The **Water Cyber Shield Act**, introduced by Senators **Adam Schiff** (D-Calif.) and **Amy Klobuchar** (D-Minn.), proposes to dedicate $300 million annually from the Drinking Water and Clean Water State Revolving Funds towards cybersecurity enhancements for water and wastewater systems. This legislative push follows a series of recent cyberattacks on at least 30 water and wastewater systems across approximately 12 states. These incidents are widely believed to be linked to groups associated with Iran's military. ### Expanding EPA's Cybersecurity Mandate The bill would amend the Safe Drinking Water Act and the Clean Water Act, granting the **EPA** the authority to conduct cybersecurity assessments and mandate corrective actions when vulnerabilities are identified. This marks a significant shift, as the **EPA** currently manages the water sector but lacks the power to enforce cybersecurity regulations. Under the proposed act, water and wastewater systems would be required to integrate cybersecurity risk assessments into their resilience planning. They would also need to comply with incident reporting requirements outlined in the forthcoming **Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)**. ### Tailored Regulations and Federal Coordination The legislation acknowledges the diverse nature of water systems, outlining different rules based on their size. It also offers states the flexibility to manage cybersecurity regulations independently or seek assistance from the **EPA**. Crucially, the **EPA** would collaborate with the **Cybersecurity and Infrastructure Security Agency (CISA)** to share threat intelligence and develop robust cybersecurity standards. A dedicated technical advisory committee would be established to facilitate the creation of these standards. To encourage compliance and protect sensitive information, cybersecurity data submitted by utilities would be exempt from public disclosure. Smaller water systems would receive prioritization for federal financial assistance and greater flexibility in meeting compliance requirements. ### A Response to Past Challenges and Ongoing Threats Senator Klobuchar emphasized the urgency of the situation, stating, "The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure." She added that the legislation would empower the **EPA** to assess vulnerabilities and assist municipal water systems in defending against cyber threats. Previous attempts by the Biden administration to introduce cybersecurity checks into annual water system assessments were met with legal challenges from water industry groups and several states, who argued that such mandates would increase costs for customers. These efforts were eventually abandoned. Since then, state-backed groups and ransomware gangs have repeatedly attacked U.S. water systems, leading to disruptions and manual operations. Senator Schiff underscored the reality of these threats: "Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities." He concluded, "These threats are not hypothetical — they are happening right now. This legislation gives **EPA** the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers." Schiff's office confirmed consultations with various stakeholders, including water industry groups, state regulators, cybersecurity experts, and federal agencies, to address potential concerns and gather feedback, particularly from the **EPA**.