U.S. Sens. Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) have introduced legislation that would expand federal oversight and funding for cybersecurity at drinking water and wastewater utilities following a series of recent cyberattacks targeting water systems.

The Water Cyber Shield Act would give the U.S. Environmental Protection Agency (EPA) additional authority to assess cybersecurity risks at water systems and require corrective actions when significant vulnerabilities are identified. The legislation also would provide additional federal funding to help utilities improve their cyber defenses.

The bill would authorize $300 million annually for the Drinking Water and Clean Water State Revolving Funds specifically for cybersecurity improvements. It also would require large drinking water and wastewater systems to incorporate cybersecurity assessments into existing risk and resilience planning.

Under the legislation, EPA would develop tiered cybersecurity standards in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), states and water sector stakeholders. The bill also would extend federal cyber incident reporting requirements to state and locally owned water and wastewater systems that are currently exempt.

The legislation would allow states with sufficient capacity to assume primary enforcement responsibilities while giving EPA authority to lead where necessary. Smaller systems would receive additional flexibility and priority for federal financial assistance.

The bill also calls for protections for sensitive cybersecurity information submitted by utilities and would establish a technical advisory committee to help EPA and water systems develop practical cybersecurity standards.

Schiff and Klobuchar said the legislation responds to an increase in cyberattacks against water utilities, including recent attacks that the lawmakers said targeted more than 30 community water systems across multiple states. Federal agencies including EPA, CISA and the FBI have urged utilities to strengthen cybersecurity defenses in response to the attacks.

The legislation was developed with input from federal agencies, water sector stakeholders, state regulators and cybersecurity experts.