PILLAR Act

The "Protecting Information by Local Leaders for Agency Resilience Act," or PILLAR Act, reauthorizes and significantly amends the Cybersecurity and Infrastructure Security Agency's (CISA) State and Local Cybersecurity Grant Program. This legislation extends the program's authorization through fiscal year 2035, ensuring continued federal support for state and local cybersecurity efforts. It aims to enhance the resilience of critical infrastructure against evolving cyber threats by updating the program's focus and requirements. A key change is the expansion of the program's scope to explicitly cover **operational technology systems** and **artificial intelligence systems**. The bill introduces new definitions for terms such as "artificial intelligence," "artificial intelligence system," and "foreign entity of concern," reflecting a broader focus on emerging technologies and supply chain risks. Grant activities are updated to include managing, monitoring, and enhancing the resilience of these expanded system types, including legacy systems and those no longer supported by manufacturers. The legislation revises the federal cost-share for grants, setting it at 60 percent for single entities and 70 percent for multi-entity groups through FY2035. An increased federal share of 65 percent and 75 percent respectively is offered if entities implement **multi-factor authentication** and identity and access management tools for critical infrastructure by October 1, 2027. Furthermore, the bill prohibits the use of grant funds for software or hardware from **foreign entities of concern** that do not align with CISA guidance, or for products that do not align with CISA's "Secure by Design" guidance. Other notable amendments include extending the cybersecurity planning committee's term to three years and requiring CISA to implement an outreach plan to inform rural and small local governments about no-cost cybersecurity services. The bill also streamlines the process for local governments to directly petition the Secretary for funds if states fail to distribute grants promptly. Finally, it mandates a Government Accountability Office (GAO) review every four years, specifically including an assessment of **artificial intelligence** adoption across a sample of grants.