The physical security walkthrough: closing your system's easy doors

You already know where the easiest doors are on your system. The gate that doesn't quite latch. The hatch nobody's checked since spring. The chemical room key three people share because a fourth key is a hassle to cut.

A "security assessment" sounds like something a city system runs with a compliance officer and a binder, not something you do solo with a flashlight and a clipboard. That's the part that keeps most small systems from ever finishing one: the templates feel built for someone else's size of operation.

The tool built for your size looks nothing like that. It's a walkthrough, a set of yes-or-no questions covering every part of your system: wellhead or intake, treatment plant, storage tank, pumps, distribution, and the office. You walk it once, mark every "no," and you already have a punch list ranked by what actually matters.

What do you inventory before you start walking

Before you check a single lock, write down what you're protecting. A critical component is any piece of physical infrastructure essential to moving water or keeping it safe to drink. That reaches past the treatment plant to the well or intake, storage tanks, pumps, distribution pipes and valves, backup power, and the office that holds your maps and passwords.

List each one by number, location, and a short description:

• source water: wells, intake, or purchased connections
• treatment: buildings, pumps, equipment, and chemical storage
• storage: tanks and pressure tanks
• power: primary and backup
• distribution: pumps, pipes, valves, hydrants, and backflow preventers
• office and records: computers, files, phones, radios, SCADA, and vehicles

This list becomes the map you walk against, and it's the same list you use again next year.

How does the walkthrough work

You answer 43 yes-or-no questions in one pass through every part of the system: wellhead or intake, treatment plant, storage tanks, pumps, distribution, and the office. Every "no" gets a short note on what's missing, then gets carried onto the worksheet you'll use to plan fixes.

Treat the finished document as sensitive. It's a list of your own weak points, so store it separately from your regular files, keep a duplicate copy off-site, and hand access only to the staff, board members, and primacy agency contacts who actually need to see it.

This isn't a form you file once. It's closer to a habit, the kind you keep up the same way you'd re-walk a leak survey.

Where do intruders actually get in

They get in through whatever you haven't checked lately: an unfenced gate, an unwatched hatch, a chemical room somebody propped open. Walk the perimeter first. Fence every critical facility, including well houses and pump pits, and lock every gate with a padlock that protects at least the shank.

Check every closure next: doors, windows, hatches, vents, and roof access on tanks. All of it should be closed and locked, checked on a regular basis, and confirmed during a daily look at your critical components.

Light what you can't watch. Exterior lighting and motion-triggered lights or alarms do a lot of the deterring for you, especially at a remote wellhead nobody drives past at night. Trim landscaping that hides an entry point, and don't leave rocks, blocks, ladders, or valve keys lying around where they double as break-in tools.

Chemical storage and deliveries deserve their own look. Have someone from your staff present for every delivery, check the driver's credentials, and confirm containers arrive sealed and match what you ordered. Keep a simple log of who delivered what and when, and store chemicals in a restricted area.

Wells and tanks each have their own weak points. A wellhead needs a proper seal, and vents and caps need screens that stay attached and are hard to remove; cap or properly retire any abandoned or test wells. On tanks, secure the ladder, hatch, and vents with tamper-resistant hardware, screen the overflow pipe, and keep a way to isolate or drain the tank if something gets into it.

Don't stop at the fence line. Password-protect every computer, run a firewall, update virus protection daily, and back up your records off-site. Limit entry codes and keys to your own staff, change them when someone leaves, and take a look at your own website for details, source locations, tank capacity, that a stranger could use against you.

How do you decide what to fix first

Every "no" goes on a simple worksheet with four columns: the question number, what needs fixing, when it's scheduled, and when it's done. That's the whole tool, no scoring software, no consultant required.

Rank the list by two questions: how likely is this threat, and how bad is the impact if it happens. An unlatched gate at a remote valve pit matters less than an unlocked chemical room or an open tank hatch, because those two put drinking water directly at risk.

Work the list top-down as budget allows, then leave the worksheet open. New "no" answers show up every time you walk it again, and that's the point, not a failure of the first pass.

What paperwork does this leave you with

The paperwork is short: a signed certificate for your funder, and the assessment itself, kept locked down where only a few people can see it. This walkthrough is not the federal Risk and Resilience Assessment required under America's Water Infrastructure Act. That requirement only applies to community water systems serving more than 3,300 people, but smaller systems get asked a version of the same question anyway: any system taking USDA Rural Development funding has to complete a Security Vulnerability Assessment and an Emergency Response Plan.

What you actually send USDA is the Certificate of Completion, never the assessment or the emergency plan itself. The certificate is signed by whoever's authorized for your system, and it confirms the work got done and that the results will feed your emergency plan.

Keep the real documents local and locked down: store the assessment separately and securely, keep a duplicate off-site, and limit who sees it to staff, local officials, and your primacy agency on a need-to-know basis. That's the whole paper trail a board or a funder needs, no scoring model behind it, just yes-or-no answers and a plan.

How often do you repeat the walk

Some of this is a daily habit, not an annual one. Check your critical components every day, and account for the tools your vehicles carry, valve keys included, so a missing wrench gets caught the same day.

Other pieces run on a longer clock. Review your emergency response plan at least once a year, or sooner if something about the system changes, and change computer passwords on a set schedule and any time someone leaves. Update virus protection daily and keep your off-site backup current.

Re-walk the full 43 questions whenever the system itself changes: a new well, a building addition, a new supplier, a new hire. Security here isn't a form you file and forget. It's a habit you keep up, the same as flushing hydrants or calibrating a meter.

If you're not sure what's actually on your list of critical components yet, start with what your water system owns before you walk the fence line.