CISA would warn covered utilities about security vulnerabilities

CISA would run the warning program, enroll covered utilities in applicable cyber hygiene services, coordinate with EPA, and use its incident-response capabilities for affected utilities. Covered utilities include water or wastewater utilities serving no more than 100,000 people, certain entities defined by another federal infrastructure law, and operators of public water systems or federally defined treatment works. A utility could leave a cyber hygiene service by notifying CISA's director. CISA would respond only after the director determines that the utility was affected by a cyber incident, and only as appropriate. The program would end five years after the subsection setting the deadline is enacted.

Shared program information would be exempt from public records laws, while CISA would protect personal details and limit its handling of the information. These rules cover information an entity shares with the security vulnerability warning program, including personal or identifying details about a specific person. CISA's director could disclose, keep, or use shared information only for a purpose listed in a referenced 2015 federal law.