§300g–10 Cybersecurity support for public water systems

Summary

The Administrator, working with the Director of the Cybersecurity and Infrastructure Security Agency, must make two things after November 15, 2021. Within 180 days the Administrator must create a Prioritization Framework to find public water systems whose loss would seriously hurt public health and safety. The framework should, when possible, look at known cybersecurity flaws under 42 U.S.C. 300i–2, whether the system can fix problems without federal help, whether it serves a defense or other national security site, and whether its failure would cause other infrastructure to fail. Within 270 days the Administrator must make a Technical Cybersecurity Support Plan that explains how to pick systems to help, timelines for offering voluntary help, and what kinds of help may be offered (for example, site vulnerability and risk assessments, penetration tests, and other support). The Administrator must consult others as needed and must send the Prioritization Framework to Congress within 190 days and the Support Plan and any list of systems needing help to Congress within 280 days after November 15, 2021. Defined terms (one line each): appropriate Congressional committees — the Senate Environment and Public Works; Senate Homeland Security and Governmental Affairs; House Energy and Commerce; and House Homeland Security. Director — the Director of CISA. incident — the meaning in 44 U.S.C. 3552. Prioritization Framework — the framework the Administrator develops. Support Plan — the Technical Cybersecurity Support Plan the Administrator develops. Nothing in this requires changing the Administrator’s existing powers, and no public water system can be forced to accept the offered technical help.