WATER UTILITY SECURITY BEGINS AT HOME

In reaction to the events of 9/11, water utilities have initiated enhanced security measures, including performance of vulnerability assessments and installation of gated fences, video monitoring, visitor identification protocols and the like.

However, for some utilities one form of internal security risk may have been overlooked. A common form of access to water system facilities occurs when outside engineers, consultants, contractors, suppliers and others inspect the facilities or view drawings and records in the course of performing work for a utility. Fencing, gates and video cameras do not control such access, if unfettered. Indeed, such access, if uncontrolled, can expose sensitive information to such persons, and indirectly to third persons, thereby possibly increasing vulnerability risks to utility assets.

Even simple forms of such access can cause risks. For example, when a utility initiates a public bidding process for a proposed construction project, potential bidders likely will have access to drawings, specifications, records and even the facility itself. These forms of access can result in sensitive information about a utility to remain in files of unsuccessful bidders as well as engineers, contractors, etc., with such files being available to persons not directly related to a project for the utility.

One way a utility may be able to protect its sensitive information from unauthorized use is by means of protective agreements with such persons needing access to facilities and information, including potential bidders. Such agreements can establish boundaries for access, use, retention and disposal of sensitive information obtained by persons given access to such information. In addition, protective agreements can specify consequences, both monetary and otherwise, for any breach of such an agreement. Protective agreements can be stand alone agreements or can be incorporated in the terms of agreements for services, purchases, or construction and in bidding documents. Of course, as in the case of any agreement, compliance with the terms of a protective agreement should be monitored carefully.