Vulnerability assessments help water systems evaluate susceptibility to potential threats and identify corrective actions that can reduce or mitigate the risk of serious consequences from adversarial actions (e.g., vandalism, insider sabotage, terrorist attack, etc.) Such an assessment for a water system takes into account the vulnerability of the water supply (both ground and surface water), transmission, treatment, and distribution systems. An effective vulnerability assessment serves as a guide to the water utility by providing a prioritized plan for security upgrades, modifications of operational procedures, and/or policy changes to mitigate the risks and vulnerabilities to the utility’s critical assets. The vulnerability assessment provides a framework for developing risk reduction options and associated costs. Water systems should review their vulnerability assessments periodically to account for changing threats or additions to the system to ensure that security objectives are being met. Preferably, a vulnerability assessment is “performance-based,” meaning that it evaluates the risk to the water system based on the effectiveness (performance) of existing and planned measures to counteract adversarial actions.
What are the basic elements of vulnerability assessments?
The following are common elements of vulnerability assessments:
- Characterization of the water system, including its mission and objectives
- Identification and prioritization of adverse consequences to avoid
- Determination of critical assets that might be subject to malevolent acts that could result in undesired consequences
- Assessment of the likelihood of such malevolent acts from adversaries
- Evaluation of existing countermeasures
- Analysis of current risk and development of a prioritized plan for risk reduction.
The vulnerability assessment process will range in complexity based on the design and operation of the water system itself. The nature and extend of the vulnerability assessment will differ among systems based on a number of factors, including system size, potential population affected, source water, treatment complexity, system infrastructure, and other factors. Security and safety evaluations also vary based on knowledge and types of threats, available security technologies, and applicable local, state, and federal regulations.
See the EPA’s Vulnerability Assessment Fact Sheet [1]