Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act, which would give the EPA explicit authority to conduct cybersecurity assessments, require corrective actions and establish security standards for water systems alongside CISA and NIST.
The bill would also authorize $300 million annually for water infrastructure upgrades, require risk assessments for large systems and expand mandatory cyber incident reporting.
The legislation follows coordinated cyberattacks against dozens of community water systems across at least 12 states. Separately, DEF CON Franklin and the National Rural Water Association launched the Water Watch Center to provide cybersecurity services to utilities serving fewer than 10,000 people, a group representing 91% of the roughly 50,000 community water systems nationwide. Five cybersecurity firms will provide managed detection and response services, building on a two-year pilot involving nearly 450 volunteer cybersecurity experts across seven states.
Damon Small, Board of Directors, Xcape, Inc.:
“The Water Cyber Shield Act attempts to address a major regulatory gap by granting the Environmental Protection Agency explicit authority to enforce baseline security standards and allocate $300 million annually for utility upgrades, but federal dollars alone cannot fix this sector’s systemic fragility. Spread across roughly 50,000 community water systems nationwide, that funding yields a negligible $6,000 per facility, an amount that barely covers an initial architecture audit, let alone operational technology overhauls.
“The industry already possesses robust reference architectures and standards for protecting control systems, so the primary barrier is execution rather than a lack of guidance. Furthermore, claiming that capital injections will solve the threat ignores the reality that maintenance windows are rare in continuous operational technology environments. Rather than waiting on Congressional appropriations, security leaders and asset owners must immediately execute foundational controls: strictly isolate industrial control networks from corporate IT, eliminate publicly exposed management interfaces to the Internet, enforce multi-factor authentication, and replace default device credentials.
“Critical Takeaways
- Funding dilution: Allocating $300 million across 50,000 utilities yields $6,000 per facility, failing to cover basic operational technology remediation.
- Operational reality: Standards already exist, but infrequent maintenance windows choke security execution far more than funding deficits.
- Immediate action: Operators must enforce network segmentation, eliminate Internet-facing control systems, and rotate default credentials immediately.
“Operational security standards already exist; what utilities lack is not awareness, but the uptime flexibility to actually apply patches.”
Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:
“While it’s always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it’s likely a far reach from what will actually happen. The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here https://www.epa.gov/cyberwater/cybersecurity-sanitary-surveys)
“I hate to say it, but historically speaking, this is likely to fail before making it to a vote, just like all other bills that have been attempted to improve water cybersecurity in the past. If we look at just the 118th and 119th Congress, we have had 9 bills introduced, as far as I’m aware, that pushed language that would have focused on either providing monetary assistance for, directly enforcing industry standards, and/or regulation around cybersecurity for water systems and CI, each varying in degree of what they would have provided and who they would have protected (rural vs non), but of those 9, all from within the 118th congress died within committees and without comments or markup, meaning no one even bothered to fight for them to get a vote across. Technically, the 4 from this congress (119) are still “pending’ but considering no movement has occurred on them, they will likely reach the same fate.
“Ultimately, Congress has been unreliable in pushing forward regulation and standards towards CI for quite some time, and the mantle thankfully has been picked up by private organizations and security practitioners who wish to have a safer and more secure water source. Even though it shouldn’t be dependent on the goodwill of private citizens to protect public infrastructure. Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn’t the first time we have had this situation happen before. So, my fingers are crossed, but I’m not holding my breath.”
John Strand, Owner, Black Hills Information Security, Inc.:
“I think this type of legislation is important, but it’s also long overdue. People have known about the security weaknesses in critical infrastructure, especially within municipalities, for well over a decade. Unfortunately, this is another example of a reactive approach to cybersecurity. Too often, meaningful action doesn’t happen until the damage has already been done.
“My concern is that by the time these programs are fully implemented and organizations begin benefiting from them, many of the municipalities with the same vulnerabilities that enabled recent attacks will have already been compromised. It’s a positive step, but it’s arriving years after the underlying risks were widely understood. This is the kind of investment that should have been made more than a decade ago, not after the attacks have already demonstrated the consequences of inaction.”
While addressing critical infrastructure is long overdue, the time to act is now as the threat is real and present. Will lawmakers act on that threat is the real question.
Related
This entry was posted on August 12, 2026 at 4:21 pm and is filed under Commentary with tags US. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
$300M Senate bill to target cyber threats to U.S. water systems
Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act, which would give the EPA explicit authority to conduct cybersecurity assessments, require corrective actions and establish security standards for water systems alongside CISA and NIST.
The bill would also authorize $300 million annually for water infrastructure upgrades, require risk assessments for large systems and expand mandatory cyber incident reporting.
The legislation follows coordinated cyberattacks against dozens of community water systems across at least 12 states. Separately, DEF CON Franklin and the National Rural Water Association launched the Water Watch Center to provide cybersecurity services to utilities serving fewer than 10,000 people, a group representing 91% of the roughly 50,000 community water systems nationwide. Five cybersecurity firms will provide managed detection and response services, building on a two-year pilot involving nearly 450 volunteer cybersecurity experts across seven states.
Damon Small, Board of Directors, Xcape, Inc.:
“The Water Cyber Shield Act attempts to address a major regulatory gap by granting the Environmental Protection Agency explicit authority to enforce baseline security standards and allocate $300 million annually for utility upgrades, but federal dollars alone cannot fix this sector’s systemic fragility. Spread across roughly 50,000 community water systems nationwide, that funding yields a negligible $6,000 per facility, an amount that barely covers an initial architecture audit, let alone operational technology overhauls.
“The industry already possesses robust reference architectures and standards for protecting control systems, so the primary barrier is execution rather than a lack of guidance. Furthermore, claiming that capital injections will solve the threat ignores the reality that maintenance windows are rare in continuous operational technology environments. Rather than waiting on Congressional appropriations, security leaders and asset owners must immediately execute foundational controls: strictly isolate industrial control networks from corporate IT, eliminate publicly exposed management interfaces to the Internet, enforce multi-factor authentication, and replace default device credentials.
“Critical Takeaways
“Operational security standards already exist; what utilities lack is not awareness, but the uptime flexibility to actually apply patches.”
Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:
“While it’s always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it’s likely a far reach from what will actually happen. The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here https://www.epa.gov/cyberwater/cybersecurity-sanitary-surveys)
“I hate to say it, but historically speaking, this is likely to fail before making it to a vote, just like all other bills that have been attempted to improve water cybersecurity in the past. If we look at just the 118th and 119th Congress, we have had 9 bills introduced, as far as I’m aware, that pushed language that would have focused on either providing monetary assistance for, directly enforcing industry standards, and/or regulation around cybersecurity for water systems and CI, each varying in degree of what they would have provided and who they would have protected (rural vs non), but of those 9, all from within the 118th congress died within committees and without comments or markup, meaning no one even bothered to fight for them to get a vote across. Technically, the 4 from this congress (119) are still “pending’ but considering no movement has occurred on them, they will likely reach the same fate.
“Ultimately, Congress has been unreliable in pushing forward regulation and standards towards CI for quite some time, and the mantle thankfully has been picked up by private organizations and security practitioners who wish to have a safer and more secure water source. Even though it shouldn’t be dependent on the goodwill of private citizens to protect public infrastructure. Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn’t the first time we have had this situation happen before. So, my fingers are crossed, but I’m not holding my breath.”
John Strand, Owner, Black Hills Information Security, Inc.:
“I think this type of legislation is important, but it’s also long overdue. People have known about the security weaknesses in critical infrastructure, especially within municipalities, for well over a decade. Unfortunately, this is another example of a reactive approach to cybersecurity. Too often, meaningful action doesn’t happen until the damage has already been done.
“My concern is that by the time these programs are fully implemented and organizations begin benefiting from them, many of the municipalities with the same vulnerabilities that enabled recent attacks will have already been compromised. It’s a positive step, but it’s arriving years after the underlying risks were widely understood. This is the kind of investment that should have been made more than a decade ago, not after the attacks have already demonstrated the consequences of inaction.”
While addressing critical infrastructure is long overdue, the time to act is now as the threat is real and present. Will lawmakers act on that threat is the real question.
Share this:
Like this:
Related
This entry was posted on August 12, 2026 at 4:21 pm and is filed under Commentary with tags US. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.