States must now plan for grid attacks—but Congress won't fund it

What it does

This bill amends federal energy law to require states to include plans for protecting local electric distribution systems (lines carrying power at lower voltages) against physical attacks, cyberattacks, and supply-chain risks in their state energy security plans. It also mandates that states consult with equipment suppliers when developing these plans, and requires the Government Accountability Office to report by 2030 on whether these state plans actually improve energy resilience.

Why we flagged it

The bill's operative mechanism is a planning and reporting requirement for state energy security, focused on identifying and mitigating physical, cyber, and supply-chain risks to local electric distribution systems. It is a regulatory mandate, not a subsidy or carve-out.

What the text implies

• Requirement to include equipment suppliers in state planning processes may create informal lobbying channels for vendors to influence state energy infrastructure decisions, though no direct procurement mandate is present.
• The 2031 sunset clause means the planning requirement expires unless Congress reauthorizes, creating potential for a gap in state energy security planning if reauthorization is delayed or blocked.
• GAO report (due 2030) will evaluate state plan efficacy, but the bill does not specify enforcement mechanisms if states fail to implement adequate plans or if plans prove ineffective.
• Inclusion of 'supply chain risks' language may incentivize states to favor domestic equipment suppliers over foreign competitors, potentially raising costs for utilities and consumers without explicit cost-benefit analysis.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill strengthens public infrastructure resilience by requiring states to plan for and mitigate threats to the electric grid that ordinary people depend on daily. It does not create new liabilities, subsidies, or carve-outs for private parties; instead, it mandates planning and accountability for critical infrastructure protection.

Who stands to gain

• Cybersecurity and physical security vendors (equipment and services)
• Grid modernization and resilience technology providers
• Consulting firms advising states on energy security planning

Named in the bill

Energy Policy and Conservation Act, State energy security plans, Local distribution systems, Electric utilities, Equipment suppliers, Department of Energy, Government Accountability Office, Senate Committee on Energy and Natural Resources, House Committee on Energy and Commerce

Where it stands

2 cosponsors: 1 Democrats, 1 Republicans.

• Mar 24, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Mar 24, 2026 — Referred to Senate Committee on Energy and Natural Resources · Congress.gov: “Read twice and referred to the Committee on Energy and Natural Resources”
• Sep 16, 2026 — Hearing held · Congress.gov: “Committee on Energy and Natural Resources. Hearings held”
• Sep 30, 2026 — Reported out of committee · Congress.gov: “Committee on Energy and Natural Resources. Ordered to be reported with an amendment in the nature of a…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 1 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $0 in lobbying spend. A filing names 7 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Catherine Cortez Masto, the sponsor, reported $298,634 in PAC receipts in the 2026 cycle.

• National Association of State Energy Officials — $0 on 1 filing

Lobbying Disclosure Act filings through Jul 17, 2026. A filing shows who paid to lobby on a bill it names, not what changed.