AWWA published “Protecting the Water Sector's Critical Infrastructure Information” to provide water utilities with a summary of state level protections available to review in preparation to comply with Section 2013 of America's Water Infrastructure Act (AWIA). The report, which can be downloaded for free here , provides excerpts of the relevant statutory text addressing the protections provided for information that may be included in a risk and resilience assessment and/or an emergency response plan. AWIA sets up three compliance phases based on the population served by a community water system and requires the system to: Conduct a risk and resilience assessment; and Prepare or revise an emergency response plan. Table 1. AWIA Compliance Deadlines Community Water System*# (population served) Risk and Resilience Assessment, no later than Emergency Response Plan, no later than >100,000 March 31, 2020 September 30, 2020 50,000-99,999 December 31, 2020 June 30, 2021 3,300-49,999 June 30, 2021 December 30, 2021 * - Wholesale systems must consider population of all systems served # - Certification will occur every 5 years after 1st compliance date Some states have taken steps to exempt certain security sensitive information from public release. In fact, 34 states currently have laws that specifically address the type of information a utility would prepare in compliance with AWIA. The remaining states have some protections that may, or may not, apply to the full scope of critical infrastructure information that may be considered security sensitive. Questions can be directed to Kevin Morley , AWWA's federal relations manager.