Staff from hundreds of utilities have spoken with me about preparedness, and every one of them has a story to share. Sometimes it was an accident that caused a chlorine leak, or a well-meaning citizen walking into city hall with an unexploded ordinance from the Civil War, or a cyber-system shut-down because of an e-mail virus. Every water and wastewater system is vulnerable in some way; it is the responsibility of each system’s leadership to be prepared just in case the unthinkable occurs.
If you are reading this, you likely have an interest in emergency preparedness, and chances are your plate is overflowing, as is the list of items on which to spend your budget. That’s why this article is about what a busy utility can do to increase its preparedness. Everything mentioned here can be accomplished quickly and inexpensively and has a good return on investment.
Most of the water systems in the United States have completed a vulnerability assessment (VA); several water systems implemented security measures as an outcome of their VA results. Only some of these water systems have maintained their security and preparedness programs, and a few have updated their VAs in the past five years.
The guidance found in AWWA Standard G430, Security Practices for Operation and Management, states that VAs should be updated at least once every five years (section 4.4). Today we have tools such as the Risk Analysis and Management for Critical Asset Protection Standard for Risk and Resilience Management of Water and Wastewater Systems (J100) that can be used to update a VA to account for any type of threat from a natural disaster to a human-caused event.
Challenge yourself to take the first step toward updating your VA this week; find the old document. It was meant to be a “for official use only” document and might have ended up locked in a director’s cabinet or file drawer. As people changed jobs during the past decade, information may have been lost. If you have misplaced your VA, you would not be alone. To locate a copy, try asking staff who worked on the original VA project, check in storage, or call the consultant who originally helped your utility with the project. If you find your VA on a shelf in the conference room, move it to a more secure location.
Even without the original document, a utility can conduct a VA that accounts for changes in the water system, utility culture, dependencies, proximity vulnerabilities, and natural disasters. Check for the latter in your local jurisdiction’s hazard mitigation plan, which likely has been updated within the past five years.
EMERGENCY RESPONSE PLANNING
Many utilities have had to use their emergency response plans in the past decade. It’s an important practice for utilities to update their plan at least yearly because it’s dangerous to have all of the critical information only in an employee’s head; the emergency response plan must be clearly defined in a written document for staff to use and refine.
Emergency response plans come in a variety of shapes, sizes, and content. AWWA’s updated guidance on emergency response planning—M19 Emergency Planning for Water Utilities—has been available since 2014. It addresses the useful contents of an emergency plan as well as communication, case studies, training and exercises, mitigation measures, and other important topics.
Spend time reviewing your utility’s emergency response plan to note what needs updating. Take a look at the emergency contact list, and make sure the names, e-mails, and phone numbers are current. A suggested way to do this is for a staff member to call each number on the list and request updated information from the person on the other end of the line: “Hello, Dr. Crumpet—this is Joe from the Foresight Water Utility. We’re updating our emergency contact list and I’m checking to see if this is the best way to reach you in an emergency.” Chances are you will encounter many informative emergency update stories by reaching out to the emergency contacts on your list. You can always schedule lunch to get additional information, and it may remind your contacts to keep current on the topic as well.
BUSINESS CONTINUITY PLANNING
The emergency response plan stops the “bleeding” in an emergency, whereas the business continuity plan (BCP) keeps the heart of the utility beating. Both are important for utility resiliency. The BCP is sometimes referred to as the continuity of operations plan (or COOP), and its roots are in the information technology world.
In a BCP, the utility identifies mission-essential functions such as bill collection and water/wastewater treatment. Several utility staff meet to develop the BCP, identifying key resources and personnel to accomplish the essential functions. Many utilities have already identified their vital records and data and have these backed up on a distant offsite computer system, per- haps even in another state.
For the employee aspects of business continuity, the plan identifies delegation of authority as well as succession planning during an emergency. Staff might not like to think about what could happen if key co-workers disappear, never to be seen again, but a utility’s resiliency depends on thinking through these aspects of continuity planning.
A new BCP resource for the water sector has been developed by the Water Research Foundation in collaboration with the US Environmental Protection Agency and AWWA. This resource includes a a template (http://www.waterrf.org/resources/pages/PublicProjectPapers-detail.aspx?ItemID=6) and a series of video tutorials (http://www.waterrf.org/resources/pages/PublicWebTools-detail.aspx?ItemID=19) that will help all water and wastewater utilities, large and small, to develop their own BCPs.
CYBER/INDUSTRIAL CONTROL SYSTEMS SECURITY
The area of cyber and supervisory control and data acquisition (SCADA) preparedness has catapulted to the forefront of emergency preparedness in the past few years. It is critical that each utility take a look at its Internet security as well as its process control system security. With the plethora of guidance available, prospective users may be challenged in identifying the guidance that is most applicable and effective in improving their security posture. For this reason AWWA is working on a process control–system security-guidance document for the water sector.
Meanwhile, one free resource available to utilities is the Cyber Security Evaluation Tool (CSET) from the Department of Homeland Security (DHS). The software is downloadable for PCs (not Macs) through the Indus- trial Control Systems Cyber Emergency Response Team (CERT) website (http://ics-cert.us-cert.gov). CERT staff are available to train and assist utilities in using the CSET software tool that has been updated to include the latest security standards.
Psychology tells us that when we respond in a crisis, we remember the most recent action taken rather than the most appropriate action to take. For this reason it is critical that utility staff experience the best actions for resiliency by participating in emergency response exercises. You can conduct a simple, 10-minute exercise during a staff meeting as easily as you can cover a safety moment. Ask staff a few questions, and discuss the answers. Here is a sample exercise that helps with business continuity planning:
(1) The fire alarm just went off in the building. What do you take with you?
(2) No one will be allowed back in the building for at least one week. Where could you be located during that time in order to conduct your utility function? What information and items are missing at that location that you will need to do your job?
TRAINING FOR STAFF
Much free training is available to utilities via the Internet and in person. Of note are the Federal Emergency Management Agency courses on the National Incident Management System, including the Incident Command System (ICS). There are several classes, but staff can begin with ICS 100 and ICS 200 for the basics about how ICS functions.
Onsite trainings, sponsored by the DHS as part of the National Emergency Response & Rescue Training Center of the Texas A&M Engineering Extension Service (TEEX), are free to utilities. Descriptions and signup information are provided on the TEEX website: http://www.teex.org/nerrtc/.
KEEPING UP WITH THE STANDARDS
If you have suggestions for emergency preparedness or stories about what has helped your utility prepare for emergencies, please send them to Shannon.Spence@ arcadis-us.com for possible publication in this column. (If desired you can maintain anonymity for yourself or your utility).
—Linda P. Warren is the owner of Launch! Consulting (www.launch-consulting.com) in Charlottesville, Va. She assists utilities throughout the United States with all aspects of resiliency, from vulnerability assessments and emergency planning to strategic planning and workshop facilitation. She actively serves on three AWWA committees: Standards Committee for Security Practices, Standards Committee for Source Water Protection, and the M19 Subcommittee on Emergency Planning for Water Utilities. She can be contacted at Linda@launch-consulting.com.