Rural and Municipal Utility Cybersecurity Act
Key claim: HR7266 reauthorizes through FY2030 DOE’s Rural and Municipal Advanced Cybersecurity Grant and Technical Assistance Program, allows noncompetitive awards, prioritizes operators as well as owners of defense critical electric infrastructure, and expands FOIA and state/tribal/local disclosure protections to all information shared under the program.
Abstract
(HR7266 · 119th Congress) Rural and Municipal Utility Cybersecurity Act This bill reauthorizes through FY2030 a program that provides cybersecurity-related assistance and funding to rural electric cooperatives and municipal or small, investor-owned electric utilities. The bill also revises methods of awarding support and expands protections for information shared under the program. This program, known as the Rural and Municipal Advanced Cybersecurity Grant and Technical Assistance Program, is administered by the Department of Energy (DOE). Current law requires DOE to provide technical assistance and funding under the program on a competitive basis; under the bill, assistance and funding may be provided on a competitive or noncompetitive basis. Current law also requires DOE to prioritize providing technical assistance and funding to certain entities, including entities that own defense critical electric infrastructure . The bill specifies that DOE must also prioritize entities that operate such infrastructure. (Defense critical electric infrastructure is electric infrastructure that (1) is located in the contiguous United States, and (2) serves a designated critical defense facility but is not owned or operated by the owner or operator of the critical facility.) Finally, the bill expands an existing protection against disclosure to cover all information shared under the program by or with the federal government or a state, tribal, or local government. This provision protects against disclosure under the Freedom of Information Act and other state, tribal, or local disclosure laws. Latest action (2026-07-13): Received in the Senate and Read twice and referred to the Committee on Energy and Natural Resources.
Why this matters
Rural cooperatives and municipal utilities are widely viewed as the softest cyber targets in the U.S. electric sector because they lack the compliance staff and budgets of investor-owned utilities. Reauthorizing DOE’s dedicated grant/technical-assistance program through FY2030 — with noncompetitive award authority and a broader FOIA shield — keeps a targeted federal funding channel open for OT/ICS defenses on defense-critical electric infrastructure, while the disclosure protections aim to reduce utilities’ legal risk when sharing vulnerability data with DOE.