,,ii  #aai? ,,congress  #b;d ,session   
,s4 #ecfh  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,augu/ #g1 #bjbf ,mr4  
,s*iff 7= himself & ,ms4 ,klobu*>7      
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,environm5t & ,public ,works  ,a ,,bill 
,to am5d ! ,safe ,dr9k+ ,wat] ,act & !  
,f$]al ,wat] ,pollution ,control ,act to
 e/abli% or modify cyb]security         
requirem5ts = dr9k+ wat] & wa/ewat]     
sy/ems1 & = o!r purposes4  #a4 ,%ort    
title2 table ( cont5ts  7a7 ,%ort title 
,?is ,act may be cit$ z ! ,wat] ,cyb]   
,%ield ,act ( #bjbf4  7b7 ,table (      
cont5ts ,! table ( cont5ts = ?is ,act is
 z foll[s3  ,sec4 #a4 ,%ort title2 table
 ( cont5ts4 ,,title ,i--,dr9k+ wat]     
infra/ructure ,sec4 #aja4 ,community    
wat] sy/em risk & resili5ce4 ,sec4 #ajb4
 ,cyb]security requirem5ts = dr9k+ wat] 
sy/ems4 ,sec4 #ajc4 ,reau?orization (   
midsize & l>ge dr9k+ wat] sy/em         
infra/ructure resili5ce & su/a9ability  
program4 ,sec4 #ajd4 ,dr9k+ wat]        

security assi/ance4 ,,title ,,ii--,clean
 wat] infra/ructure ,sec4 #bja4         
,treatm5t works risk & resili5ce4 ,sec4 
#bjb4 ,cyb]security requirem5ts =       
treatm5t works4 ,sec4 #bjc4             
,reau?orization ( ! clean wat]          
infra/ructure resili5cy & su/a9ability  
program4 ,sec4 #bjd4 ,clean wat]        
security assi/ance4 ,,title ,,iii--,cyb]
 incid5t report+ obligations ,sec4 #cja4
 ,cyb] incid5t report+4  ,i ,dr9k+ wat] 
infra/ructure  #aja4 ,community wat]    
sy/em risk & resili5ce ,section #adcc ( 
! ,safe ,dr9k+ ,wat] ,act 7#db ,u4,s4,c4
 #cjj;i-#b7 is am5d$-- 7#a7 9 subsection
 7a7--  7,a7 9 p>agraph 7#a77;,a7-- 7i7 
9 clause 7ii71 by /rik+ /orage &        
di/ribution facilities1 electronic1     
comput]1 or o!r automat$ sy/ems 7includ+
 ! security ( su* sy/ems7 :i* & ins]t+ &
 /orage & di/ribution facilities t2     
7ii7 9 clause 7v71 by /rik+ & at ! end2 
&  7iii7 by add+ at ! end ! foll[+3     
7vii7 us+ a me?od approv$ by !          
applicable ,/ate1 ! risks to electronic1

 comput]1 or o!r automat$ sy/ems = !    
purpose ( id5tify+ significant          
cyb]security risks t h ! pot5tial to    
cause ! impacts describ$ 9 subp>agraph  
7,a7 or 7,b7 ( p>agraph 7#b72 &  2 &    
7,b7 by /rik+ p>agraphs 7#c7 ?r\gh 7#e7 
& ins]t+ ! foll[+3  7#c7 ,review &      
revision  7,a7 ,9 g5]al ,ea* community  
wat] sy/em describ$ 9 p>agraph 7#a7     
%all1 n less frequ5tly ?an once e #e    
ye>s1 review &1 if necess>y1 revise !   
assessm5t4  7,b7 ,c]tification to !     
,adm9i/rator or ,/ate ,on completion ( !
 review "u subp>agraph 7,a71 a community
 wat] sy/em describ$ 9 p>agraph 7#a7    
%all submit to ! applicable ,/ate a     
c]tification t ! community wat] sy/em   
has review$ &1 if applicable1 revis$ !  
assessm5t4  2  7#b7 9 subsection 7b7--  
7,a7 by r$esignat+ p>agraphs 7#a7 ?r\gh 
7#d7 z subp>agraphs 7,a7 ?r\gh 7,d71 &  
ind5t+ appropriately2  7,b7 9 ! matt]   
prec$+ subp>agraph 7,a7 7z s            
r$esignat$71 by /rik+ ,ea* community    
wat] sy/em 9 ! fir/ s5t5ce & all t      

foll[s ?r\gh ,! em]g5cy response plan 9 
! ?ird s5t5ce & ins]t+ ! foll[+3  7#a7  
,9 g5]al ,ea* community wat] sy/em s]v+ 
a population great] ?an #c1cjj %all     
prep>e an em]g5cy response plan t       
incorporates f9d+s ( ! assessm5t        
conduct$ "u subsection 7a7 = t community
 wat] sy/em 7or any revisions to t      
assessm5t74  7#b7 ,requir$ inclusions ,!
 em]g5cy response plan ( a community    
wat] sy/em "u p>agraph 7#a7  2  7,c7 9  
p>agraph 7#b7 7z s designat$7--  7i7 9  
subp>agraph 7,a7 7z s r$esignat$71 by   
/rik+ & cyb]security2  7ii7 9           
subp>agraph 7,c7 7z s r$esignat$71 by   
/rik+ & at ! end2  7iii7 9 subp>agraph  
7,d7 7z s r$esignat$71 by /rik+ ! p]iod 
at ! end & ins]t+ 2 &2 &  7iv7 by add+  
at ! end ! foll[+3  7,e7 c\nt]measures t
 ! sy/em int5ds to adopt or1 if already 
9 use1 ma9ta9 to mitigate ! significant 
cyb]security risks id5tifi$ "u          
subsection 7a77#a77;,a77vii71 includ+ a 
s*$ule ! sy/em int5ds to foll[ to adopt 
any c\nt]measures n already 9 use by !  

sy/em4  2 &  7,d7 by add+ at ! end !    
foll[+3  7#c7 ,review2 revision ,a      
community wat] sy/em s]v+ a population  
great] ?an #c1cjj %all review &1 z      
necess>y1 revise ! em]g5cy response plan
 prep>$ "u ?is subsection n less        
frequ5tly ?an once e #e ye>s4  2  7#c7  
by /rik+ subsection 7f72  7#d7 by       
r$esignat+ subsections 7c71 7d71 & 7e7 z
 subsections 7d71 7e71 & 7f71           
respectively2  7#e7 by ins]t+ aft]      
subsection 7b7 ! foll[+3  7c7           
,submission & approval ( assessm5ts &   
plans  7#a7 ,submission  7,a7 ,9 g5]al  
,ea* community wat] sy/em subject to    
subsections 7a7 & 7b7 %all1 dur+ a      
cyb]security assessm5t pursuant to      
section #adcc;,a7b77#a77;,a71 provide to
 ! applicable ,/ate-- 7i7 ! portion ( ! 
assessm5t prep>$ "u subsection 7a7 t is 
describ$ 9 p>agraph 7#a77;,a77vii7 ( t  
subsection 7includ+ any revision to t   
portion ( ! assessm5t72 &  7ii7 !       
portion ( ! em]g5cy response plan prep>$
 "u subsection 7b7 t is describ$ 9      

p>agraph 7#b77;,e7 ( t subsection       
7includ+ any revision to t portion ( !  
em]g5cy response plan74  7,b7           
,limitation ,nei!r ! ,adm9i/rator nor a 
,/ate may require ! submission ( any    
portion ( an assessm5t "u subsection 7a7
 or an em]g5cy response plan "u         
subsection 7b7 t is n describ$ 9        
subp>agraph 7,a74  7#b7 ,review2        
approval  7,a7 ,9 g5]al ,a ,/ate %all-- 
7i7 review ! portions ( ! assessm5ts &  
em]g5cy response plans ( community wat] 
sy/ems submitt$ pursuant to p>agraph    
7#a77;,a7 = con=mity ) ! requirem5ts (  
?is section & section #adcc;,a2 &  7ii7 
7,i7 approve ( ! portions ( an assessm5t
 & em]g5cy response plan submitt$       
pursuant to p>agraph 7#a77;,a72 or      
7,,ii7 disapprove ( ! portions ( an     
assessm5t & em]g5cy response plan       
submitt$ pursuant to p>agraph 7#a77;,a7 
if ! ,adm9i/rator or ,/ate1 z           
applicable1 det]m9es t--  7aa7 !        
submitt$ portions ( ! assessm5t or      
em]g5cy response plan are miss+1        

incomplete1 or fail to con=m ) !        
requirem5ts ( ?is section or section    
#adcc;,a2 or  7bb7 ! submitt$ portions (
 ! assessm5t or em]g5cy response plan   
fail to provide = cyb]security resili5ce
 9 accordance ) ! basel9e cyb]security  
/&>ds e/abli%$ by ! ,adm9i/rator "u     
section #adcc;,a7c74  7,b7 ,en=cem5t ,a 
,/ate may use appropriate en=cem5t      
me*anisms "u ?is title or ! appropriate 
,/ate au?ority to rem$y noncompliance1 z
 describ$ 9 items 7aa7 & 7bb7 (         
subp>agraph 7,a77ii77,,ii71 "u ?is      
subsection4  7#c7 ,submitt$ docum5tation
  7,a7 ,applicability ( ,,foia ,any     
in=mation submitt$ "u ?is subsection    
%all be exempt f disclosure "u section  
#eeb7;b77#c7 ( title #e1 ,unit$ ,/ates  
,code 7commonly kn[n z ! ,fre$om (      
,in=mation ,act71 & any provision (     
,/ate1 ,tribal1 or local fre$om (       
in=mation law1 op5 gov]nm5t law1 op5    
meet+s law1 op5 records law1 sun%9e law1
 or simil> law requir+ disclosure (     
in=mation or records4  7,b7 ,treatm5t ( 

docum5tation  7i7 ,protocol developm5t  
,n lat] ?an #ahj days aft] ! date (     
enactm5t ( ! ,wat] ,cyb] ,%ield ,act (  
#bjbf & be=e any cyb]security assessm5ts
 are c>ri$ out pursuant to section      
#adcc;,a7b77#a77;,a71 ! ,adm9i/rator1 9 
consultation ) appropriate ,f$]al law   
en=cem5t & intellig5ce (ficials1 %all   
develop su* protocols z are necess>y to 
protect any in=mation provid$ "u        
p>agraph 7#a77;,a7 to ! ,/ate4  7ii7    
,requirem5ts = protocol ,! protocol     
develop$ "u clause 7i7 %all ensure t--  
7,i7 ea* copy ( ! portions ( an         
assessm5t & em]g5cy response plan       
submitt$ pursuant to p>agraph 7#a77;,a7 
are kept 9 a secure location2  7,,ii7   
only individuals designat$ by !         
applicable ,/ate may h access to copies 
( ! portions ( ! assessm5t & em]g5cy    
response plan submitt$ pursuant to      
p>agraph 7#a77;,a72 &  7,,iii7 no copy (
 ! portions ( ! assessm5t & em]g5cy     
response plan submitt$ pursuant to      
p>agraph 7#a77;,a7 %all be made         

available to anyone o!r ?an an          
individual designat$ by ! applicable    
,/ate4  7iii7 ,sav+s provision ,no?+ 9  
?is subp>agraph au?orizes any p]son to  
)hold any in=mation f ,congress or f a  
committee or subcommittee ( ,congress4  
2  7#f7 9 subsection 7e7 7z s           
r$esignat$71 by /rik+ a c]tification (  
su* assessm5t or plan is submitt$ to !  
,adm9i/rator & ins]t+ an assessm5t or   
plan is submitt$ to ! applicable ,/ate12
 &  7#g7 by /rik+ subsection 7h7 &      
ins]t+ ! foll[+3  7h7 ,def9itions ,9 ?is
 section3 7#a7 ,natural haz>d ,! t]m    
natural haz>d means a natural ev5t t    
?reat5s ! function+ ( a community wat]  
sy/em1 includ+ an e>?quake1 tornado1    
flood1 hurricane1 wildfire1 & hydrologic
 *anges4  7#b7 ,resili5ce ,! t]m        
resili5ce means ! ability ( a community 
wat] sy/em or an asset ( a community    
wat] sy/em to adapt to or )/& ! effects 
( a malevol5t act or natural haz>d )\t  
int]ruption to ! asset's or sy/em's     
function1 or if ! function is int]rupt$1

 to rapidly return to a normal op]at+   
condition4  7#c7 ,/ate  7,a7 ,9 g5]al ,!
 t]m ,/ate means a ,/ate t has assum$   
prim>y en=cem5t responsibility pursuant 
to section #adcc;,a7e74  7,b7 ,en=cem5t 
by ! ,adm9i/rator ,if a ,/ate has n     
assum$ prim>y en=cem5t responsibility   
pursuant to section #adcc;,a7e71 ! t]m  
,/ate %all1 = purposes ( obligations ( !
 ,/ate "u ?is subsection1 be consid]$ to
 be a ref]5ce to ! ,adm9i/rator4  4     
#ajb4 ,cyb]security requirem5ts = dr9k+ 
wat] sy/ems  7a7 ,9 g5]al ,! ,safe      
,dr9k+ ,wat] ,act is am5d$ by ins]t+    
aft] section #adcc 7#db ,u4,s4,c4       
#cjj;i-#b7 ! foll[+3  #adcc;,a4         
,cyb]security requirem5ts  7a7          
,def9itions ,9 ?is section3 7#a7        
,cyb]security incid5t ,! t]m            
cyb]security incid5t means a malici\s   
act or suspici\s ev5t t disrupts1 or    
attempts to disrupt1 ! op]ation (       
programmable electronic devices &       
communication networks1 includ+ h>dw>e1 
s(tw>e1 & data t are ess5tial to !      

cyb]security resili5ce ( a public wat]  
sy/em4  7#b7 ,cyb]security resili5ce ,! 
t]m cyb]security resili5ce means !      
ability ( a public wat] sy/em to adapt  
to or )/& ! effects ( a cyb]security    
incid5t )\t int]ruption to ! public wat]
 sy/em's function1 or if ! function is  
int]rupt$1 to rapidly return to a normal
 op]at+ condition4  7#c7 ,/ate  7,a7 ,9 
g5]al ,except = subsection 7e71 ! t]m   
,/ate means a ,/ate t has assum$ prim>y 
en=cem5t responsibility pursuant to     
subsection 7e74  7,b7 ,en=cem5t by !    
,adm9i/rator ,if a ,/ate has n assum$   
prim>y en=cem5t responsibility pursuant 
to subsection 7e71 ! t]m ,/ate %all1 =  
purposes ( obligations ( ! ,/ate "u ?is 
section 7except = subsection 7e771 be   
consid]$ to be a ref]5ce to !           
,adm9i/rator4  7b7 ,cyb]security        
assessm5ts  7#a7 ,assessm5ts requir$    
7,a7 ,9 g5]al ,a ,/ate %all c>ry out    
cyb]security assessm5ts ( public wat]   
sy/ems 9 accordance ) ?is p>agraph4     
7,b7 ,evaluation ( adequacy ,= a public 

wat] sy/em subject to a cyb]security    
assessm5t "u subp>agraph 7,a71 if !     
public wat] sy/em uses op]ational       
te*nology1 ! ,/ate %all evaluate !      
adequacy ( ! cyb]security ( ! op]ational
 te*nology1 & in=mation & communications
 te*nology t is connect$ to ! op]ational
 te*nology1 aga9/ ! basel9e cyb]security
 /&>ds promulgat$ by ! ,adm9i/rator "u  
subsection 7c74  7,c7 ,review (         
assessm5ts & plans ,9 c>ry+ out a       
cyb]security assessm5t requir$ "u       
subp>agraph 7,a71 a public wat] sy/em   
%all provide1 & ! ,/ate %all review1 !  
portions ( ! risk & resili5ce assessm5ts
 ( ! public wat] sy/em "u section       
#adcc7;a7 & ! em]g5cy response plans ( !
 public wat] sy/em "u section #adcc7;b7 
submitt$ "u section #adcc7;c77#a77;,a74 
7,d7 ,inspections ,9 c>ry+ out          
cyb]security assessm5ts "u ?is p>agraph1
 a ,/ate %all c>ry out inspections ( a  
repres5tative sample ( public wat]      
sy/ems ea* ye>1 :i* sampl+ %all be in=m$
 by risk-bas$ consid]ations1 subject to 

! condition t ! scope ( ! inspection is 
limit$ to ! sy/ems ( ! public wat] sy/em
 necess>y to meet ! requirem5ts ( ?is   
p>agraph4  7#b7 ,violations ,if a ,/ate 
id5tifies a violation ( ! basel9e       
cyb]security /&>ds e/abli%$ by !        
,adm9i/rator "u subsection 7c7 :ile     
conduct+ an assessm5t "u p>agraph 7#a71 
! ,/ate %all take appropriate /eps to   
ensure t ! public wat] sy/em addresses !
 violation & use me*anisms1 includ+     
en=cem5t1 = failures to correct ^?      
violations4  7#c7 ,submission to ,,epa  
7,a7 ,9 g5]al ,a ,/ate %all annually    
submit to ! ,adm9i/rator a report t     
summ>izes ! p]=mance ( ! public wat]    
sy/ems ( ! ,/ate = ea* cyb]security     
p]=mance metric e/abli%$ by !           
,adm9i/rator "u subsection 7d77#a7 bas$ 
on ! review by ! ,/ate ( risk &         
resili5ce assessm5ts pursuant to        
p>agraph 7#a77;,c74  7,b7 ,requirem5t ,a
 report submitt$ "u subp>agraph 7,a7    
%all n id5tify any specific public wat] 
sy/em & %all include only aggregations (

 data4  7#d7 ,te*nical assi/ance ,!     
,adm9i/rator %all1 on reque/ ( a public 
wat] sy/em1 provide guidance & te*nical 
assi/ance to ! public wat] sy/em )      
respect to-- 7,a7 implem5t+ any         
requirem5t "u ?is section or section    
#adcc2 &  7,b7 enhanc+ cyb]security     
resili5ce4  7c7 ,basel9e cyb]security   
/&>ds  7#a7 ,9 g5]al ,! ,adm9i/rator    
%all by rulemak+ e/abli% basel9e        
cyb]security /&>ds t %all s]ve z        
requirem5ts to provide = ! cyb]security 
resili5ce ( a public wat] sy/em4  7#b7  
,requirem5ts ,9 develop+ & e/abli%+ !   
basel9e cyb]security /&>ds "u p>agraph  
7#a71 ! ,adm9i/rator %all1 at a m9imum--
 7,a7 "w 9 conjunction ) ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy & ! ,director ( !      
,national ,in/itute ( ,/&>ds &          
,te*nology2  7,b7 develop ! basel9e     
cyb]security /&>ds 9 collaboration )    
public wat] sy/ems ( v>i\s sizes &      
capacities to ensure t fe$back f a      
v>iety ( public wat] sy/ems is consid]$ 

dur+ ! developm5t ( ! basel9e           
cyb]security /&>ds2  7,c7 ensure t be/  
practices & guidel9es t already exi/ 9 !
 wat] sector at ! "t ( ! developm5t ( ! 
basel9e cyb]security /&>ds in=m !       
developm5t ( ! basel9e cyb]security     
/&>ds2  7,d7 e/abli% a te*nical advisory
 committee to provide input ) respect   
to1 review1 & ref9e ! basel9e           
cyb]security /&>ds ?r\gh\t ! developm5t 
process1 :i* %all1 at a m9imum1         
include-- 7i7 repres5tatives f public   
wat] sy/ems ( v>i\s sizes2  7ii7        
pr(essional wat] associations2  7iii7   
cyb]security exp]ts2  7iv7 a            
repres5tative f a relevant volunt>y     
cons5sus /&>ds body1 z describ$ 9       
section #ab7;d77#a7 ( ! ,national       
,te*nology ,transf] & ,advancem5t ,act (
 #aiie 7#ae ,u4,s4,c4 #bgb note2 ,public
 ,law #ajd-aac72 &  7v7 a repres5tative 
f an in=mation te*nology or op]ational  
te*nology s]vice provid] t provides     
cyb]security s]vices to public wat]     
sy/ems2 &  7,e7 consult ) ! ,/ates4     

7#c7 ,consid]ation ( v>i$ capacity &    
risk ,9 develop+ ! basel9e cyb]security 
/&>ds "u p>agraph 7#a71 ! ,adm9i/rator--
  7,a7 %all ensure t ! basel9e          
cyb]security /&>ds acc\nt = ! v>i$      
capacity & risk ( all public wat]       
sy/ems2 &  7,b7 may e/abli% diff]5t     
basel9e cyb]security /&>ds = diff]5t    
categories ( public wat] sy/ems subject 
to assessm5ts "u subsection 7b7 bas$ on 
capacity or risk4  7d7 ,cyb]security    
p]=mance metrics  7#a7 ,e/abli%m5t (    
metrics  7,a7 ,9 g5]al ,n lat] ?an #b   
ye>s aft] ! date ( enactm5t ( ?is       
section1 ! ,adm9i/rator %all e/abli%    
cyb]security p]=mance metrics 7ref]r$ to
 9 ?is subsection z ! cyb]security      
p]=mance metrics7 to be us$ by !        
,adm9i/rator to measure or assess h[    
well ! sector ( public wat] sy/ems 9 !  
,unit$ ,/ates is mak+ progress on       
implem5t+ cyb]security be/ practices4   
7,b7 ,assessm5t2 report ,! ,adm9i/rator 
%all1 n less frequ5tly ?an once e #d    
ye>s--  7i7 assess ! sector ( public    

wat] sy/ems 9 ! ,unit$ ,/ates us+ !     
cyb]security p]=mance metrics2 &  7ii7  
submit to ,congress & make publicly     
available a report describ+1 on a       
g5]aliz$1 sector-wide basis1 ! /ate (   
public wat] sy/ems sector p]=mance us+ !
 assessm5t c>ri$ out "u clause 7i74     
7#b7 ,provision ( in=mation ,not)/&+ any
 o!r provision ( law1 a public wat]     
sy/em may1 at ! discretion ( ! public   
wat] sy/em & = ! purpose ( develop+     
sector-wide risk assessm5ts & p]=mance  
metrics to measure h[ public wat] sy/ems
 are mak+ progress 9 develop+ &         
implem5t+ cyb]security be/ practices1   
provide to ! ,adm9i/rator1 & !          
,adm9i/rator may accept1 in=mation t    
w\ld assi/ ! ,adm9i/rator 9 ! developm5t
 & ma9t5ance ( cyb]security p]=mance    
metrics4  7e7 ,en=cem5t2 ,/ate          
assumption ( duties  7#a7 ,9 g5]al ,?is 
section & section #adcc %all be en=c$ by
 ! ,adm9i/rator unless a ,/ate assumes  
prim>y en=cem5t responsibility pursuant 
to ?is subsection4  7#b7 ,application ,a

 ,/ate seek+ to assume prim>y en=cem5t  
responsibility pursuant to ?is          
subsection %all submit to ! ,adm9i/rator
 an application at su* "t1 9 su* mann]1 
& conta9+ su* in=mation z ! ,adm9i/rator
 may by regulation require4  7#c7       
,det]m9ation ,on receiv+ an application 
describ$ 9 p>agraph 7#b7 f a ,/ate1 !   
,adm9i/rator %all1 bas$ on t            
application1 det]m9e :e!r ! ,/ate--     
7,a7 has adopt$ & is implem5t+ adequate 
proc$ures = ! en=cem5t ( requirem5ts t  
are no less /r+5t ?an ^? "u ?is section 
& section #adcc2  7,b7 has adopt$       
au?ority & has suffici5t capacity to    
impose en=cem5t rem$ies 9 l9e ) ^?      
prescrib$ "u ?is title2  7,c7 has       
suffici5t capacity & p]sonnel )         
suffici5t exp]tise to p]=m cyb]security 
assessm5ts & conduct reviews ( risk &   
resili5ce assessm5ts & em]g5cy response 
plans "u section #adcc2 &  7,d7 has     
suffici5t security me*anisms 9 place to 
prev5t any unsanction$ disclosure or    
dissem9ation ( risk & resili5ce         

assessm5ts1 em]g5cy response plans1 &   
any o!r in=mation provid$ by a public   
wat] sy/em1 9 alignm5t ) ! protocols    
develop$ by ! ,adm9i/rator "u section   
#adcc7;c77#c77;,b77i74  7#d7 ,timel9e ,n
 lat] ?an #ahj days aft] ! date on :i* !
 ,adm9i/rator receives an application   
describ$ 9 p>agraph 7#b71 ! ,adm9i/rator
 %all-- 7,a7 if ! ,adm9i/rator det]m9es 
t ! ,/ate meets ea* requirem5t describ$ 
9 p>agraph 7#c71 grant ! application2 or
  7,b7 if ! ,adm9i/rator det]m9es t !   
,/ate fails to meet #a or m ( !         
requirem5ts describ$ 9 p>agraph 7#c71   
d5y ! application4  7#e7 ,revocation (  
prim>y en=cem5t responsibility ,!       
,adm9i/rator may1 z appropriate1 revoke 
an assumption ( prim>y en=cem5t         
responsibility pursuant to ?is          
subsection if ! ,adm9i/rator det]m9es t 
a ,/ate no long] meets #a or m          
requirem5ts describ$ 9 p>agraph 7#c74   
7#f7 ,regulations requir$ ,!            
,adm9i/rator %all promulgate regulations
 c>ry+ out ?is subsection n lat] ?an #a 

ye> aft] ! date ( enactm5t ( ?is        
section1 :i* %all include-- 7,a7 !      
requirem5ts = an application describ$ 9 
p>agraph 7#b72  7,b7 ! p]iod = :i* a    
,/ate may assume prim>y en=cem5t        
responsibility pursuant to ?is          
subsection be=e r5ewal2 &  7,c7 ! mann] 
by :i* ! ,adm9i/rator may revoke prim>y 
en=cem5t responsibility pursuant to     
p>agraph 7#e74  7#g7 ,sav+s provision   
,an assumption ( prim>y en=cem5t        
responsibility pursuant to ?is          
subsection %all be sep>ate f any        
au?ority assum$ "u section #adac4  4    
7b7 ,en=cem5t au?ority ,section         
#adad7;i77#a7 ( ! ,safe ,dr9k+ ,wat]    
,act 7#db ,u4,s4,c4 #cjj;g-#c7;i77#a77  
is am5d$ by ins]t+ #adcc;,a1 aft]       
#adcc14  7c7 ,records & inspections     
,section #adde7;b77#a7 ( ! ,safe ,dr9k+ 
,wat] ,act 7#db ,u4,s4,c4               
#cjj;j-#d7;b77#a77 is am5d$1 9 ! fir/   
s5t5ce-- 7#a7 by /rik+ or 7,c7 any &    
ins]t+ 7,c7 any2  7#b7 by ins]t+ or 7,d7
 a requirem5t to und]go an inspection "u

 section #adcc;,a7a77#b77;,d71 aft]     
subsection 7a712 &  7#c7 by /rik+ or    
7,c71 is & ins]t+ 7,c71 or 7,d71 is4    
7d7 ,con=m+ am5dm5t ,section #adac7;a7 (
 ! ,safe ,dr9k+ ,wat] ,act 7#db         
,u4,s4,c4 #cjj;g-#b7;a77 is am5d$1 9 !  
matt] prec$+ p>agraph 7#a71 by ins]t+   
7except = sections #adcc & #adcc;,a7    
aft] ?is title4  #ajc4 ,dr9k+ wat]      
security assi/ance  7a7 ,au?orization ( 
appropriations ,9 addition to any am\nts
 au?oriz$ to be appropriat$ "u section  
#adeb7m7 ( ! ,safe ,dr9k+ ,wat] ,act    
7#db ,u4,s4,c4 #cjj;j-#ab7m771 !re is   
au?oriz$ to be appropriat$ #cjj1jjj1jjj 
= ea* ( fiscal ye>s #bjbg ?r\gh #bjcb = 
! purposes ( help+ public wat] sy/ems 7z
 def9$ 9 section #adja ( t ,act 7#db    
,u4,s4,c4 #cjj;f77 build cyb]security   
resili5ce 7z def9$ 9 section            
#adcc;,a7a77#a7 ( ! ,safe ,dr9k+ ,wat]  
,act7 & id5tify+ & mitigat+ cyb]security
 vuln]abilities1 includ+ ^? includ$ 9   
risk & resili5ce assessm5ts & em]g5cy   
response plans prep>$ pursuant to       

section #adcc ( t ,act 7#db ,u4,s4,c4   
#cjj;i-#b74  7b7 ,guidance ,!           
,adm9i/rator ( ! ,environm5tal          
,protection ,ag5cy may issue guidance to
 det]m9e specific crit]ia = eligible    
uses ( ! am\nts made available "u       
subsection 7a7 t fur!r ! purposes       
describ$ 9 t subsection4  7c7           
,prioritization ,9 us+ am\nts made      
available pursuant to subsection 7a71 a 
,/ate %all prioritize provid+ assi/ance 
to public wat] sy/ems 7z def9$ 9 section
 #adja ( ! ,safe ,dr9k+ ,wat] ,act 7#db 
,u4,s4,c4 #cjj;f77 t h ! greate/ ne$ )  
respect to capacity1 work=ce1 exp]tise1 
or res\rces to adequately address       
cyb]security vuln]abilities4  7d7       
,rollov] ,to ! ext5t t any am\nts       
au?oriz$ to be appropriat$ "u subsection
 7a7 9 a fiscal ye> are n appropriat$ 9 
t fiscal ye>1 ! am\nts are au?oriz$ to  
be appropriat$ 9 a subsequ5t fiscal ye>1
 & %all rema9 available until exp5d$4   
,,ii ,clean wat] infra/ructure  #bja4   
,treatm5t works risk & resili5ce  7a7 ,9

 g5]al ,title ,,ii ( ! ,f$]al ,wat]     
,pollution ,control ,act 7#cc ,u4,s4,c4 
#abha et seq47 is am5d$ by add+ at ! end
 ! foll[+3  #bbh4 ,treatm5t works risk &
 resili5ce  7a7 ,def9itions ,9 ?is      
section3 7#a7 ,cov]$ treatm5t works ,!  
t]m cov]$ treatm5t works means a        
treatm5t works t--  7,a7 treats dome/ic 
sewage2  7,b7 s]ves m ?an #aj1jjj       
p]sons2 &  7,c7 has a design fl[ rate ( 
#a1jjj1jjj gallons or m4  7#b7 ,natural 
haz>d ,! t]m natural haz>d means a      
natural ev5t t ?reat5s ! function+ ( a  
treatm5t works1 includ+ an e>?quake1    
tornado1 flood1 hurricane1 wildfire1 &  
hydrologic *anges4  7#c7 ,resili5ce ,!  
t]m resili5ce means ! ability ( a       
treatm5t works or an asset ( a treatm5t 
works to adapt to1 or )/& ! effects (1 a
 malevol5t act or natural haz>d )\t     
int]ruption to ! function ( ! treatm5t  
works or asset or1 if ! function is     
int]rupt$1 to rapidly return to a normal
 op]at+ condition4  7#d7 ,/ate  7,a7 ,9 
g5]al ,! t]m ,/ate means a ,/ate t has  

assum$ prim>y en=cem5t responsibility   
pursuant to section #bbi7;e74  7,b7     
,en=cem5t by ! ,adm9i/rator ,if a ,/ate 
has n assum$ prim>y en=cem5t            
responsibility pursuant to section      
#bbi7;e71 ! t]m ,/ate %all1 = purposes (
 obligations ( ! ,/ate "u ?is           
subsection1 be consid]$ to be a ref]5ce 
to ! ,adm9i/rator4  7b7 ,risk &         
resili5ce assessm5ts  7#a7 ,9 g5]al ,ea*
 cov]$ treatm5t works %all conduct an   
assessm5t ( ! risks to1 & resili5ce (1 !
 cov]$ treatm5t works4  7#b7            
,requirem5ts ,an assessm5t "u p>agraph  
7#a7-- 7,a7 %all include an assessm5t   
(--  7i7 ! risk to ! cov]$ treatm5t     
works f malevol5t acts & natural haz>ds2
  7ii7 ! resili5ce ( collection sy/ems1 
pipes & con/ruct$ conveyances1 physical 
b>ri]s1 treatm5t1 & /orage1 dis*>ge1 &  
reuse facilities t are utiliz$ by !     
cov]$ treatm5t works2  7iii7 ! monitor+ 
practices ( ! cov]$ treatm5t works2     
7iv7 ! f9ancial infra/ructure ( ! cov]$ 
treatm5t works2  7v7 ! use1 /orage1 or  

h&l+ ( v>i\s *emicals by ! cov]$        
treatm5t works2  7vi7 ! op]ation &      
ma9t5ance ( ! cov]$ treatm5t works2 &   
7vii7 us+ a me?od approv$ by !          
applicable ,/ate1 ! risks to electronic1
 comput]1 or o!r automat$ sy/ems = !    
purpose ( id5tify+ significant          
cyb]security risks t h ! pot5tial to    
cause ! impacts describ$ 9 subp>agraph  
7,a7 or 7,b7 ( p>agraph 7#c72 &  7,b7   
may include an evaluation ( capital &   
op]ational ne$s = risk & resili5ce      
managem5t = ! cov]$ treatm5t works4     
7#c7 ,basel9e in=mation ,! ,adm9i/rator1
 n lat] ?an #a ye> aft] ! date (        
enactm5t ( ?is section1 aft]            
consultation ) appropriate dep>tm5ts &  
ag5cies ( ! ,f$]al ,gov]nm5t & ) ,/ate &
 local gov]nm5ts1 %all provide basel9e  
in=mation on malevol5t acts ( relevance 
to cov]$ treatm5t works1 :i* %all       
include consid]ation ( acts t may-- 7,a7
 sub/antially disrupt ! ability ( a     
cov]$ treatm5t works to provide safe &  
reliable collection1 /orage1 treatm5t1  

recycl+1 & reclamation ( municipal      
sewage or indu/rial wa/es2 or  7,b7     
o!rwise pres5t significant public heal? 
or economic conc]ns to ! community s]v$ 
by a cov]$ treatm5t works4  7#d7 ,review
 & revision  7,a7 ,9 g5]al ,ea* cov]$   
treatm5t works %all1 n less frequ5tly   
?an once e #e ye>s1 review &1 if        
necess>y1 revise ! assessm5t4  7,b7     
,c]tification to ! ,adm9i/rator or ,/ate
 ,on completion ( ! review "u           
subp>agraph 7,a71 a cov]$ treatm5t works
 %all submit to ! applicable ,/ate a    
c]tification t ! cov]$ treatm5t works   
has review$ &1 if applicable1 revis$ !  
assessm5t4  7c7 ,em]g5cy response plan  
7#a7 ,9 g5]al ,ea* cov]$ treatm5t works 
%all prep>e an em]g5cy response plan t  
incorporates f9d+s ( ! assessm5t        
conduct$ "u subsection 7b7 = t cov]$    
treatm5t works 7or any revisions to t   
assessm5t74  7#b7 ,requir$ inclusions ,!
 em]g5cy response plan ( a cov]$        
treatm5t works "u p>agraph 7#a7 %all    
include-- 7,a7 /rategies & res\rces to  

improve ! resili5ce ( ! cov]$ treatm5t  
works1 includ+ ! physical security ( !  
cov]$ treatm5t works2  7,b7 plans &     
proc$ures t c be implem5t$1 &           
id5tification ( equipm5t t c be utiliz$1
 9 ! ev5t ( a malevol5t act or natural  
haz>d t ?reat5s ! ability ( ! cov]$     
treatm5t works to collect1 /ore1 treat1 
recycle1 & reclaim municipal sewage or  
indu/rial wa/es2  7,c7 actions1         
proc$ures1 & equipm5t t c obviate or    
significantly less5 ! impact ( a        
malevol5t act or natural haz>d on !     
public heal? & ! collection1 /orage1    
treatm5t1 recycl+1 & reclamation (      
municipal sewage or indu/rial wa/es2    
7,d7 /rategies t c be us$ to aid 9 !    
detection ( malevol5t acts or natural   
haz>ds t ?reat5 ! security or resili5ce 
( ! cov]$ treatm5t works2 &  7,e7       
c\nt]measures t ! cov]$ treatm5t works  
int5ds to adopt or1 if already 9 use1   
ma9ta9 to mitigate ! significant        
cyb]security risks id5tifi$ "u          
subsection 7b77#b77;,a77vii71 includ+ a 

s*$ule ! cov]$ treatm5t works int5ds to 
foll[ to adopt any c\nt]measures n      
already 9 use by ! cov]$ treatm5t works4
  7#c7 ,revision ,a cov]$ treatm5t works
 %all review &1 z necess>y1 revise !    
em]g5cy response plan prep>$ "u ?is     
subsection n less frequ5tly ?an once e  
#e ye>s4  7d7 ,submission & approval (  
assessm5ts & plans  7#a7 ,submission    
7,a7 ,9 g5]al ,beg9n+ n lat] ?an #a ye> 
aft] ! date on :i* ! ,adm9i/rator       
provides basel9e in=mation "u subsection
 7b77#c71 ea* cov]$ treatm5t works %all1
 dur+ a cyb]security assessm5t pursuant 
to section #bbi7;b77#b77;,a71 provide to
 ! applicable ,/ate--  7i7 ! portion ( !
 assessm5t prep>$ "u subsection 7b7 t is
 describ$ 9 p>agraph 7#b77;,a77vii7 ( t 
subsection 7includ+ any revision to t   
portion ( ! assessm5t72 &  7ii7 !       
portion ( ! em]g5cy response plan prep>$
 "u subsection 7c7 t is describ$ 9      
p>agraph 7#b77;,e7 ( t subsection       
7includ+ any revision to t portion ( !  
em]g5cy response plan74  7,b7           

,limitation ,nei!r ! ,adm9i/rator nor a 
,/ate may require ! submission ( any    
portion ( an assessm5t "u subsection 7a7
 or an em]g5cy response plan "u         
subsection 7b7 t is n describ$ 9        
subp>agraph 7,a74  7#b7 ,review2        
approval  7,a7 ,9 g5]al ,a ,/ate %all-- 
7i7 review ! portions ( ! assessm5ts &  
em]g5cy response plans ( cov]$ treatm5t 
works submitt$ pursuant to p>agraph     
7#a77;,a7 = con=mity ) ! requirem5ts (  
?is section & section #bbi2 &  7ii7 7,i7
 approve ( ! portions ( an assessm5t &  
em]g5cy response plan submitt$ pursuant 
to p>agraph 7#a77;,a72 or  7,,ii7       
disapprove ( ! portions ( an assessm5t  
or em]g5cy response plan submitt$       
pursuant to p>agraph 7#a77;,a7 if !     
,adm9i/rator or ! ,/ate1 z applicable1  
det]m9es t-- 7aa7 ! submitt$ portions ( 
! assessm5t or em]g5cy response plan are
 miss+1 incomplete1 or fail to con=m ) !
 requirem5ts ( ?is section2 or  7bb7 !  
submitt$ portions ( ! assessm5t or      
em]g5cy response plan fail to provide = 

cyb]security resili5ce 9 accordance ) ! 
basel9e cyb]security /&>ds e/abli%$ by !
 ,adm9i/rator "u section #bbi7;c74  7,b7
 ,en=cem5t ,a ,/ate may use appropriate 
en=cem5t me*anisms "u ?is ,act or !     
appropriate ,/ate au?ority to rem$y     
noncompliance1 z describ$ 9 items 7aa7 &
 7bb7 ( subp>agraph 7,a77ii77,,ii71 "u  
?is subsection4  7#c7 ,submitt$         
docum5tation  7,a7 ,applicability (     
,,foia ,any in=mation submitt$ "u ?is   
subsection %all be exempt f disclosure  
"u section #eeb7;b77#c7 ( title #e1     
,unit$ ,/ates ,code 7commonly kn[n z !  
,fre$om ( ,in=mation ,act71 & any       
provision ( ,/ate1 ,tribal1 or local    
fre$om ( in=mation law1 op5 gov]nm5t    
law1 op5 meet+s law1 op5 records law1   
sun%9e law1 or simil> law requir+       
disclosure ( in=mation or records4  7,b7
 ,treatm5t ( docum5tation  7i7 ,protocol
 developm5t ,n lat] ?an #ahj days aft] !
 date ( enactm5t ( ! ,wat] ,cyb] ,%ield 
,act ( #bjbf & be=e any cyb]security    
assessm5ts are c>ri$ out pursuant to    

section #bbi7;b77#b77;,a71 !            
,adm9i/rator1 9 consultation )          
appropriate ,f$]al law en=cem5t &       
intellig5ce (ficials1 %all develop su*  
protocols z are necess>y to protect any 
in=mation provid$ "u p>agraph 7#a77;,a7 
to ! ,/ate4  7ii7 ,requirem5ts =        
protocol ,! protocol develop$ "u clause 
7i7 %all ensure t-- 7,i7 ea* copy ( !   
portions ( an assessm5t & em]g5cy       
response plan submitt$ pursuant to      
p>agraph 7#a77;,a7 are kept 9 a secure  
location2  7,,ii7 only individuals      
designat$ by ! applicable ,/ate may h   
access to copies ( ! portions ( !       
assessm5t & em]g5cy response plan       
submitt$ pursuant to p>agraph 7#a77;,a72
 &  7,,iii7 no copy ( ! portions ( !    
assessm5t & em]g5cy response plan       
submitt$ pursuant to p>agraph 7#a77;,a7 
%all be made available to anyone o!r ?an
 an individual designat$ by ! applicable
 ,/ate4  7iii7 ,sav+s provision ,no?+ 9 
?is subp>agraph au?orizes any p]son to  
)hold any in=mation f ,congress or f a  

committee or subcommittee ( ,congress4  
7#d7 ,applicability ( ,,foia ,any f9d+s 
or plans 7includ+ revisions & any relat$
 ag5cy records & in=mation t is         
designat$ z ,dep>tm5t ( ,def5se critical
 infra/ructure security in=mation "u    
section #acj;e7b7 ( title #aj1 ,unit$   
,/ates ,code7 submitt$ "u ?is subsection
 %all be exempt f disclosure "u section 
#eeb7;b77#c7 ( title #e1 ,unit$ ,/ates  
,code 7commonly kn[n z ! ,fre$om (      
,in=mation ,act71 & any provision (     
,/ate1 ,tribal1 or local fre$om (       
in=mation law1 op5 gov]nm5t law1 op5    
meet+s law1 op5 records law1 sun%9e law1
 or simil> law requir+ disclosure (     
in=mation or records4  7e7 ,coord9ation 
,a cov]$ treatm5t works %all1 to ! ext5t
 practicable1 coord9ate ) exi/+ local   
plann+ committees e/abli%$ pursuant to !
 ,em]g5cy ,plann+ & ,community          
,"r-,to-,"k ,act ( #aihf 7#db ,u4,s4,c4 
#aajja et seq47 :5 prep>+ or revis+ an  
assessm5t or em]g5cy response plan "u   
?is section4  7f7 ,record ma9t5ance ,ea*

 cov]$ treatm5t works %all ma9ta9 a copy
 ( ! assessm5t conduct$ "u subsection   
7b7 & ! em]g5cy response plan prep>$ "u 
subsection 7c7 7includ+ any revis$      
assessm5t or plan7 = #e ye>s aft] ! date
 on :i* t assessm5t or plan is approv$  
by ! applicable ,/ate "u ?is section4   
7g7 ,guidance to small treatm5t works ,!
 ,adm9i/rator %all provide guidance &   
te*nical assi/ance to treatm5t works t  
are n cov]$ treatm5t works on h[ to     
conduct resili5ce assessm5ts1 prep>e    
em]g5cy response plans1 & address ?reats
 f malevol5t acts & natural haz>ds t    
?reat5 to disrupt ! collection1 /orage1 
treatm5t1 recycl+1 & reclamation (      
municipal sewage or indu/rial wa/es or  
significantly affect ! public heal?4  4 
7b7 ,f$]al en=cem5t ,section #cji ( !   
,f$]al ,wat] ,pollution ,control ,act   
7#cc ,u4,s4,c4 #acai7 is am5d$ 9 ea* (  
subsections 7a71 7c71 7d71 & 7g7 by     
ins]t+ #bbh7;d71 be=e #cja1 ea* place x 
appe>s4  #bjb4 ,cyb]security requirem5ts
 = treatm5t works  7a7 ,9 g5]al ,title  

,,ii ( ! ,f$]al ,wat] ,pollution        
,control ,act 7#cc ,u4,s4,c4 #abha et   
seq47 7z am5d$ by section #bja7;a77 is  
am5d$ by add+ at ! end ! foll[+3  #bbi4 
,cyb]security requirem5ts  7a7          
,def9itions ,9 ?is section3  7#a7 ,cov]$
 treatm5t works ,! t]m cov]$ treatm5t   
works has ! mean+ giv5 ! t]m 9 section  
#bbh7;a74  7#b7 ,cyb]security incid5t ,!
 t]m cyb]security incid5t means a       
malici\s act or suspici\s ev5t t        
disrupts1 or attempts to disrupt1 !     
op]ation ( programmable electronic      
devices & communication networks1       
includ+ h>dw>e1 s(tw>e1 & data t are    
ess5tial to ! cyb]security resili5ce ( a
 treatm5t works4  7#c7 ,cyb]security    
resili5ce ,! t]m cyb]security resili5ce 
means ! ability ( a treatm5t works to   
adapt to or )/& ! effects ( a           
cyb]security incid5t )\t int]ruption to 
! treatm5t works's function1 or if !    
function is int]rupt$1 to rapidly return
 to a normal op]at+ condition4  7#d7    
,/ate  7,a7 ,9 g5]al ,except =          

subsection 7e71 ! t]m ,/ate means a     
,/ate t has assum$ prim>y en=cem5t      
responsibility pursuant to subsection   
7e74  7,b7 ,en=cem5t by ! ,adm9i/rator  
,if a ,/ate has n assum$ prim>y en=cem5t
 responsibility pursuant to subsection  
7e71 ! t]m ,/ate %all1 = purposes (     
obligations ( ! ,/ate "u ?is section    
7except = subsection 7e771 be consid]$  
to be a ref]5ce to ! ,adm9i/rator4  7b7 
,cyb]security assessm5ts  7#a7          
,assessm5ts requir$  7,a7 ,9 g5]al ,a   
,/ate %all c>ry out cyb]security        
assessm5ts ( a cov]$ treatm5t works 9   
accordance ) ?is p>agraph4  7,b7        
,evaluation ( adequacy ,= a cov]$       
treatm5t works subject to a cyb]security
 assessm5t "u subp>agraph 7,a71 if !    
cov]$ treatm5t works uses op]ational    
te*nology1 ! ,/ate %all evaluate !      
adequacy ( ! cyb]security ( ! op]ational
 te*nology1 & in=mation & communications
 te*nology t is connect$ to ! op]ational
 te*nology1 aga9/ ! basel9e cyb]security
 /&>ds promulgat$ by ! ,adm9i/rator "u  

subsection 7c74  7,c7 ,review (         
assessm5ts & plans ,9 c>ry+ out a       
cyb]security assessm5t requir$ "u       
subp>agraph 7,a71 a cov]$ treatm5t works
 %all provide1 & ! ,/ate %all review1 ! 
portions ( ! risk & resili5ce assessm5ts
 ( ! cov]$ treatm5t works "u section    
#bbh7;b7 & ! em]g5cy response plans ( ! 
cov]$ treatm5t works "u section #bbh7;c7
 submitt$ "u section #bbh7;d77#a77;,a74 
7,d7 ,inspections ,9 c>ry+ out          
cyb]security assessm5ts "u ?is p>agraph1
 a ,/ate %all c>ry out inspections ( a  
repres5tative sample ( cov]$ treatm5t   
works ea* ye>1 :i* sampl+ %all be in=m$ 
by risk-bas$ consid]ations1 subject to !
 condition t ! scope ( ! inspection is  
limit$ to ! sy/ems ( ! cov]$ treatm5t   
works necess>y to meet ! requirem5ts (  
?is p>agraph4  7#b7 ,violations ,if a   
,/ate id5tifies a violation ( ! basel9e 
cyb]security /&>ds e/abli%$ by !        
,adm9i/rator "u subsection 7c7 :ile     
conduct+ an assessm5t "u p>agraph 7#c71 
! ,/ate %all take appropriate /eps to   

ensure t ! cov]$ treatm5t works         
addresses ! violation & use me*anisms1  
includ+ en=cem5t1 to correct ^?         
violations4  7#c7 ,submission to ,,epa  
7,a7 ,9 g5]al ,a ,/ate %all annually    
submit to ! ,adm9i/rator a report t     
summ>izes ! p]=mance ( ! cov]$ treatm5t 
works ( ! ,/ate = ea* cyb]security      
p]=mance metric e/abli%$ by !           
,adm9i/rator "u subsection 7d77#a7 bas$ 
on ! review by ! ,/ate ( risk &         
resili5ce assessm5ts pursuant to        
p>agraph 7#a77;,c74  7,b7 ,requirem5t ,a
 report submitt$ "u subp>agraph 7,a7    
%all n id5tify any specific treatm5t    
works & %all include only aggregations (
 data4  7#d7 ,te*nical assi/ance ,!     
,adm9i/rator %all1 on reque/ ( a cov]$  
treatm5t works1 provide guidance &      
te*nical assi/ance to ! cov]$ treatm5t  
works ) respect to-- 7,a7 implem5t+ any 
requirem5t "u ?is section or section    
#bbh2 &  7,b7 enhanc+ cyb]security      
resili5ce4  7c7 ,basel9e cyb]security   
/&>ds  7#a7 ,9 g5]al ,! ,adm9i/rator    

%all by rulemak+ e/abli% basel9e        
cyb]security /&>ds t %all s]ve z        
requirem5ts to provide = ! cyb]security 
resili5ce ( a cov]$ treatm5t works4     
7#b7 ,requirem5ts ,9 develop+ & e/abli%+
 ! basel9e cyb]security /&>ds "u        
p>agraph 7#a71 ! ,adm9i/rator %all1 at a
 m9imum-- 7,a7 "w 9 conjunction ) !     
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy & !     
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology2  7,b7 develop !    
basel9e cyb]security /&>ds 9            
collaboration ) cov]$ treatm5t works (  
v>i\s sizes & capacities to ensure t    
fe$back f a v>iety ( cov]$ treatm5t     
works is consid]$ dur+ ! developm5t ( ! 
basel9e cyb]security /&>ds2  7,c7 ensure
 t be/ practices & guidel9es t already  
exi/ 9 ! wat] sector at ! "t ( !        
developm5t ( ! basel9e cyb]security     
/&>ds in=m ! developm5t ( ! basel9e     
cyb]security /&>ds2  7,d7 e/abli% a     
te*nical advisory committee to provide  
input ) respect to1 review1 & ref9e !   

basel9e cyb]security /&>ds ?r\gh\t !    
developm5t process1 :i* %all1 at a      
m9imum1 include-- 7i7 repres5tatives f  
cov]$ treatm5t works ( v>i\s sizes2     
7ii7 pr(essional wat] associations2     
7iii7 cyb]security exp]ts2  7iv7 a      
repres5tative f a relevant volunt>y     
cons5sus /&>ds body1 z describ$ 9       
section #ab7;d77#a7 ( ! ,national       
,te*nology ,transf] & ,advancem5t ,act (
 #aiie 7#ae ,u4,s4,c4 #bgb note2 ,public
 ,law #ajd-aac72 &  7v7 a repres5tative 
f an in=mation te*nology or op]ational  
te*nology s]vice provid] t provides     
cyb]security s]vices to cov]$ treatm5t  
works2 &  7,e7 consult ) ! ,/ates4  7#c7
 ,consid]ation ( v>i$ capacity & risk ,9
 develop+ ! basel9e cyb]security /&>ds  
"u p>agraph 7#a71 ! ,adm9i/rator--  7,a7
 %all ensure t ! basel9e cyb]security   
/&>ds acc\nt = ! v>i$ capacity & risk ( 
all cov]$ treatm5t works2 &  7,b7 may   
e/abli% diff]5t basel9e cyb]security    
/&>ds = diff]5t categories ( treatm5t   
works subject to assessm5ts "u          

subsection 7b7 bas$ on capacity or risk4
  7d7 ,cyb]security p]=mance metrics    
7#a7 ,e/abli%m5t ( metrics  7,a7 ,9     
g5]al ,n lat] ?an #b ye>s aft] ! date ( 
enactm5t ( ?is section1 ! ,adm9i/rator  
%all e/abli% cyb]security p]=mance      
metrics 7ref]r$ to 9 ?is subsection z ! 
cyb]security p]=mance metrics7 to be us$
 by ! ,adm9i/rator to measure or assess 
h[ well ! sector ( treatm5t works 9 !   
,unit$ ,/ates is mak+ progress on       
implem5t+ cyb]security be/ practices4   
7,b7 ,assessm5t2 report ,! ,adm9i/rator 
%all1 n less frequ5tly ?an once e #d    
ye>s--  7i7 assess ! sector ( treatm5t  
works 9 ! ,unit$ ,/ates us+ cyb]security
 p]=mance metrics2 &  7ii7 submit to    
,congress & make publicly available a   
report describ+1 on a g5]aliz$1         
sector-wide basis1 ! /ate ( treatm5t    
works sector p]=mance us+ ! assessm5t   
c>ri$ out "u clause 7i74  7#b7          
,provision ( in=mation ,not)/&+ any o!r 
provision ( law1 a treatm5t works may1  
at ! discretion ( ! treatm5t works & = !

 purpose ( develop+ sector-wide risk    
assessm5ts & p]=mance metrics to measure
 h[ treatm5t works are mak+ progress 9  
develop+ & implem5t+ cyb]security be/   
practices1 provide to ! ,adm9i/rator1 & 
! ,adm9i/rator may accept1 in=mation t  
w\ld assi/ ! ,adm9i/rator 9 ! developm5t
 & ma9t5ance ( cyb]security p]=mance    
metrics4  7e7 ,en=cem5t2 /ate assumption
 ( duties  7#a7 ,9 g5]al ,?is section & 
section #bbh %all be en=c$ by !         
,adm9i/rator unless a ,/ate assumes     
prim>y en=cem5t responsibility pursuant 
to ?is subsection4  7#b7 ,application ,a
 ,/ate seek+ to assume prim>y en=cem5t  
responsibility pursuant to ?is          
subsection %all submit to ! ,adm9i/rator
 an application at su* "t1 9 su* mann]1 
& conta9+ su* in=mation z ! ,adm9i/rator
 may by regulation require4  7#c7       
,det]m9ation ,on receiv+ an application 
describ$ 9 p>agraph 7#b7 f a ,/ate1 !   
,adm9i/rator %all1 bas$ on t            
application1 det]m9e :e!r ! ,/ate--     
7,a7 has adopt$ & is implem5t+ adequate 

proc$ures = ! en=cem5t ( requirem5ts t  
are no less /r+5t ?an ^? "u ?is section 
& section #bbh2  7,b7 has adopt$        
au?ority & has suffici5t capacity to    
impose en=cem5t rem$ies 9 l9e ) ^?      
prescrib$ "u ?is title2  7,c7 has       
suffici5t capacity & p]sonnel )         
suffici5t exp]tise to p]=m cyb]security 
assessm5ts & conduct reviews ( risk &   
resili5ce assessm5ts & em]g5cy response 
plans "u section #bbh2 &  7,d7 has      
suffici5t security me*anisms 9 place to 
prev5t any unsanction$ disclosure or    
dissem9ation ( risk & resili5ce         
assessm5ts1 em]g5cy response plans1 &   
any o!r in=mation provid$ by a cov]$    
treatm5t works1 9 alignm5t ) ! protocols
 develop$ by ! ,adm9i/rator "u section  
#bbh7;d77#c77;,b77i74  7#d7 ,timel9e ,n 
lat] ?an #ahj days aft] ! date on :i* ! 
,adm9i/rator receives an application    
describ$ 9 p>agraph 7#b71 ! ,adm9i/rator
 %all-- 7,a7 if ! ,adm9i/rator det]m9es 
t ! ,/ate meets ea* requirem5t describ$ 
9 p>agraph 7#c71 grant ! application2 or

  7,b7 if ! ,adm9i/rator det]m9es t !   
,/ate fails to meet #a or m ( !         
requirem5ts describ$ 9 p>agraph 7#c71   
d5y ! application4  7#e7 ,revocation (  
prim>y en=cem5t responsibility ,!       
,adm9i/rator may1 z appropriate1 revoke 
an assumption ( prim>y en=cem5t         
responsibility pursuant to ?is          
subsection if ! ,adm9i/rator det]m9es t 
a ,/ate no long] meets #a or m          
requirem5ts describ$ 9 p>agraph 7#c74   
7#f7 ,regulations requir$ ,!            
,adm9i/rator %all promulgate regulations
 c>ry+ out ?is subsection n lat] ?an #a 
ye> aft] ! date ( enactm5t ( ?is        
section1 :i* %all include-- 7,a7 !      
requirem5ts = an application describ$ 9 
p>agraph 7#b72  7,b7 ! p]iod = :i* a    
,/ate may assume prim>y en=cem5t        
responsibility pursuant to ?is          
subsection be=e r5ewal2 &  7,c7 ! mann] 
by :i* ! ,adm9i/rator may revoke prim>y 
en=cem5t responsibility pursuant to     
p>agraph 7#e74  7#g7 ,sav+s provision   
,an assumption ( prim>y en=cem5t        

responsibility pursuant to ?is          
subsection %all be sep>ate f any        
responsibility o!rwise assum$ "u ?is    
,act4  4  7b7 ,inspections ,section     
#cjh7;a7 ( ! ,f$]al ,wat] ,pollution    
,control ,act 7#cc ,u4,s4,c4 #acah7;a77 
is am5d$1 9 ! matt] prec$+ subp>agraph  
7,a7--  7#a7 by /rik+ or 7#d7 c>ry+ &   
ins]t+ 7#d7 c>ry+2 &  7#b7 by /rik+ #ejd
 ( ?is ,act-- & ins]t+ #ejd2 or 7#e7    
c>ry+ out requirem5ts "u section #bbi--4
  7c7 ,f$]al en=cem5t ,section #cji ( ! 
,f$]al ,wat] ,pollution ,control ,act   
7#cc ,u4,s4,c4 #acai7 7z am5d$ by       
section #bja7;b77 is am5d$ 9 ea* (      
subsections 7a71 7c71 7d71 & 7g7 by     
ins]t+ #bbi1 be=e #cja1 ea* place x     
appe>s4  #bjc4 ,clean wat] security     
assi/ance  7a7 ,au?orization (          
appropriations ,9 addition to any am\nts
 au?oriz$ to be appropriat$ "u section  
#fjg ( ! ,f$]al ,wat] ,pollution        
,control ,act 7#cc ,u4,s4,c4 #achg71 !re
 is au?oriz$ to be appropriat$          
#cjj1jjj1jjj = ea* ( fiscal ye>s #bjbg  

?r\gh #bjcb = ! purposes ( help+        
treatm5t works 7z def9$ 9 section #bab (
 t ,act 7#cc ,u4,s4,c4 #abib77 build    
cyb]security resili5ce 7z def9$ 9       
section #bbi ( ! ,f$]al ,wat] ,pollution
 ,control ,act7 & id5tify+ & mitigat+   
cyb]security vuln]abilities1 includ+ ^? 
includ$ 9 risk & resili5ce assessm5ts & 
em]g5cy response plans prep>$ pursuant  
to section #bbh ( t ,act4  7b7 ,guidance
 ,! ,adm9i/rator ( ! ,environm5tal      
,protection ,ag5cy may issue guidance to
 det]m9e specific crit]ia = eligible    
uses ( ! am\nts made available "u       
subsection 7a7 t fur!r ! purposes       
describ$ 9 t subsection4  7c7           
,prioritization ,9 us+ am\nts made      
available pursuant to subsection 7a71 a 
,/ate %all prioritize provid+ assi/ance 
to treatm5t works 7z def9$ 9 section    
#bab ( ! ,f$]al ,wat] ,pollution        
,control ,act 7#cc ,u4,s4,c4 #abib77 t h
 ! greate/ ne$ ) respect to capacity1   
work=ce1 exp]tise1 or res\rces to       
adequately address cyb]security         

vuln]abilities4  7d7 ,rollov] ,to !     
ext5t t any am\nts au?oriz$ to be       
appropriat$ "u subsection 7a7 9 a fiscal
 ye> are n appropriat$ 9 t fiscal ye>1 !
 am\nts are au?oriz$ to be appropriat$ 9
 a subsequ5t fiscal ye>1 & %all rema9   
available until exp5d$4  ,,iii ,cyb]    
incid5t report+ obligations  #cja4 ,cyb]
 incid5t report+ ,subtitle ,d ( title   
,,xxii ( ! ,homel& ,security ,act (     
#bjjb 7#f ,u4,s4,c4 #fha et seq47 is    
am5d$--  7#a7 9 section #bbdj 7#f       
,u4,s4,c4 #fha71 by /rik+ p>agraph 7#d7 
& ins]t+ ! foll[+3  7#d7 ,cov]$ entity  
,! t]m cov]$ entity--  7,a7 means an    
entity 9 a critical infra/ructure       
sector1 z def9$ 9 ,presid5tial ,policy  
,directive #ba1 t satisfies ! def9ition 
e/abli%$ by ! ,director 9 ! f9al rule   
issu$ pursuant to section #bbdb7;b72 &  
7,b7 includes--  7i7 a community wat]   
sy/em 7z def9$ 9 section #adja ( ! ,safe
 ,dr9k+ ,wat] ,act 7#db ,u4,s4,c4       
#cjj;f77 t s]ves a population ( great]  
?an #c1cjj p]sons2 &  7ii7 a cov]$      

treatm5t works 7z def9$ 9 section       
#bbh7;a7 ( ! ,f$]al ,wat] ,pollution    
,control ,act74  2  7#b7 9 section      
#bbdb7;a7 7#f ,u4,s4,c4 #fha;b7a771 by  
add+ at ! end ! foll[+3  7#h7           
,transmission to ,,epa ,! ,ag5cy %all   
submit to ! ,adm9i/rator ( !            
,environm5tal ,protection ,ag5cy a copy 
( ea* report submitt$ to ! ,ag5cy "u    
p>agraph 7#a71 7#b71 or 7#c74  2 &  7#c7
 9 section #bbdd7;f7 7#f ,u4,s4,c4      
#fha;d7f77-- 7,a7 by /rik+ ,?is section 
& ins]t+ ! foll[+3  7#a7 ,9 g5]al       
,except z provid$ 9 p>agraph 7#b71 ?is  
section  2 &  7,b7 by add+ at ! end !   
foll[+3  7#b7 ,exception ,?is section   
%all apply to a ,/ate1 local1 ,tribal1  
or t]ritorial gov]nm5t entity t is      
requir$ to submit a report "u section   
#bbdb7;a7 ) respect to a community wat] 
sy/em or cov]$ treatm5t works1 z def9$ 9
 clauses 7i7 & 7ii71 respectively1 (    
section #bbdj7d77;,b71 t is own$ or     
op]at$ by ! ,/ate1 local1 ,tribal or    
t]ritorial gov]nm5t entity4  4