IC 

117TH CONGRESS 

2D SESSION S. 2520 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 18, 2022 

Referred to the Committee on Homeland Security 

AN ACT 

To amend the Homeland Security Act of 2002 to provide 

for engagements with State, local, Tribal, and territorial 

governments, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42PROD with BILLS
2 

S 2520 RFH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘State and Local Gov3 ernment Cybersecurity Act of 2021’’. 

4 SEC. 2. AMENDMENTS TO THE HOMELAND SECURITY ACT 

5 OF 2002. 

6 Subtitle A of title XXII of the Homeland Security 

7 Act of 2002 (6 U.S.C. 651 et seq.) is amended— 

8 (1) in section 2201 (6 U.S.C. 651), by adding 

9 at the end the following: 

10 ‘‘(7) SLTT ENTITY.—The term ‘SLTT entity’ 

11 means a domestic government entity that is a State 

12 government, local government, Tribal government, 

13 territorial government, or any subdivision thereof.’’; 

14 and 

15 (2) in section 2209 (6 U.S.C. 659)— 

16 (A) in subsection (c)(6), by inserting 

17 ‘‘operational and’’ before ‘‘timely’’; 

18 (B) in subsection (d)(1)(E), by inserting ‘‘, 

19 including an entity that collaborates with elec20 tion officials,’’ after ‘‘governments’’; and 

21 (C) by adding at the end the following: 

22 ‘‘(p) COORDINATION ON CYBERSECURITY FOR SLTT 

23 ENTITIES.— 

24 ‘‘(1) COORDINATION.—The Center shall, upon 

25 request and to the extent practicable, and in coordi26 nation as appropriate with Federal and non-Federal 


kjohnson on DSK79L0C42PROD with BILLS
3 

S 2520 RFH

1 entities, such as the Multi-State Information Shar2 ing and Analysis Center— 

3 ‘‘(A) conduct exercises with SLTT entities; 

4 ‘‘(B) provide operational and technical cy5 bersecurity training to SLTT entities to ad6 dress cybersecurity risks or incidents, with or 

7 without reimbursement, related to— 

8 ‘‘(i) cyber threat indicators; 

9 ‘‘(ii) defensive measures; 

10 ‘‘(iii) cybersecurity risks; 

11 ‘‘(iv) vulnerabilities; and 

12 ‘‘(v) incident response and manage13 ment; 

14 ‘‘(C) in order to increase situational aware15 ness and help prevent incidents, assist SLTT 

16 entities in sharing, in real time, with the Fed17 eral Government as well as among SLTT enti18 ties, actionable— 

19 ‘‘(i) cyber threat indicators; 

20 ‘‘(ii) defensive measures; 

21 ‘‘(iii) information about cybersecurity 

22 risks; and 

23 ‘‘(iv) information about incidents; 


kjohnson on DSK79L0C42PROD with BILLS
4 

S 2520 RFH

1 ‘‘(D) provide SLTT entities notifications 

2 containing specific incident and malware infor3 mation that may affect them or their residents; 

4 ‘‘(E) provide to, and periodically update, 

5 SLTT entities via an easily accessible platform 

6 and other means— 

7 ‘‘(i) information about tools; 

8 ‘‘(ii) information about products; 

9 ‘‘(iii) resources; 

10 ‘‘(iv) policies; 

11 ‘‘(v) guidelines; 

12 ‘‘(vi) controls; and 

13 ‘‘(vii) other cybersecurity standards 

14 and best practices and procedures related 

15 to information security, including, as ap16 propriate, information produced by other 

17 Federal agencies; 

18 ‘‘(F) work with senior SLTT entity offi19 cials, including chief information officers and 

20 senior election officials and through national as21 sociations, to coordinate the effective implemen22 tation by SLTT entities of tools, products, re23 sources, policies, guidelines, controls, and proce24 dures related to information security to secure 


kjohnson on DSK79L0C42PROD with BILLS
5 

S 2520 RFH

1 the information systems, including election sys2 tems, of SLTT entities; 

3 ‘‘(G) provide operational and technical as4 sistance to SLTT entities to implement tools, 

5 products, resources, policies, guidelines, con6 trols, and procedures on information security; 

7 ‘‘(H) assist SLTT entities in developing 

8 policies and procedures for coordinating vulner9 ability disclosures consistent with international 

10 and national standards in the information tech11 nology industry; and 

12 ‘‘(I) promote cybersecurity education and 

13 awareness through engagements with Federal 

14 agencies and non-Federal entities. 

15 ‘‘(q) REPORT.—Not later than 1 year after the date 

16 of enactment of this subsection, and every 2 years there17 after, the Secretary shall submit to the Committee on 

18 Homeland Security and Governmental Affairs of the Sen19 ate and the Committee on Homeland Security of the 

20 House of Representatives a report on the services and 


kjohnson on DSK79L0C42PROD with BILLS
6 

S 2520 RFH

1 capabilities that the Agency directly and indirectly pro2 vides to SLTT entities.’’. 

Passed the Senate January 11 (legislative day, January 10), 2022. 

Attest: SONCERIA ANN BERRY, 

Secretary. 


kjohnson on DSK79L0C42PROD with BILLS