42 U.S.C. § 300i–2 — Community water system risk and resilience

(a) Risk and resilience assessments. (1) Each community water system serving more than 3,300 people must assess the risks to, and resilience of, its system. This assessment (A) must cover the risk from malevolent acts and natural hazards; the resilience of pipes, physical barriers, source water, collection and intake, pretreatment, treatment, storage, and distribution facilities, and any electronic or automated systems (including their security); the system's monitoring practices; its financial infrastructure; its use, storage, or handling of chemicals; and its operation and maintenance; and (B) may also evaluate what capital and operating investments the system needs for risk and resilience management. (2) Baseline information. By August 1, 2019, after consulting federal, state, and local governments, the Administrator had to give systems baseline information on malevolent acts relevant to them — including acts that might (A) badly disrupt the system's ability to reliably supply safe drinking water, or (B) otherwise create serious public health or economic problems for the community it serves. (3)(A) Certification. Each covered system must certify to the Administrator that it completed its assessment, by (i) March 31, 2020, for systems serving 100,000 or more people; (ii) December 31, 2020, for systems serving 50,000 to just under 100,000; and (iii) June 30, 2021, for systems serving more than 3,300 but fewer than 50,000. (B) Review and revision. Each covered system must review its assessment at least once every 5 years after its certification deadline, to see if it needs updating, and must then certify to the Administrator that it reviewed (and, if needed, revised) the assessment. (4) Contents of certifications. A certification may only contain (A) information identifying the system, (B) the certification date, and (C) a statement that the system conducted, reviewed, or revised its assessment, as applicable. (5) No forced disclosure to other entities. No state or local law can require a system to give its assessment (or a revision) to any state, regional, or local government just because federal law requires the system to certify to the Administrator. (b) Emergency response plan. Each system serving more than 3,300 people must prepare or update, as needed, an emergency response plan built on its subsection (a) assessment. Each system must certify to the Administrator, as soon as reasonably possible after October 23, 2018, but no later than 6 months after finishing its assessment, that the plan is done. The plan must include (1) strategies and resources to improve the system's resilience, including physical security and cybersecurity; (2) plans, procedures, and equipment for responding to a malevolent act or natural hazard that threatens safe drinking water delivery; (3) actions, procedures, and equipment to prevent or significantly reduce harm to public health, safety, and water supply from such threats — including alternative source water, relocating intakes, and building flood barriers; and (4) strategies to help detect malevolent acts or natural hazards that threaten the system's security or resilience. (c) Coordination. Systems must, where possible, coordinate with local emergency planning committees set up under the Emergency Planning and Community Right-to-Know Act of 1986 when preparing or updating their assessment or plan. (d) Record maintenance. Each system must keep a copy of its assessment and its emergency response plan (and any revisions) for 5 years after certifying them to the Administrator. (e) Guidance to small systems. The Administrator must give systems serving fewer than 3,300 people guidance and technical help on conducting resilience assessments, preparing emergency plans, and addressing threats from malevolent acts and natural hazards. (f) Alternative programs. (1) A system can satisfy subsections (a) and (b) instead by (A) following technical standards the Administrator has recognized under paragraph (2), and (B) certifying to the Administrator that it's complying with those standards. (2) The Administrator, consistent with the National Technology Transfer and Advancement Act, must recognize technical standards developed by third-party or voluntary consensus standards bodies that achieve this section's goals. (g) Technical assistance and grants. (1) The Administrator must run the "Drinking Water Infrastructure Risk and Resilience Program," awarding grants in fiscal years 2020 and 2021 to community water system owners or operators to boost resilience. (2) Grant recipients must use the money exclusively for planning, designing, building, or carrying out a program or project consistent with their emergency response plan, which may include (A) detection equipment for contaminants or malevolent acts, (B) fencing, gates, lighting, or security cameras, (C) tamper-proofing manhole covers, hydrants, and valve boxes, (D) better treatment technology, (E) improvements to electronic, computer, financial, or remote systems, (F) training programs and materials on security and resilience, (G) improved chemical handling, (H) security screening for employees or contractors, (I) backup power or water supply equipment, and (J) alternative source water, relocated intakes, and flood barriers. (3) Grant money cannot pay for personnel costs, or for monitoring, operating, or maintaining facilities, equipment, or systems. (4) Technical assistance. Each year, the Administrator may spend up to $5,000,000 to help systems respond to urgent vulnerabilities that could badly disrupt safe drinking water supply. (5) Grants for small systems. Each year, the Administrator may spend up to $10,000,000 on grants to systems serving fewer than 3,300 people, or nonprofits assisted under section 300j–1(e), for activities consistent with the subsection (e) guidance. (6) Authorization of appropriations. Congress may spend $25,000,000 for each of fiscal years 2020 and 2021 for this subsection. (h) Definitions. In this section, (1) "resilience" means a system's or asset's ability to adapt to or withstand a malevolent act or natural hazard without its function stopping — or, if it does stop, to get back to normal quickly; and (2) "natural hazard" means a natural event that threatens a system's function, such as an earthquake, tornado, flood, hurricane, wildfire, or hydrologic change.