Document dnBmzy1YvYdy8o6k5dV17geZB

EPA ft ._.,_., ~r United States Environmental Protection Agency Region 6 - Enforcement & Compliance Assurance Division INSPECTION REPORT Inspection Date(s): Media Program: Regulatory Program(s) 08/15/2024 Water SDWA Company Name: Facility Name: Facility Physical Location: (city, state, zip code) Mailing address: (city, state, zip code) County/Parish: Facility Phone Number Facility Contact: City of Lewisville City of Lewisville Public Works 1100 N Kealy Avenue, Suite D Lewisville, TX, 75057 1100 N Kealy Avenue, Suite D Lewisville, TX, 75057 Denton (972)-219-3510 Katelyn Hearon khearon@cityoflewisville.com I I Utilities Manager FRS Number: Identification/Permit Number: Media Identifier Number: NAICS: SIC: PWS ID#: TX0610004 Personnel participating in inspection: Fatima Shaikh EPA Region 6 Craig Young EPA Region 6 Daniel Kim EPA Region 6 Kendall Corder TCEQ Katelyn Hearon City of Lewisville Kelly Rouse City of Lewisville Eric Martinez City of Lewisville Nick Martinez City of Lewisville Lead Inspector Credentialed Inspector Credentialed Inspector Work Leader, Water Supply Division Utilities Manager Assistant Director Water Treatment Plant Supervisor Chief Information Security Officer EPA Lead Inspector Signature/Date Digitally signed by FATIMA FATIMA SHAIKH SHAIKH Date: 2024.09.20 10:45:36 -05'00' {Inspector name} 09/20/2024 Date Supervisor Signature/Date Digitally signed by RUBEN ALAYONRUBEN ALAYON-GONZALEZ GONZALEZ Date: 2024.09.20 11 :58:05 -05'00' {Supervisor name} 09/20/2024 Date 6ENFORM-020-R8.2 (02/12/2020) 1 Section I INTRODUCTION City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 PURPOSE OF THE INSPECTION EPA Region 6 inspectors Fatima Shaikh, Craig Young, and Daniel Kim arrived at the City of Lewisville public works at 9:00 am on August 15, 2024 for an announced inspection. The inspection was prompted by a national priority targeting systems for the Region's Safe Drinking Water Act {SDWA) 1433 inspections with a cybersecurity focus. We met Katelyn Hearon, Utilities Manager, Kelly Rouse, Assistant Director, Eric Martinez, Water Treatment Plant Supervisor, and Nick Martinez, Chief Information Security Officer. Kendall Corder, Work Leader of TCEQ Water Supply Division also attended the inspection. Craig Young and Daniel Kim presented their credentials to Ms. Hearon and informed her that this was an EPA inspection to evaluate the system under the SDWA Section 1433(a) and (b), which requires community water systems that serve more than 3,300 people to develop and certify completion of a Risk and Resilience Assessment (RRA), Emergency Response Plan (ERP). The scope of the inspection was to perform an onsite document review of the system's RRA and ERP in addition to a focus on cybersecurity. FACILITY DESCRIPTION The City of Lewisville is a community water system located in Lewisville, Denton County, Texas. The city has 57,075 service connections and serves a population of 134,231 customers. The water system is a surface water system with the source water coming from Lake Lewisville. The system consists of conventional treatment with flocculation, clarification, filtration, and disinfection with a capacity of 18 million gallons per day (MGD) and maximum capacity of 20.5 MGD. The system also purchases treated surface water from Dallas Water Utilities (DWU) and Upper Trinity Regional Water District (UTRWD). There are emergency interconnections with the neighboring water systems, the City of the Colony and City of Dallas. There is a potential for future interconnections with the City of Coppell and Town of Flower Mound. There are 15 operators at the plant. The plant operates 24/7 with three shifts (11PM7AM, 7AM-3PM, and 3PM-11PM). Two shifts have 4 operators, and one shift has 5 operators. Section II OBSERVATIONS I observed the RRA, and ERP certified by Kelly Rouse. The RRA and ERP were certified within 6 months of each other as required by the statute. The following observations pertain to the SDWA Section 1433(a), Risk and Resilience Assessment: I observed an assessment of the risk to the system from malevolent acts and natural hazards. o The RRA identified reference threats. I observed an assessment of the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage, distribution facilities, electronic, computer and other automated systems which are used by the system. 2 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 o The RRA discussed the results of a resilience analysis for the various threat scenarios and provided a resilience score. I observed an assessment of the monitoring practices of the system for malevolent acts and natural hazards. I observed an assessment of the impact to the financial infrastructure of the system in the event of malevolent acts and natural hazards. I observed an assessment of the impact to the use, storage, and handling of various chemicals by the system in the event of malevolent acts and natural hazards. o Mr. Rouse provided verbal information regarding the emergency response group, Public Works Emergency Response Team (PWERT) where systems in the region provide mutual aid for chemical supply. o The City also participates in the Texas Water/Wastewater Agency Response Network (TXWARN) which provides assistance to water and wastewater utilities during major system outages. I observed an assessment of the impact to the operation and maintenance of the system in the event of malevolent acts and natural hazards. o Mr. Rouse provided verbal information regarding the use of back-up power with generators at the facility that utilize local fuel. The following observations pertain to the SDWA Section 1433(b), Emergency Response Plan: I observed strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system. o The ERP discusses that water quality sampling that is conducted can be used to identify issues caused by malevolent acts or natural hazards. o There was verbal discussion where if there were to be any chemical feed issues or manipulation in the process, it would be caught. I observed actions which can prevent or mitigate the impact of a malevolent act or natural hazard on the safety and supply of drinking water. I observed plan and procedures developed, personnel required, and equipment available to respond to a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water. o The ERP presents action plans for malevolent acts or natural hazards including wildfire, tornado, flooding, fire of explosions, malevolent threats, power outages, medical emergencies, serious injury, influenza pandemic, chemical spills, and water contamination. I observed plans for coordination with existing local emergency services. I observed strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system. o The ERP discusses the recovery plans for all the possible scenarios, except for malevolent acts and chemical spills. o Mr. Martinez indicated that there is annual cybersecurity training for all employees. o Mr. Martinez indicated that a tabletop cybersecurity exercise is scheduled for October 2024, and a Water Treatment Plant one will also be taking place. 3 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 The cybersecurity portion of the inspection was discussed with the Chief Information Security Officer and the City of Lewisville personnel where the list of cybersecurity questions for community water systems was provided to the water system prior to the inspection. Section III AREAS OF CONCERN 1. The ERP is missing the contact phone numbers for the Incident Management Team in the appendix. It is recommended to add a note in the ERP indicating the location of the current upto-date directory. EPA Region 6 inspectors Fatima Shaikh, Daniel Kim, and Craig Young conducted a closing conference with Katelyn Hearon, Kelly Rouse, Eric Martinez, and Nick Martinez at City of Lewisville at 12 pm on August 15, 2024. During the closing conference, the Area of Concern was reviewed. It was noted that all the relevant changes will be updated in the RRA and ERP for the next fiscal year for next 5 -year submission cycle deadline that will be March 31, 2025, for the RRA and September 30, 2025, for the ERP. EPA resources and factsheets were provided to system for the RRA, ERP, and Cybersecurity are listed in Appendix 2. Section IV FOLLOW UP EPA received additional background information about the public water system on August 26, 2024, after exiting the Facility on August 15, 2024. Section V LIST OF APPENDICES Appendix 1 Inspection sign-in sheet Appendix 2 List of EPA resources 4 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 Appendix 1 Inspection sign-in sheet 5 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 No.N\Q.. -rrtie. ra-1-tn--c::t. S ~;t:::h T r-r::p~dor -~~f\tzcdion Ef-A- /( a'dltl.l C:o,aer ,t!/dL )/,. rl-1~./L l(,tt-d:;,,,-Hmro,,.., ,'<l.i,1- (Au,{.,,,., n:~ /A.JS~ l(,,tf. 1<.br,/.:.,..., ~,.,,. k1 ofk,v..r l)t-1hh C) t,,\M'12J<,,, ' f (. ~ C,,IJj " e I ,11 tJM{VI ., C.!J..,fL!w.:,vlk rt.o,.,t.,.r~ , ' 11'4-:"t; L5-7/<sY <l,,c ,LI. ,fu-hr>i'\Q<'(JI;\ Jllv j1;J.-,l':3f - "(';Jt>C,. ,Ul"w-ut~ ,;:,n,u~.l.<,.r, J.-,..,.r . /~ f] 'J -~,;-'31-t,r ~ ,,l".. ;1-,,1.,.,L'v (. _}ot/c4,,.'5i,,1v .o,;, G? 2 - l l ' l - ~ m ? / t 1 v ~ i o - e c ! , 1 ,L. J~, 1,....., \u: c>" ert(..,. 1f\htf1l'- t),~,~e,\ IC,"" C-r":) 'io,n) loiP ~~'V - i(l~ t>L..f.o,- J_M~~t' LJ'1 i i \('-t?.;l\t '=l'A- '=-P~ l{~C'frs<,--,,, ~i - . ,. ,. . ,. ,zc.ufi1a/ (lvJoJ~(c. ..~ ...:...~""""' . :2-lU _t..._. {J6ol It-- 1."t!\~ ei'O. ~CV. '{~u,'.}v:..:::r. f.r ... ,o, , Ito-"I' ~lt>'it_ Ay;,. V,~~--im... G,i & /..Ew1>J, 1.,<-f.. l\'U - 8\4- 3,; L!u 1.n;,~ee_o ..l-lo.uv,rr,~ 6 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 Appendix 2 List of EPA resources 7 City of Lewisville PWS ID#: TX0610004 Inspection Date: 08/15/2024 The following factsheets were shared with the system during the inspection: EPA AWIA Community Water System ERP Template and Instructions EPA AWIA Risk and Resilience Assessment Guidance EPA RRA and ERP Factsheet EPA Incident Action Checklist Cybersecurity EPA Cyber Incident Reporting Process Top Cyber Actions for Securing Water Systems Free Cyber Vulnerability Scanning for Water Utilities 8