117TH CONGRESS 
1ST SESSION H. R. 3138 
AN ACT 
To amend the Homeland Security Act of 2002 to authorize 
a grant program relating to the cybersecurity of State 
and local governments, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber-
security Improvement Act’’. 
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new sec-
tions: 
‘‘SEC. 2220A. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given the 
term in section 102 of the Cybersecurity Act of 2015 
(6 U.S.C. 1501). 
‘‘(2) CYBERSECURITY PLAN.—The term ‘Cyber-
security Plan’ means a plan submitted by an eligible 
entity under subsection (e)(1). 
‘‘(3) ELIGIBLE ENTITY.—The term ‘eligible en-
tity’ means— 
‘‘(A) a State; or 
‘‘(B) an Indian tribe that, not later than 
120 days after the date of the enactment of this 
section or not later than 120 days before the 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
start of any fiscal year in which a grant under 
this section is awarded— 
‘‘(i) notifies the Secretary that the In-
dian tribe intends to develop a Cybersecu-
rity Plan; and 
‘‘(ii) agrees to forfeit any distribution 
under subsection (n)(2). 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given the term in section 2209. 
‘‘(5) INDIAN TRIBE; TRIBAL ORGANIZATION.— 
The term ‘Indian tribe’ or ‘Tribal organization’ has 
the meaning given that term in section 4(e) of the 
of the Indian Self-Determination and Education As-
sistance Act (25 U.S.C. 5304(e)). 
‘‘(6) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given the 
term in section 2222. 
‘‘(7) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 102 of the Cybersecurity Act of 2015 (6 
U.S.C. 1501). 
‘‘(8) ONLINE SERVICE.—The term ‘online serv-
ice’ means any internet-facing service, including a 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
website, email, virtual private network, or custom 
application. 
‘‘(9) 
RANSOMWARE
INCIDENT.—The 
term 
‘ransomware incident’ means an incident that actu-
ally or imminently jeopardizes, without lawful au-
thority, the integrity, confidentiality, or availability 
of information on an information system, or actually 
or imminently jeopardizes, without lawful authority, 
an information system for the purpose of coercing 
the information system’s owner, operator, or another 
person. 
‘‘(10) STATE
AND
LOCAL
CYBERSECURITY 
GRANT PROGRAM.—The term ‘State and Local Cy-
bersecurity Grant Program’ means the program es-
tablished under subsection (b). 
‘‘(11) STATE AND LOCAL CYBERSECURITY RE-
SILIENCE COMMITTEE.—The term ‘State and Local 
Cybersecurity Resilience Committee’ means the com-
mittee established under subsection (o)(1). 
‘‘(b) ESTABLISHMENT.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, shall establish a program, to 
be known as the ‘the State and Local Cybersecurity 
Grant Program’, to award grants to eligible entities 
to address cybersecurity risks and cybersecurity 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
threats to information systems of State, local, or 
Tribal organizations. 
‘‘(2) APPLICATION.—An eligible entity seeking 
a grant under the State and Local Cybersecurity 
Grant Program shall submit to the Secretary an ap-
plication at such time, in such manner, and con-
taining such information as the Secretary may re-
quire. 
‘‘(c) BASELINE REQUIREMENTS.—An eligible entity 
or multistate group that receives a grant under this sec-
tion shall use the grant in compliance with— 
‘‘(1)(A) the Cybersecurity Plan of the eligible 
entity or the Cybersecurity Plans of the eligible enti-
ties that comprise the multistate group; and 
‘‘(B) the Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments developed under section 
2210(e)(1); or 
‘‘(2) activities carried out under paragraphs 
(3), (4), and (5) of subsection (h). 
‘‘(d) ADMINISTRATION.—The State and Local Cyber-
security Grant Program shall be administered in the same 
office of the Department that administers grants made 
under sections 2003 and 2004. 
‘‘(e) CYBERSECURITY PLANS.— 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(1) IN GENERAL.—An eligible entity applying 
for a grant under this section shall submit to the 
Secretary a Cybersecurity Plan for approval. 
‘‘(2) REQUIRED ELEMENTS.—A Cybersecurity 
Plan of an eligible entity shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of the eligible entity to pro-
tect against cybersecurity risks and cybersecu-
rity threats to information systems of State, 
local, or Tribal organizations; 
‘‘(B) describe, to the extent practicable, 
how the eligible entity will— 
‘‘(i) manage, monitor, and track infor-
mation systems, applications, and user ac-
counts owned or operated by or on behalf 
of the eligible entity or by local or Tribal 
organizations within the jurisdiction of the 
eligible entity and the information tech-
nology deployed on those information sys-
tems, including legacy information systems 
and information technology that are no 
longer supported by the manufacturer of 
the systems or technology; 
‘‘(ii) monitor, audit, and track activity 
between information systems, applications, 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
and user accounts owned or operated by or 
on behalf of the eligible entity or by local 
or Tribal organizations within the jurisdic-
tion of the eligible entity and between 
those information systems and information 
systems not owned or operated by the eligi-
ble entity or by local or Tribal organiza-
tions within the jurisdiction of the eligible 
entity; 
‘‘(iii) enhance the preparation, re-
sponse, and resilience of information sys-
tems, applications, and user accounts 
owned or operated by or on behalf of the 
eligible entity or local or Tribal organiza-
tions against cybersecurity risks and cyber-
security threats; 
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
on information systems of the eligible enti-
ty or local or Tribal organizations; 
‘‘(v) ensure that State, local, and 
Tribal organizations that own or operate 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
information systems that are located with-
in the jurisdiction of the eligible entity— 
‘‘(I) adopt best practices and 
methodologies to enhance cybersecu-
rity, such as the practices set forth in 
the cybersecurity framework developed 
by, and the cyber supply chain risk 
management best practices identified 
by, the National Institute of Stand-
ards and Technology; and 
‘‘(II) utilize knowledge bases of 
adversary tools and tactics to assess 
risk; 
‘‘(vi) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, and Tribal organizations, 
including through the use of the .gov inter-
net domain; 
‘‘(vii) ensure continuity of operations 
of the eligible entity and local, and Tribal 
organizations in the event of a cybersecu-
rity incident (including a ransomware inci-
dent), including by conducting exercises to 
practice responding to such an incident; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(viii) use the National Initiative for 
Cybersecurity 
Education 
Cybersecurity 
Workforce Framework developed by the 
National Institute of Standards and Tech-
nology to identify and mitigate any gaps in 
the cybersecurity workforces of State, 
local, or Tribal organizations, enhance re-
cruitment and retention efforts for such 
workforces, and bolster the knowledge, 
skills, and abilities of State, local, and 
Tribal organization personnel to address 
cybersecurity 
risks 
and 
cybersecurity 
threats, such as through cybersecurity hy-
giene training; 
‘‘(ix) ensure continuity of communica-
tions and data networks within the juris-
diction of the eligible entity between the el-
igible entity and local and Tribal organiza-
tions that own or operate information sys-
tems within the jurisdiction of the eligible 
entity in the event of an incident involving 
such communications or data networks 
within the jurisdiction of the eligible entity; 
‘‘(x) assess and mitigate, to the great-
est degree possible, cybersecurity risks and 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
cybersecurity threats related to critical in-
frastructure and key resources, the deg-
radation of which may impact the perform-
ance of information systems within the ju-
risdiction of the eligible entity; 
‘‘(xi) enhance capabilities to share 
cyber threat indicators and related infor-
mation between the eligible entity and local 
and Tribal organizations that own or oper-
ate information systems within the juris-
diction of the eligible entity, including by 
expanding existing information sharing 
agreements with the Department; 
‘‘(xii) enhance the capability of the el-
igible entity to share cyber threat indictors 
and related information with the Depart-
ment; 
‘‘(xiii) leverage cybersecurity services 
offered by the Department; 
‘‘(xiv) develop and coordinate strate-
gies to address cybersecurity risks and cy-
bersecurity threats to information systems 
of the eligible entity in consultation with— 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(I) local and Tribal organiza-
tions within the jurisdiction of the eli-
gible entity; and 
‘‘(II) as applicable— 
‘‘(aa) States that neighbor 
the jurisdiction of the eligible en-
tity or, as appropriate, members 
of an information sharing and 
analysis organization; and 
‘‘(bb) countries that neigh-
bor the jurisdiction of the eligible 
entity; and 
‘‘(xv) implement an information tech-
nology and operational technology mod-
ernization cybersecurity review process 
that ensures alignment between informa-
tion technology and operational technology 
cybersecurity objectives; 
‘‘(C) describe, to the extent practicable, the 
individual responsibilities of the eligible entity 
and local and Tribal organizations within the 
jurisdiction of the eligible entity in imple-
menting the plan; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(D) outline, to the extent practicable, the 
necessary resources and a timeline for imple-
menting the plan; and 
‘‘(E) describe how the eligible entity will 
measure progress towards implementing the 
plan. 
‘‘(3) DISCRETIONARY ELEMENTS.—A Cyberse-
curity Plan of an eligible entity may include a de-
scription of— 
‘‘(A) cooperative programs developed by 
groups of local and Tribal organizations within 
the jurisdiction of the eligible entity to address 
cybersecurity risks and cybersecurity threats; 
and 
‘‘(B) programs provided by the eligible en-
tity to support local and Tribal organizations 
and owners and operators of critical infrastruc-
ture to address cybersecurity risks and cyberse-
curity threats. 
‘‘(4) MANAGEMENT OF FUNDS.—An eligible en-
tity applying for a grant under this section shall 
agree to designate the Chief Information Officer, the 
Chief Information Security Officer, or an equivalent 
official of the eligible entity as the primary official 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
for the management and allocation of funds awarded 
under this section. 
‘‘(f) MULTISTATE GRANTS.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, may award grants under this 
section to a group of two or more eligible entities to 
support multistate efforts to address cybersecurity 
risks and cybersecurity threats to information sys-
tems within the jurisdictions of the eligible entities. 
‘‘(2) 
SATISFACTION
OF
OTHER
REQUIRE-
MENTS.—In order to be eligible for a multistate 
grant under this subsection, each eligible entity that 
comprises a multistate group shall submit to the 
Secretary— 
‘‘(A) a Cybersecurity Plan for approval in 
accordance with subsection (i); and 
‘‘(B) a plan for establishing a cybersecu-
rity planning committee under subsection (g). 
‘‘(3) APPLICATION.— 
‘‘(A) IN
GENERAL.—A multistate group 
applying for a multistate grant under para-
graph (1) shall submit to the Secretary an ap-
plication at such time, in such manner, and 
containing such information as the Secretary 
may require. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(B) 
MULTISTATE
PROJECT
DESCRIP-
TION.—An application of a multistate group 
under subparagraph (A) shall include a plan de-
scribing— 
‘‘(i) the division of responsibilities 
among the eligible entities that comprise 
the multistate group for administering the 
grant for which application is being made; 
‘‘(ii) the distribution of funding from 
such a grant among the eligible entities 
that comprise the multistate group; and 
‘‘(iii) how the eligible entities that 
comprise the multistate group will work to-
gether to implement the Cybersecurity 
Plan of each of those eligible entities. 
‘‘(g) PLANNING COMMITTEES.— 
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section shall establish a cy-
bersecurity planning committee to— 
‘‘(A) assist in the development, implemen-
tation, and revision of the Cybersecurity Plan of 
the eligible entity; 
‘‘(B) approve the Cybersecurity Plan of the 
eligible entity; and 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(C) assist in the determination of effec-
tive funding priorities for a grant under this 
section in accordance with subsection (h). 
‘‘(2) COMPOSITION.—A committee of an eligible 
entity established under paragraph (1) shall— 
‘‘(A) be comprised of representatives from 
the eligible entity and counties, cities, towns, 
Tribes, and public educational and health insti-
tutions within the jurisdiction of the eligible en-
tity; and 
‘‘(B) include, as appropriate, representa-
tives of rural, suburban, and high-population 
jurisdictions. 
‘‘(3) CYBERSECURITY
EXPERTISE.—Not less 
than 1⁄2 of the representatives of a committee estab-
lished under paragraph (1) shall have professional 
experience relating to cybersecurity or information 
technology. 
‘‘(4) RULE OF CONSTRUCTION REGARDING EX-
ISTING
PLANNING
COMMITTEES.—Nothing in this 
subsection may be construed to require an eligible 
entity to establish a cybersecurity planning com-
mittee if the eligible entity has established and uses 
a multijurisdictional planning committee or commis-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
sion that meets, or may be leveraged to meet, the re-
quirements of this subsection. 
‘‘(h) USE OF FUNDS.—An eligible entity that receives 
a grant under this section shall use the grant to— 
‘‘(1) implement the Cybersecurity Plan of the 
eligible entity; 
‘‘(2) develop or revise the Cybersecurity Plan of 
the eligible entity; or 
‘‘(3) assist with activities that address immi-
nent cybersecurity risks or cybersecurity threats to 
the information systems of the eligible entity or a 
local or Tribal organization within the jurisdiction of 
the eligible entity. 
‘‘(i) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore an eligible entity may receive a grant under this 
section, the Secretary, acting through the Director, 
shall review the Cybersecurity Plan, or any revisions 
thereto, of the eligible entity and approve such plan, 
or revised plan, if it satisfies the requirements speci-
fied in paragraph (2). 
‘‘(2) PLAN
REQUIREMENTS.—In approving a 
Cybersecurity Plan of an eligible entity under this 
subsection, the Director shall ensure that the Cyber-
security Plan— 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(A) satisfies the requirements of sub-
section (e)(2); 
‘‘(B) upon the issuance of the Homeland 
Security Strategy to Improve the Cybersecurity 
of State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210(e), 
complies, as appropriate, with the goals and ob-
jectives of the strategy; and 
‘‘(C) has been approved by the cybersecu-
rity planning committee of the eligible entity es-
tablished under subsection (g). 
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions 
to a Cybersecurity Plan as the Director determines 
appropriate. 
‘‘(4) EXCEPTION.—Notwithstanding subsection 
(e) and paragraph (1) of this subsection, the Sec-
retary may award a grant under this section to an 
eligible entity that does not submit a Cybersecurity 
Plan to the Secretary if— 
‘‘(A) the eligible entity certifies to the Sec-
retary that— 
‘‘(i) the activities that will be sup-
ported by the grant are integral to the de-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
velopment of the Cybersecurity Plan of the 
eligible entity; and 
‘‘(ii) the eligible entity will submit by 
September 30, 2023, to the Secretary a 
Cybersecurity Plan for review, and if ap-
propriate, approval; or 
‘‘(B) the eligible entity certifies to the Sec-
retary, and the Director confirms, that the eli-
gible entity will use funds from the grant to as-
sist with the activities described in subsection 
(h)(3). 
‘‘(j) LIMITATIONS ON USES OF FUNDS.— 
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section may not use the 
grant— 
‘‘(A) to supplant State, local, or Tribal 
funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
‘‘(C) to pay a demand for ransom in an at-
tempt to— 
‘‘(i) regain access to information or 
an information system of the eligible entity 
or of a local or Tribal organization within 
the jurisdiction of the eligible entity; or 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(ii) prevent the disclosure of infor-
mation that has been removed without au-
thorization from an information system of 
the eligible entity or of a local or Tribal or-
ganization within the jurisdiction of the eli-
gible entity; 
‘‘(D) for recreational or social purposes; or 
‘‘(E) for any purpose that does not address 
cybersecurity risks or cybersecurity threats on 
information systems of the eligible entity or of 
a local or Tribal organization within the juris-
diction of the eligible entity. 
‘‘(2) PENALTIES.—In addition to any other 
remedy available, the Secretary may take such ac-
tions as are necessary to ensure that a recipient of 
a grant under this section uses the grant for the 
purposes for which the grant is awarded. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
paragraph (1) may be construed to prohibit the use 
of grant funds provided to a State, local, or Tribal 
organization for otherwise permissible uses under 
this section on the basis that a State, local, or Trib-
al organization has previously used State, local, or 
Tribal funds to support the same or similar uses. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(k) OPPORTUNITY TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
Secretary shall provide applicants with a reasonable op-
portunity to correct defects, if any, in such applications 
before making final awards. 
‘‘(l) APPORTIONMENT.—For fiscal year 2022 and 
each fiscal year thereafter, the Secretary shall apportion 
amounts appropriated to carry out this section among 
States as follows: 
‘‘(1) BASELINE AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the 
Northern Mariana Islands, Guam, the U.S. Virgin 
Islands, and 0.75 percent of such amounts to each 
of the remaining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each eligible entity, 
bears to 
‘‘(B) the population of all eligible entities. 
‘‘(3) 
MINIMUM
ALLOCATION
TO
INDIAN 
TRIBES.— 
‘‘(A) 
IN
GENERAL.—In 
apportioning 
amounts under this section, the Secretary shall 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
ensure that, for each fiscal year, directly eligible 
Tribes collectively receive, from amounts appro-
priated under the State and Local Cybersecu-
rity Grant Program, not less than an amount 
equal to three percent of the total amount ap-
propriated for grants under this section. 
‘‘(B) ALLOCATION.—Of the amount re-
served under subparagraph (A), funds shall be 
allocated in a manner determined by the Sec-
retary in consultation with Indian tribes. 
‘‘(C) EXCEPTION.—This paragraph shall 
not apply in any fiscal year in which the Sec-
retary— 
‘‘(i) receives fewer than five applica-
tions from Indian tribes; or 
‘‘(ii) does not approve at least two ap-
plications from Indian tribes. 
‘‘(m) FEDERAL SHARE.— 
‘‘(1) IN GENERAL.—The Federal share of the 
cost of an activity carried out using funds made 
available with a grant under this section may not ex-
ceed— 
‘‘(A) in the case of a grant to an eligible 
entity— 
‘‘(i) for fiscal year 2022, 90 percent; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(ii) for fiscal year 2023, 80 percent; 
‘‘(iii) for fiscal year 2024, 70 percent; 
‘‘(iv) for fiscal year 2025, 60 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 50 percent; and 
‘‘(B) in the case of a grant to a multistate 
group— 
‘‘(i) for fiscal year 2022, 95 percent; 
‘‘(ii) for fiscal year 2023, 85 percent; 
‘‘(iii) for fiscal year 2024, 75 percent; 
‘‘(iv) for fiscal year 2025, 65 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 55 percent. 
‘‘(2) WAIVER.—The Secretary may waive or 
modify the requirements of paragraph (1) for an In-
dian tribe if the Secretary determines such a waiver 
is in the public interest. 
‘‘(n) RESPONSIBILITIES OF GRANTEES.— 
‘‘(1) CERTIFICATION.—Each eligible entity or 
multistate group that receives a grant under this 
section shall certify to the Secretary that the grant 
will be used— 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(A) for the purpose for which the grant 
is awarded; and 
‘‘(B) in compliance with, as the case may 
be— 
‘‘(i) the Cybersecurity Plan of the eli-
gible entity; 
‘‘(ii) the Cybersecurity Plans of the el-
igible entities that comprise the multistate 
group; or 
‘‘(iii) a purpose approved by the Sec-
retary under subsection (h) or pursuant to 
an exception under subsection (i). 
‘‘(2) AVAILABILITY OF FUNDS TO LOCAL AND 
TRIBAL ORGANIZATIONS.—Not later than 45 days 
after the date on which an eligible entity or 
multistate group receives a grant under this section, 
the eligible entity or multistate group shall, without 
imposing unreasonable or unduly burdensome re-
quirements as a condition of receipt, obligate or oth-
erwise make available to local and Tribal organiza-
tions within the jurisdiction of the eligible entity or 
the eligible entities that comprise the multistate 
group, and as applicable, consistent with the Cyber-
security Plan of the eligible entity or the Cybersecu-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
rity Plans of the eligible entities that comprise the 
multistate group— 
‘‘(A) not less than 80 percent of funds 
available under the grant; 
‘‘(B) with the consent of the local and 
Tribal organizations, items, services, capabili-
ties, or activities having a value of not less than 
80 percent of the amount of the grant; or 
‘‘(C) with the consent of the local and 
Tribal organizations, grant funds combined 
with other items, services, capabilities, or activi-
ties having the total value of not less than 80 
percent of the amount of the grant. 
‘‘(3) CERTIFICATIONS
REGARDING
DISTRIBU-
TION OF GRANT FUNDS TO LOCAL AND TRIBAL OR-
GANIZATIONS.—An eligible entity or multistate 
group shall certify to the Secretary that the eligible 
entity or multistate group has made the distribution 
to local, Tribal, and territorial governments required 
under paragraph (2). 
‘‘(4) EXTENSION OF PERIOD.— 
‘‘(A) IN GENERAL.—An eligible entity or 
multistate group may request in writing that 
the Secretary extend the period of time speci-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
fied in paragraph (2) for an additional period 
of time. 
‘‘(B) APPROVAL.—The Secretary may ap-
prove a request for an extension under subpara-
graph (A) if the Secretary determines the ex-
tension is necessary to ensure that the obliga-
tion and expenditure of grant funds align with 
the purpose of the State and Local Cybersecu-
rity Grant Program. 
‘‘(5) EXCEPTION.—Paragraph (2) shall not 
apply to the District of Columbia, the Common-
wealth of Puerto Rico, American Samoa, the Com-
monwealth of the Northern Mariana Islands, Guam, 
the Virgin Islands, or an Indian tribe. 
‘‘(6) DIRECT FUNDING.—If an eligible entity 
does not make a distribution to a local or Tribal or-
ganization required in accordance with paragraph 
(2), the local or Tribal organization may petition the 
Secretary to request that grant funds be provided di-
rectly to the local or Tribal organization. 
‘‘(7) PENALTIES.—In addition to other rem-
edies available to the Secretary, the Secretary may 
terminate or reduce the amount of a grant awarded 
under this section to an eligible entity or distribute 
grant funds previously awarded to such eligible enti-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
ty directly to the appropriate local or Tribal organi-
zation as a replacement grant in an amount the Sec-
retary determines appropriate if such eligible entity 
violates a requirement of this subsection. 
‘‘(o) ADVISORY COMMITTEE.— 
‘‘(1) ESTABLISHMENT.—Not later than 120 
days after the date of enactment of this section, the 
Director shall establish a State and Local Cyberse-
curity Resilience Committee to provide State, local, 
and Tribal stakeholder expertise, situational aware-
ness, and recommendations to the Director, as ap-
propriate, regarding how to— 
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of 
State, local, or Tribal organizations; and 
‘‘(B) improve the ability of State, local, 
and Tribal organizations to prevent, protect 
against, respond to, mitigate, and recover from 
such cybersecurity risks and cybersecurity 
threats. 
‘‘(2) 
DUTIES.—The 
committee 
established 
under paragraph (1) shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans sub-
mitted by applicants for grants under this sec-
tion, and, as appropriate, submit to the Direc-
tor recommendations to improve those plans 
prior to the approval of the plans under sub-
section (i); 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strat-
egy to Improve Cybersecurity for State, Local, 
Tribal, and Territorial Governments required 
under section 2210; 
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as ap-
propriate, regarding how to— 
‘‘(i) address cybersecurity risks and 
cybersecurity threats on information sys-
tems of State, local, or Tribal organiza-
tions; and 
‘‘(ii) improve the cybersecurity resil-
ience of State, local, or Tribal organiza-
tions; and 
‘‘(E) regularly coordinate with the State, 
Local, Tribal and Territorial Government Co-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
ordinating Council, within the Critical Infra-
structure Partnership Advisory Council, estab-
lished under section 871. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resilience Com-
mittee established pursuant to paragraph (1) 
shall be composed of 15 members appointed by 
the Director, as follows: 
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bu-
reau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) One individual recommended to 
the Director by the National League of 
Cities. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
‘‘(vii) One individual recommended to 
the Director by the Multi-State Informa-
tion Sharing and Analysis Center. 
‘‘(viii) One individual recommended to 
the Director by the National Congress of 
American Indians. 
‘‘(viii) Four individuals who have edu-
cational and professional experience relat-
ing to cybersecurity work or cybersecurity 
policy. 
‘‘(B) TERMS.— 
‘‘(i) IN GENERAL.—Subject to clause 
(ii), each member of the State and Local 
Cybersecurity Resilience Committee shall 
be appointed for a term of two years. 
‘‘(ii) REQUIREMENT.—At least two 
members of the State and Local Cyberse-
curity Resilience Committee shall also be 
members of the State, Local, Tribal and 
Territorial 
Government 
Coordinating 
Council, within the Critical Infrastructure 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
Partnership Advisory Council, established 
under section 871. 
‘‘(iii) EXCEPTION.—A term of a mem-
ber of the State and Local Cybersecurity 
Resilience Committee shall be three years 
if the member is appointed initially to the 
Committee upon the establishment of the 
Committee. 
‘‘(iv) TERM REMAINDERS.—Any mem-
ber of the State and Local Cybersecurity 
Resilience Committee appointed to fill a 
vacancy occurring before the expiration of 
the term for which the member’s prede-
cessor was appointed shall be appointed 
only for the remainder of such term. A 
member may serve after the expiration of 
such member’s term until a successor has 
taken office. 
‘‘(v) VACANCIES.—A vacancy in the 
State and Local Cybersecurity Resilience 
Committee shall be filled in the manner in 
which the original appointment was made. 
‘‘(C) PAY.—Members of the State and 
Local Cybersecurity Resilience Committee shall 
serve without pay. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(4) CHAIRPERSON; VICE CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
ience Committee shall select a chairperson and vice 
chairperson from among members of the committee. 
‘‘(5) 
PERMANENT
AUTHORITY.—Notwith-
standing section 14 of the Federal Advisory Com-
mittee Act (5 U.S.C. App.), the State and Local Cy-
bersecurity Resilience Committee shall be a perma-
nent authority. 
‘‘(p) REPORTS.— 
‘‘(1) ANNUAL
REPORTS
BY
GRANT
RECIPI-
ENTS.— 
‘‘(A) IN
GENERAL.—Not later than one 
year after an eligible entity or multistate group 
receives funds under this section, the eligible 
entity or multistate group shall submit to the 
Secretary a report on the progress of the eligi-
ble entity or multistate group in implementing 
the Cybersecurity Plan of the eligible entity or 
Cybersecurity Plans of the eligible entities that 
comprise the multistate group, as the case may 
be. 
‘‘(B) ABSENCE OF PLAN.—Not later than 
180 days after an eligible entity that does not 
have a Cybersecurity Plan receives funds under 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
this section for developing its Cybersecurity 
Plan, the eligible entity shall submit to the Sec-
retary a report describing how the eligible enti-
ty obligated and expended grant funds during 
the fiscal year to— 
‘‘(i) so develop such a Cybersecurity 
Plan; or 
‘‘(ii) assist with the activities de-
scribed in subsection (h)(3). 
‘‘(2) ANNUAL
REPORTS
TO
CONGRESS.—Not 
less frequently than once per year, the Secretary, 
acting through the Director, shall submit to Con-
gress a report on the use of grants awarded under 
this section and any progress made toward the fol-
lowing: 
‘‘(A) Achieving the objectives set forth in 
the Homeland Security Strategy to Improve the 
Cybersecurity of State, Local, Tribal, and Ter-
ritorial Governments, upon the date on which 
the strategy is issued under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems, ap-
plications, and user accounts owned or operated 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
by or on behalf of State, local, and Tribal orga-
nizations as a result of the award of such 
grants. 
‘‘(q) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this 
section— 
‘‘(1) for each of fiscal years 2022 through 
2026, $500,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘SEC. 2220B. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall 
develop, regularly update, and maintain a resource guide 
for use by State, local, Tribal, and territorial government 
officials, including law enforcement officers, to help such 
officials identify, prepare for, detect, protect against, re-
spond to, and recover from cybersecurity risks (as such 
term is defined in section 2209), cybersecurity threats, 
and incidents (as such term is defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002, as 
amended by section 4, is further amended by inserting 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
after the item relating to section 2220 the following new 
items: 
‘‘Sec. 2220A. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2220B. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL
GOVERNMENTS.—Section 2210 of the 
Homeland Security Act of 2002 (6 U.S.C. 660) is amend-
ed by adding at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Not later than one 
year after the date of the enactment of this 
subsection, the Secretary, acting through the 
Director, shall, in coordination with the heads 
of appropriate Federal agencies, State, local, 
Tribal, and territorial governments, the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A, and other 
stakeholders, as appropriate, develop and make 
publicly available a Homeland Security Strategy 
to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(B) RECOMMENDATIONS
AND
REQUIRE-
MENTS.—The strategy required under subpara-
graph (A) shall— 
‘‘(i) provide recommendations relating 
to the ways in which the Federal Govern-
ment should support and promote the abil-
ity of State, local, Tribal, and territorial 
governments to identify, mitigate against, 
protect against, detect, respond to, and re-
cover from cybersecurity risks (as such 
term is defined in section 2209), cyberse-
curity threats, and incidents (as such term 
is defined in section 2209); and 
‘‘(ii) establish baseline requirements 
for cybersecurity plans under this section 
and principles with which such plans shall 
align. 
‘‘(2) CONTENTS.—The strategy required under 
paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity 
threats, 
incidents, 
and 
ransomware incidents; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
available to State, local, Tribal, and territorial 
governments to help those governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
incidents, and ransomware incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help those governments identify, protect 
against, detect, respond to, and recover from 
cybersecurity risks, cybersecurity threats, inci-
dents, and ransomware incidents and make rec-
ommendations to address such limitations; 
‘‘(D) identify opportunities to improve the 
coordination of the Agency with Federal and 
non-Federal entities, such as the Multi-State 
Information Sharing and Analysis Center, to 
improve— 
‘‘(i) incident exercises, information 
sharing and incident notification proce-
dures; 
‘‘(ii) the ability for State, local, Trib-
al, and territorial governments to volun-
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
tarily adapt and implement guidance in 
Federal binding operational directives; and 
‘‘(iii) opportunities to leverage Federal 
schedules for cybersecurity investments 
under section 502 of title 40, United 
States Code; 
‘‘(E) recommend new initiatives the Fed-
eral Government should undertake to improve 
the ability of State, local, Tribal, and territorial 
governments to identify, protect against, detect, 
respond to, and recover from cybersecurity 
risks, cybersecurity threats, incidents, and 
ransomware incidents; 
‘‘(F) set short-term and long-term goals 
that will improve the ability of State, local, 
Tribal, and territorial governments to identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
incidents, and ransomware incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
and territorial governments to establish baseline 
capabilities to identify, protect against, detect, 
respond to, and recover from cybersecurity 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
risks, cybersecurity threats, incidents, and 
ransomware incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
strategy required under paragraph (1), the Director, 
in coordination with the heads of appropriate Fed-
eral agencies, State, local, Tribal, and territorial 
governments, the State and Local Cybersecurity Re-
silience Committee established under section 2220A, 
and other stakeholders, as appropriate, shall con-
sider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial gov-
ernments, including the resulting costs to such 
governments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
to compromise information systems (as such 
term is defined in section 102 of the Cybersecu-
rity Act of 2015 (6 U.S.C. 1501)) owned or op-
erated by State, local, Tribal, and territorial 
governments; 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A. 
‘‘(4) EXEMPTION.—Chapter 35 of title 44, 
United States Code (commonly known as the ‘Paper-
work Reduction Act’), shall not apply to any action 
to implement this subsection.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGEN-
CY.—Section 2202 of the Homeland Security Act of 2002 
(6 U.S.C. 652) is amended— 
(1) by redesignating subsections (d) through (i) 
as subsections (e) through (j), respectively; and 
(2) by inserting after subsection (c) the fol-
lowing new subsection: 
‘‘(d) ADDITIONAL RESPONSIBILITIES.—In addition 
to the responsibilities under subsection (c), the Director 
shall— 
‘‘(1) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resilience Committee established under section 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
2220A, for the State and Local Cybersecurity Grant 
Program under such section or any other homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(2) review, in consultation with the State and 
Local Cybersecurity Resilience Committee, all cyber-
security plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(3) provide expertise and technical assistance 
to State, local, Tribal, and territorial government of-
ficials with respect to cybersecurity; and 
‘‘(4) provide education, training, and capacity 
development to enhance the security and resilience 
of cybersecurity and infrastructure security.’’. 
(c) FEASIBILITY STUDY.—Not later than 270 days 
after the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security of the 
Department of Homeland Security shall conduct a study 
to assess the feasibility of implementing a short-term rota-
tional program for the detail to the Agency of approved 
State, local, Tribal, and territorial government employees 
in cyber workforce positions. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
SEC. 4. TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS. 
(a) TECHNICAL AMENDMENTS.— 
(1) HOMELAND SECURITY ACT OF 2002.—Sub-
title A of title XXII of the Homeland Security Act 
of 2002 (6 U.S.C. 651 et seq.) is amended— 
(A) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities relat-
ing to .gov internet domain), by amending the 
section enumerator and heading to read as fol-
lows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(B) in the second section 2215 (6 U.S.C. 
665b; relating to the joint cyber planning of-
fice), by amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(C) in the third section 2215 (6 U.S.C. 
665c; relating to the Cybersecurity State Coor-
dinator), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(D) in the fourth section 2215 (6 U.S.C. 
665d; relating to Sector Risk Management 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
Agencies), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(E) in section 2216 (6 U.S.C. 665e; relat-
ing to the Cybersecurity Advisory Committee), 
by amending the section enumerator and head-
ing to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 
and 
(F) in section 2217 (6 U.S.C. 665f; relat-
ing to Cybersecurity Education and Training 
Programs), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(2) 
CONSOLIDATED
APPROPRIATIONS
ACT, 
2021.—Paragraph (1) of section 904(b) of division U 
of the Consolidated Appropriations Act, 2021 (Pub-
lic Law 116–260) is amended, in the matter pre-
ceding subparagraph (A), by inserting ‘‘of 2002’’ 
after ‘‘Homeland Security Act’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by striking the items relating to sections 2214 
through 2217 and inserting the following new items: 
‘‘Sec. 2214. National Asset Database. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00042
Fmt 6652
Sfmt 6211
Z:\XMLBILLS\H3138.EH
NODE
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs.’’. 
Passed the House of Representatives July 20, 2021. 
Attest: 
Clerk. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
Z:\XMLBILLS\H3138.EH
NODE
117TH CONGRESS 
1ST SESSION 
H. R. 3138 
AN ACT 
To amend the Homeland Security Act of 2002 to 
authorize a grant program relating to the cyber-
security of State and local governments, and for 
other purposes. 
VerDate Sep 11 2014 
11:02 Jul 21, 2021
Jkt 000000
PO 00000
Frm 00044
Fmt 6651
Sfmt 6651
Z:\XMLBILLS\H3138.EH
NODE