Guest Column | April 11, 2019

EPA's Looming Risk Resilience Assessment (RRA) And Emergency Response Plan (ERP): What You Need To Know

Sheldon Primus

By Sheldon Primus


The U.S. EPA has a new Risk Resilience Assessment (RRA) and Emergency Response Plan (ERP) compliance deadline coming for water systems across America. These key plans are set to come due in 2020 and 2021 with varying deadlines as per the size of the utility’s service areas. This article will give you tips to be ready for the EPA deadlines.


In June 2002, the Bioterrorism Act of 2002 required drinking water utilities which served more than 3,300 people to conduct an assessment to determine if they are susceptible to terrorist attacks on their system. This population size represents a community such as Waverly, NE (a suburb of Lincoln, NE). 

A vulnerability assessment was also required for wastewater and combined utilities to determine where the utilities vulnerabilities are for both man-made and natural hazards. Under the Bioterrorism Act, the EPA developed tools and methods to:

  • Recognize and rank threats to drinking water and wastewater infrastructure;
  • Evaluate vulnerabilities and estimate the consequence related to a successful attack;
  • Create modeling tools for threats and consequences evaluation for risk management tasks; and
  • Plan for countermeasures to diminish the risk and intentional contamination by terrorist activities.

Current Regulation

The America’s Water Infrastructure Act of 2018 (AWIA) became law on October 23, 2018 as section 1433 of the Safe Drinking Water Act was amended in Section 2013 of the AWIA. In this section, the law specifies the topics that the risk and resilience assessment and emergency response plan must cover and give deadlines for certificates of completion to the EPA.

Again, the requirement for compliance is for utilities serving more than 3,300 persons that are served directly or indirectly by the system. Therefore, if a smaller community is a wholesaler to another population by a consecutive system, then all people served by those systems count as users.

The Risk and Resilience Assessment must address the funding and operational needs and an evaluation for the following:

  1. The risk to the system from malevolent acts and natural hazards;
  2. The resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system;
  3. The monitoring practices of the system;
  4. The financial infrastructure of the system;
  5. The use, storage, or handling of various chemicals by the system; and
  6. The operation and maintenance of the system.

No later than six months after the submitting the completed certification of the RRA, the Emergency Response Plan must be submitted. This plan must include the following:

  1. Strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system;
  2. Plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water;
  3. Actions, procedures, and equipment that can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers; and
  4. Strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.

The utility should seek to coordinate with local emergency planning and communities when they are conducting the assessments. In addition, the EPA requires that the documents be keep for five years after certifying the plan.



The EPA is still working on providing baseline information on the malevolent acts of relevance to community water systems, technical assistance fact sheets, and a new version of the Vulnerability Self-Assessment Tool (VSAT) and Emergency Response Guide. However, they did provide a Route to Resilience 2018 e-tool, All-Hazards Boot Camp Training, and a resource page on Creating Resilient Water Utilities (CRWU).