A federal proposal titled the Water Cyber Shield Act of 2026 would amend the Safe Drinking Water Act and the Clean Water Act to expand the U.S. Environmental Protection Agency’s responsibilities for protecting water and wastewater systems from cyberattacks. The measure is presented as a comprehensive framework to strengthen cybersecurity across the sector’s operational technology.
The initiative follows recent cyber activity affecting water utilities in multiple states, including a coordinated intrusion that targeted more than 30 community water systems in Minnesota in recent weeks. Federal entities, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency, have cautioned that attackers are increasingly focusing on programmable logic controllers used to operate pumps and treatment processes.
According to proposal materials, key provisions would:
- Direct EPA to inspect a representative sample of drinking water and wastewater systems each year and require corrective action when significant vulnerabilities are identified.
- Require large drinking water and wastewater systems to incorporate cybersecurity risks into existing risk and resilience assessments and emergency response plans.
- Set tiered cybersecurity standards, scaled to a system’s size and risk and developed jointly with CISA, the National Institute of Standards and Technology (NIST), states, and a new water sector advisory committee.
- Extend federal cyber incident reporting requirements to state and locally owned utilities, which are currently exempt.
- Protect cybersecurity information submitted by utilities from public disclosure.
- Allow states with sufficient capacity to assume primary enforcement responsibility while EPA continues to lead elsewhere.
- Authorize an additional $300 million per year for each of the Drinking Water and Clean Water State Revolving Funds, earmarked for cybersecurity upgrades.
The standards contemplated in the bill would be tiered by system size and risk profile and developed in coordination with CISA, NIST, state partners, and a new advisory body for the water sector. Smaller systems would receive added flexibility in meeting requirements and would be prioritized for funding assistance.
Oversight would be strengthened through annual inspections of a representative subset of drinking water and wastewater systems, with required corrective actions where significant vulnerabilities are found. The proposal also includes protections to keep sensitive cybersecurity submissions from public disclosure and offers a pathway for capable states to assume primary enforcement while EPA maintains leadership elsewhere.
Funding provisions designate $300 million per year for both the Drinking Water and Clean Water State Revolving Funds specifically for cybersecurity upgrades. Supporting documents indicate the proposal was developed following consultation with water utilities, state regulators, cybersecurity experts, and federal agencies.
