119TH CONGRESS 
1ST SESSION H. R. 5078 
AN ACT 
To amend the Homeland Security Act of 2002 to reauthorize 
the State and local cybersecurity grant program of the 
Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Information 
by Local Leaders for Agency Resilience Act’’ or the ‘‘PIL-
LAR Act’’. 
SEC. 2. REAUTHORIZATION OF CISA STATE AND LOCAL CY-
BERSECURITY GRANT PROGRAM. 
Section 2220A of the Homeland Security Act of 2002 
(6 U.S.C. 665g) is amended— 
(1) in subsection (a)— 
(A) by redesignating paragraphs (1), (2), 
(3), (4), (5), (6), and (7) as paragraphs (3), 
(4), (6), (8), (9), (10), and (11), respectively; 
(B) by inserting before paragraph (3), as 
so redesignated, the following new paragraphs: 
‘‘(1) ARTIFICIAL
INTELLIGENCE.—The term 
‘artificial intelligence’ has the meaning given such 
term in section 5002(3) of the National Artificial In-
telligence Initiative Act of 2020 (enacted as division 
E of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (15 
U.S.C. 9401(3))). 
‘‘(2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 
term ‘artificial intelligence system’ means any data 
system, software, hardware, application tool, or util-
ity that operates in whole or in part using artificial 
intelligence.’’;
(C) by inserting after paragraph (4), as so 
redesignated, the following new paragraph: 
‘‘(5) FOREIGN
ENTITY
OF
CONCERN.—The 
term ‘foreign entity of concern’ has the meaning 
given such term in section 10634 of the Research 
and Development, Competition, and Innovation Act 
(42 U.S.C. 19237; Public Law 117–167; popularly 
referred to as the ‘CHIPS and Science Act’).’’; and 
(D) by inserting after paragraph (6), as so 
redesignated, the following new paragraph: 
‘‘(7) MULTI-FACTOR
AUTHENTICATION.—The 
term ‘multi factor authentication’ means an authen-
tication system that requires more than one distinct 
type of authentication factor for successful authen-
tication of a user, including by using a multi-factor 
authenticator or by combining single-factor authen-
ticators that provide different types of factors.’’; 
(2) in subsection (b)(1), by striking ‘‘informa-
tion systems owned’’ and inserting ‘‘information sys-
tems or operational technology systems, including ei-
ther or both of such systems using artificial intel-
ligence, maintained, owned,’’; 
(3) in subsection (d)(4), by striking ‘‘to the in-
formation systems owned’’ and inserting ‘‘to the in-
formation systems or operational technology sys-
tems, including either or both of such systems using 
artificial intelligence, maintained, owned,’’; 
(4) in subsection (e)— 
(A) in paragraph (2)— 
(i) in subparagraph (A)(i), by striking 
‘‘information systems owned’’ and insert-
ing ‘‘information systems or operational 
technology systems, including either or 
both of such systems using artificial intel-
ligence, maintained, owned,’’; 
(ii) in subparagraph (B)— 
(I) by amending clauses (i) 
through (v) to read as follows: 
‘‘(i) manage, monitor, and track appli-
cations, user accounts, and information 
systems and operational technology sys-
tems, including either or both of such sys-
tems using artificial intelligence, that are 
maintained, owned, or operated by, or on 
behalf of, the eligible entity, or, if the eligi-
ble entity is a State, local governments 
within the jurisdiction of the eligible entity, 
and the information technology deployed 
on such information systems or operational 
technology systems (as the case may be),
including legacy information systems, oper-
ational technology systems, and informa-
tion technology that are no longer sup-
ported by the manufacturer of the systems 
or technology at issue; 
‘‘(ii) monitor, audit, and track net-
work traffic and activity transiting or trav-
eling to or from applications, user ac-
counts, and information systems and oper-
ational technology systems, including either 
or both of such systems using artificial in-
telligence, maintained, owned, or operated 
by, or on behalf of, the eligible entity or, 
if the eligible entity is a State, local gov-
ernments within the jurisdiction of the eli-
gible entity; 
‘‘(iii) enhance the preparation, re-
sponse, and resiliency of applications, user 
accounts, and information systems and 
operational technology systems, including 
either or both of such systems using artifi-
cial intelligence, maintained, owned, or op-
erated by, or on behalf of, the eligible enti-
ty or, if the eligible entity is a State, local 
governments within the jurisdiction of the
eligible entity, against cybersecurity risks 
and cybersecurity threats; 
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
on applications, user accounts, and infor-
mation systems and operational technology 
systems, including either or both of such 
systems using artificial intelligence, main-
tained, owned, or operated by, or on behalf 
of, the eligible entity or, if the eligible enti-
ty is a State, local governments within the 
jurisdiction of the eligible entity; 
‘‘(v) ensure that the eligible entity 
and, if the eligible entity is a State, local 
governments within the jurisdiction of the 
eligible entity, adopt and use best practices 
and methodologies to enhance cybersecu-
rity, particularly identity and access man-
agement solutions such as multi-factor au-
thentication, which may include— 
‘‘(I) the practices set forth in a 
cybersecurity framework developed by
the National Institute of Standards 
and Technology or the Agency; 
‘‘(II) cyber chain supply chain 
risk management best practices iden-
tified by the National Institute of 
Standards and Technology or the 
Agency; 
‘‘(III) knowledge bases of adver-
sary tools and tactics; 
‘‘(IV) technologies such as artifi-
cial intelligence; and 
‘‘(V) improving cyber incident re-
sponse capabilities through adoption 
of 
automated 
cybersecurity 
prac-
tices;’’; 
(II) in clause (x), by inserting 
‘‘or operational technology systems, 
including either or both of such sys-
tems using artificial intelligence,’’ 
after ‘‘information systems’’; 
(III) in clause (xi)(I), by insert-
ing ‘‘, including through Department 
of Homeland Security State, Local, 
and Regional Fusion Center Initiative
under section 210(A)’’ before the 
semicolon; 
(IV) in clause (xii), by inserting 
‘‘, including for bolstering the resil-
ience of outdated or vulnerable infor-
mation systems or operational tech-
nology systems, including either or 
both of such systems using artificial 
intelligence’’ before the semicolon; 
(V) by amending clause (xiii) to 
read as follows: 
‘‘(xiii) implement an information tech-
nology or operational technology, including 
either or both of such systems using artifi-
cial intelligence, modernization cybersecu-
rity review process that ensures alignment 
between 
information 
technology, 
oper-
ational technology, and artificial intel-
ligence cybersecurity objectives;’’; 
(VI) in clause (xiv)(II)— 
(aa) in item (aa), by striking 
‘‘and’’ after the semicolon; 
(bb) in item (bb), by insert-
ing ‘‘and’’ after the semicolon; 
and
(cc) by adding at the end 
the following new item: 
‘‘(cc) academic and non-
profit entities, including cyberse-
curity clinics and other nonprofit 
technical assistance programs;’’; 
and 
(VII) by amending clause (xv) to 
read as follows: 
‘‘(xv) ensure adequate access to, and 
participation in, the services and programs 
described in this subparagraph by rural 
areas and other local governments with 
small populations within the jurisdiction of 
the eligible entity, including by direct out-
reach to such rural areas and local govern-
ments with small populations; and’’; and 
(iii) in subparagraph (F)— 
(I) in clause (i), by striking 
‘‘and’’ after the semicolon; 
(II) by amending clause (ii) to 
read as follows: 
‘‘(ii) reducing cybersecurity risks to, 
and identifying, responding to, and recov-
ering from cybersecurity threats to, infor-
mation systems or operational technology 
systems, including either or both of such 
systems using artificial intelligence, main-
tained, owned or operated by, or on behalf 
of, the eligible entity or, if the eligible enti-
ty is a State, local governments within the 
jurisdiction of the eligible entity; and’’; and 
(III) by adding at the end the 
following new clause: 
‘‘(iii) assuming the cost or partial cost 
of cybersecurity investments made as a re-
sult of the plan.’’; and 
(B) in paragraph (3)(A), by striking ‘‘the 
Multi-State Information Sharing and Analysis 
Center’’ and inserting ‘‘Information Sharing 
and Analysis Organizations’’; 
(5) in subsection (g)— 
(A) in paragraph (2)(A)(ii), by inserting 
‘‘including, as appropriate, representatives of 
rural, suburban, and high-population jurisdic-
tions (including such jurisdictions with low or 
otherwise limited operating budgets)’’ before 
the semicolon; and 
(B) by amending paragraph (5) to read as 
follows:
‘‘(5) RULE OF CONSTRUCTION REGARDING CON-
TROL OF CERTAIN INFORMATION SYSTEMS OR OPER-
ATIONAL TECHNOLOGY SYSTEMS OF ELIGIBLE ENTI-
TIES.—Nothing in this subsection may be construed 
to permit a cybersecurity planning committee of an 
eligible entity that meets the requirements of this 
subsection to make decisions relating to information 
systems or operational technology systems, including 
either or both of such systems using artificial intel-
ligence, maintained, owned, or operated by, or on be-
half of, the eligible entity.’’; 
(6) in subsection (i)— 
(A) in paragraph (1)(B), by striking ‘‘2- 
year period’’ and inserting ‘‘3-year period’’; 
(B) in paragraph (3)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘2023’’ and insert-
ing ‘‘2027’’; and 
(ii) in subparagraph (B), by striking 
‘‘2023’’ and inserting ‘‘2027’’; and 
(C) in paragraph (4)— 
(i) in the matter preceding subpara-
graph (A), by striking ‘‘shall’’ and insert-
ing ‘‘may’’; and
(ii) in subparagraph (A), by striking 
‘‘information systems owned’’ and insert-
ing ‘‘information systems or operational 
technology systems, including either or 
both of such systems using artificial intel-
ligence, maintained, owned,’’; 
(7) in subsection (j)(1)— 
(A) in subparagraph (D), by striking ‘‘or’’ 
after the semicolon; 
(B) in subparagraph (E)— 
(i) by striking ‘‘information systems 
owned’’ and inserting ‘‘information sys-
tems or operational technology systems, in-
cluding either or both of such systems 
using artificial intelligence, maintained, 
owned,’’; and 
(ii) by striking the period and insert-
ing a semicolon; and 
(C) by adding at the end the following new 
subparagraphs: 
‘‘(F) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that do not align with 
guidance relevant to such software or hardware, 
or products or services, as the case may be, pro-
vided by the Agency, including Secure by De-
sign or successor guidance; or 
‘‘(G) to purchase software or hardware, or 
products or services of such software or hard-
ware, as the case may be, that are designed, de-
veloped, operated, maintained, manufactured, or 
sold by a foreign entity of concern and do not 
align with guidance provided by the Agency.’’; 
(8) in subsection (l), in the matter preceding 
paragraph (1), by striking ‘‘2022’’ and inserting 
‘‘2026’’; 
(9) in subsection (m), by amending paragraph 
(1) to read as follows: 
‘‘(1) IN GENERAL.—The Federal share of ac-
tivities carried out using funds made available pur-
suant to the award of a grant under this section 
may not exceed— 
‘‘(A) in the case of a grant to an eligible 
entity, 60 percent for each fiscal year through 
fiscal year 2033; and 
‘‘(B) in the case of a grant to a multi-enti-
ty group, 70 percent for each fiscal year 
through fiscal year 2033. 
Notwithstanding subparagraphs (A) and (B), the 
Federal share of the cost for an eligible entity or
multi-entity group shall be 65 percent for an entity 
and 75 percent for a multi-group entity for each fis-
cal year beginning with fiscal year 2028 through fis-
cal year 2033 if such entity or multi-entity group 
entity, as the case may be, implements or enables, 
by not later than October 1, 2027, multi-factor au-
thentication and identity and access management 
tools that support multi-factor authentication with 
respect to critical infrastructure, including the infor-
mation systems and operational technology systems, 
including either or both of such systems using artifi-
cial intelligence, of such critical infrastructure, that 
is within the jurisdiction of such entity or multi-enti-
ty group is responsible.’’; 
(10) in subsection (n)— 
(A) in paragraph (2)— 
(i) in subparagraph (A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘a grant’’ and insert-
ing ‘‘a grant on or after January 1, 
2026, or changes the allocation of 
funding as permissible within the al-
lowances’’; and 
(II) by amending clauses (ii) and 
(iii) to read as follows: