US Federal House Bill HB2594

US Federal 2025-2026 Regular Session

• Introduced: 4/2/25
• Refer: 4/2/25

Caption

To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector.

Summary

HB2594 would create a new nonprofit-style entity called the Water Risk and Resilience Organization (WRRO) to develop cybersecurity risk and resilience requirements for certain larger water systems. The bill applies to community water systems and treatment works serving 3,300 or more people, and directs the Environmental Protection Agency Administrator to issue implementing regulations within 270 days and certify no more than one WRRO. The WRRO would be responsible for proposing cybersecurity standards, implementation schedules, monitoring compliance, and reporting on effectiveness. The bill defines cybersecurity resilience broadly to include the ability to withstand, adapt to, and recover from cyber incidents affecting water-system operations. It also sets up a process for EPA review and approval of proposed requirements, including remands, revisions, and conflict-resolution procedures when cybersecurity rules overlap with other EPA-approved water-system obligations.

Impact

The bill would add a new federal framework for cybersecurity oversight in the water sector without directly making EPA a standard-setting body in the first instance. Instead, it creates a certified private or quasi-private WRRO that would draft requirements subject to EPA approval, and it authorizes annual self-attestations, five-year third-party or WRRO compliance assessments, and penalties of up to $25,000 per day for violations. It also preserves state authority to regulate water safety and resilience so long as state actions do not conflict with the approved cybersecurity requirements, and it authorizes $10 million for implementation.

Sentiment

No committee transcripts or recorded votes were provided, so there is no direct evidence of floor or committee sentiment. Based on the bill text, the measure appears designed to address growing concern about cyber threats to critical infrastructure, especially public water systems, and it uses a structured, technical regulatory model that suggests a policy-oriented rather than partisan framing. The absence of recorded opposition or amendments in the provided materials means overall sentiment cannot be measured beyond the bill’s apparent intent to strengthen water-sector security.

Contention

The main points of potential contention are the delegation of standard-setting to a single certified WRRO, the extent of EPA’s deference to that organization’s technical judgments, and the enforcement structure. Water utilities may be concerned about compliance costs, phased implementation burdens, and the possibility of penalties, while states may scrutinize how the federal requirements interact with existing state authority. There may also be debate over whether a private or quasi-private organization should have authority to develop binding cybersecurity requirements, even with EPA approval and procedural safeguards.