Federal cybersecurity funding expands for states and local governments through 2033

What it does

This bill reauthorizes and expands CISA's State and Local Cybersecurity Grant Program through fiscal year 2033. It broadens eligible uses of grant funds to include artificial intelligence systems and operational technology (not just traditional IT), adds new definitions and safeguards (including multi-factor authentication requirements for higher federal matching funds), requires outreach to rural and small-population jurisdictions, and allows local governments to petition for direct federal funding if states don't distribute grants within 60 days. The bill increases federal cost-sharing percentages and mandates GAO reviews of the program every three years.

Why we flagged it

The bill's core function is to reauthorize and expand an existing federal grant program for state and local cybersecurity. It is a straightforward infrastructure-funding measure with technical amendments to modernize eligible uses and improve equity in distribution.

What the text implies

• Multi-factor authentication requirement (by Oct 1, 2027) is a condition for higher federal matching funds (65–75% vs. 60–70%), creating a soft mandate that may strain smaller jurisdictions lacking technical capacity.
• Direct-funding petition mechanism (60-day trigger) may bypass state-level coordination and create administrative friction between state and local governments.
• GAO review mandate every three years through 2033 creates ongoing congressional oversight and potential for program modification or defunding based on AI adoption metrics.
• Expansion to 'artificial intelligence systems' and 'operational technology systems' is undefined beyond cross-reference to other statutes; implementation guidance from CISA will determine scope and eligible vendors.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

State and local governments—which operate critical infrastructure, schools, utilities, and emergency services—gain expanded federal funding, flexibility to address modern threats (AI, operational technology), and stronger accountability (GAO reviews, direct-funding petitions). Rural and small-population jurisdictions receive explicit outreach and inclusion, reducing digital divides. Citizens benefit from improved cybersecurity at the infrastructure and services they depend on.

Who stands to gain

• state and local governments (grant recipients)
• cybersecurity software and hardware vendors (indirect, through grant spending)
• nonprofit cybersecurity clinics and technical assistance providers

Named in the bill

CISA (Cybersecurity and Infrastructure Security Agency), Department of Homeland Security, National Institute of Standards and Technology (NIST), State and Local Fusion Centers, GAO (Government Accountability Office), Foreign entities of concern (defined by reference to Research and Development, Competition, and Inno

Where it stands

4 cosponsors: 2 Democrats, 2 Republicans.

• Sep 2, 2025 — Introduced · Congress.gov: “Introduced in House”
• Sep 2, 2025 — Referred to House Committee on Homeland Security and Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Referred to the Subcommittee on Cybersecurity and Infrastructure Protection”
• Sep 3, 2025 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
• Sep 3, 2025 — Reported out of committee · Congress.gov: “Ordered to be Reported by the Yeas and Nays: 21 - 1”
• Nov 17, 2025 — Passed the House · Congress.gov: “On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H4685-4687)”
• Nov 17, 2025 — Floor vote scheduled · Congress.gov: “Mr. Garbarino moved to suspend the rules and pass the bill, as amended”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

17 lobbying clients named this bill on 23 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $4,265,000 in lobbying spend. A filing names 7 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 96% of bills with at least one filing.

Andrew Ogles, the sponsor, reported $167,530 in PAC receipts in the 2026 cycle. $0 of that came from 1 PAC tied to these lobbying clients.

• Information Technology Industry Council — $1,440,000 on 2 filings
• Cisco Systems Inc — $850,000 on 1 filing
• Lenovo (united States) Inc. — $420,000 on 1 filing
• Crowdstrike, Inc. — $370,000 on 1 filing
• Tenable Inc — $330,000 on 2 filings

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.