America’s Water Infrastructure Act of 2018 Risk and Resiliency Requirements

The purpose of this article is to outline America’s Water Infrastructure Act of 2018 (AWIA 2018) Title II Drinking Water System Improvement Section 2013: Community Water System Risk and Resilience. The AWIA 2018 addresses the evaluation and reporting for many facets of infrastructure encompassing various forms of water and energy as well as providing funding. The Act was sponsored by Senator Amy Klobuchar (D-MN) and unanimously passed by the US House of Representatives and US Senate then signed into law by President Trump on October 23, 2018. The focus of this article is Section 2013 Community Water System Risk and Resilience.


Section 2013 of America’s Water Infrastructure Act of 2018 (AWIA 2018) amended Section 1433 of the Safe Drinking Water Act (SDWA) which added requirements on community water systems that serve 3,300 or more people to complete a risk and resilience assessment then develop an emergency response plan (ERP). Additionally, these must be updated whenever there is a major change in the water system or every five years, whichever is first. The full text of the law may be found here and the Federal Register Notice for New Risk Assessments and Emergency Response Plans for Community Water Systems is available here. Revised Section 1433(a) requires the risk and resiliency assessments, and Revised Section 1433(b) requires the ERPs.


In the United States, water system resilience to natural and manmade incidents and emergency response preparedness first became a national priority following the terrorist attacks of September 11th, 2001. Section 401 of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act of 2002) amended the Safe Drinking Water Act (SDWA) inserting section 1433-1435. Section 1433 of the SDWA required all community water systems serving a population greater than 3,300 to conduct a water system vulnerability assessment. The assessment was meant to look specifically at terrorism or other intentional acts intended to substantially disrupt the provision of a safe and reliable drinking water supply and develop or revise emergency response plans. The act specifically required the following six areas:

  1. A review of pipes and constructed conveyances
  2. Physical barriers
  3. Water collection, pretreatment, treatment, storage, and distribution facilities
  4. Electronic, computer, or other automated systems which are utilized by the public water system
  5. The use, storage, or handling of various chemicals
  6. The operations and maintenance of the system

New Requirements

AWIA has similar requirements for the risk assessment. The risk assessment shall include an assessment of:

  1. The risk to the system from malevolent acts and natural hazards
  2. The resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the systems
  3. The monitoring practices of the system
  4. The financial infrastructure of the system
  5. The use, storage, or handling of various chemicals by the system
  6. The operations and maintenance of the system

And may include an evaluation of capital and operational needs for risk and resilience management for the system.


The biggest differences between these two laws are the revelation that natural hazards can be as bad as terrorist incidents for an unprepared water systems, an ongoing review/update requirement recognizing the iterative nature of risk, inclusion of the financial infrastructure of the water system, and a copy of the assessment and plan are not required to be forwarded to the United States Environmental Protection Agency (USEPA).

Upcoming Assistance

The law also requires the USEPA to publish Baseline Information on Malevolent Acts Relevant to Community Water Systems. This publication will be available by August 2019 and no water system is able to certify completion of their risk assessment or ERP until this is published because utilities are meant to integrate that framework into their risk assessments. The USEPA administrator is required to consult with “appropriate departments and agencies of the Federal Government and with State and local governments” to provide baseline information on malevolent acts of relevance including any acts which may:

  1. Substantially disrupt the ability of the water system to provide a safe and reliable supply of drinking water
  2. Otherwise present significant public health or economic concerns to the community served by the system

Certification, Requirements, and Deadlines

The USEPA requires each utility to submit certification of the risk and resilience assessment and emergency response plan. Submissions must include: utility name, date, and a statement that the utility has completed, reviewed, or revised the assessment. The USEPA has developed an optional certification template which will be available in August 2019. The risk assessment and ERP may be self-certified by the utility. Certifications maybe submitted by regular mail, email, or an online portal. The online submission portal will provide drinking water systems with a receipt of submittal. The online portal is the favored and recommended method. All certification systems will be available in August 2019. The AWIA 2018 also states that no local, state, or regional government entities must receive copies of this certification.

Regardless, water systems serving greater than 100,000 people must submit the risk assessment by 31 March 2020; water systems serving between 50,000 and 99,999 by 31 December 2020; water systems serving between 3,301 and 49,999 by 30 June 2021.

Similarly, the utility must certify to the USEPA that it has reviewed and, if necessary, revised its ERP. The ERP is required no later than 6 months after the risk assessment. This means that a water utility serving greater than 100,000 people is required to have developed an updated ERP by 30 September 2020, a system serving between 50,000 and 99,999 is required by 30 June 2021, and a system serving 3,301 to 49,999 is required by 30 December 2021.

The ERPs are required to include:

  1. Strategies and resources to improve the resilience of the system, including the physical and cybersecurity of the system
  2. Plans and procedures that can be implemented and identification of equipment that can be utilized in the event of a malevolent or natural hazard that threatens the ability of the community water system to provide safe drinking water
  3. Actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers
  4. Strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system

The AWIA 2018 does not require the use of any standards, methods, or tools for the risk and resilience assessment or emergency response plan. AWIA 2018 only requires utilities to ensure that all criteria in AWIA Section 2013(a) and (b) are met. The USEPA however, recommends the use of AWWAJ100-10 Risk and Resilience Management of Water and Wastewater System. The USEPA also provides some tools to facilitate sound risk and resilience assessments and ERPs.

Disposition of Bioterrorism Act Assessments

Title IV of the Bioterrorism Act of 2002 required submittal of a written copy of the risk assessment and ERP to be forwarded to the USEPA. The USEPA intends to destroy these records however, under AWIA 2018 section 2013(B)(2) utilities may request their assessments and plans in lieu of destruction by emailing on their utility letterhead then in the request include the utility name, address, point of contact, and public water system identification before the date by which the water system is required to certify a risk and resilience assessment to the USEPA under section 1433(A) of the SDWA as amended by section 2013 of the AWIA 2018.

Further Resources

The USEPA Water Security Division can be reached for more help at

In April 2019, The USEPA Office of Water published a factsheet about the AWIA EPA-817-F-19-004 to help answer some questions about the AWIA requirements. This is available here.

The USEPA is offering in person training on these topics which you can register for here.

Other information on water system resilience is available here.

Finally, Nushat Dyson was listed as a point of contact and can be reached at or (202) 564-4674.