Prepare for RRA Certification Deadlines and ERP Updates

These planning requirements, part of the Safe Drinking Water Act, aren't just a compliance checkbox. Instead, they help water utilities and laboratories anticipate and withstand an increasing range of risks. As climate change intensifies, natural disasters and digital threats evolve, robust assessments and response strategies are essential.

Below, we'll dive into the key components of RRAs and ERPs, why they matter for utility staff and lab partners alike, and how to meet the EPA's 2025 and 2026 recertification deadlines.

RRA Certification Deadlines: Taking Stock of Vulnerabilities

The first step toward building resilience is establishing a baseline and understanding your system's vulnerabilities. RRAs require water utilities to assess both natural and human-made hazards that could impact their ability to deliver safe drinking water.

These assessments cover potential risks in areas including:

• Infrastructure: Physical barriers, including source water, conveyance, treatment, and storage.
• Digital: Cybersecurity and information technology systems, such as Supervisory Control and Data Acquisition (SCADA) networks and lab data platforms.
• Maintenance: Monitoring practices, including sampling locations, analytical tools, and communications with water test labs.
• Energy: Dependency on electric power and other critical suppliers.

Importantly, RRAs must reflect the latest threats, which may vary based on geographical or climate factors. For example, those in wildfire-prone regions may need to reassess the fire risks associated with source water or pumping stations. In coastal areas, sea level rise and storm surge may pose growing issues for treatment plants. Increasingly, RRAs also incorporate cybersecurity reviews, such as evaluating protections against ransomware that could disrupt water testing, reporting, power, or treatment operations.

There's no one-size-fits-all approach to this complex work. The Environmental Protection Agency (EPA) doesn't mandate a specific RRA template. However, it does provide guidance and examples through its Vulnerability Self-Assessment Tool, which helps utilities evaluate both asset criticality and threat likelihood.

Under AWIA, utilities must review and update their RRA every five years and submit a recertification statement to the EPA within six months of completion. RRA certification deadlines are as follows, depending on the CWS size:

• March 31, 2025: Over 100,000 people
• December 31, 2025: 50,000-99,999 people
• June 30, 2026: 3,301-49,000 people

ERP Updates: A Roadmap for Response and Recovery

Once utilities identify risks, the next step is to develop an ERP that outlines how to respond to and solve the hazards identified.

The EPA requires that these plans include:

• Reducing chemical risk: A response plan should outline strategies for improving system resilience, including relocating chemical storage or hardening facilities.
• Stocking supplies: ERPs should also include actions and equipment necessary to respond to incidents, including backup lab contacts and portable water testing kits.
• Collaborating with others: A comprehensive ERP will outline emergency communication procedures with key partners, including public health agencies and lab testing facilities.
• Training staff: ERPs should also account for frontline workers by ensuring utility staff receive proper safety measures and training.

For labs that partner with utilities, ERPs have significant implications beyond this standard. Utilities may establish priority testing protocols, identify emergency courier services, or outline how labs will handle surge capacity during boil water advisories or contamination events. Collaborating with utilities before an emergency strikes can ensure smoother coordination and faster response when the unexpected happens.

Utilities must update and recertify ERPs every five years—just like RRAs—and must certify completion to the EPA no later than six months after submitting their updated RRA certification.

ERP recertification deadlines vary based on CWS size:

• September 30, 2025: Over 100,000 people
• June 30, 2026: 50,000-99,999 people
• December 31, 2026: 3,301-49,000 people

The Upcoming 2025 and 2026 Deadlines

For utilities that completed their first RRA and ERP in 2020, those documents must be updated and recertified in 2025. That means many labs and water professionals will see an uptick in planning conversations, requests for input, and documentation updates in the coming months.

Failure to comply with these requirements may result in EPA enforcement actions. But more importantly, falling behind puts communities at greater risk of service interruptions, contamination, and reputational damage.

With wildfires, floods, cyberattacks, and infrastructure failures in the headlines more often, the importance of an up-to-date emergency plan has never been more evident.

By acting early, utilities and labs can proactively manage the following:

• Emergency communication: Identify gaps in emergency communication or surge testing capacity.
• Community engagement: Develop updated mutual aid agreements or lab redundancy plans.
• Data and research: Incorporate the latest data on emerging threats, such as PFAS or cyber exploits targeting SCADA systems.

Resilience and Response Is a Team Effort

As threats evolve and become more frequent, utilities should take proactive steps to stay prepared. This includes regularly reevaluating vulnerabilities and updating emergency plans—not just every five years. For labs, this means playing an active role in planning discussions, ensuring analytical capabilities are ready for crisis conditions, and helping utilities maintain the trust of the communities they serve.

Taking time to strengthen your risk assessment and response strategies is an investment in safety, reliability, and public confidence. For more information on RRAs, ERPs, and AWIA requirements, visit the EPA's water resilience page.