PRIA Logo™
119-hr-2594119th CongressWALLET

To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

Sponsored By: Representative Crawford, Eric A. "Rick" [R-AR-1]

In Committee

Summary

Creates a new independent body to set cybersecurity rules for large water systems. The Water Risk and Resilience Organization, certified by the EPA Administrator, will draft technical cyber risk and resilience requirements and implementation plans.

Show full summary
  • People served by large water systems may get stronger safeguards against cyberattacks that disrupt water treatment and delivery.
  • Community water systems and treatment works serving 3,300 or more people must meet WRRO-approved cybersecurity requirements, submit annual self-attestations and assessments at least every five years, and could face penalties up to $25,000 per day for violations.
  • Any eligible organization may apply for WRRO certification if it shows technical expertise, independence, balanced governance, and protections for sensitive information. The EPA Administrator reviews proposals for being just and reasonable and resolves conflicts with existing rules.

*Authorizes $10 million to remain available until expended to support the WRRO, increasing federal spending by $10 million.*

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

4 provisions identified: 2 benefits, 0 costs, 2 mixed.

Who is covered by water cyber rules

This bill would set who must follow the new cyber rules. A covered system would be a community water system or a treatment works that serves 3,300 or more people. If your town’s system is that size, it would need to meet the new standards and checks. Smaller systems would not be covered.

How water cyber rules get made and enforced

The new WRRO would file each proposed cyber rule with EPA, with a rollout schedule and a proposed enforcement date. EPA would approve rules that are just and reasonable and would defer to WRRO on technical details. If EPA rejects a filing, it would send fixes within 90 days. Covered systems would attest to compliance each year and get assessed at least once every five years. If enacted, violations could bring fines up to $25,000 per day, after notice, consultation, a hearing, and EPA filing; no fine could start sooner than 31 days after that filing. EPA could review a penalty within 30 days, and collected fines would fund WRRO training and resources.

New water cyber standards group and funding

EPA would set up a certification program within 270 days to name one Water Risk and Resilience Organization. Any group could apply, but only one could be certified. The group would need deep technical skill, owner/operator experience, independence, and strong rules to protect sensitive data and ensure fair enforcement. The bill would authorize $10 million for the WRRO, available until spent. The WRRO would not be a federal agency.

State role and resolving rule conflicts

The final rule would include steps to find and fix conflicts between new cyber rules and existing EPA‑approved orders or agreements. Covered systems would keep following existing orders unless EPA finds a conflict and orders a change that takes effect. If a cyber rule must change, EPA would tell the WRRO to file a modified rule. States could keep acting on water safety and resilience as long as their rules do not conflict with an EPA‑approved cyber rule. The bill would not give broad new federal power beyond what it spells out.

Sponsors & CoSponsors

Sponsor

Crawford, Eric A. "Rick" [R-AR-1]

AR • R

Cosponsors

  • Rep. Bresnahan, Robert P. [R-PA-8]

    PA • R

    Sponsored 4/17/2025

  • Rep. Finstad, Brad [R-MN-1]

    MN • R

    Sponsored 6/3/2025

  • Rep. Vindman, Eugene Simon [D-VA-7]

    VA • D

    Sponsored 9/4/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation