The American Water Works Association has thrown its support behind new legislation that would create a collaborative approach to cybersecurity in the water sector.
The Water Risk and Resilience Organization (WRRO) Establishment Act (H.R. 2594), introduced in the U.S. House of Representatives on April 2, authorizes an independent, non-federal organization to lead the development of cybersecurity requirements in the water sector, supported by oversight from the U.S. Environmental Protection Agency (EPA).
“This bill represents exactly the kind of thoughtful collaboration we need to address a very serious threat to our nation’s water systems,” said AWWA CEO David LaFrance. “The best and most efficient way to protect water operations and customer information is to leverage the knowledge of cybersecurity experts and utility leaders, while assuring strong federal oversight.
“As cybersecurity threats continue to grow, this legislation recognizes the unique challenges facing the water sector and gives professionals with relevant expertise a seat at the table when developing cyber requirements,” LaFrance added.
The Association of Metropolitan Water Agencies (AMWA) also announced its support for H.R. 2594.
The water sector has experienced an escalation in threats over recent years, from physical security breaches to cyber attacks from foreign adversaries, including ransomware attacks and infiltration of online utility programs. This poses risks to public health and safety, as bad actors could attempt to alter treatment chemical levels in drinking water or lock a utility out of its programs.
The sector has advocated for a collaborative approach to cybersecurity for several years, emphasizing the vast differences in size, capacity, and resources among utilities across the country. A one-size-fits-all approach to cybersecurity would be a challenge for many water systems, especially those serving small and rural communities. The WRRO’s collaborative structure ensures that water professionals can contribute their technical knowledge and utility expertise to the discussion and development of cybersecurity requirements.
The WRRO Establishment Act would establish a water sector-led body charged with developing appropriate cybersecurity standards and practices for the nation’s drinking water and wastewater systems
The WRRO Establishment Act marks the second cybersecurity for water legislation introduced in 2025, following the AMWA-backed WaterISAC Threat Protection Act.
Sources: AWWA, AMWA
Leave a Reply