119 S5368 IS: Water Cyber Shield Act of 2026
U.S. Senate
2026-08-07
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.Short title; table of contents
(a)This Act may be cited as the Water Cyber Shield Act of 2026
. (b)The table of contents for this Act is as follows:
Sec. 1. Short title; table of contents.
TITLE I—Drinking water infrastructure
Sec. 101. Community water system risk and resilience.
Sec. 102. Cybersecurity requirements for drinking water systems.
Sec. 103. Reauthorization of midsize and large drinking water system infrastructure resilience and sustainability program.
Sec. 104. Drinking water security assistance.
TITLE II—Clean water infrastructure
Sec. 201. Treatment works risk and resilience.
Sec. 202. Cybersecurity requirements for treatment works.
Sec. 203. Reauthorization of the clean water infrastructure resiliency and sustainability program.
Sec. 204. Clean water security assistance.
TITLE III—Cyber incident reporting obligations
Sec. 301. Cyber incident reporting.
<enum>I</enum><header>Drinking water infrastructure</header>
<section id="idefcac947006a4a8dbe4e59dacbc5930e"><enum>101.</enum><header>Community water system risk and resilience</header><text display-inline="no-display-inline">Section 1433 of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300i-2">42 U.S.C. 300i–2</external-xref>) is amended—</text> <paragraph commented="no" display-inline="no-display-inline" id="ida439f0cee3844b7aad4e8b2ea2c943e8"><enum>(1)</enum><text>in subsection (a)—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id2a8e1bc90e254a1c939e21211a33eece"><enum>(A)</enum><text display-inline="yes-display-inline">in paragraph (1)(A)—</text> <clause commented="no" display-inline="no-display-inline" id="id910b44331703475bb4f17bacf24f3c55"><enum>(i)</enum><text>in clause (ii), by striking <quote>storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which</quote> and inserting <quote>and storage and distribution facilities that</quote>;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id1ad7e17c2a2d48fda5341fdb61446448"><enum>(ii)</enum><text>in clause (v), by striking <quote>and</quote> at the end; and</text></clause> <clause commented="no" display-inline="no-display-inline" id="ida66e56c92e8d45adbd2f49cff09ca283"><enum>(iii)</enum><text>by adding at the end the following:</text>
<quoted-block style="OLC" id="idD4883491F74D4BEE89A1C71A0E0E17A0" act-name="">
<clause id="id69CF9B9214164412998D072D74124C38"><enum>(vii)</enum><text>using a method approved by the applicable State, the risks to electronic, computer, or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph (A) or (B) of paragraph (2); and</text></clause><after-quoted-block>; and</after-quoted-block></quoted-block></clause></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id05e4e9d92eb34ba794be99921a0606a8"><enum>(B)</enum><text>by striking paragraphs (3) through (5) and inserting the following:</text>
<quoted-block id="idD23C219E34AE4C55A3DBC167B7925FDC" style="OLC" act-name="">
<paragraph id="id16AF806E553346DF917D6327A2546B7D"><enum>(3)</enum><header>Review and revision</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id773bc25554be4df194fbbeba9f9d805a"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">Each community water system described in paragraph (1) shall, not less frequently than once every 5 years, review and, if necessary, revise the assessment.</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id7ddd5d2f312b4adbbb578057b6e29058"><enum>(B)</enum><header>Certification to the Administrator or State</header><text display-inline="yes-display-inline">On completion of the review under subparagraph (A), a community water system described in paragraph (1) shall submit to the applicable State a certification that the community water system has reviewed and, if applicable, revised the assessment.</text></subparagraph></paragraph><after-quoted-block>;</after-quoted-block></quoted-block></subparagraph></paragraph>
<paragraph id="idac32f66f8e274254915409411fe5409e"><enum>(2)</enum><text>in subsection (b)—</text> <subparagraph commented="no" display-inline="no-display-inline" id="idb1055a8ae1b44f169542da2bdd16818a"><enum>(A)</enum><text display-inline="yes-display-inline">by redesignating paragraphs (1) through (4) as subparagraphs (A) through (D), and indenting appropriately;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id576313bfa1a44118844c4757e06e94bd"><enum>(B)</enum><text>in the matter preceding subparagraph (A) (as so redesignated), by striking <quote>Each community water system</quote> in the first sentence and all that follows through <quote>The emergency response plan</quote> in the third sentence and inserting the following:</text> <quoted-block id="id169B5E2A94A948BB9233C4F7DB13837C" style="OLC" act-name=""> <paragraph id="id900FE3A5C681406D80F68FC4947E563E"><enum>(1)</enum><header>In general</header><text>Each community water system serving a population greater than 3,300 shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection (a) for that community water system (or any revisions to that assessment).</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="idd092461b85b447658555acd0b4f60836"> <enum>(2)</enum> <header>Required inclusions</header> <text display-inline="yes-display-inline">The emergency response plan of a community water system under paragraph (1)</text> </paragraph><after-quoted-block>;</after-quoted-block></quoted-block></subparagraph> <subparagraph id="id3ab9bef78a114d1f8b26700e4efeac6f"><enum>(C)</enum><text>in paragraph (2) (as so designated)—</text>
<clause commented="no" display-inline="no-display-inline" id="ida7f49e20728f4c689625d67898505e48"><enum>(i)</enum><text display-inline="yes-display-inline">in subparagraph (A) (as so redesignated), by striking <quote>and cybersecurity</quote>;</text></clause> <clause commented="no" display-inline="no-display-inline" id="id410a42338a7d4fa4bc6d60edfe8e14ad"><enum>(ii)</enum><text>in subparagraph (C) (as so redesignated), by striking <quote>and</quote> at the end;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="idb8838b15fffc42d483a2c170b855102b"><enum>(iii)</enum><text>in subparagraph (D) (as so redesignated), by striking the period at the end and inserting <quote>; and</quote>; and</text></clause> <clause commented="no" display-inline="no-display-inline" id="idc105670cb50c40a8abad1814679c5c3c"><enum>(iv)</enum><text>by adding at the end the following:</text>
<quoted-block style="OLC" display-inline="no-display-inline" id="id63f884a002df4d02a0f8dbe317290966">
<subparagraph id="id49d36a58acca413482b8cd17c0be25d8"><enum>(E)</enum><text>countermeasures that the system intends to adopt or, if already in use, maintain to mitigate the significant cybersecurity risks identified under subsection (a)(1)(A)(vii), including a schedule the system intends to follow to adopt any countermeasures not already in use by the system.</text></subparagraph><after-quoted-block>; and</after-quoted-block></quoted-block></clause></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="idcce9f98c8e7d427a8fb3d30400d67e5d"><enum>(D)</enum><text>by adding at the end the following:</text>
<quoted-block id="id812418FCE862432E9D49EF26232E9536" style="OLC" act-name="">
<paragraph commented="no" display-inline="no-display-inline" id="idbde0e2f428ef435eb006f9bbbd53728d"><enum>(3)</enum><header>Review; revision</header><text display-inline="yes-display-inline">A community water system serving a population greater than 3,300 shall review and, as necessary, revise the emergency response plan prepared under this subsection not less frequently than once every 5 years.</text></paragraph><after-quoted-block>;</after-quoted-block></quoted-block></subparagraph></paragraph> <paragraph id="id11ae438c827148519673f2152358e0f1"><enum>(3)</enum><text>by striking subsection (f);</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id5c77e866f682409ca060af07cde7b59f"><enum>(4)</enum><text>by redesignating subsections (c), (d), and (e) as subsections (d), (e), and (f), respectively;</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id6592f09753a34fd489ad3ed6c8768d42"><enum>(5)</enum><text display-inline="yes-display-inline">by inserting after subsection (b) the following:</text>
<quoted-block style="OLC" id="id0A9E30EDE1B243549D09C1A72CD6336A" act-name="">
<subsection id="id07A8A29B6530480F8802DA8D7F184CA9"><enum>(c)</enum><header>Submission and approval of assessments and plans</header>
<paragraph commented="no" display-inline="no-display-inline" id="idd02e13c02cb94516afa4839e60345e37"><enum>(1)</enum><header display-inline="yes-display-inline">Submission</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id4cabd27590e243ecb24637d0876d10f6"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Each community water system subject to subsections (a) and (b) shall, during a cybersecurity assessment pursuant to section 1433A(b)(1)(A), provide to the applicable State—</text> <clause commented="no" display-inline="no-display-inline" id="idd9901b13ea404103a1f68ff288f33f49"><enum>(i)</enum><text>the portion of the assessment prepared under subsection (a) that is described in paragraph (1)(A)(vii) of that subsection (including any revision to that portion of the assessment); and</text></clause>
<clause commented="no" display-inline="no-display-inline" id="idf425a32f7d8240b388145b83133d3327"><enum>(ii)</enum><text>the portion of the emergency response plan prepared under subsection (b) that is described in paragraph (2)(E) of that subsection (including any revision to that portion of the emergency response plan).</text></clause></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id397dde628cf8463e9401ac1d79e3c5fb"><enum>(B)</enum><header>Limitation</header><text>Neither the Administrator nor a State may require the submission of any portion of an assessment under subsection (a) or an emergency response plan under subsection (b) that is not described in subparagraph (A).</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id1c33ceb947ad4840bf975cc0ab11566f"><enum>(2)</enum><header>Review; approval</header>
<subparagraph commented="no" display-inline="no-display-inline" id="idd9b80e3efe714ed8b9cbb3417be43500"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A State shall—</text> <clause commented="no" display-inline="no-display-inline" id="ide4e32adf44c94b1196b98e8dc7a6d44c"><enum>(i)</enum><text display-inline="yes-display-inline">review the portions of the assessments and emergency response plans of community water systems submitted pursuant to paragraph (1)(A) for conformity with the requirements of this section and section 1433A; and</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id2a47e07f22304adb8a283843a746816b"><enum>(ii)</enum>
<subclause commented="no" display-inline="yes-display-inline" id="id521639c4d78547bf8b2f4c178c7d5df2"><enum>(I)</enum><text>approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A); or</text></subclause> <subclause commented="no" display-inline="no-display-inline" indent="up1" id="ide2a1d8b0e7e94e6e8e5172541623799c"><enum>(II)</enum><text>disapprove of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) if the Administrator or State, as applicable, determines that—</text>
<item commented="no" display-inline="no-display-inline" id="id8db4bc0d9793447b9077a973342cf6f2"><enum>(aa)</enum><text display-inline="yes-display-inline">the submitted portions of the assessment or emergency response plan are missing, incomplete, or fail to conform with the requirements of this section or section 1433A; or</text></item> <item commented="no" display-inline="no-display-inline" id="id1e0138cf63b34fbbb8c4cf78966cb8f0"><enum>(bb)</enum><text>the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the Administrator under section 1433A(c).</text></item></subclause></clause></subparagraph>
<subparagraph id="id3fd53e43c87046f6abc80def112eb098"><enum>(B)</enum><header>Enforcement</header><text>A State may use appropriate enforcement mechanisms under this title or the appropriate State authority to remedy noncompliance, as described in items (aa) and (bb) of subparagraph (A)(ii)(II), under this subsection.</text></subparagraph></paragraph> <paragraph id="id9e76300d38c7473c9c362a9a3fea1214"><enum>(3)</enum><header>Submitted documentation</header> <subparagraph commented="no" display-inline="no-display-inline" id="id67a6a68572f14ec5ab07e165e9dc270e"><enum>(A)</enum><header display-inline="yes-display-inline">Applicability of FOIA</header><text>Any information submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the <quote>Freedom of Information Act</quote>), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idd119a62eb35d46f5ab529b7126127738"><enum>(B)</enum><header>Treatment of documentation</header>
<clause commented="no" display-inline="no-display-inline" id="idf8e673f5ca19445583bc71fedfcc1d02"><enum>(i)</enum><header>Protocol development</header><text display-inline="yes-display-inline">Not later than 180 days after the date of enactment of the <short-title>Water Cyber Shield Act of 2026</short-title> and before any cybersecurity assessments are carried out pursuant to section 1433A(b)(1)(A), the Administrator, in consultation with appropriate Federal law enforcement and intelligence officials, shall develop such protocols as are necessary to protect any information provided under paragraph (1)(A) to the State.</text></clause> <clause id="id5d41492ed7f840678e4cad50edc7d920"><enum>(ii)</enum><header>Requirements for protocol</header><text>The protocol developed under clause (i) shall ensure that—</text>
<subclause commented="no" display-inline="no-display-inline" id="id061863df987849349048296538ac771b"><enum>(I)</enum><text display-inline="yes-display-inline">each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) are kept in a secure location;</text></subclause> <subclause commented="no" display-inline="no-display-inline" id="idc59375d8fb1842d5b4b77bda91d6d9a9"><enum>(II)</enum><text>only individuals designated by the applicable State may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A); and</text></subclause>
<subclause commented="no" display-inline="no-display-inline" id="id83f9f75b62bc42d29c91c2e3b35a7cd1"><enum>(III)</enum><text>no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A) shall be made available to anyone other than an individual designated by the applicable State.</text></subclause></clause> <clause id="id235866bddb224ad2a7d2f09aa2215007"><enum>(iii)</enum><header>Savings provision</header><text>Nothing in this subparagraph authorizes any person to withhold any information from Congress or from a committee or subcommittee of Congress.</text></clause></subparagraph></paragraph></subsection><after-quoted-block>;</after-quoted-block></quoted-block></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id407bb12551a6410bb8d62e418923077c"><enum>(6)</enum><text>in subsection (e) (as so redesignated), by striking <quote>a certification of such assessment or plan is submitted to the Administrator</quote> and inserting <quote>an assessment or plan is submitted to the applicable State,</quote>; and</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id754db4d5b6f94a9392c6cc92ea9099c7"><enum>(7)</enum><text display-inline="yes-display-inline">by striking subsection (h) and inserting the following:</text>
<quoted-block id="idBAECEEBCB61344D09CD6370705531566" style="OLC" act-name="">
<subsection id="id5C949DB45C7742B8BB48382D0BD4A93D"><enum>(h)</enum><header>Definitions</header><text>In this section:</text> <paragraph commented="no" display-inline="no-display-inline" id="id93938306c14745d995288d421bd1e80c"><enum>(1)</enum><header>Natural hazard</header><text display-inline="yes-display-inline">The term <term>natural hazard</term> means a natural event that threatens the functioning of a community water system, including an earthquake, tornado, flood, hurricane, wildfire, and hydrologic changes.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="idf3beda8fa2364342a3c033abab1e8b9c"><enum>(2)</enum><header>Resilience</header><text display-inline="yes-display-inline">The term <term>resilience</term> means the ability of a community water system or an asset of a community water system to adapt to or withstand the effects of a malevolent act or natural hazard without interruption to the asset's or system's function, or if the function is interrupted, to rapidly return to a normal operating condition.</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id5549d30f300d4cb9bb67c4008f6fb739"><enum>(3)</enum><header>State</header> <subparagraph commented="no" display-inline="no-display-inline" id="idff138180e43643eebf41f4a01cd6c179"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>The term <term>State</term> means a State that has assumed primary enforcement responsibility pursuant to section 1433A(e).</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idbad09f022a6f4472b5509fd54d9421b4"><enum>(B)</enum><header>Enforcement by the Administrator</header><text display-inline="yes-display-inline">If a State has not assumed primary enforcement responsibility pursuant to section 1433A(e), the term <term>State</term> shall, for purposes of obligations of the State under this subsection, be considered to be a reference to the Administrator.</text></subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block></paragraph></section> <section id="id92808131a65144c998c55f7a972f4689"><enum>102.</enum><header>Cybersecurity requirements for drinking water systems</header> <subsection commented="no" display-inline="no-display-inline" id="idb91c3fad4ae34e5e91ce59f2a6961a29"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">The Safe Drinking Water Act is amended by inserting after section 1433 (<external-xref legal-doc="usc" parsable-cite="usc/42/300i-2">42 U.S.C. 300i–2</external-xref>) the following:</text>
<quoted-block style="OLC" id="id1A779C84910747928A2F09C79A4EB0CC" act-name="">
<section section-type="subsequent-section" id="id7CD846ACA99B45B2AD5437F73C58B2E2"><enum>1433A.</enum><header>Cybersecurity requirements</header>
<subsection commented="no" display-inline="no-display-inline" id="id4f8b7a2b603b4595b37f66ba57df9cb9"><enum>(a)</enum><header display-inline="yes-display-inline">Definitions</header><text>In this section:</text> <paragraph commented="no" display-inline="no-display-inline" id="id5e121f89f55c4b1c9b9c9f87eccfde28"><enum>(1)</enum><header>Cybersecurity incident</header><text>The term <term>cybersecurity incident</term> means a malicious act or suspicious event that disrupts, or attempts to disrupt, the operation of programmable electronic devices and communication networks, including hardware, software, and data that are essential to the cybersecurity resilience of a public water system.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id8d1822e446f344c0b7b2d69138a8ca33"><enum>(2)</enum><header>Cybersecurity resilience</header><text>The term <term>cybersecurity resilience</term> means the ability of a public water system to adapt to or withstand the effects of a cybersecurity incident without interruption to the public water system's function, or if the function is interrupted, to rapidly return to a normal operating condition.</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id688b57f1978a4a80af4cb01651a8abf3"><enum>(3)</enum><header>State</header> <subparagraph commented="no" display-inline="no-display-inline" id="idd8864d594fc84cacaa6834d44fc43254"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Except for subsection (e), the term <term>State</term> means a State that has assumed primary enforcement responsibility pursuant to subsection (e).</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="ida7bc721b49664248892a03f8d136d29e"><enum>(B)</enum><header>Enforcement by the Administrator</header><text display-inline="yes-display-inline">If a State has not assumed primary enforcement responsibility pursuant to subsection (e), the term <term>State</term> shall, for purposes of obligations of the State under this section (except for subsection (e)), be considered to be a reference to the Administrator.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id959681894ec0435aaec87fb6a80897d4"><enum>(b)</enum><header>Cybersecurity assessments</header> <paragraph commented="no" display-inline="no-display-inline" id="idbb4d42160e574d95a495f1f137f60166"><enum>(1)</enum><header>Assessments required</header> <subparagraph commented="no" display-inline="no-display-inline" id="id8c52eeee3fe04ac1a9d06400e432cf3e"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A State shall carry out cybersecurity assessments of public water systems in accordance with this paragraph.</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id38e5f793573c4a3981ec5b67bb07f6a5"><enum>(B)</enum><header>Evaluation of adequacy</header><text display-inline="yes-display-inline">For a public water system subject to a cybersecurity assessment under subparagraph (A), if the public water system uses operational technology, the State shall evaluate the adequacy of the cybersecurity of the operational technology, and information and communications technology that is connected to the operational technology, against the baseline cybersecurity standards promulgated by the Administrator under subsection (c).</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="ide57ebff559b04cbd84210f8d28cd380a"><enum>(C)</enum><header>Review of assessments and plans</header><text>In carrying out a cybersecurity assessment required under subparagraph (A), a public water system shall provide, and the State shall review, the portions of the risk and resilience assessments of the public water system under section 1433(a) and the emergency response plans of the public water system under section 1433(b) submitted under section 1433(c)(1)(A).</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id2be0b65309a6452dbb5c8c390501d5e2"><enum>(D)</enum><header>Inspections</header><text>In carrying out cybersecurity assessments under this paragraph, a State shall carry out inspections of a representative sample of public water systems each year, which sampling shall be informed by risk-based considerations, subject to the condition that the scope of the inspection is limited to the systems of the public water system necessary to meet the requirements of this paragraph.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id21234406e88344d799de7378632d2877"><enum>(2)</enum><header>Violations</header><text>If a State identifies a violation of the baseline cybersecurity standards established by the Administrator under subsection (c) while conducting an assessment under paragraph (1), the State shall take appropriate steps to ensure that the public water system addresses the violation and use mechanisms, including enforcement, for failures to correct those violations.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id17ede6791420485d8324506fc16d197a"><enum>(3)</enum><header>Submission to EPA</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id83b86006ecd145419e66b27c88d23b99"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A State shall annually submit to the Administrator a report that summarizes the performance of the public water systems of the State for each cybersecurity performance metric established by the Administrator under subsection (d)(1) based on the review by the State of risk and resilience assessments pursuant to paragraph (1)(C).</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id12b366fc5b8a49e094c3f764a756b219"><enum>(B)</enum><header>Requirement</header><text>A report submitted under subparagraph (A) shall not identify any specific public water system and shall include only aggregations of data.</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id96cef11b659c47c8a39fb1fe9bd57e33"><enum>(4)</enum><header>Technical assistance</header><text>The Administrator shall, on request of a public water system, provide guidance and technical assistance to the public water system with respect to—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id1beb0f793f2e48aaab1eb002123a0959"><enum>(A)</enum><text display-inline="yes-display-inline">implementing any requirement under this section or section 1433; and</text></subparagraph>
<subparagraph id="id468afacd767e4da188ed1fefe752fa8e"><enum>(B)</enum><text>enhancing cybersecurity resilience.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id2e01c7ca460a41ab90a4820d4dd205dd"><enum>(c)</enum><header>Baseline cybersecurity standards</header> <paragraph commented="no" display-inline="no-display-inline" id="idbfdb020eed5747be83997428c283a7ef"><enum>(1)</enum><header display-inline="yes-display-inline">In general</header><text>The Administrator shall by rulemaking establish baseline cybersecurity standards that shall serve as requirements to provide for the cybersecurity resilience of a public water system.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id0e5067ee322640569512c68f115d1cc8"><enum>(2)</enum><header>Requirements</header><text>In developing and establishing the baseline cybersecurity standards under paragraph (1), the Administrator shall, at a minimum—</text> <subparagraph commented="no" display-inline="no-display-inline" id="idf53c5f2ef2414c01ae1c56b783fab82c"><enum>(A)</enum><text display-inline="yes-display-inline">work in conjunction with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id88f77f68971445bf84e43868ed971a9b"><enum>(B)</enum><text>develop the baseline cybersecurity standards in collaboration with public water systems of various sizes and capacities to ensure that feedback from a variety of public water systems is considered during the development of the baseline cybersecurity standards;</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id89c0d2b6175848fba3eb3ba1177401fd"><enum>(C)</enum><text>ensure that best practices and guidelines that already exist in the water sector at the time of the development of the baseline cybersecurity standards inform the development of the baseline cybersecurity standards;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id777b82559e004885a3f6c995fdb5299f"><enum>(D)</enum><text>establish a technical advisory committee to provide input with respect to, review, and refine the baseline cybersecurity standards throughout the development process, which shall, at a minimum, include—</text> <clause commented="no" display-inline="no-display-inline" id="iddf143a2e6f274987b556b32ea8c374d5"><enum>(i)</enum><text display-inline="yes-display-inline">representatives from public water systems of various sizes;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id4bd585968f3a427b9db684e389704962"><enum>(ii)</enum><text>professional water associations;</text></clause> <clause commented="no" display-inline="no-display-inline" id="id2f13c06bd29f4b28bb7cde3c4f5e5fc3"><enum>(iii)</enum><text>cybersecurity experts;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="idd2d3ae5561fe4d21aafc7aeb89f4f962"><enum>(iv)</enum><text>a representative from a relevant voluntary consensus standards body, as described in section 12(d)(1) of the National Technology Transfer and Advancement Act of 1995 (<external-xref legal-doc="usc" parsable-cite="usc/15/272">15 U.S.C. 272</external-xref> note; <external-xref legal-doc="public-law" parsable-cite="pl/104/113">Public Law 104–113</external-xref>); and</text></clause> <clause commented="no" display-inline="no-display-inline" id="id2c5434236bd04c33ad9b6f6fdac653c0"><enum>(v)</enum><text>a representative from an information technology or operational technology service provider that provides cybersecurity services to public water systems; and</text></clause></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id9b74407212fc455d9c8e69ed93fa1cef"><enum>(E)</enum><text>consult with the States.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idcc7dee759a684f01a64613f1b85c275c"><enum>(3)</enum><header>Consideration of varied capacity and risk</header><text>In developing the baseline cybersecurity standards under paragraph (1), the Administrator—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id80a893f483794b00ae2f24447a711251"><enum>(A)</enum><text display-inline="yes-display-inline">shall ensure that the baseline cybersecurity standards account for the varied capacity and risk of all public water systems; and</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id13d343c359874a53b267d1cfb1caed0b"><enum>(B)</enum><text>may establish different baseline cybersecurity standards for different categories of public water systems subject to assessments under subsection (b) based on capacity or risk.</text></subparagraph></paragraph></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id6fc1dcd7c5c44e7dac042dfc926b1cfa"><enum>(d)</enum><header>Cybersecurity performance metrics</header>
<paragraph commented="no" display-inline="no-display-inline" id="id8881907882fd4977beb9d2f08ab76dbd"><enum>(1)</enum><header display-inline="yes-display-inline">Establishment of metrics</header>
<subparagraph id="iddc83cc642bb14dfdbbbb55ebd696b508"><enum>(A)</enum><header>In general</header><text>Not later than 2 years after the date of enactment of this section, the Administrator shall establish cybersecurity performance metrics (referred to in this subsection as the <quote>cybersecurity performance metrics</quote>) to be used by the Administrator to measure or assess how well the sector of public water systems in the United States is making progress on implementing cybersecurity best practices.</text></subparagraph> <subparagraph id="id6f73560dd37c46c1bc521b254f4f0816"><enum>(B)</enum><header>Assessment; report</header><text>The Administrator shall, not less frequently than once every 4 years—</text>
<clause id="id2176c64d6c5a47818258f02b756adf74"><enum>(i)</enum><text>assess the sector of public water systems in the United States using the cybersecurity performance metrics; and</text></clause> <clause id="id1279b838901847549c3a0ba05105b6dd"><enum>(ii)</enum><text>submit to Congress and make publicly available a report describing, on a generalized, sector-wide basis, the state of public water systems sector performance using the assessment carried out under clause (i).</text></clause></subparagraph></paragraph>
<paragraph id="id5130aa4d21384ebd85ddaa7c96331194"><enum>(2)</enum><header>Provision of information</header><text>Notwithstanding any other provision of law, a public water system may, at the discretion of the public water system and for the purpose of developing sector-wide risk assessments and performance metrics to measure how public water systems are making progress in developing and implementing cybersecurity best practices, provide to the Administrator, and the Administrator may accept, information that would assist the Administrator in the development and maintenance of cybersecurity performance metrics.</text></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="ida1d382b433cf414f935d2e9f3e092778"><enum>(e)</enum><header>Enforcement; State assumption of duties</header> <paragraph commented="no" display-inline="no-display-inline" id="idc4fd5f22cf7842e98edc80727f692e6a"><enum>(1)</enum><header display-inline="yes-display-inline">In general</header><text display-inline="yes-display-inline">This section and section 1433 shall be enforced by the Administrator unless a State assumes primary enforcement responsibility pursuant to this subsection.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id083c320f554e4bc0b315a0d4dc6bd8fe"><enum>(2)</enum><header>Application</header><text display-inline="yes-display-inline">A State seeking to assume primary enforcement responsibility pursuant to this subsection shall submit to the Administrator an application at such time, in such manner, and containing such information as the Administrator may by regulation require.</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id2e77a6e3ce4045669381fc3f56bd5206"><enum>(3)</enum><header>Determination</header><text display-inline="yes-display-inline">On receiving an application described in paragraph (2) from a State, the Administrator shall, based on that application, determine whether the State—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="iddb01f4f133fe4a77896d22f4f0884e93"><enum>(A)</enum><text display-inline="yes-display-inline">has adopted and is implementing adequate procedures for the enforcement of requirements that are no less stringent than those under this section and section 1433;</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id07618d436ad44afa87315290f6d85036"><enum>(B)</enum><text display-inline="yes-display-inline">has adopted authority and has sufficient capacity to impose enforcement remedies in line with those prescribed under this title;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id76e3d034d72b4c2caace079837a2ba64"><enum>(C)</enum><text display-inline="yes-display-inline">has sufficient capacity and personnel with sufficient expertise to perform cybersecurity assessments and conduct reviews of risk and resilience assessments and emergency response plans under section 1433; and</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="ida2a13858f3d746e28dd53573778754ee"><enum>(D)</enum><text display-inline="yes-display-inline">has sufficient security mechanisms in place to prevent any unsanctioned disclosure or dissemination of risk and resilience assessments, emergency response plans, and any other information provided by a public water system, in alignment with the protocols developed by the Administrator under section 1433(c)(3)(B)(i).</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id09d05d71ff5340fa9b3efe9cc0bdeaba"><enum>(4)</enum><header>Timeline</header><text>Not later than 180 days after the date on which the Administrator receives an application described in paragraph (2), the Administrator shall—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id7aac4320851c46248c58c22ef7e18ead"><enum>(A)</enum><text display-inline="yes-display-inline">if the Administrator determines that the State meets each requirement described in paragraph (3), grant the application; or</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id736d6959c722411fb161725457494f20"><enum>(B)</enum><text>if the Administrator determines that the State fails to meet 1 or more of the requirements described in paragraph (3), deny the application.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idd573edebb645477fbe6555bd5b9cdb8e"><enum>(5)</enum><header>Revocation of primary enforcement responsibility</header><text display-inline="yes-display-inline">The Administrator may, as appropriate, revoke an assumption of primary enforcement responsibility pursuant to this subsection if the Administrator determines that a State no longer meets 1 or more requirements described in paragraph (3).</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id97b3a5fcaf7e4011948c30a698918551"><enum>(6)</enum><header>Regulations required</header><text display-inline="yes-display-inline">The Administrator shall promulgate regulations carrying out this subsection not later than 1 year after the date of enactment of this section, which shall include—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id1e49ce90fd5f41c29e181831c56caf07"><enum>(A)</enum><text display-inline="yes-display-inline">the requirements for an application described in paragraph (2);</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idf3f894150dc04b0f8d0410dc8d6512f4"><enum>(B)</enum><text display-inline="yes-display-inline">the period for which a State may assume primary enforcement responsibility pursuant to this subsection before renewal; and</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="idc2e3f11b5253476985882b3e4cebfa22"><enum>(C)</enum><text display-inline="yes-display-inline">the manner by which the Administrator may revoke primary enforcement responsibility pursuant to paragraph (5).</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id7c0af65b830642338a33e99292505f04"><enum>(7)</enum><header>Savings provision</header><text display-inline="yes-display-inline">An assumption of primary enforcement responsibility pursuant to this subsection shall be separate from any authority assumed under section 1413.</text></paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block></subsection> <subsection commented="no" display-inline="no-display-inline" id="ide4a6a2f5e1794393a5ac759dede4f2db"><enum>(b)</enum><header>Enforcement authority</header><text>Section 1414(i)(1) of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300g-3">42 U.S.C. 300g–3(i)(1)</external-xref>) is amended by inserting <quote>1433A,</quote> after <quote>1433,</quote>.</text></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id7bb6ece301154febb8aaba567b330f15"><enum>(c)</enum><header>Records and inspections</header><text>Section 1445(b)(1) of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300j-4">42 U.S.C. 300j–4(b)(1)</external-xref>) is amended, in the first sentence—</text> <paragraph commented="no" display-inline="no-display-inline" id="ida9db4b16874d47b497eb8d9368a6c016"><enum>(1)</enum><text display-inline="yes-display-inline">by striking <quote>or (C) any</quote> and inserting <quote>(C) any</quote>;</text></paragraph>
<paragraph id="id652d4f0232dc4c3b853b3ee5c837d22f"><enum>(2)</enum><text>by inserting <quote>or (D) a requirement to undergo an inspection under section 1433A(a)(2)(D),</quote> after <quote>subsection (a),</quote>; and</text></paragraph> <paragraph id="id577abba6ce0a4c99a412fc636415c6e9" commented="no" display-inline="no-display-inline"><enum>(3)</enum><text>by striking <quote>or (C), is</quote> and inserting <quote>(C), or (D), is</quote>.</text></paragraph></subsection>
<subsection id="idd098fb0a12ac479faa11c0d7a07c4c47" commented="no"><enum>(d)</enum><header>Conforming amendment</header><text display-inline="yes-display-inline">Section 1413(a) of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300g-2">42 U.S.C. 300g–2(a)</external-xref>) is amended, in the matter preceding paragraph (1), by inserting <quote>(except for sections 1433 and 1433A)</quote> after <quote>this title</quote>.</text></subsection></section> <section commented="no" display-inline="no-display-inline" section-type="subsequent-section" id="id8f4c8631f0174646b465108eedc17bed"><enum>103.</enum><header>Drinking water security assistance</header> <subsection commented="no" display-inline="no-display-inline" id="id4ca100ef38e84cad8fe055aa7fd363d4"><enum>(a)</enum><header display-inline="yes-display-inline">Authorization of appropriations</header><text>In addition to any amounts authorized to be appropriated under section 1452(m) of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300j-12">42 U.S.C. 300j–12(m)</external-xref>), there is authorized to be appropriated $300,000,000 for each of fiscal years 2027 through 2032 for the purposes of helping public water systems (as defined in section 1401 of that Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300f">42 U.S.C. 300f</external-xref>)) build cybersecurity resilience (as defined in section 1433A(a)(1) of the Safe Drinking Water Act) and identifying and mitigating cybersecurity vulnerabilities, including those included in risk and resilience assessments and emergency response plans prepared pursuant to section 1433 of that Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300i-2">42 U.S.C. 300i–2</external-xref>).</text></subsection>
<subsection commented="no" display-inline="no-display-inline" id="idd5dce9f063b7412ea9a46ebc8dfb1e5d"><enum>(b)</enum><header>Guidance</header><text display-inline="yes-display-inline">The Administrator of the Environmental Protection Agency may issue guidance to determine specific criteria for eligible uses of the amounts made available under subsection (a) that further the purposes described in that subsection.</text></subsection> <subsection commented="no" display-inline="no-display-inline" id="id82008652d18a4e9ca7a4fc0afebd97a9"><enum>(c)</enum><header>Prioritization</header><text>In using amounts made available pursuant to subsection (a), a State shall prioritize providing assistance to public water systems (as defined in section 1401 of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300f">42 U.S.C. 300f</external-xref>)) that have the greatest need with respect to capacity, workforce, expertise, or resources to adequately address cybersecurity vulnerabilities.</text></subsection>
<subsection commented="no" display-inline="no-display-inline" id="ida2a3b0da67e7427d8ee612b384d5f425"><enum>(d)</enum><header>Rollover</header><text>To the extent that any amounts authorized to be appropriated under subsection (a) in a fiscal year are not appropriated in that fiscal year, the amounts are authorized to be appropriated in a subsequent fiscal year, and shall remain available until expended.</text></subsection></section> <enum>II</enum><header>Clean water infrastructure</header> <section id="id0a4e3c786b1a43e59b79201a74ca8141"><enum>201.</enum><header>Treatment works risk and resilience</header> <subsection commented="no" display-inline="no-display-inline" id="idbfdc5d747c524b96aca23f43a08bc195"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Title II of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1281">33 U.S.C. 1281 et seq.</external-xref>) is amended by adding at the end the following:</text>
<quoted-block style="OLC" id="idB362635869D5474C97FDBF5F2F69BDBD" act-name="">
<section section-type="subsequent-section" id="id8B94B8702E394FFD9A99B9E62460E8E9"><enum>228.</enum><header>Treatment works risk and resilience</header>
<subsection commented="no" display-inline="no-display-inline" id="iddeb50929798f4a4595c72d8c251f1e4d"><enum>(a)</enum><header display-inline="yes-display-inline">Definitions</header><text>In this section:</text> <paragraph commented="no" display-inline="no-display-inline" id="id52227a97190d4288af13ab631392e7ef"><enum>(1)</enum><header>Covered treatment works</header><text>The term <term>covered treatment works</term> means a treatment works that—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id1951acbb3321418988265993487363b0"><enum>(A)</enum><text>treats domestic sewage;</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id0f892604db9b4e31a4ff9aa58f7b0b19"><enum>(B)</enum><text display-inline="yes-display-inline">serves more than 10,000 persons; and</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idb92c90c970dd40e09ec8901da07f5c9d"><enum>(C)</enum><text>has a design flow rate of 1,000,000 gallons or more.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id28e075aeb302416985d6442fb1ab3402"><enum>(2)</enum><header>Natural hazard</header><text display-inline="yes-display-inline">The term <term>natural hazard</term> means a natural event that threatens the functioning of a treatment works, including an earthquake, tornado, flood, hurricane, wildfire, and hydrologic changes.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="idbcd1287594f941e5a1577bbd45eff59f"><enum>(3)</enum><header>Resilience</header><text display-inline="yes-display-inline">The term <term>resilience</term> means the ability of a treatment works or an asset of a treatment works to adapt to, or withstand the effects of, a malevolent act or natural hazard without interruption to the function of the treatment works or asset or, if the function is interrupted, to rapidly return to a normal operating condition.</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id3937a68d405e41d9b735ee275fce3085"><enum>(4)</enum><header>State</header> <subparagraph commented="no" display-inline="no-display-inline" id="id8b10c7dcfe554048ba1b7a32567168c6"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>The term <term>State</term> means a State that has assumed primary enforcement responsibility pursuant to section 229(e).</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id158b9e857f4641059eefe30f24a55ec3"><enum>(B)</enum><header>Enforcement by the Administrator</header><text display-inline="yes-display-inline">If a State has not assumed primary enforcement responsibility pursuant to section 229(e), the term <term>State</term> shall, for purposes of obligations of the State under this subsection, be considered to be a reference to the Administrator.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id402ad2f579fe4fb8b784cd9be5d57320"><enum>(b)</enum><header>Risk and resilience assessments</header> <paragraph commented="no" display-inline="no-display-inline" id="id0f4bebf60c5449d4850817424fdcc4c7"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">Each covered treatment works shall conduct an assessment of the risks to, and resilience of, the covered treatment works.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id7c13567ae14a44e690da212a5fd4b29c"><enum>(2)</enum><header>Requirements</header><text display-inline="yes-display-inline">An assessment under paragraph (1)—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id574f05ec7bf1421cbd0306f66d71c606"><enum>(A)</enum><text display-inline="yes-display-inline">shall include an assessment of—</text>
<clause commented="no" display-inline="no-display-inline" id="id160555a9a2c041ac99459c8451d3a128"><enum>(i)</enum><text display-inline="yes-display-inline">the risk to the covered treatment works from malevolent acts and natural hazards;</text></clause> <clause commented="no" display-inline="no-display-inline" id="id12a2a87995704b88808d4bfd1205ee7d"><enum>(ii)</enum><text display-inline="yes-display-inline">the resilience of collection systems, pipes and constructed conveyances, physical barriers, treatment, and storage, discharge, and reuse facilities that are utilized by the covered treatment works;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id5d3a189917e94cf1a06198838e8070d1"><enum>(iii)</enum><text display-inline="yes-display-inline">the monitoring practices of the covered treatment works;</text></clause> <clause commented="no" display-inline="no-display-inline" id="id25b87a30f0dd495aa52e929df86d4c76"><enum>(iv)</enum><text display-inline="yes-display-inline">the financial infrastructure of the covered treatment works;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id411c612f441b45fd8ee620bdf6ebe15d"><enum>(v)</enum><text display-inline="yes-display-inline">the use, storage, or handling of various chemicals by the covered treatment works;</text></clause> <clause commented="no" display-inline="no-display-inline" id="ida36bf0a83b7b4ecc854f746d2aa0c57c"><enum>(vi)</enum><text display-inline="yes-display-inline">the operation and maintenance of the covered treatment works; and</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id2a473cc4ad5d4cba9368a20538b0669b"><enum>(vii)</enum><text>using a method approved by the applicable State, the risks to electronic, computer, or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph (A) or (B) of paragraph (3); and</text></clause></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="ideda01f97f9764569827f4bae179c690b"><enum>(B)</enum><text display-inline="yes-display-inline">may include an evaluation of capital and operational needs for risk and resilience management for the covered treatment works.</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="idf275a4499433492bb773e582ddff47f0"><enum>(3)</enum><header>Baseline information</header><text>The Administrator, not later than 1 year after the date of enactment of this section, after consultation with appropriate departments and agencies of the Federal Government and with State and local governments, shall provide baseline information on malevolent acts of relevance to covered treatment works, which shall include consideration of acts that may—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id97c63cdc3e8c421b876387e79af34ac5"><enum>(A)</enum><text display-inline="yes-display-inline">substantially disrupt the ability of a covered treatment works to provide safe and reliable collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes; or</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id3467b33a31db4e79abaabc885398988a"><enum>(B)</enum><text display-inline="yes-display-inline">otherwise present significant public health or economic concerns to the community served by a covered treatment works.</text></subparagraph></paragraph> <paragraph id="id5995fadc1d034172828b8129e4f965fb" commented="no"><enum>(4)</enum><header>Review and revision</header> <subparagraph commented="no" display-inline="no-display-inline" id="id2ec820d4b33249b0898fcfd62a928812"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Each covered treatment works shall, not less frequently than once every 5 years, review and, if necessary, revise the assessment.</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id4358bf755a644091811f43a3773ce3dc"><enum>(B)</enum><header>Certification to the Administrator or State</header><text display-inline="yes-display-inline">On completion of the review under subparagraph (A), a covered treatment works shall submit to the applicable State a certification that the covered treatment works has reviewed and, if applicable, revised the assessment.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id999cd0e003d8448abc59e8e8c054819b"><enum>(c)</enum><header>Emergency response plan</header> <paragraph commented="no" display-inline="no-display-inline" id="id9ccfc1e1b3cd42e3bcee979dfec91afd"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">Each covered treatment works shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection (b) for that covered treatment works (or any revisions to that assessment).</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id470df2156ffc4c588cc95c5d4969cff6"><enum>(2)</enum><header>Required inclusions</header><text display-inline="yes-display-inline">The emergency response plan of a covered treatment works under paragraph (1) shall include—</text> <subparagraph commented="no" display-inline="no-display-inline" id="id76a97edf5c834657a4d1b210b7aace10"><enum>(A)</enum><text display-inline="yes-display-inline">strategies and resources to improve the resilience of the covered treatment works, including the physical security of the covered treatment works;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id347a063e52a84561b05bd179817d31cb"><enum>(B)</enum><text display-inline="yes-display-inline">plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the covered treatment works to collect, store, treat, recycle, and reclaim municipal sewage or industrial wastes;</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id025c1df05d434e45a20fc7a41b16b090"><enum>(C)</enum><text display-inline="yes-display-inline">actions, procedures, and equipment that can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id89ed1c08eb8f4b5a8e176fe1a6109d14"><enum>(D)</enum><text display-inline="yes-display-inline">strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the covered treatment works; and</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="ide7d3e477d57e4381991ad25317160585"><enum>(E)</enum><text display-inline="yes-display-inline">countermeasures that the covered treatment works intends to adopt or, if already in use, maintain to mitigate the significant cybersecurity risks identified under subsection (b)(2)(A)(vii), including a schedule the covered treatment works intends to follow to adopt any countermeasures not already in use by the covered treatment works.</text></subparagraph></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id99873f27bd284eed9ccc68d22e24b115"><enum>(3)</enum><header>Revision</header><text>A covered treatment works shall review and, as necessary, revise the emergency response plan prepared under this subsection not less frequently than once every 5 years.</text></paragraph></subsection> <subsection id="idf18c3b1e4051496eaf2eed2431056152"><enum>(d)</enum><header>Submission and approval of assessments and plans</header> <paragraph commented="no" display-inline="no-display-inline" id="id269485130c7646829b27c26a9a3f1d48"><enum>(1)</enum><header display-inline="yes-display-inline">Submission</header> <subparagraph commented="no" display-inline="no-display-inline" id="id85ab18aa76cc4caeb5354b695468cf83"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Beginning not later than 1 year after the date on which the Administrator provides baseline information under subsection (b)(3), each covered treatment works shall, during a cybersecurity assessment pursuant to section 229(b)(2)(A), provide to the applicable State—</text>
<clause commented="no" display-inline="no-display-inline" id="idd45cdf43df984b8b9f23f146849502a9"><enum>(i)</enum><text display-inline="yes-display-inline">the portion of the assessment prepared under subsection (b) that is described in paragraph (2)(A)(vii) of that subsection (including any revision to that portion of the assessment); and</text></clause> <clause commented="no" display-inline="no-display-inline" id="idd0fadcdb02014cb68bcba17d3bd5f395"><enum>(ii)</enum><text>the portion of the emergency response plan prepared under subsection (c) that is described in paragraph (2)(E) of that subsection (including any revision to that portion of the emergency response plan).</text></clause></subparagraph>
<subparagraph id="id260c34dfcd634671acf60fbc2f43466c"><enum>(B)</enum><header>Limitation</header><text>Neither the Administrator nor a State may require the submission of any portion of an assessment under subsection (a) or an emergency response plan under subsection (b) that is not described in subparagraph (A).</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idb26162eda1354b84a41ca7f4bf886ce1"><enum>(2)</enum><header>Review; approval</header> <subparagraph commented="no" display-inline="no-display-inline" id="id9f92952627ef4fa7bf5c0bf1c493e9d1"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>A State shall—</text>
<clause commented="no" display-inline="no-display-inline" id="id40dd278ad755431dbfed5bd7c8e1e11f"><enum>(i)</enum><text display-inline="yes-display-inline">review the portions of the assessments and emergency response plans of covered treatment works submitted pursuant to paragraph (1)(A) for conformity with the requirements of this section and section 229; and</text></clause> <clause commented="no" display-inline="no-display-inline" id="id471c8a64602d4513a6ec53e17a956d95"><enum>(ii)</enum> <subclause commented="no" display-inline="yes-display-inline" id="id48b78b9629454165b6fd0b2789e0b893"><enum>(I)</enum><text>approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A); or</text></subclause>
<subclause commented="no" display-inline="no-display-inline" indent="up1" id="idc9f3be625bfa489683ff129eebadb181"><enum>(II)</enum><text>disapprove of the portions of an assessment or emergency response plan submitted pursuant to paragraph (1)(A) if the Administrator or the State, as applicable, determines that—</text> <item commented="no" display-inline="no-display-inline" id="id1de35ef1c59549ceb39183de690c9246"><enum>(aa)</enum><text display-inline="yes-display-inline">the submitted portions of the assessment or emergency response plan are missing, incomplete, or fail to conform with the requirements of this section; or</text></item>
<item commented="no" display-inline="no-display-inline" id="idc2ec6cb4c0d04ad49611736bc64849c9"><enum>(bb)</enum><text>the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the Administrator under section 229(c).</text></item></subclause></clause></subparagraph> <subparagraph id="id2c2101f18f38414ab1ce86cdbedea840"><enum>(B)</enum><header>Enforcement</header><text>A State may use appropriate enforcement mechanisms under this Act or the appropriate State authority to remedy noncompliance, as described in items (aa) and (bb) of subparagraph (A)(ii)(II), under this subsection.</text></subparagraph></paragraph>
<paragraph id="idb31f3dabd4d343d89ebcbc78a178efd5"><enum>(3)</enum><header>Submitted documentation</header>
<subparagraph id="id39ba415b8f414aacbade20b6e2a03ebf"><enum>(A)</enum><header>Applicability of FOIA</header><text>Any information submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the <quote>Freedom of Information Act</quote>), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id12b22de7c64c403a8cac0d0c53789642"><enum>(B)</enum><header>Treatment of documentation</header> <clause commented="no" display-inline="no-display-inline" id="idc89e0292c867447188e8f8b2e39d9903"><enum>(i)</enum><header>Protocol development</header><text display-inline="yes-display-inline">Not later than 180 days after the date of enactment of the <short-title>Water Cyber Shield Act of 2026</short-title> and before any cybersecurity assessments are carried out pursuant to section 229(b)(2)(A), the Administrator, in consultation with appropriate Federal law enforcement and intelligence officials, shall develop such protocols as are necessary to protect any information provided under paragraph (1)(A) to the State.</text></clause>
<clause id="idbd2d98dffedb4cc6a0d76d7d9eaade2d"><enum>(ii)</enum><header>Requirements for protocol</header><text>The protocol developed under clause (i) shall ensure that—</text> <subclause commented="no" display-inline="no-display-inline" id="id7df25ad0e04943b581639ccb2736495a"><enum>(I)</enum><text display-inline="yes-display-inline">each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) are kept in a secure location;</text></subclause>
<subclause commented="no" display-inline="no-display-inline" id="id405bc94768e243a1ac10f04ebe9dcd5e"><enum>(II)</enum><text>only individuals designated by the applicable State may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A); and</text></subclause> <subclause commented="no" display-inline="no-display-inline" id="ided3c237d91be4f94b46c2795c3d1d9fe"><enum>(III)</enum><text>no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A) shall be made available to anyone other than an individual designated by the applicable State.</text></subclause></clause>
<clause id="idc11dcf7210594abe9eef5f2271d117a5"><enum>(iii)</enum><header>Savings provision</header><text>Nothing in this subparagraph authorizes any person to withhold any information from Congress or from a committee or subcommittee of Congress.</text></clause></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idc78a3fb1ec9c493fa4d14bc5bfdc1291"><enum>(4)</enum><header>Applicability of FOIA</header><text display-inline="yes-display-inline">Any findings or plans (including revisions and any related agency records and information that is designated as Department of Defense critical infrastructure security information under section 130e(b) of title 10, United States Code) submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the <quote>Freedom of Information Act</quote>), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.</text></paragraph></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id9cfe927a468a4eeb8f1d42f33f896eeb"><enum>(e)</enum><header>Coordination</header><text display-inline="yes-display-inline">A covered treatment works shall, to the extent practicable, coordinate with existing local planning committees established pursuant to the Emergency Planning and Community Right-To-Know Act of 1986 (<external-xref legal-doc="usc" parsable-cite="usc/42/11001">42 U.S.C. 11001 et seq.</external-xref>) when preparing or revising an assessment or emergency response plan under this section.</text></subsection> <subsection commented="no" display-inline="no-display-inline" id="id89860b6b31b94bef95f5d39a69fb63ff"><enum>(f)</enum><header>Record maintenance</header><text display-inline="yes-display-inline">Each covered treatment works shall maintain a copy of the assessment conducted under subsection (b) and the emergency response plan prepared under subsection (c) (including any revised assessment or plan) for 5 years after the date on which that assessment or plan is approved by the applicable State under this section.</text></subsection>
<subsection commented="no" display-inline="no-display-inline" id="idffdc61aa84184e6294aa4f9fea6bff8a"><enum>(g)</enum><header>Guidance to small treatment works</header><text display-inline="yes-display-inline">The Administrator shall provide guidance and technical assistance to treatment works that are not covered treatment works on how to conduct resilience assessments, prepare emergency response plans, and address threats from malevolent acts and natural hazards that threaten to disrupt the collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes or significantly affect the public health.</text></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block></subsection> <subsection commented="no" display-inline="no-display-inline" id="idc72f0f47ba3849059661f9fe40b8dfad"><enum>(b)</enum><header>Federal enforcement</header><text>Section 309 of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1319">33 U.S.C. 1319</external-xref>) is amended in each of subsections (a), (c), (d), and (g) by inserting <quote>228(d),</quote> before <quote>301,</quote> each place it appears.</text></subsection></section>
<section id="id4bdae244241d4b99aecd97855c46f727"><enum>202.</enum><header>Cybersecurity requirements for treatment works</header>
<subsection commented="no" display-inline="no-display-inline" id="id528fa4ed536b49fe89ad0468cb7abe99"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Title II of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1281">33 U.S.C. 1281 et seq.</external-xref>) (as amended by section 201(a)) is amended by adding at the end the following:</text> <quoted-block style="OLC" id="id824B5A33FAA74B70B5ABAD2A22BD3581" act-name=""> <section section-type="subsequent-section" id="id5C47523624434F0E84EDA00182B14A49"><enum>229.</enum><header>Cybersecurity requirements</header> <subsection commented="no" display-inline="no-display-inline" id="id174f5db711b042a1b28e5545e2aafc8b"><enum>(a)</enum><header display-inline="yes-display-inline">Definitions</header><text>In this section:</text>
<paragraph commented="no" display-inline="no-display-inline" id="id3a6a830284e14a3392b3609be41140fa"><enum>(1)</enum><header>Covered treatment works</header><text display-inline="yes-display-inline">The term <term>covered treatment works</term> has the meaning given the term in section 228(a).</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id27e75a1c88644fb6b20919b908e8204b"><enum>(2)</enum><header>Cybersecurity incident</header><text>The term <term>cybersecurity incident</term> means a malicious act or suspicious event that disrupts, or attempts to disrupt, the operation of programmable electronic devices and communication networks, including hardware, software, and data that are essential to the cybersecurity resilience of a treatment works.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="ide75640f3244c489981187da7ff423db6"><enum>(3)</enum><header>Cybersecurity resilience</header><text>The term <term>cybersecurity resilience</term> means the ability of a treatment works to adapt to or withstand the effects of a cybersecurity incident without interruption to the treatment works's function, or if the function is interrupted, to rapidly return to a normal operating condition.</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idb0d9a144cde6476b84b9ebe2ddd09c56"><enum>(4)</enum><header>State</header> <subparagraph commented="no" display-inline="no-display-inline" id="id4b084d2bfc3a41a79443aaeba4b1e092"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Except for subsection (e), the term <term>State</term> means a State that has assumed primary enforcement responsibility pursuant to subsection (e).</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id9214c28c00364db595425981d3a7cf7b"><enum>(B)</enum><header>Enforcement by the Administrator</header><text display-inline="yes-display-inline">If a State has not assumed primary enforcement responsibility pursuant to subsection (e), the term <term>State</term> shall, for purposes of obligations of the State under this section (except for subsection (e)), be considered to be a reference to the Administrator.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id2a49819b4c874e6d9e3cb154398410ae"><enum>(b)</enum><header>Cybersecurity assessments</header> <paragraph commented="no" display-inline="no-display-inline" id="id472ac434e1d04158a1ce069ba5b4f23a"><enum>(1)</enum><header>Assessments required</header> <subparagraph commented="no" display-inline="no-display-inline" id="id03a71a1ca25e473da6762001f5a58828"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A State shall carry out cybersecurity assessments of a covered treatment works in accordance with this paragraph.</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idd428c9c689c94a68a1738249df934d51"><enum>(B)</enum><header>Evaluation of adequacy</header><text display-inline="yes-display-inline">For a covered treatment works subject to a cybersecurity assessment under subparagraph (A), if the covered treatment works uses operational technology, the State shall evaluate the adequacy of the cybersecurity of the operational technology, and information and communications technology that is connected to the operational technology, against the baseline cybersecurity standards promulgated by the Administrator under subsection (c).</text></subparagraph> <subparagraph id="ida057ec1a8a3b4a6b83df3cf09c8f6356"><enum>(C)</enum><header>Review of assessments and plans</header><text>In carrying out a cybersecurity assessment required under subparagraph (A), a covered treatment works shall provide, and the State shall review, the portions of the risk and resilience assessments of the covered treatment works under section 228(b) and the emergency response plans of the covered treatment works under section 228(c) submitted under section 228(d)(1)(A).</text></subparagraph>
<subparagraph id="idcae24f8b75a94b2b8d67c852df5fc22e"><enum>(D)</enum><header>Inspections</header><text>In carrying out cybersecurity assessments under this paragraph, a State shall carry out inspections of a representative sample of covered treatment works each year, which sampling shall be informed by risk-based considerations, subject to the condition that the scope of the inspection is limited to the systems of the covered treatment works necessary to meet the requirements of this paragraph.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id8fbb25017d8346a1a0a14d3e9fb6b63d"><enum>(2)</enum><header>Violations</header><text display-inline="yes-display-inline">If a State identifies a violation of the baseline cybersecurity standards established by the Administrator under subsection (c) while conducting an assessment under paragraph (3), the State shall take appropriate steps to ensure that the covered treatment works addresses the violation and use mechanisms, including enforcement, to correct those violations.</text></paragraph>
<paragraph id="id30105bf4dc2e4b3291ad401759aa22cf"><enum>(3)</enum><header>Submission to EPA</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id7579ef16ac3e446391273949e1afccd5"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A State shall annually submit to the Administrator a report that summarizes the performance of the covered treatment works of the State for each cybersecurity performance metric established by the Administrator under subsection (d)(1) based on the review by the State of risk and resilience assessments pursuant to paragraph (1)(C).</text></subparagraph> <subparagraph id="id8fe4589c55ca474eb5f9c8f3ea4a9033"><enum>(B)</enum><header>Requirement</header><text>A report submitted under subparagraph (A) shall not identify any specific treatment works and shall include only aggregations of data.</text></subparagraph></paragraph>
<paragraph id="idaca20be203fe41cc98c0dd6d0d459887"><enum>(4)</enum><header>Technical assistance</header><text>The Administrator shall, on request of a covered treatment works, provide guidance and technical assistance to the covered treatment works with respect to—</text> <subparagraph id="ide0ad3e04fa8145bcaecc25d6d0afb3f7"><enum>(A)</enum><text>implementing any requirement under this section or section 228; and</text></subparagraph>
<subparagraph id="id098b9ff360f042efaec8b451f2b9ab62"><enum>(B)</enum><text>enhancing cybersecurity resilience.</text></subparagraph></paragraph></subsection> <subsection commented="no" display-inline="no-display-inline" id="id5bbede525c6d458eb56fe4079164ecf8"><enum>(c)</enum><header>Baseline cybersecurity standards</header> <paragraph commented="no" display-inline="no-display-inline" id="id9af1f1a4a97b41929e96ae5234e7408b"><enum>(1)</enum><header display-inline="yes-display-inline">In general</header><text>The Administrator shall by rulemaking establish baseline cybersecurity standards that shall serve as requirements to provide for the cybersecurity resilience of a covered treatment works.</text></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id72d368600bad47dfa37ad90b69cd2900"><enum>(2)</enum><header>Requirements</header><text>In developing and establishing the baseline cybersecurity standards under paragraph (1), the Administrator shall, at a minimum—</text> <subparagraph commented="no" display-inline="no-display-inline" id="idb5c84b667d384cb3ae33dd1d2dce5919"><enum>(A)</enum><text display-inline="yes-display-inline">work in conjunction with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="id757c0f50e5d0436cb54c3588a68c9983"><enum>(B)</enum><text>develop the baseline cybersecurity standards in collaboration with covered treatment works of various sizes and capacities to ensure that feedback from a variety of covered treatment works is considered during the development of the baseline cybersecurity standards;</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id53f55f07fa69455f92ade2abf2beabe3"><enum>(C)</enum><text>ensure that best practices and guidelines that already exist in the water sector at the time of the development of the baseline cybersecurity standards inform the development of the baseline cybersecurity standards;</text></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="iddfbdc1229f714832b9679fc2885b5453"><enum>(D)</enum><text>establish a technical advisory committee to provide input with respect to, review, and refine the baseline cybersecurity standards throughout the development process, which shall, at a minimum, include—</text> <clause commented="no" display-inline="no-display-inline" id="id3c499ca0472b4f62b0c7c547d2f0043d"><enum>(i)</enum><text display-inline="yes-display-inline">representatives from covered treatment works of various sizes;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="idf4064f9e645c4cd5a27d2915a8d67917"><enum>(ii)</enum><text>professional water associations;</text></clause> <clause commented="no" display-inline="no-display-inline" id="id774c72cd899a45b0a67ad87a72d67172"><enum>(iii)</enum><text>cybersecurity experts;</text></clause>
<clause commented="no" display-inline="no-display-inline" id="id24c2d97d182547b6b4e8fd0b9a2dea34"><enum>(iv)</enum><text>a representative from a relevant voluntary consensus standards body, as described in section 12(d)(1) of the National Technology Transfer and Advancement Act of 1995 (<external-xref legal-doc="usc" parsable-cite="usc/15/272">15 U.S.C. 272</external-xref> note; <external-xref legal-doc="public-law" parsable-cite="pl/104/113">Public Law 104–113</external-xref>); and</text></clause> <clause commented="no" display-inline="no-display-inline" id="id9c9409774f5341698afc0828305584a5"><enum>(v)</enum><text>a representative from an information technology or operational technology service provider that provides cybersecurity services to covered treatment works; and</text></clause></subparagraph>
<subparagraph commented="no" display-inline="no-display-inline" id="idf8ddf05c8ba14f69afd236c6fb6425b9"><enum>(E)</enum><text>consult with the States.</text></subparagraph></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="id4ad8f12c06d34ada8a0441427b44f208"><enum>(3)</enum><header>Consideration of varied capacity and risk</header><text>In developing the baseline cybersecurity standards under paragraph (1), the Administrator—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id18022f641d0d493b92d5114ec8ab9cd2"><enum>(A)</enum><text display-inline="yes-display-inline">shall ensure that the baseline cybersecurity standards account for the varied capacity and risk of all covered treatment works; and</text></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id101b439320264db1936b5e111896c250"><enum>(B)</enum><text>may establish different baseline cybersecurity standards for different categories of treatment works subject to assessments under subsection (b) based on capacity or risk.</text></subparagraph></paragraph></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id532cea33baff4d11a6d0d92c0e005332"><enum>(d)</enum><header>Cybersecurity performance metrics</header>
<paragraph commented="no" display-inline="no-display-inline" id="idd1a77d81414342a49c3a8758095edeab"><enum>(1)</enum><header display-inline="yes-display-inline">Establishment of metrics</header>
<subparagraph id="id5f3b7a27f45247169776e83517bd5971"><enum>(A)</enum><header>In general</header><text>Not later than 2 years after the date of enactment of this section, the Administrator shall establish cybersecurity performance metrics (referred to in this subsection as the <quote>cybersecurity performance metrics</quote>) to be used by the Administrator to measure or assess how well the sector of treatment works in the United States is making progress on implementing cybersecurity best practices.</text></subparagraph> <subparagraph id="id4dda14518b3947958693b94486e1c41b"><enum>(B)</enum><header>Assessment; report</header><text>The Administrator shall, not less frequently than once every 4 years—</text>
<clause id="idc60c26d6acc04168ab5203a9940ea0fa"><enum>(i)</enum><text>assess the sector of treatment works in the United States using cybersecurity performance metrics; and</text></clause> <clause id="id001eb5f7d5a04a9dbe835c4489fefd22"><enum>(ii)</enum><text>submit to Congress and make publicly available a report describing, on a generalized, sector-wide basis, the state of treatment works sector performance using the assessment carried out under clause (i).</text></clause></subparagraph></paragraph>
<paragraph id="id66e853e16a82442a9ed8968428a11461"><enum>(2)</enum><header>Provision of information</header><text>Notwithstanding any other provision of law, a treatment works may, at the discretion of the treatment works and for the purpose of developing sector-wide risk assessments and performance metrics to measure how treatment works are making progress in developing and implementing cybersecurity best practices, provide to the Administrator, and the Administrator may accept, information that would assist the Administrator in the development and maintenance of cybersecurity performance metrics.</text></paragraph></subsection> <subsection id="idd1651edb8c9b4f5b8077dea3f8719180"><enum>(e)</enum><header>Enforcement; state assumption of duties</header> <paragraph id="idd0ac31f537f04bbfacb645fbf0e0896b"><enum>(1)</enum><header>In general</header><text>This section and section 228 shall be enforced by the Administrator unless a State assumes primary enforcement responsibility pursuant to this subsection.</text></paragraph>
<paragraph id="id35721d1654e74e0bb76c87e4e3e67a23"><enum>(2)</enum><header>Application</header><text>A State seeking to assume primary enforcement responsibility pursuant to this subsection shall submit to the Administrator an application at such time, in such manner, and containing such information as the Administrator may by regulation require.</text></paragraph> <paragraph id="id06fac3d73047482a82f47f16bd859676"><enum>(3)</enum><header>Determination</header><text>On receiving an application described in paragraph (2) from a State, the Administrator shall, based on that application, determine whether the State—</text>
<subparagraph id="id909c7590080246aa906afc187e00ed4d"><enum>(A)</enum><text>has adopted and is implementing adequate procedures for the enforcement of requirements that are no less stringent than those under this section and section 228;</text></subparagraph> <subparagraph id="id7e711d32bdc240d1aa8a7b81244f8aed"><enum>(B)</enum><text>has adopted authority and has sufficient capacity to impose enforcement remedies in line with those prescribed under this title;</text></subparagraph>
<subparagraph id="id824437146f164e8882adc68c14def092"><enum>(C)</enum><text>has sufficient capacity and personnel with sufficient expertise to perform cybersecurity assessments and conduct reviews of risk and resilience assessments and emergency response plans under section 228; and</text></subparagraph> <subparagraph id="id039031bfb6d2419dbb41d4c1514d9172"><enum>(D)</enum><text>has sufficient security mechanisms in place to prevent any unsanctioned disclosure or dissemination of risk and resilience assessments, emergency response plans, and any other information provided by a covered treatment works, in alignment with the protocols developed by the Administrator under section 228(d)(3)(B)(i).</text></subparagraph></paragraph>
<paragraph id="id7e028abd09bf48a79e6b6ef321004418"><enum>(4)</enum><header>Timeline</header><text>Not later than 180 days after the date on which the Administrator receives an application described in paragraph (2), the Administrator shall—</text> <subparagraph id="ida65c06b60bd748d7a39f84d5a999d231"><enum>(A)</enum><text>if the Administrator determines that the State meets each requirement described in paragraph (3), grant the application; or</text></subparagraph>
<subparagraph id="id7940172a378e4fa3a1e9a563328672fc"><enum>(B)</enum><text>if the Administrator determines that the State fails to meet 1 or more of the requirements described in paragraph (3), deny the application.</text></subparagraph></paragraph> <paragraph id="idb3910c8781d540bdab9dd30d98ab1642"><enum>(5)</enum><header>Revocation of primary enforcement responsibility</header><text>The Administrator may, as appropriate, revoke an assumption of primary enforcement responsibility pursuant to this subsection if the Administrator determines that a State no longer meets 1 or more requirements described in paragraph (3).</text></paragraph>
<paragraph id="idb08bf276a17541a7a4125bdca984dbe0"><enum>(6)</enum><header>Regulations required</header><text>The Administrator shall promulgate regulations carrying out this subsection not later than 1 year after the date of enactment of this section, which shall include—</text> <subparagraph id="id0cd3960f7a0a4d05ab05151bb2e3486b"><enum>(A)</enum><text>the requirements for an application described in paragraph (2);</text></subparagraph>
<subparagraph id="id04edcf918dda41d18016897f137181e4"><enum>(B)</enum><text>the period for which a State may assume primary enforcement responsibility pursuant to this subsection before renewal; and</text></subparagraph> <subparagraph id="idb47967b754ae4262bf55298b93790c5f"><enum>(C)</enum><text>the manner by which the Administrator may revoke primary enforcement responsibility pursuant to paragraph (5).</text></subparagraph></paragraph>
<paragraph id="id41a9646505624a5ab9c9184c9f021b22" commented="no"><enum>(7)</enum><header>Savings provision</header><text>An assumption of primary enforcement responsibility pursuant to this subsection shall be separate from any responsibility otherwise assumed under this Act.</text></paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block></subsection> <subsection commented="no" display-inline="no-display-inline" id="idadbe50c526b24d35bd73ee28b5c6a4c6"><enum>(b)</enum><header>Inspections</header><text>Section 308(a) of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1318">33 U.S.C. 1318(a)</external-xref>) is amended, in the matter preceding subparagraph (A)—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idc12dbb4efe224288a4f7385847544fd6"><enum>(1)</enum><text display-inline="yes-display-inline">by striking <quote>or (4) carrying</quote> and inserting <quote>(4) carrying</quote>; and</text></paragraph> <paragraph commented="no" display-inline="no-display-inline" id="idbcae6698249c4940b744e5064e0d135e"> <enum>(2)</enum> <text>by striking <quote>504 of this Act—</quote> and inserting <quote>504; or (5) carrying out requirements under section 229—</quote>.</text> </paragraph></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id6b09602cd83941d7ab5fcc814b239a6c"><enum>(c)</enum><header>Federal enforcement</header><text>Section 309 of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1319">33 U.S.C. 1319</external-xref>) (as amended by section 201(b)) is amended in each of subsections (a), (c), (d), and (g) by inserting <quote>229,</quote> before <quote>301,</quote> each place it appears.</text></subsection></section> <section commented="no" display-inline="no-display-inline" id="id78998874a97c44e282636b1844562d2a"><enum>203.</enum><header>Clean water security assistance</header> <subsection commented="no" display-inline="no-display-inline" id="id012dd3afe67e4e7aa7a317f72e697074"><enum>(a)</enum><header>Authorization of appropriations</header><text>In addition to any amounts authorized to be appropriated under section 607 of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1387">33 U.S.C. 1387</external-xref>), there is authorized to be appropriated $300,000,000 for each of fiscal years 2027 through 2032 for the purposes of helping treatment works (as defined in section 212 of that Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1292">33 U.S.C. 1292</external-xref>)) build cybersecurity resilience (as defined in section 229 of the Federal Water Pollution Control Act) and identifying and mitigating cybersecurity vulnerabilities, including those included in risk and resilience assessments and emergency response plans prepared pursuant to section 228 of that Act.</text></subsection>
<subsection commented="no" display-inline="no-display-inline" id="id85d1360541924de8b9433283f1a1cfe2"><enum>(b)</enum><header>Guidance</header><text display-inline="yes-display-inline">The Administrator of the Environmental Protection Agency may issue guidance to determine specific criteria for eligible uses of the amounts made available under subsection (a) that further the purposes described in that subsection.</text></subsection> <subsection commented="no" display-inline="no-display-inline" id="id845c10194c644dbbaae1506fa0b97f3f"><enum>(c)</enum><header>Prioritization</header><text>In using amounts made available pursuant to subsection (a), a State shall prioritize providing assistance to treatment works (as defined in section 212 of the Federal Water Pollution Control Act (<external-xref legal-doc="usc" parsable-cite="usc/33/1292">33 U.S.C. 1292</external-xref>)) that have the greatest need with respect to capacity, workforce, expertise, or resources to adequately address cybersecurity vulnerabilities.</text></subsection>
<subsection id="id498e9f0a168544e1bc0e1ab4235630f9" commented="no" display-inline="no-display-inline"><enum>(d)</enum><header>Rollover</header><text>To the extent that any amounts authorized to be appropriated under subsection (a) in a fiscal year are not appropriated in that fiscal year, the amounts are authorized to be appropriated in a subsequent fiscal year, and shall remain available until expended.</text></subsection></section> <enum>III</enum><header>Cyber incident reporting obligations</header> <section id="id5743cf722a884f86b976917afd0aeed4"><enum>301.</enum><header>Cyber incident reporting</header><text display-inline="no-display-inline">Subtitle D of title XXII of the Homeland Security Act of 2002 (<external-xref legal-doc="usc" parsable-cite="usc/6/681">6 U.S.C. 681 et seq.</external-xref>) is amended—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idf35f5281c357457b9d413311db74554b"><enum>(1)</enum><text display-inline="yes-display-inline">in section 2240 (<external-xref legal-doc="usc" parsable-cite="usc/6/681">6 U.S.C. 681</external-xref>), by striking paragraph (4) and inserting the following:</text> <quoted-block style="OLC" display-inline="no-display-inline" id="ide90c2dcbf6734c5197e245cf5db318f0"> <paragraph id="id7d6bc8bb2cc54580a355eb56f1447765"><enum>(4)</enum><header>Covered entity</header><text>The term <term>covered entity</term>—</text>
<subparagraph id="idde26efb9f269485d8bf2882d91348301"><enum>(A)</enum><text>means an entity in a critical infrastructure sector, as defined in Presidential Policy Directive 21, that satisfies the definition established by the Director in the final rule issued pursuant to section 2242(b); and</text></subparagraph> <subparagraph id="idaf09e1ac24dc4387bb7fa2d9871f2781"><enum>(B)</enum><text>includes—</text>
<clause id="id12184cf64f344d75bd247e3dd0f2b669"><enum>(i)</enum><text>a community water system (as defined in section 1401 of the Safe Drinking Water Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300f">42 U.S.C. 300f</external-xref>)) that serves a population of greater than 3,300 persons; and</text></clause> <clause id="id7b23d8b10f5b4920bb2c93284a58b633"><enum>(ii)</enum><text>a covered treatment works (as defined in section 228(a) of the Federal Water Pollution Control Act).</text></clause></subparagraph></paragraph><after-quoted-block>;</after-quoted-block></quoted-block></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id057b73e726144f25900111e298a1295f"><enum>(2)</enum><text>in section 2242(a) (<external-xref legal-doc="usc" parsable-cite="usc/6/681b">6 U.S.C. 681b(a)</external-xref>), by adding at the end the following:</text> <quoted-block style="OLC" display-inline="no-display-inline" id="id1e95cb72fc78446a90acd92a985ae777"> <paragraph id="id078f6708c05e43a2b491632987066882"><enum>(8)</enum><header>Transmission to EPA</header><text>The Agency shall submit to the Administrator of the Environmental Protection Agency a copy of each report submitted to the Agency under paragraph (1), (2), or (3).</text></paragraph><after-quoted-block>; and</after-quoted-block></quoted-block></paragraph>
<paragraph commented="no" display-inline="no-display-inline" id="id1df6a263f76a4c1cbeffb36fdeb78ff5"><enum>(3)</enum><text>in section 2244(f) (<external-xref legal-doc="usc" parsable-cite="usc/6/681d">6 U.S.C. 681d(f)</external-xref>)—</text> <subparagraph commented="no" display-inline="no-display-inline" id="idf9f5eed8f27d49feb86e0c48fcc0f4fc"><enum>(A)</enum><text display-inline="yes-display-inline">by striking <quote>This section</quote> and inserting the following:</text>
<quoted-block style="OLC" display-inline="no-display-inline" id="idaba1e1a7cea848d6a664cc6310c2b6f0">
<paragraph commented="no" display-inline="no-display-inline" id="idf33d15f2d13549e184fcfb7807072f72"><enum>(1)</enum><header>In general</header><text>Except as provided in paragraph (2), this section</text></paragraph><after-quoted-block>; and</after-quoted-block></quoted-block></subparagraph> <subparagraph commented="no" display-inline="no-display-inline" id="id685d7c526dca45fdaacc8dbf9a5a7a5e"><enum>(B)</enum><text>by adding at the end the following:</text>
<quoted-block style="OLC" display-inline="no-display-inline" id="id8aa20373a558409d85f93060ea75bdf4">
<paragraph commented="no" display-inline="no-display-inline" id="idf8375669a024429c949602689495a027"><enum>(2)</enum><header>Exception</header><text>This section shall apply to a State, local, Tribal, or territorial government entity that is required to submit a report under section 2242(a) with respect to a community water system or covered treatment works, as defined in clauses (i) and (ii), respectively, of section 2240(4)(B), that is owned or operated by the State, local, Tribal or territorial government entity.</text></paragraph><after-quoted-block>.</after-quoted-block></quoted-block></subparagraph></paragraph></section>