§300g–10 Cybersecurity Support for Public Water Systems

Summary

Requires the Administrator, working with the Director of the Cybersecurity and Infrastructure Security Agency (CISA), to pick which public water systems are most important to protect from cyber attacks and to make a plan for offering voluntary technical help. Not later than 180 days after November 15, 2021, the Administrator must create a Prioritization Framework to find water systems (and their water sources) whose failure would seriously harm public health or safety. The Framework should, when possible, consider whether vulnerabilities were already found under section 300i–2, whether the system can fix problems without federal help, whether it serves a defense or national security site, and whether its failure would trigger other infrastructure failures. Not later than 270 days after November 15, 2021, the Administrator must make a Technical Cybersecurity Support Plan that sets how systems get prioritized, timelines for offering voluntary help, which systems may need help, and what supports may be used (for example, site assessments and penetration tests). The Administrator must consult other federal and nonfederal parties while making these documents. Defines a few terms in one line each: Appropriate Congressional committees (four named committees in the Senate and House), Director (head of CISA), Incident (as defined in 44 U.S.C. 3552), Prioritization Framework (the framework described above), and Support Plan (the Technical Cybersecurity Support Plan). The Administrator must send the Framework to the named congressional committees not later than 190 days after November 15, 2021, and must send the Support Plan and a list of systems identified as needing help not later than 280 days after November 15, 2021. Nothing in the law changes the Administrator’s existing powers or forces a water system to accept the offered help.