Infrastructure Bill With New Resilience and Cybersecurity Provisions Headed to White House

In the coming days President Joe Biden is expected to sign into law H.R. 3684, the Infrastructure Investment and Jobs Act. The measure will provide $550 billion in new infrastructure spending over the next five years, including nearly $50 billion for selected drinking water and wastewater programs at EPA. Also included are provisions for resilience grant and directives to EPA and CISA to develop a program to identify and assist systems with cybersecurity challenges.

Among the programs created by the bill are two EPA grant program intended to help large drinking water and wastewater systems adapt their infrastructure to withstand the effects of climate change and extreme weather and improve their cybersecurity resilience. The bill establishes the Midsize and Large Drinking Water System Resilience and Sustainability Program at EPA at $50 million over five years and the Clean Water Infrastructure Resiliency and Sustainability Program at $25 million per year over the same period. Both programs are meant for systems serving at least 10,000. (A similar program exists for small drinking water systems already but without the cybersecurity component.). Funding both programs has only been authorized. Congress must now appropriate the funding before EPA will set the programs in motion.

Finally, the bill also includes cybersecurity provisions requiring EPA and CISA to:

• Develop a “prioritization framework” to identify public water systems that “if degraded or rendered inoperable due to an incident, would lead to significant impacts on the health and safety of the public”;
• Develop a Technical Cybersecurity Support Plan that would identify public water systems in need of prioritized cybersecurity support and establish timelines for making voluntary technical support available to specific systems; and
• Report to Congress on the framework and the support plan, including “a list describing any public water systems identified . . . as needing technical support for cybersecurity during development of the Support Plan.”