S. 5368 — Water Cyber Shield Act of 2026

This section requires community water systems serving more than 3,300 persons to assess significant cybersecurity risks to electronic and automated systems using a State-approved method and to include corresponding countermeasures and adoption schedules in their emergency response plans. It shifts review and certification of risk and resilience assessments from the Administrator to the applicable State every five years, establishes State review and approval of the cybersecurity portions of assessments and plans, and exempts submitted information from FOIA and equivalent State disclosure laws.

This section establishes cybersecurity requirements for public water systems. It requires states to conduct assessments evaluating operational technology and connected systems against baseline standards, review portions of existing risk and resilience assessments and emergency response plans, perform risk-based inspections of representative samples, enforce corrections for violations, and submit annual aggregated performance reports to the Administrator. It directs the Administrator to promulgate baseline cybersecurity standards by rulemaking in consultation with CISA, NIST, states, and stakeholders, ensuring the standards account for varied system capacities and risks, and authorizes technical assistance to systems.

This section authorizes $300 million annually for fiscal years 2027 through 2032, in addition to existing Safe Drinking Water Act amounts, to help public water systems build cybersecurity resilience and identify and mitigate vulnerabilities. It permits the Environmental Protection Agency to issue guidance on eligible uses, requires states to prioritize systems with the greatest need in capacity or resources, and allows unappropriated funds to rollover until expended.

This section requires covered treatment works—those treating domestic sewage for more than 10,000 persons with a design flow rate of 1,000,000 gallons or more—to conduct risk and resilience assessments every 5 years that evaluate threats from malevolent acts and natural hazards to collection, treatment, storage, discharge, financial, chemical, and cybersecurity systems. It also requires each such facility to prepare and update every 5 years an emergency response plan with strategies, procedures, and countermeasures to mitigate those risks.

This section establishes cybersecurity requirements for covered treatment works under the Federal Water Pollution Control Act. It requires States to conduct assessments evaluating the cybersecurity of operational technology against baseline standards, review risk and resilience assessments and emergency response plans, perform risk-based inspections of a representative sample, address identified violations, and submit annual aggregated performance reports to the Administrator. The Administrator must promulgate baseline cybersecurity standards by rulemaking in consultation with CISA, NIST, and stakeholders including treatment works of various sizes, and provide technical assistance on request.

This section authorizes $300 million annually for fiscal years 2027 through 2032, in addition to existing Clean Water Act authorizations, to help treatment works build cybersecurity resilience and identify and mitigate vulnerabilities. It requires states to prioritize assistance to facilities with the greatest need in capacity, workforce, expertise, or resources, permits the EPA Administrator to issue guidance on eligible uses, and allows unappropriated amounts to remain available until expended.

This section expands the definition of covered entity for cyber incident reporting to include community water systems serving more than 3,300 persons and covered treatment works under the Federal Water Pollution Control Act. It requires the Cybersecurity and Infrastructure Security Agency to transmit copies of all received reports to the Environmental Protection Agency Administrator. It applies the reporting requirements to state, local, tribal, and territorial governments that own or operate such systems.