I 
117TH CONGRESS 
1ST SESSION H. R. 4910 
To provide grants to assist States in developing and implementing plans 
to address cybersecurity threats or vulnerabilities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
AUGUST 3, 2021 
Mr. KILMER (for himself and Mr. MCCAUL) introduced the following bill; 
which was referred to the Committee on Homeland Security, and in addi-
tion to the Committee on Transportation and Infrastructure, for a period 
to be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee 
concerned 
A BILL 
To provide grants to assist States in developing and imple-
menting plans to address cybersecurity threats or 
vulnerabilities, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State Cyber Resiliency 
Act’’. 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
SEC. 2. ESTABLISHMENT OF STATE CYBER RESILIENCY 
GRANT PROGRAM. 
(a) ESTABLISHMENT.—There is established the State 
Cyber Resiliency Grant Program to assist State, local, and 
tribal governments in preventing, preparing for, protecting 
against, and responding to cyber threats, which shall be 
administered by the Administrator. 
(b) ELIGIBILITY.—Each State shall be eligible to 
apply for grants under the Program. 
(c) GRANTS AUTHORIZED FOR EACH STATE.—Sub-
ject to the funds available under a funding allocation de-
termined under subsection (f) for a State, the Secretary 
of Homeland Security may award to the State— 
(1) up to 2 planning grants under subsection 
(e) to develop or revise a cyber resiliency plan; and 
(2) up to 2 implementation grants under sub-
section (f) to implement an active cyber resiliency 
plan. 
(d) APPROVAL OF CYBER RESILIENCY PLANS.— 
(1) IN GENERAL.—The Secretary shall approve 
a cyber resiliency plan submitted by a State if the 
Secretary determines, after considering the rec-
ommendations of the Review Committee established 
under subsection (i), that the plan meets all of the 
following criteria: 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(A) The plan incorporates, to the extent 
practicable, any existing plans of such State to 
protect against cybersecurity threats or vulnera-
bilities. 
(B) The plan is designed to achieve each of 
the following objectives, with respect to the es-
sential functions of such State: 
(i) Enhancing the preparation, re-
sponse, and resiliency of computer net-
works, industrial control systems, and com-
munications systems performing such func-
tions against cybersecurity threats or vul-
nerabilities. 
(ii) Implementing a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices to 
prevent the disruption of such functions by 
an incident within the State. 
(iii) Ensuring that entities performing 
such functions within the State adopt gen-
erally recognized best practices and meth-
odologies with respect to cybersecurity, 
such as the practices provided in the cyber-
security framework developed by the Na-
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
tional Institute of Standards and Tech-
nology. 
(iv) Mitigating talent gaps in the 
State government cybersecurity workforce, 
enhancing recruitment and retention ef-
forts for such workforce, and bolstering the 
knowledge, skills, and abilities of State 
government personnel to protect against 
cybersecurity threats and vulnerabilities. 
(v) Protecting public safety answering 
points and other emergency communica-
tions and data networks from cybersecurity 
threats or vulnerabilities. 
(vi) Ensuring continuity of commu-
nications and data networks between enti-
ties performing such functions within the 
State, in the event of a catastrophic dis-
ruption of such communications or net-
works. 
(vii) Accounting for and mitigating, to 
the greatest degree possible, cybersecurity 
threats or vulnerabilities related to critical 
infrastructure or key resources, the deg-
radation of which may impact the perform-
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
ance of such functions within the State or 
threaten public safety. 
(viii) Providing appropriate commu-
nications capabilities to ensure cybersecu-
rity intelligence information sharing and 
the command and coordination capabilities 
among entities performing such functions. 
(ix) 
Developing 
and 
coordinating 
strategies with respect to cybersecurity 
threats or vulnerabilities in consultation 
with— 
(I) neighboring States or mem-
bers of an information sharing and 
analysis organization; and 
(II) as applicable, neighboring 
countries. 
(2) DURATION OF APPROVAL.— 
(A) 
INITIAL
DURATION.—An 
approval 
under paragraph (1) shall be initially effective 
for the 2-year period beginning on the date of 
the determination described in such paragraph. 
(B) ANNUAL EXTENSION.—The Secretary 
may annually extend such approval for a 1-year 
period, if the Secretary determines, after con-
sidering the recommendations of the Review 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
Committee, that the plan continues to meet the 
criteria described in paragraph (1) after the 
State makes such revisions as the Secretary 
may determine to be necessary. 
(3) ESSENTIAL FUNCTIONS.—For purposes of 
this subsection, the term ‘‘essential functions’’ in-
cludes, with respect to a State, those functions that 
enhance the cybersecurity posture of the State, local 
and tribal governments of the State, and the public 
services they provide. 
(e) PLANNING GRANTS.— 
(1) INITIAL PLANNING GRANT.—The Secretary 
shall require, as a condition of awarding an initial 
planning grant, that the State seeking the grant— 
(A) agrees to use the funds to develop a 
cyber resiliency plan designed to meet the cri-
teria described in subsection (d)(1); and 
(B) submits an application including such 
information as the Secretary may determine to 
be necessary. 
(2) 
ELIGIBILITY
FOR
INITIAL
PLANNING 
GRANT.—A State shall not be eligible to receive an 
initial planning grant after the date on which the 
State first submits a cyber resiliency plan to the 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
Secretary for a determination under subsection 
(d)(1). 
(3) ADDITIONAL PLANNING GRANT.—The Sec-
retary may award an additional planning grant to a 
State if the State agrees to use the funds to revise 
a cyber resiliency plan in order to receive an exten-
sion in accordance with subsection (d)(2)(B), and 
submits an application including such information as 
the Secretary may determine to be necessary. 
(4) LIMITATIONS ON NUMBER AND TIMING OF 
GRANTS.—A State shall not be eligible to receive— 
(A) more than 2 planning grants under 
this subsection; or 
(B) an additional planning grant for the 
fiscal year following the fiscal year for which it 
receives an initial planning grant. 
(f) IMPLEMENTATION GRANTS.— 
(1) APPLICATION
REQUIREMENTS.—The Sec-
retary shall require, as a condition of awarding a bi-
ennial implementation grant, that the State seeking 
the grant submits an application including the fol-
lowing: 
(A) A proposal, including a description and 
timeline, of the activities to be funded by the 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
grant as described by a cyber resiliency plan of 
the State approved under subsection (d). 
(B) A description of how each activity pro-
posed to be funded by the grant would achieve 
one or more of the objectives described in sub-
section (d)(1)(B). 
(C) A description, if applicable, of how any 
prior biennial implementation grant awarded 
under this section was spent, and to what ex-
tent the criteria described in subsection (d)(1) 
were met. 
(D) The share of any amounts awarded as 
a biennial implementation grant proposed to be 
distributed to local or tribal governments within 
such State. 
(E) Such other information as the Sec-
retary may determine to be necessary in con-
sultation with the chief information officer, 
emergency managers, and senior public safety 
officials of the State. 
(2) APPROVAL
OF
APPLICATION.—The Sec-
retary shall consider the recommendations of the Re-
view Committee in approving or disapproving an ap-
plication for a biennial implementation grant. 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(3) DISTRIBUTION TO LOCAL AND TRIBAL GOV-
ERNMENTS.— 
(A) IN GENERAL.—Not later than 45 days 
after the date that a biennial implementation 
grant is awarded, not less than 50 percent of 
any share proposed under paragraph (1)(D) 
shall be distributed to local or tribal govern-
ments, in the same manner that amounts 
awarded under section 2004 of the Homeland 
Security Act of 2002 (6 U.S.C. 605) are dis-
tributed to such governments, except that— 
(i) no such distribution may be made 
to a federally recognized Indian tribe that 
is a State under subsection (k)(11)(B); 
and 
(ii) in applying section 2004(c)(1) of 
such Act with respect to distributions 
under this subparagraph, ‘‘100 percent’’ 
shall be substituted for ‘‘80 percent’’ each 
place that term appears. 
(B) CONSULTATION.—In determining how 
an implementation grant is distributed within a 
State, the State shall consult with local and re-
gional chief information officers, emergency 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
managers, and senior public safety officials of 
the State. 
(4) COMPETITIVE AWARD.—Except as provided 
in subsection (h), biennial implementation grants 
shall be awarded— 
(A) exclusively on a competitive basis; and 
(B) based on the recommendations of the 
Review Committee. 
(5) LIMITATION ON NUMBER OF GRANTS.—The 
Secretary may award to a State not more than 2 bi-
ennial implementation grants under this section. 
(g) USE OF GRANT FUNDS.— 
(1) LIMITATIONS.—Any grant awarded under 
this section shall supplement and not supplant State 
or local funds or, as applicable, funds supplied by 
the Bureau of Indian Affairs, and may not be 
used— 
(A) to provide any Federal cost-sharing 
contribution on behalf of a State; or 
(B) for any recreational or social purpose. 
(2) APPROVED ACTIVITIES FOR IMPLEMENTA-
TION GRANTS.—A State or a government entity that 
receives funds through a biennial implementation 
grant may use such funds for one or more of the fol-
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
lowing activities, to the extent that such activities 
are proposed under subsection (f)(1)(A): 
(A) Supporting or enhancing information 
sharing and analysis organizations. 
(B) Implementing or coordinating systems 
and services that use cyber threat indicators (as 
such term is defined in section 102 of the Cy-
bersecurity Information Sharing Act of 2015 (6 
U.S.C. 1501)) to address cybersecurity threats 
or vulnerabilities. 
(C) Supporting dedicated cybersecurity 
and communications coordination planning, in-
cluding the coordination of— 
(i) emergency management elements 
of such State; 
(ii) National Guard units, as appro-
priate; 
(iii) entities associated with critical in-
frastructure or key resources; 
(iv) information sharing and analysis 
organizations; 
(v) public safety answering points; or 
(vi) nongovernmental organizations 
engaged in cybersecurity research as a for-
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
mally designated information analysis and 
sharing organization. 
(D) Establishing programs, such as schol-
arships or apprenticeships, to provide financial 
assistance to State residents who— 
(i) pursue formal education, training, 
and industry-recognized certifications for 
careers in cybersecurity as identified by the 
National Initiative for Cybersecurity Edu-
cation; and 
(ii) commit to working for State gov-
ernment for a specified period of time. 
(h) FUNDING ALLOCATIONS.— 
(1) IN
GENERAL.—From any amount appro-
priated for a fiscal year that is not reserved for use 
by the Secretary in carrying out this section, the 
Secretary shall allocate the entire amount among the 
States (including the District of Columbia) eligible 
for grants under this section taking into consider-
ation the factors specified in paragraph (2) and con-
sistent with the following: 
(A) ALLOCATIONS
FOR
THE
SEVERAL 
STATES.—Of the amount subject to allocation, 
a funding allocation for any of such States shall 
be— 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(i) not less than 0.001 percent, with 
respect to an initial planning grant, and 
not more than 0.001 percent, with respect 
to any additional planning grants; and 
(ii) not less than 0.5 percent and not 
more than 3 percent, with respect to bien-
nial implementation grants. 
(B) ALLOCATIONS FOR THE TERRITORIES 
AND POSSESSIONS.—Of the amount subject to 
allocation, a funding allocation for any of the 
territories and possessions of the United States 
eligible for grants under this section shall be— 
(i) not less than 0.001 percent, with 
respect to an initial planning grant, and 
not more than 0.001 percent, with respect 
to any additional planning grant; and 
(ii) not less than 0.1 percent and not 
more than 1 percent, with respect to bien-
nial implementation grants. 
(2) CONSIDERATIONS
FOR
FUNDING
ALLOCA-
TIONS.—In determining a funding allocation under 
paragraph (1) for a State, the Secretary shall con-
sider each of the following factors: 
(A) The considerations described in section 
1809(h)(1) of the Homeland Security Act of 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(i) REVIEW COMMITTEE
FOR CYBER RESILIENCY 
GRANTS.— 
(1) ESTABLISHMENT.—There is established a 
committee to be known as the ‘‘Review Committee 
for Cyber Resiliency Grants’’ (in this section re-
ferred to as the ‘‘Review Committee’’). 
(2) CONSIDERATION
OF
SUBMISSIONS.—The 
Secretary shall forward a copy of each cyber resil-
iency plan submitted for approval under subsection 
(d)(1), each application for an additional planning 
grant submitted under subsection (e)(3), and each 
application for a biennial implementation grant sub-
mitted under subsection (d)(1) to the Review Com-
mittee for consideration under this subsection. 
(3) DUTIES.—The Review Committee shall— 
(A) promulgate guidance for the develop-
ment of applications for grants under this sec-
tion; 
(B) review any plan or application for-
warded under paragraph (2); 
(C) provide to the State and to the Sec-
retary the recommendations of the Review Com-
mittee regarding the approval or disapproval of 
such plan or application and, if applicable, pos-
sible improvements to such plan or application; 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(D) provide to the Secretary an evaluation 
of any progress made by a State in imple-
menting an active cyber resiliency plan using a 
prior biennial implementation grant; and 
(E) submit to Congress an annual report 
on the progress made in implementing active 
cyber resiliency plans. 
(4) MEMBERSHIP.— 
(A) NUMBER
AND
APPOINTMENT.—The 
Review Committee shall be composed of 15 
members appointed by the Secretary as follows: 
(i) At least 2 individuals recommend-
ed to the Secretary by the National Gov-
ernors Association. 
(ii) At least 1 individual recommended 
to the Secretary by the National Associa-
tion of State Chief Information Officers. 
(iii) At least 1 individual recommend-
ed to the Secretary by the National Guard 
Bureau. 
(iv) At least 1 individual recommend-
ed to the Secretary by the National Asso-
ciation of Counties. 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(v) At least 1 individual recommended 
to the Secretary by the National League of 
Cities. 
(vi) Not more than 9 other individuals 
who have educational and professional ex-
perience related to cybersecurity analysis 
or policy. 
(B) TERMS.—Each member shall be ap-
pointed for a term of 1 year. Any member ap-
pointed to fill a vacancy occurring before the 
expiration of the term for which the member’s 
predecessor was appointed shall be appointed 
only for the remainder of that term. A member 
may serve after the expiration of that member’s 
term until a successor has taken office. A va-
cancy in the Commission shall be filled in the 
manner in which the original appointment was 
made. 
(C) PAY.—Members shall serve without 
pay. 
(D) CHAIRPERSON; VICE CHAIRPERSON.— 
The Secretary, or a designee of the Secretary, 
shall serve as the Chairperson of the Review 
Committee. The Administrator of the Federal 
Emergency Management Agency, or a designee 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
of the Administrator, shall serve as the Vice 
Chairperson of the Review Committee. 
(5) STAFF AND EXPERTS.—The Review Com-
mittee may— 
(A) appoint additional personnel as it con-
siders appropriate, without regard to the provi-
sions of title 5, United States Code, governing 
appointments in the competitive service; 
(B) fix the pay of such additional per-
sonnel, without regard to the provisions of 
chapter 51 and subchapter III of chapter 53 of 
such title relating to classification and General 
Schedule pay rates; and 
(C) procure temporary and intermittent 
services under section 3109(b) of such title. 
(6) DETAILEES.—Upon request of the Review 
Committee, the head of any Federal department or 
agency may detail, on a reimbursable basis, any of 
the personnel of that department or agency to the 
Commission to assist it in carrying out the duties 
under this Act. 
(7) FEDERAL ADVISORY COMMITTEE ACT.—The 
Federal Advisory Committee Act (5 U.S.C. App.) 
shall not apply to the Review Committee. 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
(8) TERMINATION.—The authority of the Re-
view Committee shall terminate on the day after the 
end of the 5-fiscal-year period described in sub-
section (j). 
(j) FUNDING.—There is authorized to be appro-
priated for grants under this section such sums as are nec-
essary for fiscal years 2020 through 2025. 
(k) DEFINITIONS.—In this section: 
(1) ACTIVE
CYBER
RESILIENCY
PLAN.—The 
term ‘‘active cyber resiliency plan’’ means a cyber 
resiliency plan for which an approval is in effect in 
accordance with subsection (d)(2)(A) or for which 
the Secretary extends such approval in accordance 
with subsection (d)(2)(B). 
(2) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the Federal 
Emergency Management Agency. 
(3) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given that 
term in section 2 of the Homeland Security Act of 
2002 (6 U.S.C. 101). 
(4) CYBER
RESILIENCY
PLAN.—The term 
‘‘cyber resiliency plan’’ means, with respect to a 
State, a plan that addresses the cybersecurity 
threats or vulnerabilities faced by the State through 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS
a statewide plan and decisionmaking process to re-
spond to cybersecurity risks or incidents. 
(5) CYBERSECURITY RISK.—The term ‘‘cyberse-
curity risk’’ has the meaning given that term in sec-
tion 2209 of the Homeland Security Act of 2002 (6 
U.S.C. 659). 
(6) INCIDENT.—The term ‘‘incident’’ has the 
meaning given that term in section 2209 of the 
Homeland Security Act of 2002 (6 U.S.C. 659). 
(7) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘‘information sharing and 
analysis organization’’ has the meaning given that 
term in section 2222 of the Homeland Security Act 
of 2002 (6 U.S.C. 671). 
(8) KEY
RESOURCES.—The term ‘‘key re-
sources’’ has the meaning given that term in section 
2 of the Homeland Security Act of 2002 (6 U.S.C. 
101). 
(9) PROGRAM.—The term ‘‘Program’’ means 
the State Cyber Resiliency Grant Program estab-
lished by this section. 
(10) PUBLIC
SAFETY
ANSWERING
POINTS.— 
The term ‘‘public safety answering points’’ has the 
meaning given that term in section 222(h) of the 
Communications Act of 1934 (47 U.S.C. 222(h)). 
VerDate Sep 11 2014 
02:04 Aug 18, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4910.IH
H4910
SSpencer on DSK126QN23PROD with BILLS