The Northern Kentucky Water District (District) serves a population of approximately 276,000. The District owns and operates three surface water treatment plants and the service area encompasses over 1,000 miles of mains. Like other large water utilities in the U.S., the District conducted a Vulnerability Assessment (VA) as required by the Public Health and Bioterrorism Act of 2002. It will be a challenge for the District to implement the recommendations that resulted from the VA. In addition to the considerable capital outlay needed to meet these recommendations, changes in policies and procedures will need to be implemented. The paper discusses three primary recommendations from the completed VA for the protection of critical assets: improve the physical protection; implement security policies and procedures; and, develop and implement an early warning program.