Community water system risk and resilience

Section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) is amended— (1) in subsection (a)— (A) in paragraph (1)(A)— (i) in clause (ii), by striking storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which and inserting and storage and distribution facilities that; (ii) in clause (v), by striking and at the end; and (iii) by adding at the end the following: (vii) using a method approved by the applicable State, the risks to electronic, computer, or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph (A) or (B) of paragraph (2); and; and (B) by striking paragraphs (3) through (5) and inserting the following: (3) Review and revision (A) In general Each community water system described in paragraph (1) shall, not less frequently than once every 5 years, review and, if necessary, revise the assessment. (B) Certification to the Administrator or State On completion of the review under subparagraph (A), a community water system described in paragraph (1) shall submit to the applicable State a certification that the community water system has reviewed and, if applicable, revised the assessment.; (2) in subsection (b)— (A) by redesignating paragraphs (1) through (4) as subparagraphs (A) through (D), and indenting appropriately; (B) in the matter preceding subparagraph (A) (as so redesignated), by striking Each community water system in the first sentence and all that follows through The emergency response plan in the third sentence and inserting the following: (1) In general Each community water system serving a population greater than 3,300 shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection (a) for that community water system (or any revisions to that assessment). (2) Required inclusions The emergency response plan of a community water system under paragraph (1); (C) in paragraph (2) (as so designated)— (i) in subparagraph (A) (as so redesignated), by striking and cybersecurity; (ii) in subparagraph (C) (as so redesignated), by striking and at the end; (iii) in subparagraph (D) (as so redesignated), by striking the period at the end and inserting; and; and (iv) by adding at the end the following: (E) countermeasures that the system intends to adopt or, if already in use, maintain to mitigate the significant cybersecurity risks identified under subsection (a)(1)(A)(vii), including a schedule the system intends to follow to adopt any countermeasures not already in use by the system.; and (D) by adding at the end the following: (3) Review; revision A community water system serving a population greater than 3,300 shall review and, as necessary, revise the emergency response plan prepared under this subsection not less frequently than once every 5 years.; (3) by striking subsection (f); (4) by redesignating subsections (c), (d), and (e) as subsections (d), (e), and (f), respectively; (5) by inserting after subsection (b) the following: (c) Submission and approval of assessments and plans (1) Submission (A) In general Each community water system subject to subsections (a) and (b) shall, during a cybersecurity assessment pursuant to section 1433A(b)(1)(A), provide to the applicable State— (i) the portion of the assessment prepared under subsection (a) that is described in paragraph (1)(A)(vii) of that subsection (including any revision to that portion of the assessment); and (ii) the portion of the emergency response plan prepared under subsection (b) that is described in paragraph (2)(E) of that subsection (including any revision to that portion of the emergency response plan). (B) Limitation Neither the Administrator nor a State may require the submission of any portion of an assessment under subsection (a) or an emergency response plan under subsection (b) that is not described in subparagraph (A). (2) Review; approval (A) In general A State shall— (i) review the portions of the assessments and emergency response plans of community water systems submitted pursuant to paragraph (1)(A) for conformity with the requirements of this section and section 1433A; and (ii) (I) approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A); or (II) disapprove of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) if the Administrator or State, as applicable, determines that— (aa) the submitted portions of the assessment or emergency response plan are missing, incomplete, or fail to conform with the requirements of this section or section 1433A; or (bb) the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the Administrator under section 1433A(c). (B) Enforcement A State may use appropriate enforcement mechanisms under this title or the appropriate State authority to remedy noncompliance, as described in items (aa) and (bb) of subparagraph (A)(ii)(II), under this subsection. (3) Submitted documentation (A) Applicability of FOIA Any information submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the Freedom of Information Act), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records. (B) Treatment of documentation (i) Protocol development Not later than 180 days after the date of enactment of the Water Cyber Shield Act of 2026 and before any cybersecurity assessments are carried out pursuant to section 1433A(b)(1)(A), the Administrator, in consultation with appropriate Federal law enforcement and intelligence officials, shall develop such protocols as are necessary to protect any information provided under paragraph (1)(A) to the State. (ii) Requirements for protocol The protocol developed under clause (i) shall ensure that— (I) each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) are kept in a secure location; (II) only individuals designated by the applicable State may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A); and (III) no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A) shall be made available to anyone other than an individual designated by the applicable State. (iii) Savings provision Nothing in this subparagraph authorizes any person to withhold any information from Congress or from a committee or subcommittee of Congress.; (6) in subsection (e) (as so redesignated), by striking a certification of such assessment or plan is submitted to the Administrator and inserting an assessment or plan is submitted to the applicable State,; and (7) by striking subsection (h) and inserting the following: (h) Definitions In this section: (1) Natural hazard The term natural hazard means a natural event that threatens the functioning of a community water system, including an earthquake, tornado, flood, hurricane, wildfire, and hydrologic changes. (2) Resilience The term resilience means the ability of a community water system or an asset of a community water system to adapt to or withstand the effects of a malevolent act or natural hazard without interruption to the asset's or system's function, or if the function is interrupted, to rapidly return to a normal operating condition. (3) State (A) In general The term State means a State that has assumed primary enforcement responsibility pursuant to section 1433A(e). (B) Enforcement by the Administrator If a State has not assumed primary enforcement responsibility pursuant to section 1433A(e), the term State shall, for purposes of obligations of the State under this subsection, be considered to be a reference to the Administrator..