• Renames and reauthorizes a CISA program from a "ransomware vulnerability warning pilot program" to a permanent "security vulnerability warning program," broadening its scope beyond ransomware to general security vulnerabilities for information systems
• Replaces "covered entities" with "covered utilities," defined as water/wastewater utilities serving 100,000 or fewer individuals, public water systems, and treatment works operators
• Automatically enrolls covered utilities in CISA cyber hygiene services and requires CISA to provide incident response on their behalf if a cyber incident occurs

---