Summary
- From cyber attacks to accidental water contamination, the EPA has been stepping up its involvement in the protecting of public water systems since the implementation of the 2020 National Enforcement and Compliance Initiative.
- SDWA Section 1433 points water utilities to the need to create Emergency Response Plans and to carry out Risk and Resilience Assessments.
- Developing, implementing, and managing a comprehensive cross-connection control program is a direct action that water utilities can take to gain regulatory compliance with the SDWA and EPA while simultaneously protecting their public water supply from the lurking threat of backflow contamination.
Safe and secure drinking water at every tap is what Americans expect, 24/7. Just last month, May 2024, the EPA issued an Enforcement Alert providing water systems with “immediate steps they can take to ensure compliance with the Safe Drinking Water Act Section 1433 and to reduce cybersecurity vulnerabilities.” Cyber attacks have been increasing against public water utilities, with the worst-case scenario outlined by the EPA including an attacker gaining the ability to “manipulate operational technology, which could cause significant adverse consequences for both the utility and drinking water consumers.” The aforementioned SDWA Section 1433 requires that water systems serving more than 3,300 water customers must conduct Risk and Resilience Assessments, or RRAs, and develop Emergency Response Plans, or ERPs. Both documents must have their completion certified by the EPA, in addition to both documents being reviewed every five years and revised if necessary.
This EPA Enforcement Alert comes at a time the EPA is stepping up its oversight of public water utilities via the 2020 National Enforcement and Compliance Initiative (NECI). The goal of this initiative is to foster greater collaboration between the EPA and the states, tribes, territories, and companies that maintain public drinking water systems to create a more effective national program and to improve compliance with the SDWA. This recent alert regarding cyber security is an example of the EPA using their resources to bring this issue to the attention of local water purveyors. It also serves as an indication of where the EPA is turning their attention as we move through the fourth year of the NECI.
Connecting the Dots of Backflow Threats
Looking at the RRAs and ERPs required by Section 1433 of the SDWA, we will see that the topics of cross-connection control and backflow prevention are present in EPA standardized templates for these documents, and issues of water contamination and what systems are actively doing to protect the quality of their water are increasingly coming under scrutiny. As recommended in the AWWA M14 Manual and required by many state regulations, a comprehensive cross-connection control program can dramatically reduce backflow contamination hazards and simultaneously fulfill multiple required components of ERPs and RRAs. In 2022, the EPA found that 29.6 percent of water systems had monitoring and reporting violations – below are the two areas in Section 1433 of the SDWA that relate to backflow and cross-connection control.
1. Emergency Response Plans (ERP) – Backflow Related
In the EPA’s free downloadable guide to writing an ERP, section 4.2 covers Water Contamination and the methods of detection that can be used to find potential sources of water contamination. While some of the recommended actions include tracking customer complaints and water sampling, one recommended action falls squarely into the category of a typical cross-connection control program activity: what the EPA calls “physical security monitoring at access points to finished water”. While this may seem at first to reference points within the actual water treatment facility, all points of use in a public distribution system are connected to the finished water supply and could therefore be a source of contamination in the event of a hazardous cross-connection and a backflow incident.
By implementing onsite visual surveys of all points of use in commercial and residential properties with water service connections, water utilities can have real world data on the devices and methods in place to protect their drinking water system from any cross-connection contamination. These activities should be spelled out clearly both in the utility’s cross-connection control plan and in their emergency response plan. Also to be included in the emergency response plan would be the remedial actions that the utility would take in the event of a backflow contamination incident, from isolating the source of the hazard and performing water quality tests to ensure the issue has been resolved.
2. Risk and Resilience Assessments (RRA) – Cross-Connection Control Activities
The EPA’s guidance for risk and resilience includes the category of “Contamination of Finished Water – Accidental” for assessing the water utility’s risk for this occurrence and assessing the resilience the utility has in the case of the incident occurring. Accidental contamination is exactly what occurs when there is a backflow contamination incident and hazardous cross-connections. To lower the risk of accidental contamination from a backflow event, a comprehensive cross-connection control program will ensure that the system is being regularly monitored for any potentially dangerous cross-connections and that proper backflow prevention assemblies, devices, and methods are in place.
In addition, having a comprehensive program in place will supply the utility with a tremendous amount of real-world data on backflow preventer test history, existing cross-connections, and more. Having information with this level of detail will be critical in mitigating risks and maintaining resilience against any accidental contamination.
Conclusion
As the EPA becomes more hands on through the National Enforcement and Compliance Initiative, being prepared for inspections and sanitary surveys has never been more relevant. Their vigilance can be noted in their recent alert regarding cybersecurity. However, implementing a robust, comprehensive cross-connection control program will go far beyond regulatory compliance and will keep your drinking water safe from the hazards of backflow contamination.
