THE SYSTEM VIOLATED THE SDWA BY FAILING TO CERTIFY THAT IT HAD CONDUCTED A VULNERABILITY ASSESSMENT(va), AND FAILED TO SUBMIT THE VA TO EPA. THE ORDER REQUIRES THEM TO CERTIFY AND SUBMIT THE VA TO EPA WITHIN 30 DAYS OF RECEIPT, AND TO INCORPORATE THE RESULTS OF THE VA INTO THEIR EMERGENCY RESPONSE PLAN WITHIN 6 MONTHS OF COMPLETION OF THE VA.