Water and wastewater utilities are designated critical infrastructure, and their physical security problem is unusual: dozens of unstaffed remote sites spread across a service area, each protecting a public health function, most of them a long drive from anyone who would respond.
Wittner Security Consultants assesses and designs physical security for treatment plants, pump stations, wells, tanks, reservoirs, and control facilities across Northern California, independently and across a whole district rather than one site at a time.
Across a multi-site utility, the highest-value work is usually consistency and prioritization rather than gold-plating one flagship plant:
Under America's Water Infrastructure Act, community water systems are required to conduct Risk and Resilience Assessments and maintain Emergency Response Plans on a recurring cycle. Much of that work is engineering and operations, but a meaningful slice is physical: site hardening, access control, monitoring, and the physical protection of critical assets.
This is your obligation as a utility, not ours, and the field is largely occupied by large engineering firms. Our role is narrower and independent: the physical security portion, assessed and specified by someone with no system to sell you. We do not certify or guarantee your AWIA compliance, and no honest consultant would.
Paul's four decades in the field include work with California Water Service. That kind of first-hand exposure to how these environments actually operate is what separates advice grounded in the field from advice grounded in a brochure.
Yes, and for a multi-site utility that is the point. A system-wide assessment ranks your sites by consequence and exposure so capital goes where the risk actually is, and it establishes one hardening and monitoring standard instead of letting each site drift. Individual high-consequence sites can still get deeper attention within that framework.
The design assumes nobody is present, so it leans on delay and detection that hold up until a response can arrive: site hardening, intrusion detection sized for the environment, verified alarm assessment to cut false dispatches, and access control that survives without a guard. The right mix depends on the site's consequence and how far away help is.
We handle the physical security portion of that work: site hardening, access, monitoring, and protection of critical physical assets. The full AWIA obligation is broader and often led by engineering firms, and the compliance determination is yours and your counsel's. We provide the independent physical security piece and do not certify compliance.
Tell Paul about the site and what prompted the call. He will tell you honestly what the work involves and whether he is the right person for it.