To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector. | ChamberLight
Bills · HR 2594
IN COMMITTEE· 119TH CONGRESS
House BillHR 2594Environmental Protection
To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.
INTRO APR 2· LAST ACTION APR 2
READING
13MIN
COSPONSORS
3BIPARTISAN
READER REACTIONS0 TOTAL
NO VOTES YET · BE THE FIRST
Introduced only
LEGISLATIVE PROGRESS
STEP 2 / 8
Introduced
In Committee
Reported
Passed House
Passed Senate
Conference
To President
Became Law
WHAT THE BILL DOES
AI-written
This bill matters because the water systems that provide clean drinking water and manage wastewater are increasingly vulnerable to cyberattacks. A successful attack could disrupt service, compromise water quality, or cause widespread outages, impacting public health and daily life for millions of Americans. Currently, cybersecurity standards for the water sector can be inconsistent or voluntary.
If this bill becomes law, it creates a dedicated organization with specific expertise to develop mandatory, national cybersecurity standards for larger water utilities. This means more consistent and robust protection against cyber threats for essential services. If it doesn't become law, the current approach to water sector cybersecurity, which may be less coordinated and standardized, would likely continue, potentially leaving critical infrastructure more exposed to evolving cyber risks.
KEY PROVISIONS
5AI-extracted
PROVISION 01
Establishes a Water Risk and Resilience Organization (WRRO) and tasks it with developing cybersecurity requirements for larger water systems.
Creates a specific expert body focused solely on securing the water sector's digital infrastructure.
PROVISION 02
Defines "covered water systems" as those serving 3,300 or more people, making them subject to the new cybersecurity rules.
Clarifies which critical water infrastructure must comply with enhanced security standards.
PROVISION 03
Requires the WRRO to develop "cybersecurity risk and resilience requirements" and accompanying implementation plans.
Ensures a systematic approach to identifying and mitigating cyber threats to water utilities.
PROVISION 04
Mandates that the EPA Administrator certify only one WRRO, review its proposed requirements for fairness, and defer to its technical expertise.
Balances regulatory oversight with expert technical judgment to create effective and practical standards.
PROVISION 05
Requires the WRRO to be independent of water system owners and operators and to establish fair procedures for developing rules, public comment, and enforcement.
Aims to ensure that the rules are developed impartially, with public input, and with transparent enforcement.
Referred to the Subcommittee on Water Resources and Environment.
COMMITTEE
APR 2
Referred to the Committee on Transportation and Infrastructure, and in addition to the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
This bill matters because the water systems that provide clean drinking water and manage wastewater are increasingly vulnerable to cyberattacks. A successful attack could disrupt service, compromise water quality, or cause widespread outages, impacting public health and daily life for millions of Americans. Currently, cybersecurity standards for the water sector can be inconsistent or voluntary.
If this bill becomes law, it creates a dedicated organization with specific expertise to develop mandatory, national cybersecurity standards for larger water utilities. This means more consistent and robust protection against cyber threats for essential services. If it doesn't become law, the current approach to water sector cybersecurity, which may be less coordinated and standardized, would likely continue, potentially leaving critical infrastructure more exposed to evolving cyber risks.
KEY PROVISIONS
AI-extracted
high
Establishes a Water Risk and Resilience Organization (WRRO) and tasks it with developing cybersecurity requirements for larger water systems.
Creates a specific expert body focused solely on securing the water sector's digital infrastructure.
high
Defines "covered water systems" as those serving 3,300 or more people, making them subject to the new cybersecurity rules.
Clarifies which critical water infrastructure must comply with enhanced security standards.
med
Requires the WRRO to develop "cybersecurity risk and resilience requirements" and accompanying implementation plans.
Ensures a systematic approach to identifying and mitigating cyber threats to water utilities.
med
Mandates that the EPA Administrator certify only one WRRO, review its proposed requirements for fairness, and defer to its technical expertise.
Balances regulatory oversight with expert technical judgment to create effective and practical standards.
med
Requires the WRRO to be independent of water system owners and operators and to establish fair procedures for developing rules, public comment, and enforcement.
Aims to ensure that the rules are developed impartially, with public input, and with transparent enforcement.
Not later than 270 days after the date of enactment.
EPA Administrator must issue a final rule for selecting and certifying the Water Risk and Resilience Organization (WRRO).
Not later than 90 days after the date on which the WRRO filed the requirement or modification.
EPA Administrator must remand a disapproved cybersecurity requirement or modification to the WRRO with specific recommendations.
GLOSSARY
AI-written
Covered water system
A public water system or wastewater treatment plant that serves 3,300 or more people.
Cyber resilient
The ability of a water system to resist, reduce the impact of, or quickly recover from a computer security attack so it can keep working normally.
Cybersecurity incident
A malicious computer act or suspicious event that disrupts or tries to disrupt the electronic devices and networks a water system needs to operate.
Water Risk and Resilience Organization (WRRO)
A new organization, certified by the EPA, responsible for creating and overseeing cybersecurity rules for certain water systems.
Administrator (of the EPA)
The head of the Environmental Protection Agency, a federal government agency responsible for protecting human health and the environment.
ACTION TIMELINE
3 EVENTS
APR 2, 25
Introduced in House
INTROREFERRAL
APR 2, 25
Referred to the Subcommittee on Water Resources and Environment.
COMMITTEE
APR 2, 25
Referred to the Committee on Transportation and Infrastructure, and in addition to the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.