I 
116TH CONGRESS 
2D SESSION 
H. R. 8048 
To establish in the Department of Homeland Security a program to make 
grants for emergency information technology expenses, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
AUGUST 14, 2020 
Mr. LANGEVIN (for himself, Mr. GALLAGHER, Mr. RUPPERSBERGER, Mr. 
HURD of Texas, Mr. RICHMOND, Mr. MCCAUL, Mr. ROSE of New York, 
and Mr. BACON) introduced the following bill; which was referred to the 
Committee on Homeland Security, and in addition to the Committees on 
Oversight and Reform, and Energy and Commerce, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
of such provisions as fall within the jurisdiction of the committee con-
cerned 
A BILL 
To establish in the Department of Homeland Security a 
program to make grants for emergency information tech-
nology expenses, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local IT 
Modernization and Cybersecurity Act’’. 
SEC. 2. DEFINITIONS. 
In this Act: 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(1) AGENCY.—The term ‘‘Agency’’ means the 
Cybersecurity and Infrastructure Security Agency of 
the Department of Homeland Security. 
(2) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; and 
(B) the Committee on Homeland Security 
of the House of Representatives. 
(3) COVERED INFORMATION TECHNOLOGY.—In 
this section, the term ‘‘covered information tech-
nology’’ includes the following information tech-
nology: 
(A) Enterprise productivity tools, includ-
ing— 
(i) email services; 
(ii) computer software for the pur-
poses of managing payroll and budget; 
(iii) personnel management solutions; 
and 
(iv) customer relationship manage-
ment software relating to the provision of 
services to users of such services. 
(B) Cybersecurity services and tools. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(C) Computer networking equipment. 
(4) 
COVERED
INFORMATION
TECHNOLOGY 
SERVICES.—The term ‘‘covered information tech-
nology services’’ means any service necessary to in-
stall, implement, maintain, or upgrade covered infor-
mation technology. 
(5) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of Homeland Security. 
(6) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency of the Department of Homeland Se-
curity. 
(7) EMERGENCY
INFORMATION
TECHNOLOGY 
EXPENSES.—The 
term 
‘‘emergency 
information 
technology expenses’’ means expenses related to— 
(A) improving covered information tech-
nology; 
(B) conducting covered information tech-
nology services; 
(C) subsidizing payroll for information 
technology staff to maintain the current staff-
ing level; or 
(D) government employees having the nec-
essary 
covered 
information 
technology 
to 
telework. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(8) FISCAL YEAR.—The term ‘‘fiscal year’’ has 
the meaning given the term under the State or local 
law of the relevant grant recipient. 
(9) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given the 
term in section 11101 of title 40, United States 
Code. 
(10) PUBLIC HEALTH EMERGENCY.—The term 
‘‘public health emergency’’ means the public health 
emergency declared by the Secretary of Health and 
Human Services pursuant to section 319 of the Pub-
lic Health Service Act (42 U.S.C. 247d) on January 
31, 2020, with respect to COVID–19. 
(11) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Homeland Security. 
(12) STATE.—The term ‘‘State’’ has the mean-
ing given the term in section 311 of title 5, United 
States Code. 
(13) TRIBAL GOVERNMENT.—The term ‘‘Tribal 
government’’ has the meaning given the term in sec-
tion 421(13) of the Congressional Budget and Im-
poundment Control Act of 1974 (2 U.S.C. 658(13)). 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 3. PUBLIC HEALTH EMERGENCY INFORMATION TECH-
NOLOGY GRANT PROGRAM. 
(a) ESTABLISHMENT.—There is established in the 
Department a program to be known as the ‘‘Public Health 
Emergency Information Technology Grant Program’’ (in 
this section referred to as the ‘‘Public Health Emergency 
IT Grant Program’’), under which the Secretary may 
award grants to States for emergency information tech-
nology expenses during the public health emergency. 
(b) APPLICATION.—Each State may apply for a grant 
under the Public Health Emergency IT Grant Program, 
and shall submit such information in support of such a 
grant as the Secretary may require. 
(c) ALLOCATION OF FUNDS.— 
(1) TRIBAL GOVERNMENTS.—Grants to Tribal 
governments under the Public Health Emergency IT 
Grant Program may not exceed $25,000,000 in the 
aggregate. 
(2) ADMINISTRATION
AND
OVERSIGHT.—The 
Secretary may not expend more than $10,000,000 
for administration of the Public Health Emergency 
IT Grant Program. 
(d) CONDITIONS ON RECEIPT OF GRANT.— 
(1) MANAGEMENT OF FUNDS.—To be eligible 
for a grant under the Public Health Emergency IT 
Grant Program, a State shall agree to designate the 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
Chief Information Officer, or an equivalent official, 
of the State as the primary official for the manage-
ment and allocation of funds awarded under the 
Public Health Emergency IT Grant Program. 
(2) 
SECURITY
STANDARDS
AND
CERTIFI-
CATIONS.— 
(A) IN GENERAL.—Not later than 90 days 
after the date of the enactment of this Act, the 
Secretary, in consultation with the Secretary of 
Commerce, shall select commonly accepted secu-
rity standards and certifications with respect to 
covered information technology. 
(B) SECURITY STANDARDS AND CERTIFI-
CATIONS REQUIRED.—To be eligible for a grant 
under the Public Health Emergency IT Grant 
Program, a State shall agree to procure only 
covered information technology that meets or 
exceeds the standards and certifications selected 
pursuant to paragraph (1) with funds made 
available under such Program. 
(e) GRANTS.— 
(1) SINGLE GRANT.—A State may not receive 
more than one grant under the Public Health Emer-
gency IT Grant Program. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(2) GRANT
AMOUNTS.—The Secretary may 
award grants to States under the Public Health 
Emergency IT Grant Program on the basis of the 
population of such State, except no grant awarded 
under such Program may be less than $5,000,000. 
(f) SUBGRANTS.—Each State that receives a grant 
under the Public Health Emergency IT Grant Program 
shall reserve not less than 40 percent of amounts received 
for the purpose of making subgrants to local governments 
within such State— 
(1) for emergency information technology ex-
penses; or 
(2) to purchase licenses for covered information 
technology on behalf of such local governments. 
(g) RETURN
OF
FUNDS.—Amounts received by 
States under the Public Health Emergency IT Grant Pro-
gram that are not expended by the date that is two years 
after the date of the receipt of such funds shall be re-
turned to the Treasury of the United States. 
(h) REPORTS.— 
(1) REPORTS
BY
GRANT
RECIPIENTS.—Not 
later than 180 days after receiving a grant under 
the Public Health Emergency IT Grant Program, a 
recipient of such grant shall submit to the Secretary 
a report that— 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(A) describes how grant funds were obli-
gated or expended, including the use of funds 
made available as subgrants; and 
(B) demonstrates compliance by such re-
cipient and subgrantee with the requirements of 
such Program. 
(2) ANNUAL REPORT TO CONGRESS.—Not later 
than 1 year after the date of the enactment of this 
Act and annually thereafter until all funds under the 
Public Health Emergency IT Grant Program are ex-
pended or returned to the Treasury of the United 
States, the Secretary shall submit to the appropriate 
congressional committees a report that— 
(A) describes how grant funds were obli-
gated or expended, including the use of funds 
made available as subgrants; and 
(B) demonstrates compliance by each re-
cipient and subgrantee with the requirements of 
such Program. 
(i) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated $1,000,000,000 for grants 
under the Public Health Emergency IT Grant Program. 
Amounts authorized to be appropriated pursuant to this 
subsection are authorized to remain available until Sep-
tember 30, 2022. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 4. MODERNIZING IT GRANT PROGRAM. 
(a) ESTABLISHMENT.—There is established in the 
Department a program to be known as the ‘‘Modernizing 
IT Grant Program’’, under which the Secretary may make 
grants to States to modernize information technology for 
the purpose of securely enabling digital delivery of govern-
ment services, including the digital delivery of— 
(1) emergency services; 
(2) government benefit and entitlement pro-
grams; and 
(3) administrative services performed by a 
State. 
(b) ELIGIBILITY.—To be eligible for a grant under 
the Modernizing IT Grant Program, a State shall— 
(1) with respect to fiscal years 2021, 2022, and 
2023, maintain the funding levels of the lesser of fis-
cal year 2019, or the average of fiscal years 2017, 
2018, and 2019, with respect to information tech-
nology support and modernization; and 
(2) provide matching funds equal to 5 percent 
of the amount of any grant received under the Mod-
ernizing IT Grant Program. 
(c) APPLICATION.— 
(1) IN GENERAL.—Each State may apply for a 
grant under the Modernizing IT Grant Program, 
and shall submit such information in support of 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
such a grant as the Secretary may require, including 
the following: 
(A) A State information technology mod-
ernization plan, including— 
(i) a description of existing informa-
tion technology; 
(ii) the costs related to maintenance 
of existing information technology; 
(iii) a compilation of recent security 
audits of existing information technology; 
(iv) a compilation of recent oper-
ational performance reports of existing in-
formation technology; 
(v) 
a 
methodology 
to 
prioritize 
projects and procurement to account for— 
(I) security gains; 
(II) operational gains; and 
(III) cost; and 
(vi) a transition plan to modernize ex-
isting information technology, including— 
(I) a comparative analysis of 
cloud-based versus on-premise solu-
tions; and 
(II) an estimate of operation and 
maintenance costs for the information 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
technology to be procured under such 
transition plan. 
(B) A local government information tech-
nology modernization plan describing how 
grants awarded under the Modernizing IT 
Grant Program will be used to provide— 
(i) subgrants to local governments to 
modernize their information technology 
supporting digital delivery of government 
services; or 
(ii) shared services to local govern-
ments to support the digital delivery of 
government services. 
(2) 
APPLICATION
EVALUATION.—The 
Sec-
retary, acting through the Director, and in consulta-
tion with the Administrator of General Services, 
shall evaluate each application for a grant under the 
Modernizing IT Grant Program with respect to the 
appropriateness of the information technology mod-
ernization plan to improve cybersecurity and en-
hance the capability to effectively deliver digital gov-
ernment services. 
(3) TECHNICAL
ASSISTANCE.—The Director 
may provide technical assistance to States applying 
for a grant under the Modernizing IT Grant Pro-
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
gram with respect to State and local government in-
formation technology modernization plans described 
in paragraph (1)(B). 
(d) CONDITIONS ON RECEIPT OF GRANT.— 
(1) MANAGEMENT OF FUNDS.—To be eligible 
for a grant under the Modernizing IT Grant Pro-
gram, a State shall agree to designate the Chief In-
formation Officer, or an equivalent official, of the 
State as the primary official for the management 
and allocation of funds awarded under the Modern-
izing IT Grant Program. 
(2) 
SECURITY
STANDARDS
AND
CERTIFI-
CATIONS.— 
(A) IN GENERAL.—Not later than 1 year 
after the date of the enactment of this Act, the 
Secretary, in consultation with the Secretary of 
Commerce, shall select commonly accepted secu-
rity standards and certifications with respect to 
information technology. 
(B) SECURITY STANDARDS AND CERTIFI-
CATIONS REQUIRED.—To be eligible for a grant 
under the Modernizing IT Grant Program, a 
State shall agree to procure only information 
technology that meets or exceeds the standards 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
and certifications described in paragraph (1) 
with funds made available under such Program. 
(e) GRANTS.— 
(1) SINGLE GRANT.—A State may not receive 
more than one grant under the Modernizing IT 
Grant Program. 
(2) GRANT AMOUNTS.— 
(A) STATE GOVERNMENTS.—The Secretary 
may determine the amount of a grant to be 
awarded to a State, excluding Tribal govern-
ments, under the Modernizing IT Grant Pro-
gram based on the population of such State, ex-
cept no grant awarded under such Program 
may be less than $100,000,000. 
(B) TRIBAL
GOVERNMENTS.—Grants to 
Tribal governments under the Modernization 
Grant Program may not exceed $500,000,000 
in the aggregate. 
(3) DISBURSEMENT OF FUNDS.—Grant funds 
awarded under the Modernizing IT Grant Program 
shall be dispersed in structured payments over a pe-
riod of five years, in such increments as the Sec-
retary determines appropriate for the project or pro-
curement to be carried out using the funds. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(f) SUBGRANTS.—Each State that receives a grant 
under the Modernizing IT Grant Program shall reserve 
not less than 40 percent of amounts received under such 
grant for the purpose of making a subgrant to local gov-
ernments to implement the local government information 
technology modernization plan required under subsection 
(c)(1)(B). 
(g) RETURN OF FUNDS.—Amounts received under 
the Modernizing IT Grant Program that are not expended 
by the date that is five years after the date of the receipt 
of such funds shall be returned to the Treasury of the 
United States. 
(h) ADMINISTRATIVE COSTS.—The Secretary may 
not expend more than $25,000,000 for administration of 
the Modernizing IT Grant Program. 
(i) REPORTS.— 
(1) REPORTS
BY
GRANT
RECIPIENTS.—Not 
later than 180 days after receiving a grant under 
the Modernizing IT Grant Program, a recipient of 
such grant shall submit to the Secretary a report 
that— 
(A) describes how grant funds were obli-
gated or expended, including the use of funds 
made available as subgrants; and 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
(B) demonstrates compliance by each re-
cipient and subgrantee with the requirements of 
such Program. 
(2) ANNUAL REPORT TO CONGRESS.—Not later 
than 1 year after the date of the first grant awarded 
under the Modernizing IT Grant Program and an-
nually thereafter until all funds are expended or re-
turned to the Treasury of the United States, the 
Secretary shall submit to the appropriate congres-
sional committees a report that— 
(A) describes how grant funds were obli-
gated or expended, including the use of funds 
made available as subgrants; and 
(B) demonstrates compliance by each re-
cipient and subgrantee with the requirements of 
such Program. 
(j) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated $25,000,000,000 for grants 
under the Modernizing IT Grant Program. Amounts au-
thorized to be appropriated pursuant to this subsection are 
authorized to remain available until September 30, 2027. 
SEC. 5. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
is amended by adding at the end the following new sec-
tions: 
‘‘SEC. 2215. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) 
ESTABLISHMENT.—The 
Secretary, 
acting 
through the Director, shall establish a program to make 
grants to States to address cybersecurity risks and cyber-
security threats to information systems of State, local, 
Tribal, or territorial governments (referred to as the 
‘State and Local Cybersecurity Grant Program’ in this 
section). 
‘‘(b) BASELINE REQUIREMENTS.—A grant awarded 
under this section shall be used in compliance with the 
following: 
‘‘(1) The Cybersecurity Plan required under 
subsection (d) and approved pursuant to subsection 
(g). 
‘‘(2) The Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments required in accordance with 
section 2210, when issued. 
‘‘(c) ADMINISTRATION.—The State and Local Cyber-
security Grant Program shall be administered in the same 
program office that administers grants made under sec-
tions 2003 and 2004. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(d) ELIGIBILITY.— 
‘‘(1) IN
GENERAL.—A State applying for a 
grant under the State and Local Cybersecurity 
Grant Program shall submit to the Secretary a Cy-
bersecurity Plan for approval. Such plan shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of such State to protect 
against cybersecurity risks and cybersecurity 
threats to information systems of State, local, 
Tribal, or territorial governments; 
‘‘(B) describe, to the extent practicable, 
how such State shall— 
‘‘(i) enhance the preparation, re-
sponse, and resiliency of information sys-
tems owned or operated by such State or, 
if appropriate, by local, Tribal, or terri-
torial governments, against cybersecurity 
risks and cybersecurity threats; 
‘‘(ii) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
in information systems of such State, local, 
Tribal, or territorial governments; 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(iii) ensure that State, local, Tribal, 
and territorial governments that own or 
operate information systems within the 
State adopt best practices and methodolo-
gies to enhance cybersecurity, such as the 
practices set forth in the cybersecurity 
framework developed by the National Insti-
tute of Standards and Technology; 
‘‘(iv) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, Tribal, and territorial gov-
ernments, including through the use of the 
.gov internet domain; 
‘‘(v) mitigate any identified gaps in 
the State, local, Tribal, or territorial gov-
ernment cybersecurity workforces, enhance 
recruitment and retention efforts for such 
workforces, and bolster the knowledge, 
skills, and abilities of State, local, Tribal, 
and territorial government personnel to ad-
dress cybersecurity risks and cybersecurity 
threats; 
‘‘(vi) ensure continuity of communica-
tions and data networks within such State 
between such State and local, Tribal, and 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
territorial governments that own or operate 
information systems within such State in 
the event of an incident involving such 
communications or data networks within 
such State; 
‘‘(vii) assess and mitigate, to the 
greatest 
degree 
possible, 
cybersecurity 
risks and cybersecurity threats related to 
critical infrastructure and key resources, 
the degradation of which may impact the 
performance of information systems within 
such State; 
‘‘(viii) enhance capability to share 
cyber threat indicators and related infor-
mation between such State and local, Trib-
al, and territorial governments that own or 
operate information systems within such 
State; and 
‘‘(ix) develop and coordinate strategies 
to address cybersecurity risks and cyberse-
curity threats in consultation with— 
‘‘(I) local, Tribal, and territorial 
governments within the State; and 
‘‘(II) as applicable— 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(aa) neighboring States or, 
as appropriate, members of an 
information sharing and analysis 
organization; and 
‘‘(bb) neighboring countries; 
and 
‘‘(C) include, to the extent practicable, an 
inventory of the information technology de-
ployed on the information systems owned or op-
erated by such State or by local, Tribal, or ter-
ritorial governments within such State, includ-
ing legacy information technology that is no 
longer supported by the manufacturer. 
‘‘(2) DISCRETIONARY ELEMENTS.—The Cyber-
security Plan of a State described in paragraph (1) 
may include— 
‘‘(A) cooperative programs developed by 
groups of local, Tribal, and territorial govern-
ments within such State to address cybersecu-
rity risks and cybersecurity threats; and 
‘‘(B) programs provided by such State to 
support local, Tribal, and territorial govern-
ments and critical infrastructure owners and 
operators to address cybersecurity risks and cy-
bersecurity threats. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(e) PLANNING COMMITTEES.— 
‘‘(1) IN
GENERAL.—A State applying for a 
grant under this section shall establish a cybersecu-
rity planning committee to assist in the following: 
‘‘(A) The development, implementation, 
and revision of such State’s Cybersecurity Plan 
required under subsection (d). 
‘‘(B) The determination of effective fund-
ing priorities for such grant in accordance with 
subsection (f). 
‘‘(2) 
COMPOSITION.—Cybersecurity 
planning 
committees described in paragraph (1) shall be com-
prised of representatives from counties, cities, towns, 
and Tribes within the State receiving a grant under 
this section, including, as appropriate, representa-
tives of rural, suburban, and high-population juris-
dictions. 
‘‘(3) RULE OF CONSTRUCTION REGARDING EX-
ISTING
PLANNING
COMMITTEES.—Nothing in this 
subsection may be construed to require that any 
State establish a cybersecurity planning committee if 
such State has established and uses a multijuris-
dictional planning committee or commission that 
meets the requirements of this paragraph. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(f) USE OF FUNDS.—A State that receives a grant 
under this section shall use the grant to implement such 
State’s Cybersecurity Plan, or to assist with activities de-
termined by the Secretary, in consultation with the Direc-
tor, to be integral to address cybersecurity risks and cy-
bersecurity threats to information systems of State, local, 
Tribal, or territorial governments, as the case may be. 
‘‘(g) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore a State may receive a grant under this section, 
the Secretary, acting through the Director, shall re-
view and approve such State’s Cybersecurity Plan 
required under subsection (d). 
‘‘(2) PLAN
REQUIREMENTS.—In approving a 
Cybersecurity Plan under this subsection, the Direc-
tor shall ensure such Plan— 
‘‘(A) meets the requirements specified in 
subsection (d); and 
‘‘(B) upon issuance of the Homeland Secu-
rity Strategy to Improve the Cybersecurity of 
State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210, 
complies, as appropriate, with the goals and ob-
jectives of such Strategy. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions 
to a Cybersecurity Plan as the Director determines 
appropriate. 
‘‘(4) EXCEPTION.—Notwithstanding the re-
quirement under subsection (d) to submit a Cyberse-
curity Plan as a condition of apply for a grant under 
this section, such a grant may be awarded to a State 
that has not so submitted a Cybersecurity Plan to 
the Secretary if— 
‘‘(A) such State certifies to the Secretary 
that it will submit to the Secretary a Cyberse-
curity Plan for approval by September 30, 
2022; 
‘‘(B) such State certifies to the Secretary 
that the activities that will be supported by 
such grant are integral to the development of 
such Cybersecurity Plan; or 
‘‘(C) such State certifies to the Secretary, 
and the Director confirms, that the activities 
that will be supported by the grant will address 
imminent cybersecurity risks or cybersecurity 
threats to the information systems of such 
State or of a local, Tribal, or territorial govern-
ment in such State. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(h) LIMITATIONS ON USES OF FUNDS.— 
‘‘(1) IN
GENERAL.—A State that receives a 
grant under this section may not use such grant— 
‘‘(A) to supplant State, local, Tribal, or 
territorial funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
‘‘(C) to pay a demand for ransom in an at-
tempt to regain access to information or an in-
formation system of such State or of a local, 
Tribal, or territorial government in such State; 
‘‘(D) for recreational or social purposes; or 
‘‘(E) for any purpose that does not directly 
address cybersecurity risks or cybersecurity 
threats on an information systems of such State 
or of a local, Tribal, or territorial government 
in such State. 
‘‘(2) PENALTIES.—In addition to other rem-
edies available, the Secretary may take such actions 
as are necessary to ensure that a recipient of a 
grant under this section is using such grant for the 
purposes for which such grant was awarded. 
‘‘(i) OPPORTUNITY TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
Secretary shall provide applicants with a reasonable op-
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
portunity to correct defects, if any, in such applications 
before making final awards. 
‘‘(j) APPORTIONMENT.—For fiscal year 2020 and 
each fiscal year thereafter, the Secretary shall apportion 
amounts appropriated to carry out this section among 
States as follows: 
‘‘(1) BASELINE AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the 
Northern Mariana Islands, Guam, and the Virgin Is-
lands, and 0.75 percent of such amounts to each of 
the remaining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each State; bears to 
‘‘(B) the population of all States. 
‘‘(k) FEDERAL SHARE.—The Federal share of the 
cost of an activity carried out using funds made available 
under the program may not exceed the following percent-
ages: 
‘‘(1) For fiscal year 2021, 90 percent. 
‘‘(2) For fiscal year 2022, 80 percent. 
‘‘(3) For fiscal year 2023, 70 percent. 
‘‘(4) For fiscal year 2024, 60 percent. 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(5) For fiscal year 2025 and each subsequent 
fiscal year, 50 percent. 
‘‘(l) STATE RESPONSIBILITIES.— 
‘‘(1) CERTIFICATION.—Each State that receives 
a grant under this section shall certify to the Sec-
retary that the grant will be used for the purpose for 
which the grant is awarded and in compliance with 
the Cybersecurity Plan or other purpose approved by 
the Secretary under subsection (g). 
‘‘(2) AVAILABILITY OF FUNDS TO LOCAL, TRIB-
AL, AND
TERRITORIAL
GOVERNMENTS.—Not later 
than 45 days after a State receives a grant under 
this section, such State shall, without imposing un-
reasonable or unduly burdensome requirements as a 
condition of receipt, obligate or otherwise make 
available to local, Tribal, and territorial governments 
in such State, consistent with the applicable Cyber-
security Plan— 
‘‘(A) not less than 80 percent of funds 
available under such grant; 
‘‘(B) with the consent of such local, Tribal, 
and territorial governments, items, services, ca-
pabilities, or activities having a value of not less 
than 80 percent of the amount of the grant; or 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(E) recommend new initiatives the Fed-
eral Government should undertake to improve 
the ability of State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(F) set short-term and long-term goals 
that will improve the ability of State, local, 
Tribal, and territorial governments to help such 
governments identify, protect against, detect, 
respond to, and recover from cybersecurity 
risks, cybersecurity threats, and incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
territorial governments to establish baseline ca-
pabilities to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
Homeland Security Strategy to Improve the Cyber-
security of State, Local, Tribal, and Territorial Gov-
ernments required under paragraph (1), the Direc-
tor, in coordination with appropriate Federal depart-
ments and agencies, State, local, Tribal, and terri-
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS