Risk-informed planning
Translate RRA findings into response procedures, continuity actions, recovery priorities, and improvement items.
Emergency Response Planning
Build plans people can use when operations are disrupted.
Systems Risk Advisory helps water, wastewater, electric utility, local government, and industrial organizations develop and update emergency response plans that connect risk findings to roles, communications, continuity actions, recovery priorities, and real operating constraints.
30+ yearsCybersecurity, physical security, OT/ICS, power, and critical infrastructure experience
Operational focusPlanning tied to essential functions, authority, communications, and recovery
AWIA alignmentERP support for covered community water systems and practical utility readiness
Exercise readyPlans can be connected to tabletop scenarios, hotwash findings, and improvement actions
Why it matters
A plan must support decisions under pressure.
Emergency response plans often fail because they are outdated, too general, or written for compliance rather than use. During an incident, people need clear roles, current contacts, practical checklists, communication paths, and decision points.
A useful plan should help staff act when information is incomplete, normal systems are unavailable, and leadership needs to make fast decisions.
That means the plan should connect to real operations, including treatment, pumping, field response, manual operations, cyber and OT incidents, physical security, power, communications, vendors, mutual aid, public messaging, and recovery sequence.
Good plans reduce confusion
Emergency response planning should clarify who has authority, who must be contacted, what actions happen first, how operations continue, and how recovery decisions will be made. The plan should not depend on one person knowing what to do.
AWIA ERP support
ERP updates should connect directly to RRA findings.
For covered community drinking water systems, America's Water Infrastructure Act requires an Emergency Response Plan that reflects the Risk and Resilience Assessment. Systems Risk Advisory helps utilities update ERP content with practical attention to cyber, physical, OT/ICS, operational, and communication needs.
Operational detail
Address the systems, people, suppliers, facilities, communications, and fallback methods needed to maintain essential service.
Usable response tools
Build plan sections, checklists, decision guides, contact lists, and exercise-ready scenarios that staff can use.
What the plan should address
Emergency response is more than a contact list.
A strong plan helps people coordinate response across leadership, operations, IT, OT, field crews, emergency management, regulators, vendors, mutual aid partners, and public information staff.
Roles and authority
Decision authority, incident leadership, backups, escalation paths, coordination with city or utility leadership, and after-hours coverage.
Communications
Internal notifications, public messaging, regulator coordination, mutual aid, law enforcement, fire, public health, and elected official updates.
Continuity actions
Manual operations, alternate staffing, backup power, chemical supply, field response, workarounds, and critical function priorities.
Recovery priorities
Restoration sequence, system validation, return-to-service decisions, documentation, hotwash items, and improvement tracking.
Planning scenarios
Plans should cover the incidents most likely to stress operations.
Emergency response planning should reflect realistic events that could interrupt essential service or force difficult decisions.
- Cyber incident or ransomware affecting business systems, communications, or recovery
- Loss of SCADA visibility, HMI access, telemetry, or remote control capability
- Unauthorized access, vandalism, intrusion, or suspicious activity at a facility or remote site
- Power outage, communications outage, generator issue, or fuel supply concern
- Chemical delivery disruption, process upset, water quality concern, or laboratory support issue
- Staffing shortage, key personnel unavailable, vendor delay, or mutual aid coordination need
- Public messaging challenge involving customers, elected officials, news media, or social media
- Recovery and return-to-service decisions after systems have been disrupted
Approach
A practical planning process.
The goal is to produce a plan that reflects how the organization actually works and supports action during an event.
Review current materials
Examine existing ERPs, RRAs, contact lists, emergency procedures, cyber plans, continuity plans, mutual aid information, and prior exercise findings.
Confirm operating reality
Meet with leadership, operations, maintenance, IT, OT, emergency management, public information, and other response partners.
Update response structure
Clarify roles, authorities, contacts, notification steps, coordination points, continuity actions, and recovery priorities.
Add usable tools
Develop checklists, scenario annexes, decision guides, communication templates, and action trackers where needed.
Prepare to test the plan
Identify tabletop or operational exercise options that can validate the plan and produce an improvement plan.
Deliverables
Clear outputs your team can use.
- Emergency Response Plan review or update
- AWIA ERP support, when applicable
- Updated roles, responsibilities, contact lists, and notification paths
- Response checklists for priority scenarios
- Cyber, OT/ICS, physical security, power, communications, and continuity planning inputs
- Public communication and leadership notification considerations
- Recovery and return-to-service decision guidance
- Optional tabletop exercise design based on the updated plan
- Improvement plan or action tracker for follow-up items
Who this is for
Built for organizations responsible for essential services.
- Community drinking water systems updating AWIA Emergency Response Plans
- Water and wastewater utilities that need clearer response procedures
- Public works departments and local governments managing utility or infrastructure risk
- Electric utility and industrial organizations with OT, SCADA, field site, or continuity concerns
- Organizations preparing for tabletop exercises, ransomware readiness reviews, or leadership briefings
Why Systems Risk Advisory
Plans should reflect infrastructure, not just paperwork.
Systems Risk Advisory brings experience across cybersecurity, physical security, OT/ICS, electrical power systems, emergency response, and critical infrastructure resilience. Emergency response planning is strongest when it reflects how facilities, control systems, field crews, vendors, leadership, and response partners work together.
We help clients connect risk findings to response actions, clarify decision points, and prepare staff to operate through disruption.
Would your plan help people act during the first hour?
If your ERP is outdated, your AWIA update cycle is approaching, or your team has not tested response roles and communication paths, now is the time to review the plan.