The bill amends section 306(a) of the Consolidated Farm and Rural Development Act to insert a new paragraph creating a Rural Water and Wastewater Cybersecurity Circuit Rider Program. The program, modeled on the existing circuit rider authority, directs circuit riders to perform rapid cybersecurity assessments, develop protocols, assist with remediation of inadequate protections, and document the cyber-protection status of the water supplies for associations that operate rural water or wastewater systems.
The statute requires circuit riders to report to the Secretary of Agriculture about which associations they served and what activities they performed, gives the Secretary discretion to set experience and certification standards for riders, and authorizes $10 million per fiscal year for 2025 through 2029 to fund the effort. The measure targets a known vulnerability—under-resourced rural utilities—and creates a specific USDA technical-assistance channel intended to reduce cyber risks to water infrastructure and public health.
At a Glance
What It Does
The bill inserts paragraph (23) into 7 U.S.C. 1926(a), directing the Secretary of Agriculture to establish a cybersecurity circuit rider program patterned after the existing circuit rider authority. Circuit riders must provide assessments, protocol development, remediation assistance, and documentation of cyber protections for eligible rural water and wastewater associations.
Who It Affects
The program applies to the associations described in paragraph (1) of section 306(a) that operate rural water or wastewater systems—primarily small, member-owned or cooperative utilities funded or served by USDA Rural Development programs. USDA will stand up and oversee the riders and set qualification standards.
Why It Matters
This creates a targeted federal technical-assistance channel for cyber resilience in a category of critical infrastructure that often lacks in-house IT/security capacity. The authorization level ($10M/year through 2029) sets an initial resource envelope but does not create a permanent entitlement beyond that window.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill adds a new, numbered paragraph to the USDA Rural Development statute to create a Cybersecurity for Rural Water Systems Act program. It directs the Secretary to stand up a set of circuit riders — mobile or regional technical-assistance staff modeled on USDA’s existing circuit rider framework — whose job is to help small water and wastewater associations with cybersecurity.
The law lists four core functions: (1) rapid assessments of an association’s ability to respond to cyber threats and to protect its cyberinfrastructure and public health; (2) help developing reasonable cybersecurity protocols; (3) remedial assistance where protections are inadequate; and (4) documentation of the association’s current state of cyber protection for its water supplies.
To keep the program accountable, circuit riders who receive funding must submit reports to the Secretary that name which associations they served and describe the activities performed. The statute gives the Secretary authority to require that circuit riders possess ‘‘necessary experience and certification’’ but leaves the specific credentialing standards to agency rulemaking or guidance.
Finally, the bill authorizes—but does not appropriate—$10 million per year for fiscal years 2025 through 2029 to carry out the new paragraph.Operationally, the text relies on the existing statutory template for circuit riders (the immediately preceding paragraph in section 306(a)), meaning USDA is likely to place the new riders within the administrative structure used for other rural technical-assistance programs. The measure focuses on short-term technical assistance and assessment rather than creating a grant program for capital upgrades; its stated purpose is to identify weaknesses, develop protocols, and help close gaps through assistance rather than to fund large-scale infrastructure replacement.
The Five Things You Need to Know
The bill inserts paragraph (23) into 7 U.S.C. 1926(a), establishing a Rural Water and Wastewater Cybersecurity Circuit Rider Program.
Circuit riders must provide rapid cybersecurity assessments, develop reasonable protocols, assist in addressing inadequate protections, and document the state of cyber protection for water supplies.
Each funded circuit rider must report to the Secretary of Agriculture listing the associations served and the activities performed.
The Secretary must ensure circuit riders possess necessary experience and certification, but the statute leaves the specific credentialing standards to the Secretary’s determination.
The bill authorizes $10,000,000 per year for fiscal years 2025 through 2029 to carry out the circuit rider program.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Provides the bill’s short title: the Cybersecurity for Rural Water Systems Act. This is a standard heading provision that has no operational effect on the program itself but establishes the statute’s naming for citation and cross-references.
Creates paragraph (23) — the cybersecurity circuit rider authority
Amends the Consolidated Farm and Rural Development Act by inserting a new paragraph (23) that requires the Secretary to establish a cybersecurity circuit rider program. The new paragraph is explicit that the program should be structured similarly to the existing circuit rider authority in the immediately preceding paragraph, tying administration and likely staffing/operations to USDA’s existing technical-assistance framework.
Core functions: assessment, protocol development, remediation assistance, documentation
Subparagraph (A) enumerates four distinct activities for circuit riders: conducting rapid assessments of an association’s cyber-response capacity and protection of cyberinfrastructure/public health; developing reasonable cybersecurity protocols; providing assistance to correct inadequate cyber protection plans; and documenting the state of cyber protection for the association’s water supplies. Each function is operationally focused on technical assistance rather than on providing direct capital funding for upgrades.
Reporting obligations for funded circuit riders
Subparagraph (B) requires circuit riders who receive funding under the new paragraph to submit reports to the Secretary documenting which associations they served and what activities they performed. The reporting requirement creates an administrative record for oversight and could inform future program decisions, but the text does not specify report timing, format, or whether reports will be public.
Qualification requirement and authorization of appropriations
Subparagraph (C) directs the Secretary to ensure circuit riders possess the necessary experience and certification to carry out the listed activities, but it delegates all determinations about those standards to the Secretary. Subparagraph (D) authorizes $10 million annually for FY2025–FY2029 to carry out the program—authorization language that requires subsequent appropriation action before funds are available.
This bill is one of many.
Codify tracks hundreds of bills on Infrastructure across all five countries.
Explore Infrastructure in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Small rural water and wastewater associations: Gains tailored cybersecurity technical assistance (assessments, protocols, remedial help) that many lack in-house capacity to perform, which should reduce operational cyber risk and protect local public health.
- Residents of rural communities: Stand to get stronger protections for drinking water and wastewater systems because the program focuses on cyber threats that could disrupt treatment, distribution, or monitoring.
- USDA Rural Development and existing circuit rider teams: Receive a statutory tool to deploy specialized cybersecurity expertise alongside other technical assistance, allowing program integration with existing rural utility support activities.
- Cybersecurity professionals and contractors: Create new contract or employment opportunities for individuals and firms qualified to serve as circuit riders under USDA standards.
Who Bears the Cost
- Federal government (Congress/appropriators): Bears the budgetary cost if Congress appropriates the authorized $10M per year and any additional administrative expenses beyond the authorization window.
- Small utilities and associations: May incur follow-up implementation costs to adopt recommended protocols and remedial measures identified by circuit riders, since the bill funds assistance and assessment rather than capital upgrades.
- USDA (program administration): Must stand up hiring, credentialing, oversight, and reporting processes for circuit riders within Rural Development, which could require reallocating staff or new administrative spending not explicitly funded by the authorization.
- Private vendors and training providers: Face demand-side effects—while some will benefit from contracts, others may need to meet USDA’s unspecified certification standards to qualify, creating compliance and credentialing costs.
Key Issues
The Core Tension
The bill confronts a classic trade-off: it channels federal technical help to under-resourced rural utilities—reducing cyber risk to public health—while relying on limited, time-bound federal funding and leaving critical program design choices to agency discretion, which risks either insufficient support if funding stalls or centralized handling of sensitive system details without clarified safeguards.
The statute authorizes $10 million per year for five fiscal years but does not appropriate funds; program launch therefore depends on future appropriations and internal USDA implementation decisions. The authorization window (FY2025–2029) creates a time-limited funding horizon that could complicate hiring and retention of qualified circuit riders and planning for sustained support to utilities that will need ongoing cybersecurity upkeep beyond initial assessments.
Key program details are delegated to the Secretary: the statute requires riders to have ‘‘necessary experience and certification’’ but does not define acceptable certifications, the number or geographic distribution of riders, report timing or confidentiality, or whether USDA may subcontract work to state agencies or private firms. That delegation speeds enactment but leaves open questions about standards, procurement, and the handling of potentially sensitive infrastructure information collected during assessments.
The reporting requirement increases oversight but could create disclosure risks if reports contain operational details about vulnerabilities; the bill does not address protections for sensitive infrastructure data or how reports will be used or shared.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.