IB 
Union Calendar No. 384 
116TH CONGRESS 
2D SESSION 
H. R. 5823 
[Report No. 116–478] 
To establish a program to make grants to States to address cybersecurity 
risks and cybersecurity threats to information systems of State, local, 
Tribal, or territorial governments, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 10, 2020 
Mr. RICHMOND (for himself, Mr. KATKO, Mr. KILMER, Mr. MCCAUL, Mr. 
RUPPERSBERGER, Mr. THOMPSON of Mississippi, Mr. ROGERS of Ala-
bama, Ms. SLOTKIN, Mr. ROSE of New York, Mr. PAYNE, Mrs. WATSON 
COLEMAN, Mr. LANGEVIN, Mr. CLEAVER, Ms. UNDERWOOD, and Ms. 
TITUS) introduced the following bill; which was referred to the Committee 
on Homeland Security 
AUGUST 18, 2020 
Additional sponsors: Ms. ESHOO, Ms. SEWELL of Alabama, and Ms. JACKSON 
LEE 
AUGUST 18, 2020 
Reported with an amendment; committed to the Committee of the Whole 
House on the State of the Union and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on February 10, 2020] 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
A BILL 
To establish a program to make grants to States to address 
cybersecurity risks and cybersecurity threats to informa-
tion systems of State, local, Tribal, or territorial govern-
ments, and for other purposes. 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyberse-
curity Improvement Act’’. 
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 
amended by adding at the end the following new sections: 
‘‘SEC. 2215. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) ESTABLISHMENT.—The Secretary, acting through 
the Director, shall establish a program to make grants to 
States to address cybersecurity risks and cybersecurity 
threats to information systems of State, local, Tribal, or ter-
ritorial governments (referred to as the ‘State and Local 
Cybersecurity Grant Program’ in this section). 
‘‘(b) BASELINE REQUIREMENTS.—A grant awarded 
under this section shall be used in compliance with the fol-
lowing: 
‘‘(1) The Cybersecurity Plan required under sub-
section (d) and approved pursuant to subsection (g). 
‘‘(2) The Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Territorial Governments required in accordance with 
section 2210, when issued. 
‘‘(c) ADMINISTRATION.—The State and Local Cyberse-
curity Grant Program shall be administered in the same 
program office that administers grants made under sections 
2003 and 2004. 
‘‘(d) ELIGIBILITY.— 
‘‘(1) IN GENERAL.—A State applying for a grant 
under the State and Local Cybersecurity Grant Pro-
gram shall submit to the Secretary a Cybersecurity 
Plan for approval. Such plan shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of such State to protect 
against cybersecurity risks and cybersecurity 
threats to information systems of State, local, 
Tribal, or territorial governments; 
‘‘(B) describe, to the extent practicable, how 
such State shall— 
‘‘(i) enhance the preparation, response, 
and resiliency of information systems 
owned or operated by such State or, if ap-
propriate, by local, Tribal, or territorial 
governments, against cybersecurity risks 
and cybersecurity threats; 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) implement a process of contin-
uous cybersecurity vulnerability assessments 
and threat mitigation practices prioritized 
by degree of risk to address cybersecurity 
risks and cybersecurity threats in informa-
tion systems of such State, local, Tribal, or 
territorial governments; 
‘‘(iii) ensure that State, local, Tribal, 
and territorial governments that own or op-
erate information systems within the State 
adopt best practices and methodologies to 
enhance cybersecurity, such as the practices 
set forth in the cybersecurity framework de-
veloped by the National Institute of Stand-
ards and Technology; 
‘‘(iv) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, Tribal, and territorial gov-
ernments, including through the use of the 
.gov internet domain; 
‘‘(v) mitigate any identified gaps in 
the State, local, Tribal, or territorial gov-
ernment cybersecurity workforces, enhance 
recruitment and retention efforts for such 
workforces, and bolster the knowledge, skills, 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ix) develop and coordinate strategies 
to address cybersecurity risks and cyberse-
curity threats in consultation with— 
‘‘(I) local, Tribal, and territorial 
governments within the State; and 
‘‘(II) as applicable— 
‘‘(aa) neighboring States or, 
as appropriate, members of an in-
formation sharing and analysis 
organization; and 
‘‘(bb) neighboring countries; 
and 
‘‘(C) include, to the extent practicable, an 
inventory of the information technology deployed 
on the information systems owned or operated by 
such State or by local, Tribal, or territorial gov-
ernments within such State, including legacy in-
formation technology that is no longer supported 
by the manufacturer. 
‘‘(e) PLANNING COMMITTEES.— 
‘‘(1) IN GENERAL.—A State applying for a grant 
under this section shall establish a cybersecurity plan-
ning committee to assist in the following: 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) The development, implementation, and 
revision of such State’s Cybersecurity Plan re-
quired under subsection (d). 
‘‘(B) The determination of effective funding 
priorities for such grant in accordance with sub-
section (f). 
‘‘(2) 
COMPOSITION.—Cybersecurity 
planning 
committees described in paragraph (1) shall be com-
prised of representatives from counties, cities, towns, 
and Tribes within the State receiving a grant under 
this section, including, as appropriate, representatives 
of rural, suburban, and high-population jurisdictions. 
‘‘(3) RULE OF CONSTRUCTION REGARDING EXIST-
ING PLANNING COMMITTEES.—Nothing in this sub-
section may be construed to require that any State es-
tablish a cybersecurity planning committee if such 
State has established and uses a multijurisdictional 
planning committee or commission that meets the re-
quirements of this paragraph. 
‘‘(f) USE OF FUNDS.—A State that receives a grant 
under this section shall use the grant to implement such 
State’s Cybersecurity Plan, or to assist with activities deter-
mined by the Secretary, in consultation with the Director, 
to be integral to address cybersecurity risks and cybersecu-
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
rity threats to information systems of State, local, Tribal, 
or territorial governments, as the case may be. 
‘‘(g) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore a State may receive a grant under this section, 
the Secretary, acting through the Director, shall re-
view and approve such State’s Cybersecurity Plan re-
quired under subsection (d). 
‘‘(2) PLAN REQUIREMENTS.—In approving a Cy-
bersecurity Plan under this subsection, the Director 
shall ensure such Plan— 
‘‘(A) meets the requirements specified in 
subsection (d); and 
‘‘(B) upon issuance of the Homeland Secu-
rity Strategy to Improve the Cybersecurity of 
State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210, com-
plies, as appropriate, with the goals and objec-
tives of such Strategy. 
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions to 
a Cybersecurity Plan as the Director determines ap-
propriate. 
‘‘(4) EXCEPTION.—Notwithstanding the require-
ment under subsection (d) to submit a Cybersecurity 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Plan as a condition of apply for a grant under this 
section, such a grant may be awarded to a State that 
has not so submitted a Cybersecurity Plan to the Sec-
retary if— 
‘‘(A) such State certifies to the Secretary 
that it will submit to the Secretary a Cybersecu-
rity Plan for approval by September 30, 2022; 
‘‘(B) such State certifies to the Secretary 
that the activities that will be supported by such 
grant are integral to the development of such Cy-
bersecurity Plan; or 
‘‘(C) such State certifies to the Secretary, 
and the Director confirms, that the activities 
that will be supported by the grant will address 
imminent cybersecurity risks or cybersecurity 
threats to the information systems of such State 
or of a local, Tribal, or territorial government in 
such State. 
‘‘(h) LIMITATIONS ON USES OF FUNDS.— 
‘‘(1) IN GENERAL.—A State that receives a grant 
under this section may not use such grant— 
‘‘(A) to supplant State, local, Tribal, or ter-
ritorial funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) to pay a demand for ransom in an at-
tempt to regain access to information or an in-
formation system of such State or of a local, 
Tribal, or territorial government in such State; 
‘‘(D) for recreational or social purposes; or 
‘‘(E) for any purpose that does not directly 
address cybersecurity risks or cybersecurity 
threats on an information systems of such State 
or of a local, Tribal, or territorial government in 
such State. 
‘‘(2) PENALTIES.—In addition to other remedies 
available, the Secretary may take such actions as are 
necessary to ensure that a recipient of a grant under 
this section is using such grant for the purposes for 
which such grant was awarded. 
‘‘(i) OPPORTUNITY TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
Secretary shall provide applicants with a reasonable oppor-
tunity to correct defects, if any, in such applications before 
making final awards. 
‘‘(j) APPORTIONMENT.—For fiscal year 2020 and each 
fiscal year thereafter, the Secretary shall apportion 
amounts appropriated to carry out this section among 
States as follows: 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) BASELINE
AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the North-
ern Mariana Islands, Guam, and the Virgin Islands, 
and 0.75 percent of such amounts to each of the re-
maining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each State; bears to 
‘‘(B) the population of all States. 
‘‘(k) FEDERAL SHARE.—The Federal share of the cost 
of an activity carried out using funds made available under 
the program may not exceed the following percentages: 
‘‘(1) For fiscal year 2021, 90 percent. 
‘‘(2) For fiscal year 2022, 80 percent. 
‘‘(3) For fiscal year 2023, 70 percent. 
‘‘(4) For fiscal year 2024, 60 percent. 
‘‘(5) For fiscal year 2025 and each subsequent 
fiscal year, 50 percent. 
‘‘(l) STATE RESPONSIBILITIES.— 
‘‘(1) CERTIFICATION.—Each State that receives a 
grant under this section shall certify to the Secretary 
that the grant will be used for the purpose for which 
the grant is awarded and in compliance with the Cy-
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
bersecurity Plan or other purpose approved by the 
Secretary under subsection (g). 
‘‘(2) AVAILABILITY OF FUNDS TO LOCAL, TRIBAL, 
AND TERRITORIAL GOVERNMENTS.—Not later than 45 
days after a State receives a grant under this section, 
such State shall, without imposing unreasonable or 
unduly burdensome requirements as a condition of re-
ceipt, obligate or otherwise make available to local, 
Tribal, and territorial governments in such State, 
consistent with the applicable Cybersecurity Plan— 
‘‘(A) not less than 80 percent of funds avail-
able under such grant; 
‘‘(B) with the consent of such local, Tribal, 
and territorial governments, items, services, ca-
pabilities, or activities having a value of not less 
than 80 percent of the amount of the grant; or 
‘‘(C) with the consent of the local, Tribal, 
and territorial governments, grant funds com-
bined with other items, services, capabilities, or 
activities having the total value of not less than 
80 percent of the amount of the grant. 
‘‘(3) CERTIFICATIONS REGARDING DISTRIBUTION 
OF GRANT FUNDS TO LOCAL, TRIBAL, TERRITORIAL 
GOVERNMENTS.—A State shall certify to the Secretary 
that the State has made the distribution to local, 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Tribal, and territorial governments required under 
paragraph (2). 
‘‘(4) EXTENSION OF PERIOD.—A State may re-
quest in writing that the Secretary extend the period 
of time specified in paragraph (2) for an additional 
period of time. The Secretary may approve such a re-
quest if the Secretary determines such extension is 
necessary to ensure the obligation and expenditure of 
grant funds align with the purpose of the grant pro-
gram. 
‘‘(5) EXCEPTION.—Paragraph (2) shall not 
apply to the District of Columbia, the Commonwealth 
of Puerto Rico, American Samoa, the Commonwealth 
of the Northern Mariana Islands, Guam, or the Vir-
gin Islands. 
‘‘(6) DIRECT
FUNDING.—If a State does not 
make the distribution to local, Tribal, or territorial 
governments in such State required under paragraph 
(2), such a local, Tribal, or territorial government 
may petition the Secretary. 
‘‘(7) PENALTIES.—In addition to other remedies 
available to the Secretary, the Secretary may termi-
nate or reduce the amount of a grant awarded under 
this section to a State or transfer grant funds pre-
viously awarded to such State directly to the appro-
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
priate local, Tribal, or territorial government if such 
State violates a requirement of this subsection. 
‘‘(m) ADVISORY COMMITTEE.— 
‘‘(1) ESTABLISHMENT.—The Director shall estab-
lish a State and Local Cybersecurity Resiliency Com-
mittee to provide State, local, Tribal, and territorial 
stakeholder expertise, situational awareness, and rec-
ommendations to the Director, as appropriate, re-
garding how to— 
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of State, 
local, Tribal, or territorial governments; and 
‘‘(B) improve the ability of such govern-
ments to prevent, protect against, respond, miti-
gate, and recover from cybersecurity risks and 
cybersecurity threats. 
‘‘(2) DUTIES.—The State and Local Cybersecu-
rity Resiliency Committee shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans submitted 
by applicants for grants under this section, and, 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
as appropriate, submit to the Director rec-
ommendations to improve such Plans prior to 
the Director’s determination regarding whether 
to approve such Plans; 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strategy 
to Improve Cybersecurity for State, Local, Trib-
al, and Territorial Governments required under 
section 2210; and 
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as appro-
priate, regarding how to— 
‘‘(i) address cybersecurity risks and cy-
bersecurity threats on information systems 
of State, local, Tribal, or territorial govern-
ments; and 
‘‘(ii) improve the cybersecurity resil-
ience of such governments. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resiliency Com-
mittee shall be composed of 15 members ap-
pointed by the Director, as follows: 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bureau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) Two individuals recommended to 
the Director by the National League of Cit-
ies. 
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
‘‘(vii) One individual recommended to 
the Director by the Multi-State Information 
Sharing and Analysis Center. 
‘‘(viii) Four individuals who have edu-
cational and professional experience related 
to cybersecurity analysis or policy. 
‘‘(B) TERMS.—Each member of the State 
and Local Cybersecurity Resiliency Committee 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
shall be appointed for a term of two years, except 
that such term shall be three years only in the 
case of members who are appointed initially to 
the Committee upon the establishment of the 
Committee. Any member appointed to fill a va-
cancy occurring before the expiration of the term 
for which the member’s predecessor was ap-
pointed shall be appointed only for the remain-
der of such term. A member may serve after the 
expiration of such member’s term until a suc-
cessor has taken office. A vacancy in the Com-
mission shall be filled in the manner in which 
the original appointment was made. 
‘‘(C) PAY.—Members of the State and Local 
Cybersecurity Resiliency Committee shall serve 
without pay. 
‘‘(4) CHAIRPERSON; VICE
CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
iency Committee shall select a chairperson and vice 
chairperson from among Committee members. 
‘‘(5) FEDERAL ADVISORY COMMITTEE ACT.—The 
Federal Advisory Committee Act (5 U.S.C. App.) 
shall not apply to the State and Local Cybersecurity 
Resilience Committee. 
‘‘(n) REPORTS.— 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) ANNUAL REPORTS BY STATE GRANT RECIPI-
ENTS.—A State that receives a grant under this sec-
tion shall annually submit to the Secretary a report 
on the progress of the State in implementing the Cy-
bersecurity Plan approved pursuant to subsection (g). 
If the State does not have a Cybersecurity Plan ap-
proved pursuant to subsection (g), the State shall sub-
mit to the Secretary a report describing how grant 
funds were obligated and expended to develop a Cy-
bersecurity Plan or improve the cybersecurity of in-
formation systems owned or operated by State, local, 
Tribal, or territorial governments in such State. The 
Secretary, acting through the Director, shall make 
each such report publicly available, including by 
making each such report available on the internet 
website of the Agency, subject to any redactions the 
Director determines necessary to protect classified or 
other sensitive information. 
‘‘(2) ANNUAL REPORTS TO CONGRESS.—At least 
once each year, the Secretary, acting through the Di-
rector, shall submit to Congress a report on the use 
of grants awarded under this section and any 
progress made toward the following: 
‘‘(A) Achieving the objectives set forth in the 
Homeland Security Strategy to Improve the Cy-
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
bersecurity of State, Local, Tribal, and Terri-
torial Governments, upon the strategy’s issuance 
under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems owned 
or operated by State, local, Tribal, and terri-
torial governments as a result of the award of 
such grants. 
‘‘(o) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this sec-
tion— 
‘‘(1) for each of fiscal years 2021 through 2025, 
$400,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘(p) DEFINITIONS.—In this section: 
‘‘(1) CRITICAL
INFRASTRUCTURE.—The term 
‘critical infrastructure’ has the meaning given that 
term in section 2. 
‘‘(2) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given such 
term in section 102 of the Cybersecurity Act of 2015. 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) DIRECTOR.—The term ‘Director’ means the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency. 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given such term in section 2209. 
‘‘(5) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given such 
term in section 2222. 
‘‘(6) INFORMATION SYSTEM.—The term ‘informa-
tion system’ has the meaning given such term in sec-
tion 102(9) of the Cybersecurity Act of 2015 (6 U.S.C. 
1501(9)). 
‘‘(7) KEY RESOURCES.—The term ‘key resources’ 
has the meaning given that term in section 2. 
‘‘(8) ONLINE SERVICE.—The term ‘online service’ 
means any internet-facing service, including a 
website, email, virtual private network, or custom ap-
plication. 
‘‘(9) STATE.—The term ‘State’— 
‘‘(A) means each of the several States, the 
District of Colombia, and the territories and pos-
sessions of the United States; and 
‘‘(B) includes any federally recognized In-
dian tribe that notifies the Secretary, not later 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
than 120 days after the date of the enactment of 
this section or not later than 120 days before the 
start of any fiscal year in which a grant under 
this section is awarded, that the tribe intends to 
develop a Cybersecurity Plan and agrees to for-
feit any distribution under subsection (l)(2). 
‘‘SEC. 2216. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall de-
velop a resource guide for use by State, local, Tribal, and 
territorial government officials, including law enforcement 
officers, to help such officials identify, prepare for, detect, 
protect against, respond to, and recover from cybersecurity 
risks, cybersecurity threats, and incidents (as such term is 
defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Homeland Security Act of 2002 is 
amended by inserting after the item relating to section 2214 
the following new items: 
‘‘Sec. 2215. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2216. Cybersecurity resource guide development for State, local, Tribal, and 
territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENTS.—Section 2210 of the Homeland 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Security Act of 2002 (6 U.S.C. 660) is amended by adding 
at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENTS.— 
‘‘(1) IN
GENERAL.—Not later than 270 days 
after the date of the enactment of this subsection, the 
Secretary, acting through the Director, shall, in co-
ordination with appropriate Federal departments and 
agencies, State, local, Tribal, and territorial govern-
ments, the State and Local Cybersecurity Resilience 
Committee (established under section 2215), and other 
stakeholders, as appropriate, develop and make pub-
licly available a Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments that provides recommenda-
tions regarding how the Federal Government should 
support and promote the ability State, local, Tribal, 
and territorial governments to identify, protect 
against, detect respond to, and recover from cyberse-
curity risks, cybersecurity threats, and incidents (as 
such term is defined in section 2209) and establishes 
baseline requirements and principles to which Cyber-
security Plans under such section shall be aligned. 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) CONTENTS.—The Homeland Security Strat-
egy to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments required under 
paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, respond 
to, and recover from cybersecurity risks, cyberse-
curity threats, and incidents; 
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
available to State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help such governments identify, protect 
against, detect, respond to, and recover from cy-
bersecurity risks, cybersecurity threats, and inci-
dents, and make recommendations to address 
such limitations; 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) identify opportunities to improve the 
Agency’s coordination with Federal and non- 
Federal entities, such as the Multi-State Infor-
mation Sharing and Analysis Center, to improve 
incident exercises, information sharing and inci-
dent notification procedures, the ability for 
State, local, Tribal, and territorial governments 
to voluntarily adapt and implement guidance in 
Federal binding operational directives, and op-
portunities to leverage Federal schedules for cy-
bersecurity investments under section 502 of title 
40, United States Code; 
‘‘(E) recommend new initiatives the Federal 
Government should undertake to improve the 
ability of State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(F) set short-term and long-term goals that 
will improve the ability of State, local, Tribal, 
and territorial governments to help such govern-
ments identify, protect against, detect, respond 
to, and recover from cybersecurity risks, cyberse-
curity threats, and incidents; and 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
territorial governments to establish baseline ca-
pabilities to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
Homeland Security Strategy to Improve the Cyberse-
curity of State, Local, Tribal, and Territorial Gov-
ernments required under paragraph (1), the Director, 
in coordination with appropriate Federal depart-
ments and agencies, State, local, Tribal, and terri-
torial governments, the State and Local Cybersecurity 
Resilience Committee, and other stakeholders, as ap-
propriate, shall consider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial govern-
ments, including the resulting costs to such gov-
ernments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
to compromise information systems owned or op-
erated by State, local, Tribal, and territorial 
governments; 
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and Local Cybersecurity Resilience Committee.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE CY-
BERSECURITY AND INFRASTRUCTURE SECURITY AGENCY.— 
Subsection (c) of section 2202 of the Homeland Security 
Act of 2002 (6 U.S.C. 652) is amended— 
(1) by redesignating paragraphs (6) through (11) 
as paragraphs (11) through (16), respectively; and 
(2) by inserting after paragraph (5) the fol-
lowing new paragraphs: 
‘‘(6) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resiliency Committee established under section 2215, 
for the State and Local Cybersecurity Grant Program 
under such section or any other homeland security as-
sistance administered by the Department to improve 
cybersecurity; 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
‘‘(7) review, in consultation with the State and 
Local Cybersecurity Resiliency Committee, all cyber-
security plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland se-
curity assistance administered by the Department to 
improve cybersecurity; 
‘‘(8) provide expertise and technical assistance to 
State, local, Tribal, and territorial government offi-
cials with respect to cybersecurity; 
‘‘(9) provide education, training, and capacity 
development to enhance the security and resilience of 
cybersecurity and infrastructure security; 
‘‘(10) provide information to State, local, Tribal, 
and territorial governments on the security benefits of 
.gov domain name registration services;’’. 
(c) FEASIBILITY STUDY.—Not later than 180 days 
after the date of the enactment of this Act, the Director of 
the Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security shall conduct a study 
to assess the feasibility of implementing a short-term rota-
tional program for the detail of approved State, local, Trib-
al, and territorial government employees in cyber workforce 
positions to the Agency. 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS
Union Calendar No. 384 
116TH CONGRESS 
2D SESSION 
H. R. 5823 
[Report No. 116–478] 
A BILL 
To establish a program to make grants to States to 
address cybersecurity risks and cybersecurity 
threats to information systems of State, local, 
Tribal, or territorial governments, and for other 
purposes. 
AUGUST 18, 2020 
Reported with an amendment; committed to the Com-
mittee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
23:20 Aug 18, 2020
Jkt 099200
PO 00000
Frm 00030
Fmt 6651
Sfmt 6651
E:\BILLS\H5823.RH
H5823
kjohnson on DSK79L0C42PROD with BILLS