42 U.S.C. § 300g–10 — Cybersecurity support for public water systems

(a) Definitions This section defines five terms used throughout it. "Appropriate Congressional committees" means four specific committees: the Senate Committee on Environment and Public Works, the Senate Committee on Homeland Security and Governmental Affairs, the House Committee on Energy and Commerce, and the House Committee on Homeland Security. "Director" means the Director of the Cybersecurity and Infrastructure Security Agency (CISA). "Incident" has the meaning given to it in a separate federal information-security law — this section does not define the term itself. "Prioritization Framework" means the framework the EPA must develop under subsection (b)(1)(A). "Support Plan" means the Technical Cybersecurity Support Plan the EPA must develop under subsection (b)(2)(A). (b) Identification of and support for public water systems Prioritization Framework. Within 180 days of November 15, 2021, the EPA, working with the Director of CISA, had to develop a framework to identify which public water systems (including their water sources) would cause significant harm to public health and safety if a cyberattack degraded or knocked them out. As far as practical, the framework had to take into account: whether the system's cybersecurity vulnerabilities have already been identified under a separate section of this title; whether the system can fix a vulnerability without additional federal help; whether the system serves a defense installation or other critical national-security asset; and whether losing that system would cause a cascading failure of other critical infrastructure. Technical Cybersecurity Support Plan. Within 270 days of November 15, 2021, using the EPA's and CISA's existing authority to offer voluntary support to water systems, and using the Prioritization Framework, the EPA had to develop a Support Plan. The plan must: set a method for identifying which specific water systems should be prioritized for cybersecurity help; set timelines for making that voluntary technical support available to those systems; may include water systems that the EPA, working with CISA, identifies as needing cybersecurity help; must describe the specific capabilities the EPA and CISA can use to support water systems under the plan, including site vulnerability and risk assessments, penetration tests, and any other support the EPA finds appropriate; and must include only plans for support that is voluntary. Required consultation. In developing both the Prioritization Framework and the Support Plan, the EPA must consult with whatever federal or non-federal entities it determines to be appropriate. Required reports to Congress. Not later than 190 days after November 15, 2021, the EPA must submit to the appropriate Congressional committees a report describing the Prioritization Framework. Not later than 280 days after November 15, 2021, the EPA must submit to those committees the Support Plan itself, along with a list describing any public water systems that the EPA, working with CISA, identified during the plan's development as needing technical cybersecurity support. (c) Rules of construction Nothing in this section changes the EPA's existing legal authority, and nothing in it compels any public water system to accept the technical support the EPA offers.