New Law Requires Utilities to Complete Risk and Resilience Assessments and Emergency Response Plans

After the events of September 11, 2001, President Bush signed into law the Public Health Security and Bioterrorism Response Act of 2002. This law amended the Safe Drinking Water Act, requiring community water systems to conduct vulnerability assessments and develop emergency response plans and submit copies to the EPA.

In October of 2018, the America’s Water Infrastructure Act (AWIA 2018) became a law. AWIA 2018 has now amended the previous law, with some new requirements. AWIA 2018 requires community water systems that serve more than 3,300 people to develop Risk and Resilience Assessments (RRA) and Emergency Response Plans (ERP). Deadlines have also been set for when these must be certified to the Environmental Protection Agency (EPA). It is important to note that the actual assessments and plans are not submitted to EPA. Rather, each system must certify that they have completed the requirements and keep the assessments and plans on file.

The initial due dates for completing and certifying the Risk and Resilience Assessments are shown below and are due as early as March 31, 2020 for systems serving 100,000 people or more.

Each water system must complete and certify its Emergency Response Plan no later than 6 months after the Risk and Resilience Assessment is certified. Re-certification is required every five years.

A helpful overview of the Risk and Resilience Assessments and Emergency Response Plans can be found at this link . The overview includes helpful information and frequently asked questions.

There are two helpful tools that have been created to complete the Risk and Resilience Assessments and Emergency Response Plans. The first tool is the Vulnerability Self-Assessment Tool (VSAT) Web 2.0. This is an online software tool that aids in completing the Risk and Resilience Assessment. VSAT has six steps that include compiling information on the utility, completing a utility resilience index, qualitative risk assessment, quantitative risk assessment, and countermeasure analysis. After the assessment is complete, the tool generates a report that can serve as the Risk and Resilience Assessment. The utility can then certify to the EPA that the required assessment has been completed.

The second tool is a template that aids in completing an Emergency Response Plan. Before completing the Emergency Response Plan, the EPA recommends completing the following five steps:
1. Complete the Risk and Resilience Assessment
2. Identify state and regulatory requirements
3. Identify and integrate local plans
4. Coordinate with Local Emergency Planning Committees (LEPCs) and
5. Plan for Resources.

The template includes five sections: compiling utility information, developing resilience strategies, emergency plans and procedures (including core response procedures and incident specific response procedures), mitigation actions, and detection strategies. The completed template can serve as the Emergency Response Plan. The utility can then certify to the EPA that the required plan has been completed.

Any new requirements can be a challenge to implement. Engineers at FOX have participated in EPA training for these new requirements and would be happy to assist your utility in the completion of the requirements. If you have any questions or would like assistance in meeting these new requirements, please contact Taylor Hopper, P.E ( or Adib Amini, Ph.D. (

FOX Engineering is an environmental engineering firm based in Ames, Iowa. We specialize in water and wastewater solutions for our diverse municipal and industrial clients. Our work varies in size and scope and can be found throughout the Midwest and beyond.