Treatment works risk and resilience

(a) In general Title II of the Federal Water Pollution Control Act (33 U.S.C. 1281 et seq.) is amended by adding at the end the following: 228. Treatment works risk and resilience (a) Definitions In this section: (1) Covered treatment works The term covered treatment works means a treatment works that— (A) treats domestic sewage; (B) serves more than 10,000 persons; and (C) has a design flow rate of 1,000,000 gallons or more. (2) Natural hazard The term natural hazard means a natural event that threatens the functioning of a treatment works, including an earthquake, tornado, flood, hurricane, wildfire, and hydrologic changes. (3) Resilience The term resilience means the ability of a treatment works or an asset of a treatment works to adapt to, or withstand the effects of, a malevolent act or natural hazard without interruption to the function of the treatment works or asset or, if the function is interrupted, to rapidly return to a normal operating condition. (4) State (A) In general The term State means a State that has assumed primary enforcement responsibility pursuant to section 229(e). (B) Enforcement by the Administrator If a State has not assumed primary enforcement responsibility pursuant to section 229(e), the term State shall, for purposes of obligations of the State under this subsection, be considered to be a reference to the Administrator. (b) Risk and resilience assessments (1) In general Each covered treatment works shall conduct an assessment of the risks to, and resilience of, the covered treatment works. (2) Requirements An assessment under paragraph (1)— (A) shall include an assessment of— (i) the risk to the covered treatment works from malevolent acts and natural hazards; (ii) the resilience of collection systems, pipes and constructed conveyances, physical barriers, treatment, and storage, discharge, and reuse facilities that are utilized by the covered treatment works; (iii) the monitoring practices of the covered treatment works; (iv) the financial infrastructure of the covered treatment works; (v) the use, storage, or handling of various chemicals by the covered treatment works; (vi) the operation and maintenance of the covered treatment works; and (vii) using a method approved by the applicable State, the risks to electronic, computer, or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph (A) or (B) of paragraph (3); and (B) may include an evaluation of capital and operational needs for risk and resilience management for the covered treatment works. (3) Baseline information The Administrator, not later than 1 year after the date of enactment of this section, after consultation with appropriate departments and agencies of the Federal Government and with State and local governments, shall provide baseline information on malevolent acts of relevance to covered treatment works, which shall include consideration of acts that may— (A) substantially disrupt the ability of a covered treatment works to provide safe and reliable collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes; or (B) otherwise present significant public health or economic concerns to the community served by a covered treatment works. (4) Review and revision (A) In general Each covered treatment works shall, not less frequently than once every 5 years, review and, if necessary, revise the assessment. (B) Certification to the Administrator or State On completion of the review under subparagraph (A), a covered treatment works shall submit to the applicable State a certification that the covered treatment works has reviewed and, if applicable, revised the assessment. (c) Emergency response plan (1) In general Each covered treatment works shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection (b) for that covered treatment works (or any revisions to that assessment). (2) Required inclusions The emergency response plan of a covered treatment works under paragraph (1) shall include— (A) strategies and resources to improve the resilience of the covered treatment works, including the physical security of the covered treatment works; (B) plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the covered treatment works to collect, store, treat, recycle, and reclaim municipal sewage or industrial wastes; (C) actions, procedures, and equipment that can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes; (D) strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the covered treatment works; and (E) countermeasures that the covered treatment works intends to adopt or, if already in use, maintain to mitigate the significant cybersecurity risks identified under subsection (b)(2)(A)(vii), including a schedule the covered treatment works intends to follow to adopt any countermeasures not already in use by the covered treatment works. (3) Revision A covered treatment works shall review and, as necessary, revise the emergency response plan prepared under this subsection not less frequently than once every 5 years. (d) Submission and approval of assessments and plans (1) Submission (A) In general Beginning not later than 1 year after the date on which the Administrator provides baseline information under subsection (b)(3), each covered treatment works shall, during a cybersecurity assessment pursuant to section 229(b)(2)(A), provide to the applicable State— (i) the portion of the assessment prepared under subsection (b) that is described in paragraph (2)(A)(vii) of that subsection (including any revision to that portion of the assessment); and (ii) the portion of the emergency response plan prepared under subsection (c) that is described in paragraph (2)(E) of that subsection (including any revision to that portion of the emergency response plan). (B) Limitation Neither the Administrator nor a State may require the submission of any portion of an assessment under subsection (a) or an emergency response plan under subsection (b) that is not described in subparagraph (A). (2) Review; approval (A) In general A State shall— (i) review the portions of the assessments and emergency response plans of covered treatment works submitted pursuant to paragraph (1)(A) for conformity with the requirements of this section and section 229; and (ii) (I) approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A); or (II) disapprove of the portions of an assessment or emergency response plan submitted pursuant to paragraph (1)(A) if the Administrator or the State, as applicable, determines that— (aa) the submitted portions of the assessment or emergency response plan are missing, incomplete, or fail to conform with the requirements of this section; or (bb) the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the Administrator under section 229(c). (B) Enforcement A State may use appropriate enforcement mechanisms under this Act or the appropriate State authority to remedy noncompliance, as described in items (aa) and (bb) of subparagraph (A)(ii)(II), under this subsection. (3) Submitted documentation (A) Applicability of FOIA Any information submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the Freedom of Information Act), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records. (B) Treatment of documentation (i) Protocol development Not later than 180 days after the date of enactment of the Water Cyber Shield Act of 2026 and before any cybersecurity assessments are carried out pursuant to section 229(b)(2)(A), the Administrator, in consultation with appropriate Federal law enforcement and intelligence officials, shall develop such protocols as are necessary to protect any information provided under paragraph (1)(A) to the State. (ii) Requirements for protocol The protocol developed under clause (i) shall ensure that— (I) each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph (1)(A) are kept in a secure location; (II) only individuals designated by the applicable State may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A); and (III) no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph (1)(A) shall be made available to anyone other than an individual designated by the applicable State. (iii) Savings provision Nothing in this subparagraph authorizes any person to withhold any information from Congress or from a committee or subcommittee of Congress. (4) Applicability of FOIA Any findings or plans (including revisions and any related agency records and information that is designated as Department of Defense critical infrastructure security information under section 130e(b) of title 10, United States Code) submitted under this subsection shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code (commonly known as the Freedom of Information Act), and any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records. (e) Coordination A covered treatment works shall, to the extent practicable, coordinate with existing local planning committees established pursuant to the Emergency Planning and Community Right-To-Know Act of 1986 (42 U.S.C. 11001 et seq.) when preparing or revising an assessment or emergency response plan under this section. (f) Record maintenance Each covered treatment works shall maintain a copy of the assessment conducted under subsection (b) and the emergency response plan prepared under subsection (c) (including any revised assessment or plan) for 5 years after the date on which that assessment or plan is approved by the applicable State under this section. (g) Guidance to small treatment works The Administrator shall provide guidance and technical assistance to treatment works that are not covered treatment works on how to conduct resilience assessments, prepare emergency response plans, and address threats from malevolent acts and natural hazards that threaten to disrupt the collection, storage, treatment, recycling, and reclamation of municipal sewage or industrial wastes or significantly affect the public health.. (b) Federal enforcement Section 309 of the Federal Water Pollution Control Act (33 U.S.C. 1319) is amended in each of subsections (a), (c), (d), and (g) by inserting 228(d), before 301, each place it appears.