Cybersecurity requirements for treatment works

(a) In general Title II of the Federal Water Pollution Control Act (33 U.S.C. 1281 et seq.) (as amended by section 201(a)) is amended by adding at the end the following: 229. Cybersecurity requirements (a) Definitions In this section: (1) Covered treatment works The term covered treatment works has the meaning given the term in section 228(a). (2) Cybersecurity incident The term cybersecurity incident means a malicious act or suspicious event that disrupts, or attempts to disrupt, the operation of programmable electronic devices and communication networks, including hardware, software, and data that are essential to the cybersecurity resilience of a treatment works. (3) Cybersecurity resilience The term cybersecurity resilience means the ability of a treatment works to adapt to or withstand the effects of a cybersecurity incident without interruption to the treatment works's function, or if the function is interrupted, to rapidly return to a normal operating condition. (4) State (A) In general Except for subsection (e), the term State means a State that has assumed primary enforcement responsibility pursuant to subsection (e). (B) Enforcement by the Administrator If a State has not assumed primary enforcement responsibility pursuant to subsection (e), the term State shall, for purposes of obligations of the State under this section (except for subsection (e)), be considered to be a reference to the Administrator. (b) Cybersecurity assessments (1) Assessments required (A) In general A State shall carry out cybersecurity assessments of a covered treatment works in accordance with this paragraph. (B) Evaluation of adequacy For a covered treatment works subject to a cybersecurity assessment under subparagraph (A), if the covered treatment works uses operational technology, the State shall evaluate the adequacy of the cybersecurity of the operational technology, and information and communications technology that is connected to the operational technology, against the baseline cybersecurity standards promulgated by the Administrator under subsection (c). (C) Review of assessments and plans In carrying out a cybersecurity assessment required under subparagraph (A), a covered treatment works shall provide, and the State shall review, the portions of the risk and resilience assessments of the covered treatment works under section 228(b) and the emergency response plans of the covered treatment works under section 228(c) submitted under section 228(d)(1)(A). (D) Inspections In carrying out cybersecurity assessments under this paragraph, a State shall carry out inspections of a representative sample of covered treatment works each year, which sampling shall be informed by risk-based considerations, subject to the condition that the scope of the inspection is limited to the systems of the covered treatment works necessary to meet the requirements of this paragraph. (2) Violations If a State identifies a violation of the baseline cybersecurity standards established by the Administrator under subsection (c) while conducting an assessment under paragraph (3), the State shall take appropriate steps to ensure that the covered treatment works addresses the violation and use mechanisms, including enforcement, to correct those violations. (3) Submission to EPA (A) In general A State shall annually submit to the Administrator a report that summarizes the performance of the covered treatment works of the State for each cybersecurity performance metric established by the Administrator under subsection (d)(1) based on the review by the State of risk and resilience assessments pursuant to paragraph (1)(C). (B) Requirement A report submitted under subparagraph (A) shall not identify any specific treatment works and shall include only aggregations of data. (4) Technical assistance The Administrator shall, on request of a covered treatment works, provide guidance and technical assistance to the covered treatment works with respect to— (A) implementing any requirement under this section or section 228; and (B) enhancing cybersecurity resilience. (c) Baseline cybersecurity standards (1) In general The Administrator shall by rulemaking establish baseline cybersecurity standards that shall serve as requirements to provide for the cybersecurity resilience of a covered treatment works. (2) Requirements In developing and establishing the baseline cybersecurity standards under paragraph (1), the Administrator shall, at a minimum— (A) work in conjunction with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology; (B) develop the baseline cybersecurity standards in collaboration with covered treatment works of various sizes and capacities to ensure that feedback from a variety of covered treatment works is considered during the development of the baseline cybersecurity standards; (C) ensure that best practices and guidelines that already exist in the water sector at the time of the development of the baseline cybersecurity standards inform the development of the baseline cybersecurity standards; (D) establish a technical advisory committee to provide input with respect to, review, and refine the baseline cybersecurity standards throughout the development process, which shall, at a minimum, include— (i) representatives from covered treatment works of various sizes; (ii) professional water associations; (iii) cybersecurity experts; (iv) a representative from a relevant voluntary consensus standards body, as described in section 12(d)(1) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note; Public Law 104–113); and (v) a representative from an information technology or operational technology service provider that provides cybersecurity services to covered treatment works; and (E) consult with the States. (3) Consideration of varied capacity and risk In developing the baseline cybersecurity standards under paragraph (1), the Administrator— (A) shall ensure that the baseline cybersecurity standards account for the varied capacity and risk of all covered treatment works; and (B) may establish different baseline cybersecurity standards for different categories of treatment works subject to assessments under subsection (b) based on capacity or risk. (d) Cybersecurity performance metrics (1) Establishment of metrics (A) In general Not later than 2 years after the date of enactment of this section, the Administrator shall establish cybersecurity performance metrics (referred to in this subsection as the cybersecurity performance metrics) to be used by the Administrator to measure or assess how well the sector of treatment works in the United States is making progress on implementing cybersecurity best practices. (B) Assessment; report The Administrator shall, not less frequently than once every 4 years— (i) assess the sector of treatment works in the United States using cybersecurity performance metrics; and (ii) submit to Congress and make publicly available a report describing, on a generalized, sector-wide basis, the state of treatment works sector performance using the assessment carried out under clause (i). (2) Provision of information Notwithstanding any other provision of law, a treatment works may, at the discretion of the treatment works and for the purpose of developing sector-wide risk assessments and performance metrics to measure how treatment works are making progress in developing and implementing cybersecurity best practices, provide to the Administrator, and the Administrator may accept, information that would assist the Administrator in the development and maintenance of cybersecurity performance metrics. (e) Enforcement; state assumption of duties (1) In general This section and section 228 shall be enforced by the Administrator unless a State assumes primary enforcement responsibility pursuant to this subsection. (2) Application A State seeking to assume primary enforcement responsibility pursuant to this subsection shall submit to the Administrator an application at such time, in such manner, and containing such information as the Administrator may by regulation require. (3) Determination On receiving an application described in paragraph (2) from a State, the Administrator shall, based on that application, determine whether the State— (A) has adopted and is implementing adequate procedures for the enforcement of requirements that are no less stringent than those under this section and section 228; (B) has adopted authority and has sufficient capacity to impose enforcement remedies in line with those prescribed under this title; (C) has sufficient capacity and personnel with sufficient expertise to perform cybersecurity assessments and conduct reviews of risk and resilience assessments and emergency response plans under section 228; and (D) has sufficient security mechanisms in place to prevent any unsanctioned disclosure or dissemination of risk and resilience assessments, emergency response plans, and any other information provided by a covered treatment works, in alignment with the protocols developed by the Administrator under section 228(d)(3)(B)(i). (4) Timeline Not later than 180 days after the date on which the Administrator receives an application described in paragraph (2), the Administrator shall— (A) if the Administrator determines that the State meets each requirement described in paragraph (3), grant the application; or (B) if the Administrator determines that the State fails to meet 1 or more of the requirements described in paragraph (3), deny the application. (5) Revocation of primary enforcement responsibility The Administrator may, as appropriate, revoke an assumption of primary enforcement responsibility pursuant to this subsection if the Administrator determines that a State no longer meets 1 or more requirements described in paragraph (3). (6) Regulations required The Administrator shall promulgate regulations carrying out this subsection not later than 1 year after the date of enactment of this section, which shall include— (A) the requirements for an application described in paragraph (2); (B) the period for which a State may assume primary enforcement responsibility pursuant to this subsection before renewal; and (C) the manner by which the Administrator may revoke primary enforcement responsibility pursuant to paragraph (5). (7) Savings provision An assumption of primary enforcement responsibility pursuant to this subsection shall be separate from any responsibility otherwise assumed under this Act.. (b) Inspections Section 308(a) of the Federal Water Pollution Control Act (33 U.S.C. 1318(a)) is amended, in the matter preceding subparagraph (A)— (1) by striking or (4) carrying and inserting (4) carrying; and (2) by striking 504 of this Act— and inserting 504; or (5) carrying out requirements under section 229—. (c) Federal enforcement Section 309 of the Federal Water Pollution Control Act (33 U.S.C. 1319) (as amended by section 201(b)) is amended in each of subsections (a), (c), (d), and (g) by inserting 229, before 301, each place it appears.