AWWA Backs Collaborative Cybersecurity Legislation to Strengthen Water Sector Resilience

The increasing number of cyber threats in the water sector has become a matter of urgent concern. Recognizing the need for robust solutions, the American Water Works Association (AWWA) has voiced its strong support for the introduction of a new bill that aims to create a collaborative approach to cybersecurity in the water industry. This bill, known as the Water Risk and Resilience Organization (WRRO) Establishment Act (H.R. 2594), was introduced in the U.S. House of Representatives on April 2, 2025. It seeks to bring together industry professionals and cybersecurity experts to address the growing vulnerabilities in water systems across the United States.

The proposed legislation, which authorizes the creation of an independent, non-federal organization to oversee cybersecurity efforts, emphasizes the importance of both federal oversight and industry expertise. The organization would work closely with the U.S. Environmental Protection Agency (EPA) to ensure water systems are prepared to tackle cyber threats.

A Collaborative Approach to Cybersecurity

The WRRO Establishment Act represents a key shift in the way cybersecurity is addressed within the water sector. AWWA CEO David LaFrance highlighted the necessity of bringing together water utility leaders and cybersecurity professionals to develop effective protection strategies. “The best and most efficient way to protect water operations and customer information is to leverage the knowledge of cybersecurity experts and utility leaders,” LaFrance said, underscoring that collaboration is critical to safeguarding the integrity of water infrastructure.

The legislation also acknowledges the unique challenges that the water sector faces. From small rural utilities to large metropolitan systems, water utilities vary greatly in size, resources, and capacity. A one-size-fits-all approach to cybersecurity would not be effective, as each system faces its own set of risks and challenges. The WRRO’s collaborative framework aims to allow water professionals to contribute their expertise to the development of cybersecurity standards tailored to the specific needs of different utilities.

The Role of Federal Oversight

With the increasing reliance on digital systems in the water sector, the potential for devastating cyberattacks has grown significantly. Reliable water services are essential not only for public health but also for national security and economic stability. By involving both the federal government and industry professionals, the WRRO ensures that cybersecurity measures are not only comprehensive but also sustainable in the long term.

The proposed legislation also provides a platform for constant dialogue between utility operators, federal agencies, and cybersecurity experts. This dialogue is crucial to ensure that as cyber threats evolve, so do the strategies to combat them. This proactive, collaborative approach ensures that water systems remain resilient and capable of withstanding cyber threats.

A Vision for the Future

AWWA’s endorsement of the WRRO Establishment Act is the latest step in the organization’s years-long effort to advocate for a tailored and flexible cybersecurity framework in the water sector. The bill has gained the support of numerous AWWA members, nearly 200 of whom met with lawmakers to discuss the importance of this legislation. Representative Rick Crawford (R-AR), who played a key role in introducing the bill, has been praised for his leadership on this issue. AWWA looks forward to working alongside Rep. Crawford and other congressional leaders to ensure the bill’s passage.

With its broad-based support and a strong foundation of industry expertise, the WRRO Establishment Act stands to be a critical tool in bolstering the cybersecurity resilience of water systems across the United States.

What Undercode Says:

As the water sector increasingly integrates digital technologies, it faces growing cybersecurity risks. The AWWA’s endorsement of the WRRO Establishment Act signals a crucial turning point in how water utilities approach cybersecurity. For too long, the sector has been underprepared for the level of cyber threats targeting infrastructure critical to national security, public health, and economic stability. The establishment of a dedicated, non-federal organization under the proposed bill promises to bring the necessary expertise and resources to tackle these threats head-on.

What stands out most in the bill’s design is its recognition of the vast differences across water utilities. Not all water systems are equipped with the same resources or capacity to address cybersecurity challenges, and forcing a one-size-fits-all solution could leave many systems vulnerable. The WRRO’s flexible, collaborative structure addresses this disparity by incorporating input from utility operators, cybersecurity professionals, and federal agencies, ensuring a tailored, adaptable approach that can scale based on the unique needs of each system.

The involvement of the EPA ensures that there is a robust oversight mechanism in place, preventing the bill from becoming a mere industry-led initiative without the necessary regulatory backing. This oversight is critical for ensuring that any cybersecurity standards set under the WRRO are not only effective but also enforceable.

Another compelling aspect is the emphasis on continuous collaboration. As cyber threats evolve at an alarming pace, static solutions are ineffective. This collaborative framework encourages a dynamic, ongoing dialogue that allows cybersecurity measures to adapt in real-time to new threats.

However, there are also potential challenges to consider. The bill’s success hinges on a broad coalition of stakeholders, including lawmakers, industry professionals, and cybersecurity experts. While the initial reception has been positive, it remains to be seen how effectively the collaboration will be maintained as the bill moves through Congress. Furthermore, the implementation of cybersecurity measures across the diverse landscape of U.S. water utilities may prove to be a complex and resource-intensive task.

Yet, the strategic foresight demonstrated by AWWA in advocating for this collaborative approach is commendable. By advocating for a specialized, adaptable cybersecurity framework, they are not just reacting to current threats—they are preparing the sector for future challenges.

Fact Checker Results:

The Water Risk and Resilience Organization (WRRO) Establishment Act focuses on creating a non-federal organization to collaborate with the EPA for better cybersecurity standards in the water sector.
The bill introduces a flexible framework that considers the varying capacities of different water utilities, ensuring that cybersecurity standards are not “one-size-fits-all.”