IB 
Union Calendar No. 328 
119TH CONGRESS 
1ST SESSION H. R. 5078 
[Report No. 119–377] 
To amend the Homeland Security Act of 2002 to reauthorize the State 
and local cybersecurity grant program of the Cybersecurity and Infra-
structure Security Agency of the Department of Homeland Security, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 2, 2025 
Mr. OGLES (for himself, Mr. GARBARINO, Mr. SWALWELL, and Mr. EVANS 
of Colorado) introduced the following bill; which was referred to the Com-
mittee on Homeland Security 
NOVEMBER 12, 2025 
Additional sponsor: Mr. VINDMAN 
NOVEMBER 12, 2025 
Committed to the Committee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to reauthorize 
the State and local cybersecurity grant program of the 
Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security, and for other pur-
poses. 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Information 
by Local Leaders for Agency Resilience Act’’ or the ‘‘PIL-
LAR Act’’. 
SEC. 2. REAUTHORIZATION OF CISA STATE AND LOCAL CY-
BERSECURITY GRANT PROGRAM. 
Section 2220A of the Homeland Security Act of 2002 
(6 U.S.C. 665g) is amended— 
(1) in subsection (a)— 
(A) by redesignating paragraphs (1), (2), 
(3), (4), (5), (6), and (7) as paragraphs (3), 
(4), (6), (8), (9), (10), and (11), respectively; 
(B) by inserting before paragraph (3), as 
so redesignated, the following new paragraphs: 
‘‘(1) ARTIFICIAL
INTELLIGENCE.—The term 
‘artificial intelligence’ has the meaning given such 
term in section 5002(3) of the National Artificial In-
telligence Initiative Act of 2020 (enacted as division 
E of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (15 
U.S.C. 9401(3))). 
‘‘(2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 
term ‘artificial intelligence system’ means any data 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
system, software, hardware, application tool, or util-
ity that operates in whole or in part using artificial 
intelligence.’’; 
(C) by inserting after paragraph (4), as so 
redesignated, the following new paragraph: 
‘‘(5) FOREIGN
ENTITY
OF
CONCERN.—The 
term ‘foreign entity of concern’ has the meaning 
given such term in section 10634 of the Research 
and Development, Competition, and Innovation Act 
(42 U.S.C. 19237; Public Law 117–167; popularly 
referred to as the ‘CHIPS and Science Act’).’’; and 
(D) by inserting after paragraph (6), as so 
redesignated, the following new paragraph: 
‘‘(7) MULTI-FACTOR
AUTHENTICATION.—The 
term ‘multi factor authentication’ means an authen-
tication system that requires more than one distinct 
type of authentication factor for successful authen-
tication of a user, including by using a multi-factor 
authenticator or by combining single-factor authen-
ticators that provide different types of factors.’’; 
(2) in subsection (b)(1), by striking ‘‘informa-
tion systems owned’’ and inserting ‘‘information sys-
tems or operational technology systems, including ei-
ther or both of such systems using artificial intel-
ligence, maintained, owned, or’’; 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
agement solutions such as multi-factor au-
thentication, which may include— 
‘‘(I) the practices set forth in a 
cybersecurity framework developed by 
the National Institute of Standards 
and Technology or the Agency; 
‘‘(II) cyber chain supply chain 
risk management best practices iden-
tified by the National Institute of 
Standards and Technology or the 
Agency; 
‘‘(III) knowledge bases of adver-
sary tools and tactics; 
‘‘(IV) technologies such as artifi-
cial intelligence; and 
‘‘(V) improving cyber incident re-
sponse capabilities through adoption 
of 
automated 
cybersecurity 
prac-
tices;’’; 
(II) in clause (x), by inserting 
‘‘or operational technology systems, 
including either or both of such sys-
tems using artificial intelligence,’’ 
after ‘‘information systems’’; 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
(III) in clause (xi)(I), by insert-
ing ‘‘, including through Department 
of Homeland Security State, Local, 
and Regional Fusion Center Initiative 
under section 210(A)’’ before the 
semicolon; 
(IV) in clause (xii), by inserting 
‘‘, including for bolstering the resil-
ience of outdated or vulnerable infor-
mation systems or operational tech-
nology systems, including either or 
both of such systems using artificial 
intelligence’’ before the semicolon; 
(V) by amending clause (xiii) to 
read as follows: 
‘‘(xiii) implement an information tech-
nology or operational technology, including 
either or both of such systems using artifi-
cial intelligence, modernization cybersecu-
rity review process that ensures alignment 
between 
information 
technology, 
oper-
ational technology, and artificial intel-
ligence cybersecurity objectives;’’; 
(VI) in clause (xiv)(II)— 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
(aa) in item (aa), by striking 
‘‘and’’ after the semicolon; 
(bb) in item (bb), by insert-
ing ‘‘and’’ after the semicolon; 
and 
(cc) by adding at the end 
the following new item: 
‘‘(cc) academic and non-
profit entities, including cyberse-
curity clinics and other nonprofit 
technical assistance programs;’’; 
and 
(VII) by amending clause (xv) to 
read as follows: 
‘‘(xv) ensure adequate access to, and 
participation in, the services and programs 
described in this subparagraph by rural 
areas and other local governments with 
small populations within the jurisdiction of 
the eligible entity, including by direct out-
reach to such rural areas and local govern-
ments with small populations; and’’; and 
(iii) in subparagraph (F)— 
(I) in clause (i), by striking 
‘‘and’’ after the semicolon; 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
(II) by amending clause (ii) to 
read as follows: 
‘‘(ii) reducing cybersecurity risks to, 
and identifying, responding to, and recov-
ering from cybersecurity threats to, infor-
mation systems or operational technology 
systems, including either or both of such 
systems using artificial intelligence, main-
tained, owned or operated by, or on behalf 
of, the eligible entity or, if the eligible enti-
ty is a State, local governments within the 
jurisdiction of the eligible entity; and’’; and 
(III) by adding at the end the 
following new clause: 
‘‘(iii) assuming the cost or partial cost 
of cybersecurity investments made as a re-
sult of the plan.’’; and 
(B) in paragraph (3)(A), by striking ‘‘the 
Multi-State Information Sharing and Analysis 
Center’’ and inserting ‘‘Information Sharing 
and Analysis Organizations’’; 
(5) in subsection (g)— 
(A) in paragraph (2)(A)(ii), by inserting 
‘‘including, as appropriate, representatives of 
rural, suburban, and high-population jurisdic-
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
tions (including such jurisdictions with low or 
otherwise limited operating budgets)’’ before 
the semicolon; and 
(B) by amending paragraph (5) to read as 
follows: 
‘‘(5) RULE OF CONSTRUCTION REGARDING CON-
TROL OF CERTAIN INFORMATION SYSTEMS OR OPER-
ATIONAL TECHNOLOGY SYSTEMS OF ELIGIBLE ENTI-
TIES.—Nothing in this subsection may be construed 
to permit a cybersecurity planning committee of an 
eligible entity that meets the requirements of this 
subsection to make decisions relating to information 
systems or operational technology systems, including 
either or both of such systems using artificial intel-
ligence, maintained, owned, or operated by, or on be-
half of, the eligible entity.’’; 
(6) in subsection (i)— 
(A) in paragraph (1)(B), by striking ‘‘2- 
year period’’ and inserting ‘‘3-year period’’; 
(B) in paragraph (3)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘2023’’ and insert-
ing ‘‘2027’’; and 
(ii) in subparagraph (B), by striking 
‘‘2023’’ and inserting ‘‘2027’’; and 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
(C) in paragraph (4)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘shall’’ and insert-
ing ‘‘may’’; and 
(ii) in subparagraph (A), by striking 
‘‘information systems owned’’ inserting 
‘‘information systems or operational tech-
nology systems, including either or both of 
such systems using artificial intelligence, 
maintained, owned,’’; 
(7) in subsection (j)(1)— 
(A) in subparagraph (D), by striking ‘‘or’’ 
after the semicolon; 
(B) in subparagraph (E)— 
(i) by striking ‘‘information systems 
owned’’ and inserting ‘‘information sys-
tems or operational technology systems, in-
cluding either or both of such systems 
using artificial intelligence, maintained, 
owned,’’; and 
(ii) by striking the period and insert-
ing a semicolon; and 
(C) by adding at the end the following new 
subparagraphs: 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(E) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that do not align with 
guidance relevant to such software or hardware, 
or products or services, as the case may be, pro-
vided by the Agency, including Secure by De-
sign or successor guidance; or 
‘‘(F) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that are designed, de-
veloped, operated, maintained, manufactured, or 
sold by a foreign entity of concern and do not 
align with guidance provided by the Agency.’’; 
(8) in subsection (l), in the matter preceding 
paragraph (1), by striking ‘‘2022’’ and inserting 
‘‘2026’’; 
(9) in subsection (m), by amending paragraph 
(1) to read as follows: 
‘‘(1) IN GENERAL.—The Federal share of ac-
tivities carried out using funds made available pur-
suant to the award of a grant under this section 
may not exceed— 
‘‘(A) in the case of a grant to an eligible 
entity, 60 percent for each fiscal year through 
fiscal year 2035; and 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(B) in the case of a grant to a multi-enti-
ty group, 70 percent for each fiscal year 
through fiscal year 2035. 
Notwithstanding subparagraphs (A) and (B), the 
Federal share of the cost for an eligible entity or 
multi-entity group shall be 65 percent for an entity 
and 75 percent for a multi-group entity for each fis-
cal year beginning with fiscal year 2028 through fis-
cal year 2035 if such entity or multi-entity group 
entity, as the case may be, implements or enables, 
by not later than October 1, 2027, multi-factor au-
thentication and identity and access management 
tools that support multi-factor authentication with 
respect to critical infrastructure, including the infor-
mation systems and operational technology systems, 
including either or both of such systems using artifi-
cial intelligence, of such critical infrastructure, that 
is within the jurisdiction of such entity or multi-enti-
ty group is responsible.’’; 
(10) in subsection (n)— 
(A) in paragraph (2)— 
(i) in subparagraph (A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘a grant’’ and insert-
ing ‘‘a grant on or after January 1, 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
2026, or changes the allocation of 
funding as permissible within the al-
lowances of’’; and 
(II) by amending clauses (ii) and 
(iii) to read as follows: 
‘‘(ii) with the consent of the local gov-
ernments, items, in-kind services, capabili-
ties, or activities, or a combination of fund-
ing and other services, having a value of 
not less than 80 percent of the amount of 
the grant; or 
‘‘(iii) with the consent of the local 
governments, grant funds combined with 
other items, in-kind services, capabilities, 
or activities, or a combination of funding 
and other services, having the total value 
of not less than 80 percent of the amount 
of the grant.’’; and 
(ii) in subparagraph (B), by amending 
clauses (ii) and (iii) to read as follows: 
‘‘(ii) items, in kind services, capabili-
ties, or activities, or a combination of fund-
ing and other services, having a value of 
not less than 25 percent of the amount of 
the grant awarded to the eligible entity; or 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(iii) grant funds combined with other 
items, in kind services, capabilities, or ac-
tivities, or a combination of funding and 
other services, having the total value of not 
less than 25 percent of the grant awarded 
to the eligible entity.’’; and 
(B) by amending paragraph (5) to read as 
follows: 
‘‘(5) DIRECT FUNDING.—If an eligible entity 
does not make a distribution to a local government 
required under paragraph (2) within 60 days of the 
anticipated grant disbursement date, such local gov-
ernment may petition the Secretary to request the 
Secretary to provide funds directly to such local gov-
ernment.’’; 
(11) in subsection (o), in the matter preceding 
paragraph (1), by inserting ‘‘and representatives 
from rural areas and other local governments with 
small populations’’ after ‘‘governments’’; 
(12) by redesignating subsections (p) through 
(s) as subsections (q) through (t), respectively; 
(13) by inserting after subsection (o) the fol-
lowing new subsection: 
‘‘(p) OUTREACH
TO LOCAL GOVERNMENTS.—The 
Secretary, acting through the Director, shall implement an 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
outreach plan to inform local governments, including those 
in rural areas or with small populations, about no-cost cy-
bersecurity service offerings available from the Agency.’’; 
(14) in subsection (r), as so redesignated— 
(A) in paragraph (1)(A)— 
(i) in clause (i), by striking ‘‘and’’ 
after the semicolon; 
(ii) in clause (ii)— 
(I) by striking ‘‘information sys-
tems owned’’ inserting ‘‘information 
systems or operational technology sys-
tems, including either or both of such 
systems using artificial intelligence, 
maintained, owned,’’; and 
(II) by striking the period and 
inserting ‘‘; and’’; and 
(iii) by adding at the end the fol-
lowing new clause: 
‘‘(iii) assuming the costs associated 
with continuing the programs specified in 
the Cybersecurity Plan by including such 
programs in State and local government 
budgets upon full expenditure of grant 
funds by the eligible entity.’’; 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
(B) in paragraph (2)(E)(ii), by striking 
‘‘information systems owned’’ and inserting ‘‘in-
formation systems or operational technology 
systems, including either or both of such sys-
tems using artificial intelligence, maintained, 
owned’’; and 
(C) by amending paragraph (6) to read as 
follows: 
‘‘(6) GAO REVIEW.—Not later than four years 
after the date of the enactment of this paragraph 
and every four years thereafter until the termination 
of the State and Local Cybersecurity Grant Pro-
gram, the Comptroller General of the United States 
shall conduct a review of the Program, including re-
lating to the following: 
‘‘(A) The grant selection process of the 
Secretary. 
‘‘(B) A sample of grants awarded under 
this section. 
‘‘(C) A review of artificial intelligence 
adoption across the sample of grants re-
viewed.’’; 
(15) in subsection (s), as so redesignated, by 
amending paragraph (1) to read as follows: 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(1) IN GENERAL.—The activities under this 
section are subject to the availability of appropria-
tions.’’; and 
(16) in subsection (t), as so redesignated, in 
paragraph (1), by striking ‘‘2025’’ and inserting 
‘‘2035’’. 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS
Union Calendar No. 328 
119TH CONGRESS 
1ST SESSION 
H. R. 5078 
[Report No. 119–377] 
A BILL 
To amend the Homeland Security Act of 2002 to 
reauthorize the State and local cybersecurity 
grant program of the Cybersecurity and Infra-
structure Security Agency of the Department of 
Homeland Security, and for other purposes. 
NOVEMBER 12, 2025 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
00:54 Nov 13, 2025
Jkt 069200
PO 00000
Frm 00022
Fmt 6651
Sfmt 6651
E:\BILLS\H5078.RH
H5078
ssavage on LAPJG3WLY3PROD with BILLS