Water utilities get free cybersecurity, but cyber incidents stay secret

What it does

This bill converts a pilot ransomware-warning program at CISA into a permanent security vulnerability warning program for small water and wastewater utilities (serving ≤100,000 people). It automatically enrolls these utilities in CISA's cyber hygiene services, shields information they share from public disclosure under federal and state freedom-of-information laws, and authorizes CISA to conduct incident response on their behalf. The program terminates after five years.

Why we flagged it

The bill's core function is to establish a permanent federal cybersecurity assistance program for small water utilities, converting a pilot into a standing authority. While framed as infrastructure protection, the operative mechanism includes a significant information-disclosure exemption.

What the text implies

• FOIA exemption applies to ALL information shared under the program, not just sensitive vulnerability data—utilities could share operational details, incident timelines, or system configurations that would normally be public record.
• Automatic enrollment of utilities means no opt-in consent; utilities must affirmatively disenroll to avoid participation, shifting the default to mandatory federal data collection.
• Five-year sunset clause creates pressure to reauthorize; if reauthorization stalls, the program terminates abruptly, potentially leaving utilities mid-incident without federal response support.
• Coordination requirement with EPA suggests water-sector focus, but definition of 'covered utility' includes entities under Infrastructure Investment and Jobs Act—scope may be broader than water systems alone.
• CISA's incident-response authority is open-ended ('as appropriate')—no statutory limits on scope, duration, or cost of federal response operations conducted on behalf of utilities.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Citizens benefit from improved cybersecurity at water utilities (critical infrastructure protecting public health) and automatic enrollment removes adoption friction. However, the broad exemption from federal and state freedom-of-information laws means the public cannot learn about cyber incidents affecting water systems, undermining transparency and accountability for critical infrastructure security.

Who stands to gain

• Small water and wastewater utilities (public entities receiving free cybersecurity services)
• CISA (expanded authority and budget justification for cyber hygiene and incident response programs)

Named in the bill

Cybersecurity and Infrastructure Security Agency (CISA), Environmental Protection Agency (EPA), Water and wastewater utilities, Infrastructure Investment and Jobs Act, Safe Drinking Water Act, Federal Water Pollution Control Act, Cyber Incident Reporting for Critical Infrastructure Act of 2022, Cybersecurity Information Sharing Act of 2015

Where it stands

4 cosponsors: 2 Democrats, 2 Republicans.

• Oct 1, 2026 — Introduced · Congress.gov: “Introduced in House”
• Oct 1, 2026 — Referred to House Committee on Homeland Security · Congress.gov: “Referred to the House Committee on Homeland Security”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.