Technical and procedural changes only. The two versions of H.R. 7266 are substantively identical, with v4 reflecting the bill as referred to the Senate after passing the House. There are no changes to the legislative text or policy provisions between v3 and v4.
Rural and Municipal Utility Cybersecurity Act
- Sponsor
- Rep. Miller-Meeks, Mariannette [R-IA-1]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Jul 13, 2026
Bottom line
H.R. 7266 extends a critical federal program designed to bolster the cybersecurity of smaller electric utilities, which are often resource-constrained, thereby strengthening the resilience of the nation's bulk-power system.
What it actually does
This bill reauthorizes and amends the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program, originally established under the Infrastructure Investment and Jobs Act. It expands the definition of 'eligible entity' to include investor-owned electric utilities selling less than 4,000,000 megawatt hours annually and authorizes $250,000,000 for the program for fiscal years 2027 through 2031. The program provides funding and technical assistance to small and rural electric utilities to enhance their cybersecurity defenses against threats to the electric grid.
Proponents argue
Proponents argue that the program is essential for protecting the nation's critical electric infrastructure, as smaller rural and municipal utilities often lack the resources and expertise to defend against sophisticated cyber threats. They contend that federal support ensures a more uniform and robust cybersecurity posture across the entire grid, preventing potential cascading failures from attacks on less-protected entities. The expansion of eligible entities is seen as a pragmatic step to include more vulnerable utilities.
Opponents contend
Opponents, if any, might argue that such grant programs can create dependency on federal funding rather than encouraging self-sufficiency in cybersecurity investments. Some might also raise concerns about the efficiency of federal grant distribution or the potential for bureaucratic overhead. However, specific organized opposition to cybersecurity grants for utilities is generally uncommon given the bipartisan consensus on grid security.
The bill is short and straightforward, allowing for a quick and comprehensive understanding of its provisions within the time typically allotted for legislative review.
Section 2, amending Section 40124(a) of the Infrastructure Investment and Jobs Act
Expanded Definition of Eligible Entity
This provision expands the types of electric utilities that can receive grants and technical assistance under the program. Previously, it focused on rural electric cooperatives, municipally owned utilities, and certain not-for-profit partnerships. The amendment adds investor-owned electric utilities that sell less than 4,000,000 megawatt hours of electricity per year, broadening the reach of the program to more small-to-medium sized utilities.
Supporters argue
Supporters argue that including smaller investor-owned utilities ensures that all vulnerable parts of the electric grid receive necessary cybersecurity support, regardless of their ownership structure. This holistic approach strengthens the entire bulk-power system.
Critics contend
No specific opposition is typically raised against expanding eligibility for cybersecurity programs, especially when targeting smaller entities. Any potential concern might revolve around diluting the available funds among more recipients, but the overall goal of enhanced security is widely supported.
Tradeoffs
The primary tradeoff is potentially spreading the authorized funding across a larger pool of eligible entities, which could mean less funding per entity if the overall appropriation does not increase proportionally. However, the benefit is a more comprehensive approach to grid security.
Section 2, amending Section 40124(b) of the Infrastructure Investment and Jobs Act
Program Reauthorization and Establishment
This section formally reauthorizes the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program. It directs the Secretary (of Energy) to maintain the program, providing technical assistance and awarding funding (grants, cooperative agreements, prizes) to eligible entities. The purpose remains to help these entities protect against, detect, respond to, and recover from cybersecurity threats.
Section 2, amending Section 40124(d)(2) of the Infrastructure Investment and Jobs Act
Priority for Funding and Technical Assistance
This provision directs the Secretary to prioritize eligible entities that have limited cybersecurity resources, own assets critical to the reliability of the bulk-power system, or own or operate defense critical electric infrastructure when providing technical assistance and awarding funding. This ensures that the most vulnerable and strategically important utilities receive attention first.
Information shared by or with federal, state, tribal, or local governments under the program is deemed voluntarily shared and exempt from disclosure under the Freedom of Information Act (FOIA) and similar state, tribal, or local open records laws.
Section 2, amending Section 40124(e) of the Infrastructure Investment and Jobs Act
Why it matters:This is standard legislative practice for information sharing programs related to critical infrastructure security. The intent is to encourage entities to share sensitive cybersecurity threat information without fear of it becoming public through disclosure laws, which could inadvertently aid adversaries or expose vulnerabilities.
Case for: Proponents argue that this FOIA exemption is crucial for fostering trust and encouraging robust information sharing among utilities and government agencies. Without such protection, utilities might be hesitant to share sensitive threat intelligence, hindering collective defense efforts against cyberattacks on the grid.
Case against: Critics of broad FOIA exemptions often argue that they reduce government transparency and accountability. While acknowledging the need for security, some may contend that such exemptions could be abused or prevent public oversight of how cybersecurity threats are managed and how federal funds are utilized, potentially shielding inefficiencies or missteps.
Estimated impact: This provision has a significant impact on the operational transparency of the program and the willingness of private entities to participate in information sharing. It directly affects the public's right to access certain government records related to cybersecurity threats and responses.