AWIA §2013, EPA SDWA §1433, CISA OT, CIRCIA, and every active state mandate — tracked, evidenced, and certifiable. Includes the Banana Translation feature that turns regulatory language into plain English your entire team can actually use.
One click on the banana icon and every regulation on screen converts from legalese into plain English that operators, board members, and GMs can actually act on. No training manual required.
This is the strategic moat that makes KORVA Sentinel different from every other compliance tool on the market. Competitors sell to procurement. We speak operator.
| Requirement | What it means |
|---|---|
| Risk and Resilience Assessment certification | A written certification to the EPA Administrator of the completion of a risk and resilience assessment under §1433(a). You fill out the RRA paperwork and tell EPA you did it. EPA doesn't take the doc — just the sign-off that says it's done. |
| Cybersecurity risk coverage | Assessment shall include risks to the cybersecurity of the system, including electronic, computer, or other automated systems utilized by the system. Your SCADA, PLCs, HMIs, and any computer that runs your water system needs to be in the assessment. That includes the laptop your vendor uses to log in remotely. |
| Emergency Response Plan integration | The ERP shall be updated to reflect findings of the assessment and certified within 6 months of RRA completion. After you finish the RRA, you have 6 months to update your emergency plan to match. If your RRA is June 30, your ERP is due December 31. |
| Civil penalty exposure | Violation of §1433 may result in civil penalties under SDWA §1414 not to exceed the maximum penalty per day of violation. If you miss the deadline or certify something false, EPA can charge you $69,733 per day — starting from the date you were supposed to comply. |
Risk & Resilience Assessment and Emergency Response Plan tracking with deadline-aware certification workflow. Pre-mapped templates for systems under 50,000. EPA certification packet in minutes.
Default password elimination. OT/IT segmentation. MFA on remote access. Asset inventory. ICS-CERT advisory tracking. Full WaterISAC Fundamentals coverage, mapped to your devices.
NY DOH Appendix 5-E. NY DEC 6 NYCRR. NY PSC Part 1200. Indiana SEA 459. Texas TCEQ §290. Every active state mandate and every bill in committee — so you're never blindsided.
Pre-built incident workflows with timestamped escalation, regulator-ready notice templates, and decision trees that walk you through "is this a covered incident?" in real time.
AXIOM is trained on the full federal and state water-cyber regulatory corpus — and on your specific utility profile. Ask anything in plain English. Get answers tied to your actual deadlines.
Every artifact a regulator can ask for — organized, versioned, and producible in under five minutes. Asset inventories. Credential policies. Training records. Certification packets.
Start where you are. Diagnose, plan, then run the system that keeps you compliant every cycle.
Know exactly where you stand against every federal and state mandate that applies to your utility — in 24 hours, without a consultant.
Live evidence tracking, vendor risk monitoring, incident-readiness workflows, and AXIOM AI advisor — keeping you compliant on every cycle.
Layers 01 + 02 packaged for the June 30 recertification deadline. Self-service or add a licensed PE seal.