Baseline Information on Malevolent Acts for Community Water Systems Version 3.0
Safe drinking water is essential to human health and the nation’s economy. Public water systems, like other critical infrastructure, face an array of threats from both natural hazards, such as floods and hurricanes, and malevolent acts like cyberattacks. This guidance document can help public water system owners and operators to assess the threat that certain malevolent acts pose to their systems and to identify steps that may reduce their risk.
Assessing threats is a critical step in an “all-hazards” approach to risk management, which also involves:
- Evaluating and mitigating the vulnerabilities of critical assets, and
- Understanding and reducing the potential consequences of incidents that may occur.
The information provided in this document is not a threat analysis for a specific water system. Due to significant variability in assets, system design, environment and other characteristics that influence the risk presented by malevolent acts, some information in this document may not be relevant to certain water systems. Default threat likelihood ranges are offered only as a starting point to consider when estimating the probability of malevolent acts as part of a risk and resilience assessment. The process water systems go through to assess threats should account for their unique situations, which cannot be reflected in the baseline values in this guidance.
Why is EPA providing this document?
Pursuant to the requirements of section 1433 of the Safe Drinking Water Act (SDWA), which was modified by America’s Water Infrastructure Act (AWIA) section 2013(a) in 2018, the U.S. Environmental Protection Agency (EPA), in consultation with federal, state, and local government and private sector partners, has developed this guidance document to provide baseline information regarding malevolent acts of relevance to community water systems. To assist these systems with risk and resilience assessments, SDWA section 1433 directed EPA to provide baseline information on malevolent acts that may either:
- Substantially disrupt the ability of the system to provide a safe and reliable supply of drinking water; or
- Otherwise present significant public health or economic concerns to the community served by the system.
What changes has EPA made in version 3.0 of this document?
- Replaced most point estimates of default threat likelihood with order of magnitude ranges.
- Eliminated accidental contamination of source and finished water as malevolent act threat categories.
- Revised factors potentially impacting threat likelihood.
- Eliminated default threat likelihood values for wastewater.
- Combined cyberattacks on business enterprise systems and process control systems into a single category of cyberattack.
Baseline Information on Malevolent Acts for Community Water Systems Version 3.0 (pdf)