Your RRA.
Done in 48 hours.
Your Emergency Response Plan is filed. The only thing standing between your utility and AWIA recertification is a current Risk and Resilience Assessment. KORVA Sentinel builds it — done-for-you, 4 deliverables, delivered in 48 hours. The June 30 deadline has passed — the penalty clock is running, and Iranian-affiliated actors are actively targeting water system PLCs across 12 states right now (CISA AA26-097A). Uncertified means no documented cyber posture. Get certified now and stop both clocks.
The math is in your favor.
The June 30 deadline has passed. Every day uncertified is penalty exposure. KORVA delivers in 48 hours — stop the clock as fast as possible.
What EPA actually requires in an RRA.
Five threat domains. All five must be documented, assessed, and evidence-backed. Most operators don't know this going in — most DIY attempts fail on cybersecurity and financial resilience.
This is what you receive.
Not a template with your name on it. A completed, utility-specific compliance document built from your intake data — defensible to EPA and audit-ready from day one.
-
✓Built from your intake, not a generic template Your infrastructure layout, OT systems, chemical storage, and operational dependencies are reflected throughout. The document reads like a site-visit assessment because it is.
-
✓Cross-referenced against your EPA record We pull your PWSID data from our 27,575-record database before your intake is even complete. Existing violations, population tier, and prior certification history all inform the build.
-
✓Structured for EPA certification Formatted to the AWIA §2013 recertification requirements. Every section maps to a specific regulatory element — no ambiguity when you file your certification.
-
✓Audit-defense grade methodology Includes a decision log showing how each risk rating was reached. If EPA asks for your reasoning, it's already documented.
Section 3.2 — Threat & Vulnerability Analysis
Your RRA includes a fully populated risk matrix covering every threat across all five domains. Each row is rated for likelihood, consequence, and residual risk after existing controls — giving you a defensible, documented baseline for every finding.
This is the section auditors go to first. Ours includes the controls assessment and explicit rationale for every rating — the two elements most often missing in self-built RRAs.
Everything in the RRA package.
Four deliverables. One intake. One price. One deadline to close.
Risk & Resilience Assessment
Your formal RRA covering all five EPA threat domains — physical, cyber, chemical, natural hazard, and financial resilience. Built from your intake and cross-referenced against your EPA record. Not a template.
Evidence & Documentation Index
A structured index mapping every RRA element to supporting evidence. When an auditor asks a question, you locate the answer in minutes — not days of searching through files you can't find.
EPA Certification Support Packet
A ready-to-certify file aligned to EPA's AWIA recertification process. Includes the attestation checklist required for submission and a step-by-step submission guide specific to your state.
Audit Defense File
A decision log showing exactly how your RRA was built, what methodology was applied, and why every risk rating is defensible. Regulators can trace every conclusion — and so can you, years from now.
Why not just hire an engineering firm?
It's a legitimate question. Here's the honest answer.
| KORVA Sentinel | Engineering Firm | DIY Internal | |
|---|---|---|---|
| Price | $3,997 flat | $20,000 – $75,000+ | Staff time only — significant and unbilled |
| Delivery timeline | 48 hours from intake submission | 3–6 months — and if you push them to accelerate, add a rush surcharge on top | Unknown — depends entirely on staff capacity |
| Fastest certified path now? | YES — 48 hours from intake | NO — procurement alone is 4–12 weeks minimum. Deadline is past; you're accumulating penalty while they're scheduling site visits. | UNLIKELY — depends on your staff load, and uncertified staff won't know what EPA actually checks for |
| What you provide | 20-minute intake form. We handle the rest. | Months of interviews, site visits, and document gathering | You research the requirements and write every section |
| Regulatory defensibility | HIGH — audit defense file included | HIGH — but you're paying $50K+ for it | VARIABLE — depends on who writes it and whether they know what EPA actually checks |
| Procurement required? | No. Order online in minutes. | RFP, contract negotiation, board approval — 4–12 weeks | No — but staff bandwidth is its own constraint |
| PE-sealed option | Available — quoted separately via email | Yes — included (it's in your $50K) | No — requires a separate PE engagement |
Engineering firms build excellent documents. But you cannot procure, contract, and receive delivery from an engineering firm while the penalty clock is running and the attack window is open. The question now is how fast you can get certified — and documented.
We mapped your compliance status before you called.
KORVA Sentinel maintains 27,575+ water utility records sourced from EPA SDWIS and AWIA federal data. When you submit your intake, we already have your PWSID, your violation history, your population tier, and your current AWIA certification status on file. Your intake adds the operational specifics we can't get from public records. That combination produces a document with the depth of a site-visit assessment — at a fraction of the timeline and cost.
How it works.
Four steps. About 20 minutes of your time. One complete deliverable set.
Purchase
Pay $3,997 via Square. You're routed immediately to the intake form. No procurement process, no calls to schedule, no waiting. Documents in 48 hours from intake submission.
Complete Intake
Answer our structured utility questionnaire — 25 questions, 15–20 minutes. Your answers plus your EPA record data drive the build. We cross-reference your intake against your PWSID record before we write a single page.
We Build
KORVA builds your RRA, evidence index, EPA certification packet, and audit defense file. All four deliverables, 48 hours from intake submission. You receive a secure delivery link when complete.
You Certify
Review your documents, use the included submission checklist, and certify to EPA. Your certification support packet walks through every step. The attestation is yours to make — we make it straightforward.
$71,545 per day.
And 12 states under active attack.
The SDWA civil penalty cap is $71,545 per day (40 CFR §19). That clock started July 1, 2026. It stops the day you certify. Meanwhile, Iranian-affiliated actors are actively exploiting internet-exposed PLCs at water utilities across 12 states — default credentials, open HMI ports, no documented cyber posture on file. CISA AA26-097A, July 2026. There is no pause in the attack campaign and no grace period in the statute.
Questions we hear every time.
Probably not. AWIA §2013 requires a current RRA — one that reflects your system's present posture. If your infrastructure, OT systems, staff, or service area have changed since 2021, your 2021 document may not meet the currency requirement. More importantly: the June 30, 2026 deadline is a new recertification cycle — a separate obligation from whatever was filed previously. If you have a recent (2023–2024) RRA built to AWIA standards, it may qualify. We recommend a $497 Risk Snapshot review before assuming you're covered.
If your internal process is far enough along and will deliver a certification-ready document before June 30 — you're set. Use it. The question is whether the timeline is actually realistic. Most utilities building internally are doing it alongside operational responsibilities, without dedicated compliance staff, and without prior experience writing to AWIA standards. If there's any doubt, the cost of being wrong is $71,545 per day. A $3,997 KORVA build costs less than one day of penalty exposure — and you can use your internal work as intake input. It often strengthens the final document significantly.
AWIA does not require RRAs to be produced by licensed engineers for the federal certification filing — it requires that you certify a current RRA meeting the substantive requirements of §2013. KORVA builds to those substantive requirements: all five threat domains, documented methodology, and a defensible evidence base. The certification attestation is made by your utility — you're affirming the document exists, is current, and meets the standard. Our audit defense file is specifically designed to support that attestation. For utilities required by state regulators or grant programs to have PE-sealed documents, we quote PE sealing separately. Most systems in the 3,301–49,999 population tier do not require a PE seal for the federal AWIA certification itself.
The 25-question intake captures the operational specifics that only you can provide: your infrastructure layout, OT systems, chemical storage, staff capacity, and critical dependencies. Everything else — your PWSID, population tier, service area, violation history, and AWIA compliance record — we already have from our 27,575-record database. Your answers supplement what we know with what public records can't tell us. That combination produces a document with the specificity of a site-visit assessment at a fraction of the time and cost. More complete intake answers produce a stronger document. You can attach supporting materials — previous plans, site diagrams, existing assessments — to strengthen the build further.
Get certified as fast as possible — the penalty clock started July 1, 2026. Every day you're uncertified is $71,545 in potential exposure. Order today, receive your documents in 48 hours, and certify immediately after review. Documented remediation effort matters in any enforcement conversation: showing EPA you acted promptly after the deadline is far better than continuing to do nothing. Most utilities using our package certify within a week of ordering. The certification is yours to complete — we make it as fast and straightforward as possible.
Your ERP is filed. This is the last document between you and certified.
One intake. 48 hours. 4 deliverables. Iranian-affiliated actors are actively targeting water PLCs across 12 states right now (CISA AA26-097A). Get certified, get documented, stop both clocks — no engineering firm, no procurement, no delay.
KORVA Sentinel is a compliance readiness and documentation platform. This page does not constitute legal advice and does not guarantee EPA acceptance, penalty avoidance, or regulatory outcomes. Utilities should verify their specific obligations with EPA, their state primacy agency, and current legal counsel before final certification action. Civil penalty figures reflect the 40 CFR §19 statutory maximum; actual enforcement is at EPA discretion. PE-sealed deliverables are quoted separately — contact us via the purchase flow and note PE-seal in your intake.