N.J. Stat. tit. 58, ch. 31

in effect

N.J. Stat. § 58:31-1 Short title.

1. This act shall be known and may be cited as the "Water Quality Accountability Act." L.2017, c.133, s.1.

N.J. Stat. § 58:31-2 Definitions relative to operation, management of public water systems.

2. As used in P.L.2017, c.133 (C.58:31-1 et seq.): "Board" means the Board of Public Utilities. "Cybersecurity incident" means an event occurring on or conducted through a computer network that jeopardizes the integrity, confidentiality, or availability of computers, information systems, communications systems, networks, physical or virtual infrastructure controlled by computers or information systems, or information residing thereon. "Cybersecurity insurance policy" means an insurance policy designed to mitigate losses from cybersecurity incidents, including, but not limited to, data breaches, business interruption, and network damage. "Department" means the Department of Environmental Protection. "Industrial control system" means an information system used to control industrial processes such as manufacturing, product handling, production, or distribution. "Industrial control system" includes supervisory control and data acquisition systems used to control geographically dispersed assets, and distributed control systems and smaller control systems using programmable logic controllers to control localized processes. "Information resource" means information and related resources, such as personnel, equipment, funds, and information technology. "Information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. "New Jersey Cybersecurity and Communications Integration Cell" means the New Jersey Cybersecurity and Communications Integration Cell established pursuant to Executive Order No. 178 (2015) in the New Jersey Office of Homeland Security and Preparedness, or any successor entity. "Public community water system" means the same as that term is defined in subsection l. of section 3 of P.L.1977, c.224 (C.58:12A-3). "Public water system" means the same as the term is defined in section 3 of P.L.1977, c.224 (C.58:12A-3). "Water purveyor" means any person that owns a public community water system with more than 500 service connections. L.2017, c.133, s.2; amended, 2021, c.262, s.1.

N.J. Stat. § 58:31-3 Inspections, testing by water purveyor.

3. a. Each water purveyor shall inspect each valve in its public community water system in accordance with the provisions of subsection b. of this section in order to determine (1) accessibility of the valve for operational purposes, and (2) the valve's operating condition. A water purveyor shall repair or replace any valve found to be broken or otherwise not operational. b. Each water purveyor shall inspect each valve that is 12 or more inches in diameter at least once every four years, and shall inspect all other valves at least once every eight years, except that the requirements of this subsection shall not apply to any service connection valve or customer shut-off valve. At a minimum, each valve inspection conducted pursuant to this subsection shall include: (1) clearing of the area around the valve to ensure full access to the valve for operating purposes; (2) cleaning out of the valve box; (3) dynamic testing of the valve, by opening and then closing the valve for either of the following number of turns: (a) the number of turns recommended by the valve manufacturer to constitute a credible test; or (b) the number of turns which constitutes 15 percent of the total number of turns necessary to completely open or completely close the valve ; and (4) complying with any other criteria as may be required by the department pursuant to rules and regulations adopted pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.). c. (1) Each water purveyor shall, once a year, test every fire hydrant in its system in order to determine the hydrant's working condition. (2) Each water purveyor shall formulate and implement a plan for flushing every fire hydrant in the public community water system, and every dead end of a main in the public community water system. This plan for flushing may be combined with the periodic testing of fire hydrants required pursuant to paragraph (1) of this subsection. d. Each water purveyor shall keep a record of all inspections, tests, and flushings conducted pursuant to this section for a period of at least 12 years. e. Each water purveyor that owns, solely or jointly, a fire hydrant shall mark each hydrant with the initials of its name, abbreviation of its name, corporate symbol, or other distinguishing mark or code by which ownership may be readily and definitely ascertained. Each fire hydrant shall be marked with a number or symbol, or both, by which the location of the hydrant may be determined on the water purveyor's office records. The markings may be made with a soft metal plate, plastic, or another durable material, and shall be of such size and so spaced and maintained as to be easily read. f. Each water purveyor shall identify, to the extent possible, the geographic location of each valve and fire hydrant in its public community water system using a global positioning system based on satellite or other location technology. L.2017, c.133, s.3; amended 2021, c.262, s.12.

N.J. Stat. § 58:31-4 Development of cybersecurity system; exemptions.

4. a. Within 120 days after the effective date of P.L.2017, c.133 (C.58:31-1 et seq.), each water purveyor shall develop a cybersecurity program, in accordance with requirements established by the New Jersey Cybersecurity and Communications Integration Cell , as rules and regulations adopted pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), that defines and implements organization accountabilities and responsibilities for cyber risk management activities, and establishes policies, plans, processes, and procedures for identifying and mitigating cyber risk to its public community water system. As part of the cybersecurity program, a water purveyor shall: identify the individual chiefly responsible for ensuring that the policies, plans processes, and procedures established pursuant to this section are executed in a timely manner; conduct risk assessments and implement appropriate controls to mitigate identified risks to the public community water system; maintain situational awareness of cyber threats and vulnerabilities to the public community water system; and create and exercise incident response and recovery plans. No later than 180 days after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), a water purveyor shall update its cybersecurity program to conform to the requirements of section 3 of P.L.2021, c.262 (C.58:31-4.1). A water purveyor shall submit a copy of the cybersecurity program developed pursuant to this subsection to the New Jersey Cybersecurity and Communications Integration Cell, in a form and manner as determined by the New Jersey Cybersecurity and Communications Integration Cell. A cybersecurity program submitted pursuant to this subsection shall not be considered a government record under P.L.1963, c.73 (C.47:1A-1 et seq.), and shall not be made available for public inspection. b. Within 60 days after developing the cybersecurity program required pursuant to subsection a. of this section, each water purveyor shall join the New Jersey Cybersecurity and Communications Integration Cell and create a cybersecurity incident reporting process. c. (Deleted by amendment, P.L.2021, c.262). d. No later than 180 days after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), each water purveyor shall obtain a cybersecurity insurance policy that meets any applicable standards adopted by the board. L.2017, c.133, s.4; amended 2021, c.262, s.2.

N.J. Stat. § 58:31-4.1 Update of cybersecurity program; revision; proof of compliance; audit.

3. a. In addition to the requirements of section 4 of P.L.2017, c.133 (C.58:31-4), and the requirements established by the board pursuant thereto, no later than 180 days after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), each water purveyor shall update its cybersecurity program developed pursuant to section 4 of P.L.2017, c.133 (C.58:31-4) to apply to all of the public community water system's industrial control systems, and to reasonably conform to the most recent version of one or more of the following industry-recognized cybersecurity frameworks: (1) the Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology; (2) the Center for Internet Security Critical Security Controls for Effective Cyber Defense; or (3) the International Organization for Standardization and International Electrotechnical Commission 27000 family of standards for an information security management system. b. Whenever a final revision to one or more of the frameworks listed in subsection a. of this section is published, a water purveyor whose cybersecurity program reasonably conformed to that framework shall revise its cybersecurity program to reasonably conform to the revised framework, and submit a copy of the revised cybersecurity program to the New Jersey Cybersecurity and Communications Integration Cell, no later than 180 days after publication of the revised framework. c. No later than one year after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), and each year thereafter, each water purveyor shall submit to the board, the department , and the New Jersey Cybersecurity and Communications Integration Cell a certification demonstrating that the water purveyor is in compliance with the requirements of this section. The certification shall be made in the form and manner as determined by the department, in consultation with the New Jersey Cybersecurity and Communications Integration Cell. The certification shall be signed by the responsible corporate officer of the public community water system, if privately held, executive director, if an authority, or mayor or chief executive officer of the municipality, if municipally owned, as applicable. d. The New Jersey Cybersecurity and Communications Integration Cell shall cause to be audited, for compliance with the requirements of section 4 of P.L.2017, c.133 (C.58:31-4) and this section, any public community water system that fails to submit a cybersecurity program as required pursuant to subsection a. of section 4 of P.L.2017, c.133 (C.58:31-4), a revision pursuant to subsection b. of this section, or a certification pursuant to this section. Any audit shall be conducted by a qualified and independent cybersecurity company, at the water purveyor's expense. Following the audit, the water purveyor shall submit the audit and any corrective action plans derived from the audit to the New Jersey Cybersecurity and Communications Integration Cell. e. A water purveyor shall, upon the request of the board, the department, or the New Jersey Cybersecurity and Communications Integration Cell, provide proof of compliance with the requirements of this section, in a form and manner as determined by the board, the department, or by the New Jersey Cybersecurity and Communications Integration Cell. f. The board shall update any requirements it has established for cybersecurity programs pursuant to subsection a. of section 4 of P.L.2017, c.133 (C.58:31-4) to conform to the requirements of this section. L.2021, c.262, s.3.

N.J. Stat. § 58:31-4.2 Purveyor's water report; audit.

4. a. Beginning 90 days after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), a water purveyor shall report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of a cybersecurity incident, and in accordance with all applicable laws, rules , and regulations: (1) any cybersecurity incident that results in the compromise of the confidentiality, integrity, availability, or privacy of the water purveyor's utility billing, communications, data management, or business information systems, or the information thereon; and (2) any cybersecurity incident against the water purveyor's industrial control system, including monitoring, operations, and centralized control systems, that adversely impact, disable, or manipulate infrastructure, resulting in loss of service, contamination of finished water, or damage to infrastructure. b. No later than 30 days after receiving a report of a cybersecurity incident from a water purveyor pursuant to subsection a. of this section, the New Jersey Cybersecurity and Communications Integration Cell shall cause to be audited the water purveyor's cybersecurity program and any actions the water purveyor took in response to the cybersecurity incident. The audit shall identify cyber threats and vulnerabilities to the public community water system, weaknesses in the public community water system's cybersecurity program, and strategies to address those weaknesses so as to protect the public community water system from the threat of future cybersecurity incidents. Any audit shall be conducted by a qualified and independent cybersecurity company, at the water purveyor's expense. Following the audit, the water purveyor shall submit the audit and any corrective action plans derived from the audit to the New Jersey Cybersecurity and Communications Integration Cell. L.2021, c.262, s.4.

N.J. Stat. § 58:31-5 Violations; mitigation.

5. In addition to any other requirements in law, or any rule or regulation adopted pursuant thereto, whenever a water purveyor is issued , pursuant to section 10 of P.L.1977, c.224 (C.58:12A-10) , three notices of violation for any reason or two notices of violation related to an exceedance of a maximum contaminant level within any 12-month period, the water purveyor, within 60 days after receipt of the third or second notice, as applicable, shall submit to the department a mitigation plan specifying whether the notice of violation will be addressed through operational changes or require a capital expenditure and providing a schedule for implementation of the mitigation plan. The mitigation plan shall include a report prepared by the licensed operator of the public community water system and a professional engineer licensed pursuant to P.L.1938, c.342 (C.45:8-27 et seq.) that includes a technical analysis of the notices of violation and an explanation of how the mitigation plan submitted pursuant to this section is intended to prevent a recurrence of the issue that resulted in the notice of violation. Any capital expenditures required pursuant to this section shall be incorporated into the asset management plan required pursuant to section 7 of P.L.2017, c.133 (C.58:31-7). L.2017, c.133, s.5; amended 2021, c.262, s.13.

N.J. Stat. § 58:31-6 Additional certifications.

6. a. In addition to any other certifications required pursuant to law, rule, or regulation, the responsible corporate officer of the public community water system, if privately held, executive director, if an authority, or mayor or chief executive officer of the municipality, if municipally owned, as applicable, shall be required to certify in writing each year to the department and, if applicable, the board, in a form and manner as determined by the department, that the water purveyor complies with: all federal and State drinking water regulations, including water quality sampling, testing, and reporting requirements; the hydrant and valve requirements set forth in section 3 of P.L.2017, c.133 (C.58:31-3); the notice of violation mitigation plan requirements set forth in section 5 of P.L.2017, c.133 (C.58:31-5), if applicable; and the infrastructure improvement investment required pursuant to section 7 of P.L.2017, c.133 (C.58:31-7). A water purveyor shall post the annual certification required pursuant to this section on its Internet website, if applicable. b. The department shall audit, or cause to be audited, for compliance with the requirements of P.L.2017, c.133 (C.58:31-7 et seq.), any public community water system that fails to submit the certification required pursuant to subsection a. of this section in a timely manner. If the department finds that a water purveyor has made a false or misleading statement in a certification submitted pursuant to subsection a. of this section, the department shall forward the matter to the Attorney General for further investigation and, if necessary, criminal prosecution or other appropriate relief, pursuant to any applicable State or federal law, rule, or regulation. c. The department shall annually audit, or cause to be audited, for compliance with the requirements of P.L.2017, c.133 (C.58:31-7 et seq.) a random selection of at least 10 percent of all public community water systems in the State. d. The department may require a water purveyor to pay the cost of an audit ordered pursuant to this section. e. This section shall not be construed to abrogate or limit the review and fiscal oversight authority granted to the Division of Local Government Services in the Department of Community Affairs by the "Local Budget Law," N.J.S.40A:4-1 et seq., the "Local Fiscal Affairs Law," N.J.S.40A:5-1 et seq., the "Local Authorities Fiscal Control Law," P.L.1983, c.313 (C.40A:5A-1 et seq.), or any other law. L.2017, c.133, s.6; amended 2021, c.262, s.5.

N.J. Stat. § 58:31-7 Asset management plan; report.

7. a. Beginning no later than 18 months after the effective date of P.L.2017, c.133 (C.58:31-1 et seq.), every water purveyor shall implement an asset management plan designed to inspect, maintain, repair, and renew its infrastructure consistent with standards established by the American Water Works Association. The asset management plan shall include: (1) a water main renewal program designed to achieve a 150-year replacement cycle, or other appropriate replacement cycle as determined by a detailed engineering analysis of the asset condition and estimated service lives of the water mains serving the public community water system , or by the department ; (2) a water supply and treatment program designed to inspect, maintain, repair, renew, and upgrade wells, intakes, pumps, and treatment facilities in accordance with all federal and State regulations, standards established by the American Water Works Association, and any mitigation plan required pursuant to section 5 of P.L.2017, c.133 (C.58:31-5); and (3) any other programs, plans, or provisions as may be required by the department pursuant to rules and regulations adopted pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.). Each water purveyor shall dedicate adequate funds on an annual basis to address and remediate the highest priority projects as determined by its asset management plan. All asset management plans and system condition reports shall be certified to by the licensed operator or professional engineer of the public community water system and the responsible corporate officer of the public community water system, if privately held, executive director, if an authority, or mayor or chief executive officer of the municipality, if municipally owned, as applicable. The replacement cycle shall be determined by dividing the miles of water main located in the public community water system by 150 or other appropriate demonstration set forth in the certified asset management plan prepared pursuant to this section. b. No later than one year after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), and each year thereafter, each water purveyor shall provide to the department and the board, if applicable, a report based on its asset management plan prepared pursuant to subsection a. of this section identifying: (1) the infrastructure improvements completed in the past year and the cost of those improvements, including improvements funded by emergency and routine capital spending; (2) the infrastructure improvements generally planned to be undertaken in the next three years and the estimated cost of those improvements; and (3) the infrastructure improvements that may be required over the next 10 years and the estimated cost of those improvements. A report provided pursuant to this subsection by a municipality, county, or authority that is a water purveyor, is subject to the Local Authorities Fiscal Control Law, P.L.1983, c.313 (C.40A:5A-1 et seq.), and has a capital program extending beyond three years shall also identify infrastructure improvements to be undertaken pursuant to the asset management plan in the remaining years of the capital program, along with the actual or estimated cost of the improvements. Compliance with this subsection may be demonstrated through the submission of evidence of completion of a detailed, comprehensive planning study, facility master planning study, or other long range planning study that is intended for use in developing three- and ten-year capital improvement plans. A detailed comprehensive planning study, facility master planning study, or other long range planning study submitted pursuant to this subsection shall not be considered a government record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), and shall not be made available for public inspection. A municipal water department or municipal water authority shall also submit the report required pursuant to this subsection to the Division of Local Government Services in the Department of Community Affairs. A water purveyor shall, upon request, provide a copy of its asset management plan to the department, the board, or the Division of Local Government Services in the Department of Community Affairs. c. The department, the board, and the Department of Community Affairs shall create a centralized portal allowing for electronic submittal of the report required pursuant to subsection b. of this section. The lack of a centralized portal pursuant to this subsection shall not negate the requirement for a water purveyor to submit a report pursuant to subsection b. of this section. L.2017, c.133, s.7; amended 2021, c.262, s.6.

N.J. Stat. § 58:31-8 Asset management plan revision.

7. a. In addition to the requirements of section 7 of P.L.2017, c.133 (C.58:31-7), no later than 18 months after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), each water purveyor shall revise its asset management plan developed pursuant to section 7 of P.L.2017, c.133 (C.58:31-7) to include: (1) a comprehensive inventory, mapping, and evaluation of the condition of the public community water system's following asset classes: transmission and distribution piping, valves, service lines, hydrants, water treatment plant facilities, and water supply facilities including wells, reservoirs, and intakes; (2) level of service goals for the public community water system, based upon industry standards such as those established by the American Water Works Association, which may include, but need not be limited to, goals related to customer service and accountability, energy and water efficiency and conservation, water main breaks and service interruptions, and social and environmental considerations; (3) a priority order in which the public community water system's assets, identified in the comprehensive inventory prepared pursuant to paragraph (1) of this subsection, will be repaired or replaced as part of the water purveyor's asset management plan, based on each assets' importance to the proper function of the public community water system, or business risk exposure; and (4) a long-term funding strategy to implement the water purveyor's asset management plan, including funding sources and estimated annual expenditures to address prioritized repairs, upgrades, and treatment. b. The department shall, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), adopt rules and regulations to implement the requirements of this section. L.2021, c.262, s.7.

N.J. Stat. § 58:31-9 Penalties, remedies.

8. Any person who violates the provisions of P.L.2017, c.133 (C.58:31-1 et seq.), or any rule or regulation adopted pursuant thereto, shall be subject to the penalties and other remedies set forth in section 10 of P.L.1977, c.224 (C.58:12A-10). No later than 18 months after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), the department shall adopt, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), a schedule of civil administrative penalties to be applied pursuant to this section for specific violations of P.L.2017, c.133 (C.58:31-1 et seq.). L.2021, c.262, s.8.

N.J. Stat. § 58:31-10 Report card publication on website.

9. No later than one year after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), and annually thereafter, the department shall develop and publish on its Internet website a report card for each water purveyor in the State, indicating the water purveyor's compliance with federal and State drinking water quality standards, its compliance with the requirements of P.L.2017, c.133 (C.58:31-1 et seq.), and any other factors the department deems appropriate. The report card shall be designed to inform the public about the overall condition of a public community water system, and the quality of water coming from the public community water system. L.2021, c.262, s.9.

N.J. Stat. § 58:31-10.1 Public access, mitigation plan, certification, report, asset management, water purveyors.

1. a. The department shall publish on its Internet website, in an easily accessible format, and update as appropriate: (1) each mitigation plan submitted by a water purveyor pursuant to section 5 of P.L.2017, c.133 (C.58:31-5), if applicable; (2) each certification submitted by a water purveyor pursuant to section 6 of P.L.2017, c.133 (C.58:31-6); and (3) each report submitted by a water purveyor based on its asset management plan pursuant to subsection b. of section 7 of P.L.2017, c.133 (C.58:31-7). b. The department shall publish the documents required pursuant to subsection a. of this section no later than 30 days after receipt of the documents from a water purveyor. L.2023, c.44.

N.J. Stat. § 58:31-11 Report to the Governor.

10. No later than 18 months after the effective date of P.L.2021, c.262 (C.58:31-4.1 et al.), and every three years thereafter, the department shall prepare and submit a report to the Governor and, pursuant to section 2 of P.L.1991, c.164 (C.52:14-19.1), the Legislature assessing: a. the data submitted by public community water systems pursuant to subsections b. and c. of section 7 of P.L.2017, c.133 (C.58:31-7). The assessment shall include, but need not be limited to, an analysis of the total estimated cost of infrastructure improvements to public community water systems, Statewide, required over the next 10 years; and b. the compliance of public community water systems with the requirements of P.L.2017, c.133 (C.58:31-1 et seq.) and the rules and regulations adopted pursuant thereto. L.2021, c.262, s.10.

N.J. Stat. § 58:31-12 Rules, regulations.

11. The department and the board shall adopt, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), rules and regulations as are necessary to carry out the provisions of P.L.2017, c.133 (C.58:31-1 et seq.). L.2021, c.262, s.11.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://www.njleg.state.nj.us/legislative-activity/statutesFetched: 10/17/2026