Community water systems should be aware that the U.S. Environmental Protection Agency (EPA) posted a list of systems that expected to comply with §2013, America’s Water Infrastructure Act of 2018 (AWIA). As compliance deadlines pass, EPA is posting the list of utilities that have certified their Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP). Currently, 99.45% of large systems (serving more than 100,000) are shown to be in compliance with risk and resilience assessment and 98.15% of systems are in compliance with emergency response plans. However, following the cyber incident in Florida multiple systems have received media inquiries about the status of their compliance since they do not appear on the certified list. While these lists present a snapshot and some certifications may have been received by EPA after posting, the absence is calling into question the utilities’ security and preparedness priorities. Utilities should be prepared for media inquiries regarding actions being taken to comply with AWIA and more specific actions taken to address cybersecurity. As a reminder, some of the information requested by reporters or the public may be sensitive, and care should be taken when discussing that information, especially if releasing it could present a threat to public safety or the integrity of utility operations. Each state has different criteria, so utilities are encouraged to review Protecting the Water Sector's Critical Infrastructure Information prior to releasing any information that may be security sensitive. As a reminder, AWIA §2013 sets up three compliance phases based on the population served by a community water system and requires the system to: Conduct a risk and resilience assessment; Prepare or revise an emergency response plan; and Complete self-certifications by the due dates listed in the following table: AWIA Compliance Deadlines Community Water System*# Risk and Resilience Assessment, no later than Emergency Response Plan, no later than >100,000 March 31, 2020 September 30, 2020 50,000-99,999 December 31, 2020 June 30, 2021 3,300-49,999 June 30, 2021 December 30, 2021 * - Wholesale systems must consider population of all systems served # - Certification will occur every five years after first compliance date AWWA has developed several resources to support utility compliance with AIWA §2013 and cybersecurity, including some which specifically support small systems. Utility Risk & Resilience Cybersecurity Guidance Small Systems & AWIA Questions can be directed to Kevin Morley , federal relations manager, or Greg Kail , director of communications.