Emergency Response Plan Tom Hyatt, MRWA Water Training Specialist
Certification of community water systems’ Emergency Response Plan (ERP) is due by December 30, 2021, for systems serving more than 3,300 people and fewer than 50,000. The time to prepare this document has arrived. The good news is that many water systems already have an ERP, which was required with the Vulnerability Assessment by the Bioterrorism Act following the events of September 11, 2001. Make sure to update your existing document. Change listings of utility response personnel to reflect current decision-makers and employees; ensure phone numbers, email addresses, and other contact information is accurate for utility and other agency representatives; revise listings for chemical and parts suppliers, water haulers, electricians, excavators, and other emergency contacts, as needed; and ensure that any emergency use of water through interconnection with other water systems is still agreed upon by all parties.
Because of cybersecurity considerations, something that was far less recognized as a threat during the early 2000s, you’ll want to ask about the utility’s IT specialist. Larger water systems will possibly have a staff member in this roll or a cybersecurity firm on retainer. Small utilities might be at a loss as to where to turn if a cyber-attack occurs. The Department of Homeland Security (DHS) offers cyber security advisors to help make your utility less vulnerable to such an intrusion at cyberadvisor@ hq.dhs.gov. Following a cyber-attack, the DHS National
Cybersecurity and Communications Integration Center (NCCIC) offers recovery assistance at this 24-hour number: 888-282-0870. Consider other malevolent acts, as well. Can someone gain access to sensitive data: customer information, system maps, operations manuals, passwords, etc.? How well are facilities protected: well houses, treatment plants, storage tanks, equipment storage, electrical components? How well protected are billing clerks or others who regularly communicate with the public if someone were to enter a facility with the intent to harm people? Although plans to protect people and facilities are really part of the already completed Risk and Resilience Assessment, we need to consider how the utility will recover if any breach occurs. These responses could include identifying methods of alert when physical intrusion or threat occurs, persons responsible for responding to specific threats, step-by-step action protocols, inter-agency communication needs, and types of public notification.
Aftermath of 2011 Joplin tornado.
Utilities also need to strategize recovery methods for natural disasters: floods, droughts, ice storms, tornadoes, etc. Examples might involve the following scenarios: If power is lost, how do workers override automated controls with manual operations; what types of water (continued on page 14) 13
