6 U.S.C. § 665g — State and Local Cybersecurity Grant Program

(a) Definitions. (1) “Cybersecurity Plan” means a plan submitted by an eligible entity under subsection (e)(1). (2) “Eligible entity” means a State^* or Tribal government. (3) “Multi-entity group” means two or more eligible entities seeking a grant under this section. (4) “Online service” means any service exposed to the internet, including a website, email, virtual private network, or custom application. (5) “Rural area” has the meaning given in 49 U.S.C. § 5302; this section does not define it. (6) “State and Local Cybersecurity Grant Program” means the program established in subsection (b). (7) “Tribal government” means the recognized governing body of an Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation individually identified in the latest list published under 25 U.S.C. § 5131.

(b) Establishment. (1) The Department^* must have a program that awards grants to eligible entities to address cybersecurity risks and threats to information systems owned or operated by, or for, State, local, or Tribal governments. (2) An eligible entity seeking a grant must apply to the Secretary^* at the time, in the manner, and with the information the Secretary requires.

(c) Administration. The program must be run by the same Department office that administers grants under 6 U.S.C. §§ 604 and 605.

(d) Use of funds. An eligible entity receiving a grant, and a local government^* receiving grant money when appropriate, must use it to: (1) carry out the eligible entity’s Cybersecurity Plan; (2) create or revise that plan; (3) pay direct grant-administration costs, limited to 5 percent of the grant; (4) help address imminent cybersecurity threats to the eligible entity’s or a local government’s information systems when the Secretary, acting through the Director^*, confirms the threats; or (5) fund another appropriate activity the Secretary, acting through the Director, determines.

(e) Cybersecurity plans. (1) An applicant must submit a Cybersecurity Plan for review under subsection (i). (2) The plan must, as far as practicable: (A) include existing plans for protecting information systems owned or operated by, or for, State, local, or Tribal governments from cybersecurity risks and threats, and, if the eligible entity is a State, include consultation and feedback from local governments and associations of local governments within the eligible entity’s jurisdiction; (B) describe how the eligible entity will—(i) manage, monitor^*, and track information systems, applications, and user accounts owned or operated by, or for, the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, and the information technology used on those systems, including legacy systems and technology no longer supported by their manufacturer; (ii) monitor, audit, and track network traffic and activity going to, from, or through information systems, applications, and user accounts owned or operated by, or for, the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction; (iii) improve preparation, response, and resilience of information systems, applications, and user accounts owned or operated by, or for, the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, against cybersecurity risks and threats; (iv) continuously assess cybersecurity vulnerabilities and use threat-mitigation practices prioritized by risk on information systems, applications, and user accounts owned or operated by, or for, the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction; (v) ensure that the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, adopt and use cybersecurity best practices and methods, including the National Institute of Standards and Technology cybersecurity framework, NIST supply-chain risk-management best practices, and knowledge bases of adversary tools and tactics; (vi) promote safe, recognizable, and trustworthy online services by the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, including through the .gov internet domain; (vii) ensure that the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, can continue operating during a cybersecurity incident^*, including by practicing incident response; (viii) use NIST’s National Initiative for Cybersecurity Education Workforce Framework for Cybersecurity to identify and address cybersecurity-workforce gaps of the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction; improve recruitment and retention for those workforces; and strengthen the knowledge, skills, and abilities of personnel of the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, including through cybersecurity-hygiene training; (ix) if the eligible entity is a State, ensure that communications and data networks within its jurisdiction continue to connect the State and local governments within its jurisdiction during an incident involving those networks; (x) assess and mitigate, to the greatest extent possible, cybersecurity risks and threats involving critical infrastructure^* and key resources whose degradation could affect information systems within the eligible entity’s jurisdiction; (xi) improve the ability to share cyber-threat indicators and related information between the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction, including by expanding information-sharing agreements with the Department, and between the eligible entity and the Department; (xii) use cybersecurity services offered by the Department; (xiii) implement an information-technology and operational-technology modernization cybersecurity-review process that aligns information-technology and operational-technology cybersecurity objectives; (xiv) develop and coordinate strategies to address cybersecurity risks and threats in consultation with the eligible entity’s local governments and associations of local governments within its jurisdiction if the eligible entity is a State; as applicable, eligible entities neighboring the eligible entity’s jurisdiction or members of an Information Sharing and Analysis Organization^*; and countries neighboring the eligible entity’s jurisdiction; (xv) ensure adequate access to and participation by rural areas within the eligible entity’s jurisdiction in the services and programs described in this subparagraph; and (xvi) distribute funds, items, services, capabilities, or activities to local governments under subsection (n)(2)(A), including the portion the eligible entity plans to distribute to rural areas under subsection (n)(2)(B). (C) assess the eligible entity’s capabilities relating to the actions described in subparagraph (B); (D) describe, as appropriate and as far as practicable, the individual responsibilities of the eligible entity and local governments within the eligible entity’s jurisdiction in carrying out the plan; (E) outline, as far as practicable, the resources needed and a timeline for carrying out the plan; and (F) describe the measures the eligible entity will use to measure progress toward—(i) carrying out the plan; and (ii) reducing cybersecurity risks to, and identifying, responding to, and recovering from cybersecurity threats to, information systems owned or operated by, or for, the eligible entity and, if the eligible entity is a State, local governments within the eligible entity’s jurisdiction. (3) When drafting a Cybersecurity Plan, an eligible entity may consult the Multi-State Information Sharing and Analysis Center; include a description of cooperative programs developed by local-government groups within the eligible entity’s jurisdiction to address cybersecurity risks and threats; and include a description of programs provided by the eligible entity to support local governments and critical-infrastructure owners and operators in addressing cybersecurity risks and threats.

(f) Multi-entity grants. (1) The Secretary may award grants to a multi-entity group for joint efforts addressing cyber risks and threats to systems in the members’ jurisdictions. (2) Each member must have a plan reviewed under subsection (i) and a planning committee established under subsection (g). (3) The group must apply as the Secretary requires. Its application must include a project plan stating how responsibilities and grant money will be divided and how the members will work together to carry out each member’s plan.

(g) Planning committees. (1) A grant recipient must establish a cybersecurity planning committee to help develop, carry out, and revise its plan; approve the plan; and help set effective grant-funding priorities under subsections (d) and (j). (2) The committee must include representatives of the entity; if it is a State, counties, cities, and towns in the State; and public education and health institutions in the jurisdiction. When appropriate it must include rural, suburban, and high-population jurisdictions. (3) At least half its representatives must have professional cybersecurity or information-technology experience. (4) An entity need not create a new committee if it already uses a multijurisdictional committee or commission that meets these requirements or can be expanded or used to meet them, including through a cybersecurity subcommittee. (5) This subsection does not allow the committee to decide matters about the entity’s information systems.

(h) Tribal governments. For a requirement under (e) or (g), the Secretary may, after consulting the Interior Secretary and Tribal governments, set an alternative requirement that is substantively similar if necessary for effective delivery and administration of Tribal grants.

(i) Review of plans. (1) Before an entity may receive a grant, the Secretary, acting through the Director, must review its plan and revisions and determine whether they meet paragraph (2), subject to paragraph (3). An approval lasts two years from the determination date. Two years later and annually thereafter, the Secretary must decide whether the plan and revisions still meet paragraph (2) and renew the approval if they do. (2) The review must confirm that the plan meets subsection (e)(2) and has been approved by the entity’s subsection (g) committee and its Chief Information Officer, Chief Information Security Officer, or equivalent. (3) Despite subsection (e) and paragraph (1), before September 30, 2023, the Secretary could award a grant without prior plan review if the entity certified that the funded activities were integral to developing its plan or necessary for subsection (d)(4) activities as confirmed by the Director, and that it would submit a plan for review by September 30, 2023. (4) This subsection does not authorize the Secretary to regulate how an entity or local government improves its systems’ cybersecurity, or to condition a grant on joining a particular Federal program or using a particular product or technology.

(j) Limits on uses. A recipient may not use the grant to replace State or local money, make a required recipient cost-sharing contribution, pay a ransom, support recreation or social activities, or fund anything that does not address cyber risks or threats on covered systems. The Secretary may take necessary compliance actions. The ban on replacing State or local funds does not prohibit an otherwise allowed use merely because the government previously used its own State, local, or Tribal funds for the same or a similar use.

(k) Chance to amend. Before making final awards, the Secretary must give applicants a reasonable chance to fix application defects, including by revising a submitted plan.

(l) Apportionment. For fiscal year 2022 and each later year, the Secretary must first give 0.25 percent to each of American Samoa, the Northern Mariana Islands, Guam, and the U.S. Virgin Islands; 1 percent to each other State; and 3 percent to Tribal governments. The Secretary must divide the remainder among States: 50 percent according to each State’s share of the population of all States, and 50 percent according to each State’s share of the population living in rural areas of all States. For Tribal allocations, the Secretary must consult the Interior Secretary and Tribal governments. A State or Tribal government’s share of a multi-entity grant counts as its apportionment.

(m) Federal share. The Federal share of activity costs may not exceed, for a grant to an eligible entity, 90 percent in fiscal year 2022, 80 percent in 2023, 70 percent in 2024, or 60 percent in 2025; and, for a multi-entity grant, 100 percent in 2022, 90 percent in 2023, 80 percent in 2024, or 70 percent in 2025. The Secretary may waive or change these limits for demonstrated economic hardship and must publish hardship guidelines. The guidelines must consider changes in unemployment, changes in the percentage of people eligible for the supplemental nutrition assistance program under the Food and Nutrition Act of 2008, and other appropriate factors. After consulting the Interior Secretary and Tribal governments, the Secretary may waive or change the limits for one or more Tribal governments if doing so is in the public interest.

(n) Grantee responsibilities. (1) Each recipient must certify that the grant will be used for its awarded purpose and comply with (d) and (j). (2) Unless subparagraph (C) applies, within 45 days after receiving a grant, an eligible entity or multi-entity group must, without unreasonable or unduly burdensome conditions, obligate or make available to local governments, consistent with the applicable plans, at least 80 percent of grant funds, or items, services, capabilities, or activities worth at least 80 percent, or a combination worth at least 80 percent, with local-government consent where required. The entity must ensure rural areas receive at least 25 percent of the amount of the grant, or items, services, capabilities, or activities worth that amount, or a combination worth that amount. These requirements do not apply to a grant solely supporting plan development or revision, or to the District of Columbia, Puerto Rico, American Samoa, the Northern Mariana Islands, Guam, the U.S. Virgin Islands, or a Tribal government. (3) The recipient must certify that it made the required local distribution. (4) It may ask in writing for more time. The Secretary may approve an extension needed to align obligations and spending with the program’s purpose. (5) If an eligible entity does not distribute money to a local government on time, that local government may ask the Secretary to provide the money directly. (6) A grant may not buy land or construct, remodel, or alter buildings or other physical facilities. (7) An applicant must agree to consult its Chief Information Officer, Chief Information Security Officer, or equivalent when allocating grant funds. (8) Besides other remedies, if an entity violates this subsection, the Secretary may end or reduce its grant, or distribute its previously awarded funds as a replacement grant directly to the appropriate local government if the entity is a State, or to another Tribal government or governments if it is a Tribal government, in amounts the Secretary determines.

(o) Consultation. The Secretary must consult State, local, and Tribal representatives with professional cybersecurity experience, including representatives of government associations, about applicant and plan guidance, the risk-based-formula study, hardship guidelines, and modifications described in subsection (q)(2)(D).

(p) Congress. At least 3 business days before the Department announces a grant award, including notifying the recipient, the Secretary must notify the appropriate congressional committees^*.

(q) Reports, study, and review. (1)(A) No later than one year after receiving implementation money, and annually until one year after the money is spent or returned, an eligible entity—including one in a multi-entity group—must report to the Secretary, using its plan’s measures, its progress in carrying out the plan and in reducing risks and identifying, responding to, and recovering from threats to covered systems. (B) An entity without a plan must report one year after receiving funds and annually until one year after the funds are spent or returned, explaining how it obligated and spent money to develop or revise a plan or help with subsection (d)(4) activities. (2) At least annually, the Secretary acting through the Director must report to Congress on grant use, the share supporting rural cybersecurity, program effectiveness, needed program changes, and progress in developing, carrying out, or revising plans and reducing risks and handling threats to State, local, or Tribal government systems. (3) The Secretary acting through the Director must make each such report public, including on the Agency^* website. The Director may redact information, after consulting each eligible entity, to protect classified information or information exempt under 5 U.S.C. § 552, the “Freedom of Information Act.” (4) By September 30, 2024, the Secretary acting through the Director must submit to the appropriate congressional committees a study and legislative recommendations about using a risk-based formula. The study must address possible components and their effect on rural support, needed data, implementation obstacles including legislative obstacles, a recommended formula if used for fiscal year 2026, and other information needed to understand progress and obstacles. The Paperwork Reduction Act does not apply to actions under this paragraph. (5) Within two years after November 15, 2021, the Secretary acting through the Director must report to Congress on Tribal governments’ cybersecurity needs, determined with the Interior Secretary and Tribal governments, and recommendations for meeting those needs, including needed program changes. (6) Within three years after November 15, 2021, the Comptroller General must review the program, including the Secretary’s grant-selection process and a sample of grants.

(r) Appropriations. The authorized amounts are $200 million for fiscal year 2022, $400 million for 2023, $300 million for 2024, and $100 million for 2025. During a fiscal year, the Secretary or the Department component head administering the program may transfer up to 5 percent of those or other program appropriations to a Department account for salaries, expenses, and other management, administration, or evaluation costs. Those transferred funds are in addition to other appropriations for those costs.

(s) Termination. Subject to paragraph (2), this section ends September 30, 2026. The subsection (q) reporting requirements end one year after the final grant funds are spent or returned.