Security Assessment of Public Water Supplies - EH: Minnesota Department of Health

Security Assessment of Public Water Supplies

While an attack by foreign terrorists may be unlikely, homegrown terrorists and ordinary vandals are a threat to the safety of drinking water. A recent cyberattack on a public water supply (PWS) reminds us to continue to be watchful and secure our water systems. The U.S. Environmental Protection Agency requires PWSs serving at least 3,300 people to conduct security assessments. MDH provides security evaluation assistance to all PWS during regularly scheduled inspections. Various organizations offer security self-assessment tools, including the National Rural Water Association. All systems should regularly review and/or consider any action items as additional protections and barriers:

Water Tower: photo courtesy of EPA

Coordination

  • Ask your local law enforcement staff and public works/utility director to review your security measures.
  • Ask your local emergency manager to review your response plans. Develop mutual aid agreements with neighboring communities for emergency water supplies.
  • Train personnel in security awareness. Post the response actions for reporting threats or acts of terrorism. Call 911 or the local sheriff if suspicious activities occur.
  • Plan for public notification.
  • Practice response plans on a regular schedule.
  • Develop local capacity to communicate with local health care facilities. The Health Alert Network (HAN) is in use by most emergency health professionals.

Go to > top.

Access to Facilities

  • Restrict access with physical barriers to reservoirs, treatment system vents, and intakes. Prohibit parking or stopping on roadways near facilities. Fix all broken barriers, security fences, hatches, and manholes
    immediately.
  • Lock all facilities. Do not leave keys in equipment.
  • Evaluate the reliability and security status of current and former employees. Post “Employee Only” signs at entrances to restricted areas. Tell employees to question any strangers in restricted areas.
  • Store chemicals in secure facilities. Require chemical suppliers to provide their personnel with photo-identification. Use only reliable and known suppliers and contractors. Only accept deliveries of intact containers of chemicals that have been ordered.
  • Install security lighting, motion detectors, and surveillance cameras.

Go to > top.

Access to Documents

  • Store all documents in a secure facility with limited access.
  • Limit access to water distribution maps and plans of facilities.
  • Require contractors and consultants to maintain security to their copies of maps and plans.

Go to > top.

Cybersecurity and Access to Computer Systems

  • Obtain technology security such as firewalls, anti-virus software, and intrusion detection software to protect computer systems.
  • Limit computer access to personnel who need to know. Utilize strong password protection.
  • Eliminate exposure to external networks and secure remote access. Develop and enforce mobile device policies.
  • Keep all computers software and applications up to date. Implement an update management cycle.
  • Develop a cybersecurity response plan.
  • Employee training related to cybersecurity.
  • See the 10 Basic Cybersecurity Measures (PDF).
  • Join the Information Sharing and Analysis Center (ISAC). This organization provides infrastructure owner and operators tools and information to protect their facilities from physical and cyber threats.

Go to > top.

Monitoring

  • Develop and follow a water quality monitoring program.
  • Check and record chemical usage daily.
  • Keep good records to help identify water quality issues and unusual events.
  • Ask your local law enforcement officials to routinely patrol facilities and to strictly enforce parking restrictions.
  • Check all facilities daily.

Go to > top.

Water Disinfection

  • Maintain a free chlorine residual of at least 0.2 parts per million at the ends of the distribution system. If you do not currently disinfect your system, consider adding a disinfectant.
  • Check chemical quality on a regular basis.
  • Larger systems should consider installation of chlorine residual recorders that will send an electronic alarm if the chlorine residual drops.

Go to > top.

For more information

Go to > top.

Updated Friday, 05-Mar-2021 16:10:58 CST