Critical infrastructure and utilities laws by state

106 bills on critical infrastructure and utilities in 23 jurisdictions, 12 of them enacted in 2025 and 2026. The laws come first, with what each requires, then the bills that moved most recently.

  • 12 laws enacted in 2025 and 2026, in 8 states. Most: Maryland (4), Utah (2), California (1).
  • 106 bills in 23 jurisdictions, 49 of them in Congress. Latest action 23 October 2026.

Updated 2 November 2026LawsRecent billsBy state

Enacted in 2025 and 2026

12 laws, by state. Laws enacted before 2025 are not listed.

California

  • Enacted

    AB 979: California Cybersecurity Integration Center: artificial intelligence.

    The California Cybersecurity Integration Center must develop a California AI Cybersecurity Collaboration Playbook by January 1, 2027, in consultation with the Office of Information Security and the Government Operations Agency. The playbook must include mandatory information sharing mechanisms for state contractors and vendors providing artificial intelligence services regarding potential threats and vulnerabilities.

Colorado

  • Enacted

    HB 1252: Updates to State Emergency Response Departments & Divisions

    Reorganizes state emergency management functions by designating the Office of Emergency Management as the primary agency for disaster recovery coordination, creating a State Recovery Task Force, establishing protections for disaster survivor information, and relocating the auxiliary communications unit while updating related statutes and tribal affairs coordination requirements.

Louisiana

  • Enacted

    HB 1033: CRIME: Provides relative to the definition of "critical infrastructure"

    Expands the definition of 'critical infrastructure' in Louisiana law to include government facilities, military installations, and oil and gas exploration platforms, vehicles, and equipment with wireline equipment.

Maine

  • Enacted

    LD 2103: An Act Requiring Hospitals To Adopt Cybersecurity Plans

    Hospitals licensed under Maine law must adopt and submit a cybersecurity plan to the department and update it at least once per year. The plan must include provisions for timely notification of cybersecurity intrusions, backup communication, triage, service diversion, patient complaint processes, and cybersecurity training for employees and board members. Hospitals must annually test the plan.

Maryland

  • Enacted

    HB 1239: Public Safety - Critical Infrastructure Protection

    The Department of Emergency Management must coordinate consequence management efforts and respond to cascading impacts of attacks on the State's critical infrastructure in consultation with the Maryland Coordination and Analysis Center. The Department of Information Technology must allow critical infrastructure owners or operators to join the Maryland Information Sharing and Analysis Center and provide cybersecurity reporting standards.

    Took effect 1 July 2026

  • Enacted

    HB 593: Criminal Law - Interference With Critical Infrastructure or a Public Safety Answering Point

    A person may not intentionally, willfully, and without authorization commit acts that interrupt or impair critical infrastructure or public safety answering points, or that deny access to authorized users of such systems. A person may not intentionally, willfully, and without authorization access computers or possess ransomware with intent to interrupt operations of state government, utilities, health care facilities, or public schools.

    Took effect 1 October 2026

  • Enacted

    SB 482: Criminal Law - Interference With Critical Infrastructure or a Public Safety Answering Point

    A person may not intentionally and without authorization access, attempt to access, or exceed authorized access to computer systems or networks with intent to interrupt or impair functioning of critical infrastructure or public safety answering points. A person may not commit such acts that deny access to authorized users of or interrupt or impair critical infrastructure or public safety answering points.

    Took effect 1 October 2026

  • Enacted

    SB 871: Department of the Environment - Community Water and Sewerage Systems - Cybersecurity Planning and Assessments

    Community water system and community sewerage system providers serving over 3,300 customers or using information technology and operational technology must adopt cybersecurity standards meeting or exceeding federal CISA cross-sector goals, implement zero-trust cybersecurity approaches, and conduct annual third-party assessments by July 1, 2026. All such providers must appoint a cybersecurity point of contact and attend annual cybersecurity awareness trainings. All providers must report cybersecurity incidents to the State Security Operations Center.

    Took effect 1 October 2025

New Hampshire

  • Enacted

    SB 589: relative to port electrification, microgrid development, and cybersecurity standards for energy and water systems.

    Establishes a task force to report on transmission corridors, interstate trucking charging terminals, and port electrification by June 30, 2027; authorizes the department of energy to establish a microgrid pilot program; requires cybersecurity guidelines for distributed energy resources; and mandates cybersecurity protection programs for public water systems and wastewater facilities.

Utah

  • Enacted

    HB 165: Critical Infrastructure Amendments

    On or after July 1, 2026, governmental entities and critical infrastructure providers must not enter into or renew contracts for information and communications technology on the Cyber Center's prohibited list, nor place additional such technology into service, unless no reasonable alternative exists. Entities with access to critical infrastructure must not enter into agreements with foreign principals allowing remote access to or control of critical infrastructure.

    Took effect 6 May 2026

  • Enacted

    HB 19: Drinking Water Utilities Amendments

    Suppliers of community water systems must complete an emergency response plan by December 31, 2026 (for systems serving 3,300 or more) or July 1, 2027 (for smaller systems), and annually thereafter. Suppliers must report security breaches to the Utah Cyber Center within two hours of discovery. Emergency response plans must include cybersecurity training, software updates, network protection, secure authentication, vulnerability assessments, and manual operation capability.

    Took effect 6 May 2026

Virginia

  • Enacted

    SB 1239: Cybersecurity; electric service by investor-owned electric utilities, report.

    Requires the State Corporation Commission to convene a work group to evaluate cybersecurity related to electric service by investor-owned incumbent electric utilities and electric cooperatives, and to submit a written report with findings and recommendations to specified legislative committees by November 30, 2025.

Bills that moved most recently

The 25 open critical infrastructure and utilities bills with the latest action. The Cybersecurity Legislation Tracker follows all 106.

  • New York S 10724: Establishes the "rural water utility modernization and security act"

    What it would do: Requires rural water utilities serving 10,000 or fewer persons to implement a cybersecurity action plan including internet disconnection of control devices, firewalls, VPNs, password updates, and staff training. Mandates annual third-party vulnerability audits and 24-hour breach notification to state authorities.

    In committee

  • Congress S. 3315: Health Care Cybersecurity and Resiliency Act of 2026

    What it would do: Requires the HHS Secretary and CISA Director to coordinate on healthcare cybersecurity; mandates HHS develop a cybersecurity incident response plan within one year; updates breach reporting requirements; establishes minimum cybersecurity standards including multifactor authentication and encryption; authorizes grants for eligible health entities to adopt cybersecurity best practices through fiscal year 2030.

    Passed chamber

  • Congress H.R. 10671: Securing Our Critical Infrastructure Act

    In committee

  • Congress H.R. 7257: SECURE Grid Act

    What it would do: Amends the Energy Policy and Conservation Act to require States to include physical security, cybersecurity, and resilience of local distribution systems in their State energy security plans, and extends the deadline for such plans from 2025 to 2030.

    Passed chamber

  • Congress S. 4166: SECURE Grid Act

    What it would do: Amends the Energy Policy and Conservation Act to require States to include physical security, cybersecurity, and resilience of local distribution systems in State energy security plans, and mandates the Secretary of Energy provide assistance to States for implementing these requirements through September 30, 2031.

    Passed committee

  • Congress H.R. 10568: Protecting Biological Data as Critical Infrastructure Act

    In committee

  • Congress H.R. 10569: Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act

    In committee

  • Congress S. 3404: Satellite Cybersecurity Act of 2025

    What it would do: Requires the Comptroller General to study and report on Federal cybersecurity support for commercial satellite systems. Directs the Secretary of Commerce to establish a public cybersecurity clearinghouse and consolidate voluntary recommendations for satellite system security within 180 days.

    Passed chamber

  • Congress S. 5508: Telecommunications Cybersecurity and Resilience Act

    In committee

  • Congress S. 5548: Securing National Security Systems from Chinese Optical Transceivers Act of 2026

    In committee

  • Congress S. 4429: Connected Vehicle Security Act of 2026

    What it would do: Prohibits importation, manufacture, sale, resale, or introduction into interstate commerce of connected vehicles and related software and hardware from China, North Korea, Russia, and Iran beginning January 1, 2027, with hardware restrictions starting January 1, 2030, subject to limited exceptions and authorizations.

    Passed committee

  • Congress H.R. 10519: To direct the Secretary of Homeland Security, acting through the Director of the Cybersecurity and Infrastructure Security Agency, to establish a Critical Infrastructure AI Cyber Defense Pilot Program, and for other purposes.

    In committee

  • Congress H.R. 7625: MTS CYBER Act of 2026

    What it would do: Directs the Comptroller General to review the Coast Guard's budget, resources, and capabilities as a co-Sector Risk Management Agency for the marine transportation system within 270 days, and report findings to specified congressional committees.

    Passed committee

  • Congress H.R. 10151: Water Authority Cybersecurity Protection Act

    In committee

  • California SB 833: Critical infrastructure: artificial intelligence systems: human oversight.

    What it would do: Requires state agencies operating critical infrastructure to establish human oversight mechanisms for AI systems by July 1, 2026, conduct annual safety assessments, and report AI adverse events within specified timeframes, with civil penalties up to $500 per seven days for non-compliance.

    Passed chamber

  • Congress S. 5368: Water Cyber Shield Act of 2026

    In committee

  • Congress S. 5313: Quantum-GUARD Act of 2026

    In committee

  • Congress H.R. 9908: Rural Hospital Cybersecurity Enhancement Act

    In committee

  • Virginia HB 591: Data centers; policy of the Commonwealth.

    Passed chamber

  • Congress H.R. 7258: Energy Emergency Leadership Act

    What it would do: Amends the Department of Energy Organization Act to assign Assistant Secretaries responsibility for energy emergency and energy security functions, including infrastructure security, cybersecurity, emergency planning, and technical assistance to state, local, tribal, and energy sector entities upon request.

    Passed chamber

  • Congress H.R. 7266: Rural and Municipal Utility Cybersecurity Act

    What it would do: Amends the Infrastructure Investment and Jobs Act to reauthorize and maintain the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program, authorizing $250,000,000 for fiscal years 2026 through 2030 to provide grants, technical assistance, and prizes to eligible rural and municipal electric utilities for cybersecurity protection.

    Passed chamber

  • Congress H.R. 7305: Energy Threat Analysis Center Act of 2026

    What it would do: Amends the Infrastructure Investment and Jobs Act to reauthorize the Department of Energy's Energy Sector Operational Support for Cyberresilience Program through 2031, allowing establishment of an Energy Threat Analysis Center to enhance government-energy sector collaboration on threat analysis and mitigation.

    Passed chamber

  • Congress S. 4794: Precision Agriculture Cybersecurity Act

    In committee

  • Congress S. 4728: Combat Emerging Threats to Critical Infrastructure Act of 2026

    In committee

  • Michigan HB 6011: Businesses: other; cybersecurity requirements for large-scale solar energy facilities; provide for. Amends 2008 PA 295 (MCL 460.1001 - 460.1232) by adding sec. 112a.

    What it would do: Requires operators of large-scale solar energy facilities (50+ megawatts) to maintain risk-based cybersecurity and resilience programs aligned with national frameworks, implement incident response plans, and notify Michigan State Police and local emergency management within 24 hours of material cybersecurity incidents.

    In committee

Critical infrastructure and utilities laws, state by state

Questions

Which states have critical infrastructure and utilities laws?

States that enacted critical infrastructure and utilities laws in 2025 and 2026: Maryland (4), Utah (2), California (1), Colorado (1), Louisiana (1), Maine (1), New Hampshire (1) and Virginia (1). Laws enacted before 2025 are not listed here.

Which states have the most critical infrastructure and utilities bills?

Congress (49), Maryland (8), New Jersey (8), Michigan (5) and Texas (5). In all, 106 bills in 23 jurisdictions, the latest action on 23 October 2026.

What do critical infrastructure and utilities bills cover?

Security of utilities, water systems, energy, health care, telecommunications and other critical infrastructure. Each enacted law above has a line on what it requires.

Is this legal advice?

No. Which bills count as critical infrastructure and utilities bills, and the line on what each law requires or each bill would do, are drafted by software and not reviewed by an attorney. Every bill links to the legislature’s own record: read the text before relying on it. The list covers bills from the 2025 and 2026 sessions.

More in Cybersecurity Legislation

Follow critical infrastructure and utilities bills in every state

The Cybersecurity Legislation Tracker sends the bills that moved and a monthly report you can forward to a client.

Start free trialRead a monthly issue