H.R. 7266: Rural and Municipal Utility Cybersecurity Act

This bill, known as the Rural and Municipal Utility Cybersecurity Act, seeks to enhance the cybersecurity measures for rural and municipal electric utilities. The key provisions of the bill are as follows:

Establishment of a Cybersecurity Program

The bill establishes a program aimed at providing technical assistance and funding to eligible rural and municipal utilities to help them protect against cybersecurity threats. This program is designed to support the deployment of advanced cybersecurity technologies and foster greater participation in cybersecurity information sharing.

Eligibility and Definition

Eligible entities for support under this program include:

• Rural electric cooperatives
• Electric utilities owned by political subdivisions of a state (such as municipally owned utilities)
• Electric utilities owned by agencies or authorities of political subdivisions
• Not-for-profit entities partnering with a minimum of six eligible entities
• Investor-owned electric utilities that sell less than 4,000,000 megawatt hours of electricity per year

Objectives of the Program

The primary objectives outlined in the bill are:

• To implement advanced cybersecurity technologies for electric utility systems
• To increase participation from eligible entities in sharing information about cybersecurity threats

Funding and Technical Assistance

The Secretary of the relevant department is tasked with providing technical assistance and awarding funds, including grants and cooperative agreements, to eligible entities. This funding may be awarded on both a competitive and non-competitive basis, prioritizing those entities that:

• Have limited cybersecurity resources
• Own assets critical to the reliability of the bulk-power system
• Operate or own defense critical electric infrastructure

Information Protection

Information shared under this program is considered voluntarily shared and is protected from disclosure under the Freedom of Information Act and related state laws, ensuring that sensitive information regarding cybersecurity does not become publicly accessible.

Authorization of Funding

The bill authorizes appropriations of $250,000,000 to be allocated to this program for the fiscal years 2026 through 2030, supporting its implementation and sustaining cybersecurity improvements for eligible utilities.

Relevant Companies

• AGR - Avangrid, Inc., a subsidiary of Iberdrola, provides electricity in the U.S. and may benefit from improved cybersecurity measures as mandated by this bill.
• DUK - Duke Energy Corporation is a major electric utility and may need to align its cybersecurity strategies with the provisions in the bill.
• EXC - Exelon Corporation operates utilities that could be directly affected by enhanced cybersecurity funding and requirements.