To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.
- Sponsor
- Rep. Crawford, Eric A. "Rick" [R-AR-1]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Apr 2, 2025
Bottom line
H.R. 2594 seeks to enhance the cybersecurity posture of critical water infrastructure through a new industry-led, EPA-overseen self-regulatory framework.
What it actually does
This bill establishes a new self-regulatory entity, the Water Risk and Resilience Organization (WRRO), to develop and enforce cybersecurity risk and resilience requirements for community water systems and treatment works serving populations of 3,300 or more. The Environmental Protection Agency (EPA) would certify this single organization and oversee its proposed requirements and enforcement actions, but would defer to the WRRO's technical expertise.
Proponents argue
Proponents argue that the water sector is a critical infrastructure vulnerable to cyberattacks, and a specialized, industry-led organization like the WRRO is best positioned to develop practical, effective, and adaptable cybersecurity standards. They contend that this approach leverages sector-specific expertise, fosters industry buy-in, and allows for more agile responses to evolving cyber threats than traditional government regulation.
Opponents contend
Opponents might argue that delegating significant regulatory authority to a single, industry-led organization could lead to insufficient oversight, potential conflicts of interest, or standards that prioritize industry convenience over robust public safety. Concerns could also be raised about the EPA's deferential role, potentially weakening federal accountability for critical infrastructure protection, and the potential for high compliance costs for smaller covered water systems.
The bill is concise and can be read thoroughly within a short timeframe, allowing for a good understanding of its core mechanisms.
Section 1(b), 1(c)
Establishment and Certification of the Water Risk and Resilience Organization
This provision directs the EPA Administrator to issue rules for selecting and certifying a single Water Risk and Resilience Organization (WRRO). The WRRO must demonstrate advanced technical knowledge, include experienced water system owners/operators, prove its ability to develop effective cybersecurity requirements, secure sensitive information, and establish rules for independence, balanced stakeholder representation, reasonable fees, and fair enforcement procedures.
Supporters argue
Supporters argue that centralizing expertise within a single, industry-led organization ensures that cybersecurity requirements are practical, technically sound, and developed by those with direct operational experience in the water sector. This model promotes efficiency and responsiveness.
Critics contend
Critics might express concern that certifying only one organization could create a monopoly, potentially limiting diverse perspectives or innovation in cybersecurity approaches. They might also question the independence of an organization largely composed of industry members.
Tradeoffs
Balances the need for specialized industry expertise with concerns about potential monopolization and maintaining true independence from regulated entities.
Section 1(d)
Development and Approval of Cybersecurity Requirements
The WRRO is tasked with proposing cybersecurity risk and resilience requirements, along with implementation plans, to the EPA. The EPA must approve these requirements if they are "just, reasonable, and not unduly discriminatory or preferential," with a mandate to defer to the WRRO's technical expertise. The EPA can remand disapproved requirements with recommendations or order the WRRO to file specific requirements if existing ones are deemed insufficient.
Section 1(e), 1(f)
Compliance Monitoring, Assessment, and Enforcement by WRRO
The WRRO is responsible for routinely monitoring and assessing the effectiveness and implementation of its cybersecurity requirements. This includes requiring annual self-attestations from covered water systems and conducting third-party assessments at least every five years. The WRRO can impose penalties up to $25,000 per day for violations, after due process. Importantly, these WRRO penalties are the exclusive enforcement mechanism for these specific cybersecurity requirements, and collected funds are returned to the WRRO for training. The EPA retains review authority over WRRO penalties.
Section 1(g), 1(h)
Limitations on Authority and Independent Status of WRRO
This section clarifies that the WRRO and EPA are not authorized to develop binding cybersecurity requirements beyond what is specifically provided in this Act. It also states that the Act does not preempt state authority over water service safety and resilience, provided state actions are not inconsistent with WRRO requirements. Crucially, the WRRO is explicitly defined as not a department, agency, or instrumentality of the United States Government.
States that "No penalty may be imposed on a covered water system under any other provision of law for a violation of a cybersecurity risk and resilience requirement approved by the Administrator under subsection (d)." It also specifies that "Any penalties collected under this subsection shall be returned to the WRRO to support training initiatives and other resource capabilities of the WRRO under this section."
Section 1(f)(4)(B) and (C)
Why it matters:This is a significant detail that defines the scope of enforcement and the financial incentives for the WRRO. It's not a primary statement of purpose but a critical operational detail. It could be seen as standard legislative drafting to define enforcement scope, or potentially as a way to limit external oversight and provide a self-funding mechanism for the WRRO.
Case for: Supporters would argue that this provision streamlines enforcement, preventing multiple agencies from penalizing the same violation, and ensures that funds collected from the industry are reinvested directly into improving the sector's cybersecurity capabilities through the WRRO's training and resources.
Case against: Critics might contend that this provision effectively removes other federal enforcement levers for cybersecurity in the water sector, potentially limiting the government's ability to respond to severe or repeated non-compliance. Returning funds to the WRRO could be seen as a conflict of interest, incentivizing penalties rather than prevention.
Estimated impact: Shifts enforcement authority and financial resources related to cybersecurity compliance exclusively to the WRRO, potentially impacting millions of dollars in penalties and the operational budget of the WRRO.