Cybersecurity Policy Report, Senate Bill Would Empower EPA to Enforce Cyber Standards for Water, Wastewater Sectors, (Aug 10, 2026)
The Environmental Protection Agency would be empowered to develop and enforce cybersecurity standards for the water and wastewater sectors under legislation unveiled today by Sens. Adam Schiff (D., Calif.) and Amy Klobuchar (D., Minn.).
The introduction of the Water Cyber Shield Act (S.B. 5368, 119th Cong. (2026)) is a response to recent cyber attacks on U.S. water utilities and aims to plug a legal hole in EPA’s enforcement powers that became apparent in 2023, Sens. Schiff and Klobuchar said in a news release.
“The EPA serves as the federal Sector Risk Management Agency for the water sector, but it currently lacks many of the authorities necessary to oversee cybersecurity across the nation’s drinking water and wastewater systems. This legislation fills the gap exposed in 2023 when the Biden administration was forced to abandon a proposal for stronger cybersecurity guidelines after lawsuits by states over lack of explicit authority,” they said.
In 2023, the Biden administration’s EPA sought to impose cyber rules on a subset of water utilities but lost a court challenge mounted by the attorneys general for Arkansas, Iowa, and Missouri (CPR, Oct. 18, 2023).
Aside from the statutory gap that prevented EPA from cyber rulemaking, the U.S. water sector has a significant number of small systems that lack resources for regulatory compliance or cyber defense. The Water Cyber Shield Act would give those systems additional resources and require EPA to adjust its rules to account for the size of the regulated entity, according to a summary of the bill.
It would direct the EPA “to use a tiered approach, not a one-size-fits-all approach: the bill directs the EPA to establish baseline cybersecurity standards for all systems of various sizes and risks and gives EPA the ability to establish different standards for different categories of systems based on risk and capacity,” the summary says.
It would also authorize an additional $300 million each year in cybersecurity funding for the EPA’s Clean Water State Revolving Fund.
The bill’s provisions would apply to both the water and wastewater sectors by amending the Safe Drinking Water Act and Clean Water Act. For both sectors, it would require the EPA to establish technical advisory committees that include industry representatives.
The EPA would enforce the bill’s provisions but could hand those responsibilities off to states that want to assume them, the summary notes.
Gaps in water sector cybersecurity became apparent recently after water utilities in seven states were hit by hackers who exploited operational technology (OT). The hackers, suspected of working for the Iranian government, modified the OT systems and in some cases locked utilities out of their own networks (CPR, July 31).
“Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities,” Sen. Schiff said.
“These threats are not hypothetical—they are happening right now. This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers,” he added.
“The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure,” Sen. Klobuchar said. “Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats. Protecting our critical infrastructure and the safety of Minnesotans is a top priority.”
The American Water Works Association (AWWA), a trade group for the water sector, is still reviewing the bill, according to a spokesperson. AWWA sent a letter last week to congressional leaders expressing support for legislation to strengthen the water sector’s cyber defenses, including the Water Risk and Resilience Organization (WRRO) Establishment Act (HR 2594), which would create a WRRO of industry stakeholders and experts to develop cybersecurity rules for water and wastewater systems serving more than 3,300 people and submit the proposed rules to the EPA for approval (CPR, Aug. 6).
The National Association of Water Companies, which also supports the WRRO Establishment Act, welcomes the senators’ attention to the topic of water cybersecurity but has concerns “that the EPA does not have adequate resources to effectively implement the bill and enforce the new standards,” a spokesperson told CPR.
MainStory: TopStory FederalLegislation DataSecurity