THE SYSTEM VIOLATED THE SDWA BY FAILING TO CERTIFY TO EPA THAT IT HAD CONDUCTED A VULNERABILITY ASSESSMENT (VA), AND FAILED TO SUBMIT THE VA TO EPA. THE ORDER REQUIRES THEM TO CERTIFY AND SUBMIT THE ASSESSMENT WITHIN 30 DAYS OF RECEIPT AND TO CERTIFY THAT THEY HAVE INCORPORATED THE RESULTS OF THE VA INTO THEIR EMERGENCY RESPONSE PLAN WITHIN 6 MONTHS OF COMPLETION OF THE VA.