Water Cyber Shield Act of 2026
- Sponsor
- Sen. Schiff, Adam B. [D-CA]
- Committees
- Environment and Public Works Committee (primary)
- Last action
- Aug 7, 2026
Bottom line
The Water Cyber Shield Act of 2026 mandates comprehensive cybersecurity standards, assessments, and reporting for critical drinking water and wastewater infrastructure, backed by significant federal funding authorizations, marking a shift from voluntary guidelines to enforceable regulations.
What it actually does
This bill establishes new, mandatory cybersecurity requirements for community drinking water systems serving over 3,300 people and for certain large wastewater treatment works. It amends the Safe Drinking Water Act and the Federal Water Pollution Control Act to require risk and resilience assessments that explicitly include cybersecurity risks, and mandates emergency response plans with specific cybersecurity countermeasures. The bill also directs the EPA to establish baseline cybersecurity standards and performance metrics, with states responsible for conducting assessments and enforcing compliance, backed by federal oversight. Additionally, it authorizes $3.6 billion in funding over six fiscal years to help these systems enhance their cybersecurity resilience and integrates these water systems into federal cyber incident reporting obligations.
Proponents argue
Supporters argue that the bill is a critical and overdue measure to protect vital public health and safety infrastructure from escalating cyber threats. They contend that the current voluntary approach is insufficient given the increasing sophistication of cyberattacks, and that mandatory standards, coupled with federal financial assistance, are essential to ensure the resilience of water systems nationwide. Proponents emphasize that securing these systems is a national security imperative and will prevent potentially catastrophic disruptions to essential services.
Opponents contend
Critics might raise concerns about the potential for federal overreach into state and local utility operations, arguing that a 'one-size-fits-all' approach to cybersecurity standards may not be appropriate for the diverse range of water systems. They may also highlight the significant financial and administrative burdens these new mandates could place on smaller systems, even with authorized federal funding, potentially leading to increased water rates for consumers or diversion of resources from other critical infrastructure needs. Some may also question the EPA's capacity to effectively regulate complex cybersecurity issues.
The bill is moderately complex, requiring careful reading to understand the amendments to existing statutes and the technical nature of cybersecurity requirements. An informed reader would need adequate time to fully grasp its implications.
Sec. 101, amending Section 1433 of the Safe Drinking Water Act
Community Water System Risk and Resilience Assessments
This section modifies existing requirements for community water systems serving more than 3,300 people to conduct risk and resilience assessments and prepare emergency response plans. It explicitly adds the requirement to assess risks to electronic, computer, or other automated systems for identifying significant cybersecurity risks. Emergency response plans must now include countermeasures to mitigate these identified cybersecurity risks, along with a schedule for their adoption. These assessments and plans must be reviewed and revised every five years.
Supporters argue
Supporters argue that explicitly including cybersecurity in risk assessments and emergency plans is crucial for protecting water infrastructure from modern threats. This ensures that systems proactively identify vulnerabilities and plan for mitigation, enhancing overall resilience.
Critics contend
Opponents may contend that these new requirements add significant compliance costs and administrative burdens, especially for smaller systems within the affected population threshold, potentially without sufficient federal funding to offset these expenses.
Tradeoffs
This provision balances the need for enhanced cybersecurity with the potential for increased regulatory and financial burdens on water utilities. It aims to improve security but may strain resources for some systems.
Sec. 102, adding Section 1433A to the Safe Drinking Water Act
Cybersecurity Requirements for Drinking Water Systems
This new section mandates that states carry out cybersecurity assessments of public water systems, evaluating their operational technology and connected information technology against baseline cybersecurity standards established by the EPA. The EPA is directed to develop these standards in collaboration with CISA, NIST, and a technical advisory committee, ensuring they account for varied system capacities and risks. The EPA will also establish cybersecurity performance metrics for the sector. States can assume primary enforcement responsibility if they meet specific criteria, otherwise, the EPA will enforce these requirements.
Sec. 103
Drinking Water Security Assistance Program
This section authorizes the appropriation of $300,000,000 for each of fiscal years 2027 through 2032, totaling $1.8 billion, to help public water systems build cybersecurity resilience and mitigate vulnerabilities. The Administrator of the EPA may issue guidance for eligible uses of these funds, and states are directed to prioritize assistance to systems with the greatest need regarding capacity, workforce, expertise, or resources. Any unappropriated funds from a fiscal year are authorized to be appropriated in subsequent years and remain available until expended.
Sec. 201, adding Section 228 to the Federal Water Pollution Control Act
Treatment Works Risk and Resilience Assessments
This section establishes new requirements for 'covered treatment works' (wastewater systems treating domestic sewage, serving >10,000 persons, and with a design flow rate of >1,000,000 gallons) to conduct risk and resilience assessments. Similar to drinking water systems, these assessments must include cybersecurity risks to electronic and automated systems, and emergency response plans must detail countermeasures. These plans and assessments must be reviewed and revised every five years. The EPA will provide baseline information on malevolent acts, and states will review and approve the cybersecurity portions of these documents.
Sec. 202, adding Section 229 to the Federal Water Pollution Control Act
Cybersecurity Requirements for Treatment Works
This new section mirrors the cybersecurity requirements for drinking water systems, applying them to 'covered treatment works.' It mandates state-led cybersecurity assessments, evaluation against EPA-established baseline cybersecurity standards, and the development of sector-wide performance metrics. The EPA is responsible for developing these standards and metrics, consulting with relevant agencies and a technical advisory committee. States can assume primary enforcement responsibility for these requirements, with the EPA serving as the backstop enforcer.
Sec. 203
Clean Water Security Assistance Program
This section authorizes the appropriation of $300,000,000 for each of fiscal years 2027 through 2032, totaling $1.8 billion, to help treatment works build cybersecurity resilience and mitigate vulnerabilities. Similar to the drinking water assistance, the EPA may issue guidance for eligible uses, and states must prioritize assistance to systems with the greatest need. Unappropriated funds are authorized to roll over to subsequent fiscal years and remain available until expended.
Sec. 301, amending Subtitle D of title XXII of the Homeland Security Act of 2002
Cyber Incident Reporting Obligations for Water Systems
This section amends the Homeland Security Act of 2002 to include community water systems serving over 3,300 persons and 'covered treatment works' (as defined in the bill) in the definition of 'covered entity' for cyber incident reporting. This means these water systems will be required to report significant cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA). CISA is then mandated to submit a copy of each such report to the Administrator of the Environmental Protection Agency (EPA). The section also clarifies that state, local, Tribal, or territorial government entities owning or operating such water systems are subject to these reporting requirements.
Exempts specific cybersecurity assessment and emergency response plan information submitted to states from disclosure under the Freedom of Information Act (FOIA) and similar state, Tribal, or local freedom of information laws.
Sec. 101(5), amending SDWA 1433(c)(3)(A) and Sec. 201(d)(3)(A) and (4), adding FWPCA 228(d)(3)(A) and (4)
Why it matters:This is standard legislative practice for protecting sensitive infrastructure security information. The intent is to prevent malicious actors from using public records requests to gain insights into system vulnerabilities, which would undermine the very purpose of the assessments.
Case for: Proponents argue that this exemption is absolutely necessary to protect sensitive cybersecurity information from falling into the wrong hands, thereby enhancing national security and the actual resilience of water systems. Without it, systems might be hesitant to provide full details.
Case against: Critics might argue that such broad exemptions reduce transparency and public accountability, making it harder for the public and oversight bodies to understand the security posture of their local water systems. This could lead to a lack of public trust or awareness regarding potential vulnerabilities.
Estimated impact: Significantly impacts public access to information regarding water system cybersecurity, prioritizing security over transparency.
Defines 'State' for the purposes of these new cybersecurity requirements. While it primarily refers to a State that has assumed primary enforcement responsibility, it explicitly states that if a State has not assumed such responsibility, the term 'State' shall be considered a reference to the Administrator (EPA).
Sec. 101(7), amending SDWA 1433(h)(3) and Sec. 102(a), adding SDWA 1433A(a)(3); Sec. 201(a), adding FWPCA 228(a)(4) and Sec. 202(a), adding FWPCA 229(a)(4)
Why it matters:This is standard legislative drafting to ensure a federal backstop for enforcement. It's a technical detail that clarifies jurisdictional authority rather than being intentionally obscured.
Case for: Proponents argue this ensures that cybersecurity requirements are enforced nationwide, regardless of whether individual states have the capacity or willingness to assume primary enforcement. It provides a necessary federal safety net.
Case against: Critics might argue that this provision allows the EPA to exert federal control over local water systems even if states prefer to manage their own regulatory frameworks, potentially undermining state autonomy.
Estimated impact: Ensures universal application and enforcement of the new cybersecurity mandates across all affected water and wastewater systems, preventing regulatory gaps.
Mandates the establishment of a technical advisory committee to provide input, review, and refine the baseline cybersecurity standards. The committee must include representatives from public water systems of various sizes, professional water associations, cybersecurity experts, a relevant voluntary consensus standards body, and an information technology or operational technology service provider that provides cybersecurity services to public water systems.
Sec. 102(a), adding SDWA 1433A(c)(2)(D) and Sec. 202(a), adding FWPCA 229(c)(2)(D)
Why it matters:This level of detail is typical for specifying the composition of advisory bodies in legislation. It's a technical specification to ensure broad stakeholder input, not an attempt to hide information.
Case for: Proponents argue that this ensures the baseline standards are practical, informed by real-world operational challenges, and leverage existing industry best practices. Including diverse stakeholders, especially service providers, ensures technical feasibility and broad buy-in.
Case against: Critics might suggest that including representatives from IT/OT service providers on the committee could create potential conflicts of interest, as these entities stand to benefit financially from the implementation of new cybersecurity standards.
Estimated impact: Shapes the content and practical applicability of the mandatory cybersecurity standards, influencing compliance costs and effectiveness for water systems.