Community water systems serving more than 3,300 people must develop or update a risk and resilience assessment and an emergency response plan under section 2013 of America's Water Infrastructure Act, and certify both to EPA on a five-year cycle. The deadline depends on population served. Systems at or below 3,300 people do not certify.
What the law is
AWIA was signed on 23 October 2018. Section 2013 amended section 1433 of the Safe Drinking Water Act. The result is two documents per system: a risk and resilience assessment (RRA) and an emergency response plan (ERP). The system certifies to EPA that it completed each. It does not send the full documents.
Systems serving 3,300 or fewer people are not required to certify to EPA. EPA is to provide them with guidance and technical assistance.
The dates EPA lists
EPA's Region 8 page gives the following cycle, assuming the RRA is submitted on its final due date. The ERP is due six months after the RRA.
- 100,000 or more: RRA by 31 March 2025, ERP by 30 September 2025.
- 50,000 to 99,999: RRA by 31 December 2025, ERP by 30 June 2026.
- 3,301 to 49,999: RRA by 30 June 2026, ERP by 31 December 2026.
As of this review date, the largest two groups have passed their dates for this cycle, and the smallest group's ERP date is still ahead. Check EPA's current page before relying on this, because schedules can change.
What the RRA and ERP are for
The EPA page says the statute specifies the components of the assessment but does not list them on that page. Read the statute or EPA's fact sheet for the full list. The page also does not state whether cyber risk is covered, so do not assume a particular cyber checklist is built in. Confirm with EPA guidance.
A sensible reading: the RRA is where a utility asks what could go wrong, and the ERP is where it writes down what staff do when it does.
Practical tips for operators
- Put the next certification date in a shared calendar with a named owner.
- Keep the assessment as a living file. A five-year gap is long enough for control systems to change.
- Tie the ERP to a drill. A plan nobody has rehearsed tends to fail on the first call.
- Record software and remote access paths used by your SCADA vendor as inputs to the assessment.
Safeguard can help with the evidence side of any such program: compliance and evidence automation, plus asset discovery and SBOM scanning for software the utility runs. It does not replace the assessment itself.
Quick check
Does a 2,000 person system need to certify?
Per the EPA page, systems serving 3,300 or fewer are not required to certify to EPA, though EPA provides guidance and technical assistance.
Does a system send its full assessment to EPA?
The page describes certification. Check EPA instructions for exactly what is submitted.
Sources
Last reviewed: 19 October 2026.
