,i  #aai? ,,congress  #a/ ,session  ,h4 
,r4 #beid  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,april #b1 #bjbe,mr4  
,craw=d introduc$ ! foll[+ bill2 :i* 0  
ref]r$ to ! ,committee on               
,transportation & ,infra/ructure1 & 9   
addition to ! ,committee on ,en]gy &    
,comm]ce1 = a p]iod to be subsequ5tly   
det]m9$ by ! ,speak]1 9 ea* case =      
consid]ation ( su* provisions z fall )9 
! jurisdiction ( ! committee conc]n$  ,a
 ,,bill  ,to e/abli% a ,wat] ,risk &    
,resili5ce ,organization to develop risk
 & resili5ce requirem5ts = ! wat]       
sector4  #a4 ,wat] risk & resili5ce     
organization  7a7 ,def9itions ,9 ?is    
section3 7#a7 ,adm9i/rator ,! t]m       
,adm9i/rator means ! ,adm9i/rator ( !   
,environm5tal ,protection ,ag5cy4  7#b7 
,cov]$ wat] sy/em ,! t]m cov]$ wat]     
sy/em means-- 7,a7 a community wat]     
sy/em 7z def9$ 9 section #adja ( ! ,safe
 ,dr9k+ ,wat] ,act 7#db ,u4,s4,c4       
#cjj;f77 t s]ves a population ( #c1cjj  
or m p]sons2 or  7,b7 a treatm5t works  

7z def9$ 9 section #bab ( ! ,f$]al ,wat]
 ,pollution ,control ,act 7#cc ,u4,s4,c4
 #abib77 t s]ves a population ( #c1cjj  
or m p]sons4  7#c7 ,cyb] resili5t  7,a7 
,9 g5]al ,! t]m cyb] resili5t means !   
ability ( a cov]$ wat] sy/em to )/& or  
r$uce ! magnitude or duration (         
cyb]security incid5ts t disrupt !       
ability ( ! cov]$ wat] sy/em to function
 normally4  7,b7 ,inclusion ,! t]m cyb] 
resili5t includes ! ability ( a cov]$   
wat] sy/em to anticipate1 absorb1 adapt 
to1 or rapidly recov] f cyb]security    
incid5ts4  7#d7 ,cyb]security incid5t ,!
 t]m cyb]security incid5t means a       
malici\s act or suspici\s ev5t t        
disrupts1 or attempts to disrupt1 !     
op]ation ( programmable electronic      
devices & communication networks1       
includ+ h>dw>e1 s(tw>e1 & data t are    
ess5tial to ! cyb] resili5t op]ation ( a
 cov]$ wat] sy/em4  7#e7 ,cyb]security  
risk & resili5ce requirem5t ,! t]m      
cyb]security risk & resili5ce requirem5t
 means a requirem5t t provides = ! cyb] 

resili5t op]ation ( a cov]$ wat] sy/em &
 ! cyb] resili5t design ( plann$        
additions or modifications to a cov]$   
wat] sy/em4  7#f7 ,wat] risk & resili5ce
 organization2 wrro ,! t]ms ,wat] ,risk 
& ,resili5ce ,organization & ,,wrro mean
 ! organization c]tifi$ by !            
,adm9i/rator "u subsection 7c74  7b7    
,applicability ,n lat] ?an #bgj days    
aft] ! date ( enactm5t ( ?is ,act1 !    
,adm9i/rator %all issue a f9al rule to  
c>ry out ?is section1 includ+           
regulations = ! selection & c]tification
 ( ! ,,wrro "u subsection 7c74  7c7     
,c]tification  7#a7 ,9 g5]al ,foll[+ !  
issuance ( ! f9al rule "u subsection    
7b77#a71 any organization may submit an 
application to ! ,adm9i/rator1 at su*   
"t1 9 su* mann]1 & conta9+ su* in=mation
 z ! ,adm9i/rator may require1 =        
c]tification z ! ,wat] ,risk &          
,resili5ce ,organization4  7#b7         
,requirem5ts ,! ,adm9i/rator %all c]tify
 n m ?an #a organization t submitt$ an  
application "u p>agraph 7#a7 z ! ,wat]  

,risk & ,resili5ce ,organization if !   
,adm9i/rator det]m9es t ! organization--
 7,a7 demon/rates advanc$ te*nical k &  
exp]tise 9 ! op]ations ( cov]$ wat]     
sy/ems2  7,b7 is compris$ ( #a or m     
memb]s ) relevant exp]i5ce z own]s or   
op]ators ( cov]$ wat] sy/ems2  7,c7 has 
demon/rat$ ! ability to develop &       
implem5t cyb]security risk & resili5ce  
requirem5ts t provide = an adequate     
level ( cyb]security risk & resili5ce = 
a cov]$ wat] sy/em2  7,d7 is capable (  
e/abli%+ measures1 9 l9e ) prevail+ be/ 
practices1 to secure s5sitive in=mation 
& to protect s5sitive security in=mation
 f public disclosure2 &  7,e7 has       
e/abli%$ rules t--  7i7 require t !     
organization be indep5d5t ( ! us]s1     
own]s1 & op]ators ( a cov]$ wat] sy/em1 
) balanc$ & objective /akehold]         
repres5tation 9 ! selection ( directors 
( ! organization & balanc$ decision mak+
 9 any committee or subord9ate          
organizational /ructure2  7ii7 require t
 ! organization allocate reasonable     

dues1 fees1 & o!r *>ges among end-us]s =
 all activities "u ?is section2  7iii7  
provide j & reasonable proc$ures =      
en=cem5t ( cyb]security risk & resili5ce
 requirem5ts & ! imposition ( p5alties 9
 accordance ) subsection 7f71 includ+   
limitations on activities1 functions1 or
 op]ations1 or o!r appropriate          
sanctions2 &  7iv7 provides = reasonable
 notice & opportunity = public comm5t1  
due process1 op5ness1 & balanc+ (       
int]e/s 9 develop+ cyb]security risk &  
resili5ce requirem5ts & o!rwise ex]cis+ 
duties describ$ 9 ?is section4  7d7     
,cyb]security risk & resili5ce          
requirem5ts  7#a7 ,9 g5]al  7,a7        
,propos$ requirem5ts ,! ,,wrro %all file
 ) ! ,adm9i/rator ea* cyb]security risk 
& resili5ce requirem5t or modification  
to su* a requirem5t t ! ,,wrro proposes 
to be made effective "u ?is section4    
7,b7 ,implem5tation plan  7i7 ,9 g5]al  
,= ea* propos$ cyb]security risk &      
resili5ce requirem5t or modification to 
su* a requirem5t fil$ pursuant to       

subp>agraph 7,a71 ! ,,wrro %all file an 
implem5tation plan1 includ+ ! s*$ule =  
implem5tation1 :i* may include a        
specifi$ date1 by :i* cov]$ wat] sy/ems 
%all a*ieve compliance ) all ( !        
cyb]security risk & resili5ce requirem5t
 or modification to su* a requirem5t4 ,!
 implem5tation s*$ule may acc\nt = a    
phas$ roll\t ( ! requirem5t1 recogniz+ t
 ! requirem5t may n apply1 9 totality1  
to all cov]$ wat] sy/ems4  7ii7         
,reasonable deadl9es ,! en=cem5t date   
propos$ by ! ,,wrro 9 ! implem5tation   
plan "u clause 7i7 %all provide a       
reasonable implem5tation p]iod = cov]$  
wat] sy/ems to meet ! requirem5ts "u !  
implem5tation plan4  7#b7 ,approval     
7,a7 ,9 g5]al ,not)/&+ p>agraph         
7#c77;,a71 ! ,adm9i/rator %all approve a
 propos$ cyb]security risk & resili5ce  
requirem5t or modification to su* a     
requirem5t1 includ+ ! accompany+        
implem5tation plan fil$ "u p>agraph     
7#a71 if ! ,adm9i/rator det]m9es t !    
requirem5t is j1 reasonable1 & n unduly 

discrim9atory or pref]5tial4  7,b7      
,def]5ce to wrro ,! ,adm9i/rator %all   
def] to ! te*nical exp]tise ( ! ,,wrro )
 respect to ! cont5t ( a propos$        
cyb]security risk & resili5ce requirem5t
 or modification to su* a requirem5t4   
7#c7 ,disapproval ( requirem5t  7,a7 ,9 
g5]al ,not)/&+ p>agraph 7#b77;,a71 if ! 
,adm9i/rator disapproves1 9 :ole or 9   
"p1 a fil$ cyb]security risk & resili5ce
 requirem5t or modification to su* a    
requirem5t1 ! ,adm9i/rator %all rem& su*
 requirem5t to ! ,,wrro & provide to !  
,,wrro specific recomm5dations t w\ld   
lead to ! approval ( ! cyb]security risk
 & resili5ce requirem5t or modification 
to su* requirem5t "u p>agraph 7#b74     
7,b7 ,timel9e ,! ,adm9i/rator %all rem& 
to ! ,,wrro a propos$ cyb]security risk 
& resili5ce requirem5t or modification  
to su* a requirem5t disapprov$ "u       
subp>agraph 7,a71 includ+ ! submission (
 ! specific recomm5dations requir$ "u t 
subp>agraph1 n lat] ?an #ij days aft] ! 
date on :i* ! ,,wrro fil$ ! requirem5t  

or modification ) ! ,adm9i/rator "u     
p>agraph 7#a77;,a74  7,c7 ,response &   
approval  7i7 ,9 g5]al ,on receipt ( !  
rem& ( a propos$ cyb]security risk &    
resili5ce requirem5t or modification to 
su* a requirem5t & receipt ( ! specific 
recomm5dations ( ! ,adm9i/rator pursuant
 to subp>agraph 7,a71 ! ,,wrro %all--   
7,i7 accept ! recomm5dations ( !        
,adm9i/rator & resubmit an am5d$ propos$
 cyb]security risk & resili5ce          
requirem5t or modification to su* a     
requirem5t consi/5t ) ^? recomm5dations2
  7,,ii7 provide to ! ,adm9i/rator & a  
reason :y ! recomm5dation 0 n accept$2  
or  7,,iii7 )draw ! propos$ cyb]security
 risk & resili5ce requirem5t or         
modification to su* a requirem5t4  7ii7 
,am5d$ requirem5t ,if ! ,,wrro files an 
am5d$ propos$ cyb]security risk &       
resili5ce requirem5t or modification to 
su* a requirem5t "u clause 7i77,i7 !    
,adm9i/rator %all review su* propos$    
requirem5t or modification & det]m9e    
:e!r to approve su* am5d$ requirem5t or 

modification 9 accordance ) p>agraph    
7#b77;,a74  7iii7 ,response by ,,wrro   
,on receipt ( a response f ! ,,wrro     
pursuant to clause 7i77,,ii71 !         
,adm9i/rator %all-- 7,i7 approve !      
propos$ cyb]security risk & resili5ce   
requirem5t or modification to su* a     
requirem5t2 or  7,,ii7 invite ! ,,wrro  
to engage 9 negotiations ) !            
,adm9i/rator to rea* cons5sus to address
 ! specific recomm5dation made by !     
,adm9i/rator "u subp>agraph 7,a74  7#d7 
,effective date ,! effective date ( an  
approv$ cyb]security risk & resili5ce   
requirem5t or modification to su* a     
requirem5t propos$ "u ?is subsection    
%all be set by ! ,adm9i/rator 9         
accordance ) ! propos$ implem5tation    
plan submitt$ by ! ,,wrro "u p>agraph   
7#a74  7#e7 ,submission ( specific      
requirem5t ,! ,adm9i/rator1 on ! motion 
( ! ,adm9i/rator or on compla9t may1    
foll[+ consultation ) ! ,,wrro1 ord] !  
,,wrro to file ) ! ,adm9i/rator "u      
p>agraph 7#a7 a propos$ cyb]security    

risk & resili5ce requirem5t or          
modification to su* z requirem5t t      
addresses a specific matt] if !         
,adm9i/rator det]m9es !re is a          
reasonable basis to conclude ! exi/+    
cyb]security risk & resili5ce           
requirem5ts are insuffici5t1 :5         
implem5t$ by cov]$ wat] sy/ems1 to      
protect1 def5d1 or recov] f or mitigate 
a cyb]security incid5t4  7#f7 ,conflict 
7,a7 ,9 g5]al ,! f9al rule adopt$ "u    
subsection 7b77#b7 %all include specific
 processes = ! id5tification & timely   
resolution ( any conflict betwe5 a      
cyb]security risk & resili5ce requirem5t
 & any function1 rule1 ord]1 t>iff1 or  
agreem5t accept$1 approv$1 or ord]$ by !
 ,adm9i/rator t is applicable to a cov]$
 wat] sy/em4  7,b7 ,compliance ,a cov]$ 
wat] sy/em %all cont9ue to comply ) a   
function1 rule1 ord]1 t>iff1 or agreem5t
 describ$ 9 subp>agraph 7,a7 unless--   
7i7 ! ,adm9i/rator f9ds a conflict exi/s
 betwe5 a cyb]security risk & resili5ce 
requirem5t & any function1 rule1 ord]1  

t>iff1 or agreem5t approv$ or o!rwise   
accept$ or ord]$ by ! ,adm9i/rator2     
7ii7 ! ,adm9i/rator ord]s a *ange to t  
function1 rule1 ord]1 t>iff1 or         
agreem5t2 &  7iii7 ! ord]$ *ange becomes
 effective4  7,c7 ,modification ,if !   
,adm9i/rator det]m9es t a cyb]security  
risk & resili5ce requirem5t ne$s to be  
*ang$ z a result ( a conflict id5tifi$  
"u ?is p>agraph1 ! ,adm9i/rator %all    
direct ! ,,wrro to propose & file ) !   
,adm9i/rator a modifi$ cyb]security risk
 & resili5ce requirem5t pursuant to     
p>agraphs 7#a7 ?r\gh 7#d7 ( ?is section4
  7e7 ,wat] sy/em monitor+ & assessm5t  
,to aid 9 ! developm5t & adoption (     
appropriate & necess>y cyb]security risk
 & resili5ce requirem5ts & modifications
 to su* requirem5ts1 ! ,,wrro %all--    
7#a7 r\t9ely monitor & conduct p]iodic  
assessm5ts ( ! implem5tation (          
cyb]security risk & resili5ce           
requirem5ts approv$ by ! ,adm9i/rator "u
 subsection 7d7 & ! effectiv5ess (      
cyb]security risk & resili5ce           

requirem5ts = cov]$ sy/ems1 includ+ by  
requir+-- 7,a7 annual self-atte/ations (
 compliance ) su* cyb]security risk &   
resili5ce requirem5ts by cov]$ wat]     
sy/ems2 &  7,b7 assessm5ts ( ! cov]$    
wat] sy/em by ! ,,wrro or by a ?ird p>ty
 designat$ by ! ,,wrro n less frequ5tly 
?an e #e ye>s ( compliance by cov]$ wat]
 sy/ems ) su* cyb]security risk &       
resili5ce requirem5ts2 &  7#b7 annually 
submit to ! ,adm9i/rator a report       
describ+ ! implem5tation ( cyb]security 
risk & resili5ce requirem5ts approv$ by 
! ,adm9i/rator "u subsection 7d7 & !    
effectiv5ess ( cyb]security risk &      
resili5ce requirem5ts = cov]$ wat]      
sy/ems subject to ! requirem5ts t       
reports "u ?is p>agraph--  7,a7 %all    
only include aggregat$ or anonymiz$     
f9d+s1 obs]vations1 & data2 &  7,b7 %all
 n conta9 any s5sitive security         
in=mation4  7f7 ,en=cem5t  7#a7 ,9 g5]al
 ,! ,,wrro may1 subject to p>agraphs    
7#b7 ?r\gh 7#e71 impose a p5alty on !   
own] or op]ator ( a cov]$ wat] sy/em = a

 violation ( a cyb]security risk &      
resili5ce requirem5t if ! ,,wrro1 aft]  
notice & an opportunity = a consultation
 & a he>+-- 7,a7 f9ds t ! own] or       
op]ator ( a cov]$ sy/em has violat$ or  
fail$ to comply ) ! cyb]security risk & 
resili5ce requirem5t2 &  7,b7 files     
notice ( ! f9d+ "u subp>agraph 7,a7 & ! 
record ( ! proce$+ ) ! ,adm9i/rator4    
7#b7 ,notice  7,a7 ,9 g5]al ,! ,,wrro   
may n impose a p5alty on ! own] or      
op]ator ( a cov]$ wat] sy/em "u p>agraph
 7#a7 unless ! ,,wrro provides ! own] or
 op]ator )--  7i7 notice ( ! alleg$     
violation ( or failure to comply ) a    
cyb]security risk & resili5ce           
requirem5t2 &  7ii7 an opportunity = a  
consultation & a he>+ prior to f9d+ t ! 
own] or op]ator has violat$ or fail$ to 
comply ) ! applicable cyb]security risk 
& resili5ce requirem5t "u p>agraph      
7#a77;,a74  7,b7 ,access to c\nsel ,!   
own] or op]ator ( a cov]$ wat] sy/em may
 engage legal c\nsel to take "p 9 !     
consultation & he>+ describ$ 9          

subp>agraph 7,a77ii74  7#c7 ,effective  
date ( p5alty ,a p5alty impos$ "u       
p>agraph 7#a7 may take effect n e>li]   
?an #ca days aft] ! date on :i* ! ,,wrro
 files ) ! ,adm9i/rator notice ( !      
p5alty & ! record ( proce$+s "u         
subp>agraph 7,b7 ( t p>agraph4  7#d7    
,imposition ( p5alty  7,a7 ,maximum     
am\nt ,a p5alty impos$ "u p>agraph 7#a7 
%all n exce$ #be1jjj p] day ! applicable
 own] or op]ator is 9 violation ( a     
cyb]security risk & resili5ce requirem5t
 approv$ by ! ,adm9i/rator "u subsection
 7d74  7,b7 ,limitation ,no p5alty may  
be impos$ on a cov]$ wat] sy/em "u any  
o!r provision ( law = a violation ( a   
cyb]security risk & resili5ce requirem5t
 approv$ by ! ,adm9i/rator "u subsection
 7d74  7,c7 ,use ( p5alty funds ,any    
p5alties collect$ "u ?is subsection %all
 be return$ to ! ,,wrro to support tra9+
 initiatives & o!r res\rce capabilities 
( ! ,,wrro 9 c>ry+ out ! duties ( !     
,,wrro "u ?is section4  7#e7 ,review by 
adm9i/rator  7,a7 ,9 g5]al ,!           

,adm9i/rator may review a p5alty impos$ 
"u p>agraph 7#a74  7,b7 ,application =  
review ,! ,adm9i/rator may conduct a    
review "u subp>agraph 7,a7 on ! motion (
 ! ,adm9i/rator or on application by an 
own] or op]ator ( a cov]$ wat] sy/em t  
is ! subject ( a p5alty impos$ "u       
p>agraph 7#a71 if su* application is    
fil$ n lat] ?an #cj days aft] ! date on 
:i* ! notice ( t p5alty is fil$ ) !     
,adm9i/rator4  7,c7 ,/ay ( p5alty ,a    
p5alty "u review by ! ,adm9i/rator "u   
?is p>agraph may only be /ay$ if1 on !  
motion ( ! ,adm9i/rator or on           
application by ! own] or op]ator ( !    
cov]$ wat] sy/em t is ! subject ( !     
p5alty1 ! ,adm9i/rator sep>ately ord]s !
 /ay ( ! p5alty4  7,d7 ,proce$+s  7i7 ,9
 g5]al ,9 any proce$+ to review a p5alty
 impos$ "u p>agraph 7#a71 !             
,adm9i/rator1 aft] notice &1 subject to 
clause 7ii71 opportunity = a he>+1 %all 
by ord] affirm1 set aside1 re9/ate1 or  
modify ! p5alty1 &1 if appropriate1 rem&
 to ! ,,wrro = fur!r proce$+s4  7ii7    

,record bel[ ,a he>+ "u clause 7i7 may  
consi/ solely ( ! record be=e ! ,,wrro &
 an opportunity = ! pres5tation (       
support+ reasons to affirm1 modify1 or  
set aside ! applicable p5alty4  7iii7   
,exp$it$ proc$ures ,! ,adm9i/rator %all 
act exp$iti\sly 9 adm9i/]+ all proce$+s 
"u ?is p>agraph4  7g7 ,sav+s provisions 
7#a7 ,au?ority ,no?+ 9 ?is section      
au?orizes ! ,,wrro or ! ,adm9i/rator to 
develop b9d+ cyb]security risk &        
resili5ce requirem5ts = cov]$ wat]      
sy/ems1 except z specifically provid$ = 
9 ?is ,act4  7#b7 ,rule ( con/ruction   
,no?+ 9 ?is section preempts any        
au?ority ( any ,/ate to take action to  
ensure ! safety1 adequacy1 & resili5ce (
 wat] s]vice )9 t ,/ate1 z long z su*   
action is n inconsi/5t ) or 9 conflict )
 any cyb]security risk & resili5ce      
requirem5t4  7h7 ,/atus ( ,,wrro ,!     
,,wrro is n a dep>tm5t1 ag5cy1 or       
in/rum5tality ( ! ,unit$ ,/ates         
,gov]nm5t4  7i7 ,au?orization (         
appropriations ,!re is au?oriz$ to be   

appropriat$ to c>ry out ?is section     
#aj1jjj1jjj to rema9 available to !     
,,wrro until exp5d$4