Two bipartisan bills aimed at supporting rural water systems have been reintroduced in the U.S. Senate, offering enhanced cybersecurity defenses for small water and wastewater utilities. These bills focus on offering enhanced cybersecurity defenses, which are crucial for protecting the infrastructure of small water and wastewater utilities. These utilities, often located in rural areas, are vital for providing clean water and managing wastewater for local communities. By strengthening their cybersecurity measures, the bills aim to safeguard these essential services from potential cyber threats and attacks, ensuring the continued safety and reliability of water resources for rural populations.
U.S. Senator Catherine Cortez Masto, a Nevada Democrat re-introduced the Rural Water System Disaster Preparedness and Assistance Act, co-led by Senator Cindy Hyde-Smith, a Republican from Mississippi to help rural water and wastewater utilities prepare and become more resilient in the face of natural disasters and other extreme weather events. The Cybersecurity for Rural Water Systems Act, co-led by Senator Mike Rounds, a Republican from South Dakota, would update technical assistance opportunities for cyber defense to address vulnerabilities in rural water systems.
The Rural Water System Disaster Preparedness and Assistance Act would create an assistance program at the U.S. Department of Agriculture (USDA) to help rural water and wastewater utilities identify vulnerabilities, map water infrastructure, develop disaster protocols, and train employees for emergency and disaster response. This legislation is endorsed by the National Rural Water Association (NRWA) and the Rural Community Assistance Partnership (RCAP).
The Cybersecurity for Rural Water Systems Act would update and expand the Circuit Rider Program to assess the cybersecurity of small water and wastewater utilities, develop protocols to enhance cyber defenses and provide assistance to improve cyber protections. Currently, only 20% of water and wastewater systems across the U.S. have even basic levels of cyber protection. This legislation is endorsed by the NRWA, RCAP, and CyberSolarium 2.0.
These legislative measures, introduced months after the October 2024 attack on the American Water Works Company in New Jersey and a year after the Biden administration’s warning about severe threats to the sector, have garnered support from the Cyberspace Solarium Commission, the NRWA, and the RCAP.
“Between increasing cyber threats and extreme weather disasters, rural Nevadans are experiencing more and more challenges, and it’s critical that their drinking water and wastewater systems are optimized to withstand such events,” Senator Cortez Masto said in a recent statement. “My bipartisan legislation will help protect rural water utilities and ensure they have the resources they need to support our communities all year round.”
“Our rural water associations are on the frontlines when disasters strike, and our legislation gives them critical pre-disaster assistance to strengthen their ability to prepare and respond in these situations—whether tornadoes, hurricanes, or other disasters. It amounts to a smart investment in long-term resilience by ensuring rural water systems have the tools to address vulnerabilities and train for emergencies before disasters hit,” according to Hyde-Smith. “I’m proud to renew this bipartisan effort with Senator Cortez Masto to protect our communities and improve disaster response for rural America.”
“As our near-peer adversaries continue to utilize cyberattacks, we must have cybersecurity safeguards in place to protect our critical infrastructure such as water systems,” said Senator Rounds. “Our legislation would modernize and expand the Circuit Rider Program, providing cybersecurity-related technical assistance to rural water and wastewater systems.”
“This legislation is a much-needed enhancement of our efforts to improve the cybersecurity of rural water systems,” according to Mark Montgomery, executive director of the Cyberspace Solarium Commission. “These water systems face real and immediate threats from both criminals and nation-state actors that can have consequences on national security, economic productivity, and public health and safety. The existing circuit rider program that this leverages is a proven vehicle for delivering security solutions.”
“The Rural Water System Disaster Preparedness and Assistance Act of 2025 will improve the resiliency and disaster mitigation planning for rural communities while also providing essential equipment and personnel to respond when disasters occur. The Cybersecurity for Rural Water Systems Act of 2025 will create ‘Circuit Rider’ cybersecurity specialists who will directly deliver onsite training and technical assistance to rural utilities across our nation that lack the technical, financial, and managerial resources and in-house expertise to defend themselves from cyber threats,” said Matt Holmes, chief executive officer of the NRWA. “On behalf of our 31,000 members, NRWA applauds Senators Cortez Masto, Hyde-Smith, and Rounds’s efforts to protect and enhance the public health and economic vitality of rural communities and create a more resilient, prepared, and secure water sector.”
“RCAP is pleased to support both the Rural Water System Disaster Preparedness and Assistance Act and the Cybersecurity for Rural Water Systems Act, which address two critical challenges facing rural water and wastewater systems,” identified Olga Morales Pate, CEO of the Rural Community Assistance Partnership. “Disasters and cyber threats can devastate small utilities that often lack the resources to prepare and respond effectively.”
Morales Pate added that these bills provide essential funding and technical assistance to help rural communities enhance emergency preparedness, strengthen cybersecurity defenses, and safeguard critical infrastructure. “We commend the leadership of lawmakers championing these efforts and look forward to working alongside our partners to ensure rural systems remain resilient in the face of growing threats.”
Commenting on these developments, Evan Dornbush, former NSA cybersecurity expert, wrote in an emailed statement “We’ve already seen multiple examples of foreign actors attempting to, and successfully breach the technology utilized by water systems using zero-day exploits and remaining undetected for extended time periods.”
He added “Building a consolidated program for operators to cost-share on monitoring, remediation, and information-distribution efforts sounds like a national imperative at this point in history.”
