The Water Cyber Shield Act of 2026 has been proposed as a comprehensive update to federal oversight of cybersecurity in the water sector. The measure would amend the Safe Drinking Water Act and the Clean Water Act to expand the U.S. Environmental Protection Agency’s role in protecting drinking water and wastewater systems from cyber threats. It is positioned as a sector-wide framework to improve preparedness, establish clearer standards, and accelerate remediation of known weaknesses.
The proposal follows a recent wave of cyberattacks on water utilities across the United States, including a coordinated intrusion that affected more than 30 community water systems in Minnesota. Federal agencies have warned that hackers are increasingly targeting programmable logic controllers that run pumps and treatment processes, elevating operational risks. Against that backdrop, the act seeks to bring consistent expectations and resources to utilities of different sizes and risk profiles.
Under the proposal, EPA would be directed to inspect a representative sample of drinking water and wastewater systems each year and require corrective action when significant vulnerabilities are identified. Large systems would need to incorporate cybersecurity risks into existing risk and resilience assessments and emergency response plans to ensure cyber threats are addressed alongside physical and operational hazards.
According to the text, the act would establish tiered cybersecurity standards scaled to a system’s size and risk, developed jointly with the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology, state partners, and a new water sector advisory committee. It would also extend federal cyber incident reporting requirements to state and locally owned utilities, which are currently exempt, and protect cybersecurity information submitted by utilities from public disclosure.
The measure envisions a cooperative enforcement model in which states with sufficient capacity could assume primary enforcement responsibility, while EPA would continue to lead elsewhere. To support implementation, the proposal would authorize an additional $300 million per year for each of the Drinking Water and Clean Water State Revolving Funds, specifically earmarked for cybersecurity upgrades across the sector.
Smaller systems would receive added flexibility in meeting requirements and priority access to funding for upgrades. The proposal was developed following months of consultation with water utilities, state regulators, cybersecurity experts, and federal agencies, according to the announcement.