Schiff and Klobuchar Unveil Water Cyber Shield Act With Up to $600 Million Annually for Utility Cybersecurity

Washington, D.C. — August 10, 2026 — U.S. Senators Adam Schiff of California and Amy Klobuchar of Minnesota have introduced the Water Cyber Shield Act of 2026, legislation designed to establish federal cybersecurity requirements for drinking-water and wastewater systems while providing dedicated financial assistance for security improvements.

The bill would amend the Safe Drinking Water Act and the Federal Water Pollution Control Act, commonly known as the Clean Water Act. It would give the Environmental Protection Agency explicit authority to conduct cybersecurity assessments, establish baseline standards, require action when significant vulnerabilities are identified and oversee enforcement when states do not assume that responsibility.

The legislative text contains two separate annual funding authorizations. It would authorize $300 million for public drinking-water systems and another $300 million for wastewater treatment works during each fiscal year from 2027 through 2032. That creates a potential combined authorization of $600 million annually and $3.6 billion across the six-year period.

An authorization does not place the money directly into utility accounts. Congress would still need to provide the funding through the appropriations process. The bill also contains a rollover provision allowing amounts not appropriated during one fiscal year to be authorized in a subsequent year and remain available until expended.

Funding for drinking-water systems would supplement amounts available through the Drinking Water State Revolving Fund. The assistance could support cybersecurity resilience, vulnerability identification, mitigation work, risk and resilience assessments and emergency-response planning.

A separate authorization would supplement Clean Water State Revolving Fund assistance for wastewater treatment works. States would be directed to prioritize systems facing the greatest limitations in staffing, technical expertise, capacity or financial resources.

The funding provisions are designed to prevent cybersecurity requirements from operating solely as an unfunded mandate. Smaller systems and utilities with limited internal capacity would receive greater flexibility and priority for federal assistance.

The bill follows coordinated cyberattacks targeting more than 30 community water systems across multiple states. Federal authorities have also warned water utilities about cyber activity associated with Iranian actors and other foreign and criminal threats.

Water and wastewater systems rely on digital networks, operational technology, remote access, automated treatment controls and connected monitoring equipment. A successful intrusion can affect billing, communications, pumps, chemical treatment, monitoring equipment and other systems required to maintain reliable service.

The Water Cyber Shield Act would require community water systems serving more than 3,300 people to incorporate significant cybersecurity risks into their risk and resilience assessments and emergency-response plans. Those systems would be required to review the plans and revise them as necessary at least once every five years.

The plans would need to identify cybersecurity countermeasures already in use and establish schedules for adopting protections that have not yet been implemented. The assessment process would examine whether operational technology and connected systems are adequately protected against identified risks.

For wastewater infrastructure, the bill defines covered treatment works as facilities that treat domestic sewage, serve more than 10,000 people and have a design flow rate of at least one million gallons. Covered facilities would conduct risk and resilience assessments addressing physical infrastructure, treatment operations, monitoring practices, financial systems, chemical handling, maintenance and electronic or automated systems.

Wastewater assessments and emergency-response plans would also be reviewed at least once every five years. The legislation would require covered facilities to identify countermeasures for significant cybersecurity risks and establish implementation schedules for protections not already in place.

The bill would direct the EPA to create baseline cybersecurity standards in coordination with the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology, states and water-sector stakeholders. The standards could differ according to the size, capacity and risk profile of each regulated system.

That tiered structure is intended to prevent a small rural utility from facing the same requirements as a major metropolitan system with a larger workforce, greater financial resources and more extensive operational technology. The EPA would retain authority to establish minimum protections while accounting for differences across the sector.

Technical advisory committees would participate in developing and refining the standards. Membership would include representatives from utilities of different sizes, professional water associations, cybersecurity specialists, voluntary standards organizations and companies providing information-technology or operational-technology security services.

The bill would allow qualified states to apply for primary enforcement responsibility. States with sufficient authority, expertise and resources could administer assessments and enforce requirements within their jurisdictions. The EPA would retain responsibility in states that do not assume the role and could revoke state authority if required standards were no longer met.

EPA regulations governing the state-assumption process would be required within one year of enactment. The agency would have 180 days to approve or deny a state application after receiving it.

Sensitive cybersecurity information submitted by utilities would receive protection from disclosure under federal, state and local public-records laws. The bill would require secure handling protocols before assessments begin, limit access to designated personnel and require protected material to be stored in secure locations.

Those protections are intended to prevent vulnerability assessments, emergency-response details and descriptions of operational weaknesses from becoming publicly accessible roadmaps for attackers. Public reporting would focus on generalized sector-wide findings instead of security details belonging to individual utilities.

The EPA would be required to establish cybersecurity performance metrics within two years of enactment. At least once every four years, the agency would assess progress across the drinking-water and wastewater sectors, report its findings to Congress and publish a generalized account of sector performance.

The legislation would also modify federal cyber incident-reporting obligations. Community water systems serving more than 3,300 people and covered wastewater treatment works would be included within the reporting framework established under the Cyber Incident Reporting for Critical Infrastructure Act.

The proposed changes would extend reporting obligations to qualifying state, local, Tribal and territorial government-operated systems that had previously been exempt. CISA would transmit copies of applicable cyber incident, ransom-payment and supplemental reports to the EPA, allowing the sector’s federal risk-management agency to incorporate incident information into its oversight.

Schiff said recent events demonstrate that attacks against water infrastructure are no longer theoretical. He argued that the legislation would pair federal authority with resources for local utilities, reducing pressure to pass cybersecurity expenses directly to ratepayers.

Klobuchar said the attacks in Minnesota exposed an urgent need to strengthen water infrastructure and identify vulnerabilities. “Protecting our critical infrastructure and the safety of Minnesotans is a top priority,” she said.

The bill was developed following consultations with water-sector organizations, state regulators, cybersecurity specialists and federal agencies. Its structure attempts to address long-running concerns about federal authority, local costs, protection of sensitive information and the ability of smaller utilities to comply with national standards.

The Water Cyber Shield Act remains proposed legislation. Its funding authorizations, regulatory authority, reporting requirements and enforcement provisions would not take effect unless the measure passes Congress and is signed into law.

---

Office of U.S. Senator Adam Schiff. (Free Download)

---

---

---

Office of U.S. Senator Adam Schiff. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---