Sponsors (4)
The bill standardizes and strengthens cybersecurity for mid‑sized water systems via centralized technical standards and funding for training, but it raises compliance costs and penalties, concentrates rulemaking authority outside traditional public agencies, and leaves some smaller systems with less protection.
Covered water systems serving ≥3,300 people will be required to meet standardized cybersecurity and resilience requirements, reducing the risk of service disruptions from cyberattacks.
A single certified technical body (WRRO) will develop best-practice cybersecurity standards, giving smaller systems access to technical expertise they often lack.
Owners and operators get clear compliance schedules and phased rollouts, making implementation planning and budgeting easier.
Owners and operators of covered systems face fines up to $25,000 per day for violations, creating potentially large financial liabilities.
Covered systems serving ≥3,300 people will incur compliance costs and recurring expenses for implementing new cybersecurity requirements and five‑year assessments.
Smaller systems just below the 3,300-person threshold may remain excluded despite similar cybersecurity risks, producing uneven protection across communities.
Based on analysis of 2 sections of legislative text.
Creates a new, EPA-overseen regime that lets the EPA certify one nonprofit or other organization as the Water Risk and Resilience Organization (WRRO). The WRRO would write, file, and help enforce cybersecurity and resilience requirements for drinking water and wastewater systems that serve 3,300 or more people, subject to procedural protections, information-sharing limits, and EPA review. The EPA Administrator must issue a final rule within 270 days to set application and certification standards. The WRRO must include owners/operators among its members, protect sensitive security information, provide notice and opportunities for public comment, and follow fair enforcement and fee allocation rules. Covered water systems could be required to meet WRRO-set cybersecurity rules and face penalties under the regime.
Creates a certified Water Risk and Resilience Organization to set and enforce cybersecurity and resilience requirements for drinking water and wastewater systems serving 3,300+ people, under EPA oversight.
Introduced April 2, 2025 by Rick Crawford · Last progress April 2, 2025