Independent Vendor-neutral Northern California
California Compliance

AWIA and the Physical Security of Water Utilities

California Compliance Published July 2026 Reviewed July 2026 Wittner Security Consultants

America's Water Infrastructure Act (AWIA) requires community water systems to conduct Risk and Resilience Assessments and maintain Emergency Response Plans on a recurring cycle. Much of that work is engineering and operations, but a defined portion is physical: hardening sites, controlling access, monitoring, and protecting critical physical assets.

This article covers that physical security portion for California water and wastewater utilities. It is general information, not legal advice, and Wittner Security Consultants does not certify or guarantee AWIA compliance.

What AWIA requires, briefly

AWIA, enacted in 2018, requires community water systems serving more than 3,300 people to conduct a Risk and Resilience Assessment (RRA), and to prepare or update an Emergency Response Plan (ERP) that incorporates the assessment's findings. Systems certify completion to the U.S. Environmental Protection Agency, and the requirement runs on a recurring cycle, so this is not a one-time exercise.

The assessment is broad. It spans physical threats, malevolent acts and natural hazards, the resilience of critical infrastructure, monitoring practices, financial systems, and more. The precise obligations, thresholds, and deadlines are matters for the EPA's guidance and your own counsel, not a security consultant.

The physical security portion

Within that broad assessment sits a slice that is squarely physical security, and it is often the part a large engineering firm is least focused on:

  • Site hardening. Perimeter, barriers, and the physical protection of treatment plants, pump stations, wells, tanks, and reservoirs.
  • Access control. Who can physically reach critical facilities and equipment, across a service area that may include dozens of remote, unstaffed sites.
  • Monitoring and detection. Intrusion detection and surveillance sized realistically for sites where a human response is far away.
  • Protection of critical assets. The specific points where a physical breach would have the greatest consequence for the supply.
  • Chemical storage security. Treatment chemicals as both a safety hazard and a target.

This maps directly onto the distinctive water utility security problem: many critical sites, most of them remote and unmanned.

Where an independent consultant fits

The value of an independent voice here is the same as everywhere: the firm assessing your physical security is not also selling you the systems to fix it, so the recommendation is sized to your actual risk and your budget rather than to a vendor's catalogue.

Especially useful for small and mid-sized districts

Large utilities often have the engineering resources to absorb AWIA work. Smaller and mid-sized California districts frequently do not, and the physical security portion is exactly the kind of specialized, periodic work that is hard to justify hiring for full time. Independent assessment lets a district get senior physical security expertise for the RRA cycle without carrying it on the payroll, and get a prioritized assessment it can actually act on across budget years.

Common questions

Does AWIA require a physical security assessment?

AWIA requires a broad Risk and Resilience Assessment that includes physical threats among many other factors. Physical security is one defined component of that larger assessment, not the whole of it. An independent consultant can handle that physical security portion, site hardening, access, and monitoring, while the full RRA and its compliance determination remain with the utility and its counsel in coordination with the EPA.

Which water systems does AWIA apply to?

AWIA's Risk and Resilience Assessment and Emergency Response Plan requirements apply to community water systems serving more than 3,300 people, on a recurring certification cycle. The exact thresholds, timelines, and obligations are set by the statute and EPA guidance, and should be confirmed with the EPA and your counsel rather than a security consultant.

Can you complete our whole AWIA assessment?

No. The full Risk and Resilience Assessment spans engineering, operations, financial systems, and more, and is often led by engineering firms. Wittner Security Consultants provides the independent physical security portion, assessing and specifying site hardening, access control, and monitoring, and does not certify or guarantee AWIA compliance. That determination is the utility's, with its counsel and the EPA.

Keep reading

Related reading.

Request an assessment

Have a real facility behind the question?

Tell Paul what you are protecting and what prompted the reading. He will tell you honestly what the work involves and whether he is the right person for it.

Call Paul Request assessment