Your ERP is done.
One document left.
Your Emergency Response Plan is filed. The only thing standing between your utility and AWIA recertification is a current Risk and Resilience Assessment. KORVA Sentinel builds it — done-for-you, 4 deliverables, delivered in 48 hours. June 30 is solvable.
The math is in your favor.
June 30 is 15 days away. KORVA delivers in 48 hours. You have more runway than you think.
What EPA actually requires in an RRA.
Five threat domains. All five must be documented, assessed, and evidence-backed. Most operators don't know this going in — most DIY attempts fail on cybersecurity and financial resilience.
This is what you receive.
Not a template with your name on it. A completed, utility-specific compliance document built from your intake data — defensible to EPA and audit-ready from day one.
-
✓Built from your intake, not a generic template Your infrastructure layout, OT systems, chemical storage, and operational dependencies are reflected throughout. The document reads like a site-visit assessment because it is.
-
✓Cross-referenced against your EPA record We pull your PWSID data from our 27,575-record database before your intake is even complete. Existing violations, population tier, and prior certification history all inform the build.
-
✓Structured for EPA certification Formatted to the AWIA §2013 recertification requirements. Every section maps to a specific regulatory element — no ambiguity when you file your certification.
-
✓Audit-defense grade methodology Includes a decision log showing how each risk rating was reached. If EPA asks for your reasoning, it's already documented.
Section 3.2 — Threat & Vulnerability Analysis
Your RRA includes a fully populated risk matrix covering every threat across all five domains. Each row is rated for likelihood, consequence, and residual risk after existing controls — giving you a defensible, documented baseline for every finding.
This is the section auditors go to first. Ours includes the controls assessment and explicit rationale for every rating — the two elements most often missing in self-built RRAs.
Everything in the RRA package.
Four deliverables. One intake. One price. One deadline to close.
Risk & Resilience Assessment
Your formal RRA covering all five EPA threat domains — physical, cyber, chemical, natural hazard, and financial resilience. Built from your intake and cross-referenced against your EPA record. Not a template.
Evidence & Documentation Index
A structured index mapping every RRA element to supporting evidence. When an auditor asks a question, you locate the answer in minutes — not days of searching through files you can't find.
EPA Certification Support Packet
A ready-to-certify file aligned to EPA's AWIA recertification process. Includes the attestation checklist required for submission and a step-by-step submission guide specific to your state.
Audit Defense File
A decision log showing exactly how your RRA was built, what methodology was applied, and why every risk rating is defensible. Regulators can trace every conclusion — and so can you, years from now.
Why not just hire an engineering firm?
It's a legitimate question. Here's the honest answer.
| KORVA Sentinel | Engineering Firm | DIY Internal | |
|---|---|---|---|
| Price | $3,997 flat | $20,000 – $75,000+ | Staff time only — significant and unbilled |
| Delivery timeline | 48 hours from intake submission | 3–6 months — and if you push them to accelerate, add a rush surcharge on top | Unknown — depends entirely on staff capacity |
| Can it make June 30? | YES — with rush order | NO — procurement alone is 4–12 weeks. And if you try to rush them, you pay a premium on top of a $20K–$75K base rate to still miss the deadline. | UNLIKELY — depends on your staff load and whether anyone on your team has written an RRA before |
| What you provide | 20-minute intake form. We handle the rest. | Months of interviews, site visits, and document gathering | You research the requirements and write every section |
| Regulatory defensibility | HIGH — audit defense file included | HIGH — but you're paying $50K+ for it | VARIABLE — depends on who writes it and whether they know what EPA actually checks |
| Procurement required? | No. Order online in minutes. | RFP, contract negotiation, board approval — 4–12 weeks | No — but staff bandwidth is its own constraint |
| PE-sealed option | Available — quoted separately via email | Yes — included (it's in your $50K) | No — requires a separate PE engagement |
Engineering firms build excellent documents. But you cannot procure, contract, and receive delivery from an engineering firm in 15 days. For this deadline cycle, that option is closed for most utilities. The question is whether your RRA gets done before June 30 at all.
We mapped your compliance status before you called.
KORVA Sentinel maintains 27,575+ water utility records sourced from EPA SDWIS and AWIA federal data. When you submit your intake, we already have your PWSID, your violation history, your population tier, and your current AWIA certification status on file. Your intake adds the operational specifics we can't get from public records. That combination produces a document with the depth of a site-visit assessment — at a fraction of the timeline and cost.
How it works.
Four steps. About 20 minutes of your time. One complete deliverable set.
Purchase
Pay $3,997 via Square. You're routed immediately to the intake form. No procurement process, no calls to schedule, no waiting. Documents in 48 hours from intake submission.
Complete Intake
Answer our structured utility questionnaire — 25 questions, 15–20 minutes. Your answers plus your EPA record data drive the build. We cross-reference your intake against your PWSID record before we write a single page.
We Build
KORVA builds your RRA, evidence index, EPA certification packet, and audit defense file. All four deliverables, 48 hours from intake submission. You receive a secure delivery link when complete.
You Certify
Review your documents, use the included submission checklist, and certify to EPA. Your certification support packet walks through every step. The attestation is yours to make — we make it straightforward.
$69,733 per day.
That's what uncertified costs.
The SDWA civil penalty cap is $69,733 per day (40 CFR §19). That clock starts June 30, 2026. It stops the day you certify. A false or misleading certification carries criminal exposure under 18 U.S.C. §1001. There is no grace period in the statute.
Questions we hear every time.
Probably not. AWIA §2013 requires a current RRA — one that reflects your system's present posture. If your infrastructure, OT systems, staff, or service area have changed since 2021, your 2021 document may not meet the currency requirement. More importantly: the June 30, 2026 deadline is a new recertification cycle — a separate obligation from whatever was filed previously. If you have a recent (2023–2024) RRA built to AWIA standards, it may qualify. We recommend a $497 Risk Snapshot review before assuming you're covered.
If your internal process is far enough along and will deliver a certification-ready document before June 30 — you're set. Use it. The question is whether the timeline is actually realistic. Most utilities building internally are doing it alongside operational responsibilities, without dedicated compliance staff, and without prior experience writing to AWIA standards. If there's any doubt, the cost of being wrong is $69,733 per day. A $3,997 KORVA build costs less than one day of penalty exposure — and you can use your internal work as intake input. It often strengthens the final document significantly.
AWIA does not require RRAs to be produced by licensed engineers for the federal certification filing — it requires that you certify a current RRA meeting the substantive requirements of §2013. KORVA builds to those substantive requirements: all five threat domains, documented methodology, and a defensible evidence base. The certification attestation is made by your utility — you're affirming the document exists, is current, and meets the standard. Our audit defense file is specifically designed to support that attestation. For utilities required by state regulators or grant programs to have PE-sealed documents, we quote PE sealing separately. Most systems in the 3,301–49,999 population tier do not require a PE seal for the federal AWIA certification itself.
The 25-question intake captures the operational specifics that only you can provide: your infrastructure layout, OT systems, chemical storage, staff capacity, and critical dependencies. Everything else — your PWSID, population tier, service area, violation history, and AWIA compliance record — we already have from our 27,575-record database. Your answers supplement what we know with what public records can't tell us. That combination produces a document with the specificity of a site-visit assessment at a fraction of the time and cost. More complete intake answers produce a stronger document. You can attach supporting materials — previous plans, site diagrams, existing assessments — to strengthen the build further.
With 48-hour delivery, this question mostly solves itself — you can order today and have your documents within 2 days, leaving 13 days before the June 30 deadline to review, certify, and submit. That's a comfortable margin. The risk of missing June 30 isn't the delivery timeline — it's waiting to order. Every day you don't start is one fewer day to complete your review and file your certification. The documents themselves take 48 hours. The certification is yours to complete, and most utilities using our package submit within a week of delivery.
Your ERP is filed. This is the last document between you and certified.
One intake. 48 hours. 4 deliverables. Certify before June 30 — no engineering firm, no procurement, no rush surcharges.
KORVA Sentinel is a compliance readiness and documentation platform. This page does not constitute legal advice and does not guarantee EPA acceptance, penalty avoidance, or regulatory outcomes. Utilities should verify their specific obligations with EPA, their state primacy agency, and current legal counsel before final certification action. Civil penalty figures reflect the 40 CFR §19 statutory maximum; actual enforcement is at EPA discretion. PE-sealed deliverables are quoted separately — contact us via the purchase flow and note PE-seal in your intake.