The Water Cyber Shield Act of 2026 has been introduced as a federal proposal to strengthen the cybersecurity of drinking water and wastewater systems. The measure would amend the Safe Drinking Water Act and the Clean Water Act and expand the U.S. Environmental Protection Agency’s role in protecting utility infrastructure from cyber threats. Its focus is to establish clearer oversight, standards, and funding to reduce vulnerabilities across systems of varying sizes.
The proposal follows a series of cyber incidents reported in recent weeks at water utilities around the United States, including a coordinated intrusion that targeted more than 30 community water systems in Minnesota. Federal agencies, including the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), have warned that attackers are increasingly probing programmable logic controllers used to run pumps and treatment processes. The summary frames the bill as a comprehensive response to these risks.
According to a summary of the proposal, the Water Cyber Shield Act would take the following actions:
- Direct EPA to inspect a representative sample of drinking water and wastewater systems each year and require corrective action when significant vulnerabilities are identified.
- Require large drinking water and wastewater systems to fold cybersecurity risks into their existing risk and resilience assessments and emergency response plans.
- Set tiered cybersecurity standards, scaled to a system’s size and risk and developed jointly with CISA, the National Institute of Standards and Technology (NIST), states, and a new water sector advisory committee.
- Extend federal cyber incident reporting requirements to state and locally owned utilities, which are currently exempt.
- Protect cybersecurity information submitted by utilities from public disclosure.
- Let states with sufficient capacity take on primary enforcement responsibility while EPA continues to lead elsewhere.
- Authorize an additional $300 million a year for each of the Drinking Water and Clean Water State Revolving Funds, earmarked for cybersecurity upgrades.
The approach would combine baseline oversight with risk-based standards produced in coordination with national cybersecurity agencies and state partners. By extending incident reporting and safeguarding sensitive submissions, the proposal aims to improve visibility into threats while limiting the exposure of operational details. Allowing qualified states to assume primary enforcement is intended to leverage local capacity while maintaining federal leadership where needed.
The funding component designates an additional $300 million annually for each of the two State Revolving Funds to support cybersecurity improvements such as technology upgrades and resilience measures. Smaller systems would receive added flexibility under the framework and priority access to funding. The summary notes that the proposal follows months of consultation with water utilities, state regulators, cybersecurity experts, and federal agencies.