Water Cyber Shield Act of 2026

The Water Cyber Shield Act of 2026 amends the Safe Drinking Water Act and the Federal Water Pollution Control Act to establish or modify cybersecurity requirements for drinking water and wastewater systems. Title I, Drinking Water Infrastructure: Sec. 101, Community water system risk and resilience: Amends existing law to require community water systems to assess risks to electronic, computer, or other automated systems for identifying significant cybersecurity risks, review and revise assessments every 5 years, and submit certifications to the state. It also requires systems serving over 3,300 people to prepare emergency response plans that include countermeasures for cybersecurity risks, reviewed every 5 years. Sec. 102, Cybersecurity requirements for drinking water systems: Adds a new section requiring states to carry out cybersecurity assessments of public water systems, evaluating operational technology against baseline cybersecurity standards set by the EPA Administrator. States must inspect a representative sample annually, report aggregated performance metrics to the EPA, and address violations. The Administrator provides technical assistance. Sec. 103, Drinking water security assistance: Authorizes $300,000,000 for each fiscal year 2027 through 2032 to help public water systems build cybersecurity resilience and mitigate vulnerabilities, with states prioritizing systems with greatest need. Title II, Clean Water Infrastructure: Sec. 201, Treatment works risk and resilience: Requires covered treatment works (serving over 10,000 persons with design flow of 1,000,000 gallons or more) to conduct risk and resilience assessments including cybersecurity risks, and prepare emergency response plans, reviewed every 5 years. Sec. 202, Cybersecurity requirements for treatment works: Similar to Title I, requires states to carry out cybersecurity assessments of covered treatment works, evaluate operational technology against baseline standards, inspect a representative sample annually, report aggregated data, and address violations. Sec. 203, Clean water security assistance: Authorizes $300,000,000 for each fiscal year 2027 through 2032 to help treatment works build cybersecurity resilience and mitigate vulnerabilities, with states prioritizing those with greatest need. Title III, Cyber Incident Reporting Obligations: Sec. 301, Cyber incident reporting: Amends the Homeland Security Act to include community water systems serving over 3,300 persons and covered treatment works as covered entities for cyber incident reporting, and requires reports to be transmitted to the EPA Administrator.