HR7266-119

What This Bill Does

The Rural and Municipal Utility Cybersecurity Act rewrites section 40124 of the Infrastructure Investment and Jobs Act. It keeps the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program and defines advanced cybersecurity technology, bulk-power system, cybersecurity threat, defense critical electric infrastructure, eligible entity, and the program itself.

Eligible entities include rural electric cooperatives, municipally owned electric utilities, utilities owned by state or local political subdivisions, not-for-profit partnerships with at least six such utilities, and investor-owned electric utilities selling less than 4,000,000 megawatt hours per year. The Secretary of Energy must provide technical assistance and award funding, including grants, cooperative agreements, and prizes, to help eligible entities protect against, detect, respond to, and recover from cybersecurity threats. DOE must develop award criteria, may enter agreements to advance the program's objectives, and must inform eligible entities about opportunities.

The bill prioritizes entities with limited cybersecurity resources, assets critical to bulk-power system reliability, or defense critical electric infrastructure. Information shared with federal, state, tribal, or local governments under the program is treated as voluntarily shared information and exempt from federal, state, tribal, and local public-disclosure laws. The bill authorizes $250,000,000 for fiscal years 2026 through 2030.

Who Benefits and How

Rural electric cooperatives benefit from grants, technical assistance, cooperative agreements, or prizes to deploy advanced cybersecurity technology. Municipally owned electric utilities benefit from the same support for cyber threat detection, response, and recovery. Small investor-owned electric utilities benefit if they fall below the 4,000,000 megawatt-hour threshold. Electric utilities with bulk-power or defense critical infrastructure benefit from funding priority. Cybersecurity technology vendors benefit from demand for hardware, software, services, and operational capabilities. State, tribal, and local government cybersecurity partners benefit from protected information sharing.

Who Bears the Burden and How

Department of Energy program staff must maintain the program, develop award criteria, inform eligible entities, administer funding, and manage agreements. Federal taxpayers bear the $250 million authorization if Congress appropriates the funds. Open-records requesters bear reduced access because shared cybersecurity information is exempt from FOIA and similar state, tribal, and local disclosure laws. Eligible utilities must apply for support, participate in information-sharing programs, and implement cybersecurity projects. State, tribal, and local records officials must treat covered information as exempt from disclosure.

Key Provisions

• Defines advanced cybersecurity technology, cybersecurity threat, eligible entity, and the rural utility cybersecurity program.
• Requires DOE to maintain a grant and technical assistance program for eligible electric utilities.
• Authorizes grants, cooperative agreements, prizes, and technical assistance.
• Requires DOE to develop award criteria and inform eligible entities about opportunities.
• Prioritizes utilities with limited cybersecurity resources, bulk-power system assets, or defense critical electric infrastructure.
• Exempts shared cybersecurity information from FOIA and similar open-records laws.
• Authorizes $250 million for fiscal years 2026 through 2030.