IIB 
119TH CONGRESS 
1ST SESSION H. R. 5078 
IN THE SENATE OF THE UNITED STATES 
NOVEMBER 18, 2025 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to reauthorize 
the State and local cybersecurity grant program of the 
Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Information 
by Local Leaders for Agency Resilience Act’’ or the ‘‘PIL-
LAR Act’’. 
SEC. 2. REAUTHORIZATION OF CISA STATE AND LOCAL CY-
BERSECURITY GRANT PROGRAM. 
Section 2220A of the Homeland Security Act of 2002 
(6 U.S.C. 665g) is amended— 
(1) in subsection (a)— 
(A) by redesignating paragraphs (1), (2), 
(3), (4), (5), (6), and (7) as paragraphs (3), 
(4), (6), (8), (9), (10), and (11), respectively; 
(B) by inserting before paragraph (3), as 
so redesignated, the following new paragraphs: 
‘‘(1) ARTIFICIAL
INTELLIGENCE.—The term 
‘artificial intelligence’ has the meaning given such 
term in section 5002(3) of the National Artificial In-
telligence Initiative Act of 2020 (enacted as division 
E of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (15 
U.S.C. 9401(3))). 
‘‘(2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 
term ‘artificial intelligence system’ means any data 
system, software, hardware, application tool, or util-
ity that operates in whole or in part using artificial 
intelligence.’’; 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
(C) by inserting after paragraph (4), as so 
redesignated, the following new paragraph: 
‘‘(5) FOREIGN
ENTITY
OF
CONCERN.—The 
term ‘foreign entity of concern’ has the meaning 
given such term in section 10634 of the Research 
and Development, Competition, and Innovation Act 
(42 U.S.C. 19237; Public Law 117–167; popularly 
referred to as the ‘CHIPS and Science Act’).’’; and 
(D) by inserting after paragraph (6), as so 
redesignated, the following new paragraph: 
‘‘(7) MULTI-FACTOR
AUTHENTICATION.—The 
term ‘multi factor authentication’ means an authen-
tication system that requires more than one distinct 
type of authentication factor for successful authen-
tication of a user, including by using a multi-factor 
authenticator or by combining single-factor authen-
ticators that provide different types of factors.’’; 
(2) in subsection (b)(1), by striking ‘‘informa-
tion systems owned’’ and inserting ‘‘information sys-
tems or operational technology systems, including ei-
ther or both of such systems using artificial intel-
ligence, maintained, owned,’’; 
(3) in subsection (d)(4), by striking ‘‘to the in-
formation systems owned’’ and inserting ‘‘to the in-
formation systems or operational technology sys-
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
eligible entity, against cybersecurity risks 
and cybersecurity threats; 
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
on applications, user accounts, and infor-
mation systems and operational technology 
systems, including either or both of such 
systems using artificial intelligence, main-
tained, owned, or operated by, or on behalf 
of, the eligible entity or, if the eligible enti-
ty is a State, local governments within the 
jurisdiction of the eligible entity; 
‘‘(v) ensure that the eligible entity 
and, if the eligible entity is a State, local 
governments within the jurisdiction of the 
eligible entity, adopt and use best practices 
and methodologies to enhance cybersecu-
rity, particularly identity and access man-
agement solutions such as multi-factor au-
thentication, which may include— 
‘‘(I) the practices set forth in a 
cybersecurity framework developed by 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
the National Institute of Standards 
and Technology or the Agency; 
‘‘(II) cyber chain supply chain 
risk management best practices iden-
tified by the National Institute of 
Standards and Technology or the 
Agency; 
‘‘(III) knowledge bases of adver-
sary tools and tactics; 
‘‘(IV) technologies such as artifi-
cial intelligence; and 
‘‘(V) improving cyber incident re-
sponse capabilities through adoption 
of 
automated 
cybersecurity 
prac-
tices;’’; 
(II) in clause (x), by inserting 
‘‘or operational technology systems, 
including either or both of such sys-
tems using artificial intelligence,’’ 
after ‘‘information systems’’; 
(III) in clause (xi)(I), by insert-
ing ‘‘, including through Department 
of Homeland Security State, Local, 
and Regional Fusion Center Initiative 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
under section 210(A)’’ before the 
semicolon; 
(IV) in clause (xii), by inserting 
‘‘, including for bolstering the resil-
ience of outdated or vulnerable infor-
mation systems or operational tech-
nology systems, including either or 
both of such systems using artificial 
intelligence’’ before the semicolon; 
(V) by amending clause (xiii) to 
read as follows: 
‘‘(xiii) implement an information tech-
nology or operational technology, including 
either or both of such systems using artifi-
cial intelligence, modernization cybersecu-
rity review process that ensures alignment 
between 
information 
technology, 
oper-
ational technology, and artificial intel-
ligence cybersecurity objectives;’’; 
(VI) in clause (xiv)(II)— 
(aa) in item (aa), by striking 
‘‘and’’ after the semicolon; 
(bb) in item (bb), by insert-
ing ‘‘and’’ after the semicolon; 
and 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
(cc) by adding at the end 
the following new item: 
‘‘(cc) academic and non-
profit entities, including cyberse-
curity clinics and other nonprofit 
technical assistance programs;’’; 
and 
(VII) by amending clause (xv) to 
read as follows: 
‘‘(xv) ensure adequate access to, and 
participation in, the services and programs 
described in this subparagraph by rural 
areas and other local governments with 
small populations within the jurisdiction of 
the eligible entity, including by direct out-
reach to such rural areas and local govern-
ments with small populations; and’’; and 
(iii) in subparagraph (F)— 
(I) in clause (i), by striking 
‘‘and’’ after the semicolon; 
(II) by amending clause (ii) to 
read as follows: 
‘‘(ii) reducing cybersecurity risks to, 
and identifying, responding to, and recov-
ering from cybersecurity threats to, infor-
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
mation systems or operational technology 
systems, including either or both of such 
systems using artificial intelligence, main-
tained, owned or operated by, or on behalf 
of, the eligible entity or, if the eligible enti-
ty is a State, local governments within the 
jurisdiction of the eligible entity; and’’; and 
(III) by adding at the end the 
following new clause: 
‘‘(iii) assuming the cost or partial cost 
of cybersecurity investments made as a re-
sult of the plan.’’; and 
(B) in paragraph (3)(A), by striking ‘‘the 
Multi-State Information Sharing and Analysis 
Center’’ and inserting ‘‘Information Sharing 
and Analysis Organizations’’; 
(5) in subsection (g)— 
(A) in paragraph (2)(A)(ii), by inserting 
‘‘including, as appropriate, representatives of 
rural, suburban, and high-population jurisdic-
tions (including such jurisdictions with low or 
otherwise limited operating budgets)’’ before 
the semicolon; and 
(B) by amending paragraph (5) to read as 
follows: 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
‘‘(5) RULE OF CONSTRUCTION REGARDING CON-
TROL OF CERTAIN INFORMATION SYSTEMS OR OPER-
ATIONAL TECHNOLOGY SYSTEMS OF ELIGIBLE ENTI-
TIES.—Nothing in this subsection may be construed 
to permit a cybersecurity planning committee of an 
eligible entity that meets the requirements of this 
subsection to make decisions relating to information 
systems or operational technology systems, including 
either or both of such systems using artificial intel-
ligence, maintained, owned, or operated by, or on be-
half of, the eligible entity.’’; 
(6) in subsection (i)— 
(A) in paragraph (1)(B), by striking ‘‘2- 
year period’’ and inserting ‘‘3-year period’’; 
(B) in paragraph (3)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘2023’’ and insert-
ing ‘‘2027’’; and 
(ii) in subparagraph (B), by striking 
‘‘2023’’ and inserting ‘‘2027’’; and 
(C) in paragraph (4)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘shall’’ and insert-
ing ‘‘may’’; and 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
(ii) in subparagraph (A), by striking 
‘‘information systems owned’’ and insert-
ing ‘‘information systems or operational 
technology systems, including either or 
both of such systems using artificial intel-
ligence, maintained, owned,’’; 
(7) in subsection (j)(1)— 
(A) in subparagraph (D), by striking ‘‘or’’ 
after the semicolon; 
(B) in subparagraph (E)— 
(i) by striking ‘‘information systems 
owned’’ and inserting ‘‘information sys-
tems or operational technology systems, in-
cluding either or both of such systems 
using artificial intelligence, maintained, 
owned,’’; and 
(ii) by striking the period and insert-
ing a semicolon; and 
(C) by adding at the end the following new 
subparagraphs: 
‘‘(F) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that do not align with 
guidance relevant to such software or hardware, 
or products or services, as the case may be, pro-
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
vided by the Agency, including Secure by De-
sign or successor guidance; or 
‘‘(G) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that are designed, de-
veloped, operated, maintained, manufactured, or 
sold by a foreign entity of concern and do not 
align with guidance provided by the Agency.’’; 
(8) in subsection (l), in the matter preceding 
paragraph (1), by striking ‘‘2022’’ and inserting 
‘‘2026’’; 
(9) in subsection (m), by amending paragraph 
(1) to read as follows: 
‘‘(1) IN GENERAL.—The Federal share of ac-
tivities carried out using funds made available pur-
suant to the award of a grant under this section 
may not exceed— 
‘‘(A) in the case of a grant to an eligible 
entity, 60 percent for each fiscal year through 
fiscal year 2033; and 
‘‘(B) in the case of a grant to a multi-enti-
ty group, 70 percent for each fiscal year 
through fiscal year 2033. 
Notwithstanding subparagraphs (A) and (B), the 
Federal share of the cost for an eligible entity or 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
multi-entity group shall be 65 percent for an entity 
and 75 percent for a multi-group entity for each fis-
cal year beginning with fiscal year 2028 through fis-
cal year 2033 if such entity or multi-entity group 
entity, as the case may be, implements or enables, 
by not later than October 1, 2027, multi-factor au-
thentication and identity and access management 
tools that support multi-factor authentication with 
respect to critical infrastructure, including the infor-
mation systems and operational technology systems, 
including either or both of such systems using artifi-
cial intelligence, of such critical infrastructure, that 
is within the jurisdiction of such entity or multi-enti-
ty group is responsible.’’; 
(10) in subsection (n)— 
(A) in paragraph (2)— 
(i) in subparagraph (A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘a grant’’ and insert-
ing ‘‘a grant on or after January 1, 
2026, or changes the allocation of 
funding as permissible within the al-
lowances’’; and 
(II) by amending clauses (ii) and 
(iii) to read as follows: 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
‘‘(ii) with the consent of the local gov-
ernments, items, in-kind services, capabili-
ties, or activities, or a combination of fund-
ing and other services, having a value of 
not less than 80 percent of the amount of 
the grant; or 
‘‘(iii) with the consent of the local 
governments, grant funds combined with 
other items, in-kind services, capabilities, 
or activities, or a combination of funding 
and other services, having the total value 
of not less than 80 percent of the amount 
of the grant.’’; and 
(ii) in subparagraph (B), by amending 
clauses (ii) and (iii) to read as follows: 
‘‘(ii) items, in kind services, capabili-
ties, or activities, or a combination of fund-
ing and other services, having a value of 
not less than 25 percent of the amount of 
the grant awarded to the eligible entity; or 
‘‘(iii) grant funds combined with other 
items, in kind services, capabilities, or ac-
tivities, or a combination of funding and 
other services, having the total value of not 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
less than 25 percent of the grant awarded 
to the eligible entity.’’; and 
(B) by amending paragraph (5) to read as 
follows: 
‘‘(5) DIRECT FUNDING.—If an eligible entity 
does not make a distribution to a local government 
required under paragraph (2) within 60 days of the 
anticipated grant disbursement date, such local gov-
ernment may petition the Secretary to request the 
Secretary to provide funds directly to such local gov-
ernment.’’; 
(11) in subsection (o), in the matter preceding 
paragraph (1), by inserting ‘‘and representatives 
from rural areas and other local governments with 
small populations’’ after ‘‘governments’’; 
(12) by redesignating subsections (p) through 
(s) as subsections (q) through (t), respectively; 
(13) by inserting after subsection (o) the fol-
lowing new subsection: 
‘‘(p) OUTREACH
TO LOCAL GOVERNMENTS.—The 
Secretary, acting through the Director, shall implement an 
outreach plan to inform local governments, including those 
in rural areas or with small populations, about no-cost cy-
bersecurity service offerings available from the Agency.’’; 
(14) in subsection (r), as so redesignated— 
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS
HR 5078 RFS
(A) in paragraph (1)(A)— 
(i) in clause (i), by striking ‘‘and’’ 
after the semicolon; 
(ii) in clause (ii)— 
(I) by striking ‘‘information sys-
tems owned’’ and inserting ‘‘informa-
tion systems or operational technology 
systems, including either or both of 
such systems using artificial intel-
ligence, maintained, owned,’’; and 
(II) by striking the period and 
inserting ‘‘; and’’; and 
(iii) by adding at the end the fol-
lowing new clause: 
‘‘(iii) assuming the costs associated 
with continuing the programs specified in 
the Cybersecurity Plan by including such 
programs in State and local government 
budgets upon full expenditure of grant 
funds by the eligible entity.’’; 
(B) in paragraph (2)(E)(ii), by striking 
‘‘information systems owned’’ and inserting ‘‘in-
formation systems or operational technology 
systems, including either or both of such sys-
VerDate Sep 11 2014 
23:33 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5078.RFS
H5078
ssavage on LAPJG3WLY3PROD with BILLS