IIB 
117TH CONGRESS 
1ST SESSION H. R. 3138 
IN THE SENATE OF THE UNITED STATES 
JULY 21, 2021 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to authorize 
a grant program relating to the cybersecurity of State 
and local governments, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber-
security Improvement Act’’. 
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new sec-
tions: 
‘‘SEC. 2220A. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given the 
term in section 102 of the Cybersecurity Act of 2015 
(6 U.S.C. 1501). 
‘‘(2) CYBERSECURITY PLAN.—The term ‘Cyber-
security Plan’ means a plan submitted by an eligible 
entity under subsection (e)(1). 
‘‘(3) ELIGIBLE ENTITY.—The term ‘eligible en-
tity’ means— 
‘‘(A) a State; or 
‘‘(B) an Indian tribe that, not later than 
120 days after the date of the enactment of this 
section or not later than 120 days before the 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
start of any fiscal year in which a grant under 
this section is awarded— 
‘‘(i) notifies the Secretary that the In-
dian tribe intends to develop a Cybersecu-
rity Plan; and 
‘‘(ii) agrees to forfeit any distribution 
under subsection (n)(2). 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given the term in section 2209. 
‘‘(5) INDIAN TRIBE; TRIBAL ORGANIZATION.— 
The term ‘Indian tribe’ or ‘Tribal organization’ has 
the meaning given that term in section 4(e) of the 
of the Indian Self-Determination and Education As-
sistance Act (25 U.S.C. 5304(e)). 
‘‘(6) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given the 
term in section 2222. 
‘‘(7) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 102 of the Cybersecurity Act of 2015 (6 
U.S.C. 1501). 
‘‘(8) ONLINE SERVICE.—The term ‘online serv-
ice’ means any internet-facing service, including a 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
website, email, virtual private network, or custom 
application. 
‘‘(9) 
RANSOMWARE
INCIDENT.—The 
term 
‘ransomware incident’ means an incident that actu-
ally or imminently jeopardizes, without lawful au-
thority, the integrity, confidentiality, or availability 
of information on an information system, or actually 
or imminently jeopardizes, without lawful authority, 
an information system for the purpose of coercing 
the information system’s owner, operator, or another 
person. 
‘‘(10) STATE
AND
LOCAL
CYBERSECURITY 
GRANT PROGRAM.—The term ‘State and Local Cy-
bersecurity Grant Program’ means the program es-
tablished under subsection (b). 
‘‘(11) STATE AND LOCAL CYBERSECURITY RE-
SILIENCE COMMITTEE.—The term ‘State and Local 
Cybersecurity Resilience Committee’ means the com-
mittee established under subsection (o)(1). 
‘‘(b) ESTABLISHMENT.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, shall establish a program, to 
be known as the ‘the State and Local Cybersecurity 
Grant Program’, to award grants to eligible entities 
to address cybersecurity risks and cybersecurity 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
threats to information systems of State, local, or 
Tribal organizations. 
‘‘(2) APPLICATION.—An eligible entity seeking 
a grant under the State and Local Cybersecurity 
Grant Program shall submit to the Secretary an ap-
plication at such time, in such manner, and con-
taining such information as the Secretary may re-
quire. 
‘‘(c) BASELINE REQUIREMENTS.—An eligible entity 
or multistate group that receives a grant under this sec-
tion shall use the grant in compliance with— 
‘‘(1)(A) the Cybersecurity Plan of the eligible 
entity or the Cybersecurity Plans of the eligible enti-
ties that comprise the multistate group; and 
‘‘(B) the Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments developed under section 
2210(e)(1); or 
‘‘(2) activities carried out under paragraphs 
(3), (4), and (5) of subsection (h). 
‘‘(d) ADMINISTRATION.—The State and Local Cyber-
security Grant Program shall be administered in the same 
office of the Department that administers grants made 
under sections 2003 and 2004. 
‘‘(e) CYBERSECURITY PLANS.— 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(1) IN GENERAL.—An eligible entity applying 
for a grant under this section shall submit to the 
Secretary a Cybersecurity Plan for approval. 
‘‘(2) REQUIRED ELEMENTS.—A Cybersecurity 
Plan of an eligible entity shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of the eligible entity to pro-
tect against cybersecurity risks and cybersecu-
rity threats to information systems of State, 
local, or Tribal organizations; 
‘‘(B) describe, to the extent practicable, 
how the eligible entity will— 
‘‘(i) manage, monitor, and track infor-
mation systems, applications, and user ac-
counts owned or operated by or on behalf 
of the eligible entity or by local or Tribal 
organizations within the jurisdiction of the 
eligible entity and the information tech-
nology deployed on those information sys-
tems, including legacy information systems 
and information technology that are no 
longer supported by the manufacturer of 
the systems or technology; 
‘‘(ii) monitor, audit, and track activity 
between information systems, applications, 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
and user accounts owned or operated by or 
on behalf of the eligible entity or by local 
or Tribal organizations within the jurisdic-
tion of the eligible entity and between 
those information systems and information 
systems not owned or operated by the eligi-
ble entity or by local or Tribal organiza-
tions within the jurisdiction of the eligible 
entity; 
‘‘(iii) enhance the preparation, re-
sponse, and resilience of information sys-
tems, applications, and user accounts 
owned or operated by or on behalf of the 
eligible entity or local or Tribal organiza-
tions against cybersecurity risks and cyber-
security threats; 
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
on information systems of the eligible enti-
ty or local or Tribal organizations; 
‘‘(v) ensure that State, local, and 
Tribal organizations that own or operate 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
information systems that are located with-
in the jurisdiction of the eligible entity— 
‘‘(I) adopt best practices and 
methodologies to enhance cybersecu-
rity, such as the practices set forth in 
the cybersecurity framework developed 
by, and the cyber supply chain risk 
management best practices identified 
by, the National Institute of Stand-
ards and Technology; and 
‘‘(II) utilize knowledge bases of 
adversary tools and tactics to assess 
risk; 
‘‘(vi) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, and Tribal organizations, 
including through the use of the .gov inter-
net domain; 
‘‘(vii) ensure continuity of operations 
of the eligible entity and local, and Tribal 
organizations in the event of a cybersecu-
rity incident (including a ransomware inci-
dent), including by conducting exercises to 
practice responding to such an incident; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(viii) use the National Initiative for 
Cybersecurity 
Education 
Cybersecurity 
Workforce Framework developed by the 
National Institute of Standards and Tech-
nology to identify and mitigate any gaps in 
the cybersecurity workforces of State, 
local, or Tribal organizations, enhance re-
cruitment and retention efforts for such 
workforces, and bolster the knowledge, 
skills, and abilities of State, local, and 
Tribal organization personnel to address 
cybersecurity 
risks 
and 
cybersecurity 
threats, such as through cybersecurity hy-
giene training; 
‘‘(ix) ensure continuity of communica-
tions and data networks within the juris-
diction of the eligible entity between the el-
igible entity and local and Tribal organiza-
tions that own or operate information sys-
tems within the jurisdiction of the eligible 
entity in the event of an incident involving 
such communications or data networks 
within the jurisdiction of the eligible entity; 
‘‘(x) assess and mitigate, to the great-
est degree possible, cybersecurity risks and 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
cybersecurity threats related to critical in-
frastructure and key resources, the deg-
radation of which may impact the perform-
ance of information systems within the ju-
risdiction of the eligible entity; 
‘‘(xi) enhance capabilities to share 
cyber threat indicators and related infor-
mation between the eligible entity and local 
and Tribal organizations that own or oper-
ate information systems within the juris-
diction of the eligible entity, including by 
expanding existing information sharing 
agreements with the Department; 
‘‘(xii) enhance the capability of the el-
igible entity to share cyber threat indictors 
and related information with the Depart-
ment; 
‘‘(xiii) leverage cybersecurity services 
offered by the Department; 
‘‘(xiv) develop and coordinate strate-
gies to address cybersecurity risks and cy-
bersecurity threats to information systems 
of the eligible entity in consultation with— 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(I) local and Tribal organiza-
tions within the jurisdiction of the eli-
gible entity; and 
‘‘(II) as applicable— 
‘‘(aa) States that neighbor 
the jurisdiction of the eligible en-
tity or, as appropriate, members 
of an information sharing and 
analysis organization; and 
‘‘(bb) countries that neigh-
bor the jurisdiction of the eligible 
entity; and 
‘‘(xv) implement an information tech-
nology and operational technology mod-
ernization cybersecurity review process 
that ensures alignment between informa-
tion technology and operational technology 
cybersecurity objectives; 
‘‘(C) describe, to the extent practicable, the 
individual responsibilities of the eligible entity 
and local and Tribal organizations within the 
jurisdiction of the eligible entity in imple-
menting the plan; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(D) outline, to the extent practicable, the 
necessary resources and a timeline for imple-
menting the plan; and 
‘‘(E) describe how the eligible entity will 
measure progress towards implementing the 
plan. 
‘‘(3) DISCRETIONARY ELEMENTS.—A Cyberse-
curity Plan of an eligible entity may include a de-
scription of— 
‘‘(A) cooperative programs developed by 
groups of local and Tribal organizations within 
the jurisdiction of the eligible entity to address 
cybersecurity risks and cybersecurity threats; 
and 
‘‘(B) programs provided by the eligible en-
tity to support local and Tribal organizations 
and owners and operators of critical infrastruc-
ture to address cybersecurity risks and cyberse-
curity threats. 
‘‘(4) MANAGEMENT OF FUNDS.—An eligible en-
tity applying for a grant under this section shall 
agree to designate the Chief Information Officer, the 
Chief Information Security Officer, or an equivalent 
official of the eligible entity as the primary official 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
for the management and allocation of funds awarded 
under this section. 
‘‘(f) MULTISTATE GRANTS.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, may award grants under this 
section to a group of two or more eligible entities to 
support multistate efforts to address cybersecurity 
risks and cybersecurity threats to information sys-
tems within the jurisdictions of the eligible entities. 
‘‘(2) 
SATISFACTION
OF
OTHER
REQUIRE-
MENTS.—In order to be eligible for a multistate 
grant under this subsection, each eligible entity that 
comprises a multistate group shall submit to the 
Secretary— 
‘‘(A) a Cybersecurity Plan for approval in 
accordance with subsection (i); and 
‘‘(B) a plan for establishing a cybersecu-
rity planning committee under subsection (g). 
‘‘(3) APPLICATION.— 
‘‘(A) IN
GENERAL.—A multistate group 
applying for a multistate grant under para-
graph (1) shall submit to the Secretary an ap-
plication at such time, in such manner, and 
containing such information as the Secretary 
may require. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(C) assist in the determination of effec-
tive funding priorities for a grant under this 
section in accordance with subsection (h). 
‘‘(2) COMPOSITION.—A committee of an eligible 
entity established under paragraph (1) shall— 
‘‘(A) be comprised of representatives from 
the eligible entity and counties, cities, towns, 
Tribes, and public educational and health insti-
tutions within the jurisdiction of the eligible en-
tity; and 
‘‘(B) include, as appropriate, representa-
tives of rural, suburban, and high-population 
jurisdictions. 
‘‘(3) CYBERSECURITY
EXPERTISE.—Not less 
than 1⁄2 of the representatives of a committee estab-
lished under paragraph (1) shall have professional 
experience relating to cybersecurity or information 
technology. 
‘‘(4) RULE OF CONSTRUCTION REGARDING EX-
ISTING
PLANNING
COMMITTEES.—Nothing in this 
subsection may be construed to require an eligible 
entity to establish a cybersecurity planning com-
mittee if the eligible entity has established and uses 
a multijurisdictional planning committee or commis-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
sion that meets, or may be leveraged to meet, the re-
quirements of this subsection. 
‘‘(h) USE OF FUNDS.—An eligible entity that receives 
a grant under this section shall use the grant to— 
‘‘(1) implement the Cybersecurity Plan of the 
eligible entity; 
‘‘(2) develop or revise the Cybersecurity Plan of 
the eligible entity; or 
‘‘(3) assist with activities that address immi-
nent cybersecurity risks or cybersecurity threats to 
the information systems of the eligible entity or a 
local or Tribal organization within the jurisdiction of 
the eligible entity. 
‘‘(i) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore an eligible entity may receive a grant under this 
section, the Secretary, acting through the Director, 
shall review the Cybersecurity Plan, or any revisions 
thereto, of the eligible entity and approve such plan, 
or revised plan, if it satisfies the requirements speci-
fied in paragraph (2). 
‘‘(2) PLAN
REQUIREMENTS.—In approving a 
Cybersecurity Plan of an eligible entity under this 
subsection, the Director shall ensure that the Cyber-
security Plan— 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(A) satisfies the requirements of sub-
section (e)(2); 
‘‘(B) upon the issuance of the Homeland 
Security Strategy to Improve the Cybersecurity 
of State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210(e), 
complies, as appropriate, with the goals and ob-
jectives of the strategy; and 
‘‘(C) has been approved by the cybersecu-
rity planning committee of the eligible entity es-
tablished under subsection (g). 
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions 
to a Cybersecurity Plan as the Director determines 
appropriate. 
‘‘(4) EXCEPTION.—Notwithstanding subsection 
(e) and paragraph (1) of this subsection, the Sec-
retary may award a grant under this section to an 
eligible entity that does not submit a Cybersecurity 
Plan to the Secretary if— 
‘‘(A) the eligible entity certifies to the Sec-
retary that— 
‘‘(i) the activities that will be sup-
ported by the grant are integral to the de-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
velopment of the Cybersecurity Plan of the 
eligible entity; and 
‘‘(ii) the eligible entity will submit by 
September 30, 2023, to the Secretary a 
Cybersecurity Plan for review, and if ap-
propriate, approval; or 
‘‘(B) the eligible entity certifies to the Sec-
retary, and the Director confirms, that the eli-
gible entity will use funds from the grant to as-
sist with the activities described in subsection 
(h)(3). 
‘‘(j) LIMITATIONS ON USES OF FUNDS.— 
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section may not use the 
grant— 
‘‘(A) to supplant State, local, or Tribal 
funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
‘‘(C) to pay a demand for ransom in an at-
tempt to— 
‘‘(i) regain access to information or 
an information system of the eligible entity 
or of a local or Tribal organization within 
the jurisdiction of the eligible entity; or 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(ii) prevent the disclosure of infor-
mation that has been removed without au-
thorization from an information system of 
the eligible entity or of a local or Tribal or-
ganization within the jurisdiction of the eli-
gible entity; 
‘‘(D) for recreational or social purposes; or 
‘‘(E) for any purpose that does not address 
cybersecurity risks or cybersecurity threats on 
information systems of the eligible entity or of 
a local or Tribal organization within the juris-
diction of the eligible entity. 
‘‘(2) PENALTIES.—In addition to any other 
remedy available, the Secretary may take such ac-
tions as are necessary to ensure that a recipient of 
a grant under this section uses the grant for the 
purposes for which the grant is awarded. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
paragraph (1) may be construed to prohibit the use 
of grant funds provided to a State, local, or Tribal 
organization for otherwise permissible uses under 
this section on the basis that a State, local, or Trib-
al organization has previously used State, local, or 
Tribal funds to support the same or similar uses. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(k) OPPORTUNITY TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
Secretary shall provide applicants with a reasonable op-
portunity to correct defects, if any, in such applications 
before making final awards. 
‘‘(l) APPORTIONMENT.—For fiscal year 2022 and 
each fiscal year thereafter, the Secretary shall apportion 
amounts appropriated to carry out this section among 
States as follows: 
‘‘(1) BASELINE AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the 
Northern Mariana Islands, Guam, the U.S. Virgin 
Islands, and 0.75 percent of such amounts to each 
of the remaining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each eligible entity, 
bears to 
‘‘(B) the population of all eligible entities. 
‘‘(3) 
MINIMUM
ALLOCATION
TO
INDIAN 
TRIBES.— 
‘‘(A) 
IN
GENERAL.—In 
apportioning 
amounts under this section, the Secretary shall 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
ensure that, for each fiscal year, directly eligible 
Tribes collectively receive, from amounts appro-
priated under the State and Local Cybersecu-
rity Grant Program, not less than an amount 
equal to three percent of the total amount ap-
propriated for grants under this section. 
‘‘(B) ALLOCATION.—Of the amount re-
served under subparagraph (A), funds shall be 
allocated in a manner determined by the Sec-
retary in consultation with Indian tribes. 
‘‘(C) EXCEPTION.—This paragraph shall 
not apply in any fiscal year in which the Sec-
retary— 
‘‘(i) receives fewer than five applica-
tions from Indian tribes; or 
‘‘(ii) does not approve at least two ap-
plications from Indian tribes. 
‘‘(m) FEDERAL SHARE.— 
‘‘(1) IN GENERAL.—The Federal share of the 
cost of an activity carried out using funds made 
available with a grant under this section may not ex-
ceed— 
‘‘(A) in the case of a grant to an eligible 
entity— 
‘‘(i) for fiscal year 2022, 90 percent; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(ii) for fiscal year 2023, 80 percent; 
‘‘(iii) for fiscal year 2024, 70 percent; 
‘‘(iv) for fiscal year 2025, 60 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 50 percent; and 
‘‘(B) in the case of a grant to a multistate 
group— 
‘‘(i) for fiscal year 2022, 95 percent; 
‘‘(ii) for fiscal year 2023, 85 percent; 
‘‘(iii) for fiscal year 2024, 75 percent; 
‘‘(iv) for fiscal year 2025, 65 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 55 percent. 
‘‘(2) WAIVER.—The Secretary may waive or 
modify the requirements of paragraph (1) for an In-
dian tribe if the Secretary determines such a waiver 
is in the public interest. 
‘‘(n) RESPONSIBILITIES OF GRANTEES.— 
‘‘(1) CERTIFICATION.—Each eligible entity or 
multistate group that receives a grant under this 
section shall certify to the Secretary that the grant 
will be used— 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(A) for the purpose for which the grant 
is awarded; and 
‘‘(B) in compliance with, as the case may 
be— 
‘‘(i) the Cybersecurity Plan of the eli-
gible entity; 
‘‘(ii) the Cybersecurity Plans of the el-
igible entities that comprise the multistate 
group; or 
‘‘(iii) a purpose approved by the Sec-
retary under subsection (h) or pursuant to 
an exception under subsection (i). 
‘‘(2) AVAILABILITY OF FUNDS TO LOCAL AND 
TRIBAL ORGANIZATIONS.—Not later than 45 days 
after the date on which an eligible entity or 
multistate group receives a grant under this section, 
the eligible entity or multistate group shall, without 
imposing unreasonable or unduly burdensome re-
quirements as a condition of receipt, obligate or oth-
erwise make available to local and Tribal organiza-
tions within the jurisdiction of the eligible entity or 
the eligible entities that comprise the multistate 
group, and as applicable, consistent with the Cyber-
security Plan of the eligible entity or the Cybersecu-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
rity Plans of the eligible entities that comprise the 
multistate group— 
‘‘(A) not less than 80 percent of funds 
available under the grant; 
‘‘(B) with the consent of the local and 
Tribal organizations, items, services, capabili-
ties, or activities having a value of not less than 
80 percent of the amount of the grant; or 
‘‘(C) with the consent of the local and 
Tribal organizations, grant funds combined 
with other items, services, capabilities, or activi-
ties having the total value of not less than 80 
percent of the amount of the grant. 
‘‘(3) CERTIFICATIONS
REGARDING
DISTRIBU-
TION OF GRANT FUNDS TO LOCAL AND TRIBAL OR-
GANIZATIONS.—An eligible entity or multistate 
group shall certify to the Secretary that the eligible 
entity or multistate group has made the distribution 
to local, Tribal, and territorial governments required 
under paragraph (2). 
‘‘(4) EXTENSION OF PERIOD.— 
‘‘(A) IN GENERAL.—An eligible entity or 
multistate group may request in writing that 
the Secretary extend the period of time speci-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
fied in paragraph (2) for an additional period 
of time. 
‘‘(B) APPROVAL.—The Secretary may ap-
prove a request for an extension under subpara-
graph (A) if the Secretary determines the ex-
tension is necessary to ensure that the obliga-
tion and expenditure of grant funds align with 
the purpose of the State and Local Cybersecu-
rity Grant Program. 
‘‘(5) EXCEPTION.—Paragraph (2) shall not 
apply to the District of Columbia, the Common-
wealth of Puerto Rico, American Samoa, the Com-
monwealth of the Northern Mariana Islands, Guam, 
the Virgin Islands, or an Indian tribe. 
‘‘(6) DIRECT FUNDING.—If an eligible entity 
does not make a distribution to a local or Tribal or-
ganization required in accordance with paragraph 
(2), the local or Tribal organization may petition the 
Secretary to request that grant funds be provided di-
rectly to the local or Tribal organization. 
‘‘(7) PENALTIES.—In addition to other rem-
edies available to the Secretary, the Secretary may 
terminate or reduce the amount of a grant awarded 
under this section to an eligible entity or distribute 
grant funds previously awarded to such eligible enti-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
ty directly to the appropriate local or Tribal organi-
zation as a replacement grant in an amount the Sec-
retary determines appropriate if such eligible entity 
violates a requirement of this subsection. 
‘‘(o) ADVISORY COMMITTEE.— 
‘‘(1) ESTABLISHMENT.—Not later than 120 
days after the date of enactment of this section, the 
Director shall establish a State and Local Cyberse-
curity Resilience Committee to provide State, local, 
and Tribal stakeholder expertise, situational aware-
ness, and recommendations to the Director, as ap-
propriate, regarding how to— 
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of 
State, local, or Tribal organizations; and 
‘‘(B) improve the ability of State, local, 
and Tribal organizations to prevent, protect 
against, respond to, mitigate, and recover from 
such cybersecurity risks and cybersecurity 
threats. 
‘‘(2) 
DUTIES.—The 
committee 
established 
under paragraph (1) shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans sub-
mitted by applicants for grants under this sec-
tion, and, as appropriate, submit to the Direc-
tor recommendations to improve those plans 
prior to the approval of the plans under sub-
section (i); 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strat-
egy to Improve Cybersecurity for State, Local, 
Tribal, and Territorial Governments required 
under section 2210; 
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as ap-
propriate, regarding how to— 
‘‘(i) address cybersecurity risks and 
cybersecurity threats on information sys-
tems of State, local, or Tribal organiza-
tions; and 
‘‘(ii) improve the cybersecurity resil-
ience of State, local, or Tribal organiza-
tions; and 
‘‘(E) regularly coordinate with the State, 
Local, Tribal and Territorial Government Co-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
ordinating Council, within the Critical Infra-
structure Partnership Advisory Council, estab-
lished under section 871. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resilience Com-
mittee established pursuant to paragraph (1) 
shall be composed of 15 members appointed by 
the Director, as follows: 
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bu-
reau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) One individual recommended to 
the Director by the National League of 
Cities. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
‘‘(vii) One individual recommended to 
the Director by the Multi-State Informa-
tion Sharing and Analysis Center. 
‘‘(viii) One individual recommended to 
the Director by the National Congress of 
American Indians. 
‘‘(viii) Four individuals who have edu-
cational and professional experience relat-
ing to cybersecurity work or cybersecurity 
policy. 
‘‘(B) TERMS.— 
‘‘(i) IN GENERAL.—Subject to clause 
(ii), each member of the State and Local 
Cybersecurity Resilience Committee shall 
be appointed for a term of two years. 
‘‘(ii) REQUIREMENT.—At least two 
members of the State and Local Cyberse-
curity Resilience Committee shall also be 
members of the State, Local, Tribal and 
Territorial 
Government 
Coordinating 
Council, within the Critical Infrastructure 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
Partnership Advisory Council, established 
under section 871. 
‘‘(iii) EXCEPTION.—A term of a mem-
ber of the State and Local Cybersecurity 
Resilience Committee shall be three years 
if the member is appointed initially to the 
Committee upon the establishment of the 
Committee. 
‘‘(iv) TERM REMAINDERS.—Any mem-
ber of the State and Local Cybersecurity 
Resilience Committee appointed to fill a 
vacancy occurring before the expiration of 
the term for which the member’s prede-
cessor was appointed shall be appointed 
only for the remainder of such term. A 
member may serve after the expiration of 
such member’s term until a successor has 
taken office. 
‘‘(v) VACANCIES.—A vacancy in the 
State and Local Cybersecurity Resilience 
Committee shall be filled in the manner in 
which the original appointment was made. 
‘‘(C) PAY.—Members of the State and 
Local Cybersecurity Resilience Committee shall 
serve without pay. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(4) CHAIRPERSON; VICE CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
ience Committee shall select a chairperson and vice 
chairperson from among members of the committee. 
‘‘(5) 
PERMANENT
AUTHORITY.—Notwith-
standing section 14 of the Federal Advisory Com-
mittee Act (5 U.S.C. App.), the State and Local Cy-
bersecurity Resilience Committee shall be a perma-
nent authority. 
‘‘(p) REPORTS.— 
‘‘(1) ANNUAL
REPORTS
BY
GRANT
RECIPI-
ENTS.— 
‘‘(A) IN
GENERAL.—Not later than one 
year after an eligible entity or multistate group 
receives funds under this section, the eligible 
entity or multistate group shall submit to the 
Secretary a report on the progress of the eligi-
ble entity or multistate group in implementing 
the Cybersecurity Plan of the eligible entity or 
Cybersecurity Plans of the eligible entities that 
comprise the multistate group, as the case may 
be. 
‘‘(B) ABSENCE OF PLAN.—Not later than 
180 days after an eligible entity that does not 
have a Cybersecurity Plan receives funds under 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
this section for developing its Cybersecurity 
Plan, the eligible entity shall submit to the Sec-
retary a report describing how the eligible enti-
ty obligated and expended grant funds during 
the fiscal year to— 
‘‘(i) so develop such a Cybersecurity 
Plan; or 
‘‘(ii) assist with the activities de-
scribed in subsection (h)(3). 
‘‘(2) ANNUAL
REPORTS
TO
CONGRESS.—Not 
less frequently than once per year, the Secretary, 
acting through the Director, shall submit to Con-
gress a report on the use of grants awarded under 
this section and any progress made toward the fol-
lowing: 
‘‘(A) Achieving the objectives set forth in 
the Homeland Security Strategy to Improve the 
Cybersecurity of State, Local, Tribal, and Ter-
ritorial Governments, upon the date on which 
the strategy is issued under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems, ap-
plications, and user accounts owned or operated 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
by or on behalf of State, local, and Tribal orga-
nizations as a result of the award of such 
grants. 
‘‘(q) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this 
section— 
‘‘(1) for each of fiscal years 2022 through 
2026, $500,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘SEC. 2220B. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall 
develop, regularly update, and maintain a resource guide 
for use by State, local, Tribal, and territorial government 
officials, including law enforcement officers, to help such 
officials identify, prepare for, detect, protect against, re-
spond to, and recover from cybersecurity risks (as such 
term is defined in section 2209), cybersecurity threats, 
and incidents (as such term is defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002, as 
amended by section 4, is further amended by inserting 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
after the item relating to section 2220 the following new 
items: 
‘‘Sec. 2220A. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2220B. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL
GOVERNMENTS.—Section 2210 of the 
Homeland Security Act of 2002 (6 U.S.C. 660) is amend-
ed by adding at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Not later than one 
year after the date of the enactment of this 
subsection, the Secretary, acting through the 
Director, shall, in coordination with the heads 
of appropriate Federal agencies, State, local, 
Tribal, and territorial governments, the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A, and other 
stakeholders, as appropriate, develop and make 
publicly available a Homeland Security Strategy 
to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS