Water Cyber Shield Act of 2026

The Water Cyber Shield Act of 2026 mandates cybersecurity risk assessments and emergency response plans for community water systems serving more than 3,300 people and large wastewater treatment facilities serving over 10,000 people with a design flow rate of at least one million gallons. The bill requires the Environmental Protection Agency to establish baseline cybersecurity standards in collaboration with federal agencies and industry experts, while authorizing states to assume primary enforcement responsibilities if they demonstrate adequate capacity and security protocols. It allocates $300 million annually for fiscal years 2027 through 2032 to help water systems build cybersecurity resilience, prioritizing assistance for facilities with the greatest need for resources or expertise. Additionally, the legislation expands cyber incident reporting obligations under the Homeland Security Act to include these specific water infrastructure entities and requires that submitted security documentation be protected from public disclosure under federal and state freedom of information laws.