# Plain Language Summary: Water Risk and Resilience Organization Bill

This bill creates a new organization called the Water Risk and Resilience Organization (WRRO) to develop cybersecurity standards for water systems across the country. The EPA would certify one organization to take on this role, and that organization would be responsible for creating rules to protect water systems from cyberattacks—the kind of digital attacks that could disrupt a water utility's computer systems and potentially affect the water supply.

The bill applies to medium and large water systems that serve 3,300 or more people, including both drinking water systems and wastewater treatment facilities. The WRRO would develop cybersecurity requirements that these water systems must follow, similar to how other industries have safety standards. For example, a requirement might specify that water systems need certain types of firewalls, backup systems, or employee training to prevent hackers from taking control of their operations. The EPA would review and approve these requirements before they become official rules, though the EPA is supposed to defer to the WRRO's technical expertise.

Water systems that don't follow the approved cybersecurity requirements could face penalties up to $25,000 per day they remain in violation. However, the bill includes protections for water system operators—they get notice of violations, a chance to be heard, and can appeal penalties to the EPA. The bill also makes clear that states can still create their own water safety rules as long as they don't conflict with the federal cybersecurity standards. The organization itself would be independent and funded through fees charged to water systems, with any penalties collected going back to support the WRRO's training and resources.