Vulnerability Assessments & Emergency Response Plans

Do you know what to do in an emergency at the water plant?

What are your system’s weaknesses? Do you have an alternate supply of drinking water? Who do you notify first in an emergency?

Ensuring the safety of the public’s water supply is our top priority. With increased vigilance, we can minimize the risk of terrorist acts against our clients’ water systems, and ensure that our citizens continue to receive safe drinking water.

Mandated Vulnerability Assessments.

On June 12, 2002, the federal government passed the Public Health Security and Bioterrorism and Response Act (H.R. 3448). The Act requires that all community public water systems serving 3,300 people or more conduct a vulnerability assessment and prepare or revise, where necessary, an emergency response plan that incorporates the results of the vulnerability assessment. The U.S. Environmental Protection Agency (EPA) requires these water systems to conduct and submit a security assessment. Completion deadlines are based on the population served, and are listed below. Within 6 months of submitting a vulnerability assessment, the water system must certify with the EPA that they have updated their Emergency Response Plan.

Vulnerability Assessment and Emergency Response Plan (ERP) Schedule

Population Served Assessment Deadline ERP Deadline
100,000+ March 31, 2003 September 30, 2003
50,000-99,999 December 31, 2003 June 30, 2004
3,300-49,999 June 30, 2004 December 31, 2004

* Final date. Emergency Response Plans must be certified as completed within 6 months of submitting the vulnerability assessment.

Community Water Systems serving populations more than 3,300 must do the following to comply with the Bioterrorism Act:

  • Conduct a vulnerability assessment.
  • Certify to EPA that community water system conducted a VA.
  • Submit a copy of the vulnerability assessment to the EPA.
  • Certify to EPA that the community water system has completed an Emergency Response Plan.

Six Critical Elements of a Vulnerability Assessment

  • Characterization of the water system, including its mission and objectives.
  • Identification and prioritization of adverse consequences to avoid.
  • Determination of malevolent acts that could result in undesired consequences.
  • Assessment of the likelihood (qualitative probability) of such malevolent acts.
  • Evaluation of existing countermeasures.
  • Development of prioritized plan for upgrades to lower risk.

What EPA will be checking for…

  • All community water systems serving 3,300 or more submit a VA.
  • The methodology used in your vulnerability assessment covers the 6 critical elements listed above.
  • Vulnerability Assessments contain components listed in the Bioterrorism Act (PL107-188):
    • Pipes and constructed conveyances
    • Physical barriers
    • Collection, pretreatment, treatment, storage and distribution facilities
    • Electronic or computer systems
    • Use, storage, and handling of chemicals.

Water systems serving fewer than 3,300 people.

A vulnerability assessment is an integral part of a good emergency plan. Although not mandated by H.R. 3448, the Division of Water Supply strongly encourages small water systems serving populations under 3,300 to complete a vulnerability assessment.

Completing a vulnerability assessment will enhance the security of the water system and identify areas of potential improvements. Security Vulnerability Self-Assessments for Small Drinking Water Systems are also available through Kimmons.


Our firm is uniquely qualified to conduct Vulnerability Assessment and Emergency Response Plans for the water industry. Our assessment teams consist of security experts, law enforcement officials, and experts from the water industry. The security experience of our staff is what separates our firm from other assessment firms. Decades of law enforcement experience and physical security experience provides unique and valuable insight to security vulnerabilities and requirements.