To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

Key Points

• The bill creates a new industry-run body called the Water Risk and Resilience Organization to write cybersecurity rules for large water and sewer utilities, with EPA certifying only one such organization.
• The rules would apply to community water systems and treatment plants serving 3,300 or more people, covering most mid-size and large utilities nationwide.
• EPA oversees the process and must approve proposed cybersecurity requirements as long as they are reasonable, but the agency is directed to defer to the WRRO's technical judgment.
• Utilities that violate the cybersecurity rules can be fined up to $25,000 per day, with the money funneled back into training and resources for the water industry.
• The organization is explicitly kept separate from the federal government even though it holds EPA-backed enforcement power, and Congress would provide $10 million in startup funding.
• Costs of running the WRRO, including dues and fees, are spread among the end-users of covered water systems, meaning ratepayers could see costs passed through.