Infrastructure security risk pilot

Full Title:
RESILIENCE Act of 2026

Summary#

This bill creates a one-year pilot program in which CISA will train State, local, Tribal, and territorial government officials to carry out security vulnerability and terrorism risk assessments of critical infrastructure. It also requires CISA to run one or more public clearinghouses that share voluntary security guidance and best practices for owners and operators of critical infrastructure. The bill aims to expand local capacity to assess risks and to make security guidance easier to find and use.

  • Pilot program: CISA must set up a one-year pilot within one year of enactment to train appropriate government officials. CISA must report to Congress within 180 days after the pilot ends.
  • Clearinghouses: CISA must maintain one or more clearinghouses to provide voluntary security guidance, best practices, and other materials to owners, operators, and some nonprofits. Materials must meet accessibility and plain‑language rules.
  • Annual outreach report: CISA must publish an annual report describing its outreach to owners/operators, including methods used and breakdowns by the 16 critical infrastructure sectors, urban/rural areas, regional offices, and channels like protective security advisors.
  • Paperwork Reduction Act exemption: The usual Paperwork Reduction Act review does not apply to rulemaking or information collection required under these new measures.
  • Civil rights preserved: The bill says it does not change or waive federal civil rights obligations (for example, Title II of the ADA or Title VI of the Civil Rights Act).
  • Definitions: The bill defines terms such as Agency (CISA), Department (DHS), Director, and nonprofit (501(c)(3) organizations that the Secretary determines are at risk of a terrorist attack).

What it means for you#

  • State, local, Tribal, and territorial officials: Some officials could get training from CISA to conduct security and terrorism risk assessments of critical infrastructure in their areas.
  • Owners and operators of critical infrastructure (businesses and utilities): They will have public access to a CISA-operated clearinghouse with guidance and best practices that are meant to be accessible and in plain language.
  • Nonprofit organizations: Certain nonprofits (those that are 501(c)(3) and that the Secretary determines are at risk of attack) may be included as audiences for clearinghouse materials. The bill does not specify how the Secretary will decide which nonprofits qualify.
  • CISA and DHS staff: CISA will need to design and run the pilot, maintain clearinghouse(s), and produce annual and pilot reports. This will require staff time and program resources.
  • General public: The bill increases public reporting about CISA outreach to critical infrastructure sectors and regions.
  • If you work for a local government or a critical infrastructure owner: You may be invited to participate in training or to use the clearinghouse resources, depending on CISA’s implementation choices.

Expenses#

No publicly available information.

  • The bill will likely require CISA to spend money and staff time to design and deliver the pilot, operate clearinghouse websites or platforms, and prepare the required reports.
  • Participating State, local, Tribal, and territorial officials may incur costs from travel or time away from other duties to take part in training.
  • The Paperwork Reduction Act exemption could speed up certain rulemakings or data collections and reduce some procedural costs, but the bill does not identify or authorize specific funding.
  • No fiscal note or specific funding amounts are included in the provided material.

Proponents' View#

  • The bill appears intended to build local capacity to identify and manage physical security vulnerabilities and terrorism risk at critical infrastructure facilities.
  • Supporters may argue that training more local officials creates a “force multiplier” by spreading assessment skills beyond federal personnel.
  • Making guidance and best practices available in one or more accessible clearinghouses could make it easier for owners and operators to find and use security information.
  • Annual public reporting could increase transparency about CISA’s outreach and help target future outreach by sector and region.

Opponents' View#

  • One concern is that the bill exempts certain rulemaking and information collection from the Paperwork Reduction Act, which removes a standard federal review process and public input step; critics may see this as reducing oversight of new data collections.
  • The bill does not specify funding. It is unclear whether CISA will get new appropriations or must reassign existing staff, which could limit implementation.
  • The definition of which nonprofits are “at risk of a terrorist attack” is left to the Secretary, and the bill does not describe the criteria or process for that decision. This raises questions about transparency and consistency.
  • The pilot lasts one year. It is unclear whether that is enough time to evaluate effectiveness or to scale successful practices.
  • The bill requires accessible and plain-language materials but does not detail enforcement or quality controls for the content that will be posted or aggregated in the clearinghouses.