Rural America Gets Cyber Shield: A Bipartisan Digital Safety Plan

Summary

• Bipartisan Legislation: Reps. Don Davis and Zach Nunn introduced the Cybersecurity for Rural Water Systems Act to protect small rural water utilities from cyberattacks.
• Help for Small Systems: The bill targets water and wastewater systems that serve fewer than 10,000 people.
• Training and Technical Help: It would expand a USDA program that sends experts to help rural utilities, adding cybersecurity assistance.
• Longer Funding: The bill would reauthorize that program through fiscal year 2030.

Small water systems get attention in Congress

Small rural water utilities often run on a handful of staff and old equipment, and attackers have noticed. Reps. Don Davis (D-N.C.) and Zach Nunn (R-Iowa) introduced the Cybersecurity for Rural Water Systems Act (H.R. 2109) on March 14, 2025. It aims to help those utilities defend themselves.

What the bill would do

The bill builds on USDA’s Circuit Rider Program, which sends technical experts to rural water and wastewater systems to help with operations and compliance. It would add cybersecurity help for systems serving fewer than 10,000 people. That is an approach built for communities without an IT department.

Nunn’s office framed the Cybersecurity for Rural Water Systems Act as protection for rural drinking water. The target is systems that cannot afford security staff, and the vehicle is the existing Circuit Rider Program.

Training for the people who run the plants

Much of the practical value is training. Circuit riders already visit these utilities. Adding security to their checklist means plant operators and local officials get basic guidance on passwords, remote access and backups from someone who knows their equipment, at little or no cost.

The bill would also reauthorize the Circuit Rider Program through fiscal year 2030. Steadier funding.

Why water utilities are a target

Attacks on U.S. water systems have risen, and federal agencies have warned that many small utilities leave control systems exposed to the internet with default passwords.

Small systems rarely have the money to hire outside security firms. A federal program that brings expertise to them fills a gap the market does not.

What comes next

The bill was referred to the House Agriculture Committee. Its approach, using a program rural utilities already know and trust, is low cost and practical.

Whether it passes or not, the bill points at a real weak spot: thousands of small water systems with little defense. Utilities do not have to wait for Congress to change default passwords and take control systems off the open internet.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.