HR5078-119

What This Bill Does

H.R.5078, the PILLAR Act, would revise the State and Local Cybersecurity Grant Program under 6 USC 665g. It broadens specified provisions from owned information systems to maintained, owned or operated information and operational-technology systems, expressly including systems using artificial intelligence. Plans would address inventories, network monitoring, risk-prioritized continuous vulnerability assessments, identity and access management, automated response and coordinated IT/OT/AI modernization. It does not require every government to adopt AI. Existing practicability qualifications in the plan requirements remain relevant.

The House-passed text proposes federal shares of no more than 60% for individual eligible entities and 70% for multi-entity groups through FY2033. For FY2028-2033 it specifies 65% and 75% respectively when the entity or group implements or enables the specified multifactor-authentication and supporting identity/access tools for relevant critical infrastructure by October 1, 2027. This is a five-percentage-point incentive, not full federal funding. Existing hardship and Tribal waiver provisions are not repealed. The bill replaces the historical dollar authorization schedule with a statement that activities depend on available appropriations; it does not appropriate a new dollar amount.

Important current-law defect: its termination instruction still strikes 2025 to insert 2033. Public Law 119-75 section 5009 already changed the termination date to September 30, 2026. The old strike text is therefore absent. Although a 2033 horizon is plainly proposed, a working extension beyond current law requires reconciliation; future grant payments or MFA discounts cannot be treated as guaranteed by this stale instruction. H.R.5078 itself remains a proposal, last referred to Senate Homeland Security and Governmental Affairs on November 18, 2025 according to the official September 22, 2026 check.

Who Benefits and How

State and Tribal grantees would gain explicit scope to address operational technology and AI-enabled systems. Local governments with small populations and rural areas gain express outreach attention, including notice of no-cost CISA services. Localities could petition the Secretary for direct funds when a required distribution has not been made within 60 days of its anticipated disbursement date; this is a petition route, not automatic payment or a replacement of the existing 45-day distribution rule. The proposal preserves the 80% local pass-through and 25% rural share measured against the grant, not a new combined 105% distribution requirement. Local consent is still required for the specified in-kind substitutions in the general pass-through rule.

Academic cybersecurity clinics and nonprofit technical-assistance organizations gain explicit recognition in planning consultation. Eligible entities may consult Information Sharing and Analysis Organizations rather than only the specifically named Multi-State center. Neither provision awards these organizations contracts or grants. A longer three-year period for an approved plan determination offers administrative flexibility, but the separate requirement to begin renewal determinations after two years is unchanged, so the bill does not clearly eliminate year-two review.

Who Bears the Burden and How

DHS and CISA would administer broader plan criteria, procurement restrictions, outreach and grant reporting. State and Tribal recipients would document cybersecurity investments and progress toward sustaining programs through their own budgets after grant funds are spent. GAO would review selection, sampled grants and AI adoption within three years of enactment and every three years thereafter until termination. Recipients would retain nonfederal cost shares unless a waiver applies, and meeting the MFA incentive could require deployment costs. Those future incentive effects depend on a valid program extension and appropriations.

Grant money could not buy hardware, software or related products or services that fail applicable CISA guidance, including Secure by Design or successor guidance. Suppliers of nonconforming products could lose grant-funded sales; recipients face procurement screening. A separate foreign-entity-of-concern clause combines that supplier characteristic with failure to align with CISA guidance. It is not an unconditional ban on every product from every foreign supplier, and the broader guidance restriction already reaches nonconforming products regardless of origin. The bill creates no general market ban or new criminal penalty.

The text also changes the date for the limited pre-plan grant exception to September 30, 2027, restarts the apportionment wording at FY2026, expands in-kind pass-through wording and updates committee representation. It does not remove the existing exceptions to pass-through duties for specified jurisdictions, Tribal governments and plan-only grants. Its shall-to-may edit inside the negative rule of construction does not create new authority to compel use of a specific technology or federal program.

Key Provisions

• Expands covered cybersecurity planning and eligible-use language to operational technology and AI-enabled systems, including maintained systems.
• Requires stronger plan treatment of identity/access management, continuous assessments, modernization and rural or small-population outreach.
• Establishes proposed 60%/70% federal shares through FY2033 and conditional 65%/75% shares for FY2028-2033 with qualifying MFA tools by October 1, 2027, subject to the unresolved sunset and available funding.
• Prohibits grant-funded purchases that fail applicable CISA guidance without imposing a blanket foreign-product ban.
• Modifies pass-through options while retaining 80% local and 25% rural shares, consent conditions and existing exceptions; provides a 60-day direct-funding petition trigger.
• Requires recurring three-year GAO reviews and grant-recipient reporting on program sustainability after federal grant funds are exhausted.
• Proposes a 2033 sunset using obsolete 2025 strike text; current law instead terminates the program on September 30, 2026.