119-hr2594

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 2594 Introduced in House

    (IH) ]

<DOC>

119th CONGRESS
 1st Session
 H. R. 2594

 To establish a Water Risk and Resilience Organization to develop risk 
 and resilience requirements for the water sector.

_______________________________________________________________________

 IN THE HOUSE OF REPRESENTATIVES

 April 2, 2025

 Mr. Crawford introduced the following bill; which was referred to the 
Committee on Transportation and Infrastructure, and in addition to the 
 Committee on Energy and Commerce, for a period to be subsequently 
 determined by the Speaker, in each case for consideration of such 
 provisions as fall within the jurisdiction of the committee concerned

_______________________________________________________________________

 A BILL

 To establish a Water Risk and Resilience Organization to develop risk 
 and resilience requirements for the water sector.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. WATER RISK AND RESILIENCE ORGANIZATION.

    (a) 

=== Definitions. ===
-In this section:

    (1) Administrator.--The term ``Administrator'' means the 
 Administrator of the Environmental Protection Agency.

    (2) Covered water system.--The term ``covered water 
 system'' means--
        (A) a community water system (as defined in 

section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f)) 
 that serves a population of 3,300 or more persons; or
        (B) a treatment works (as defined in 

section 212 of 
 the Federal Water Pollution Control Act (33 U.S.C. 
 1292)) that serves a population of 3,300 or more 
 persons.

    (3) Cyber resilient.--
        (A) In general.--The term ``cyber resilient'' means 
 the ability of a covered water system to withstand or 
 reduce the magnitude or duration of cybersecurity 
 incidents that disrupt the ability of the covered water 
 system to function normally.
        (B) Inclusion.--The term ``cyber resilient'' 
 includes the ability of a covered water system to 
 anticipate, absorb, adapt to, or rapidly recover from 
 cybersecurity incidents.

    (4) Cybersecurity incident.--The term ``cybersecurity 
 incident'' means a malicious act or suspicious event that 
 disrupts, or attempts to disrupt, the operation of programmable 
 electronic devices and communication networks, including 
 hardware, software, and data that are essential to the cyber 
 resilient operation of a covered water system.

    (5) Cybersecurity risk and resilience requirement.--The 
 term ``cybersecurity risk and resilience requirement'' means a 
 requirement that provides for the cyber resilient operation of 
 a covered water system and the cyber resilient design of 
 planned additions or modifications to a covered water system.

    (6) Water risk and resilience organization; wrro.--The 
 terms ``Water Risk and Resilience Organization'' and ``WRRO'' 
 mean the organization certified by the Administrator under 
 subsection
            (c) .

    (b) Applicability.--Not later than 270 days after the date of 
enactment of this Act, the Administrator shall issue a final rule to 
carry out this section, including regulations for the selection and 
certification of the WRRO under subsection
            (c) .
            (c) Certification.--

    (1) In general.--Following the issuance of the final rule 
 under subsection

    (b)

    (1) , any organization may submit an 
 application to the Administrator, at such time, in such manner, 
 and containing such information as the Administrator may 
 require, for certification as the Water Risk and Resilience 
 Organization.

    (2) Requirements.--The Administrator shall certify not more 
 than 1 organization that submitted an application under 
 paragraph

    (1) as the Water Risk and Resilience Organization if 
 the Administrator determines that the organization--
        (A) demonstrates advanced technical knowledge and 
 expertise in the operations of covered water systems;
        (B) is comprised of 1 or more members with relevant 
 experience as owners or operators of covered water 
 systems;
            (C) has demonstrated the ability to develop and 
 implement cybersecurity risk and resilience 
 requirements that provide for an adequate level of 
 cybersecurity risk and resilience for a covered water 
 system;
            (D) is capable of establishing measures, in line 
 with prevailing best practices, to secure sensitive 
 information and to protect sensitive security 
 information from public disclosure; and
        (E) has established rules that--
            (i) require that the organization be 
 independent of the users, owners, and operators 
 of a covered water system, with balanced and 
 objective stakeholder representation in the 
 selection of directors of the organization and 
 balanced decision making in any committee or 
 subordinate organizational structure;
            (ii) require that the organization allocate 
 reasonable dues, fees, and other charges among 
 end-users for all activities under this 
 section;
            (iii) provide just and reasonable 
 procedures for enforcement of cybersecurity 
 risk and resilience requirements and the 
 imposition of penalties in accordance with 
 subsection

    (f) , including limitations on 
 activities, functions, or operations, or other 
 appropriate sanctions; and
            (iv) provides for reasonable notice and 
 opportunity for public comment, due process, 
 openness, and balancing of interests in 
 developing cybersecurity risk and resilience 
 requirements and otherwise exercising duties 
 described in this section.
            (d) Cybersecurity Risk and Resilience Requirements.--

    (1) In general.--
        (A) Proposed requirements.--The WRRO shall file 
 with the Administrator each cybersecurity risk and 
 resilience requirement or modification to such a 
 requirement that the WRRO proposes to be made effective 
 under this section.
        (B) Implementation plan.--
            (i) In general.--For each proposed 
 cybersecurity risk and resilience requirement 
 or modification to such a requirement filed 
 pursuant to subparagraph
        (A) , the WRRO shall 
 file an implementation plan, including the 
 schedule for implementation, which may include 
 a specified date, by which covered water 
 systems shall achieve compliance with all of 
 the cybersecurity risk and resilience 
 requirement or modification to such a 
 requirement. The implementation schedule may 
 account for a phased rollout of the 
 requirement, recognizing that the requirement 
 may not apply, in totality, to all covered 
 water systems.
            (ii) Reasonable deadlines.--The enforcement 
 date proposed by the WRRO in the implementation 
 plan under clause
            (i) shall provide a 
 reasonable implementation period for covered 
 water systems to meet the requirements under 
 the implementation plan.

    (2) Approval.--
        (A) In general.--Notwithstanding paragraph

    (3)
        (A) , 
 the Administrator shall approve a proposed 
 cybersecurity risk and resilience requirement or 
 modification to such a requirement, including the 
 accompanying implementation plan filed under paragraph

    (1) , if the Administrator determines that the 
 requirement is just, reasonable, and not unduly 
 discriminatory or preferential.
        (B) Deference to wrro.--The Administrator shall 
 defer to the technical expertise of the WRRO with 
 respect to the content of a proposed cybersecurity risk 
 and resilience requirement or modification to such a 
 requirement.

    (3) Disapproval of requirement.--
        (A) In general.--Notwithstanding paragraph

    (2)
        (A) , 
 if the Administrator disapproves, in whole or in part, 
 a filed cybersecurity risk and resilience requirement 
 or modification to such a requirement, the 
 Administrator shall remand such requirement to the WRRO 
 and provide to the WRRO specific recommendations that 
 would lead to the approval of the cybersecurity risk 
 and resilience requirement or modification to such 
 requirement under paragraph

    (2) .
        (B) Timeline.--The Administrator shall remand to 
 the WRRO a proposed cybersecurity risk and resilience 
 requirement or modification to such a requirement 
 disapproved under subparagraph
        (A) , including the 
 submission of the specific recommendations required 
 under that subparagraph, not later than 90 days after 
 the date on which the WRRO filed the requirement or 
 modification with the Administrator under paragraph

    (1)
        (A) .
            (C) Response and approval.--
            (i) In general.--On receipt of the remand 
 of a proposed cybersecurity risk and resilience 
 requirement or modification to such a 
 requirement and receipt of the specific 
 recommendations of the Administrator pursuant 
 to subparagraph
        (A) , the WRRO shall--
            (I) accept the recommendations of 
 the Administrator and resubmit an 
 amended proposed cybersecurity risk and 
 resilience requirement or modification 
 to such a requirement consistent with 
 those recommendations;
            (II) provide to the Administrator 
 and a reason why the recommendation was 
 not accepted; or
            (III) withdraw the proposed 
 cybersecurity risk and resilience 
 requirement or modification to such a 
 requirement.
            (ii) Amended requirement.--If the WRRO 
 files an amended proposed cybersecurity risk 
 and resilience requirement or modification to 
 such a requirement under clause
            (i) 
            (I) the 
 Administrator shall review such proposed 
 requirement or modification and determine 
 whether to approve such amended requirement or 
 modification in accordance with paragraph

    (2)
        (A) .
            (iii) Response by wrro.--On receipt of a 
 response from the WRRO pursuant to clause
            (i) 
            (II) , the Administrator shall--
            (I) approve the proposed 
 cybersecurity risk and resilience 
 requirement or modification to such a 
 requirement; or
            (II) invite the WRRO to engage in 
 negotiations with the Administrator to 
 reach consensus to address the specific 
 recommendation made by the 
 Administrator under subparagraph
        (A) .

    (4) Effective date.--The effective date of an approved 
 cybersecurity risk and resilience requirement or modification 
 to such a requirement proposed under this subsection shall be 
 set by the Administrator in accordance with the proposed 
 implementation plan submitted by the WRRO under paragraph

    (1) .

    (5) Submission of specific requirement.--The Administrator, 
 on the motion of the Administrator or on complaint may, 
 following consultation with the WRRO, order the WRRO to file 
 with the Administrator under paragraph

    (1) a proposed 
 cybersecurity risk and resilience requirement or modification 
 to such as requirement that addresses a specific matter if the 
 Administrator determines there is a reasonable basis to 
 conclude the existing cybersecurity risk and resilience 
 requirements are insufficient, when implemented by covered 
 water systems, to protect, defend, or recover from or mitigate 
 a cybersecurity incident.

    (6) Conflict.--
        (A) In general.--The final rule adopted under 
 subsection

    (b)

    (2) shall include specific processes for 
 the identification and timely resolution of any 
 conflict between a cybersecurity risk and resilience 
 requirement and any function, rule, order, tariff, or 
 agreement accepted, approved, or ordered by the 
 Administrator that is applicable to a covered water 
 system.
        (B) Compliance.--A covered water system shall 
 continue to comply with a function, rule, order, 
 tariff, or agreement described in subparagraph
        (A) unless--
            (i) the Administrator finds a conflict 
 exists between a cybersecurity risk and 
 resilience requirement and any function, rule, 
 order, tariff, or agreement approved or 
 otherwise accepted or ordered by the 
 Administrator;
            (ii) the Administrator orders a change to 
 that function, rule, order, tariff, or 
 agreement; and
            (iii) the ordered change becomes effective.
            (C) Modification.--If the Administrator determines 
 that a cybersecurity risk and resilience requirement 
 needs to be changed as a result of a conflict 
 identified under this paragraph, the Administrator 
 shall direct the WRRO to propose and file with the 
 Administrator a modified cybersecurity risk and 
 resilience requirement pursuant to paragraphs

    (1) through

    (4) of this section.

    (e) Water System Monitoring and Assessment.--To aid in the 
development and adoption of appropriate and necessary cybersecurity 
risk and resilience requirements and modifications to such 
requirements, the WRRO shall--

    (1) routinely monitor and conduct periodic assessments of 
 the implementation of cybersecurity risk and resilience 
 requirements approved by the Administrator under subsection
            (d) and the effectiveness of cybersecurity risk and resilience 
 requirements for covered systems, including by requiring--
        (A) annual self-attestations of compliance with 
 such cybersecurity risk and resilience requirements by 
 covered water systems; and
        (B) assessments of the covered water system by the 
 WRRO or by a third party designated by the WRRO not 
 less frequently than every 5 years of compliance by 
 covered water systems with such cybersecurity risk and 
 resilience requirements; and

    (2) annually submit to the Administrator a report 
 describing the implementation of cybersecurity risk and 
 resilience requirements approved by the Administrator under 
 subsection
            (d) and the effectiveness of cybersecurity risk and 
 resilience requirements for covered water systems subject to 
 the requirements that reports under this paragraph--
        (A) shall only include aggregated or anonymized 
 findings, observations, and data; and
        (B) shall not contain any sensitive security 
 information.

    (f) Enforcement.--

    (1) In general.--The WRRO may, subject to paragraphs

    (2) through

    (5) , impose a penalty on the owner or operator of a 
 covered water system for a violation of a cybersecurity risk 
 and resilience requirement if the WRRO, after notice and an 
 opportunity for a consultation and a hearing--
        (A) finds that the owner or operator of a covered 
 system has violated or failed to comply with the 
 cybersecurity risk and resilience requirement; and
        (B) files notice of the finding under subparagraph
        (A) and the record of the proceeding with the 
 Administrator.

    (2) Notice.--
        (A) In general.--The WRRO may not impose a penalty 
 on the owner or operator of a covered water system 
 under paragraph

    (1) unless the WRRO provides the owner 
 or operator with--
            (i) notice of the alleged violation of or 
 failure to comply with a cybersecurity risk and 
 resilience requirement; and
            (ii) an opportunity for a consultation and 
 a hearing prior to finding that the owner or 
 operator has violated or failed to comply with 
 the applicable cybersecurity risk and 
 resilience requirement under paragraph

    (1)
        (A) .
        (B) Access to counsel.--The owner or operator of a 
 covered water system may engage legal counsel to take 
 part in the consultation and hearing described in 
 subparagraph
        (A)
            (ii) .

    (3) Effective date of penalty.--A penalty imposed under 
 paragraph

    (1) may take effect not earlier than 31 days after 
 the date on which the WRRO files with the Administrator notice 
 of the penalty and the record of proceedings under subparagraph
        (B) of that paragraph.

    (4) Imposition of penalty.--
        (A) Maximum amount.--A penalty imposed under 
 paragraph

    (1) shall not exceed $25,000 per day the 
 applicable owner or operator is in violation of a 
 cybersecurity risk and resilience requirement approved 
 by the Administrator under subsection
            (d) .
        (B) Limitation.--No penalty may be imposed on a 
 covered water system under any other provision of law 
 for a violation of a cybersecurity risk and resilience 
 requirement approved by the Administrator under 
 subsection
            (d) .
            (C) Use of penalty funds.--Any penalties collected 
 under this subsection shall be returned to the WRRO to 
 support training initiatives and other resource 
 capabilities of the WRRO in carrying out the duties of 
 the WRRO under this section.

    (5) Review by administrator.--
        (A) In general.--The Administrator may review a 
 penalty imposed under paragraph

    (1) .
        (B) Application for review.--The Administrator may 
 conduct a review under subparagraph
        (A) on the motion 
 of the Administrator or on application by an owner or 
 operator of a covered water system that is the subject 
 of a penalty imposed under paragraph

    (1) , if such 
 application is filed not later than 30 days after the 
 date on which the notice of that penalty is filed with 
 the Administrator.
            (C) Stay of penalty.--A penalty under review by the 
 Administrator under this paragraph may only be stayed 
 if, on the motion of the Administrator or on 
 application by the owner or operator of the covered 
 water system that is the subject of the penalty, the 
 Administrator separately orders the stay of the 
 penalty.
            (D) Proceedings.--
            (i) In general.--In any proceeding to 
 review a penalty imposed under paragraph

    (1) , 
 the Administrator, after notice and, subject to 
 clause
            (ii) , opportunity for a hearing, shall 
 by order affirm, set aside, reinstate, or 
 modify the penalty, and, if appropriate, remand 
 to the WRRO for further proceedings.
            (ii) Record below.--A hearing under clause
            (i) may consist solely of the record before the 
 WRRO and an opportunity for the presentation of 
 supporting reasons to affirm, modify, or set 
 aside the applicable penalty.
            (iii) Expedited procedures.--The 
 Administrator shall act expeditiously in 
 administering all proceedings under this 
 paragraph.

    (g) Savings Provisions.--

    (1) Authority.--Nothing in this section authorizes the WRRO 
 or the Administrator to develop binding cybersecurity risk and 
 resilience requirements for covered water systems, except as 
 specifically provided for in this Act.

    (2) Rule of construction.--Nothing in this section preempts 
 any authority of any State to take action to ensure the safety, 
 adequacy, and resilience of water service within that State, as 
 long as such action is not inconsistent with or in conflict 
 with any cybersecurity risk and resilience requirement.

    (h) Status of WRRO.--The WRRO is not a department, agency, or 
instrumentality of the United States Government.
            (i) Authorization of Appropriations.--There is authorized to be 
appropriated to carry out this section $10,000,000 to remain available 
to the WRRO until expended.
 <all>