No official summary available for this bill.
[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 7922 Introduced in House (IH)]
<DOC>
118th CONGRESS
2d Session
H. R. 7922
To establish a Water Risk and Resilience Organization to develop risk
and resilience requirements for the water sector.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
April 10, 2024
Mr. Crawford (for himself and Mr. Duarte) introduced the following
bill; which was referred to the Committee on Transportation and
Infrastructure, and in addition to the Committee on Energy and
Commerce, for a period to be subsequently determined by the Speaker, in
each case for consideration of such provisions as fall within the
jurisdiction of the committee concerned
_______________________________________________________________________
A BILL
To establish a Water Risk and Resilience Organization to develop risk
and resilience requirements for the water sector.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. WATER RISK AND RESILIENCE ORGANIZATION.
(a) Definitions.--In this section:
(1) Administrator.--The term ``Administrator'' means the
Administrator of the Environmental Protection Agency.
(2) Agency.--The term ``Agency'' means the Environmental
Protection Agency.
(3) Covered water system.--The term ``covered water
system'' means--
(A) a community water system (as defined in section
1401 of the Safe Drinking Water Act (42 U.S.C. 300f))
that serves a population of 3,300 or more persons; or
(B) a treatment works (as defined in section 212 of
the Federal Water Pollution Control Act (33 U.S.C.
1292)) that serves a population of 3,300 or more
persons.
(4) Cyber resilient.--The term ``cyber resilient'' means
the ability of a covered water or wastewater system to
withstand or reduce the magnitude or duration of cybersecurity
incidents that disrupt the covered system's ability to function
normally and which includes the capability to anticipate,
absorb, adapt to, or rapidly recover from cybersecurity
incidents.
(5) Cybersecurity incident.--The term ``cybersecurity
incident'' means a malicious act or suspicious event that
disrupts, or attempts to disrupt, the operation of programmable
electronic devices and communication networks including
hardware, software, and data that are essential to the cyber
resilient operation of a covered water system.
(6) Cybersecurity risk and resilience requirement.--The
term ``cybersecurity risk and resilience requirement'' means a
cybersecurity requirement approved by the Administrator under
subsection (d) to provide for the cyber resilient operation of
a covered water system and the cyber resilient design of
planned additions or modifications to such system.
(7) Water risk and resilience organization.--The terms
``Water Risk and Resilience Organization'' and ``WRRO'' mean
the organization certified by the Agency under subsection (c).
(b) Jurisdiction and Applicability.--
(1) Jurisdiction.--The Administrator shall have
jurisdiction, within the United States, over the WRRO certified
by the Agency under subsection (c).
(2) Regulations.--Not later than 270 days after the date of
enactment of this Act, the Administrator shall issue a final
rule to implement this section to certify the WRRO.
(c) Certification.--
(1) In general.--Following the issuance of a rule under
subsection (b)(2), any person may submit an application to the
Administrator for certification as a Water Risk and Resilience
Organization.
(2) Requirements.--The Administrator shall certify one
Water Risk and Resilience Organization if the Administrator
determines that such organization--
(A) demonstrates advanced technical knowledge and
expertise in the operations of covered water systems;
(B) is comprised of 1 or more members with relevant
experience as owners or operators of covered water
systems;
(C) has demonstrated the ability to develop and
implement cybersecurity risk and resilience
requirements that provide for an adequate level of
cybersecurity risk and resilience for a covered water
system;
(D) is capable of establishing measures, in line
with prevailing best practices, to secure sensitive
information and to protect sensitive security
information from public disclosure; and
(E) has established rules that require that--
(i) it is independent of the users, owners,
and operators of a covered water system, with
balanced and objective stakeholder
representation in the selection of directors of
the organization and balanced decision making
in any committee or subordinate organizational
structure;
(ii) it allocate reasonable dues, fees, and
other charges among end-users for all
activities under this section;
(iii) provide just and reasonable
procedures for enforcement of cybersecurity
risk and resilience requirements and the
imposition of penalties in accordance with
subsection (f) (including limitations on
activities, functions, or operations, or other
appropriate sanctions); and
(iv) provide for reasonable notice and
opportunity for public comment, due process,
openness, and balance of interests in
developing cybersecurity risk and resilience
requirements and otherwise exercising duties.
(d) Cybersecurity Risk and Resilience Requirements.--
(1) In general.--
(A) Proposed requirements.--The WRRO shall propose
and file with the Administrator each cybersecurity risk
and resilience requirement or modification to a
requirement that it proposes to be made effective under
this section.
(B) Implementation plan.--For each cybersecurity
risk and resilience requirement or modification to such
a requirement proposed pursuant to subparagraph (A),
the WRRO shall also propose an implementation plan,
including the schedule by which covered water systems
must achieve compliance with all or parts of the
cybersecurity risk and resilience requirement or
modification to such a requirement. The enforcement
date must provide a reasonable implementation period
for covered water systems to meet the requirements
under the implementation plan.
(2) Approval.--
(A) In general.--Notwithstanding paragraph (3)(A),
the Administrator shall approve, by rule or order, a
proposed cybersecurity risk and resilience requirement
or modification to such a requirement if the
Administrator determines that the requirement is just,
reasonable, not unduly Discriminatory, or preferential.
(B) Deference to wrro.--The Administrator shall
defer to the technical expertise of the WRRO with
respect to the content of a proposed cybersecurity risk
and resilience requirement or modification to such a
requirement.
(3) Disapproval of requirement.--
(A) In general.--Notwithstanding paragraph (2)(A),
the Administrator shall remand to the WRRO a proposed
cybersecurity risk and resilience requirement or
modification to such a requirement for which the
Administrator disapproves, in whole or in part, and
provide 1 or more specific recommendations that would
cause the proposed requirement or modification to be
approved under paragraph (2).
(B) Response and approval.--
(i) In general.--Upon remand of a proposed
cybersecurity risk and resilience requirement
or modification to such a requirement and
receipt of the Administrator's recommendation
pursuant to subparagraph (A), the WRRO shall--
(I) accept the Administrator's
recommendation and resubmit an amended
proposed cybersecurity risk and
resilience requirement or modification
to such a requirement consistent with
the Administrator's recommendation;
(II) respond to the Administrator
and provide a reason why the
recommendation was not accepted; or
(III) withdraw the proposed
cybersecurity risk and resilience
requirement or modification to such a
requirement.
(ii) Amended requirement.--If the WRRO
resubmits a requirement or modification, the
Administrator shall review an amended proposed
cybersecurity risk and resilience requirement
or modification to such requirement submitted
by the WRRO pursuant to clause (i)(I) and
determine whether to approve such amended
requirement in accordance with paragraph
(2)(A).
(iii) Response by wrro.--Upon receipt of a
response from the WRRO pursuant to clause
(i)(II), the Administrator shall--
(I) approve the proposed
cybersecurity risk and resilience
requirement or modification to such a
requirement; or
(II) invite the WRRO to engage in
negotiations with the Administrator to
reach consensus to address the specific
recommendation made by the
Administrator under subparagraph (A).
(4) Effective date.--The effective date of a cybersecurity
risk and resilience requirement or modification to such a
requirement proposed under this subsection shall be set by the
Administrator in accordance with the proposed implementation
plan submitted by the WRRO under paragraph (1).
(5) Submission of specific requirement.--The Administrator,
upon the Administrator's own motion or upon complaint and
having a reasonable basis to conclude existing recommendations
under the WRRO are insufficient, when implemented by covered
water systems, to protect, defend, mitigate, or recover from a
cybersecurity incident, may, following consultation with the
WRRO, order the WRRO to submit to the Agency a proposed
cybersecurity risk and resilience requirement or a modification
to such a requirement that addresses a specific matter if the
Administrator considers such a requirement or modified
requirement necessary to protect, defend, mitigate, or recover
from a cybersecurity incident.
(6) Conflict.--
(A) In general.--The final rule adopted under
subsection (b)(2) shall include specific processes for
the identification and timely resolution of any
conflict between a cybersecurity risk and resilience
requirement and any function, rule, order, tariff, or
agreement accepted, approved, or ordered by the
Administrator applicable to a covered water system.
(B) Compliance.--A water system shall continue to
comply with such function, rule, order, tariff, or
agreement approved, or otherwise accepted or ordered by
the Administrator unless--
(i) the Administrator finds a conflict
exists between cybersecurity risk and
resilience requirement and any such provision;
(ii) the Administrator orders a change to
such provision; and
(iii) the ordered change becomes effective.
(C) Modification.--If the Administrator determines
that a cybersecurity risk and resilience requirement
needs to be changed as a result of a conflict
identified under this paragraph, the Administrator
shall direct the WRRO to develop and file with the
Administrator a modified cybersecurity risk and
resilience requirement under this subsection,
undertaken pursuant to the processes in paragraphs (1)
through (4) above.
(e) Water System Monitoring and Assessment.--To aid in the
development and adoption of appropriate and necessary cybersecurity
risk and resilience requirements and modifications to requirements, the
WRRO shall--
(1) routinely monitor and conduct periodic assessments,
including requiring self-attestations of compliance from
covered water systems annually and assessments of the covered
water system by the WRRO or a designated third party not less
than every five years, of the implementation of cybersecurity
risk and resilience requirements, and the effectiveness of
cybersecurity risk and resilience requirements for covered
water systems in the United States; and
(2) annually submit to the Administrator a report on the
implementation of cybersecurity risk and resilience
requirements, the effectiveness of cybersecurity risk and
resilience requirements for covered water systems in the United
States, provided that such reports shall only include
aggregated or anonymized findings, observations, and data, and
shall not contain any sensitive security information.
(f) Enforcement.--
(1) In general.--The WRRO may impose, subject to paragraphs
(2) and (4), a penalty on an owner or operator of a covered
water system for a violation of a cybersecurity risk and
resilience requirement approved by the Administrator under
subsection (d) if the WRRO, after notice and an opportunity for
a hearing--
(A) finds that the owner or operator of a covered
system has violated or failed to comply with a
requirement approved by the Administrator under
subsection (d); and
(B) files notice and the record of the proceeding
with the Administrator.
(2) Notice.--The WRRO may not impose a penalty on an owner
or operator of a covered system under paragraph (1) unless the
WRRO provides the owner or operator with notice of the alleged
violation or failure to comply with a cybersecurity risk and
resilience requirement and an opportunity for a consultation
and a hearing prior to finding that the owner or operator has
violated such requirement under paragraph (1)(A). The owner or
operator of a covered water system may engage legal Counsel to
take part in the consultation and hearing Requirements.
(3) Effective date of penalty.--A penalty imposed under
paragraph (1) may take effect not earlier than the 31st day
after the WRRO files with the Administrator notice of the
penalty and the record of proceedings.
(4) Imposition of penalty.--A penalty imposed under
paragraph (1) shall not exceed $25,000 per day the entity is in
violation of a cybersecurity risk and resilience requirement.
(A) A penalty imposed under this subsection shall
be the only penalty imposed for the violation. The
Administrator is barred from imposing additional
penalties on the covered water System for the same
violation.
(B) Any penalties collected will be returned to the
WRRO to support training initiatives and support other
resource capabilities of the WRRO in carrying out its
duties under this Act.
(5) Review by administrator.--
(A) In general.--A penalty imposed under paragraph
(1) may be subject to review by the Administrator.
(B) Application for review.--The Administrator may
conduct a review under subparagraph (A) on the
Administrator's own motion or upon application by an
owner or operator of a covered water system that is the
subject of a penalty imposed under paragraph (1) filed
not later than 30 days after notice of such penalty is
filed with the Administrator.
(C) Stay of penalty.--A penalty under review by the
Administrator under this paragraph may not be stayed
unless the Administrator otherwise orders that such
penalty be stayed upon the Administrator's own motion
or upon application by the owner or operator of the
covered water system owner or operator that is the
subject of such penalty.
(D) Proceeding.--
(i) In general.--In any proceeding to
review a penalty imposed under paragraph (1),
the Administrator, after notice and opportunity
for hearing (which hearing may consist solely
of the record before the WRRO and opportunity
for the presentation of supporting reasons to
affirm, modify, or set aside the penalty),
shall by order affirm, set aside, reinstate, or
modify the penalty, and, if appropriate, remand
to the WRRO for further proceedings.
(ii) Expedited procedures.--The
Administrator shall act expeditiously in
administering all hearings under this section.
(g) Savings Provision.--
(1) Authority.--Nothing in this Act authorizes the WRRO or
the EPA Administrator to develop cybersecurity binding risk and
resilience requirements for covered water systems, except as
defined by this act.
(2) Rule of construction.--Nothing in this section may be
construed to preempt any authority of any State to take action
to ensure the safety, adequacy, and resilience of water service
within that State, as long as such action is not inconsistent
with or conflicts with any cybersecurity risk and resilience
requirement.
(h) Status of WRRO.--The WRRO certified under subsection (c) is not
a department, agency, or instrumentality of the United States
Government.
(i) Authorization of Appropriations.--There is authorized to be
appropriated to carry out this subsection $5,000,000 for each of fiscal
years 2024 and 2025, to remain available to the WRRO until expended.
<all>
Introduced in House
Introduced in House
Referred to the Committee on Transportation and Infrastructure, and in addition to the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Committee on Transportation and Infrastructure, and in addition to the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Subcommittee on Environment, Manufacturing, and Critical Materials.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line