Browse Arkansas Code titles and sections
42 U.S.C. § 300g–10 — Cybersecurity support for public water systems
Federal law — U.S. Code and appendices · legal_authorities
**(a) Definitions** In this section:
(1) **Appropriate Congressional committees** — The term “appropriate Congressional committees” means—
(A) the Committee on Environment and Public Works of the Senate;
(B) the Committee on Homeland Security and Governmental Affairs of the Senate;
(C) the Committee on Energy and Commerce of the House of Representatives; and
(D) the Committee on Homeland Security of the House of Representatives.
(2) **Director** — The term “Director” means the Director of the Cybersecurity and Infrastructure Security Agency.
(3) **Incident** — The term “incident” has the meaning given the term in [section 3552 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552&num=0&edition=prelim).
(4) **Prioritization Framework** — The term “Prioritization Framework” means the prioritization framework developed by the Administrator under subsection (b)(1)(A).
(5) **Support Plan** — The term “Support Plan” means the Technical Cybersecurity Support Plan developed by the Administrator under subsection (b)(2)(A).
**(b) Identification of and support for public water systems**
(1) **Prioritization Framework**
(A) *In general* — Not later than 180 days after November 15, 2021, the Administrator, in coordination with the Director, shall develop a prioritization framework to identify public water systems (including sources of water for those public water systems) that, if degraded or rendered inoperable due to an incident, would lead to significant impacts on the health and safety of the public.
(B) *Considerations* — In developing the Prioritization Framework, to the extent practicable, the Administrator shall incorporate consideration of—
(i) whether cybersecurity vulnerabilities for a public water syst
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 300g–10
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 62563603ebd16c074d1fa8bf89b1782d7626e526210394386d9d16fb71d44970. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Record provenance
Stable record: federal_law:legal_authorities:record_usc_77e575de48fd5cded88443b3
Source file: Laws/federal/codes/united-states-code/title-42/section-300g10-cybersecurity-support-for-public-water-systems--c7e2a093a9.md
Pages: Not recorded – Not recorded
Passage SHA-256: b60d2e5a37f999b587277d111b43b76d8ae202dfcc567dbcff4ea8c7afc1fe39
Source location: Title 42, Chapter 6A, § 300g–10; chapter-6a-public-health-service.md
Stored source content
**(a) Definitions** In this section:
(1) **Appropriate Congressional committees** — The term “appropriate Congressional committees” means—
(A) the Committee on Environment and Public Works of the Senate;
(B) the Committee on Homeland Security and Governmental Affairs of the Senate;
(C) the Committee on Energy and Commerce of the House of Representatives; and
(D) the Committee on Homeland Security of the House of Representatives.
(2) **Director** — The term “Director” means the Director of the Cybersecurity and Infrastructure Security Agency.
(3) **Incident** — The term “incident” has the meaning given the term in [section 3552 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552&num=0&edition=prelim).
(4) **Prioritization Framework** — The term “Prioritization Framework” means the prioritization framework developed by the Administrator under subsection (b)(1)(A).
(5) **Support Plan** — The term “Support Plan” means the Technical Cybersecurity Support Plan developed by the Administrator under subsection (b)(2)(A).
**(b) Identification of and support for public water systems**
(1) **Prioritization Framework**
(A) *In general* — Not later than 180 days after November 15, 2021, the Administrator, in coordination with the Director, shall develop a prioritization framework to identify public water systems (including sources of water for those public water systems) that, if degraded or rendered inoperable due to an incident, would lead to significant impacts on the health and safety of the public.
(B) *Considerations* — In developing the Prioritization Framework, to the extent practicable, the Administrator shall incorporate consideration of—
(i) whether cybersecurity vulnerabilities for a public water system have been identified under [section 300i–2 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section300i-2&num=0&edition=prelim);
(ii) the capacity of a public water system to remediate a cybersecurity vulnerability without additional Federal support;
(iii) whether a public water system serves a defense installation or critical national security asset; and
(iv) whether a public water system, if degraded or rendered inoperable due to an incident, would cause a cascading failure of other critical infrastructure.
(2) **Technical Cybersecurity Support Plan**
(A) *In general* — Not later than 270 days after November 15, 2021, the Administrator, in coordination with the Director and using existing authorities of the Administrator and the Director for providing voluntary support to public water systems and the Prioritization Framework, shall develop a Technical Cybersecurity Support Plan for public water systems.
(B) *Requirements* — The Support Plan—
(i) shall establish a methodology for identifying specific public water systems for which cybersecurity support should be prioritized;
(ii) shall establish timelines for making voluntary technical support for cybersecurity available to specific public water systems;
(iii) may include public water systems identified by the Administrator, in coordination with the Director, as needing technical support for cybersecurity;
(iv) shall include specific capabilities of the Administrator and the Director that may be utilized to provide support to public water systems under the Support Plan, including—
(I) site vulnerability and risk assessments;
(II) penetration tests; and
(III) any additional support determined to be appropriate by the Administrator; and
(v) shall only include plans for providing voluntary support to public water systems.
(3) **Consultation required** — In developing the Prioritization Framework pursuant to paragraph (1) and the Support Plan pursuant to paragraph (2), the Administrator shall consult with such Federal or non-Federal entities as determined to be appropriate by the Administrator.
(4) **Reports required**
(A) *Prioritization Framework* — Not later than 190 days after November 15, 2021, the Administrator shall submit to the appropriate Congressional committees a report describing the Prioritization Framework.
(B) *Technical Cybersecurity Support Plan* — Not later than 280 days after November 15, 2021, the Administrator shall submit to the appropriate Congressional committees—
(i) the Support Plan; and
(ii) a list describing any public water systems identified by the Administrator, in coordination with the Director, as needing technical support for cybersecurity during the development of the Support Plan.
**(c) Rules of construction** Nothing in this section—
(1) alters the existing authorities of the Administrator; or
(2) compels a public water system to accept technical support offered by the Administrator.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter.
**(b) Additional Definitions.—** As used in this subchapter:
(1) The term “binding operational directive” means a compulsory direction to an agency that—
(A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk;
(B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and
(C) may be revised or repealed by the Director if the direction issued on behalf of the Director is not in accordance with policies and principles developed by the Director.
(2) The term “incident” means an occurrence that—
(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or
(B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
(3) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—
(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;
(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
(C) availability, which means ensuring timely and reliable access to and use of information.
(4) The term “information technology” has the meaning given that term
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3552
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.