---
kind: "section"
citation: "42 U.S.C. § 18725"
title: "42"
title_heading: "The Public Health and Welfare"
number: "18725"
heading: "Cybersecurity plan"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/42/18725"
units:
  - "Chapter 162 — Energy Infrastructure"
  - "Subchapter I — Grid Infrastructure and Resiliency"
  - "Part B — Cybersecurity"
---

# §18725. Cybersecurity plan

- (a) **In general—** The [Secretary](/usc/42/18701.md?p=3) may require, as the [Secretary](/usc/42/18701.md?p=3) determines appropriate, a recipient of any award or other funding under this division—
  - (1) to submit to the [Secretary](/usc/42/18701.md?p=3), prior to the issuance of the award or other funding, a cybersecurity plan that demonstrates the cybersecurity maturity of the recipient in the context of the [project](/usc/42/13641.md?p=2) for which that award or other funding was provided; and
  - (2) establish a plan for maintaining and improving cybersecurity throughout the life of the proposed solution of the [project](/usc/42/13641.md?p=2).
- (b) **Contents of cybersecurity plan—** A cybersecurity plan described in [subsection (a)](#a) shall, at a minimum, describe how the recipient described in that subsection—
  - (1) plans to maintain cybersecurity between networks, systems, devices, applications, or components—
    - (A) within the proposed solution of the [project](/usc/42/13641.md?p=2); and
    - (B) at the necessary external interfaces at the proposed solution boundaries;
  - (2) will perform ongoing evaluation of cybersecurity risks to address issues as the issues arise throughout the life of the proposed solution;
  - (3) will report known or suspected network or system compromises of the [project](/usc/42/13641.md?p=2) to the [Secretary](/usc/42/18701.md?p=3); and
  - (4) will leverage applicable cybersecurity [programs](/usc/42/18791.md?p=2) of the [Department](/usc/42/18701.md?p=1), including cyber vulnerability testing and security engineering evaluations.
- (c) **Additional guidance—** Each recipient described in [subsection (a)](#a) should—
  - (1) maximize the use of open guidance and standards, including, wherever possible—
    - (A) the Cybersecurity Capability Maturity Model of the [Department](/usc/42/18701.md?p=1) (or a successor model); and
    - (B) the Framework for Improving Critical Infrastructure Cybersecurity of the National Institute of Standards and Technology; and
  - (2) document—
    - (A) any deviation from open standards; and
    - (B) the utilization of proprietary standards where the recipient determines that such deviation necessary.
- (d) **Coordination—** The Office of Cybersecurity, Energy Security, and Emergency Response of the [Department](/usc/42/18701.md?p=1) shall review each cybersecurity plan submitted under [subsection (a)](#a) to ensure integration with [Department](/usc/42/18701.md?p=1) research, development, and demonstration [programs](/usc/42/18791.md?p=2).
- (e) **Protection of information—** Information provided to, or collected by, the Federal Government pursuant to this section the disclosure of which the [Secretary](/usc/42/18701.md?p=3) reasonably foresees could be detrimental to the physical security or cybersecurity of any electric utility or the bulk-power system—
  - (1) shall be exempt from disclosure under [section 552(b)(3) of title 5](/usc/5/552.md?p=b-3); and
  - (2) shall not be made available by any Federal [agency](/usc/42/8262.md?p=1), [State](/usc/42/18791.md?p=3), political subdivision of a [State](/usc/42/18791.md?p=3), or Tribal authority pursuant to any Federal, [State](/usc/42/18791.md?p=3), political subdivision of a [State](/usc/42/18791.md?p=3), or Tribal law, respectively, requiring public disclosure of information or records.

## Source credit

(Pub. L. 117–58, div. D, title I, § 40126, Nov. 15, 2021, 135 Stat. 956.)

## Notes

### Editorial Notes

### References in Text

This division, referred to in subsec. (a), is div. D of Pub. L. 117–58, Nov. 15, 2021, 135 Stat. 923, which enacted this chapter and enacted and amended numerous other sections and notes in the Code. For complete classification of div. D to the Code, see Tables.

### Statutory Notes and Related Subsidiaries

### Wage Rate Requirements

For provisions relating to rates of wages to be paid to laborers and mechanics on projects for construction, alteration, or repair work funded under div. D or an amendment by div. D of Pub. L. 117–58, including authority of Secretary of Labor, see section 18851 of this title.