Specifications include, but are not limited to: A. Risk and Resilience Assessment Each community water system serving a population of greater than 3,300 persons shall assess the risks to, and resilience of, its system. Such an assessment shall include: 1. the risk to the system from malevolent acts and natural hazards; 2. the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system; 3. the monitoring practices of the system; 4. the financial infrastructure of the system; 5. the use, storage, or handling of various chemicals by the system; and 6. the operation and maintenance of the system. The assessment may include an evaluation of capital and operational needs for risk and resilience management for the system. B. Emergency Response Plan No later than six months after certifying completion of its risk and resilience assessment, each system must prepare or revise, where necessary, an emergency response plan that incorporates the findings of the assessment. The plan shall include: 1. Strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system; 2. Plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water; 3. Actions, procedures and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes and construction of flood protection barriers; and 4. Strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.