PRIA Logo™
119-s-5368119th CongressWALLET

Water Cyber Shield Act of 2026

Sponsored By: Senator Schiff, Adam B. [D-CA]

Introduced

Summary

Creates a coordinated federal–state cybersecurity regime for drinking water and wastewater systems. It would require routine cyber risk assessments, mandatory incident reporting for certain systems, and provide grant funding and technical assistance to harden networks and operational technology.

Show full summary
  • Community households: Community water systems serving more than 3,300 people would need cybersecurity risk assessments and emergency response plans that are reviewed and updated at least every 5 years.
  • Large treatment plants and operators: Covered treatment works that serve over 10,000 people and meet the 1,000,000 gallons‑per‑day threshold would complete resilience assessments, submit specified plan portions to States, and retain records for five years.
  • States and federal agencies: States must review and approve or disapprove submissions, do risk‑based annual inspections, and may enforce standards or apply to assume enforcement. EPA would set baseline cybersecurity standards in coordination with CISA and NIST and provide technical assistance and grant funding, with confidential handling rules for submitted materials.

*Would increase federal spending by $300 million per year from 2027 through 2032 for drinking water cybersecurity assistance.*

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 1 benefits, 0 costs, 2 mixed.

Federal grants for water cybersecurity

This bill would authorize $300 million per year for FY2027–FY2032 to help public water systems improve cybersecurity. It would also authorize $300 million per year for FY2027–FY2032 for treatment works cybersecurity. EPA would write guidance on eligible uses and States would prioritize systems with the greatest need. Congress must still appropriate the money and any authorization not appropriated in a year would remain available until spent.

New cybersecurity rules for water utilities

This bill would direct EPA, with CISA and NIST, to set baseline cybersecurity standards and performance metrics for water systems. Community water systems serving more than 3,300 people would need risk and resilience assessments and emergency response plans, reviewed at least every five years. Large sewage treatment plants (serve >10,000 people and design flow ≥1,000,000 gallons) would face similar assessment and planning rules and must keep records for five years. States would review specified plan portions and do annual, risk-informed inspections; these rules would raise security but also add compliance work and costs that utilities might pass to customers.

Reporting, enforcement, and data protections

This bill would protect submitted cybersecurity assessments and plans from public disclosure and require EPA to issue secure handling protocols within 180 days. It would add community water systems serving more than 3,300 people and large treatment works to mandatory cyber-incident reporting and require agencies that receive reports to send copies to EPA. The bill would make the treatment works cybersecurity rules enforceable under federal water pollution law. States could apply to EPA to assume primary enforcement and EPA would have 180 days to act on each application.

Sponsors & CoSponsors

Sponsor

Schiff, Adam B. [D-CA]

CA • D

Cosponsors

  • Sen. Klobuchar, Amy [D-MN]

    MN • D

    Sponsored 8/7/2026

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation