Rural and Municipal Utility Cybersecurity Act
- Sponsor
- Sen. McCormick, David [R-PA]
- Committees
- Energy and Natural Resources Committee (primary)
- Last action
- Sep 30, 2026
Bottom line
The bill continues and expands a federal program to enhance cybersecurity for smaller electric utilities, providing funding and technical assistance while protecting shared threat information from public disclosure.
What it actually does
This bill reauthorizes and amends the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program established under the Infrastructure Investment and Jobs Act. It expands the definition of eligible entities to include certain small investor-owned electric utilities and not-for-profit partnerships, sets objectives for deploying advanced cybersecurity technologies and increasing information sharing, and authorizes $250,000,000 in appropriations for fiscal years 2027 through 2031. Crucially, it also exempts cybersecurity information shared under the program from public disclosure laws like the Freedom of Information Act.
Proponents argue
Supporters argue this bill is essential for strengthening the cybersecurity posture of critical infrastructure, particularly for smaller utilities that often lack the resources to defend against sophisticated cyber threats. By expanding eligibility and reauthorizing funding, the bill ensures these vulnerable entities can deploy advanced technologies and participate in vital threat information sharing, thereby safeguarding the nation's bulk-power system and defense critical electric infrastructure. The FOIA exemption is seen as necessary to encourage candid and timely sharing of sensitive threat intelligence.
Opponents contend
Critics might raise concerns about the transparency implications of exempting shared cybersecurity information from public disclosure, arguing it could reduce accountability and public oversight of critical infrastructure security. While direct opposition to cybersecurity funding is rare, some may question the scope of federal involvement, the efficiency of the grant distribution process, or whether the authorized funding is sufficient given the expanded eligibility and the scale of the cybersecurity challenge.
The bill is very short and straightforward, making it highly accessible for a reader to understand its provisions quickly.
Section 2, amending 40124(b) and (f)
Reauthorization and Funding for Cybersecurity Program
This provision reauthorizes the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program, ensuring its continuation. It also authorizes an appropriation of $250,000,000 for the program to operate from fiscal years 2027 through 2031. This funding is intended to provide grants and technical assistance to eligible electric utilities to protect against, detect, respond to, and recover from cybersecurity threats.
Supporters argue
Supporters argue that reauthorizing and funding this program is crucial for national security, as it directly addresses the cybersecurity vulnerabilities of smaller utilities that are vital components of the nation's energy infrastructure. The funding ensures these entities can acquire necessary technologies and expertise.
Critics contend
While direct opposition to cybersecurity funding is uncommon, some might argue about the overall level of federal spending or question if the authorized amount is optimally allocated given other national priorities.
Tradeoffs
The primary tension involves balancing federal spending priorities with the critical need to secure the nation's energy infrastructure against evolving cyber threats. It also involves determining the appropriate level of federal intervention versus local responsibility for cybersecurity.
Section 2, amending 40124(a)(5) and (d)
Expanded Eligibility and Prioritization for Awards
This provision expands the definition of 'eligible entity' to include investor-owned electric utilities that sell less than 4,000,000 megawatt hours of electricity per year, as well as not-for-profit entities partnered with at least six other eligible utilities. It also directs the Secretary to prioritize funding and technical assistance for eligible entities that have limited cybersecurity resources, own assets critical to the bulk-power system, or operate defense critical electric infrastructure.
Section 2, amending 40124(e)
Protection of Shared Cybersecurity Information
This provision stipulates that any cybersecurity information shared by or with federal, state, tribal, or local governments under this program will be considered voluntarily shared and exempt from disclosure under the Freedom of Information Act (FOIA) and similar state or local public records laws. This means such information cannot be requested or released to the public.
The definition of 'eligible entity' includes 'an investor-owned electric utility that sells less than 4,000,000 megawatt hours of electricity per year.'
Section 2, amending 40124(a)(5)(E)
Why it matters:It's standard legislative practice to define terms upfront, but the specific threshold for investor-owned utilities might not immediately stand out as a significant expansion of the program's scope.
Case for: Supporters argue that many smaller investor-owned utilities face similar cybersecurity resource challenges as rural cooperatives and municipal utilities, and their inclusion ensures a more comprehensive approach to securing the grid, regardless of ownership model.
Case against: Critics might argue that federal funds should primarily target public or cooperative entities, and that investor-owned utilities, even small ones, should rely on private investment or market mechanisms for cybersecurity improvements, potentially diverting resources from the program's original intent.
Estimated impact: This expands the pool of potential recipients for the $250 million in authorized funding, potentially increasing competition for grants and extending the program's reach to a broader segment of the electric utility sector.