To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

Environmental Protection

house

senate

president

Introduced on April 10, 2024 by Rick Crawford

Cosponsors

Legislation Details

Establishes a Water Risk and Resilience Organization (WRRO) to develop cybersecurity risk and resilience requirements for the water sector.
Defines key terms including “covered water system,” “cyber resilient,” and “cybersecurity incident.”
Specifies that the Environmental Protection Agency (EPA) Administrator has jurisdiction over the WRRO and mandates the issuance of a final rule for WRRO certification within 270 days of the Act’s enactment.
Outlines the certification process for the WRRO, including demonstrating technical knowledge, experience, and the ability to develop and implement cybersecurity requirements.
Requires the WRRO to propose cybersecurity risk and resilience requirements and implementation plans for approval by the EPA Administrator.
Details the process for approval, disapproval, and amendment of proposed cybersecurity requirements by the EPA Administrator, emphasizing deference to the WRRO’s technical expertise.
Mandates routine monitoring, periodic assessments, and annual reporting by the WRRO on the implementation and effectiveness of cybersecurity requirements.
Allows the WRRO to impose penalties on covered water systems for non-compliance with approved cybersecurity requirements, with a maximum penalty of $25,000 per day.
Provides for review of penalties by the EPA Administrator and outlines the review process.
Includes a savings provision clarifying the WRRO and EPA Administrator’s authority and the relationship with state actions.
States that the WRRO is not a part of the United States Government.
Authorizes appropriations of $5,000,000 for fiscal years 2024 and 2025 to support the WRRO’s activities.

Last updated 8/8/2024