A water utility is a network of buildings and structures spread across a service area: intakes, wells, treatment plants, chemical storage, pump stations, storage tanks and reservoirs, and the control systems that tie them together. Many of those sites are unstaffed for long stretches, and many sit in plain view of a public road. The protection around them is often a fence, a gate and a camera. That combination records an attack. It does little to delay one.
This note is written for utility managers, consulting engineers, specifiers and contracting officers planning new water or wastewater facilities, or upgrades to existing ones. It sets out how the federal assessment requirement frames physical protection, where exposure tends to sit on a utility’s sites, and what to write into a specification so that the protective elements are designed rather than added after the fact.
The assessment cycle already asks the question
Section 1433 of the Safe Drinking Water Act, as amended by Section 2013 of America’s Water Infrastructure Act of 2018, requires every community water system serving more than 3,300 people to complete a risk and resilience assessment and an emergency response plan, and to certify to EPA that it has done so. The statute lists what the assessment must address. The list includes the risk to the system from malevolent acts and natural hazards, and the resilience of the system’s pipes and constructed conveyances, physical barriers, source water, intakes, pretreatment, treatment, storage and distribution facilities, along with its automated systems, monitoring practices, financial infrastructure, chemical handling, and operation and maintenance.
Systems must review and, where needed, revise both documents at least every five years. In the current cycle, EPA lists June 30, 2026 as the assessment deadline for systems serving 3,301 to 49,999 people, and December 31, 2026 as the deadline for their emergency response plans. Larger systems certified their assessments in 2025. For many utilities, that means a recent assessment has identified physical weaknesses that now need a design response, and the capital plan is where those findings either become projects or stay on paper.
The requirement applies to community drinking water systems. Wastewater utilities are not covered by Section 1433, but their treatment plants, lift stations and chemical storage share many of the same exposures, and the same method of assessment and specification applies to them.
Turn each finding into a written threat
An assessment finding such as “chemical building vulnerable to intrusion” is a starting point, not a design requirement. Before anything is selected, each finding should be written as a threat with a reference that a designer can test against. A pump station control building that a person could reach with hand and power tools needs a forced-entry threat. An elevated tank or treatment building visible from a public road may need to be evaluated against a rifle fired from outside the fence. A plant entrance on a long, straight approach may need to be evaluated against a vehicle.
Each threat has its own reference. ASTM F2656 is the usual test standard for vehicle barriers, and it defines the test vehicle, the impact speed and the penetration measured. UL 752 and NIJ-STD-0108.01 are common references for ballistic threats, and each defines the test round and the conditions under which it is fired. The specification should cite the standard and its edition for each threat and state which structures it applies to. A wall described only as “hardened” or “secure” cannot be tested, inspected or accepted against anything.