HB2109 would include cybersecurity technical assistance in the national rural water and wastewater circuit rider program operated by the Department of Agriculture. The request is to help small systems serving fewer than 10,000 people assess vulnerabilities and implement cybersecurity plans, procedures, and technologies.
It also extends the program’s funding from current levels to 32.5 million per year for fiscal years 2026 through 2030, with 7.5 million dedicated to cybersecurity assistance. The changes are enacted by amending Section 306(a)(22)(A) of the Consolidated Farm and Rural Development Act.
At a Glance
What It Does
The bill expands the circuit rider program within USDA’s Rural Development to include cybersecurity technical assistance for rural water systems serving under 10,000 people, requiring assessment of cyber threat resilience and implementation of cybersecurity measures.
Who It Affects
Rural water utilities with fewer than 10,000 residents, and the USDA Rural Development circuit rider teams that provide on-site guidance and technical support.
Why It Matters
Weak cyber defenses at small water utilities pose risk to public health and safety. This bill formalizes federal support to build resilience in a critical infrastructure sector by pairing hands-on guidance with dedicated funding.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Cybersecurity for Rural Water Systems Act directs the USDA’s national rural water and wastewater circuit rider program to provide cybersecurity technical assistance to small rural water systems. The assistance is meant to help these systems assess their vulnerabilities to cyber threats and implement cybersecurity plans, procedures, and technologies to defend against those threats.
These changes are achieved by amending the Consolidated Farm and Rural Development Act to add cybersecurity tasks to the circuit rider program for systems serving fewer than 10,000 people. In addition, the bill increases funding for the circuit rider program, setting the annual appropriation at 32.5 million for fiscal years 2026 through 2030, with 7.5 million dedicated specifically to cybersecurity technical assistance.
The overall aim is to bolster the cyber hygiene of rural water infrastructure through technical guidance and sustained federal support.
The Five Things You Need to Know
The bill requires the circuit rider program to provide cybersecurity technical assistance to rural water systems serving fewer than 10,000 people.
The assistance must help assess vulnerability to cyber threats and support implementation of cybersecurity plans and technologies.
Funding for the circuit rider program is increased to 32.5 million per year for 2026–2030, with 7.5 million reserved for cybersecurity.
The changes are enacted via amendments to Section 306(a)(22)(A) of the Consolidated Farm and Rural Development Act.
The act is titled the Cybersecurity for Rural Water Systems Act.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short Title
Designates the bill as the Cybersecurity for Rural Water Systems Act, establishing its official name and citation.
Inclusion of cybersecurity technical assistance in the circuit rider program
Amends Section 306(a)(22)(A) to add cybersecurity technical assistance for rural water systems serving fewer than 10,000 people. The added subsection requires the circuit rider program to assess system efficacy against cyber threats and to help implement cybersecurity plans, procedures, and technologies to protect against such threats.
Extension of program funding
Amends Section 306(a)(22)(B) to raise annual funding for the circuit rider program to 32.5 million for fiscal years 2026 through 2030, with 7.5 million of each year reserved specifically for cybersecurity technical assistance under the amended subsection (A)(ii).
This bill is one of many.
Codify tracks hundreds of bills on Infrastructure across all five countries.
Explore Infrastructure in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Small rural water systems serving fewer than 10,000 residents will receive cybersecurity guidance and assistance during circuit rider visits, improving resilience against cyber threats.
- USDA Rural Development field offices and circuit rider teams will have an expanded scope and dedicated funding to deliver cybersecurity support.
- State and local authorities overseeing rural water utilities benefit from more robust cyber hygiene and risk management.
- Cybersecurity service providers that participate in circuit rider engagements may gain new contracting opportunities.
Who Bears the Cost
- Federal taxpayers fund the increased program appropriation tied to the expanded scope.
- USDA Rural Development program administration will need to allocate staff and resources to administer the expanded program.
- Small rural water systems may incur costs to implement recommended cybersecurity measures beyond the provided technical assistance.
- Private cybersecurity vendors and contractors engaged in the program may experience higher demand and associated pricing dynamics.
Key Issues
The Core Tension
Balancing finite federal resources with the cybersecurity needs of diverse, under-resourced rural water systems: can a centralized circuit rider program deliver durable cyber resilience without imposing new, unmanageable costs on small communities?
The bill advances a targeted expansion of federal support to secure rural water infrastructure through expert, on-the-ground cybersecurity assistance. The practical challenge is ensuring that the expanded funding translates into meaningful, sustainable risk reduction for small systems that often operate with limited budgets and staff.
The program’s effectiveness will hinge on the availability of qualified circuit riders, timely deployment of guidance, and the ability of small utilities to absorb and implement recommended cybersecurity measures. Additionally, while the act increases funding, it does not specify matching requirements or ongoing authorization, which could affect long-term viability and scalability.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.