Sens. Adam Schiff, D-Calif., and Amy Klobuchar, D-Minn., unveiled legislation on Aug. 10 that would expand the Environmental Protection Agency’s (EPA) cybersecurity authority over drinking water and wastewater systems following a series of cyberattacks against U.S. water utilities.
The lawmakers said that while the EPA serves as the federal Sector Risk Management Agency for the water sector, it currently lacks many of the authorities needed to oversee cybersecurity.
The Water Cyber Shield Act would authorize the EPA to conduct cybersecurity assessments of public water systems and require corrective actions when significant vulnerabilities are identified.
It would also authorize an additional $300 million each year for cybersecurity improvements through the Drinking Water and Clean Water State Revolving Funds.
“Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities,” Schiff said in a press release announcing the legislation. “These threats are not hypothetical – they are happening right now.”
“This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers,” Schiff said.
Last month, federal agencies warned water utilities about increasing cyber threats to the sector. Their warning followed cyberattacks against more than 30 municipal water systems in Minnesota.
In recent days, the senators said coordinated attacks targeted over 30 community water systems across multiple states.
The legislation would direct EPA to develop tiered cybersecurity standards in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), states, and water-sector stakeholders.
The bill would also require large drinking water and wastewater systems to assess cybersecurity risks as part of their existing risk and resilience planning.
It would also extend federal cyber incident reporting requirements to state- and locally-owned water and wastewater systems that have been exempt from those requirements, while protecting sensitive cybersecurity information that utilities submit to the government from public disclosure.
Smaller systems and utilities with fewer resources would receive additional flexibility under the legislation and would be prioritized for federal financial assistance. EPA would also establish a technical advisory committee to work closely with water utilities on cybersecurity standards.
“The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure,” Klobuchar said. “Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats.”
Schiff and Klobuchar said the legislation was developed after consultation with federal agencies, water-sector stakeholders, state regulators, and cybersecurity experts.
The proposal follows a failed federal effort in 2023 to strengthen cybersecurity requirements for public water systems. EPA withdrew a memorandum that sought to incorporate cybersecurity into state reviews of water systems after states challenged the agency’s authority to impose the requirements.
It also comes after water industry groups asked Washington for cybersecurity rules. The American Water Works Association (AWWA) sent a letter on Aug. 5 to congressional leadership urging strong federal support for water utilities following the recent cyberattacks.
“We respectfully urge Congress to provide the support utilities have long needed for continued cybersecurity investment in their systems,” AWWA CEO David LaFrance wrote in the letter.