Cybersecurity Policy Report, House Subcommittee Hears Conflicting Views on Need for Water Sector Cyber Rules, (Feb 24, 2026)
Organizations Mentioned:North American Electric Reliability Corporation (NERC)
Witnesses at a House subcommittee hearing today offered conflicting views on the need for government mandates to improve the cyber defenses of the water and wastewater sector.
Legislation that merely aims to raise awareness of the cybersecurity resources available to water utilities falls short of what the sector actually needs, according to Lindsey Rechtin, who testified on behalf of the Association of Metropolitan Water Agencies (AMWA).
But a witness for the National Rural Water Association (NRWA), Eric Hill, recommended against any mandates, particularly for the smaller utilities represented by NRWA.
Ms. Rechtin told the House Energy and Commerce Committee’s environment subcommittee that AMWA endorsed the approach taken by the Water Risk and Resilience Organization (WRRO) Establishment Act (HR 2594), which would empower a WRRO to recommend cybersecurity rules to the Environmental Protection Agency.
HR 2594 would create a WRRO of industry stakeholders and experts to develop cybersecurity rules for water and wastewater systems serving more than 3,300 people and submit the proposed rules to the EPA for approval.
“Based on the model of the North American Electric Reliability Corporation in the energy sector, the WRRO would work in partnership with the EPA to ensure that water systems employ minimum best practices to defend against cyber threats, while avoiding one-size-fits-all mandates,” Ms. Rechtin said in her written testimony.
“The WRRO model would leverage the expertise and experience of utility managers and operators when formulating practical requirements that consider utility scale, resources, existing challenges, and the most pressing threats,” she said.
“The WRRO therefore goes one step beyond simply making water systems aware of cyber best practices and would provide direction on specifically which actions individual water systems should adopt, based upon their size and unique risk profiles,” she added.
“As Congress explores various options to bolster water systems’ cybersecurity posture, AMWA strongly encourages that the WRRO model be part of the discussion,” Ms. Rechtin told the subcommittee.
Other legislation that would provide funding and resources to the water sector also has AMWA’s endorsement, she said, including the Water Intelligence, Security, and Cyber Threat Protection Act (HR 2344) and the Water Infrastructure Resilience and Sustainability Act (HR 5566).
HR 2344, introduced by Rep. Jan Schakowsky (D., Ill.), and its Senate companion (S 1181), introduced by Sen. Ed Markey (D., Mass.), would allocate $20 million to help smaller water systems pay for membership in the Water Information Sharing and Analysis Center (CPR, March 26, 2025).
HR 5566, bipartisan legislation sponsored by Rep. Salud Carbajal (D., Calif.), would reauthorize three grant programs that are due to expire and provide $100 million annually for water sector cybersecurity (CPR, Sept. 29, 2025).
“AMWA believes that each of these legislative proposals should remain part of the discussion as Congress explores ways to improve cybersecurity in the water sector,” Ms. Rechtin said.
Mr. Hill, however, suggested that the cybersecurity rules contemplated by HR 2594 would be unworkable for smaller water systems. He recalled that the EPA tried that approach and was rebuffed by a federal court for overreach (CPR, Oct. 13, 2023).
NRWA was an intervenor in the lawsuit challenging the EPA’s cyber mandate, which would have required water systems to include cybersecurity assessments in the periodic “sanitary surveys” that previously had focused on physical security.
“NRWA supports cybersecurity implementation but believes that education and support, not mandated sanitary surveys, are the right path forward for small systems,” Mr. Hill said in his written testimony.
“Operators and managers need to be educated and prepared by an expert they trust, and an expert that is qualified to train and implement a solution onsite, face to face with the operator,” he said. “Meaningful security improvements happen in small communities through trusted relationships and practical, affordable solutions, not through one-size-fits-all mandates.”
News: FederalLegislation DataSecurity