From EPA Water Security Division (via Region 7), 8/28/2019

 “EPA will host an overview webinar to provide participants with a quick introduction to the new risk assessment and emergency response plan requirements. Participants will also learn about the updated Vulnerability Self-Assessment Tool Web 2.0 and Emergency Response Plan Guidance, Template and Instructions.

Date and time: September 5, 2019 from noon - 1:30 PM CDT

Registration link

Notes: This webinar is related to the AWIA Risk Assessment and Emergency Plan requirements for systems serving more than 3,300 people, including consecutives.  Further information on those requirements is available at EPA's website.  

Example ERP Template in MS-Word: At the bottom of the website is the ERP Template in .pdf.  There is also an MS-Word version that is available by first downloading the .pdf, then clicking on the box in the middle right side of page 2 entitled "AWIA ERP Template."  That will open an MS-Word document that can be used. 

IAMU will be hosting a series of free insurance-related webinars this fall. During each webinar, Jester’s Heith Hockenberry will review a few of the different coverages that IAMU members should purchase as part of their insurance coverage.
 
There is no charge to attend, but registration is required. To register, go to www.iamu.org > Events > Register For An Event (Scroll through the calendar and register for one or more webinars). You will need to register for each webinar individually.
 
The dates, times, and topics for the webinars are:

• Sept. 26 – 1-2 p.m.: Property and Inland Marine (equipment)
• Oct. 28 – 1-2 p.m.: General Liability, Public Officials, Law Enforcement & Umbrella
• Nov. 18 – 2-3 p.m.: Auto (Physical Damage & Liability) and Crime
• Dec. 16 – 1-2 p.m. (Cyber)

On Aug. 16, more than 20 entities in Texas reported a ransomware attack with the majority of these entities being smaller local governments. The evidence gathered indicates the attacks came from one-single threat actor. If this happened in your community, are your prepared? Do you know how to respond?

If you are a member of the IAMU Safety Group Insurance Group, you can get coverage for such an event. Currently, only about 20% of all safety group members purchase the coverage. If your utility or municipality doesn’t currently have such coverage, be sure to ask your agent for more information.

According to the Department of Homeland Security (DHS) and its Cybersecurity and Infrastructure Security Agency (CISA), ransomware has rapidly emerged as the most visible cybersecurity risk playing out across the nation’s networks, locking up private-sector organizations and government agencies alike. And that’s only what is seen – many more infections are going unreported, ransoms are being paid, and the vicious ransomware cycle continues. Organizations are strongly urged to consider ransomware infections as destructive attacks, not an event where you can simply pay off the bad guys and regain control of your network.

According to CISA, ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website. Ransomware can be devastating to an individual or an organization. Anyone with important data stored on their computer or network is at risk, including government or law enforcement agencies and healthcare systems or other critical infrastructure entities. Recovery can be a difficult process that may require the services of a reputable data recovery specialist, and some victims pay to recover their files. However, there is no guarantee that individuals will recover their files if they pay the ransom.

Helping organizations protect themselves from ransomware attacks is a chief priority for the CISA. The agency has assisted many ransomware response and recovery efforts, building an understanding of how ransomware attacks unfold, and what potential steps can be taken to better defend systems. But there is also a recognition that there’s no such thing as perfect cybersecurity, and ransomware infections can still happen. The agency has also developed recommendations to help organizations limit damage and recover smartly and effectively.

RANSOMWARE MITIGATIONS TO HELP YOU DEFEND TODAY AND SECURE TOMORROW

The CISA recommendations outline three sets of straightforward steps any organization can take to manage their risk. These recommendations are written broadly for all levels within an organization. It is never as easy as it should be, so if your organization needs help, the agency urges you to reach out for assistance – CISA is here to help, but so is the FBI, numerous private sector security firms, state authorities, and others.

1. Backup your data, system images, and configurations and keep the backups offline.
2. Update and patch systems.
3. Make sure your security solutions are up to date.
4. Review and exercise your incident response plan.
5. Pay attention to ransomware events and apply lessons learned.

Actions to Recover If Impacted – Don’t Let a Bad Day Get Worse

1. Ask for help. Contact IAMU immediately. You may reach Russ Saffell, Director of Member Security & Critical Infrastructure Protection at 515.289.1999 or 515.988.8686 (cell).
2. Isolate the infected systems and phase your return to operations.
3. Review the connections of any business relationships (customers, partners, vendors) that touch your network
4. Apply business impact assessment findings to prioritize recovery.

Actions to Secure Your Environment Going Forward – Don’t Let Yourself be an Easy Mark

1. Practice good cyber hygiene; backup, update, whitelist apps, limit privilege, and use multifactor authentication.
2. Segment your networks; make it hard for the bad guy to move around and infect multiple systems.
3. Develop containment strategies; if bad guys get in, make it hard for them to get stuff out
4. Know your system’s baseline for recovery.
5. Review disaster recovery procedures and validate goals with executives.

For more information on ransomware, visit the CISA Resource Page on Ransomware (www.us-cert.gov/Ransomware). Victims of ransomware should report it immediately to CISA at www.us-cert.gov/report, a local FBI Field Office, or Secret Service Field Office.

The American Public Gas Association (APGA) now offers a mutual aid program for municipal natural gas systems to provide and receive assistance from program participants around the country in the event of a disaster or emergency situation.

The APGA Mutual Aid Program supplements the Iowa Mutual Aid System, allowing other utilities from around the country to help in Iowa when needed and allowing for Iowa utilities to help out in other areas of the country.

Participation in the program is voluntary, but APGA and IAMU encourage as many members as possible to sign the Mutual Aid Agreement form to create a robust and effective nationwide mutual aid program. If your utility has already signed the Iowa Mutual Aid Agreement, your utility must ALSO sign the APGA agreement to be able to participate in the national program. If your municipal natural gas system would like to participate, the Mutual Aid Agreement form needs to be signed by the designated point of contact for the program. The forms should then be mailed or faxed to APGA or scanned and emailed directly to scook@apga.org.

In the event of an emergency, a utility can call for aid by sending a Request for Aid (RFA) form to APGA. APGA staff would identify potential matches based on what the system is requesting and then put the two (or more) systems in contact with each other. After the match has been made, the requesting and responding systems coordinate the logistics of the relief until completion.

The APGA Mutual Aid program was formally approved by the APGA Board of Directors in May 2019 and was developed with input from the APGA Operations & Safety Committee and APGA’s Mutual Aid Task Group, including IAMU. The program guidelines aim to allow as close to 100% participation from APGA members as possible.

The final agreement addresses concerns brought forward by APGA membership, including indemnification, workers compensation, and Operator Qualification.

• Indemnification - The APGA Mutual Aid Agreement states that the Requesting System indemnifies Responding Systems “to the full extent permitted by law, but without waiving and subject to all defenses including all constitutional, statutory and common law immunities and limits of liability, to release, indemnify, defend and hold harmless the Responding System...”
• Workers Compensation - The APGA Mutual Aid Agreement maintains that “At all times, employees of a Responding System continue to be employees of the Responding System and are not ever deemed to be employees of a Requesting System.” The agreement states that the Requesting System will compensate the Responding System’s employees’ “wages and salaries for paid time spent in Requesting System’s service area and paid time during travel to and from such service area, plus Responding System’s standard payable additives to cover all employee benefits and allowances.”
• Operator Qualification - The APGA Mutual Aid Agreement puts the onus on the Requesting System to ensure that those working on their system are Operator Qualified. It states that the “Requesting System must specify in their request for aid what tasks are covered tasks per 49 CFR 192 subpart N. The Requesting System receiving personnel pursuant is required to confirm that Responding Company personnel’s knowledge, skills and ability are consistent with Requesting Company’s needs.

If your municipal natural gas utility has any questions about the APGA Mutual Aid Program, contact APGA staff at (202) 464-2742 or by email at scook@apga.org or visit www.apga.org/mutual-aid.

The Business & Financial Conference is the annual meeting for public power professionals in the areas of business and finance, offering more than 60 sessions bringing you the latest in:

• Accounting & Finance
• Customer Accounting & Services
• Human Resources & Training
• Information Technology
• Pricing & Market Analysis
• Risk Management & Insurance
  

Registration
Registration for the 2019 B&F Conference is currently open. Book your hotel reservations directly with the Hyatt Regency Minneapolis. For more information go to https://www.publicpower.org/event/business-financial-conference

Who Should Attend
Conference attendees get the latest information from experts in their fields, learn about the national issues and industry-wide activities and trends that are affecting their communities and utilities, and share experiences and strategies for dealing with key issues and challenges at more than 50 breakout sessions and roundtables. Bringing together more than 450 public power professionals, the conference is ideal for both industry veterans and those new to the electric utility industry who are interested in professional development and networking.

Conference sessions are designed for utility employees at both the professional and management levels, in the fields of accounting and finance; customer accounting and services; human resources and training; information technology; and pricing and market analysis. Attendees typically include specialists, coordinators, analysts, managers, directors and vice presidents in their area of specialty. The conference is also recommended for utility employees with interests and responsibilities in conference topics and with cross-departmental responsibilities, as well as rising stars and future leaders those who would benefit from learning more about these strategic areas and making connections with the national public power community.

The Iowa Utilities Board issued an order on Aug. 14 outlining the timeline for comments on the proposed report forms. Initial comments must be filed by Aug. 30 with reply comments by Sept. 13. Although IAMU has not heard anything definitive, we don’t expect to hear anything until after Sept. 13. IAMU is monitoring this issue and will provide an update as we know more.

If you have any questions, you may contact IAMU General Counsel Tim Whipple at twhipple@iamu.org or Krista Wenzel at eefiling@iamu.org or by phone at 712-579-6000.
 
Here is a link to the order if you would like to review it: https://efs.iowa.gov/cs/groups/external/documents/docket/mdax/ody0/~edisp/1864224.pdf

IAMU is planning to hold its Equipment Demo & Exhibit Day on Wednesday, Oct. 2, from 1 – 6 p.m. on our Training Field. Demo Day is a time for IAMU members to connect with vendors who can demonstrate or showcase their equipment, tools, processes, and materials in a real-life setting.

The event is FREE for utility members and associate members. If you’re not a member, contact us to find out how you might be able to participate. For more information or to register for the event, click here.

Mark your calendars for the IAMU Water Distribution & Leak Detection/Line Locating Workshops.  The workshops will take place September 10th - 11th at the IAMU Training and Office Complex.

Water Distribution Training topics will include:

• Fire hydrant maintenance
• Water main tapping / HydraStop
• Water main installation / repair & fittings

Water Leak Detection / Line Locating topics will include:

• Water leak detection (with various equipment)
• Line locating
• Trenching & shoring
• Fittings

0.6 CEUs each day for Water Distribution.

Cost:
Early Registration (on or before September 6th)

• IAMU Members - $65/day or $115 both days
• Non-Members - $105/day or $190 both days

Late/At-the-Door Registration

• IAMU Members - $75/day or $135 both days
• Non-Members - $115/day or $210 both days

Registration is open.  For more information about the workshops, brochure, and online registration, click HERE.

IAMU is hosting a luncheon on Friday, August 23, 2019, at IAMU, as part of Water and Wastewater Workers Week. The event will go from 11 a.m. until 1 p.m. The menu includes hamburgers, brats, salads, chips, and cookies. We will also be drawing for door prizes.