Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesUnder federal law, a community water system (CWS) serving 3,301 or more people must assess cybersecurity risks, include cyber incident planning in its emergency response plan (ERP), and certify both documents to the U.S. Environmental Protection Agency (EPA). A CWS serving fewer than 3,301 people is not required to certify a risk and resilience assessment (RRA) or ERP under this law, though EPA encourages voluntary planning. Whether a system is covered depends on its type and population—not simply on whether it is small or uses computers.
Which small water utilities are covered?
The federal requirements come from section 1433 of the Safe Drinking Water Act, as amended by section 2013 of America’s Water Infrastructure Act (AWIA) in 2018. They apply to community water systems serving more than 3,300 people: the first covered count is 3,301. EPA explains the scope on its AWIA Section 2013 / SDWA Section 1433 page.
As an Amazon Associate I earn from qualifying purchases.
- CWS serving 3,301 or more: must complete and certify an RRA, prepare and certify an ERP, and meet related recordkeeping duties.
- CWS serving 3,300 or fewer: not required to certify an RRA or ERP to EPA under section 1433.
- Non-community water systems and wastewater systems: not subject to section 1433’s RRA and ERP certification duty.
These are federal requirements. State drinking-water primacy agencies may have additional requirements or instructions, so check with the relevant state agency as well as EPA.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What cybersecurity work must a covered utility do?
Assess cyber risk in the RRA
A covered system’s RRA must evaluate risks to and resilience of the water system, including its electronic, computer, and automated systems and their security. Cybersecurity is part of a broader assessment, not a separate substitute for it. The assessment also covers malevolent acts and natural hazards, infrastructure and facilities, monitoring practices, financial infrastructure, chemical use and handling, and system operations and maintenance.
#1 Best Overall
EPA does not mandate a particular assessment method, standard, or tool. Its guidance states that it does not require water systems to use designated standards, methods, or tools for RRAs or ERPs. The utility remains responsible for making sure its work addresses the statutory requirements.
Use the RRA to build the ERP
The ERP must incorporate the RRA’s findings. For cybersecurity, it needs strategies and resources for resilience; procedures and equipment for responding to threats; measures to reduce impacts on public health and the drinking-water supply; and ways to detect malevolent acts or natural hazards. EPA says the plan must address preparing for, responding to, and recovering from a cyber incident. See its cybersecurity planning guidance.
The ERP is an operational plan, not just a record that risks were identified. Staff should be able to use it to understand who does what, how the utility will communicate and respond, and how it will restore service and recover after an incident.
When are the assessment and plan due?
EPA describes a five-year cycle for RRAs and ERPs. The ERP is due no later than six months after the RRA is certified. For systems serving 3,301–49,999 people, EPA’s deadline table lists June 30, 2026, as the next-cycle RRA certification deadline, with December 31, 2026, as the corresponding ERP deadline if the RRA was certified on the final day. The RRA date has passed; a utility should check its own submission history and current EPA certification status rather than infer compliance from the general deadline. The deadlines and cycle details are in EPA’s section 1433 deadline table.
Rank #2
- BUSINESS CYBERSECURITY SOLUTION: SafeBiz is an advanced cybersecurity solution that protects your work network and safeguards your Business data and all internet connected devices in your business from cyber threats and hackers. SafeHome blocks phishing, malware, ransomware, online scams and dark web threats.
- ADVANCED THREAT PREVENTION: SafeBiz includes a Next-Gen Firewall, DNS Security, Web Filtering, Dark Web Protection, Geo-fencing and other AI Powered cybersecurity features protecting your Business and Sensitive Data from internet threats and hackers.
- BUSINESS DATA & IDENTITY SECURITY: Safeguards your Official and financial data, protecting them from online theft and unauthorized access.
- EASY SETUP: Connects effortlessly to any existing wireless router or internet connection, setting up in minutes without the need for any changes to your Business internet connection.
- HIGH SPEED CONNECTIVITY: Supports an aggregate throughput of up-to 4.3 Gbps, maintaining high-speed browsing and streaming performance for up to 128 devices.
Because the ERP deadline follows the actual RRA certification date, a utility should calculate its plan deadline from its own certification record. Do not assume the December 31 date applies if the assessment was certified earlier or later than the final listed deadline.
How do covered systems certify and keep records?
Certification is required for each individual Public Water System Identification Number (PWSID). EPA lists online portal, email, and regular mail as submission options. Keep copies of the RRA and ERP for five years after certifying the plan. EPA’s section 1433 guidance provides current certification details.
A practical compliance record should make it easy to confirm which PWSIDs were certified, when each certification occurred, which plan version was submitted, who owns the next review, and when records can be disposed of after the retention period. Those records help a utility track its own schedule; they do not replace the required assessment or plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which EPA resources can a utility use?
EPA offers free resources that can help systems with different staffing and technical capacity. They are options, not mandated vendors or required tools.
- Small System RRA Checklist: EPA recommends this checklist for smaller CWSs. The July 2024 version combines cyberattack categories and includes priority cybersecurity practices aligned with CISA’s Cross-Sector Cybersecurity Performance Goals. Find it on EPA’s AWIA guidance page.
- ERP template and instructions: EPA’s drinking-water template was updated in September 2024 with cybersecurity content and practical mitigation options. See Develop or Update an Emergency Response Plan.
- Water Sector Cybersecurity Evaluation Program: A free assessment conducted by a third-party contractor, listed among EPA’s cybersecurity planning resources.
- Water Cyber Assessment Tool: A self-guided option for evaluating cybersecurity, also listed on EPA’s cybersecurity planning page.
- Incident response materials: EPA links to a Cybersecurity Incident Action Checklist and a customizable incident response plan template on that same planning page.
When choosing an approach, compare how well it covers every RRA and ERP element, whether it addresses both information technology and operational technology, and whether staff can complete and maintain it. A self-guided checklist may suit a utility with limited capacity; a third-party assessment may offer additional help. Whichever approach is chosen, the utility is responsible for completeness and certification.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can a system below the threshold do voluntarily?
Not having a section 1433 certification duty does not mean a small system is immune to cyber incidents or other disruptions. EPA encourages voluntary planning and recommends cybersecurity risk assessment and mitigation planning for water and wastewater systems of every size. Its small-system checklist and August 2024 cybersecurity guidance provide starting points.
EPA’s primer for very small systems recommends baseline measures such as individual employee accounts, unique complex passwords, and multifactor authentication where possible. Practical continuity planning can also identify staff responsibilities, emergency contacts, backup power needs, staff training, and local mutual-aid networks. These are recommendations, not section 1433 certification requirements for systems below the threshold.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
