America's Water Infrastructure Act (AWIA) requires community water systems to conduct Risk and Resilience Assessments and maintain Emergency Response Plans on a recurring cycle. Much of that work is engineering and operations, but a defined portion is physical: hardening sites, controlling access, monitoring, and protecting critical physical assets.
This article covers that physical security portion for California water and wastewater utilities. It is general information, not legal advice, and Wittner Security Consultants does not certify or guarantee AWIA compliance.
AWIA, enacted in 2018, requires community water systems serving more than 3,300 people to conduct a Risk and Resilience Assessment (RRA), and to prepare or update an Emergency Response Plan (ERP) that incorporates the assessment's findings. Systems certify completion to the U.S. Environmental Protection Agency, and the requirement runs on a recurring cycle, so this is not a one-time exercise.
The assessment is broad. It spans physical threats, malevolent acts and natural hazards, the resilience of critical infrastructure, monitoring practices, financial systems, and more. The precise obligations, thresholds, and deadlines are matters for the EPA's guidance and your own counsel, not a security consultant.
Within that broad assessment sits a slice that is squarely physical security, and it is often the part a large engineering firm is least focused on:
This maps directly onto the distinctive water utility security problem: many critical sites, most of them remote and unmanned.
The value of an independent voice here is the same as everywhere: the firm assessing your physical security is not also selling you the systems to fix it, so the recommendation is sized to your actual risk and your budget rather than to a vendor's catalogue.
Large utilities often have the engineering resources to absorb AWIA work. Smaller and mid-sized California districts frequently do not, and the physical security portion is exactly the kind of specialized, periodic work that is hard to justify hiring for full time. Independent assessment lets a district get senior physical security expertise for the RRA cycle without carrying it on the payroll, and get a prioritized assessment it can actually act on across budget years.
AWIA requires a broad Risk and Resilience Assessment that includes physical threats among many other factors. Physical security is one defined component of that larger assessment, not the whole of it. An independent consultant can handle that physical security portion, site hardening, access, and monitoring, while the full RRA and its compliance determination remain with the utility and its counsel in coordination with the EPA.
AWIA's Risk and Resilience Assessment and Emergency Response Plan requirements apply to community water systems serving more than 3,300 people, on a recurring certification cycle. The exact thresholds, timelines, and obligations are set by the statute and EPA guidance, and should be confirmed with the EPA and your counsel rather than a security consultant.
No. The full Risk and Resilience Assessment spans engineering, operations, financial systems, and more, and is often led by engineering firms. Wittner Security Consultants provides the independent physical security portion, assessing and specifying site hardening, access control, and monitoring, and does not certify or guarantee AWIA compliance. That determination is the utility's, with its counsel and the EPA.
Tell Paul what you are protecting and what prompted the reading. He will tell you honestly what the work involves and whether he is the right person for it.