Technical corrections only. The two versions of H.R. 5078 are substantively identical, with the only differences being the procedural headers indicating passage in the House and referral to the Senate, and the attesting clerk. No substantive policy changes were made between v3 and v4.
PILLAR Act
- Sponsor
- Rep. Ogles, Andrew [R-TN-5]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Nov 18, 2025
Bottom line
The PILLAR Act aims to bolster state and local government cybersecurity defenses against evolving threats, including those posed by AI and OT, while encouraging the adoption of critical security measures like multi-factor authentication.
What it actually does
This bill, the PILLAR Act, reauthorizes and significantly amends the Cybersecurity and Infrastructure Security Agency's (CISA) State and Local Cybersecurity Grant Program. It expands the program's scope to explicitly include operational technology (OT) systems and artificial intelligence (AI) systems, introduces new definitions for AI and "foreign entities of concern," and modifies the federal cost-share requirements, offering incentives for multi-factor authentication (MFA) adoption. It also extends the program's authorization through fiscal year 2033 and enhances oversight.
Proponents argue
Supporters argue that the bill is crucial for modernizing state and local cybersecurity capabilities, especially given the increasing sophistication of cyber threats and the growing reliance on operational technology and artificial intelligence. They contend that expanding the grant program's scope and providing incentives for best practices like MFA will strengthen critical infrastructure resilience and protect sensitive government data from malicious actors, including foreign adversaries.
Opponents contend
Critics might express concerns about the potential for increased federal oversight or the administrative burden on smaller local governments to comply with new requirements or match federal funds. Some may also question the effectiveness of grant programs in driving fundamental cybersecurity improvements without more direct federal intervention or standardized mandates, or raise concerns about the definition and application of "foreign entity of concern" potentially limiting technology choices.
The bill is moderately complex due to its amendatory nature and technical language, requiring careful reading to understand the full scope of changes, which may exceed the time typically allotted for legislative review.
Section 2(1) (amending Section 2220A(a) of the Homeland Security Act of 2002)
Expansion of Definitions
This provision adds new definitions to the existing law, including "artificial intelligence," "artificial intelligence system," "foreign entity of concern," and "multi-factor authentication." These definitions are crucial for clarifying the expanded scope and new restrictions within the grant program, ensuring that federal funds are directed towards modern cybersecurity challenges and away from potentially risky foreign technologies, thereby providing a clearer framework for eligible activities and prohibited procurements under the reauthorized program.
Supporters argue
Supporters argue that these updated definitions are essential to ensure the grant program remains relevant and effective in addressing contemporary cybersecurity challenges, particularly those related to emerging technologies like AI and geopolitical risks associated with foreign entities.
Critics contend
No specific opposition is typically raised against definitional updates that clarify scope, though the "foreign entity of concern" definition could be contentious if it is perceived to unduly restrict market access or technology choices.
Tradeoffs
Balancing the need for clear, modern definitions with the potential for overly broad or restrictive language that could impact innovation or procurement flexibility.
Section 2(2), 2(3), 2(4)(A)(i), 2(4)(A)(ii)(I), 2(4)(A)(ii)(II), 2(4)(A)(ii)(IV), 2(4)(A)(ii)(V), 2(4)(A)(ii)(XII), 2(4)(A)(ii)(XIII), 2(4)(A)(iii)(II), 2(5)(B), 2(6)(C)(ii), 2(7)(B)(i), 2(9)(B), 2(14)(A)(ii)(I), 2(14)(B)
Inclusion of Operational Technology and AI Systems in Grant Scope
The bill repeatedly amends the existing law to explicitly include "operational technology systems" and "artificial intelligence systems" within the scope of the State and Local Cybersecurity Grant Program. This means grant funds can now be used to secure these types of systems, which were not explicitly covered before, reflecting the growing importance and vulnerability of industrial control systems and AI deployments in government operations, and ensuring a more comprehensive approach to cybersecurity funding.
Section 2(4)(A)(ii)(V) and Section 2(9)
Enhanced Cybersecurity Best Practices and MFA Mandate
This provision mandates that eligible entities adopt and use best practices, particularly identity and access management solutions like multi-factor authentication (MFA). It also introduces a higher federal cost-share (65% for single entities, 75% for multi-entity groups) for fiscal years 2028-2033 if MFA and supporting identity and access management tools are implemented for critical infrastructure by October 1, 2027. This financial incentive aims to accelerate the adoption of a critical security control across state and local government systems.
Section 2(7)(C)
Prohibition on Foreign Entities of Concern
This amendment prohibits the use of grant funds to purchase software, hardware, or related products/services that are designed, developed, operated, maintained, manufactured, or sold by a "foreign entity of concern" and do not align with Agency guidance. This aims to prevent federal funds from supporting technology from potentially hostile foreign adversaries, thereby bolstering the security of the supply chain for critical cybersecurity infrastructure used by state and local governments.
Section 2(16) and Section 2(14)(C)
Reauthorization and GAO Review Expansion
The bill extends the authorization for the State and Local Cybersecurity Grant Program from fiscal year 2025 to fiscal year 2033. Additionally, it mandates that the Government Accountability Office (GAO) conduct reviews of the program every three years, specifically including an assessment of artificial intelligence adoption across a sample of grants. This provides long-term stability for the program and enhances oversight, particularly concerning the integration of emerging technologies.
Section 2(10)
Changes to Local Government Distribution and Direct Funding
This section modifies the requirements for how states (eligible entities) distribute grant funds to local governments. It clarifies that distributions can include a combination of funding, in-kind services, or capabilities. Crucially, it allows local governments to petition the Secretary of Homeland Security for direct funding if an eligible entity (state) fails to distribute required funds within 60 days of the anticipated disbursement date, aiming to ensure equitable and timely access to resources for all local jurisdictions.
The Secretary, acting through the Director of CISA, shall implement an outreach plan to inform local governments, including those in rural areas or with small populations, about no-cost cybersecurity service offerings available from the Agency.
Section 2(13) (inserting new subsection (p))
Why it matters:Likely standard legislative practice for adding new, distinct directives rather than amending existing clauses, as it's a new programmatic requirement for CISA.
Case for: Supporters would argue that explicit outreach is necessary to ensure that smaller, rural local governments, which often lack dedicated cybersecurity staff or awareness of federal programs, are informed about available no-cost services from CISA. This promotes equitable access to resources and strengthens overall national cybersecurity.
Case against: No specific opposition, but some might argue that CISA already has outreach mechanisms and this adds an explicit, potentially redundant, mandate that could divert resources from direct technical assistance.
Estimated impact: Modest administrative cost for CISA to develop and implement the plan, but potentially significant impact on the cybersecurity posture of underserved local governments by increasing their access to federal resources.
Clarifies that nothing in the subsection permits a cybersecurity planning committee of an eligible entity to make decisions relating to information systems or operational technology systems, including either or both of such systems using artificial intelligence, maintained, owned, or operated by, or on behalf of, the eligible entity.
Section 2(5)(B) (amending Section 2220A(g)(5))
Why it matters:This is standard legislative practice for clarifying the intent and limits of a provision, ensuring that the creation of planning committees does not inadvertently grant them operational control over government systems.
Case for: Proponents would argue this clarifies that cybersecurity planning committees, while important for strategy, do not override the operational authority of eligible entities over their own information and operational technology systems, including AI systems. This preserves local control and accountability for system management.
Case against: No specific opposition, as it's a clarifying measure to prevent unintended consequences or jurisdictional disputes between planning bodies and operational IT/OT departments.
Estimated impact: Prevents potential jurisdictional disputes or confusion regarding operational control of cybersecurity systems, ensuring clear lines of authority within state and local governments.