I 
119TH CONGRESS 
1ST SESSION H. R. 2594 
To establish a Water Risk and Resilience Organization to develop risk and 
resilience requirements for the water sector. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 2, 2025 
Mr. CRAWFORD introduced the following bill; which was referred to the Com-
mittee on Transportation and Infrastructure, and in addition to the Com-
mittee on Energy and Commerce, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To establish a Water Risk and Resilience Organization to 
develop risk and resilience requirements for the water sector. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. WATER RISK AND RESILIENCE ORGANIZATION. 
(a) DEFINITIONS.—In this section: 
(1) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the Environ-
mental Protection Agency. 
(2) COVERED WATER SYSTEM.—The term ‘‘cov-
ered water system’’ means— 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(A) a community water system (as defined 
in section 1401 of the Safe Drinking Water Act 
(42 U.S.C. 300f)) that serves a population of 
3,300 or more persons; or 
(B) a treatment works (as defined in sec-
tion 212 of the Federal Water Pollution Control 
Act (33 U.S.C. 1292)) that serves a population 
of 3,300 or more persons. 
(3) CYBER RESILIENT.— 
(A) IN GENERAL.—The term ‘‘cyber resil-
ient’’ means the ability of a covered water sys-
tem to withstand or reduce the magnitude or 
duration of cybersecurity incidents that disrupt 
the ability of the covered water system to func-
tion normally. 
(B) INCLUSION.—The term ‘‘cyber resil-
ient’’ includes the ability of a covered water sys-
tem to anticipate, absorb, adapt to, or rapidly 
recover from cybersecurity incidents. 
(4) CYBERSECURITY INCIDENT.—The term ‘‘cy-
bersecurity incident’’ means a malicious act or sus-
picious event that disrupts, or attempts to disrupt, 
the operation of programmable electronic devices 
and communication networks, including hardware, 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
software, and data that are essential to the cyber re-
silient operation of a covered water system. 
(5) CYBERSECURITY RISK AND RESILIENCE RE-
QUIREMENT.—The term ‘‘cybersecurity risk and re-
silience requirement’’ means a requirement that pro-
vides for the cyber resilient operation of a covered 
water system and the cyber resilient design of 
planned additions or modifications to a covered 
water system. 
(6) WATER RISK AND RESILIENCE ORGANIZA-
TION; WRRO.—The terms ‘‘Water Risk and Resil-
ience Organization’’ and ‘‘WRRO’’ mean the organi-
zation certified by the Administrator under sub-
section (c). 
(b) APPLICABILITY.—Not later than 270 days after 
the date of enactment of this Act, the Administrator shall 
issue a final rule to carry out this section, including regu-
lations for the selection and certification of the WRRO 
under subsection (c). 
(c) CERTIFICATION.— 
(1) IN
GENERAL.—Following the issuance of 
the final rule under subsection (b)(1), any organiza-
tion may submit an application to the Adminis-
trator, at such time, in such manner, and containing 
such information as the Administrator may require, 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
for certification as the Water Risk and Resilience 
Organization. 
(2) REQUIREMENTS.—The Administrator shall 
certify not more than 1 organization that submitted 
an application under paragraph (1) as the Water 
Risk and Resilience Organization if the Adminis-
trator determines that the organization— 
(A) 
demonstrates 
advanced 
technical 
knowledge and expertise in the operations of 
covered water systems; 
(B) is comprised of 1 or more members 
with relevant experience as owners or operators 
of covered water systems; 
(C) has demonstrated the ability to develop 
and implement cybersecurity risk and resilience 
requirements that provide for an adequate level 
of cybersecurity risk and resilience for a covered 
water system; 
(D) is capable of establishing measures, in 
line with prevailing best practices, to secure 
sensitive information and to protect sensitive 
security information from public disclosure; and 
(E) has established rules that— 
(i) require that the organization be 
independent of the users, owners, and op-
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(I) accept the recommendations 
of the Administrator and resubmit an 
amended proposed cybersecurity risk 
and resilience requirement or modi-
fication to such a requirement con-
sistent with those recommendations; 
(II) provide to the Administrator 
and a reason why the recommendation 
was not accepted; or 
(III) withdraw the proposed cy-
bersecurity risk and resilience require-
ment or modification to such a re-
quirement. 
(ii) AMENDED REQUIREMENT.—If the 
WRRO files an amended proposed cyberse-
curity risk and resilience requirement or 
modification to such a requirement under 
clause (i)(I) the Administrator shall review 
such proposed requirement or modification 
and determine whether to approve such 
amended requirement or modification in 
accordance with paragraph (2)(A). 
(iii) RESPONSE BY WRRO.—On receipt 
of a response from the WRRO pursuant to 
clause (i)(II), the Administrator shall— 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(I) approve the proposed cyberse-
curity risk and resilience requirement 
or modification to such a requirement; 
or 
(II) invite the WRRO to engage 
in negotiations with the Administrator 
to reach consensus to address the spe-
cific recommendation made by the Ad-
ministrator under subparagraph (A). 
(4) EFFECTIVE DATE.—The effective date of an 
approved cybersecurity risk and resilience require-
ment or modification to such a requirement pro-
posed under this subsection shall be set by the Ad-
ministrator in accordance with the proposed imple-
mentation plan submitted by the WRRO under para-
graph (1). 
(5) SUBMISSION OF SPECIFIC REQUIREMENT.— 
The Administrator, on the motion of the Adminis-
trator or on complaint may, following consultation 
with the WRRO, order the WRRO to file with the 
Administrator under paragraph (1) a proposed cy-
bersecurity risk and resilience requirement or modi-
fication to such as requirement that addresses a spe-
cific matter if the Administrator determines there is 
a reasonable basis to conclude the existing cyberse-
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
curity risk and resilience requirements are insuffi-
cient, when implemented by covered water systems, 
to protect, defend, or recover from or mitigate a cy-
bersecurity incident. 
(6) CONFLICT.— 
(A) IN GENERAL.—The final rule adopted 
under subsection (b)(2) shall include specific 
processes for the identification and timely reso-
lution of any conflict between a cybersecurity 
risk and resilience requirement and any func-
tion, rule, order, tariff, or agreement accepted, 
approved, or ordered by the Administrator that 
is applicable to a covered water system. 
(B) COMPLIANCE.—A covered water sys-
tem shall continue to comply with a function, 
rule, order, tariff, or agreement described in 
subparagraph (A) unless— 
(i) the Administrator finds a conflict 
exists between a cybersecurity risk and re-
silience requirement and any function, 
rule, order, tariff, or agreement approved 
or otherwise accepted or ordered by the 
Administrator; 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(ii) the Administrator orders a change 
to that function, rule, order, tariff, or 
agreement; and 
(iii) the ordered change becomes effec-
tive. 
(C) MODIFICATION.—If the Administrator 
determines that a cybersecurity risk and resil-
ience requirement needs to be changed as a re-
sult of a conflict identified under this para-
graph, the Administrator shall direct the 
WRRO to propose and file with the Adminis-
trator a modified cybersecurity risk and resil-
ience requirement pursuant to paragraphs (1) 
through (4) of this section. 
(e) WATER
SYSTEM
MONITORING
AND
ASSESS-
MENT.—To aid in the development and adoption of appro-
priate and necessary cybersecurity risk and resilience re-
quirements and modifications to such requirements, the 
WRRO shall— 
(1) routinely monitor and conduct periodic as-
sessments of the implementation of cybersecurity 
risk and resilience requirements approved by the Ad-
ministrator under subsection (d) and the effective-
ness of cybersecurity risk and resilience require-
ments for covered systems, including by requiring— 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(A) annual self-attestations of compliance 
with such cybersecurity risk and resilience re-
quirements by covered water systems; and 
(B) assessments of the covered water sys-
tem by the WRRO or by a third party des-
ignated by the WRRO not less frequently than 
every 5 years of compliance by covered water 
systems with such cybersecurity risk and resil-
ience requirements; and 
(2) annually submit to the Administrator a re-
port describing the implementation of cybersecurity 
risk and resilience requirements approved by the Ad-
ministrator under subsection (d) and the effective-
ness of cybersecurity risk and resilience require-
ments for covered water systems subject to the re-
quirements that reports under this paragraph— 
(A) shall only include aggregated or 
anonymized findings, observations, and data; 
and 
(B) shall not contain any sensitive security 
information. 
(f) ENFORCEMENT.— 
(1) IN GENERAL.—The WRRO may, subject to 
paragraphs (2) through (5), impose a penalty on the 
owner or operator of a covered water system for a 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
violation of a cybersecurity risk and resilience re-
quirement if the WRRO, after notice and an oppor-
tunity for a consultation and a hearing— 
(A) finds that the owner or operator of a 
covered system has violated or failed to comply 
with the cybersecurity risk and resilience re-
quirement; and 
(B) files notice of the finding under sub-
paragraph (A) and the record of the proceeding 
with the Administrator. 
(2) NOTICE.— 
(A) IN GENERAL.—The WRRO may not 
impose a penalty on the owner or operator of a 
covered water system under paragraph (1) un-
less the WRRO provides the owner or operator 
with— 
(i) notice of the alleged violation of or 
failure to comply with a cybersecurity risk 
and resilience requirement; and 
(ii) an opportunity for a consultation 
and a hearing prior to finding that the 
owner or operator has violated or failed to 
comply with the applicable cybersecurity 
risk and resilience requirement under para-
graph (1)(A). 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(B) ACCESS TO COUNSEL.—The owner or 
operator of a covered water system may engage 
legal counsel to take part in the consultation 
and hearing described in subparagraph (A)(ii). 
(3) EFFECTIVE DATE OF PENALTY.—A penalty 
imposed under paragraph (1) may take effect not 
earlier than 31 days after the date on which the 
WRRO files with the Administrator notice of the 
penalty and the record of proceedings under sub-
paragraph (B) of that paragraph. 
(4) IMPOSITION OF PENALTY.— 
(A) MAXIMUM
AMOUNT.—A penalty im-
posed under paragraph (1) shall not exceed 
$25,000 per day the applicable owner or oper-
ator is in violation of a cybersecurity risk and 
resilience requirement approved by the Adminis-
trator under subsection (d). 
(B) LIMITATION.—No penalty may be im-
posed on a covered water system under any 
other provision of law for a violation of a cyber-
security risk and resilience requirement ap-
proved by the Administrator under subsection 
(d). 
(C) USE OF PENALTY FUNDS.—Any pen-
alties collected under this subsection shall be re-
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
turned to the WRRO to support training initia-
tives and other resource capabilities of the 
WRRO in carrying out the duties of the WRRO 
under this section. 
(5) REVIEW BY ADMINISTRATOR.— 
(A) IN GENERAL.—The Administrator may 
review a penalty imposed under paragraph (1). 
(B) APPLICATION FOR REVIEW.—The Ad-
ministrator may conduct a review under sub-
paragraph (A) on the motion of the Adminis-
trator or on application by an owner or oper-
ator of a covered water system that is the sub-
ject of a penalty imposed under paragraph (1), 
if such application is filed not later than 30 
days after the date on which the notice of that 
penalty is filed with the Administrator. 
(C) STAY OF PENALTY.—A penalty under 
review by the Administrator under this para-
graph may only be stayed if, on the motion of 
the Administrator or on application by the 
owner or operator of the covered water system 
that is the subject of the penalty, the Adminis-
trator separately orders the stay of the penalty. 
(D) PROCEEDINGS.— 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(i) IN GENERAL.—In any proceeding 
to review a penalty imposed under para-
graph (1), the Administrator, after notice 
and, subject to clause (ii), opportunity for 
a hearing, shall by order affirm, set aside, 
reinstate, or modify the penalty, and, if ap-
propriate, remand to the WRRO for fur-
ther proceedings. 
(ii) 
RECORD
BELOW.—A 
hearing 
under clause (i) may consist solely of the 
record before the WRRO and an oppor-
tunity for the presentation of supporting 
reasons to affirm, modify, or set aside the 
applicable penalty. 
(iii) EXPEDITED
PROCEDURES.—The 
Administrator shall act expeditiously in ad-
ministering all proceedings under this 
paragraph. 
(g) SAVINGS PROVISIONS.— 
(1) AUTHORITY.—Nothing in this section au-
thorizes the WRRO or the Administrator to develop 
binding cybersecurity risk and resilience require-
ments for covered water systems, except as specifi-
cally provided for in this Act. 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS
(2) RULE OF CONSTRUCTION.—Nothing in this 
section preempts any authority of any State to take 
action to ensure the safety, adequacy, and resilience 
of water service within that State, as long as such 
action is not inconsistent with or in conflict with any 
cybersecurity risk and resilience requirement. 
(h) STATUS OF WRRO.—The WRRO is not a depart-
ment, agency, or instrumentality of the United States 
Government. 
(i) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to carry out this section 
$10,000,000 to remain available to the WRRO until ex-
pended. 
Æ 
VerDate Sep 11 2014 
22:29 Apr 07, 2025
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6301
E:\BILLS\H2594.IH
H2594
ssavage on LAPJG3WLY3PROD with BILLS