H.R. 5078 — PILLAR Act

This section amends the CISA State and Local Cybersecurity Grant Program (6 U.S.C. 665g), which provides grants to state, local, tribal, and territorial governments to protect against cybersecurity threats, by (1) adding definitions for "artificial intelligence" (cross-referencing 15 U.S.C. 9401(3)), "artificial intelligence system" (i.e., any data system, software, hardware, application tool, or utility operating in whole or in part using AI), "foreign entity of concern" (cross-referencing 42 U.S.C. 19237), and "multi-factor authentication" (i.e., an authentication system requiring more than one distinct type of authentication factor); (2) expanding the program's scope in subsections (b)(1), (d)(4), and (e)(2)(A)(i) from "information systems owned" to "information systems or operational technology systems, including either or both of such systems using artificial intelligence, maintained, owned"; and (3) revising permissible grant uses in subsection (e)(2)(B) to require managing, monitoring, auditing, and enhancing resiliency of such systems (including legacy systems unsupported by manufacturers); conducting continuous vulnerability assessments and threat mitigation; adopting best practices such as multi-factor authentication, NIST frameworks, supply chain risk management, AI technologies, and automated incident response; and other insertions to support fusion centers and resilience of outdated systems.