THE SYSTEM VIOLATED THE SDWA BY FAILING TO CERTIFY TO EPA THAT IT HAD CONDUCTED A VULNERABILITY ASSESSMENT (VA), AND FAILED TO SUBMIT A COPY TO EPA. THE ORDER REQUIRES THEM TO CERTIFY AND SUBMIT THE VA WITHIN 30 DAYS OF RECEIPT AND TO INCORPORATE THE RESULTS OF THE VA IN THEIR EMERGENCY RESPONSE PLAN WITHIN 6 MONTHS OF THE COMPLETION OF THE VA.