Water utilities get to write their own cybersecurity rules—with EPA's blessing

What it does

This bill creates a new Water Risk and Resilience Organization (WRRO) certified by the EPA to develop cybersecurity standards for large water systems (serving 3,300+ people). The WRRO would propose requirements, the EPA would approve them with deference to the WRRO's technical expertise, and water systems would face penalties up to $25,000/day for non-compliance. The bill funds this with $10 million and explicitly preserves state authority.

Why we flagged it

The bill's core function is to delegate authority for developing water-sector cybersecurity standards to a private, EPA-certified organization rather than having EPA or Congress set them directly. This is a structural choice about who writes the rules, not a direct regulatory mandate.

What the text implies

• The WRRO is a private organization with 'balanced stakeholder representation' but includes water-system owners/operators on its board—creating potential conflicts of interest in setting standards that affect their own compliance costs.
• EPA 'deference to technical expertise' language may limit meaningful EPA review of proposed standards, shifting rule-making power away from elected officials to an industry-influenced body.
• Penalties collected ($25,000/day max) flow back to the WRRO to fund its own operations, creating a financial incentive for the WRRO to enforce aggressively and potentially favor larger systems that can afford compliance.
• The bill applies only to systems serving 3,300+ people, leaving smaller rural water systems unprotected and potentially creating a two-tier cybersecurity landscape.
• No explicit requirement for public transparency in WRRO standard-setting beyond 'notice and opportunity for comment'—actual deliberations and technical decisions may remain opaque.

Who it affects

Citizens benefit from stronger cybersecurity protections for drinking water and wastewater systems, reducing risk of service disruption or contamination from cyberattacks. However, compliance costs will likely be passed to ratepayers, and the WRRO's quasi-regulatory power with limited EPA oversight creates potential for industry-friendly standards that may not reflect public interest.

Who stands to gain

• water utilities and treatment operators
• cybersecurity consulting and software vendors
• large municipal water systems (economies of scale in compliance)

Named in the bill

EPA (Environmental Protection Agency), WRRO (Water Risk and Resilience Organization), Safe Drinking Water Act, Federal Water Pollution Control Act, community water systems, treatment works, American Water Works Association (AWK), Veolia Water Technologies (WAT)

Where it stands

3 cosponsors: 2 Republicans, 1 Democrats.

• Apr 2, 2025 — Introduced · Congress.gov: “Introduced in House”
• Apr 2, 2025 — Referred to House Committee on Energy and Commerce and House Committee on Transportation and Infrastructure · Congress.gov: “Referred to the Committee on Transportation and Infrastructure, and in addition to the Committee on Energy…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

4 lobbying clients named this bill on 7 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $1,000,000 in lobbying spend. A filing names 17 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 72% of bills with at least one filing.

Rick Crawford, the sponsor, reported $590,291 in PAC receipts in the 2026 cycle.

• Metropolitan Water District of Southern California — $380,000 on 2 filings
• Association of Metropolitan Water Agencies — $220,000 on 2 filings
• American Water — $200,000 on 2 filings
• American Water Works Association — $200,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.