UT HB0019

Community water systems serving 3,300+ people must complete emergency response plans by December 31, 2026; smaller systems must comply by July 1, 2027, with annual updates thereafter

Security breaches at community water systems must be reported to the Utah Cyber Center within two hours of discovery; the Cyber Center must then notify the Division of Drinking Water within one day

Emergency response plans must include cybersecurity requirements such as regular software updates, network protection, secure authentication practices, annual employee cybersecurity training, and prompt removal of system access for terminated employees

Division of Drinking Water must submit annual reports by October 31 to the Natural Resources, Agriculture, and Environment Interim Committee and the Public Utilities, Energy, and Technology Interim Committee on water system security incidents and recommendations for legislative action

Emergency response plans and incident reports are classified as protected records exempt from public disclosure under state records law; effective date is May 6, 2026