cause you to disengage from exam preparatory practices which can seriously hinder performance on the exam.”

Other effects of anxiety can be seen as physiological symptoms such as nausea, stomach cramps, or lightheadedness. To explain this, Dr. MacFarlane offered, “Our bodies lack the ability to differentiate between real life and mental simulations. So, if we are extremely worried or anxious about something, our minds can create physiological manifestations that are directly associated with the negative mental simulations.”

Why do some operators who excel in their jobs perform poorly on the exam?

Even though the exam is measuring the knowledge and application of tasks that an operator performs daily, while in the testing environment, they lose the contextual cues that would normally assist them in everyday operations.

Without those additional sources of information, operators must work harder to draw parallels between the tasks on the exam and the tasks they perform in their job. In other words, because an operator is not being tested in the environment in which he/she normally performs a task (a water or wastewater system), it can be difficult to recognize and solve the same problem in a test environment.

What can operators do to help with testing anxiety?

1. Practice, Practice, Practice

There is no better way of reducing test anxiety than to spend an adequate amount of time preparing and practicing. Test-taking is a skill—one that must be practiced and honed. Dr. MacFarlane noted that in many cases, due to inefficient study techniques, people have a tendency to work on areas in which they are already proficient and to avoid areas that could use improvement. Operators should make better use of their study time by taking periodic practice tests to help gauge the areas they need to work on. As an added benefit, the practice tests will train them to work under the pressure of a time constraint. Because the time limit on most certification exams can create a state of panic, it is important that operators learn to perform under these stressors and to control the feelings of unease.

2. Don’t “cram”

Countless studies have been done over the years on the ineffectiveness of “cramming,” or waiting until the last available opportunity to study for an exam. Say an operator spends the last six hours before the exam reviewing material. It is easy for them to think that they have everything committed to memory; the material is “fresh” in their mind. The reality is that nothing could be further from the truth. Reviewing this way gives an operator a familiarity with the material, meaning he/she will be able to recognize it when they see it on paper. Unfortunately, the ability to recognize concepts is not the same as being able to recall it. The ability to recall or reconstruct information accurately when an operator needs it requires exposure to the information over a long period of time.

The best course of action is to build a study plan that spans the course of several weeks prior to the exam. The more time an operator spends reorganizing the material so it has a structure, the more likely they are to commit the information to long term memory. Operators should aim for 45-60 minutes per day with their study material for at least six weeks prior to the exam.

3. How can an operator cope with anxiety on test day?

Even the most prepared test-takers can feel anxiety on test day, but there are proven methods to counteract the effects. Operators should start with getting adequate sleep the night before. Studies have shown that people perform better on memory tasks when they are well-rested. Some people will suffer from interrupted sleep when particularly worried about something. To help with this, operators can try exercising for 30 minutes before bed. Doing so will help their bodies release excess cortisol (stress hormone) in their systems caused by anxiety and will allow them to sleep better.

An operator should ensure their body is well nourished the day of the exam. This means do not skip breakfast and eat healthy foods such as grains or fruit and avoid foods with high fat content. The goal here is to eliminate as many distractors as possible so an operator can dedicate all their attention to the exam. If an operator is tired or his/her body does not have enough fuel, it can drastically hinder their performance.

4. Breathing – The 5-5-7 Method

During the exam, it can be extremely beneficial to stop at regular intervals (perhaps every five questions) and take deep breaths. The 5-5-7 is a breathing exercise performed by inhaling for five seconds, holding your breath for another five seconds, then exhaling for seven seconds. Dr. MacFarlane suggested that completing this exercise at regular intervals during a test session can physiologically stimulate the central nervous system, which can heighten an operator’s awareness and push anxiety from their mind. He also stressed the importance of practicing this technique for several weeks prior to the exam during their preparation, saying “The more practiced you are in this technique, the more effective it will be during exam time. Your body and mind will have a Pavlovian response to the exercise which increases its effectiveness.”

5. Muscle Relaxation

Another proven technique outlined during our discussion was progressive muscle relaxation, or PMR. This is done by deliberately applying tension (by clenching) to certain muscle groups and then releasing the induced tension. During this process, all of an operator’s attention should be focused on how their muscles feel as the tension is released. As operators learn to distinguish the feelings of a tense muscle as compared to a completely relaxed one, they are able to recognize the physical effects anxiety has on their bodies and can quickly alleviate it with this technique. Operators should be encouraged to practice PMR both when preparing for the exam and on the day of testing. They should spend 15-20 minutes at a time performing this technique on their major muscle groups (feet, legs, hands, arms, neck, and shoulders) and it will help mitigate anxiety.

The Bottom Line

While these methods have been shown to help with anxiety, they may not work for everyone. There are many more techniques that may offer relief, and operators can use these tips as a starting point to find what works best for them. Above all, operators should make sure they spend adequate time studying and reviewing the material. The better command they have of the content, the less anxious they will be about the exam, and the better they will perform.

➽ Tom Healy, Director of Certification Services for The Association of Boards of Certification


Thursday, September 4, 2025

REMINDER - Walter A. Weers Outstanding Achievement Award

In the past, the Water and Wastewater Facility Operators Certification Board (board) annually issued the Walter A. Weers Outstanding Achievement Award to honor individuals who have made outstanding contributions to the Colorado Water and Wastewater Facility Operators Certification Program (program) and to the water professionals operating facilities under the program.     

The award is named after Walter A. Weers, who devoted a half-century of outstanding volunteer service to the advancement of the certification of professionals in the Colorado water and wastewater industry. The award is intended to honor truly exceptional contributions and may not be presented each year or may be awarded to more than one recipient per year (at the discretion of the board). The award was last presented in 2019, and the program would like to raise awareness of this award in hopes of honoring an individual in 2026. 

This outstanding achievement award recognizes those individuals who:

  • Have given their time unselfishly to educate operators,
  • Have provided their expertise to the examination of operators, or
  • Have used their creativity and tenacity to build Colorado’s certification program into one of the premier programs in the country. 

Anyone who has had a direct impact on the program and the water professionals operating Colorado facilities under this program can be nominated for this award. Nominations must be submitted before October 15th of each year to be considered and acted on by the board at its November meeting. If the board decides to honor an individual, the award will be presented in conjunction with the Colorado Rural Water Association (CRWA) annual conference in March of the following year. 

Consider taking a few minutes of your time to submit an award nomination that can inspire others to continue providing outstanding service to the program and to highlight the importance of the profession and its impact on Colorado communities. Anyone can submit a nomination form, and nominations can be as short as one to two paragraphs. You never know what great acts of service and kindness you may inspire!   

You can find more information about this award on the board’s website, as well as a link to the nomination form, submission instructions, and previous recipients. 

If you have any questions about this award or the nomination process, feel free to contact Jessica Morgan cdphe.facilityoperator@state.co.us.

➽Jessica Morgan, Liaison to the Water & Wastewater Facility Operators Certification Board


Wednesday, August 27, 2025

WQCD wants your input! - What does Excellence mean to the water sector?


Click here to take the survey!

Providing safe drinking water to the public has never been a simple task. While there are thousands of water systems, and operators that are working to install backflow devices to prevent contamination, maintaining and adjusting chlorine levels, sampling and managing all the documents to prove that the work is being done and safe water is being provided, seldom is there recognition for the work.

Continually improving a water system has never been so hard. As our scientific knowledge and discoveries of contaminants expand, so do the regulations and standards operators need to uphold. This increases the work and the amount of pressure that comes with operating an entire community drinking water system. While we are not physically present on a daily basis to observe and acknowledge the effort it takes to maintain such standards, we do appreciate and rely on the knowledge and passion it takes to maintain a culture of health - that is we look at our daily routines and emergencies through a lens of protecting people’s health. One way of showing our appreciation is through the Excellence Program Awards formerly known as the Pursuing Excellence Program. We intend on continuing and revitalizing the tradition of recognizing the wonderful public water systems that have been supplying safe and clean water by showing our gratitude and how much we value the work being done.

The Excellence Awards Program will distribute two recognition awards, the Outstanding Compliance Award and the Commitment Award. The Commitment Award will focus on recognizing entities that have been proactive in enhancing their water system by submitting a project they have done that embraces a continuous improvement approach. 

We understand that "excellence" is subjective and what is considered excellent in one system's circumstances may not be the same for another system in different circumstances.  Our aim is to understand what “excellence” means to you and ensure it reflects the achievements of water professionals who are delivering exceptional performance in our water systems. One entity might be putting in maximum effort in educational outreach for exposure of the industry to recruit new operators, while a different entity might find it more rewarding to assist smaller systems in bettering their water supply and process. 

We notice and value all the different ways operators are advancing the industry and want to make sure this Commitment Award is tailored to include the opinions of water systems. In order to take into account opinions of those working first-hand in the field, we have created a two-question excellence survey that includes different ways we believe a system can achieve excellence in the industry. There are various aspects of maintaining a water system included in this survey and we want to know which ones are valued the most within this community.

To customize this Commitment Award and reward projects that resonate with the survey results, we ask that you please take a couple seconds of your day to complete the survey. The link for the survey will be below. We appreciate every response and will make sure to take them into account when discussing what projects to award.

➽ Priscila Lopez, Drinking water coach- Excellence Program Manager 

Wednesday, August 20, 2025

Wildfire Planning and Recovery Playbook - 2025 Updates!

After a wet spring and variable monsoon season, wildfire season is again upon us in Colorado. As many of you are aware, our public water systems and local communities face a diverse and significant array of challenges when planning, responding, and recovering from wildfires. The best time to start planning for wildfires is right now, in advance of fires.

The Water Quality Control Division (WQCD), along with many state, federal, and local partners, have released a revised and updated version of our Wildfire Planning and Recovery Playbook, available on our Source Water Assessment and Protection website.  Several authors also hosted a webinar on July 25th, with the slide presentation and a recording available.

Pre-fire planning, response, and recovery is a team effort, and requires coordination across multiple jurisdictions, and administrative and physical boundaries. Each community wildfire event may present a unique set of circumstances that must be understood and conveyed to effectively navigate wildfire incidents. The centerpiece of the playbook is the comprehensive critical contacts list, outlining necessary points of contact along with each representative’s roles and responsibilities within the planning, response, and recovery process. Below is an example of the critical contacts list contained in the playbook.



The playbook also provides various actionable steps through each phase of the fire cycle, from planning through recovery.  Examples include identifying your values at risk, forming a recovery group and identifying partners, understanding prefire actions and resources, and roles and responsibilities of partners throughout the different phases of a wildfire incident. The playbook also includes 2 full pages of links to additional resources, including a list of funding programs and technical assistance partners.

The playbook is concise, usable, and accessible. The target audience for this playbook is public water systems, municipalities, counties, and tribes. The updated version reflects lessons learned from recent urban and suburban wildfires and the new Wildfire Ready Watersheds framework from the Colorado Water Conservation Board. Please contact the source water protection team at cdphe.wqswap@state.co.us with any questions or for more information.

➽ Robert Murphy, CPSS, Source Water Protection Program Coordinator

➽ Kristen Hughes, Source Water Protection Specialist

➽ John Duggan, Source Water & Emerging Contaminants Unit Manager

Thursday, August 14, 2025

Upcoming EPA Cyber/Resilience Funding Cycle

EPA Announces Availability of $9 Million to Protect Drinking Water from Natural Hazards and Cybersecurity Threats

The U.S. Environmental Protection Agency (EPA) has announced over $9 million in grant funding through the new competitive Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability grant program, which will assist medium and large size public water systems with protecting drinking water sources from natural hazards, extreme weather events, and cybersecurity threats. The application period is open until October 6, 2025, and can be found on www.grants.gov under opportunity number EPA-OW-OGWDW-25-01, assistance listing number 66.488.

Learn More About The Grant Opportunity on EPA's Website

EPA will host a webinar on the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability Grant Program on August 19th, from 2:00 to 3:00 PM ET. Please join us to learn more.

Register for EPA's August 19th Webinar


Cyber Alert EPA: Active Exploitation of Microsoft SharePoint Vulnerabilities

The U.S. EPA is issuing this alert to inform water and wastewater system owners and operators about the active exploitation of security vulnerabilities in Microsoft SharePoint that allows attackers to mislead the system into thinking they are a trusted user, also known as network spoofing, and remotely run malicious code, known as a remote code execution (RCE). This exploit enables unauthorized access specifically to Microsoft SharePoint servers, which are hosted and operated on-site. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a cybersecurity alert on this malicious activity, publicly reported as “ToolShell.” 

Mitigations

All drinking water and wastewater systems with Microsoft SharePoint servers are strongly encouraged to implement the following mitigations immediately to enhance resilience against this compromise:

  • Apply the necessary security updates released by Microsoft.
  • Configure Antimalware Scan Interface (AMSI) in SharePoint and deploy Microsoft Defender Antivirus on all SharePoint servers.
  • Rotate ASP.NET machine keys, then after applying Microsoft’s security update, rotate ASP.NET machine keys again, and restart the Internet Information Services (IIS) web server.
  • Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) from the internet.
  • Conduct scanning for IPs 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
  • Monitor for malicious POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit
  • Update intrusion prevention system and web application firewall rules to block exploit patterns and anomalous behavior.
  • Implement comprehensive logging to identify exploitation activity.
  • Audit and minimize layout and admin privileges

For additional information on detection, prevention, and advanced threat hunting measures, drinking water and wastewater systems owners and operators are encouraged to visit Microsoft’s Disrupting active exploitation of on-premises SharePoint vulnerabilities and advisory as well as CISA’s cybersecurity alert.

Conclusion

The U.S. EPA requests that the Water Sector Coordinating Council (WSCC)/Government Coordinating Council (GCC) review this advisory and pass it along to all water & wastewater entities that may be susceptible to this threat. Additionally, we encourage the EPA Regions share the advisory with the state primacy agencies and direct implementation utilities.

Wednesday, August 6, 2025

Cybersecurity: NIST's Updated Password Guidelines & Sector Resources

The water and wastewater sectors are essential to daily life, and safeguarding them from cyber threats is crucial. The newly updated National Institute of Standards and Technology’s (NIST) password guidelines, along with the range of resources offered by the EPA and CISA, provide a strong foundation for improving cybersecurity across the industry. We encourage you and your colleagues to implement these new password guidelines and general cyber hygiene. Here’s a breakdown of the key updates and additional cybersecurity resources that can help strengthen your system's defenses.

NIST’s Updated Password Guidelines: What’s New?

In September 2024, NIST introduced new password management guidelines aimed at improving both security and user experience. The changes reflect a shift towards longer, more memorable passwords, and away from overly complex password requirements.

Key Updates:

  1. Password Length: NIST now recommends using passwords or passphrases that are at least 15 characters long. The focus has shifted from enforcing complexity (e.g., mixing uppercase, numbers, and symbols) to prioritizing longer passwords that are easier to remember.
  2. Password Composition: Gone are the days of forcing users to include specific character types. The new focus is on allowing longer, memorable passwords, which reduces the chances of people creating easily guessable passwords. 
  3. Fewer Password Changes: Unless there’s evidence of a security breach, mandatory password changes are no longer required. This policy change helps users avoid creating predictable patterns due to frequent password resets.
  4. Password Managers: NIST now strongly encourages the use of password manager software, which can generate and store strong, unique passwords for each account. It’s a vital tool to prevent the risk of password reuse across different accounts.
  5. Avoid Password Hints & Security Questions: To minimize the risk of social engineering attacks, NIST advises against using password hints or security questions that could easily be guessed.
  6. Multi-Factor Authentication (MFA): MFA is a non-negotiable security measure. By requiring more than just a password to access sensitive systems, MFA adds an additional layer of protection.

These updated guidelines emphasize simplicity and practicality, reducing user frustration while enhancing security. In an industry like water and wastewater, where systems are critical to public health, these updates offer a crucial balance of usability and protection.

Additional Cybersecurity Resources for the Water & Wastewater Sector

Alongside these password updates, there are also significant resources available to bolster cybersecurity across water and wastewater systems.

On March 13, 2025, the EPA will host a cybersecurity briefing for the water and wastewater sector. The session will cover unclassified threats, along with available funding and technical resources from the Environmental Protection Agency (EPA) and the Cybersecurity and Infrastructure Security Agency (CISA). Here are a few resources to explore:

By staying informed and adopting the latest cybersecurity practices, water and wastewater utilities can ensure a secure future, protecting critical infrastructure from evolving threats.

➽ Kyra Gregory, Drinking Water Training Specialists 

Wednesday, July 30, 2025

EPA PFAS Rule Update: What Colorado Water Systems Need to Know

The division is closely monitoring recent developments from the EPA regarding its 2024 drinking water PFAS Rule. While the EPA has signaled potential changes to the regulation, the official rulemaking timeline remains unchanged, with Colorado’s adoption scheduled for August 11, 2025. The division is committed to maintaining clarity for water systems and intends to highlight this federal uncertainty in its Statement of Basis and Purpose that is part of the rulemaking. The division is committed to communicating with water systems when federal action occurs and proposing revisions to Colorado’s PFAS rule to align with federal requirements before the Water Quality Control Commission.

Resources: 

EPA’s Announced Changes

In May 2025, the EPA announced that it may significantly revise the 2024 PFAS Rule. Proposed changes include:

  • Removing and reconsidering regulations for four PFAS compounds: PFNA, PFHxS, HFPO-DA (GenX), and PFBS.
  • Retaining Maximum Contaminant Levels (MCLs) and monitoring requirements for PFOA and PFOS only.
  • Eliminating the Hazard Index concept and its associated MCL for PFAS mixtures.
  • Extending the compliance deadline for PFOA and PFOS MCLs from 2029 to 2031.

These changes are planned to occur via a revised PFAS Rule proposal in Fall 2025, and anticipated finalization in Spring 2026.

It’s important to note that, so far, EPA’s announcement has not indicated changes to the requirements for initial monitoring of six PFAS compounds by the April 2027 compliance deadline.

Colorado’s Approach

Colorado is moving forward with adopting the PFAS rule this summer to retain full Safe Drinking Water Act primacy. This ensures that the division, not EPA, will continue to oversee PFAS compliance, monitoring, and enforcement across Colorado systems.

To account for the evolving federal landscape, the division has included a “federal flexibility provision” in its rule language. This provision allows for the automatic extension or stay of any deadlines or requirements altered by the final federal PFAS Rule, minimizing disruption for water systems.

Why Primacy Matters

Colorado’s decision to adopt the rule in 2025 avoids a primacy extension agreement with EPA. Under such an agreement, EPA would have authority over PFAS compliance while the state catches up. This would fragment regulatory oversight, complicate compliance for Colorado’s water systems, and limit our decision-making authority during this period. We believe that the division can provide the best decisions for water systems and their customers in Colorado.

The division’s experience with the Lead and Copper Rule Revisions (LCRR) demonstrated the benefit of timely rule adoption. Being one of the few states to implement LCRR on schedule allowed the division to retain control and better support systems through technical and operational challenges. The same advantages apply here.

Operational Implications for Water Systems

Drinking water data across Colorado shows that PFOA and PFOS are the primary PFAS compounds detected in public water supplies in Colorado. The removal of other compounds from the federal rule should not change which systems require PFAS treatment in Colorado. However, there may be impacts to treatment plant design and operation, which the division will work to consider during rule implementation.

In the meantime, systems are encouraged to stay engaged and continue monitoring for PFAS to meet initial monitoring requirements. The division will provide ongoing updates and technical assistance throughout this evolving process.

Stay Informed

The division is committed to supporting Colorado’s water systems during this transition. As the revised federal rule develops, Colorado will adapt, but always with the goal of maintaining clarity, consistency, and strong public health protections.

➽ Haley Orahood, Regulatory Development and Implementation Specialist

Wednesday, July 23, 2025

New resource alert - W/WW Operator Resources Webpage

* While Aqua Talk is a safe drinking water information hub, the information below is also helpful to your wastewater friends, so please pass it along!

We encourage you to bookmark the Operator Resources webpage and visit regularly for updates and guidance tailored to your role as a certified operator. 

We are excited to announce that the Water Quality Control Division (Division) recently developed a new resource designed specifically for Colorado certified water and wastewater operators, or for those interested in entering the workforce. It is a single webpage that serves as a one-stop shop, bringing together all the essential information, tools, and resources operators need to know.

From certification, examination, and renewal details to information on training and funding opportunities, regulatory requirements, and guidance documents, everything you need is now conveniently located in one place. There is also a direct link to the CCWP Portal and contact information for CCWP, Division, and Board staff. Say goodbye to the hassle of navigating several sites to track down information!

If you have any questions about or issues with this webpage, please contact Jessica Morgan cdphe.facilityoperator@state.co.us.

➽ Jessica Morgan, Liaison to the Water & Wastewater Facility Operators Certification Board

Wednesday, July 16, 2025

Coordination with Public Water Systems on SCADA Vulnerabilities


In June 2025, the EPA’s Water Infrastructure and Cyber Resilience Division (WICRD) notified the Water Quality Control Division (WQCD) that they had identified potential cybersecurity vulnerabilities at four Colorado public water systems (PWSs). While scanning for vulnerable devices, EPA identified the specific TCP/IP addresses of four BIF3800 SCADA Control Systems that were internet-exposed and could potentially allow a remote user to access the device and disrupt the utility’s operations. WQCD Field Services immediately reached out to the four water systems to notify them of the potential vulnerability so they could take action to protect their systems. 

Many utilities installed SCADA BIF3800 units as early as the 1990s and were controlling ancillary processes in the distribution systems of the water systems. There was a common thought that hackers would not be interested in equipment that is so old, or that the older control systems would be less vulnerable to cyber attacks. Unfortunately, hackers can exploit any internet-exposed interfaces like these. The EPA and the Cybersecurity and Infrastructure Security Agency (CISA) recently published this joint fact sheet, which highlights the risks posed by internet-exposed Human Machine Interfaces (HMIs), including how hackers can find and exploit HMIs with cybersecurity weaknesses easily. The EPA and CISA fact sheet includes recommended mitigations to secure HMIs, including:

  • Conduct an inventory of all internet-exposed devices.
  • If possible, disconnect HMIs and all other accessible and unprotected systems from the public-facing internet.
  • If it is not possible to disconnect the device, secure it by creating a username and a strong password to prevent a threat actor from easily viewing and accessing the device. Change factory default passwords.

Thankfully, the four water systems quickly responded to remove the exposure and did not experience any cyber events due to this issue. The CISA team in Colorado also reached out to the water systems to provide technical support to mitigate the vulnerabilities.  

WQCD encourages water systems to continue to evaluate and protect their systems against cyber threats. Utilities that need support can contact the Colorado CISA Team, including Edward (Charlie) Marmon at edward.marmon@cisa.dhs.gov  or Kindra Brewer at kindra.brewer@cisa.dhs.gov, and the EPA’s Cybersecurity Technical Assistance Help Desk is also available for assistance. The WQCD Drinking Water Security Response Toolbox is a one-stop shop for security resources. 

➽ Heather Young, PE, CWP, Field Services Section Manager

➽ Naheem Noah, Field Services Section

Wednesday, July 9, 2025

Cyber Alert: Global Conflict Potential to Impact US Critical Infrastructure

EPA Cyber Alert: Iran Conflict is Increasing the Likelihood of Low-Level Cyberattacks Against US Networks

Note: The Water Quality Control Division is posting the following information out in partnership with the Environmental Protection Agency (EPA) .

The U.S. EPA is issuing this alert to inform water and wastewater system owners and operators of the need for increased vigilance for potential cyber activity in the United States due to the current geopolitical environment. The U.S. Department of Homeland Security (DHS) published a National Terrorism Advisory System Bulletin, indicating that low-level cyberattacks against U.S. networks by pro-Iranian hacktivists are likely, and cyber actors affiliated with the Iranian Government may conduct attacks against U.S. networks. Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet warning that Iranian-affiliated cyber actors may target U.S. devices and networks for near-term cyber operations.

Iranian-affiliated cyber actors have demonstrated the ability to exploit operational technology (OT) devices at U.S. water and wastewater systems, forcing many systems to revert to manual operations and resulting in operational impacts.

All drinking water and wastewater systems are strongly encouraged to implement the following mitigations immediately to enhance resilience against low-level cyberattacks:

  • Reduce OT Exposure to the Public-Facing Internet
  • Replace All Default Passwords on OT Devices with Strong, Unique Passwords
  • Implement Multifactor Authentication for Remote Access to OT Devices

In addition to these immediate actions, drinking water and wastewater systems are encouraged to adopt the actions outlined in the CISA, EPA, and FBI Top Cyber Actions for Securing Water Systems Fact Sheet to further reduce cyber risk and improve resilience against malicious cyber activity.

The U.S. EPA requests that the Water Sector Coordinating Council (WSCC)/Government

Coordinating Council (GCC) review this advisory and pass it along to all water & wastewater entities that may be susceptible to this threat. Additionally, we encourage the EPA Regions share the advisory with the state primacy agencies and direct implementation utilities.

Water and wastewater system owners and operators should direct their IT/OT system

administrators to review this alert for further use and implementation. If you rely on third party vendors for technology support, then you are encouraged to contact them to confirm their awareness of this threat. Organizations are encouraged to report information concerning suspicious or criminal activity to FBI Internet Crime Complaint Center (IC3) at IC3.gov or to CISA via CISA’s Incident Reporting System. If you have questions about any of the information contained in this document, please contact the Water Infrastructure and Cyber Resilience Division, Cybersecurity Branch at watercyberta@epa.gov.

Stay Informed

If you are interested in subscribing to receive security alert notifications immediately upon release, please sign up using this form and select the topics that interest you. This topic is General - Security updates - Water and wastewater systems.

➽ WQCD Security Workgroup

Aqua Answers: Bag and Cartridge Filters in Surface Water Treatment


Dear Aqua Answers,

I’m the operator for a surface water treatment system that uses bag and cartridge filters, and I have a few questions!

___________________________________________________________________________

Question 1: What’s the difference between compliance filters and other bag or cartridge filters at my plant?

For suppliers of surface water or groundwater under the direct influence of surface water (SW/GWUDI), the treatment system must be designed to meet the requirements of Section 11.8 of Regulation 11, also known as the Surface Water Treatment Rule (SWTR). This rule requires the treatment process to remove specific levels of Giardia and Cryptosporidium to ensure public health protection.

One way to meet these requirements is by using bag or cartridge filtration. These filters use a straining process where water passes through a disposable bag or cartridge housed in a permanently installed filter housing. Each filter and housing combination used for compliance filtration must be approved by the Colorado Department of Public Health and Environment (the Department) through the alternative technology approval process. Typically, this approval is obtained by the filter manufacturer rather than through a site-specific approval.

Every installation of bag or cartridge filters at a public water system (PWS) must also be reviewed by the Department as part of a design submittal.

Additional filters, sometimes called “roughing filters” may be installed upstream of the compliance filters. These do not require separate Department alternative technology approval but usually still require review as part of the design submittal.

For more details on design requirements, see the State of Colorado Design Criteria for Potable Water Systems (DCPWS), Section 4.3.9.

Question 2: How do I know which cartridges or bags I should use in my compliance filters?

Many SW/GWUDI suppliers have been issued a Record of Approved Waterworks (RAW) that lists all the supplier’s approved treatment and storage facilities and water sources. To find your facility’s RAW, visit the Department’s RAW webpage and enter your PWSID or facility name.

If you don’t have a RAW, you can find this information in the approval letter issued by the Department for your filtration system, or you can contact the Engineering Section for assistance.

Your RAW (or approval letter) will specify the approved filter manufacturer, model number, and the Department’s alternative technology acceptance letter. You can find the acceptance letter on our drinking water alternative technology website.

Important: Many bag and cartridge filters on the market have not been approved by the Department. Using unapproved filters or filter/housing combinations for compliance filtration can result in a treatment technique violation or a significant deficiency noted during a sanitary survey—both of which would require the supplier to issue a public notice.

Question 3: I have a sanitary survey coming up. Is there anything I should know about my bag or cartridge filters?

Yes! Suppliers using alternative filtration technology must continuously meet the design, performance, and operation and maintenance requirements in Sections 4.3.9.6 – 4.3.9.8 of the DCPWS and in the Department’s acceptance letter for the specific filtration technology.

For bag and cartridge filtration systems, this typically includes:

  • Not exceeding the maximum specified pressure differential.
  • Keeping daily records of pressure differentials and filter change-outs. These records will be reviewed during the sanitary survey.
  • Maintaining specific spare parts on-site, which may also be checked during the survey.

Be sure to review your RAW and acceptance letter to understand all conditions of approval and ensure you’re keeping the required records. Both your RAW conditions and site-specific records will be evaluated during the sanitary survey.

Question 4: I’m a contract operator managing multiple public water systems. Do the requirements for bag and cartridge filters differ by system type?

Yes, the requirements can vary based on system size and type (e.g., community, non-community, or transient systems). These differences may include NSF 61 certification, the number of redundant filters required, and other system-specific considerations. The DCPWS outlines these requirements in detail, but if you have any questions, please reach out to the Department’s Engineering Section for assistance.

Sincerely,

Aqua Answers

Wednesday, June 25, 2025

Being prepared for toxic algae season

As climate conditions continue to shift, Colorado has seen increasingly warm and nutrient-rich waters during the summer months — conditions that remain ideal for toxic algae to form in standing or slow-moving water. Toxic algae or harmful algae blooms (HABs) are made up of cyanobacteria, commonly known as blue-green algae. Although these organisms naturally occur in Colorado waters, they become a problem when they multiply rapidly, resulting in a dense cyanobacteria concentration or “bloom.” In drinking water sources, cyanobacteria blooms can cause the water to taste or smell bad. Taste and odor in drinking water is not regulated but creates customer concerns about water quality and safety. Most complaints that water utilities receive are about taste and odor, and these issues can last for prolonged periods. In addition to taste and odor problems, the blooms can become harmful and create a public health risk when they produce toxins. Removing toxins in a safe and cost-effective way can be a challenge for treatment facilities, and not all water providers are equipped to do so. 

Drinking water providers can contact the Water Quality Control Division at 303-692-3500 with questions about toxic algae. We can help water providers who experience taste and odor problems and toxins. This includes ideas about customer communication and steps that utilities can take to monitor and manage toxic algae and best treat their drinking water. If you detect microcystins above 0.3 μg/L and/or cylindrospermopsin above 0.7 μg/L (EPA’s cyanotoxin health advisory values), call the CDPHE 24-hour incident reporting hotline at 1-877-518-5608 so the division can provide you with immediate assistance.

We have resources to help drinking water providers and recreational water managers with toxic algae monitoring, response and public education and created a map to show recent toxic algae conditions for select waterbodies in the state. 

This 2019 AquaTalk article remains especially relevant today as cyanotoxins still pose a public health concern, even without being formally regulated. While EPA is continuing to evaluate the need for national regulation, the core takeaways from past events like Salem, Oregon’s microcystin advisory remain vital reminders for proactive communication, monitoring, and response. Whether you manage a public drinking water system or recreate on Colorado lakes and reservoirs, this piece offers timeless lessons for navigating toxic algae season safely.