DDW-2025-003131

195 North 1950 West • Salt Lake City, UT Mailing Address: P.O. Box 144830 • Salt Lake City, UT 84114-4830 Telephone [phone] • Fax [phone] • T.D.D. [phone] www.deq.utah.gov Printed on 100% recycled paper
State of Utah

Department of
Environmental Quality

Kimberly D. Shelley Executive Director
DIVISION OF DRINKING WATER Nathan Lunstad, Ph.D., P.E. Director
SPENCER J. COX Governor DEIDRE HENDERSON Lieutenant Governor
January 30, 2025

Tony Spackman Direct Responsible Charge Operator Canyon Meadows Mutual Water UTAH26069 8827 Lupine Rd
Provo, UT 84604
Subject: Compliance with R309-300 Certification Rules for Water Supply Operators Dear Mr. Spackman,

Thank you for bringing your concerns to our attention regarding the operation and security of the surface water treatment plant. Maintaining the quality and quantity of the water supply is our highest priority, and your vigilance as a certified Direct Responsible Charge (DRC) is critical to ensuring compliance with the R309-300 Certification Rules set forth by the State of Utah.
We would like to address the issues raised:
1. Unauthorized Changes to Plant Operations According to R309-300-5(3), all direct responsible charge operators must be certified at a minimum of the grade level of the water system with an appropriate certificate. The
involvement of untrained personnel in making changes to plant operations is a violation of
these rules and poses significant risks to public health and safety. We encourage open communication between the board and the DRC to ensure that the management and operation of the plant remain within regulatory compliance.
2. Access Control and Security
To maintain the integrity of the treatment process, access to the plant should be strictly limited to authorized personnel who have the necessary training and certifications. While R309-300 does not explicitly address access control and security measures, proper operation and maintenance of the water system require limiting access to qualified
individuals only. We recommend an immediate review and revision of access protocols to
align with security best practices. Furthermore, SCADA (Supervisory Control and Data Acquisition) systems must be secured against unauthorized access. Implementing robust cybersecurity measures, including strong password policies and access logs, is essential to protect these critical systems

Page 2
3. Role of Untrained Staff R309-300-5(3) mandates that all direct responsible charge operators be certified at the
appropriate grade level for the water system. Any staff involved in operational activities
must hold the appropriate certifications and be under the direct supervision of the DRC. This requirement ensures the plant’s safe and effective operation and safeguards the public water supply.
Recommendations and Next Steps:
● Establish clear communication protocols between the board and the DRC to ensure alignment on all operational decisions.
● Conduct a thorough review of plant access and implement a controlled access system for both physical and digital infrastructure.
● Provide additional training or certifications for staff as needed to comply with R309-300
requirements.
● Develop and enforce a formal policy restricting unauthorized changes to the plant’s operations.
We appreciate your proactive approach in addressing these critical issues and are committed to
supporting you in maintaining compliance and ensuring the safety and reliability of the water supply. If further assistance or clarification is needed, please do not hesitate to contact us. Sincerely,

Nathan Lunstad Ph.D., P.E. Director Division of Drinking Water
cc: Helen Lau, Utah Division of Drinking Water, [e-mail]
Sarah Page, Utah Division of Drinking Water, [e-mail]

Nathan Lunstad (Jan 30, 2025 10:39 MST)