HR5078-119

What This Bill Does

The PILLAR Act updates section 2220A of the Homeland Security Act, the CISA State and Local Cybersecurity Grant Program. It adds definitions for artificial intelligence, artificial intelligence systems, foreign entities of concern, and multi-factor authentication. It expands the program from information systems alone to information systems and operational technology systems, including systems using artificial intelligence, that are maintained, owned, or operated by eligible entities or by local governments within a state.

The bill rewrites cybersecurity-plan uses to include managing applications, user accounts, legacy systems, unsupported technology, operational technology, and AI-enabled systems; monitoring network traffic; improving incident response; continuous vulnerability assessment; identity and access management such as multi-factor authentication; NIST or CISA cybersecurity frameworks; supply-chain risk management; adversary tactics knowledge bases; AI-related technologies; and automated cybersecurity practices. It allows academic entities, cybersecurity clinics, and nonprofit technical assistance programs to support grant work. It requires direct outreach to rural areas and local governments with small populations.

The bill changes program administration. It replaces a reference to the Multi-State Information Sharing and Analysis Center with Information Sharing and Analysis Organizations. It extends certain grant periods from two years to three years and keeps the program running through fiscal year 2033 subject to appropriations. The federal share may be up to 60 percent for eligible entities and 70 percent for multi-entity groups through 2033, with higher shares of 65 percent and 75 percent beginning in fiscal year 2028 if the entity implements multi-factor authentication and identity-and-access-management tools for critical infrastructure by October 1, 2027. It bars grant funds from purchasing software, hardware, products, or services that do not align with CISA guidance such as Secure by Design guidance, or that are designed, developed, operated, maintained, manufactured, or sold by a foreign entity of concern and do not align with CISA guidance. Local governments may petition the Secretary for direct funding if a required distribution is not made within 60 days of the anticipated disbursement date. GAO must review the program within three years and every three years until termination, including grant selection, a sample of grants, and AI adoption.

Who Benefits and How

State governments, local governments, rural local governments, small-population local governments, critical infrastructure operators under local jurisdiction, CISA, cybersecurity clinics, nonprofit technical assistance programs, domestic cybersecurity vendors, secure-by-design software vendors, identity-and-access-management vendors, multi-factor authentication vendors, Information Sharing and Analysis Organizations, and GAO cybersecurity reviewers benefit because the bill extends funding, broadens eligible system types, raises cost shares for MFA adoption, creates direct-funding leverage for local governments, and steers grants toward secure domestic technology and no-cost CISA services.

Who Bears the Burden and How

State cybersecurity offices, local government IT departments, rural local governments, small-population jurisdictions, CISA grant administrators, the DHS Secretary, the CISA Director, cybersecurity planning committees, foreign-entity-of-concern technology vendors, software vendors that do not align with CISA guidance, hardware vendors that do not align with CISA guidance, critical infrastructure owners, and GAO must comply with expanded plan content, operational-technology and AI reviews, Secure by Design purchasing restrictions, local funding-distribution rules, direct-petition procedures, outreach plans, federal-share conditions, state budget-sustainability requirements, and recurring GAO audits.

Key Provisions

• Extends the State and Local Cybersecurity Grant Program through fiscal year 2033 subject to appropriations.
• Defines artificial intelligence, artificial intelligence systems, foreign entities of concern, and multi-factor authentication.
• Expands grant planning from information systems to operational technology and AI-enabled systems.
• Requires cybersecurity plans to cover asset tracking, network monitoring, incident response, vulnerability assessment, MFA, supply-chain risk management, and automated cybersecurity practices.
• Bars grant purchases of nonsecure software or hardware that does not align with CISA guidance.
• Bars grant purchases from foreign entities of concern when products do not align with CISA guidance.
• Raises federal cost-share ceilings and provides higher shares for entities that implement MFA and identity-access tools for critical infrastructure by October 1, 2027.
• Requires local-government distributions, allows direct-funding petitions after a 60-day delay, and mandates rural no-cost-services outreach.
• Requires GAO reviews every three years, including AI adoption in sampled grants.