‘‘(1) 
IN
GENERAL.—The 
Secretary, 
acting 
through the Director, may award grants under this 
section to a group of two or more eligible entities to 
support multistate efforts to address cybersecurity 
risks and cybersecurity threats to information systems 
within the jurisdictions of the eligible entities. 
‘‘(2) 
SATISFACTION
OF
OTHER
REQUIRE-
MENTS.—In order to be eligible for a multistate grant 
under this subsection, each eligible entity that com-
prises a multistate group shall submit to the Sec-
retary— 
‘‘(A) a Cybersecurity Plan for approval in 
accordance with subsection (i); and 
‘‘(B) a plan for establishing a cybersecurity 
planning committee under subsection (g). 
‘‘(3) APPLICATION.— 
‘‘(A) IN GENERAL.—A multistate group ap-
plying for a multistate grant under paragraph 
(1) shall submit to the Secretary an application 
at such time, in such manner, and containing 
such information as the Secretary may require. 
‘‘(B) 
MULTISTATE
PROJECT
DESCRIP-
TION.—An application of a multistate group 
under subparagraph (A) shall include a plan de-
scribing— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) the division of responsibilities 
among the eligible entities that comprise the 
multistate group for administering the 
grant for which application is being made; 
‘‘(ii) the distribution of funding from 
such a grant among the eligible entities that 
comprise the multistate group; and 
‘‘(iii) how the eligible entities that 
comprise the multistate group will work to-
gether to implement the Cybersecurity Plan 
of each of those eligible entities. 
‘‘(g) PLANNING COMMITTEES.— 
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section shall establish a cy-
bersecurity planning committee to— 
‘‘(A) assist in the development, implementa-
tion, and revision of the Cybersecurity Plan of 
the eligible entity; 
‘‘(B) approve the Cybersecurity Plan of the 
eligible entity; and 
‘‘(C) assist in the determination of effective 
funding priorities for a grant under this section 
in accordance with subsection (h). 
‘‘(2) COMPOSITION.—A committee of an eligible 
entity established under paragraph (1) shall— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) be comprised of representatives from 
the eligible entity and counties, cities, towns, 
Tribes, and public educational and health insti-
tutions within the jurisdiction of the eligible en-
tity; and 
‘‘(B) include, as appropriate, representa-
tives of rural, suburban, and high-population ju-
risdictions. 
‘‘(3) CYBERSECURITY EXPERTISE.—Not less than 
1⁄2 of the representatives of a committee established 
under paragraph (1) shall have professional experi-
ence relating to cybersecurity or information tech-
nology. 
‘‘(4) RULE OF CONSTRUCTION REGARDING EXIST-
ING PLANNING COMMITTEES.—Nothing in this sub-
section may be construed to require an eligible entity 
to establish a cybersecurity planning committee if the 
eligible entity has established and uses a multijuris-
dictional planning committee or commission that 
meets, or may be leveraged to meet, the requirements 
of this subsection. 
‘‘(h) USE OF FUNDS.—An eligible entity that receives 
a grant under this section shall use the grant to— 
‘‘(1) implement the Cybersecurity Plan of the eli-
gible entity; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) develop or revise the Cybersecurity Plan of 
the eligible entity; or 
‘‘(3) assist with activities that address imminent 
cybersecurity risks or cybersecurity threats to the in-
formation systems of the eligible entity or a local or 
Tribal organization within the jurisdiction of the eli-
gible entity. 
‘‘(i) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore an eligible entity may receive a grant under this 
section, the Secretary, acting through the Director, 
shall review the Cybersecurity Plan, or any revisions 
thereto, of the eligible entity and approve such plan, 
or revised plan, if it satisfies the requirements speci-
fied in paragraph (2). 
‘‘(2) PLAN REQUIREMENTS.—In approving a Cy-
bersecurity Plan of an eligible entity under this sub-
section, the Director shall ensure that the Cybersecu-
rity Plan— 
‘‘(A) satisfies the requirements of subsection 
(e)(2); 
‘‘(B) upon the issuance of the Homeland Se-
curity Strategy to Improve the Cybersecurity of 
State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210(e), 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
complies, as appropriate, with the goals and ob-
jectives of the strategy; and 
‘‘(C) has been approved by the cybersecurity 
planning committee of the eligible entity estab-
lished under subsection (g). 
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions to 
a Cybersecurity Plan as the Director determines ap-
propriate. 
‘‘(4) EXCEPTION.—Notwithstanding subsection 
(e) and paragraph (1) of this subsection, the Sec-
retary may award a grant under this section to an 
eligible entity that does not submit a Cybersecurity 
Plan to the Secretary if— 
‘‘(A) the eligible entity certifies to the Sec-
retary that— 
‘‘(i) the activities that will be sup-
ported by the grant are integral to the de-
velopment of the Cybersecurity Plan of the 
eligible entity; and 
‘‘(ii) the eligible entity will submit by 
September 30, 2023, to the Secretary a Cy-
bersecurity Plan for review, and if appro-
priate, approval; or 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) the eligible entity certifies to the Sec-
retary, and the Director confirms, that the eligi-
ble entity will use funds from the grant to assist 
with the activities described in subsection (h)(3). 
‘‘(j) LIMITATIONS ON USES OF FUNDS.— 
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section may not use the 
grant— 
‘‘(A) to supplant State, local, or Tribal 
funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
‘‘(C) to pay a demand for ransom in an at-
tempt to— 
‘‘(i) regain access to information or an 
information system of the eligible entity or 
of a local or Tribal organization within the 
jurisdiction of the eligible entity; or 
‘‘(ii) prevent the disclosure of informa-
tion that has been removed without author-
ization from an information system of the 
eligible entity or of a local or Tribal organi-
zation within the jurisdiction of the eligible 
entity; 
‘‘(D) for recreational or social purposes; or 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(E) for any purpose that does not address 
cybersecurity risks or cybersecurity threats on 
information systems of the eligible entity or of a 
local or Tribal organization within the jurisdic-
tion of the eligible entity. 
‘‘(2) PENALTIES.—In addition to any other rem-
edy available, the Secretary may take such actions as 
are necessary to ensure that a recipient of a grant 
under this section uses the grant for the purposes for 
which the grant is awarded. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
paragraph (1) may be construed to prohibit the use 
of grant funds provided to a State, local, or Tribal 
organization for otherwise permissible uses under this 
section on the basis that a State, local, or Tribal or-
ganization has previously used State, local, or Tribal 
funds to support the same or similar uses. 
‘‘(k) OPPORTUNITY
TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
Secretary shall provide applicants with a reasonable oppor-
tunity to correct defects, if any, in such applications before 
making final awards. 
‘‘(l) APPORTIONMENT.—For fiscal year 2022 and each 
fiscal year thereafter, the Secretary shall apportion 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
amounts appropriated to carry out this section among 
States as follows: 
‘‘(1) BASELINE
AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the North-
ern Mariana Islands, Guam, the U.S. Virgin Islands, 
and 0.75 percent of such amounts to each of the re-
maining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each eligible entity, 
bears to 
‘‘(B) the population of all eligible entities. 
‘‘(3) MINIMUM ALLOCATION TO INDIAN TRIBES.— 
‘‘(A) 
IN
GENERAL.—In 
apportioning 
amounts under this section, the Secretary shall 
ensure that, for each fiscal year, directly eligible 
Tribes collectively receive, from amounts appro-
priated under the State and Local Cybersecurity 
Grant Program, not less than an amount equal 
to three percent of the total amount appropriated 
for grants under this section. 
‘‘(B) ALLOCATION.—Of the amount reserved 
under subparagraph (A), funds shall be allocated 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
in a manner determined by the Secretary in con-
sultation with Indian tribes. 
‘‘(C) EXCEPTION.—This paragraph shall 
not apply in any fiscal year in which the Sec-
retary— 
‘‘(i) receives fewer than five applica-
tions from Indian tribes; or 
‘‘(ii) does not approve at least two ap-
plication from Indian tribes. 
‘‘(m) FEDERAL SHARE.— 
‘‘(1) IN GENERAL.—The Federal share of the cost 
of an activity carried out using funds made available 
with a grant under this section may not exceed— 
‘‘(A) in the case of a grant to an eligible en-
tity— 
‘‘(i) for fiscal year 2022, 90 percent; 
‘‘(ii) for fiscal year 2023, 80 percent; 
‘‘(iii) for fiscal year 2024, 70 percent; 
‘‘(iv) for fiscal year 2025, 60 percent; 
and 
‘‘(v) for fiscal year 2026 and each sub-
sequent fiscal year, 50 percent; and 
‘‘(B) in the case of a grant to a multistate 
group— 
‘‘(i) for fiscal year 2022, 95 percent; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) for fiscal year 2023, 85 percent; 
‘‘(iii) for fiscal year 2024, 75 percent; 
‘‘(iv) for fiscal year 2025, 65 percent; 
and 
‘‘(v) for fiscal year 2026 and each sub-
sequent fiscal year, 55 percent. 
‘‘(2) WAIVER.—The Secretary may waive or 
modify the requirements of paragraph (1) for an In-
dian tribe if the Secretary determines such a waiver 
is in the public interest. 
‘‘(n) RESPONSIBILITIES OF GRANTEES.— 
‘‘(1) CERTIFICATION.—Each eligible entity or 
multistate group that receives a grant under this sec-
tion shall certify to the Secretary that the grant will 
be used— 
‘‘(A) for the purpose for which the grant is 
awarded; and 
‘‘(B) in compliance with, as the case may 
be— 
‘‘(i) the Cybersecurity Plan of the eligi-
ble entity; 
‘‘(ii) the Cybersecurity Plans of the eli-
gible entities that comprise the multistate 
group; or 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iii) a purpose approved by the Sec-
retary under subsection (h) or pursuant to 
an exception under subsection (i). 
‘‘(2) AVAILABILITY
OF
FUNDS
TO
LOCAL
AND 
TRIBAL
ORGANIZATIONS.—Not later than 45 days 
after the date on which an eligible entity or 
multistate group receives a grant under this section, 
the eligible entity or multistate group shall, without 
imposing unreasonable or unduly burdensome re-
quirements as a condition of receipt, obligate or other-
wise make available to local and Tribal organizations 
within the jurisdiction of the eligible entity or the eli-
gible entities that comprise the multistate group, and 
as applicable, consistent with the Cybersecurity Plan 
of the eligible entity or the Cybersecurity Plans of the 
eligible entities that comprise the multistate group— 
‘‘(A) not less than 80 percent of funds avail-
able under the grant; 
‘‘(B) with the consent of the local and Trib-
al organizations, items, services, capabilities, or 
activities having a value of not less than 80 per-
cent of the amount of the grant; or 
‘‘(C) with the consent of the local and Trib-
al organizations, grant funds combined with 
other items, services, capabilities, or activities 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
having the total value of not less than 80 percent 
of the amount of the grant. 
‘‘(3) CERTIFICATIONS REGARDING DISTRIBUTION 
OF GRANT FUNDS TO LOCAL AND TRIBAL ORGANIZA-
TIONS.—An eligible entity or multistate group shall 
certify to the Secretary that the eligible entity or 
multistate group has made the distribution to local, 
Tribal, and territorial governments required under 
paragraph (2). 
‘‘(4) EXTENSION OF PERIOD.— 
‘‘(A) IN
GENERAL.—An eligible entity or 
multistate group may request in writing that the 
Secretary extend the period of time specified in 
paragraph (2) for an additional period of time. 
‘‘(B) APPROVAL.—The Secretary may ap-
prove a request for an extension under subpara-
graph (A) if the Secretary determines the exten-
sion is necessary to ensure that the obligation 
and expenditure of grant funds align with the 
purpose of the State and Local Cybersecurity 
Grant Program. 
‘‘(5) EXCEPTION.—Paragraph (2) shall not 
apply to the District of Columbia, the Commonwealth 
of Puerto Rico, American Samoa, the Commonwealth 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
of the Northern Mariana Islands, Guam, the Virgin 
Islands, or an Indian tribe. 
‘‘(6) DIRECT
FUNDING.—If an eligible entity 
does not make a distribution to a local or Tribal or-
ganization required in accordance with paragraph 
(2), the local or Tribal organization may petition the 
Secretary to request that grant funds be provided di-
rectly to the local or Tribal organization. 
‘‘(7) PENALTIES.—In addition to other remedies 
available to the Secretary, the Secretary may termi-
nate or reduce the amount of a grant awarded under 
this section to an eligible entity or distribute grant 
funds previously awarded to such eligible entity di-
rectly to the appropriate local or Tribal organization 
as a replacement grant in an amount the Secretary 
determines appropriate if such eligible entity violates 
a requirement of this subsection. 
‘‘(o) ADVISORY COMMITTEE.— 
‘‘(1) ESTABLISHMENT.—Not later than 120 days 
after the date of enactment of this section, the Direc-
tor shall establish a State and Local Cybersecurity 
Resilience Committee to provide State, local, and 
Tribal stakeholder expertise, situational awareness, 
and recommendations to the Director, as appropriate, 
regarding how to— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of State, 
local, or Tribal organizations; and 
‘‘(B) improve the ability of State, local, and 
Tribal organizations to prevent, protect against, 
respond to, mitigate, and recover from such cy-
bersecurity risks and cybersecurity threats. 
‘‘(2) DUTIES.—The committee established under 
paragraph (1) shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans submitted 
by applicants for grants under this section, and, 
as appropriate, submit to the Director rec-
ommendations to improve those plans prior to 
the approval of the plans under subsection (i); 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strategy 
to Improve Cybersecurity for State, Local, Trib-
al, and Territorial Governments required under 
section 2210; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as appro-
priate, regarding how to— 
‘‘(i) address cybersecurity risks and cy-
bersecurity threats on information systems 
of State, local, or Tribal organizations; and 
‘‘(ii) improve the cybersecurity resil-
ience of State, local, or Tribal organiza-
tions; and 
‘‘(E) regularly coordinate with the State, 
Local, Tribal and Territorial Government Co-
ordinating Council, within the Critical Infra-
structure Partnership Advisory Council, estab-
lished under section 871. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resilience Com-
mittee established pursuant to paragraph (1) 
shall be composed of 15 members appointed by 
the Director, as follows: 
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bureau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) One individual recommended to 
the Director by the National League of Cit-
ies. 
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
‘‘(vii) One individual recommended to 
the Director by the Multi-State Information 
Sharing and Analysis Center. 
‘‘(viii) One individual recommended to 
the Director by the National Congress of 
American Indians. 
‘‘(viii) Four individuals who have edu-
cational and professional experience relat-
ing to cybersecurity work or cybersecurity 
policy. 
‘‘(B) TERMS.— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) IN
GENERAL.—Subject to clause 
(ii), each member of the State and Local 
Cybersecurity Resilience Committee shall be 
appointed for a term of two years. 
‘‘(ii) REQUIREMENT.—At least two 
members of the State and Local Cybersecu-
rity Resilience Committee shall also be 
members of the State, Local, Tribal and 
Territorial Government Coordinating Coun-
cil, within the Critical Infrastructure Part-
nership Advisory Council, established under 
section 871. 
‘‘(iii) EXCEPTION.—A term of a mem-
ber of the State and Local Cybersecurity 
Resilience Committee shall be three years if 
the member is appointed initially to the 
Committee upon the establishment of the 
Committee. 
‘‘(iv) TERM REMAINDERS.—Any mem-
ber of the State and Local Cybersecurity 
Resilience Committee appointed to fill a va-
cancy occurring before the expiration of the 
term for which the member’s predecessor 
was appointed shall be appointed only for 
the remainder of such term. A member may 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
serve after the expiration of such member’s 
term until a successor has taken office. 
‘‘(v) VACANCIES.—A vacancy in the 
State and Local Cybersecurity Resilience 
Committee shall be filled in the manner in 
which the original appointment was made. 
‘‘(C) PAY.—Members of the State and Local 
Cybersecurity Resilience Committee shall serve 
without pay. 
‘‘(4) CHAIRPERSON; VICE
CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
ience Committee shall select a chairperson and vice 
chairperson from among members of the committee. 
‘‘(5) PERMANENT AUTHORITY.—Notwithstanding 
section 14 of the Federal Advisory Committee Act (5 
U.S.C. App.), the State and Local Cybersecurity Re-
silience Committee shall be a permanent authority. 
‘‘(p) REPORTS.— 
‘‘(1) ANNUAL REPORTS BY GRANT RECIPIENTS.— 
‘‘(A) IN GENERAL.—Not later than one year 
after an eligible entity or multistate group re-
ceives funds under this section, the eligible entity 
or multistate group shall submit to the Secretary 
a report on the progress of the eligible entity or 
multistate group in implementing the Cybersecu-
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
rity Plan of the eligible entity or Cybersecurity 
Plans of the eligible entities that comprise the 
multistate group, as the case may be. 
‘‘(B) ABSENCE OF PLAN.—Not later than 
180 days after an eligible entity that does not 
have a Cybersecurity Plan receives funds under 
this section for developing its Cybersecurity 
Plan, the eligible entity shall submit to the Sec-
retary a report describing how the eligible entity 
obligated and expended grant funds during the 
fiscal year to— 
‘‘(i) so develop such a Cybersecurity 
Plan; or 
‘‘(ii) assist with the activities described 
in subsection (h)(3). 
‘‘(2) ANNUAL REPORTS TO CONGRESS.—Not less 
frequently than once per year, the Secretary, acting 
through the Director, shall submit to Congress a re-
port on the use of grants awarded under this section 
and any progress made toward the following: 
‘‘(A) Achieving the objectives set forth in the 
Homeland Security Strategy to Improve the Cy-
bersecurity of State, Local, Tribal, and Terri-
torial Governments, upon the date on which the 
strategy is issued under section 2210. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems, ap-
plications, and user accounts owned or operated 
by or on behalf of State, local, and Tribal orga-
nizations as a result of the award of such grants. 
‘‘(q) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this sec-
tion— 
‘‘(1) for each of fiscal years 2022 through 2026, 
$500,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘SEC. 2220B. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall de-
velop, regularly update, and maintain a resource guide for 
use by State, local, Tribal, and territorial government offi-
cials, including law enforcement officers, to help such offi-
cials identify, prepare for, detect, protect against, respond 
to, and recover from cybersecurity risks (as such term is 
defined in section 2209), cybersecurity threats, and inci-
dents (as such term is defined in section 2209).’’. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Homeland Security Act of 2002, as 
amended by section 4, is further amended by inserting after 
the item relating to section 2220 the following new items: 
‘‘Sec. 2220A. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2220B. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE THE 
CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND TERRI-
TORIAL GOVERNMENTS.—Section 2210 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 660) is amended by adding 
at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Not later than one 
year after the date of the enactment of this sub-
section, the Secretary, acting through the Direc-
tor, shall, in coordination with the heads of ap-
propriate Federal agencies, State, local, Tribal, 
and territorial governments, the State and Local 
Cybersecurity Resilience Committee established 
under section 2220A, and other stakeholders, as 
appropriate, develop and make publicly avail-
able a Homeland Security Strategy to Improve 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
the Cybersecurity of State, Local, Tribal, and 
Territorial Governments. 
‘‘(B) RECOMMENDATIONS
AND
REQUIRE-
MENTS.—The strategy required under subpara-
graph (A) shall— 
‘‘(i) provide recommendations relating 
to the ways in which the Federal Govern-
ment should support and promote the abil-
ity of State, local, Tribal, and territorial 
governments to identify, mitigate against, 
protect against, detect, respond to, and re-
cover from cybersecurity risks (as such term 
is defined in section 2209), cybersecurity 
threats, and incidents (as such term is de-
fined in section 2209); and 
‘‘(ii) establish baseline requirements for 
cybersecurity plans under this section and 
principles with which such plans shall 
align. 
‘‘(2) CONTENTS.—The strategy required under 
paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, respond 
to, and recover from cybersecurity risks, cyberse-
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
curity threats, incidents, and ransomware inci-
dents; 
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
available to State, local, Tribal, and territorial 
governments to help those governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
incidents, and ransomware incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help those governments identify, protect 
against, detect, respond to, and recover from cy-
bersecurity risks, cybersecurity threats, incidents, 
and ransomware incidents and make rec-
ommendations to address such limitations; 
‘‘(D) identify opportunities to improve the 
coordination of the Agency with Federal and 
non-Federal entities, such as the Multi-State In-
formation Sharing and Analysis Center, to im-
prove— 
‘‘(i) incident exercises, information 
sharing and incident notification proce-
dures; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) the ability for State, local, Tribal, 
and territorial governments to voluntarily 
adapt and implement guidance in Federal 
binding operational directives; and 
‘‘(iii) opportunities to leverage Federal 
schedules 
for 
cybersecurity 
investments 
under section 502 of title 40, United States 
Code; 
‘‘(E) recommend new initiatives the Federal 
Government should undertake to improve the 
ability of State, local, Tribal, and territorial 
governments to identify, protect against, detect, 
respond to, and recover from cybersecurity risks, 
cybersecurity threats, incidents, and ransomware 
incidents; 
‘‘(F) set short-term and long-term goals that 
will improve the ability of State, local, Tribal, 
and territorial governments to identify, protect 
against, detect, respond to, and recover from cy-
bersecurity risks, cybersecurity threats, incidents, 
and ransomware incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
and territorial governments to establish baseline 
capabilities to identify, protect against, detect, 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
respond to, and recover from cybersecurity risks, 
cybersecurity threats, incidents, and ransomware 
incidents. 
‘‘(3) CONSIDERATIONS.—In developing the strat-
egy required under paragraph (1), the Director, in co-
ordination with the heads of appropriate Federal 
agencies, State, local, Tribal, and territorial govern-
ments, the State and Local Cybersecurity Resilience 
Committee established under section 2220A, and other 
stakeholders, as appropriate, shall consider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial govern-
ments, including the resulting costs to such gov-
ernments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
to compromise information systems (as such 
term is defined in section 102 of the Cybersecu-
rity Act of 2015 (6 U.S.C. 1501)) owned or oper-
ated by State, local, Tribal, and territorial gov-
ernments; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A. 
‘‘(4) EXEMPTION.—Chapter 35 of title 44, 
United States Code (commonly known as the ‘Paper-
work Reduction Act’), shall not apply to any action 
to implement this subsection.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE CY-
BERSECURITY AND INFRASTRUCTURE SECURITY AGENCY.— 
Section 2202 of the Homeland Security Act of 2002 (6 
U.S.C. 652) is amended— 
(1) by redesignating subsections (d) through (i) 
as subsections (e) through (j), respectively; and 
(2) by inserting after subsection (c) the following 
new subsection: 
‘‘(d) ADDITIONAL RESPONSIBILITIES.—In addition to 
the responsibilities under subsection (c), the Director 
shall— 
‘‘(1) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resilience Committee established under section 2220A, 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
for the State and Local Cybersecurity Grant Program 
under such section or any other homeland security as-
sistance administered by the Department to improve 
cybersecurity; 
‘‘(2) review, in consultation with the State and 
Local Cybersecurity Resilience Committee, all cyberse-
curity plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland se-
curity assistance administered by the Department to 
improve cybersecurity; 
‘‘(3) provide expertise and technical assistance to 
State, local, Tribal, and territorial government offi-
cials with respect to cybersecurity; and 
‘‘(4) provide education, training, and capacity 
development to enhance the security and resilience of 
cybersecurity and infrastructure security.’’. 
(c) FEASIBILITY STUDY.—Not later than 270 days 
after the date of the enactment of this Act, the Director of 
the Cybersecurity and Infrastructure Security of the De-
partment of Homeland Security shall conduct a study to 
assess the feasibility of implementing a short-term rota-
tional program for the detail to the Agency of approved 
State, local, Tribal, and territorial government employees 
in cyber workforce positions. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
SEC. 4. TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS. 
(a) TECHNICAL AMENDMENTS.— 
(1) HOMELAND SECURITY ACT OF 2002.—Subtitle 
A of title XXII of the Homeland Security Act of 2002 
(6 U.S.C. 651 et seq.) is amended— 
(A) in the first section 2215 (6 U.S.C. 665; 
relating to the duties and authorities relating to 
.gov internet domain), by amending the section 
enumerator and heading to read as follows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(B) in the second section 2215 (6 U.S.C. 
665b; relating to the joint cyber planning office), 
by amending the section enumerator and head-
ing to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(C) in the third section 2215 (6 U.S.C. 
665c; relating to the Cybersecurity State Coordi-
nator), by amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(D) in the fourth section 2215 (6 U.S.C. 
665d; relating to Sector Risk Management Agen-
cies), by amending the section enumerator and 
heading to read as follows: 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(E) in section 2216 (6 U.S.C. 665e; relating 
to the Cybersecurity Advisory Committee), by 
amending the section enumerator and heading to 
read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(F) in section 2217 (6 U.S.C. 665f; relating 
to Cybersecurity Education and Training Pro-
grams), by amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(2) CONSOLIDATED APPROPRIATIONS ACT, 2021.— 
Paragraph (1) of section 904(b) of division U of the 
Consolidated Appropriations Act, 2021 (Public Law 
116–260) is amended, in the matter preceding sub-
paragraph (A), by inserting ‘‘of 2002’’ after ‘‘Home-
land Security Act’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Homeland Security Act of 2002 is 
amended by striking the items relating to sections 2214 
through 2217 and inserting the following new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs.’’. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6213
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6213
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
Union Calendar No. 31 
117TH CONGRESS 
1ST SESSION 
H. R. 3138 
[Report No. 117–48] 
A BILL 
To amend the Homeland Security Act of 2002 to 
authorize a grant program relating to the cyber-
security of State and local governments, and for 
other purposes. 
JUNE 1, 2021 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00044
Fmt 6651
Sfmt 6651
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS