Transcription
Security Vulnerability SelfAssessment Guide for WaterSystemsRural CommunityAssistance Corporationwww.rcac.org1MidwestAssistanceProgram COMMUNITYRESOURCE GROUPINCORPORATEDSoutheast RuralCommunity AssistanceProject, Inc.,. 1mWater Is Life Produced for the Rural Community Assistance Partnership (RCAP) National Networkby Rural Community Assistance Corporation, Western RCAPRCAP Safety and Security Education Program
Security Vulnerability SelfAssessment Guide for WaterSystemsRCAP Regional Offices:If you need technical assistance to complete your Security Vulnerability Assessment,please contact one of our regional offices listed below.MidwestRCAPWesternRCAPNortheast RCAPGreat LakesRCAPRCAP National OfficeSoutheast RCAPSouthernRCAPRegional OfficesRCAP National OfficeWestern RCAPSoutheast RCAPGreat Lakes RCAPSouthern RCAPNortheast RCAPMidwest RCAPContact 9767479/443-2700800/488-1969952/758-4334Web w.map-inc.orgThis material is based upon work supported in part under a grant by the Rural Utilities Service, United StatesDepartment of Agriculture. Any opinions, findings, and conclusions or recommendations expressed in this materialare solely the responsibility of the authors and do not necessarily represent the official views of the Rural UtilitiesService. Additional funding provided by U.S. Department of Health and Human Services and revised by RCAC(August 2005) based on materials developed by the Washington State Department of Health, Training andOutreach Section, Division of Drinking Water.For additional copies of this publication, call 888/321-7227or visit RCAP’s web site at www.rcap.org.This publication is being distributed under the auspices of Rural Community Assistance Partnership.
ContentsSecurity Vulnerability Self-Assessment Guide for Water Systems . 2INTRODUCTION . 2HOW TO USE THIS SELF-ASSESSMENT GUIDE . 2KEEP THIS DOCUMENT . 2ACKNOWLEDGMENTS . 2INVENTORY OF SMALL W ATER SYSTEM CRITICAL COMPONENTS . 3Attachment 1. Prioritization of Needed Actions.18Attachment 2: Threat Identification Checklists.19WATER SYSTEM TELEPHONE THREAT IDENTIFICATION CHECKLIST.19WATER SYSTEM REPORT OF SUSPICIOUS ACTIVITY .21Attachment 3: Certificate of Completion .23Security Vulnerability Self-Assessment Guide for Water SystemsPage 1
Security Vulnerability SelfAssessment Guide for WaterSystemsIntroductionThis Security Vulnerability Self-Assessment Guide is designed to help small water systems determinepossible vulnerable components and identify security measures that should be considered. A“vulnerability assessment” is the identification of weaknesses in water system security, focusing ondefined threats that could compromise its ability to provide adequate potable water, and/or water forfirefighting. This document is designed particularly for systems that serve populations of 3,300 or fewer.The Self-Assessment Guide has a simple design. Answers to assessment questions are “yes” or “no.” Forany “no” answer, refer to the “comment” column and/or contact your drinking water primacy agency. Thencomplete the “Prioritization of Needed Actions” form (see Attachment 1) to identify and prioritize neededactions based on your assessment.How to Use this Self-Assessment GuideThis document is designed for use by water system personnel. Physical facilities pose a high degree ofexposure to any security threat. This self-assessment should be conducted on all components of yoursystem (wellhead or surface water intake, treatment plant, storage tank(s), pumps, distribution system,and other important components of your system).You can obtain an Emergency Response Plan manual and template from Rural Community AssistancePartnership, Inc. (RCAP) at: 888/321-7227 or on line at http://www.rcap.org.Security is everyone’s responsibility. We hope this document helps you to increase the awareness of allyour employees, governing officials, and customers about security issues.Once you have completed this document, review the actions you need to take to improve your system’ssecurity. Make sure to prioritize your actions based on the most likely threats and their potential impact.The Requirement for a Security Vulnerability AssessmentThe United States Department of Agriculture, Rural Development (USDA/RD) is requiring that all systemsthat receive USDA/RD funding must complete a Security Vulnerability Assessment (SVA) and EmergencyResponse Plan (ERP). In addition to the USDA/RD requirements, the preparation of a SVA and ERP willhelp improve the management of the water system and increases the ability of the system to respond toemergencies.Keep this DocumentThis is a working document. Its purpose is to start your process of security vulnerability assessment andsecurity enhancements. Security is not an end point, but a goal that can be achieved only throughcontinued efforts to assess and upgrade your system.Don’t forget that this is a sensitive document. It should be stored separately in a secure place at yourwater system. A duplicate copy should also be retained at a secure off-site location.Access to this document should be limited to key water system personnel and local officials as well as thedrinking water primacy agency and others on a need-to-know basis.AcknowledgmentsRevised by RCAC, this guide is based on materials developed by the result of collaboration among theAssociation of State Drinking Water Administrators (ASDWA), the U.S. Environmental Protection Agency(U.S. EPA), the U.S. EPA Drinking Water Academy, and the National Rural Water Association (NRWA).Security Vulnerability Self-Assessment Guide for Water SystemsPage 2
Inventory of Water System Critical ComponentsComponentSource Water TypeGround WaterSurface WaterGround Water Under DirectInfluence of Surface WaterMixed Ground and SurfaceWaterPurchasedTreatment PlantBuildingsPumpsTreatment Equipment (e.g.,basin, clearwell, filter)Number & Location (if applicable)DescriptionProcess ControlsTreatment Chemicals andStorageLaboratory Chemicals andStorageStorageStorage TanksPressure TanksPowerPrimary PowerAuxiliary PowerDistribution SystemPumpsPipesValvesAppurtenances (e.g., flushhydrants, backflow preventers,meters)Other Vulnerable /Work VehiclesCommunicationsTelephoneCell PhoneRadioComputer Control Systems(SCADA)Security Vulnerability Self-Assessment Guide for Water SystemsPage 3
Security Vulnerability Self-Assessment for WaterSystemsGeneral Questions for the Entire Water SystemThe first 13 questions in this vulnerability self-assessment are general questions designed to apply to allcomponents of your system (wellhead or surface water intake, treatment plant, storage tank(s), pumps,distribution system, and offices). These are followed by more specific questions that look at individual systemcomponents in greater detail.QUESTIONANSWERCOMMENT1. Do you have a written emergency responseplan (ERP)?YesN/A No It is essential that you have an ERP. If you do nothave an ERP, you can obtain a sample from RCAPor your drinking water primacy agency.As a first step in developing your ERP, you shoulddevelop your Emergency Contact List. A plan is vitalin case there is an incident that requires immediateresponse. Your plan should be reviewed at leastannually (or more frequently if necessary) to ensureit is up-to-date and addresses security emergencies.Insert Comments Here2. Is access to the critical components of thewater system (i.e., a part of the physicalinfrastructure of the system that is essentialfor water flow and/or water quality)restricted to authorized personnel only?YesN/A No You should restrict or limit access to the criticalcomponents of your water system to authorizedpersonnel only. This is the first step in securityenhancement for your water system. Consider thefollowing: Issue water system photo identification cards foremployees, and require them to be displayed withinthe restricted area at all times. Post signs restricting entry to authorized personneland ensure that assigned staff will escort peoplewithout proper ID.Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 4
QUESTIONANSWER3. Are facilities fenced, including well housesand pump pits, and are gates locked whereappropriate?YesN/A No COMMENTIdeally, all facilities should have a security fencearound the perimeter.The fence perimeter should be walked periodically tocheck for breaches and maintenance needs. Allgates should be locked with chains and a tamperproof padlock that at a minimum protects the shank.Other barriers such as concrete "jersey" barriersshould be considered to guard certain criticalcomponents from accidental or intentional vehicleintrusion.Insert Comments Here4. Are your doors, windows, and other pointsof entry such as tank and roof hatches andvents kept closed and locked?YesN/A No Lock all building doors and windows, hatches andvents, gates, and other points of entry to preventaccess by unauthorized personnel. Check locksregularly. Dead bolt locks and lock guards provide ahigh level of security for the cost.A daily check of critical system componentsenhances security and ensures that an unauthorizedentry has not taken place.Doors and hinges to critical facilities should beconstructed of heavy-duty reinforced material.Hinges on all outside doors should be located on theinside.To limit access to water systems, all windows shouldbe locked and reinforced with wire mesh or ironbars, and bolted on the inside or install alarms.Systems should ensure that this type of securitymeets with the requirements of any fire codes.Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 5
QUESTIONANSWER5. Is there external lighting around the criticalcomponents of your water system?YesN/A No COMMENTAdequate lighting of the exterior of water systems’critical components is a good deterrent tounauthorized access and may result in the detectionor deterrence of trespassers. Motion detectors thatactivate switches that turn lights on or trigger alarmsalso enhance security.Insert Comments Here6. Are warning signs (tampering, unauthorizedaccess, etc.) posted on all criticalcomponents of your water system? (Forexample, well houses and storage tanks.)YesN/A No Warning signs are an effective means to deterunauthorized access.“Warning - Tampering with this facility is a federaloffense” should be posted on all water facilities.These are available from your state Rural WaterAssociation.“Authorized Personnel Only,” “Unauthorized AccessProhibited,” and “Employees Only” are examples ofother signs that may be useful.Insert Comments Here7. Do you patrol and inspect your sourceintake, buildings, storage tanks, equipment,and other critical components?Yes NoN/A Frequent and random patrolling of the water systemby utility staff and local law enforcement agency maydiscourage potential tampering. It may also helpidentify problems that may have arisen since theprevious patrol.Insert Comments Here8. Is the area around the critical componentsof your water system free of objects thatmay be used for breaking and entering?Yes NoN/A When assessing the area around your watersystem’s critical components, look for objects thatcould be used to gain entry (e.g., large rocks,cement blocks, pieces of wood, ladders, valve keys,and other tools).Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 6
QUESTIONANSWER9. Are the entry points to your water systemeasily seen?YesN/A No COMMENTTrim or avoid landscaping that will block your view orpermit trespassers to hide, conduct unnoticedsuspicious activities, or allow easy access to yoursystem’s critical componentsIf possible, park vehicles and equipment in placeswhere they do not block the view of your watersystem’s critical components.Insert Comments Here10. Do you have an alarm system that willdetect unauthorized entry or attemptedentry at critical components?YesN/A No Consider installing an alarm system that notifies theproper authorities or your water system’s designatedcontact for emergencies when there has been abreach of security.You should also have an audible alarm at the site asa deterrent and to notify neighbors of a potentialthreat.Insert Comments Here11. Do you have a key control andaccountability policy?YesN/A No Keep a record of locks and associated keys, and towhom the keys have been assigned. This record willfacilitate lock replacement and key management(e.g., after employee turnover or loss of keys).Vehicle and building keys should be kept in alockbox when not in use.You should have all keys stamped (engraved) “DONOT DUPLICATE.”Insert Comments Here12. Are entry codes and keys limited to watersystem personnel only?Yes NoN/A Suppliers and personnel from co-locatedorganizations should be denied access to codesand/or keys. Codes should be changed frequently ifpossible. Entry into any building should always beunder the direct control of water system personnel.Insert Comments Here13. Do you have a neighborhood watchprogram for your water system?YesN/A No Watchful neighbors can be very helpful to a securityprogram. Make sure they know who to call in theevent of an emergency or suspicious activity.Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 7
Water SourcesIn addition to the above general checklist for your entire water system (questions 1-13), you should give specialattention to the following issues, presented in separate tables, related to various water system components.Your water sources (surface water intakes or wells) should be secured. Surface water supplies present thegreatest challenge. Typically they encompass large land areas. Where areas cannot be secured, steps shouldbe taken to initiate or increase law enforcement patrols. Pay particular attention to surface water intakes. Askthe public to be vigilant and report suspicious activity.QUESTIONANSWERCOMMENT14. Are your wellheads sealed properly?Yes No N/A A properly sealed wellhead decreases theopportunity for the introduction of contaminants. Ifyou are not sure whether your wellhead is properlysealed, contact your well drilling/maintenancecompany, your drinking water primacy agency, orother technical assistance providers.Insert Comments Here15. Are well vents and caps screened andsecurely attached?YesN/A No Properly installed vents and caps can help preventthe introduction of a contaminant into the watersupply.Ensure that vents and caps serve their purpose, andcannot be easily breached or removed.Insert Comments Here16. Are observation/test and abandoned wellsproperly secured to prevent tampering?YesN/A No All observation/test and abandoned wells should beproperly capped or secured to prevent theintroduction of contaminants into the aquifer or watersupply. Abandoned wells should be destroyedaccording to state regulations.Insert Comments Here17. Is your surface water source secured withfences or gates? Do water systempersonnel visit the source?YesN/A No Surface water supplies present the greatestchallenge to secure. Often, they encompass largeland areas. Where areas cannot be secured, stepsshould be taken to initiate or increase patrols bywater utility personnel and law enforcement agents.Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 8
Treatment Plant and SuppliersSome small systems provide easy access to their water system for suppliers of equipment, chemicals, andother materials for the convenience of both parties. This practice should be discontinued.QUESTIONANSWER18. Are deliveries of chemicals and othersupplies made in the presence of watersystem personnel?YesN/A No COMMENTEstablish a policy that an authorized person,designated by the water system, must accompanyall deliveries. Verify the credentials of all drivers.This prevents unauthorized personnel from havingaccess to the water system.Insert Comments Here19. Have you discussed with your supplier(s)procedures to ensure the security of theirproducts?YesN/A No Verify that your suppliers take precautions to ensurethat their products are not contaminated. Chain ofcustody procedures for delivery of chemicals shouldbe reviewed. You should inspect chemicals andother supplies at the time of delivery to verify theyare sealed and in unopened containers. Match alldelivered goods with purchase orders to ensure thatthey were, in fact, ordered by your water system.You should keep a log or journal of deliveries. Itshould include the driver’s name (taken from thedriver’s photo I.D.), date, time, material delivered,and the supplier’s name.Insert Comments Here20. Are chemicals, particularly those that arepotentially hazardous or flammable,properly stored in a secure area?YesN/A No All chemicals should be stored in an areadesignated for their storage only, and the areashould be secure and access to the area restricted.Access to chemical storage should be available onlyto authorized employees.You should have tools and equipment on site (suchas a fire extinguisher, drysweep, etc.) to takeimmediate actions when responding to anemergency.Insert Comments HereSecurity Vulnerability Self-Assessment Guide for Water SystemsPage 9
QUESTION21. Do you monitor raw and treated water sothat you can detect changes in waterquality?ANSWERYesN/A No COMMENTMonitoring of raw and treated water can establish abaseline that may allow you to know if there hasbeen a contamination incident.Some parameters for raw water include pH, turbidity,total and fecal coliform, total organic carbon, specificconductivity, ultraviolet adsorption, color, and odor.Routine parameters for finished water anddistribution systems include free and total chlorineresidual, heterotrophic plate count (HPC), total andfecal coliform, pH, specific conductivity, color, taste,odor, and system pressure.Insert Comments Here22. Are tank ladders, access hatches, and entrypoints secured?YesN/A No The use of tamper-proof padlocks at entry points(hatches, vents, and ladder enclosures) will reducethe potential for unauthorized entry.If you have towers, consider putting physical barrierson the legs to prevent unauthorized climbing.Insert Comments Here23. Are vents and overflow pipes properlyprotected with screens and/or grates?YesN/A No Air vents and overflow pipes are direct conduits tothe finished water in storage facilities. Secure allvents and overflow pipes with heavy-duty screensand/or grates.Insert Comments Here24. Can you isolate the storage tank from therest of the system?YesN/A No A water system should be able to take its storagetank(s) out of operation or drain its storage tank(s) ifthere is a contamination problem or structuraldamage.Install shut-off or bypass valves to allow you toisolate the storage tank in the case of acontamination problem or structural damage.Consider installing a sampling tap on the storagetank outlet to test water in the tank for possibleco
Security Vulnerability Self-Assessment for Water Systems General Questions for the Entire Water System The first 13 questions in this vulnerability self-assessment are general questions designed to apply to all components of your system (wellhead or surface water intake, treatment plant, s
