Critical Infrastructure Policy: US Senators Introduce "Water Cyber Shield Act" Following Wave of Utility Attacks
Executive Summary
In direct response to a surge in cyberattacks targeting municipal water facilities, U.S. Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act on August 11, 2026. The bipartisan legislation establishes mandatory federal incident reporting rules for water utilities, strengthens EPA oversight over municipal operational technology (OT), mandates annual cybersecurity compliance assessments, and creates dedicated EPA grant programs to fund OT defenses for small water facilities. The bill follows recent coordinated cyberattacks targeting programmable logic controllers (PLCs) across more than 30 communities in Minnesota and seven other states.
Technical & Policy Framework of the Water Cyber Shield Act
The legislation establishes a comprehensive cyber defense architecture for the Water and Wastewater Systems (WWS) sector:
1. Mandatory Incident Reporting & Secure Remote OT Connectivity
The bill mandates strict operational technology defense standards:
* 24-Hour Incident Reporting: Water utilities must report cyber intrusions, unauthorized PLC setpoint modifications, and SCADA outages to CISA and the EPA within 24 hours of discovery.
* Mandatory Secure OT Connectivity: Water systems must align remote access connections with CISA and UK NCSC Secure Connectivity Principles for Operational Technology, prohibiting direct internet exposure of PLC EtherNet/IP (port 44818) and Modbus (port 502) interfaces.
2. Annual EPA Cyber Audits & Municipal Grant Funding
The Act provides financial and regulatory resources for small utilities:
* Annual Compliance Audits: The EPA will execute yearly cybersecurity assessments, auditing water treatment facilities for default password removal, air-gapped backups, and network segmentation.
* Targeted EPA Infrastructure Grants: The bill authorizes dedicated federal grant funding to assist resource-constrained municipal water districts in deploying industrial intrusion detection systems and managed OT security services.
Legislative Detail
Specification
Legislation
Water Cyber Shield Act of 2026
Sponsors
Senators Adam Schiff (D-CA) & Amy Klobuchar (D-MN)
Introduced Date
August 11, 2026
Regulatory Body
Environmental Protection Agency (EPA) & CISA
Key Mandates
24-Hour Incident Reporting, Annual OT Cyber Audits, Direct PLC Internet Blocking
Target Sector
Municipal Water & Wastewater Treatment Utilities
Legislative Enforcement & Operational Technology Security Standards
The introduction of the Water Cyber Shield Act represents a major policy transition from voluntary guidelines to enforceable regulatory mandates for critical infrastructure OT. As state-sponsored threat actors and extortion groups increasingly target legacy industrial control systems, federal oversight ensures that small public utilities receive the resources and guidance necessary to withstand sophisticated cyber intrusions.
Proactively hardening industrial control systems against remote tampering is essential to protecting public health and clean water access.
Recommendations and Mitigations
Water district directors, SCADA engineers, and municipal utility operators should align OT networks with the proposed standards:
1. Remove Industrial Control Systems (PLCs/HMIs) from Public Internet Exposure: Ensure Allen-Bradley, Modicon, and Siemens PLCs operate behind air-gapped firewalls or encrypted VPN gateways.
2. Enforce Multi-Factor Authentication & Change Default Passwords: Replace default factory administrative passwords on all cellular OT modems, SCADA gateways, and industrial routers.
3. Establish 24-Hour Cyber Incident Response Procedures: Maintain formal IR plans to report suspected OT intrusions to CISA and regional EPA coordinators within 24 hours.
4. Deploy Industrial Intrusion Detection Systems (IDS): Implement OT-aware network monitoring tools (such as Dragos or Claroty) to detect unauthorized PLC ladder logic downloads and chemical setpoint tampering.