Summary of HR 2594: Water Risk and Resilience Organization Act

Bill Number: HR 2594

Introduced: April 02, 2025

Status: Introduced in House

Primary Sponsor: Eric A. "Rick" Crawford

Cosponsor: Brad Finstad

Purpose and Intent

The Water Risk and Resilience Organization Act aims to establish a dedicated organization responsible for developing and implementing cybersecurity risk and resilience requirements for the water sector. The bill seeks to enhance the security and operational resilience of community water systems and treatment works, particularly in the face of increasing cybersecurity threats.

Key Provisions

1. Definitions:

   • Covered Water System: Includes community water systems serving 3,300 or more persons and treatment works of the same size.
   • Cyber Resilient: The ability of a covered water system to withstand and recover from cybersecurity incidents.
   • Cybersecurity Incident: Any malicious act that disrupts the operation of essential electronic devices and networks in covered water systems.

2. Establishment of the Water Risk and Resilience Organization (WRRO):

   • The Environmental Protection Agency (EPA) Administrator will certify one organization as the WRRO, which must demonstrate expertise in water system operations and cybersecurity.
   • The WRRO will be responsible for developing cybersecurity risk and resilience requirements for covered water systems.

3. Regulatory Framework:

   • The EPA Administrator is required to issue final rules within 270 days of the bill's enactment to establish the certification process for the WRRO.
   • The WRRO will propose cybersecurity requirements and implementation plans, which the Administrator must approve if deemed just and reasonable.

4. Implementation and Compliance:

   • The WRRO will file proposed requirements and implementation plans with the Administrator, including timelines for compliance.
   • The Administrator has the authority to approve or disapprove these proposals, with specific recommendations provided for any disapproved requirements.

5. Public Engagement and Transparency:

   • The WRRO must ensure balanced stakeholder representation and provide opportunities for public comment in developing cybersecurity requirements.

Impact

• Who Will Be Affected:

  • Community water systems and treatment works serving populations of 3,300 or more will be directly impacted by the new cybersecurity requirements.
  • The WRRO will play a crucial role in shaping the cybersecurity landscape for these systems, enhancing their resilience against potential threats.

• Potential Benefits:

  • Improved cybersecurity measures are expected to safeguard water systems from disruptions, ensuring reliable access to safe drinking water.
  • The establishment of the WRRO aims to create a standardized approach to cybersecurity in the water sector, promoting best practices and resilience.

Procedural Aspects

• The bill was referred to the Committee on Transportation and Infrastructure and the Committee on Energy and Commerce for consideration.
• It has also been referred to the Subcommittee on Water Resources and Environment for further evaluation.

This legislation represents a proactive step towards enhancing the cybersecurity posture of critical water infrastructure, addressing vulnerabilities that could impact public health and safety.