Water Cyber Shield Act of 2026

This bill aims to significantly enhance the cybersecurity posture of critical water infrastructure across the United States. It specifically targets community water systems serving populations greater than 3,300 people and certain wastewater treatment works that treat domestic sewage, serve over 10,000 persons, and have a design flow rate of 1,000,000 gallons or more. The legislation seeks to protect these vital systems from malevolent acts and natural hazards, with a particular focus on cyber threats. The bill mandates that both types of systems conduct and regularly revise risk and resilience assessments at least every five years. These assessments must include identifying significant cybersecurity risks to electronic, computer, or other automated systems. Following these assessments, systems are required to develop or update emergency response plans that incorporate findings and detail countermeasures to mitigate identified cybersecurity vulnerabilities, including a schedule for their adoption. The Environmental Protection Agency (EPA) is directed to establish baseline cybersecurity standards through rulemaking, collaborating with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST). These standards will serve as requirements for ensuring cybersecurity resilience, with consideration for the varied capacities and risks of different systems. States will be responsible for carrying out cybersecurity assessments, reviewing plans, and enforcing compliance, with provisions for states to assume primary enforcement responsibility if they meet specific criteria for procedures, capacity, and security mechanisms. To support these efforts, the bill authorizes $300 million annually for fiscal years 2027 through 2032 to help public water and treatment works build cybersecurity resilience and mitigate vulnerabilities. This funding is to be prioritized for systems with the greatest need in terms of capacity, workforce, expertise, or resources. The EPA will also provide essential guidance and technical assistance to help systems implement the new requirements and enhance their cybersecurity. Furthermore, the legislation amends the Homeland Security Act of 2002 to include these community water systems and covered treatment works as "covered entities" for cyber incident reporting. This means they will be required to report cybersecurity incidents to CISA. CISA, in turn, will be mandated to transmit copies of these reports to the EPA, ensuring a coordinated federal response and oversight of cybersecurity threats to the water sector.