H.R. 2594

119th CONGRESS 1st Session

To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

IN THE HOUSE OF REPRESENTATIVES · April 2, 2025 · Sponsor: Mr. Crawford

Table of contents

• H.R. 2594
  • SEC. 1. Water risk and resilience organization

SEC. 1. Water risk and resilience organization

• (a) Definitions
  • In this section:
    • The term Administrator means the Administrator of the Environmental Protection Agency.
    • The term covered water system means—
    • The term cybersecurity incident means a malicious act or suspicious event that disrupts, or attempts to disrupt, the operation of programmable electronic devices and communication networks, including hardware, software, and data that are essential to the cyber resilient operation of a covered water system.
    • The term cybersecurity risk and resilience requirement means a requirement that provides for the cyber resilient operation of a covered water system and the cyber resilient design of planned additions or modifications to a covered water system.
    • The terms and mean the organization certified by the Administrator under subsection (c). Water Risk and Resilience Organization,WRRO
• (b) Applicability
  • Not later than 270 days after the date of enactment of this Act, the Administrator shall issue a final rule to carry out this section, including regulations for the selection and certification of the WRRO under subsection (c).
• (c) Certification
  • (1) In general
    • Following the issuance of the final rule under subsection (b)(1), any organization may submit an application to the Administrator, at such time, in such manner, and containing such information as the Administrator may require, for certification as the Water Risk and Resilience Organization.
  • (2) Requirements
    • The Administrator shall certify not more than 1 organization that submitted an application under paragraph (1) as the Water Risk and Resilience Organization if the Administrator determines that the organization—
      • demonstrates advanced technical knowledge and expertise in the operations of covered water systems;
      • is comprised of 1 or more members with relevant experience as owners or operators of covered water systems;
      • has demonstrated the ability to develop and implement cybersecurity risk and resilience requirements that provide for an adequate level of cybersecurity risk and resilience for a covered water system;
      • is capable of establishing measures, in line with prevailing best practices, to secure sensitive information and to protect sensitive security information from public disclosure; and
      • has established rules that—
        • (i) require that the organization be independent of the users, owners, and operators of a covered water system, with balanced and objective stakeholder representation in the selection of directors of the organization and balanced decision making in any committee or subordinate organizational structure;
        • (ii) require that the organization allocate reasonable dues, fees, and other charges among end-users for all activities under this section;
        • (iii) provide just and reasonable procedures for enforcement of cybersecurity risk and resilience requirements and the imposition of penalties in accordance with subsection (f), including limitations on activities, functions, or operations, or other appropriate sanctions; and
        • (iv) provides for reasonable notice and opportunity for public comment, due process, openness, and balancing of interests in developing cybersecurity risk and resilience requirements and otherwise exercising duties described in this section.
• (d) Cybersecurity risk and resilience requirements
  • (1) In general
    • (A) Proposed requirements
      • The WRRO shall file with the Administrator each cybersecurity risk and resilience requirement or modification to such a requirement that the WRRO proposes to be made effective under this section.
    • (B) Implementation plan
      • (i) For each proposed cybersecurity risk and resilience requirement or modification to such a requirement filed pursuant to subparagraph (A), the WRRO shall file an implementation plan, including the schedule for implementation, which may include a specified date, by which covered water systems shall achieve compliance with all of the cybersecurity risk and resilience requirement or modification to such a requirement. The implementation schedule may account for a phased rollout of the requirement, recognizing that the requirement may not apply, in totality, to all covered water systems.
      • (ii) The enforcement date proposed by the WRRO in the implementation plan under clause (i) shall provide a reasonable implementation period for covered water systems to meet the requirements under the implementation plan.
  • (2) Approval
    • (A) In general
      • Notwithstanding paragraph (3)(A), the Administrator shall approve a proposed cybersecurity risk and resilience requirement or modification to such a requirement, including the accompanying implementation plan filed under paragraph (1), if the Administrator determines that the requirement is just, reasonable, and not unduly discriminatory or preferential.
    • (B) Deference to wrro
      • The Administrator shall defer to the technical expertise of the WRRO with respect to the content of a proposed cybersecurity risk and resilience requirement or modification to such a requirement.
  • (3) Disapproval of requirement
    • (A) In general
      • Notwithstanding paragraph (2)(A), if the Administrator disapproves, in whole or in part, a filed cybersecurity risk and resilience requirement or modification to such a requirement, the Administrator shall remand such requirement to the WRRO and provide to the WRRO specific recommendations that would lead to the approval of the cybersecurity risk and resilience requirement or modification to such requirement under paragraph (2).
    • (B) Timeline
      • The Administrator shall remand to the WRRO a proposed cybersecurity risk and resilience requirement or modification to such a requirement disapproved under subparagraph (A), including the submission of the specific recommendations required under that subparagraph, not later than 90 days after the date on which the WRRO filed the requirement or modification with the Administrator under paragraph (1)(A).
    • (C) Response and approval
      • (i) On receipt of the remand of a proposed cybersecurity risk and resilience requirement or modification to such a requirement and receipt of the specific recommendations of the Administrator pursuant to subparagraph (A), the WRRO shall—
      • accept the recommendations of the Administrator and resubmit an amended proposed cybersecurity risk and resilience requirement or modification to such a requirement consistent with those recommendations;
      • provide to the Administrator and a reason why the recommendation was not accepted; or
      • withdraw the proposed cybersecurity risk and resilience requirement or modification to such a requirement.
      • (ii) If the WRRO files an amended proposed cybersecurity risk and resilience requirement or modification to such a requirement under clause (i)(I) the Administrator shall review such proposed requirement or modification and determine whether to approve such amended requirement or modification in accordance with paragraph (2)(A).
      • (iii) On receipt of a response from the WRRO pursuant to clause (i)(II), the Administrator shall—
      • approve the proposed cybersecurity risk and resilience requirement or modification to such a requirement; or
      • invite the WRRO to engage in negotiations with the Administrator to reach consensus to address the specific recommendation made by the Administrator under subparagraph (A).
  • (4) Effective date
    • The effective date of an approved cybersecurity risk and resilience requirement or modification to such a requirement proposed under this subsection shall be set by the Administrator in accordance with the proposed implementation plan submitted by the WRRO under paragraph (1).
  • (5) Submission of specific requirement
    • The Administrator, on the motion of the Administrator or on complaint may, following consultation with the WRRO, order the WRRO to file with the Administrator under paragraph (1) a proposed cybersecurity risk and resilience requirement or modification to such as requirement that addresses a specific matter if the Administrator determines there is a reasonable basis to conclude the existing cybersecurity risk and resilience requirements are insufficient, when implemented by covered water systems, to protect, defend, or recover from or mitigate a cybersecurity incident.
  • (6) Conflict
    • (A) In general
      • The final rule adopted under subsection (b)(2) shall include specific processes for the identification and timely resolution of any conflict between a cybersecurity risk and resilience requirement and any function, rule, order, tariff, or agreement accepted, approved, or ordered by the Administrator that is applicable to a covered water system.
    • (B) Compliance
      • A covered water system shall continue to comply with a function, rule, order, tariff, or agreement described in subparagraph (A) unless—
        • (i) the Administrator finds a conflict exists between a cybersecurity risk and resilience requirement and any function, rule, order, tariff, or agreement approved or otherwise accepted or ordered by the Administrator;
        • (ii) the Administrator orders a change to that function, rule, order, tariff, or agreement; and
        • (iii) the ordered change becomes effective.
    • (C) Modification
      • If the Administrator determines that a cybersecurity risk and resilience requirement needs to be changed as a result of a conflict identified under this paragraph, the Administrator shall direct the WRRO to propose and file with the Administrator a modified cybersecurity risk and resilience requirement pursuant to paragraphs (1) through (4) of this section.
• (e) Water system monitoring and assessment
  • To aid in the development and adoption of appropriate and necessary cybersecurity risk and resilience requirements and modifications to such requirements, the WRRO shall—
    • routinely monitor and conduct periodic assessments of the implementation of cybersecurity risk and resilience requirements approved by the Administrator under subsection (d) and the effectiveness of cybersecurity risk and resilience requirements for covered systems, including by requiring—
      • annual self-attestations of compliance with such cybersecurity risk and resilience requirements by covered water systems; and
      • assessments of the covered water system by the WRRO or by a third party designated by the WRRO not less frequently than every 5 years of compliance by covered water systems with such cybersecurity risk and resilience requirements; and
    • annually submit to the Administrator a report describing the implementation of cybersecurity risk and resilience requirements approved by the Administrator under subsection (d) and the effectiveness of cybersecurity risk and resilience requirements for covered water systems subject to the requirements that reports under this paragraph—
      • shall only include aggregated or anonymized findings, observations, and data; and
      • shall not contain any sensitive security information.
• (f) Enforcement
  • (1) In general
    • The WRRO may, subject to paragraphs (2) through (5), impose a penalty on the owner or operator of a covered water system for a violation of a cybersecurity risk and resilience requirement if the WRRO, after notice and an opportunity for a consultation and a hearing—
      • finds that the owner or operator of a covered system has violated or failed to comply with the cybersecurity risk and resilience requirement; and
      • files notice of the finding under subparagraph (A) and the record of the proceeding with the Administrator.
  • (2) Notice
    • (A) In general
      • The WRRO may not impose a penalty on the owner or operator of a covered water system under paragraph (1) unless the WRRO provides the owner or operator with—
        • (i) notice of the alleged violation of or failure to comply with a cybersecurity risk and resilience requirement; and
        • (ii) an opportunity for a consultation and a hearing prior to finding that the owner or operator has violated or failed to comply with the applicable cybersecurity risk and resilience requirement under paragraph (1)(A).
    • (B) Access to counsel
      • The owner or operator of a covered water system may engage legal counsel to take part in the consultation and hearing described in subparagraph (A)(ii).
  • (3) Effective date of penalty
    • A penalty imposed under paragraph (1) may take effect not earlier than 31 days after the date on which the WRRO files with the Administrator notice of the penalty and the record of proceedings under subparagraph (B) of that paragraph.
  • (4) Imposition of penalty
    • (A) Maximum amount
      • A penalty imposed under paragraph (1) shall not exceed $25,000 per day the applicable owner or operator is in violation of a cybersecurity risk and resilience requirement approved by the Administrator under subsection (d).
    • (B) Limitation
      • No penalty may be imposed on a covered water system under any other provision of law for a violation of a cybersecurity risk and resilience requirement approved by the Administrator under subsection (d).
    • (C) Use of penalty funds
      • Any penalties collected under this subsection shall be returned to the WRRO to support training initiatives and other resource capabilities of the WRRO in carrying out the duties of the WRRO under this section.
  • (5) Review by administrator
    • (A) In general
      • The Administrator may review a penalty imposed under paragraph (1).
    • (B) Application for review
      • The Administrator may conduct a review under subparagraph (A) on the motion of the Administrator or on application by an owner or operator of a covered water system that is the subject of a penalty imposed under paragraph (1), if such application is filed not later than 30 days after the date on which the notice of that penalty is filed with the Administrator.
    • (C) Stay of penalty
      • A penalty under review by the Administrator under this paragraph may only be stayed if, on the motion of the Administrator or on application by the owner or operator of the covered water system that is the subject of the penalty, the Administrator separately orders the stay of the penalty.
    • (D) Proceedings
      • (i) In any proceeding to review a penalty imposed under paragraph (1), the Administrator, after notice and, subject to clause (ii), opportunity for a hearing, shall by order affirm, set aside, reinstate, or modify the penalty, and, if appropriate, remand to the WRRO for further proceedings.
      • (ii) A hearing under clause (i) may consist solely of the record before the WRRO and an opportunity for the presentation of supporting reasons to affirm, modify, or set aside the applicable penalty.
      • (iii) The Administrator shall act expeditiously in administering all proceedings under this paragraph.
• (g) Savings provisions
  • (1) Authority
    • Nothing in this section authorizes the WRRO or the Administrator to develop binding cybersecurity risk and resilience requirements for covered water systems, except as specifically provided for in this Act.
  • (2) Rule of construction
    • Nothing in this section preempts any authority of any State to take action to ensure the safety, adequacy, and resilience of water service within that State, as long as such action is not inconsistent with or in conflict with any cybersecurity risk and resilience requirement.
• (h) Status of WRRO
  • The WRRO is not a department, agency, or instrumentality of the United States Government.
• (i) Authorization of appropriations
  • There is authorized to be appropriated to carry out this section $10,000,000 to remain available to the WRRO until expended.