RRA and ERP.
Both. Get Certified Now.
Your water system needs both documents to certify under AWIA §2013 — and right now, that's not just a compliance question. The June 30 deadline has passed, the penalty clock is running, and Iranian-affiliated actors are actively targeting water system PLCs across 12 states (CISA AA26-097A). An uncertified system has no documented cyber posture. KORVA builds both documents together — one intake, 48-hour delivery — and closes both gaps at once.
The math is in your favor.
The June 30 deadline has passed. Every day your system remains uncertified is penalty exposure. KORVA delivers both documents in 48 hours — get certified and stop the clock.
What EPA actually requires in both documents.
The RRA covers five threat domains. The ERP must address how your system responds to each one. Building them separately means they often tell different stories — KORVA builds both from the same intake so they're consistent throughout.
This is what you receive.
Not two separate templates with your name on them. Two completed, utility-specific compliance documents built from one intake — cross-referenced against each other so regulators see a consistent record across both filings.
-
✓Built from your intake, not generic templates Your infrastructure layout, OT systems, chemical storage, and operational dependencies are reflected throughout both documents. They read like site-visit assessments because they are built to that standard.
-
✓Cross-referenced against your EPA record We pull your PWSID data from our 27,575-record database before your intake is even complete. Violation history, population tier, and prior certification data all inform both builds.
-
✓RRA and ERP are internally consistent An ERP that doesn't address the same hazards your RRA identified is a red flag in any EPA review. Building both from the same intake eliminates that risk entirely.
-
✓Audit-defense grade methodology on both documents Both include a decision log showing how each risk rating and response protocol was determined. If EPA asks for your reasoning, it's already documented.
Every RRA risk maps to an ERP response protocol.
Each high-risk finding in your RRA links directly to a corresponding response protocol in your ERP. Auditors trace from risk identification to response procedure in a single review — no gaps, no inconsistencies between documents.
This cross-referencing is only possible when both documents are built together from the same intake. Systems that build their RRA and ERP at different times or with different vendors almost always show alignment gaps under scrutiny.
Everything in the AWIA Bundle.
Six deliverables. One intake. One price. Two documents that tell a consistent story.
Risk & Resilience Assessment
Your formal RRA covering all five EPA threat domains — physical, cyber, chemical, natural hazard, and financial resilience. Built from your intake and cross-referenced against your EPA record. Not a template.
Emergency Response Plan
Your ERP built in direct coordination with your RRA — addressing the same hazards, using the same risk framework, internally consistent throughout. Both documents pass review as a unified compliance record.
Evidence & Documentation Index
A unified index mapping every element of both documents to supporting evidence. When an auditor asks a question, you locate the answer in minutes — not days of searching through files you can't find.
EPA Certification Support Packet
Ready-to-certify submission support aligned to EPA's AWIA recertification process — covering both the RRA and ERP attestation requirements in a single, organized submission file.
Audit Defense File
A decision log and methodology record for both documents — showing exactly how each was built, what criteria were applied, and why every risk rating and response protocol is defensible.
5-Year Retention Package
AWIA requires document retention through the full compliance cycle. Your bundle includes a structured retention folder organized to meet EPA records-access expectations — ready to go from day one.
Why not just hire an engineering firm?
It's a legitimate question. Here's the honest answer.
| KORVA Bundle | Engineering Firm | DIY Internal | |
|---|---|---|---|
| Price | $5,497 flat — both documents | $40,000 – $80,000+ for both, separately contracted | Staff time only — significant and unbilled |
| Delivery timeline | 48 hours from intake submission | 3–6 months per document — accelerating means a rush surcharge on a $40K+ baseline | Unknown — depends entirely on staff capacity and prior AWIA experience |
| Fastest path to certified now? | YES — 48 hours from intake | NO — procurement alone is 4–12 weeks. Two documents means two contracts. The deadline has passed and they still can't deliver on any useful timeline. | UNLIKELY — writing two coordinated, defensible AWIA documents alongside operational duties, without prior experience, under enforcement pressure is not realistic. |
| What you provide | 30-minute intake. One form. Covers both documents. | Months of interviews, site visits, and document gathering — per document, separately | You research the requirements and write every section of both documents |
| Documents internally consistent? | YES — built from the same intake simultaneously | VARIABLE — often contracted separately, often show gaps when reviewed together | VARIABLE — depends on whether the same person writes both with the same framework |
| Regulatory defensibility | HIGH — audit defense file included for both documents | HIGH — but you're paying $80K+ for it | VARIABLE — depends on whether your staff knows what EPA actually checks |
| Procurement required? | No. Order online in minutes. | RFP, contract negotiation, board approval — 4–12 weeks, for each document | No — but staff bandwidth is its own constraint |
| PE-sealed option | Available at $15,000 — quoted separately | Yes — included (it's in your $80K) | No — requires a separate PE engagement |
Engineering firms build excellent documents. But the June 30 deadline has passed — procurement, contracting, and delivery from an engineering firm takes months. For most utilities in violation right now, that option cannot close the gap fast enough. The only question is how quickly you can get certified and stop the penalty clock.
We mapped your compliance status before you called.
KORVA Sentinel maintains 27,575+ water utility records sourced from EPA SDWIS and AWIA federal data. When you submit your intake, we already have your PWSID, your violation history, your population tier, and your current AWIA certification status on file. Your intake adds the operational specifics we can't get from public records. That combination produces two documents with the depth of site-visit assessments — at a fraction of the timeline and cost.
How it works.
Four steps. About 30 minutes of your time. Six deliverables — two documents, built together, delivered in 48 hours.
Purchase
Pay $5,497 via Square. You're routed immediately to the intake form. No procurement process, no calls to schedule, no waiting. Both documents delivered within 48 hours of intake submission.
Complete Intake
Answer our structured utility questionnaire — approximately 30 questions, 20–30 minutes. One intake drives both builds. Your answers plus your EPA record data produce two internally consistent, utility-specific documents.
We Build Both
KORVA builds your RRA and ERP in coordination — the same risk identification framework runs through both documents so they're internally consistent throughout. All six deliverables arrive in a single secure delivery link within 48 hours of intake submission.
You Certify
Review both documents, use the included dual-document certification packet, and certify to EPA. Your submission checklist walks through every step. The attestation is yours to make — we make it straightforward.
$71,545 per day.
And 12 states under active attack.
The SDWA civil penalty cap is $71,545 per day (40 CFR §19). That clock started July 1, 2026 for every uncertified system. It stops the day you certify. Meanwhile, Iranian-affiliated actors are actively exploiting default credentials and open HMI ports at water utilities across 12 states — documented in CISA Advisory AA26-097A. An uncertified system has no documented cyber posture to show regulators or insurers. There is no grace period in the statute, and no pause in the attack campaign.
PE-Sealed option available.
For utilities under regulatory scrutiny, board requirements, or state mandates requiring a licensed engineer's seal on both documents.
AWIA Bundle — PE Sealed
The complete AWIA Recertification Bundle — RRA and ERP — reviewed and sealed by a licensed Professional Engineer. Appropriate for systems where the state, insurer, or board requires PE certification on compliance documents.
- Includes everything in the self-service bundle
- Licensed PE review and seal on both documents
- Appropriate for regulatory enforcement contexts
- Appropriate where state mandate requires PE attestation
- Appropriate for utility board-level certification requirements
- Custom timeline quoted at engagement
Questions we hear every time.
Yes. AWIA §2013 requires recertification every five years. Your 2021 documents satisfied the first cycle. The second cycle requires updated documents reflecting current threats, infrastructure, and operational context — not a re-submission of your 2021 files. The June 30, 2026 deadline has passed. If your documents haven't been updated for this cycle, you are in active violation and need to certify now.
Get the Compliance Risk Snapshot ($497). It identifies whether your existing documents satisfy this recertification cycle, what gaps exist, and which path — RRA only, ERP only, or bundle — is right for your system. If only one is missing, you save $1,503 by purchasing the single-document package. If both are missing, the Bundle is the right path and costs $499 less than buying them separately.
AWIA does not require RRAs or ERPs to be produced by licensed engineers for the federal certification filing — it requires that you certify current documents meeting the substantive requirements of §2013. KORVA builds to those requirements: all five threat domains, documented methodology, defensible evidence base, and coordinated ERP response protocols. The certification attestation is made by your utility. Our audit defense file is specifically designed to support that attestation. For state-mandated PE seals, we quote that separately. Most systems in the 3,301–49,999 tier do not require a PE seal for the federal AWIA certification itself.
The 30-question intake captures what only you can provide: your infrastructure layout, OT systems, chemical storage, staff capacity, and critical dependencies. Everything else — your PWSID, population tier, service area, violation history, and AWIA compliance record — we already have from our 27,575-record database. Your answers supplement what we know with what public records can't tell us. That combination produces two documents with the specificity of site-visit assessments. More complete answers produce stronger documents. You can attach supporting materials — previous plans, site diagrams, existing assessments — to strengthen both builds further.
The RRA and ERP each cost $3,997 purchased separately — a total of $7,994. The Bundle is $5,497 — $2,497 less. The discount reflects the efficiency of building both documents from a single intake. You also get the 5-Year Retention Package, which is not included in the standalone packages. If you need only one document, buy the single package. If you need both, the Bundle is always the right path.
Yes. If only one document is missing, you don't need the bundle. The RRA Certification Package and ERP Certification Package are each $3,997 with the same 48-hour delivery. The Bundle is the right path only when you need both — and at $5,497 it costs $2,497 less than buying them separately.
Systems in the 3,301–49,999 population tier that did not certify by June 30, 2026 are in active violation of SDWA §1433. EPA has authority to assess civil penalties up to $71,545 per day from July 1 forward. State regulators and insurers are increasingly checking certification status. And the regulatory exposure isn't the only pressure: CISA Advisory AA26-097A (July 2026) documents Iranian-affiliated actors actively targeting water system PLCs across 12 states — exploiting the exact gaps your RRA is supposed to document and your ERP is supposed to address. An uncertified system has no documented cyber posture on file. Getting certified as quickly as possible — and documenting a remediation effort — matters significantly in any enforcement conversation and in any incident response conversation. With 48-hour delivery, you can have both documents in hand within two days of ordering.
Both documents. One intake. 48 hours. Get certified now.
The June 30 deadline has passed. Every day uncertified is $71,545 in penalty exposure — and Iranian-affiliated actors are actively targeting water system PLCs in 12 states right now. An uncertified system carries both risks simultaneously. The AWIA Bundle is the fastest compliant path to certified — both documents, built together, internally consistent, delivered in 48 hours. Stop the clock. Document your posture.
KORVA Sentinel is a compliance readiness and documentation platform. This page does not constitute legal advice and does not guarantee EPA acceptance, penalty avoidance, or regulatory outcomes. Utilities should verify their specific obligations with EPA, their state primacy agency, CISA, and current legal counsel before final certification action. Civil penalty figures reflect the 40 CFR §19 statutory maximum; actual enforcement is at EPA discretion. PE-sealed deliverables are quoted separately — contact info@securemywater.site and note PE-seal in your inquiry.