Water Risk and Resilience Organization

Full Title:
To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

Summary#

This bill would create a non‑federal Water Risk and Resilience Organization (WRRO) certified by the Environmental Protection Agency (EPA) Administrator. The WRRO would write cybersecurity risk and resilience requirements for covered water systems. "Covered water systems" are community drinking water systems or wastewater treatment works that serve 3,300 or more people. The EPA must issue a final rule within 270 days to set the selection and certification process for the WRRO.

The WRRO would be certified only if it shows technical knowledge of water system operations, includes members with operator experience, can develop cybersecurity requirements, protects sensitive information, and follows rules on independence, fees, enforcement, and public comment. The WRRO must file each proposed requirement and an implementation plan with the EPA. The Administrator approves proposals that are just, reasonable, and not unduly discriminatory, and defers to the WRRO’s technical expertise. If the EPA disapproves a proposal, it must remand it with recommendations within 90 days.

The WRRO would monitor covered systems, require annual self‑attestations, and require assessments by the WRRO or a third party at least every 5 years. The WRRO may issue penalties up to $25,000 per day for violations after notice and a hearing; penalty notices and records must be filed with the EPA, and the EPA may review penalties. Penalties collected are returned to the WRRO to support training and resources. The WRRO is not a federal agency. The bill authorizes $10,000,000 to carry out the section, available until expended. The bill preserves State authorities that are not inconsistent with WRRO requirements.

What it means for you#

  • Owners or operators of drinking water and wastewater systems that serve 3,300+ people would be subject to new cybersecurity and resilience rules developed by the WRRO and approved by the EPA.
  • Those systems would need to file annual self‑attestations and undergo assessments at least every 5 years.
  • Systems found in violation could face penalties, and penalties are subject to EPA review.
  • Households and customers served by covered systems would be indirectly affected if their system updates operations to meet new requirements.

Expenses#

  • The bill authorizes $10,000,000 to carry out the section, to remain available to the WRRO until expended.
  • The WRRO may impose penalties up to $25,000 per day for violations; collected penalties are returned to the WRRO to fund training and resources.
  • No publicly available information on estimated compliance costs for water systems or other federal costs beyond the authorization in the bill text.

Proponents' View#

No publicly available information.

Opponents' View#

No publicly available information.