What the law requires

America’s Water Infrastructure Act of 2018 (AWIA) Section 2013 amended Safe Drinking Water Act (SDWA) Section 1433. Community drinking water systems serving more than 3,300 people must:

1. Prepare or revise a Risk and Resilience Assessment (RRA) and certify completion to EPA.
2. No later than six months after that RRA certification, prepare or revise an Emergency Response Plan (ERP) that incorporates the RRA findings, and certify the ERP to EPA.
3. Every five years, review the RRA (and ERP), revise where applicable, and re-certify to EPA. That is the cycle underway in 2025–2026.

Certify for each PWSID. Submit certification statements only (not the full RRA/ERP documents). Keep your plans in a secure location at the system (EPA recommends at least five years). Electronic certification is preferred so EPA can acknowledge receipt.

Systems serving 3,300 or fewer people, non-community systems, and wastewater systems are not required to certify to EPA. ARWA still encourages strong risk planning, and Circuit Riders can help voluntarily.

Official EPA overview: AWIA Section 2013 / SDWA 1433.

Certification deadlines (five-year cycle)

If your system met the original statutory deadlines, the next five-year submission cycle is:

*ERP certifications are due six months from the date of your RRA certification. Table dates assume the system certified the RRA on the final due date. If you certified the RRA earlier, your ERP date moves earlier with it. If you are past a deadline, complete the review and certify as soon as possible; do not wait for the next five-year cycle.

EPA deadline details · How to certify (portal, email, or mail)

What must be in the RRA and ERP

EPA does not require a specific software product. Your documents must meet the statutory elements. In plain terms:

Risk and Resilience Assessment (RRA)

• Risks from malevolent acts and natural hazards
• Resilience of pipes and constructed conveyances, source water, water collection and intake, pretreatment, treatment, storage and distribution, and electronic, computer, or other automated systems (including the physical security and cybersecurity of those systems)
• Monitoring practices
• Financial infrastructure
• Use, storage, or handling of chemicals
• Operation and maintenance
• Evaluation of capital and operational needs for risk and resilience, including for physical security and cybersecurity

Emergency Response Plan (ERP)

• Strategies and resources to improve resilience, including physical security and cybersecurity
• Plans and procedures that can be implemented, and equipment that can be used, in an emergency
• Actions to ensure the system’s functions and the provision of water as soon as possible after a natural hazard or malevolent act
• How the system will coordinate with local emergency planning committees and other responders

The ERP must incorporate findings of the RRA.

EPA tools and resources

• Small System Risk and Resilience Assessment Checklist (recommended for many systems under 50,000)
• Emergency Response Plan Template and Guidance
• Vulnerability Self-Assessment Tool (VSAT) and related risk assessment resources
• Baseline Information on Malevolent Acts for Community Water Systems
• Certification process and statement forms

How ARWA can help

1. Do it yourself with EPA tools. Use the checklist, ERP template, and EPA certification portal linked above.
2. Free Circuit Rider assistance. Your ARWA Circuit Rider can help you work through the RRA review, ERP update, and certification steps at no charge to the utility. Find your Circuit Rider.
3. Associate members (paid, optional). Some firms offer software or full turn-key products that go beyond the minimum. That is a business decision for your system; ARWA can help you think through options. Circuit Riders remain available either way.

Contact your Circuit Rider or the ARWA office at arwa@alruralwater.com or (334) 396-5511.

Optional associate resources

The following have worked with Alabama systems on AWIA-related products. Confirm current offerings and pricing directly with the vendor:

• SEMS Technologies: semstechnologies.com (software-oriented compliance tools)
• Squad Consulting Associates (turn-key style assistance). Flyer: Small Systems AWIA Compliance Assistance (PDF)

Related ARWA pages

• Circuit Rider Program
• Utility Security, Cybersecurity & Readiness
• Cybersecurity (WaterISAC / NRWA / CISA)

Source of truth for deadlines and certification: epa.gov/waterresilience/awia-section-2013 (page last reviewed against EPA materials July 2026). This page is for member assistance and is not legal advice.