,i  #aah? ,,congress  #b;d ,session  ,h4
 ,r4 #gibb  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,april #aj1 #bjbd ,mr4
 ,craw=d 7= himself & ,mr4 ,du>te7      
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ,transportation &      
,infra/ructure1 & 9 addition to !       
,committee on ,en]gy & ,comm]ce1 = a    
p]iod to be subsequ5tly det]m9$ by !    
,speak]1 9 ea* case = consid]ation ( su*
 provisions z fall )9 ! jurisdiction ( !
 committee conc]n$  ,a ,,bill  ,to      
e/abli% a ,wat] ,risk & ,resili5ce      
,organization to develop risk &         
resili5ce requirem5ts = ! wat] sector4  
#a4 ,wat] risk & resili5ce organization 
7a7 ,def9itions ,9 ?is section3 7#a7    
,adm9i/rator ,! t]m ,adm9i/rator means !
 ,adm9i/rator ( ! ,environm5tal         
,protection ,ag5cy4  7#b7 ,ag5cy ,! t]m 
,ag5cy means ! ,environm5tal ,protection
 ,ag5cy4  7#c7 ,cov]$ wat] sy/em ,! t]m 
cov]$ wat] sy/em means--  7,a7 a        
community wat] sy/em 7z def9$ 9 section 
#adja ( ! ,safe ,dr9k+ ,wat] ,act 7#db  

,u4,s4,c4 #cjj;f77 t s]ves a population 
( #c1cjj or m p]sons2 or  7,b7 a        
treatm5t works 7z def9$ 9 section #bab (
 ! ,f$]al ,wat] ,pollution ,control ,act
 7#cc ,u4,s4,c4 #abib77 t s]ves a       
population ( #c1cjj or m p]sons4  7#d7  
,cyb] resili5t ,! t]m cyb] resili5t     
means ! ability ( a cov]$ wat] or       
wa/ewat] sy/em to )/& or r$uce !        
magnitude or duration ( cyb]security    
incid5ts t disrupt ! cov]$ sy/em's      
ability to function normally & :i*      
includes ! capability to anticipate1    
absorb1 adapt to1 or rapidly recov] f   
cyb]security incid5ts4  7#e7            
,cyb]security incid5t ,! t]m            
cyb]security incid5t means a malici\s   
act or suspici\s ev5t t disrupts1 or    
attempts to disrupt1 ! op]ation (       
programmable electronic devices &       
communication networks includ+ h>dw>e1  
s(tw>e1 & data t are ess5tial to ! cyb] 
resili5t op]ation ( a cov]$ wat] sy/em4 
7#f7 ,cyb]security risk & resili5ce     
requirem5t ,! t]m cyb]security risk &   

resili5ce requirem5t means a            
cyb]security requirem5t approv$ by !    
,adm9i/rator "u subsection 7d7 to       
provide = ! cyb] resili5t op]ation ( a  
cov]$ wat] sy/em & ! cyb] resili5t      
design ( plann$ additions or            
modifications to su* sy/em4  7#g7 ,wat] 
risk & resili5ce organization ,! t]ms   
,wat] ,risk & ,resili5ce ,organization &
 ,,wrro mean ! organization c]tifi$ by !
 ,ag5cy "u subsection 7c74  7b7         
,jurisdiction & applicability  7#a7     
,jurisdiction ,! ,adm9i/rator %all h    
jurisdiction1 )9 ! ,unit$ ,/ates1 ov] ! 
,,wrro c]tifi$ by ! ,ag5cy "u subsection
 7c74  7#b7 ,regulations ,n lat] ?an    
#bgj days aft] ! date ( enactm5t ( ?is  
,act1 ! ,adm9i/rator %all issue a f9al  
rule to implem5t ?is section to c]tify !
 ,,wrro4  7c7 ,c]tification  7#a7 ,9    
g5]al ,foll[+ ! issuance ( a rule "u    
subsection 7b77#b71 any p]son may submit
 an application to ! ,adm9i/rator =     
c]tification z a ,wat] ,risk &          
,resili5ce ,organization4  7#b7         

,requirem5ts ,! ,adm9i/rator %all c]tify
 "o ,wat] ,risk & ,resili5ce            
,organization if ! ,adm9i/rator det]m9es
 t su* organization--  7,a7 demon/rates 
advanc$ te*nical k & exp]tise 9 !       
op]ations ( cov]$ wat] sy/ems2  7,b7 is 
compris$ ( #a or m memb]s ) relevant    
exp]i5ce z own]s or op]ators ( cov]$    
wat] sy/ems2  7,c7 has demon/rat$ !     
ability to develop & implem5t           
cyb]security risk & resili5ce           
requirem5ts t provide = an adequate     
level ( cyb]security risk & resili5ce = 
a cov]$ wat] sy/em2  7,d7 is capable (  
e/abli%+ measures1 9 l9e ) prevail+ be/ 
practices1 to secure s5sitive in=mation 
& to protect s5sitive security in=mation
 f public disclosure2 &  7,e7 has       
e/abli%$ rules t require t-- 7i7 x is   
indep5d5t ( ! us]s1 own]s1 & op]ators ( 
a cov]$ wat] sy/em1 ) balanc$ &         
objective /akehold] repres5tation 9 !   
selection ( directors ( ! organization &
 balanc$ decision mak+ 9 any committee  
or subord9ate organizational /ructure2  

7ii7 x allocate reasonable dues1 fees1 &
 o!r *>ges among end-us]s = all         
activities "u ?is section2  7iii7       
provide j & reasonable proc$ures =      
en=cem5t ( cyb]security risk & resili5ce
 requirem5ts & ! imposition ( p5alties 9
 accordance ) subsection 7f7 7includ+   
limitations on activities1 functions1 or
 op]ations1 or o!r appropriate          
sanctions72 &  7iv7 provide = reasonable
 notice & opportunity = public comm5t1  
due process1 op5ness1 & balance (       
int]e/s 9 develop+ cyb]security risk &  
resili5ce requirem5ts & o!rwise ex]cis+ 
duties4  7d7 ,cyb]security risk &       
resili5ce requirem5ts  7#a7 ,9 g5]al    
7,a7 ,propos$ requirem5ts ,! ,,wrro %all
 propose & file ) ! ,adm9i/rator ea*    
cyb]security risk & resili5ce requirem5t
 or modification to a requirem5t t x    
proposes to be made effective "u ?is    
section4  7,b7 ,implem5tation plan ,=   
ea* cyb]security risk & resili5ce       
requirem5t or modification to su* a     
requirem5t propos$ pursuant to          

subp>agraph 7,a71 ! ,,wrro %all also    
propose an implem5tation plan1 includ+ !
 s*$ule by :i* cov]$ wat] sy/ems mu/    
a*ieve compliance ) all or p>ts ( !     
cyb]security risk & resili5ce requirem5t
 or modification to su* a requirem5t4 ,!
 en=cem5t date mu/ provide a reasonable 
implem5tation p]iod = cov]$ wat] sy/ems 
to meet ! requirem5ts "u ! implem5tation
 plan4  7#b7 ,approval  7,a7 ,9 g5]al   
,not)/&+ p>agraph 7#c77;,a71 !          
,adm9i/rator %all approve1 by rule or   
ord]1 a propos$ cyb]security risk &     
resili5ce requirem5t or modification to 
su* a requirem5t if ! ,adm9i/rator      
det]m9es t ! requirem5t is j1           
reasonable1 n unduly ,discrim9atory1 or 
pref]5tial4  7,b7 ,def]5ce to ,,wrro ,! 
,adm9i/rator %all def] to ! te*nical    
exp]tise ( ! ,,wrro ) respect to !      
cont5t ( a propos$ cyb]security risk &  
resili5ce requirem5t or modification to 
su* a requirem5t4  7#c7 ,disapproval (  
requirem5t  7,a7 ,9 g5]al ,not)/&+      
p>agraph 7#b77;,a71 ! ,adm9i/rator %all 

rem& to ! ,,wrro a propos$ cyb]security 
risk & resili5ce requirem5t or          
modification to su* a requirem5t = :i* !
 ,adm9i/rator disapproves1 9 :ole or 9  
"p1 & provide #a or m specific          
recomm5dations t w\ld cause ! propos$   
requirem5t or modification to be approv$
 "u p>agraph 7#b74  7,b7 ,response &    
approval  7i7 ,9 g5]al ,^u rem& ( a     
propos$ cyb]security risk & resili5ce   
requirem5t or modification to su* a     
requirem5t & receipt ( ! ,adm9i/rator's 
recomm5dation pursuant to subp>agraph   
7,a71 ! ,,wrro %all-- 7,i7 accept !     
,adm9i/rator's recomm5dation & resubmit 
an am5d$ propos$ cyb]security risk &    
resili5ce requirem5t or modification to 
su* a requirem5t consi/5t ) !           
,adm9i/rator's recomm5dation2  7,,ii7   
respond to ! ,adm9i/rator & provide a   
reason :y ! recomm5dation 0 n accept$2  
or  7,,iii7 )draw ! propos$ cyb]security
 risk & resili5ce requirem5t or         
modification to su* a requirem5t4  7ii7 
,am5d$ requirem5t ,if ! ,,wrro resubmits

 a requirem5t or modification1 !        
,adm9i/rator %all review an am5d$       
propos$ cyb]security risk & resili5ce   
requirem5t or modification to su*       
requirem5t submitt$ by ! ,,wrro pursuant
 to clause 7i77,i7 & det]m9e :e!r to    
approve su* am5d$ requirem5t 9          
accordance ) p>agraph 7#b77;,a74  7iii7 
,response by ,,wrro ,^u receipt ( a     
response f ! ,,wrro pursuant to clause  
7i77,,ii71 ! ,adm9i/rator %all--  7,i7  
approve ! propos$ cyb]security risk &   
resili5ce requirem5t or modification to 
su* a requirem5t2 or  7,,ii7 invite !   
,,wrro to engage 9 negotiations ) !     
,adm9i/rator to rea* cons5sus to address
 ! specific recomm5dation made by !     
,adm9i/rator "u subp>agraph 7,a74  7#d7 
,effective date ,! effective date ( a   
cyb]security risk & resili5ce requirem5t
 or modification to su* a requirem5t    
propos$ "u ?is subsection %all be set by
 ! ,adm9i/rator 9 accordance ) ! propos$
 implem5tation plan submitt$ by ! ,,wrro
 "u p>agraph 7#a74  7#e7 ,submission (  

specific requirem5t ,! ,adm9i/rator1 ^u 
! ,adm9i/rator's own motion or ^u       
compla9t & hav+ a reasonable basis to   
conclude exi/+ recomm5dations "u !      
,,wrro are insuffici5t1 :5 implem5t$ by 
cov]$ wat] sy/ems1 to protect1 def5d1   
mitigate1 or recov] f a cyb]security    
incid5t1 may1 foll[+ consultation ) !   
,,wrro1 ord] ! ,,wrro to submit to !    
,ag5cy a propos$ cyb]security risk &    
resili5ce requirem5t or a modification  
to su* a requirem5t t addresses a       
specific matt] if ! ,adm9i/rator        
consid]s su* a requirem5t or modifi$    
requirem5t necess>y to protect1 def5d1  
mitigate1 or recov] f a cyb]security    
incid5t4  7#f7 ,conflict  7,a7 ,9 g5]al 
,! f9al rule adopt$ "u subsection       
7b77#b7 %all include specific processes 
= ! id5tification & timely resolution ( 
any conflict betwe5 a cyb]security risk 
& resili5ce requirem5t & any function1  
rule1 ord]1 t>iff1 or agreem5t accept$1 
approv$1 or ord]$ by ! ,adm9i/rator     
applicable to a cov]$ wat] sy/em4  7,b7 

,compliance ,a wat] sy/em %all cont9ue  
to comply ) su* function1 rule1 ord]1   
t>iff1 or agreem5t approv$1 or o!rwise  
accept$ or ord]$ by ! ,adm9i/rator      
unless--  7i7 ! ,adm9i/rator f9ds a     
conflict exi/s betwe5 cyb]security risk 
& resili5ce requirem5t & any su*        
provision2  7ii7 ! ,adm9i/rator ord]s a 
*ange to su* provision2 &  7iii7 ! ord]$
 *ange becomes effective4  7,c7         
,modification ,if ! ,adm9i/rator        
det]m9es t a cyb]security risk &        
resili5ce requirem5t ne$s to be *ang$ z 
a result ( a conflict id5tifi$ "u ?is   
p>agraph1 ! ,adm9i/rator %all direct !  
,,wrro to develop & file ) !            
,adm9i/rator a modifi$ cyb]security risk
 & resili5ce requirem5t "u ?is          
subsection1 und]tak5 pursuant to !      
processes 9 p>agraphs 7#a7 ?r\gh 7#d7   
above4  7e7 ,wat] sy/em monitor+ &      
assessm5t ,to aid 9 ! developm5t &      
adoption ( appropriate & necess>y       
cyb]security risk & resili5ce           
requirem5ts & modifications to          

requirem5ts1 ! ,,wrro %all-- 7#a7       
r\t9ely monitor & conduct p]iodic       
assessm5ts1 includ+ requir+             
self-atte/ations ( compliance f cov]$   
wat] sy/ems annually & assessm5ts ( !   
cov]$ wat] sy/em by ! ,,wrro or a       
designat$ ?ird p>ty n less ?an e five   
ye>s1 ( ! implem5tation ( cyb]security  
risk & resili5ce requirem5ts1 & !       
effectiv5ess ( cyb]security risk &      
resili5ce requirem5ts = cov]$ wat]      
sy/ems 9 ! ,unit$ ,/ates2 &  7#b7       
annually submit to ! ,adm9i/rator a     
report on ! implem5tation ( cyb]security
 risk & resili5ce requirem5ts1 !        
effectiv5ess ( cyb]security risk &      
resili5ce requirem5ts = cov]$ wat]      
sy/ems 9 ! ,unit$ ,/ates1 provid$ t su* 
reports %all only include aggregat$ or  
anonymiz$ f9d+s1 obs]vations1 & data1 & 
%all n conta9 any s5sitive security     
in=mation4  7f7 ,en=cem5t  7#a7 ,9 g5]al
 ,! ,,wrro may impose1 subject to       
p>agraphs 7#b7 & 7#d71 a p5alty on an   
own] or op]ator ( a cov]$ wat] sy/em = a

 violation ( a cyb]security risk &      
resili5ce requirem5t approv$ by !       
,adm9i/rator "u subsection 7d7 if !     
,,wrro1 aft] notice & an opportunity = a
 he>+--  7,a7 f9ds t ! own] or op]ator (
 a cov]$ sy/em has violat$ or fail$ to  
comply ) a requirem5t approv$ by !      
,adm9i/rator "u subsection 7d72 &  7,b7 
files notice & ! record ( ! proce$+ ) ! 
,adm9i/rator4  7#b7 ,notice ,! ,,wrro   
may n impose a p5alty on an own] or     
op]ator ( a cov]$ sy/em "u p>agraph 7#a7
 unless ! ,,wrro provides ! own] or     
op]ator ) notice ( ! alleg$ violation or
 failure to comply ) a cyb]security risk
 & resili5ce requirem5t & an opportunity
 = a consultation & a he>+ prior to f9d+
 t ! own] or op]ator has violat$ su*    
requirem5t "u p>agraph 7#a77;,a74 ,!    
own] or op]ator ( a cov]$ wat] sy/em may
 engage legal ,c\nsel to take "p 9 !    
consultation & he>+ ,requirem5ts4  7#c7 
,effective date ( p5alty ,a p5alty      
impos$ "u p>agraph 7#a7 may take effect 
n e>li] ?an ! #ca/ day aft] ! ,,wrro    

files ) ! ,adm9i/rator notice ( ! p5alty
 & ! record ( proce$+s4  7#d7           
,imposition ( p5alty ,a p5alty impos$ "u
 p>agraph 7#a7 %all n exce$ #be1jjj p]  
day ! entity is 9 violation ( a         
cyb]security risk & resili5ce           
requirem5t4 7,a7 ,a p5alty impos$ "u ?is
 subsection %all be ! only p5alty impos$
 = ! violation4 ,! ,adm9i/rator is b>r$ 
f impos+ additional p5alties on ! cov]$ 
wat] ,sy/em = ! same violation4  7,b7   
,any p5alties collect$ w be return$ to !
 ,,wrro to support tra9+ initiatives &  
support o!r res\rce capabilities ( !    
,,wrro 9 c>ry+ out its duties "u ?is    
,act4  7#e7 ,review by adm9i/rator  7,a7
 ,9 g5]al ,a p5alty impos$ "u p>agraph  
7#a7 may be subject to review by !      
,adm9i/rator4  7,b7 ,application =      
review ,! ,adm9i/rator may conduct a    
review "u subp>agraph 7,a7 on !         
,adm9i/rator's own motion or ^u         
application by an own] or op]ator ( a   
cov]$ wat] sy/em t is ! subject ( a     
p5alty impos$ "u p>agraph 7#a7 fil$ n   

lat] ?an #cj days aft] notice ( su*     
p5alty is fil$ ) ! ,adm9i/rator4  7,c7  
,/ay ( p5alty ,a p5alty "u review by !  
,adm9i/rator "u ?is p>agraph may n be   
/ay$ unless ! ,adm9i/rator o!rwise ord]s
 t su* p5alty be /ay$ ^u !              
,adm9i/rator's own motion or ^u         
application by ! own] or op]ator ( !    
cov]$ wat] sy/em own] or op]ator t is ! 
subject ( su* p5alty4  7,d7 ,proce$+    
7i7 ,9 g5]al ,9 any proce$+ to review a 
p5alty impos$ "u p>agraph 7#a71 !       
,adm9i/rator1 aft] notice & opportunity 
= he>+ 7:i* he>+ may consi/ solely ( !  
record be=e ! ,,wrro & opportunity = !  
pres5tation ( support+ reasons to       
affirm1 modify1 or set aside ! p5alty71 
%all by ord] affirm1 set aside1 re9/ate1
 or modify ! p5alty1 &1 if appropriate1 
rem& to ! ,,wrro = fur!r proce$+s4  7ii7
 ,exp$it$ proc$ures ,! ,adm9i/rator %all
 act exp$iti\sly 9 adm9i/]+ all he>+s "u
 ?is section4  7g7 ,sav+s provision     
7#a7 ,au?ority ,no?+ 9 ?is ,act         
au?orizes ! ,,wrro or ! ,,epa           

,adm9i/rator to develop cyb]security    
b9d+ risk & resili5ce requirem5ts =     
cov]$ wat] sy/ems1 except z def9$ by ?is
 act4  7#b7 ,rule ( con/ruction ,no?+ 9 
?is section may be con/ru$ to preempt   
any au?ority ( any ,/ate to take action 
to ensure ! safety1 adequacy1 &         
resili5ce ( wat] s]vice )9 t ,/ate1 z   
long z su* action is n inconsi/5t ) or  
conflicts ) any cyb]security risk &     
resili5ce requirem5t4  7h7 ,/atus (     
,,wrro ,! ,,wrro c]tifi$ "u subsection  
7c7 is n a dep>tm5t1 ag5cy1 or          
in/rum5tality ( ! ,unit$ ,/ates         
,gov]nm5t4  7i7 ,au?orization (         
appropriations ,!re is au?oriz$ to be   
appropriat$ to c>ry out ?is subsection  
#e1jjj1jjj = ea* ( fiscal ye>s #bjbd &  
#bjbe1 to rema9 available to ! ,,wrro   
until exp5d$4