This compliance-focused article flags that community water systems serving 3,301 to 49,999 people - the vast majority of US systems - were required to certify their Risk and Resilience Assessments (RRAs) by June 30, 2026 under the America's Water Infrastructure Act (AWIA) 2013. This is a hard compliance deadline that directly affects most mid-sized utilities rather than only the largest systems.
It also previews the upcoming Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which will require water utilities to report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours once the rule is finalized later in 2026. The article notes New York has already finalized binding cybersecurity regulations for wastewater facilities, a template other states are expected to follow through 2026 and 2027.