Sponsors (2)
Official title: Amend the Safe Drinking Water Act and the Federal Water Pollution Control Act to establish or modify cybersecurity requirements for drinking water and wastewater systems, and for other purposes.
Introduced August 7, 2026 by Adam Schiff · Last progress August 7, 2026
The bill strengthens cybersecurity and resilience for water systems through targeted funding, reporting, and oversight—reducing risks to public health and enabling federal support—while imposing compliance costs, administrative and coordination burdens, and privacy/exemptions that may disproportionately strain smaller or under-resourced systems.
Owners and operators of public water and wastewater systems (especially small and rural utilities) will receive federal grants and technical assistance (authorized $300M/year FY2027–2032) to fund vulnerability assessments, cybersecurity upgrades, and resilience projects.
Customers and communities (including hospitals and urban and rural residents) will face a lower risk of service interruptions, contamination, and public-health impacts because improved cybersecurity, emergency planning, and incident reporting enable faster detection and response to cyber incidents.
Large community water systems and wastewater treatment plants will be covered by federal cybersecurity reporting and incident-sharing requirements, improving federal detection, coordination, and support during cyber incidents.
Small and under-resourced community water systems will incur new compliance costs to perform state‑approved cybersecurity assessments, maintain and revise plans, and submit certifications and incident reports, straining limited budgets.
Uneven state capacity and variable resources across jurisdictions could produce inconsistent implementation, ongoing security gaps for smaller systems, and unequal protection for communities (especially rural and Tribal areas).
Exempting assessments and emergency plans from FOIA and sharing incident/ransom-payment reports across agencies reduces public access and raises confidentiality and privacy concerns about sensitive operational or financial information.
Based on analysis of 3 sections of legislative text.
Sets mandatory cybersecurity risk assessments, five‑year reviews, emergency‑plan requirements, and an EPA national resilience program with grants for drinking water and large wastewater treatment works.
Makes community water systems and large wastewater treatment plants follow new, regular risk-and-resilience assessments and emergency-response plan rules that explicitly cover cybersecurity risks and include State-approved methods. Creates a new EPA-administered national treatment-works risk and resilience program with grant and technical-assistance authority, reporting and oversight, and requires information-sharing of covered cyber incidents with EPA from the federal Cybersecurity Agency. Requires covered community water systems and treatment works to document and schedule cybersecurity countermeasures, conduct periodic reviews (including a required five-year review and certification for drinking water), and incorporates these requirements into Clean Water State Revolving Fund project selection and State planning. Adds reporting and enforcement tools and narrows certain enforcement exceptions for State/local governments when they report covered incidents for water systems they operate.