/01What Section 1433 requires
Section 1433 of the Safe Drinking Water Act was rewritten by America’s Water Infrastructure Act of 2018. It asks every community water system serving more than 3,300 people for two documents and two certifications:
- A Risk and Resilience Assessment (RRA) of the risks to your system from malevolent acts and natural hazards, including the risks to its “electronic, computer, or other automated systems (including the security of such systems).”
- An Emergency Response Plan (ERP), prepared or revised within six months of certifying the assessment, that sets out how you will detect, respond to and recover from those events.
You certify each one to EPA by a deadline set by the size of your system, keep copies for five years, and review both at least every five years. EPA asks for the certifications, not the documents themselves.
/02Who it applies to
Community water systems that serve more than 3,300 people, which EPA counts as 3,301 or more. Smaller systems are not required to comply, although the same practices protect them too.
In New Jersey, systems with more than 500 service connections also answer to the Water Quality Accountability Act, which adds its own cybersecurity program, incident reporting and insurance rules. Our WQAA checklist covers them. In New York, systems serving more than 3,300 people also answer to NYSDOH Appendix 5-E. See how the three rules compare.
/03The deadlines
Certification runs in five-year cycles. The second cycle began in 2025.
| Population served | Risk and Resilience Assessment | Emergency Response Plan |
|---|
| 100,000 or more | March 31, 2025 | September 30, 2025 |
| 50,000 to 99,999 | December 31, 2025 | June 30, 2026 |
| 3,301 to 49,999 | June 30, 2026 | December 31, 2026 |
If you serve 3,301 to 49,999 peopleYour assessment was due June 30, 2026, and your Emergency Response Plan is due December 31, 2026. The plan is due six months after you certify the assessment, so if you certified the assessment early, your plan is due earlier too.
/04What the assessment must cover
The assessment weighs the risk to your system from malevolent acts and natural hazards, and the resilience of:
- Pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities
- Electronic, computer or other automated systems, including their security
- Monitoring practices
- Financial infrastructure
- The use, storage and handling of chemicals
- Operation and maintenance
It may also look at the capital and operational needs of managing those risks. The cybersecurity part is the one most systems find hardest, because it starts with an inventory most utilities do not have: every PLC, HMI, remote site, cellular modem and vendor connection.
/05What the response plan must include
- Strategies and resources to improve resilience, including physical security and cybersecurity
- Plans and procedures for responding to a malevolent act or natural hazard that threatens your ability to deliver safe water
- Actions, procedures and equipment that lessen the impact, such as alternative source water, relocated intakes and flood protection barriers
- Strategies to help detect malevolent acts and natural hazards
Coordinate with your local emergency planning committee as you write it. For cyber incidents, the plan should say who spots a problem, who decides to isolate systems, how operators run the plant in manual, how you restore from known-good backups, and who you report to.
/06Where systems fall short
EPA is enforcing Section 1433. It took at least 100 enforcement actions for violations between 2020 and 2024, and in 2024 it reported that more than 70% of the systems it had inspected since September 2023 violated basic requirements. Default passwords and shared logins were common.
A 2024 review by EPA’s Office of Inspector General found 97 drinking water systems, serving about 26.6 million people, with critical or high-risk cybersecurity vulnerabilities.
The threat is current. Since July 27, 2026, utilities in at least seven states have reported attacks on internet-facing PLCs. Read the briefing.
/07A checklist to certify with confidence
- Confirm your population served, your deadlines, and the date you certified your last assessment.
- Inventory every connected system: SCADA servers, HMIs, PLCs, historians, remote sites, telemetry links, cellular modems and vendor connections.
- Find anything reachable from the internet, and take it off or put it behind a secure gateway.
- Change every default password, and replace shared logins with named accounts.
- Assess your cyber controls against EPA’s water sector cybersecurity checklist and CISA’s Cybersecurity Performance Goals.
- Assess the other components: physical barriers, source water, treatment, chemicals, monitoring, finances, and operation and maintenance.
- Write the cyber incident procedures in your plan: detect, isolate, run in manual, restore, report.
- Coordinate the plan with your local emergency planning committee.
- Rehearse it in a tabletop exercise with operators, IT and leadership.
- Certify the assessment, then the plan within six months, and keep copies for five years.
- Put the next review on the calendar, and keep your inventory current between cycles.
/08What may change
Congress is weighing bills that would change the rules. In August 2026, the Congressional Research Service listed proposals to revise Section 1433’s vulnerability assessment requirements and add wastewater requirements (S. 5368), to have systems adopt standards set by an independent organization (H.R. 2594), and to fund water cybersecurity through new and existing grant programs, including in the Water Resources Development Act of 2026 (S. 4949). All were listed as introduced.
/09How we help
We complete the cybersecurity portions of your Risk and Resilience Assessment and Emergency Response Plan, give you a package ready to certify to EPA, and run the tabletop exercise. Culper-I keeps your asset inventory and risk picture current between cycles, so the next certification starts from real data instead of a blank page. The result is water and wastewater compliance. See the rules it covers.
