RESILIENCE Act of 2026
- Sponsor
- Rep. Underwood, Lauren [D-IL-14]
- Committees
- Homeland Security Committee (primary)
- Last action
- Jul 22, 2026
Bottom line
The RESILIENCE Act aims to bolster national critical infrastructure security by expanding CISA's training capabilities to local officials and centralizing access to security resources for facility operators.
What it actually does
This bill establishes a one-year pilot program for the Cybersecurity and Infrastructure Security Agency (CISA) to train State, local, Tribal, and territorial government officials on conducting security vulnerability and terrorism risk assessments for critical infrastructure facilities. It also mandates CISA to maintain online clearinghouses for critical infrastructure owners and operators to access security guidance and best practices, and requires annual reports on CISA's outreach efforts to these stakeholders.
Proponents argue
Supporters argue that this bill will create a 'force multiplier' by empowering local officials with essential skills to assess and mitigate risks to critical infrastructure, thereby strengthening national security and resilience against terrorism and other threats. They contend that providing accessible, plain-language guidance through clearinghouses will improve preparedness across all sectors and geographic areas, fostering a more robust defense posture.
Opponents contend
Critics might argue that while the intent is positive, the pilot program's one-year duration may be too short to yield meaningful, scalable results, potentially leading to a fragmented approach rather than a cohesive national strategy. Some may also raise concerns about the potential for unfunded mandates on state and local entities or question the effectiveness of a clearinghouse without robust engagement mechanisms to ensure adoption of best practices.
The bill is concise and can be read quickly, allowing ample time for stakeholders to understand its provisions and implications.
Section 2(a)
CISA Critical Infrastructure Security Training Pilot Program
This provision directs the Cybersecurity and Infrastructure Security Agency (CISA) to create a one-year pilot program. Through this program, CISA will train State, local, Tribal, and territorial government officials on how to conduct security vulnerability and terrorism risk assessments for critical infrastructure facilities. After the pilot concludes, CISA must submit a report on the program's outcomes to the relevant Congressional committees.
Supporters argue
Supporters argue this program will significantly enhance national security by decentralizing and expanding expertise in critical infrastructure protection, making communities more resilient against threats. It leverages local knowledge and resources, creating a broader network of trained professionals capable of identifying and mitigating risks.
Critics contend
Some might argue that a one-year pilot program is insufficient to build lasting capacity or to thoroughly evaluate the effectiveness of such a broad training initiative, potentially leading to inconsistent application of standards or a lack of sustained impact without further commitment.
Tradeoffs
The tension lies between the immediate need to enhance local capabilities and the potential for a short pilot program to yield only temporary or limited results without sustained funding and expansion, raising questions about long-term impact.
Section 2(b)(1)
Establishment of CISA Critical Infrastructure Clearinghouses
This provision amends existing law to require CISA to establish and maintain one or more online clearinghouses. These clearinghouses will serve as central repositories where owners and operators of critical infrastructure, along with other relevant stakeholders including certain nonprofit organizations, can access security guidance, best practices, and other voluntary content. The content must be accessible to individuals with disabilities and written in plain language.
Section 2(b)(2)
Annual Report on CISA Critical Infrastructure Outreach
This provision requires the Director of CISA to publish an annual report detailing the agency's outreach efforts to critical infrastructure owners and operators regarding security guidance and best practices. The report must summarize outreach methods, frequency, and specific activities conducted across all 16 critical infrastructure sectors, in various geographic areas (rural, suburban, urban), by regional offices, and through protective security advisors. It also mandates the inclusion of detailed plans for expanding future outreach.
This section exempts any rulemaking or information collection required under this Act, specifically related to the pilot program or the new clearinghouse authority, from the requirements of the Paperwork Reduction Act (PRA).
Section 2(c)
Why it matters:This is a common legislative practice to streamline the implementation of new programs by reducing administrative hurdles associated with federal information collection requirements. It is generally intended to accelerate agency action rather than to be evasive.
Case for: Proponents would argue that this exemption allows CISA to rapidly implement the pilot program and establish the clearinghouses without delays caused by extensive PRA review processes, thereby accelerating critical security enhancements.
Case against: Critics might contend that exempting these activities from PRA review could reduce transparency and public input on how CISA collects and uses information, potentially leading to less efficient or less publicly accountable processes.
Estimated impact: Streamlines administrative processes for CISA, potentially saving time and resources in program implementation by bypassing a standard federal review process.
This section defines 'nonprofit organization' for the purpose of accessing the critical infrastructure clearinghouses as an organization described in 501(c)(3) of the Internal Revenue Code and, crucially, one that is 'determined by the Secretary to be at risk of a terrorist attack.'
Section 2(e)(4)
Why it matters:Placing definitions at the end is standard legislative practice. The specific condition is important for targeting resources to organizations with demonstrated needs, rather than being an evasive tactic.
Case for: Supporters would argue this ensures that limited resources and potentially sensitive security information are directed to nonprofit organizations that genuinely face a heightened risk of terrorist attack, maximizing the impact of the clearinghouse and prioritizing those most vulnerable.
Case against: Critics might express concern that the 'determined by the Secretary' clause introduces a subjective element that could lead to inconsistent application, potential for political influence, or the exclusion of deserving organizations if the criteria for 'at risk' are not transparent or sufficiently broad.
Estimated impact: Limits access to the critical infrastructure clearinghouse for nonprofits to only those specifically identified by the Secretary of Homeland Security as high-risk, affecting a subset of the broader nonprofit community.