I 
118TH CONGRESS 
2D SESSION 
H. R. 7922 
To establish a Water Risk and Resilience Organization to develop risk and 
resilience requirements for the water sector. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 10, 2024 
Mr. CRAWFORD (for himself and Mr. DUARTE) introduced the following bill; 
which was referred to the Committee on Transportation and Infrastruc-
ture, and in addition to the Committee on Energy and Commerce, for a 
period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To establish a Water Risk and Resilience Organization to 
develop risk and resilience requirements for the water sector. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. WATER RISK AND RESILIENCE ORGANIZATION. 
(a) DEFINITIONS.—In this section: 
(1) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the Environ-
mental Protection Agency. 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(2) AGENCY.—The term ‘‘Agency’’ means the 
Environmental Protection Agency. 
(3) COVERED WATER SYSTEM.—The term ‘‘cov-
ered water system’’ means— 
(A) a community water system (as defined 
in section 1401 of the Safe Drinking Water Act 
(42 U.S.C. 300f)) that serves a population of 
3,300 or more persons; or 
(B) a treatment works (as defined in sec-
tion 212 of the Federal Water Pollution Control 
Act (33 U.S.C. 1292)) that serves a population 
of 3,300 or more persons. 
(4) CYBER RESILIENT.—The term ‘‘cyber resil-
ient’’ means the ability of a covered water or waste-
water system to withstand or reduce the magnitude 
or duration of cybersecurity incidents that disrupt 
the covered system’s ability to function normally and 
which includes the capability to anticipate, absorb, 
adapt to, or rapidly recover from cybersecurity inci-
dents. 
(5) CYBERSECURITY INCIDENT.—The term ‘‘cy-
bersecurity incident’’ means a malicious act or sus-
picious event that disrupts, or attempts to disrupt, 
the operation of programmable electronic devices 
and communication networks including hardware, 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
software, and data that are essential to the cyber re-
silient operation of a covered water system. 
(6) CYBERSECURITY RISK AND RESILIENCE RE-
QUIREMENT.—The term ‘‘cybersecurity risk and re-
silience requirement’’ means a cybersecurity require-
ment approved by the Administrator under sub-
section (d) to provide for the cyber resilient oper-
ation of a covered water system and the cyber resil-
ient design of planned additions or modifications to 
such system. 
(7) WATER RISK AND RESILIENCE ORGANIZA-
TION.—The terms ‘‘Water Risk and Resilience Orga-
nization’’ and ‘‘WRRO’’ mean the organization cer-
tified by the Agency under subsection (c). 
(b) JURISDICTION AND APPLICABILITY.— 
(1) JURISDICTION.—The Administrator shall 
have jurisdiction, within the United States, over the 
WRRO certified by the Agency under subsection (c). 
(2) REGULATIONS.—Not later than 270 days 
after the date of enactment of this Act, the Adminis-
trator shall issue a final rule to implement this sec-
tion to certify the WRRO. 
(c) CERTIFICATION.— 
(1) IN GENERAL.—Following the issuance of a 
rule under subsection (b)(2), any person may submit 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
an application to the Administrator for certification 
as a Water Risk and Resilience Organization. 
(2) REQUIREMENTS.—The Administrator shall 
certify one Water Risk and Resilience Organization 
if the Administrator determines that such organiza-
tion— 
(A) 
demonstrates 
advanced 
technical 
knowledge and expertise in the operations of 
covered water systems; 
(B) is comprised of 1 or more members 
with relevant experience as owners or operators 
of covered water systems; 
(C) has demonstrated the ability to develop 
and implement cybersecurity risk and resilience 
requirements that provide for an adequate level 
of cybersecurity risk and resilience for a covered 
water system; 
(D) is capable of establishing measures, in 
line with prevailing best practices, to secure 
sensitive information and to protect sensitive 
security information from public disclosure; and 
(E) has established rules that require 
that— 
(i) it is independent of the users, own-
ers, and operators of a covered water sys-
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
tem, with balanced and objective stake-
holder representation in the selection of di-
rectors of the organization and balanced 
decision making in any committee or sub-
ordinate organizational structure; 
(ii) it allocate reasonable dues, fees, 
and other charges among end-users for all 
activities under this section; 
(iii) provide just and reasonable pro-
cedures for enforcement of cybersecurity 
risk and resilience requirements and the 
imposition of penalties in accordance with 
subsection (f) (including limitations on ac-
tivities, functions, or operations, or other 
appropriate sanctions); and 
(iv) provide for reasonable notice and 
opportunity for public comment, due proc-
ess, openness, and balance of interests in 
developing cybersecurity risk and resilience 
requirements and otherwise exercising du-
ties. 
(d) CYBERSECURITY RISK
AND RESILIENCE RE-
QUIREMENTS.— 
(1) IN GENERAL.— 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(A) 
PROPOSED
REQUIREMENTS.—The 
WRRO shall propose and file with the Adminis-
trator each cybersecurity risk and resilience re-
quirement or modification to a requirement that 
it proposes to be made effective under this sec-
tion. 
(B) IMPLEMENTATION
PLAN.—For each 
cybersecurity risk and resilience requirement or 
modification to such a requirement proposed 
pursuant to subparagraph (A), the WRRO shall 
also propose an implementation plan, including 
the schedule by which covered water systems 
must achieve compliance with all or parts of the 
cybersecurity risk and resilience requirement or 
modification to such a requirement. The en-
forcement date must provide a reasonable im-
plementation period for covered water systems 
to meet the requirements under the implemen-
tation plan. 
(2) APPROVAL.— 
(A) IN GENERAL.—Notwithstanding para-
graph (3)(A), the Administrator shall approve, 
by rule or order, a proposed cybersecurity risk 
and resilience requirement or modification to 
such a requirement if the Administrator deter-
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
mines that the requirement is just, reasonable, 
not unduly Discriminatory, or preferential. 
(B) DEFERENCE TO WRRO.—The Adminis-
trator shall defer to the technical expertise of 
the WRRO with respect to the content of a pro-
posed cybersecurity risk and resilience require-
ment or modification to such a requirement. 
(3) DISAPPROVAL OF REQUIREMENT.— 
(A) IN GENERAL.—Notwithstanding para-
graph (2)(A), the Administrator shall remand 
to the WRRO a proposed cybersecurity risk and 
resilience requirement or modification to such a 
requirement for which the Administrator dis-
approves, in whole or in part, and provide 1 or 
more specific recommendations that would 
cause the proposed requirement or modification 
to be approved under paragraph (2). 
(B) RESPONSE AND APPROVAL.— 
(i) IN GENERAL.—Upon remand of a 
proposed cybersecurity risk and resilience 
requirement or modification to such a re-
quirement and receipt of the Administra-
tor’s recommendation pursuant to subpara-
graph (A), the WRRO shall— 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(I) accept the Administrator’s 
recommendation and resubmit an 
amended proposed cybersecurity risk 
and resilience requirement or modi-
fication to such a requirement con-
sistent with the Administrator’s rec-
ommendation; 
(II) respond to the Administrator 
and provide a reason why the rec-
ommendation was not accepted; or 
(III) withdraw the proposed cy-
bersecurity risk and resilience require-
ment or modification to such a re-
quirement. 
(ii) AMENDED REQUIREMENT.—If the 
WRRO resubmits a requirement or modi-
fication, the Administrator shall review an 
amended proposed cybersecurity risk and 
resilience requirement or modification to 
such requirement submitted by the WRRO 
pursuant to clause (i)(I) and determine 
whether to approve such amended require-
ment in accordance with paragraph (2)(A). 
(iii) RESPONSE BY WRRO.—Upon re-
ceipt of a response from the WRRO pursu-
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
ant to clause (i)(II), the Administrator 
shall— 
(I) approve the proposed cyberse-
curity risk and resilience requirement 
or modification to such a requirement; 
or 
(II) invite the WRRO to engage 
in negotiations with the Administrator 
to reach consensus to address the spe-
cific recommendation made by the Ad-
ministrator under subparagraph (A). 
(4) EFFECTIVE DATE.—The effective date of a 
cybersecurity risk and resilience requirement or 
modification to such a requirement proposed under 
this subsection shall be set by the Administrator in 
accordance with the proposed implementation plan 
submitted by the WRRO under paragraph (1). 
(5) SUBMISSION OF SPECIFIC REQUIREMENT.— 
The Administrator, upon the Administrator’s own 
motion or upon complaint and having a reasonable 
basis to conclude existing recommendations under 
the WRRO are insufficient, when implemented by 
covered water systems, to protect, defend, mitigate, 
or recover from a cybersecurity incident, may, fol-
lowing consultation with the WRRO, order the 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(ii) the Administrator orders a change 
to such provision; and 
(iii) the ordered change becomes effec-
tive. 
(C) MODIFICATION.—If the Administrator 
determines that a cybersecurity risk and resil-
ience requirement needs to be changed as a re-
sult of a conflict identified under this para-
graph, the Administrator shall direct the 
WRRO to develop and file with the Adminis-
trator a modified cybersecurity risk and resil-
ience requirement under this subsection, under-
taken pursuant to the processes in paragraphs 
(1) through (4) above. 
(e) WATER
SYSTEM
MONITORING
AND
ASSESS-
MENT.—To aid in the development and adoption of appro-
priate and necessary cybersecurity risk and resilience re-
quirements and modifications to requirements, the WRRO 
shall— 
(1) routinely monitor and conduct periodic as-
sessments, including requiring self-attestations of 
compliance from covered water systems annually and 
assessments of the covered water system by the 
WRRO or a designated third party not less than 
every five years, of the implementation of cybersecu-
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
rity risk and resilience requirements, and the effec-
tiveness of cybersecurity risk and resilience require-
ments for covered water systems in the United 
States; and 
(2) annually submit to the Administrator a re-
port on the implementation of cybersecurity risk and 
resilience requirements, the effectiveness of cyberse-
curity risk and resilience requirements for covered 
water systems in the United States, provided that 
such reports shall only include aggregated or 
anonymized findings, observations, and data, and 
shall not contain any sensitive security information. 
(f) ENFORCEMENT.— 
(1) IN
GENERAL.—The WRRO may impose, 
subject to paragraphs (2) and (4), a penalty on an 
owner or operator of a covered water system for a 
violation of a cybersecurity risk and resilience re-
quirement approved by the Administrator under sub-
section (d) if the WRRO, after notice and an oppor-
tunity for a hearing— 
(A) finds that the owner or operator of a 
covered system has violated or failed to comply 
with a requirement approved by the Adminis-
trator under subsection (d); and 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(B) files notice and the record of the pro-
ceeding with the Administrator. 
(2) NOTICE.—The WRRO may not impose a 
penalty on an owner or operator of a covered system 
under paragraph (1) unless the WRRO provides the 
owner or operator with notice of the alleged violation 
or failure to comply with a cybersecurity risk and re-
silience requirement and an opportunity for a con-
sultation and a hearing prior to finding that the 
owner or operator has violated such requirement 
under paragraph (1)(A). The owner or operator of 
a covered water system may engage legal Counsel to 
take part in the consultation and hearing Require-
ments. 
(3) EFFECTIVE DATE OF PENALTY.—A penalty 
imposed under paragraph (1) may take effect not 
earlier than the 31st day after the WRRO files with 
the Administrator notice of the penalty and the 
record of proceedings. 
(4) IMPOSITION OF PENALTY.—A penalty im-
posed under paragraph (1) shall not exceed $25,000 
per day the entity is in violation of a cybersecurity 
risk and resilience requirement. 
(A) A penalty imposed under this sub-
section shall be the only penalty imposed for the 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
violation. The Administrator is barred from im-
posing additional penalties on the covered water 
System for the same violation. 
(B) Any penalties collected will be returned 
to the WRRO to support training initiatives 
and support other resource capabilities of the 
WRRO in carrying out its duties under this 
Act. 
(5) REVIEW BY ADMINISTRATOR.— 
(A) IN
GENERAL.—A penalty imposed 
under paragraph (1) may be subject to review 
by the Administrator. 
(B) APPLICATION FOR REVIEW.—The Ad-
ministrator may conduct a review under sub-
paragraph (A) on the Administrator’s own mo-
tion or upon application by an owner or oper-
ator of a covered water system that is the sub-
ject of a penalty imposed under paragraph (1) 
filed not later than 30 days after notice of such 
penalty is filed with the Administrator. 
(C) STAY OF PENALTY.—A penalty under 
review by the Administrator under this para-
graph may not be stayed unless the Adminis-
trator otherwise orders that such penalty be 
stayed upon the Administrator’s own motion or 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
upon application by the owner or operator of 
the covered water system owner or operator 
that is the subject of such penalty. 
(D) PROCEEDING.— 
(i) IN GENERAL.—In any proceeding 
to review a penalty imposed under para-
graph (1), the Administrator, after notice 
and opportunity for hearing (which hearing 
may consist solely of the record before the 
WRRO and opportunity for the presen-
tation of supporting reasons to affirm, 
modify, or set aside the penalty), shall by 
order affirm, set aside, reinstate, or modify 
the penalty, and, if appropriate, remand to 
the WRRO for further proceedings. 
(ii) EXPEDITED
PROCEDURES.—The 
Administrator shall act expeditiously in ad-
ministering all hearings under this section. 
(g) SAVINGS PROVISION.— 
(1) AUTHORITY.—Nothing in this Act author-
izes the WRRO or the EPA Administrator to de-
velop cybersecurity binding risk and resilience re-
quirements for covered water systems, except as de-
fined by this act. 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(2) RULE OF CONSTRUCTION.—Nothing in this 
section may be construed to preempt any authority 
of any State to take action to ensure the safety, ade-
quacy, and resilience of water service within that 
State, as long as such action is not inconsistent with 
or conflicts with any cybersecurity risk and resilience 
requirement. 
(h) STATUS OF WRRO.—The WRRO certified under 
subsection (c) is not a department, agency, or instrumen-
tality of the United States Government. 
(i) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to carry out this subsection 
$5,000,000 for each of fiscal years 2024 and 2025, to re-
main available to the WRRO until expended. 
Æ 
VerDate Sep 11 2014 
01:24 Apr 21, 2024
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6301
E:\BILLS\H7922.IH
H7922
kjohnson on DSK7ZCZBW3PROD with $$_JOB