I 
117TH CONGRESS 
1ST SESSION H. R. 3138 
To amend the Homeland Security Act of 2002 to authorize a grant program 
relating to the cybersecurity of State and local governments, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 12, 2021 
Ms. CLARKE of New York (for herself, Mr. GARBARINO, Mr. KILMER, Mr. 
KATKO, Mr. RUPPERSBERGER, Mr. MCCAUL, and Mr. THOMPSON of Mis-
sissippi) introduced the following bill; which was referred to the Com-
mittee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
a grant program relating to the cybersecurity of State 
and local governments, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber-
security Improvement Act’’. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new sec-
tions: 
‘‘SEC. 2220A. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given the 
term in section 102 of the Cybersecurity Act of 2015 
(6 U.S.C. 1501). 
‘‘(2) CYBERSECURITY PLAN.—The term ‘Cyber-
security Plan’ means a plan submitted by a State 
under subsection (e)(1). 
‘‘(3) ELIGIBLE ENTITY.—The term ‘eligible en-
tity’ means— 
‘‘(A) a State; or 
‘‘(B) a federally recognized Indian Tribe 
that, not later than 120 days after the date of 
the enactment of this section or not later than 
120 days before the start of any fiscal year in 
which a grant under this section is awarded— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) notifies the Secretary that the In-
dian Tribe intends to develop a Cybersecu-
rity Plan; and 
‘‘(ii) agrees to forfeit any distribution 
under subsection (n)(2). 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given the term in section 2209. 
‘‘(5) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given the 
term in section 2222. 
‘‘(6) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 102 of the Cybersecurity Act of 2015 (6 
U.S.C. 1501). 
‘‘(8) ONLINE SERVICE.—The term ‘online serv-
ice’ means any internet-facing service, including a 
website, email, virtual private network, or custom 
application. 
‘‘(9) STATE.—The term ‘State’ means each of 
the several States, the District of Columbia, and the 
territories and possessions of the United States. 
‘‘(10) STATE
AND
LOCAL
CYBERSECURITY 
GRANT PROGRAM.—The term ‘State and Local Cy-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
bersecurity Grant Program’ means the program es-
tablished under subsection (b). 
‘‘(11) STATE AND LOCAL CYBERSECURITY RE-
SILIENCY COMMITTEE.—The term ‘State and Local 
Cybersecurity Resiliency Committee’ means the com-
mittee established under subsection (o)(1). 
‘‘(b) ESTABLISHMENT.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, shall establish a program, to 
be known as the ‘the State and Local Cybersecurity 
Grant Program’, to award grants to eligible entities 
to address cybersecurity risks and cybersecurity 
threats to information systems of State, local, or 
Tribal governments. 
‘‘(2) APPLICATION.—An eligible entity desiring 
a grant under the State and Local Cybersecurity 
Grant Program shall submit to the Secretary an ap-
plication at such time, in such manner, and con-
taining such information as the Secretary may re-
quire. 
‘‘(c) BASELINE REQUIREMENTS.—An eligible entity 
or multistate group that receives a grant under this sec-
tion shall use the grant in compliance with— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) the Cybersecurity Plan of the eligible enti-
ty or the Cybersecurity Plans of the eligible entities 
that comprise the multistate group; and 
‘‘(2) the Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments developed under section 
2210(e)(1). 
‘‘(d) ADMINISTRATION.—The State and Local Cyber-
security Grant Program shall be administered in the same 
office of the Department that administers grants made 
under sections 2003 and 2004. 
‘‘(e) CYBERSECURITY PLANS.— 
‘‘(1) IN GENERAL.—An eligible entity applying 
for a grant under this section shall submit to the 
Secretary a Cybersecurity Plan for approval. 
‘‘(2) REQUIRED ELEMENTS.—A Cybersecurity 
Plan of an eligible entity shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of the eligible entity to pro-
tect against cybersecurity risks and cybersecu-
rity threats to information systems of State, 
local, or Tribal governments; 
‘‘(B) describe, to the extent practicable, 
how the eligible entity will— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) manage, monitor, and track infor-
mation systems owned or operated by the 
eligible entity or by local or Tribal govern-
ments within the jurisdiction of the eligible 
entity and the information technology de-
ployed on those information systems, in-
cluding legacy information systems and in-
formation technology that are no longer 
supported by the manufacturer of the sys-
tems or technology; 
‘‘(ii) monitor activity between infor-
mation systems owned or operated by the 
eligible entity or by local or Tribal govern-
ments within the jurisdiction of the eligible 
entity and between those information sys-
tems and information systems not owned 
or operated by the eligible entity or by 
local or Tribal governments within the ju-
risdiction of the eligible entity; 
‘‘(iii) enhance the preparation, re-
sponse, and resiliency of information sys-
tems owned or operated by the eligible en-
tity or local or Tribal governments against 
cybersecurity 
risks 
and 
cybersecurity 
threats; 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
on information systems of the eligible enti-
ty or local or Tribal governments; 
‘‘(v) ensure that State, local, and 
Tribal governments that own or operate in-
formation systems that are located within 
the jurisdiction of the eligible entity adopt 
best practices and methodologies to en-
hance cybersecurity, such as the practices 
set forth in the cybersecurity framework 
developed by, and the cyber supply chain 
risk management best practices identified 
by, the National Institute of Standards 
and Technology; 
‘‘(vi) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, and Tribal governments, 
including through the use of the .gov inter-
net domain; 
‘‘(vii) ensure continuity of operations 
of the eligible entity and local, and Tribal 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
governments in the event of a cybersecu-
rity incident, including by conducting exer-
cises to practice responding to an incident; 
‘‘(viii) use the National Initiative for 
Cybersecurity 
Education 
Cybersecurity 
Workforce Framework developed by the 
National Institute of Standards and Tech-
nology to identify and mitigate any gaps in 
the cybersecurity workforces of State, 
local, or Tribal governments, enhance re-
cruitment and retention efforts for such 
workforces, and bolster the knowledge, 
skills, and abilities of State, local, and 
Tribal government personnel to address cy-
bersecurity risks and cybersecurity threats, 
such as through cybersecurity hygiene 
training; 
‘‘(ix) ensure continuity of communica-
tions and data networks within the juris-
diction of the eligible entity between the el-
igible entity and local and Tribal govern-
ments that own or operate information sys-
tems within the jurisdiction of the eligible 
entity in the event of an incident involving 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
such communications or data networks 
within the jurisdiction of the eligible entity; 
‘‘(x) assess and mitigate, to the great-
est degree possible, cybersecurity risks and 
cybersecurity threats related to critical in-
frastructure and key resources, the deg-
radation of which may impact the perform-
ance of information systems within the ju-
risdiction of the eligible entity; 
‘‘(xi) enhance capabilities to share 
cyber threat indicators and related infor-
mation between the eligible entity and local 
and Tribal governments that own or oper-
ate information systems within the juris-
diction of the eligible entity; 
‘‘(xii) enhance the capability of the el-
igible entity to share cyber threat indictors 
and related information with the Depart-
ment; 
‘‘(xiii) leverage cybersecurity services 
offered by the Department; and 
‘‘(xiv) develop and coordinate strate-
gies to address cybersecurity risks and cy-
bersecurity threats to information systems 
of the eligible entity in consultation with— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(I) local and Tribal govern-
ments within the jurisdiction of the el-
igible entity; and 
‘‘(II) as applicable— 
‘‘(aa) States that neighbor 
the jurisdiction of the eligible en-
tity or, as appropriate, members 
of an information sharing and 
analysis organization; and 
‘‘(bb) countries that neigh-
bor the jurisdiction of the eligible 
entity; 
‘‘(C) describe, to the extent practicable, the 
individual responsibilities of the eligible entity 
and local and Tribal governments within the ju-
risdiction of the eligible entity in implementing 
the plan; 
‘‘(D) outline, to the extent practicable, the 
necessary resources and a timeline for imple-
menting the plan; and 
‘‘(E) describe how the eligible entity will 
measure progress towards implementing the 
plan. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) DISCRETIONARY ELEMENTS.—A Cyberse-
curity Plan of an eligible entity may include a de-
scription of— 
‘‘(A) cooperative programs developed by 
groups of local and Tribal governments within 
the jurisdiction of the eligible entity to address 
cybersecurity risks and cybersecurity threats; 
and 
‘‘(B) programs provided by the eligible en-
tity to support local and Tribal governments 
and owners and operators of critical infrastruc-
ture to address cybersecurity risks and cyberse-
curity threats. 
‘‘(4) MANAGEMENT OF FUNDS.—An eligible en-
tity applying for a grant under this section shall 
agree to designate the Chief Information Officer, the 
Chief Information Security Officer, or an equivalent 
official of the eligible entity as the primary official 
for the management and allocation of funds awarded 
under this section. 
‘‘(f) MULTISTATE GRANTS.— 
‘‘(1) IN
GENERAL.—The Secretary, acting 
through the Director, may award grants under this 
section to a group of two or more eligible entities to 
support multistate efforts to address cybersecurity 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
risks and cybersecurity threats to information sys-
tems within the jurisdictions of the eligible entities. 
‘‘(2) 
SATISFACTION
OF
OTHER
REQUIRE-
MENTS.—In order to be eligible for a multistate 
grant under this subsection, each eligible entity that 
comprises a multistate group shall— 
‘‘(A) submit to the Secretary a Cybersecu-
rity Plan for approval in accordance with sub-
section (i); and 
‘‘(B) establish a cybersecurity planning 
committee under subsection (g). 
‘‘(3) APPLICATION.— 
‘‘(A) IN
GENERAL.—A multistate group 
applying for a multistate grant under para-
graph (1) shall submit to the Secretary an ap-
plication at such time, in such manner, and 
containing such information as the Secretary 
may require. 
‘‘(B) JOINT
CYBERSECURITY
PLAN.—An 
application of a multistate group under sub-
paragraph (A) shall include a plan describing— 
‘‘(i) the division of responsibilities 
among the eligible entities that comprise 
the multistate group for administering the 
grant for which application is being made; 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) the distribution of funding from 
such a grant among the eligible entities 
that comprise the multistate group; and 
‘‘(iii) how the eligible entities that 
comprise the multistate group will work to-
gether to implement the Cybersecurity 
Plan of each of those eligible entities. 
‘‘(g) PLANNING COMMITTEES.— 
‘‘(1) IN GENERAL.—An eligible entity applying 
for a grant under this section shall establish a cyber-
security planning committee to— 
‘‘(A) assist in the development, implemen-
tation, and revision of the Cybersecurity Plan of 
the eligible entity; 
‘‘(B) approve the Cybersecurity Plan of the 
eligible entity; and 
‘‘(C) assist in the determination of effec-
tive funding priorities for a grant under this 
section in accordance with subsection (h). 
‘‘(2) COMPOSITION.—A committee of an eligible 
entity established under paragraph (1) shall— 
‘‘(A) be comprised of representatives from 
the eligible entity and counties, cities, towns, 
and Tribes within the jurisdiction of the eligible 
entity; and 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) include, as appropriate, representa-
tives of rural, suburban, and high-population 
jurisdictions. 
‘‘(3) CYBERSECURITY
EXPERTISE.—Not less 
than 1⁄2 of the representatives of a committee estab-
lished under paragraph (1) shall have professional 
experience relating to cybersecurity or information 
technology. 
‘‘(4) RULE OF CONSTRUCTION REGARDING EX-
ISTING
PLANNING
COMMITTEES.—Nothing in this 
subsection may be construed to require an eligible 
entity to establish a cybersecurity planning com-
mittee if the eligible entity has established and uses 
a multijurisdictional planning committee or commis-
sion that meets the requirements of this subsection. 
‘‘(h) USE OF FUNDS.—An eligible entity that receives 
a grant under this section shall use the grant to— 
‘‘(1) implement the Cybersecurity Plan of the 
eligible entity; 
‘‘(2) develop or revise the Cybersecurity Plan of 
the eligible entity; or 
‘‘(3) assist with activities that address immi-
nent cybersecurity risks or cybersecurity threats to 
the information systems of the eligible entity or a 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
local or Tribal government within the jurisdiction of 
the eligible entity. 
‘‘(i) APPROVAL OF PLANS.— 
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be-
fore an eligible entity may receive a grant under this 
section, the Secretary, acting through the Director, 
shall review the Cybersecurity Plan, or any revisions 
thereto, of the eligible entity and approve such plan, 
or revised plan, if it satisfies the requirements speci-
fied in paragraph (2). 
‘‘(2) PLAN
REQUIREMENTS.—In approving a 
Cybersecurity Plan of an eligible entity under this 
subsection, the Director shall ensure that the Cyber-
security Plan— 
‘‘(A) satisfies the requirements of sub-
section (e)(2); 
‘‘(B) upon the issuance of the Homeland 
Security Strategy to Improve the Cybersecurity 
of State, Local, Tribal, and Territorial Govern-
ments authorized pursuant to section 2210(e), 
complies, as appropriate, with the goals and ob-
jectives of the strategy; and 
‘‘(C) has been approved by the cybersecu-
rity planning committee of the eligible entity es-
tablished under subsection (g). 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) APPROVAL OF REVISIONS.—The Secretary, 
acting through the Director, may approve revisions 
to a Cybersecurity Plan as the Director determines 
appropriate. 
‘‘(4) EXCEPTION.—Notwithstanding subsection 
(e) and paragraph (1) of this subsection, the Sec-
retary may award a grant under this section to an 
eligible entity that does not submit a Cybersecurity 
Plan to the Secretary if— 
‘‘(A) the eligible entity certifies to the Sec-
retary that— 
‘‘(i) the activities that will be sup-
ported by the grant are integral to the de-
velopment of the Cybersecurity Plan of the 
eligible entity; and 
‘‘(ii) the eligible entity will submit by 
September 30, 2023, to the Secretary a 
Cybersecurity Plan for review, and if ap-
propriate, approval; or 
‘‘(B) the eligible entity certifies to the Sec-
retary, and the Director confirms, that the eli-
gible entity will use funds from the grant to as-
sist with the activities described in subsection 
(h)(3). 
‘‘(j) LIMITATIONS ON USES OF FUNDS.— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—An eligible entity that re-
ceives a grant under this section may not use the 
grant— 
‘‘(A) to supplant State, local, or Tribal 
funds; 
‘‘(B) for any recipient cost-sharing con-
tribution; 
‘‘(C) to pay a demand for ransom in an at-
tempt to regain access to information or an in-
formation system of the eligible entity or of a 
local or Tribal government within the jurisdic-
tion of the eligible entity; 
‘‘(D) for recreational or social purposes; or 
‘‘(E) for any purpose that does not address 
cybersecurity risks or cybersecurity threats on 
information systems of the eligible entity or of 
a local or Tribal government within the jurisdic-
tion of the eligible entity. 
‘‘(2) PENALTIES.—In addition to any other 
remedy available, the Secretary may take such ac-
tions as are necessary to ensure that a recipient of 
a grant under this section uses the grant for the 
purposes for which the grant is awarded. 
‘‘(k) OPPORTUNITY TO AMEND APPLICATIONS.—In 
considering applications for grants under this section, the 
VerDate Sep 11 2014 
00:15 May 14, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
Secretary shall provide applicants with a reasonable op-
portunity to correct defects, if any, in such applications 
before making final awards. 
‘‘(l) APPORTIONMENT.—For fiscal year 2022 and 
each fiscal year thereafter, the Secretary shall apportion 
amounts appropriated to carry out this section among 
States as follows: 
‘‘(1) BASELINE AMOUNT.—The Secretary shall 
first apportion 0.25 percent of such amounts to each 
of American Samoa, the Commonwealth of the 
Northern Mariana Islands, Guam, the Virgin Is-
lands,, and 0.75 percent of such amounts to each of 
the remaining States. 
‘‘(2) REMAINDER.—The Secretary shall appor-
tion the remainder of such amounts in the ratio 
that— 
‘‘(A) the population of each eligible entity, 
bears to 
‘‘(B) the population of all eligible entities. 
‘‘(m) FEDERAL SHARE.— 
‘‘(1) IN GENERAL.—The Federal share of the 
cost of an activity carried out using funds made 
available with a grant under this section may not ex-
ceed— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) in the case of a grant to an eligible 
entity— 
‘‘(i) for fiscal year 2022, 90 percent; 
‘‘(ii) for fiscal year 2023, 80 percent; 
‘‘(iii) for fiscal year 2024, 70 percent; 
‘‘(iv) for fiscal year 2025, 60 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 50 percent; and 
‘‘(B) in the case of a grant to a multistate 
group— 
‘‘(i) for fiscal year 2022, 95 percent; 
‘‘(ii) for fiscal year 2023, 85 percent; 
‘‘(iii) for fiscal year 2024, 75 percent; 
‘‘(iv) for fiscal year 2025, 65 percent; 
and 
‘‘(v) for fiscal year 2026 and each 
subsequent fiscal year, 55 percent. 
‘‘(n) RESPONSIBILITIES OF GRANTEES.— 
‘‘(1) CERTIFICATION.—Each eligible entity or 
multistate group that receives a grant under this 
section shall certify to the Secretary that the grant 
will be used— 
‘‘(A) for the purpose for which the grant 
is awarded; and 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) in compliance with, as the case may 
be— 
‘‘(i) the Cybersecurity Plan of the eli-
gible entity; 
‘‘(ii) the Cybersecurity Plans of the el-
igible entities that comprise the multistate 
group; or 
‘‘(iii) a purpose approved by the Sec-
retary under subsection (h). 
‘‘(2) AVAILABILITY OF FUNDS TO LOCAL AND 
TRIBAL
GOVERNMENTS.—Not later than 45 days 
after the date on which an eligible entity or 
multistate group receives a grant under this section, 
the eligible entity or multistate group shall, without 
imposing unreasonable or unduly burdensome re-
quirements as a condition of receipt, obligate or oth-
erwise make available to local and Tribal govern-
ments within the jurisdiction of the eligible entity or 
the eligible entities that comprise the multistate 
group, consistent with the Cybersecurity Plan of the 
eligible entity or the Cybersecurity Plans of the eligi-
ble entities that comprise the multistate group— 
‘‘(A) not less than 80 percent of funds 
available under the grant; 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) with the consent of the local and 
Tribal governments, items, services, capabilities, 
or activities having a value of not less than 80 
percent of the amount of the grant; or 
‘‘(C) with the consent of the local and 
Tribal governments, grant funds combined with 
other items, services, capabilities, or activities 
having the total value of not less than 80 per-
cent of the amount of the grant. 
‘‘(3) CERTIFICATIONS
REGARDING
DISTRIBU-
TION OF GRANT FUNDS TO LOCAL AND TRIBAL GOV-
ERNMENTS.—An eligible entity or multistate group 
shall certify to the Secretary that the eligible entity 
or multistate group has made the distribution to 
local, Tribal, and territorial governments required 
under paragraph (2). 
‘‘(4) EXTENSION OF PERIOD.— 
‘‘(A) IN GENERAL.—An eligible entity or 
multistate group may request in writing that 
the Secretary extend the period of time speci-
fied in paragraph (2) for an additional period 
of time. 
‘‘(B) APPROVAL.—The Secretary may ap-
prove a request for an extension under subpara-
graph (A) if the Secretary determines the ex-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
tension is necessary to ensure that the obliga-
tion and expenditure of grant funds align with 
the purpose of the State and Local Cybersecu-
rity Grant Program. 
‘‘(5) EXCEPTION.—Paragraph (2) shall not 
apply to the District of Columbia, the Common-
wealth of Puerto Rico, American Samoa, the Com-
monwealth of the Northern Mariana Islands, Guam, 
the Virgin Islands, or a Federally recognized Indian 
Tribe. 
‘‘(6) DIRECT FUNDING.—If an eligible entity 
does not make a distribution to a local or Tribal 
government required in accordance with paragraph 
(2), the local or Tribal government may petition the 
Secretary. 
‘‘(7) PENALTIES.—In addition to other rem-
edies available to the Secretary, the Secretary may 
terminate or reduce the amount of a grant awarded 
under this section to an eligible entity or transfer 
grant funds previously awarded to such eligible enti-
ty directly to the appropriate local or Tribal govern-
ment if such eligible entity violates a requirement of 
this subsection. 
‘‘(o) ADVISORY COMMITTEE.— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) ESTABLISHMENT.—Not later than 120 
days after the date of enactment of this section, the 
Director shall establish a State and Local Cyberse-
curity Resiliency Committee to provide State, local, 
and Tribal stakeholder expertise, situational aware-
ness, and recommendations to the Director, as ap-
propriate, regarding how to— 
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of 
State, local, or Tribal governments; and 
‘‘(B) improve the ability of State, local, 
and Tribal governments to prevent, protect 
against, respond to, mitigate, and recover from 
such cybersecurity risks and cybersecurity 
threats. 
‘‘(2) 
DUTIES.—The 
committee 
established 
under paragraph (1) shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans sub-
mitted by applicants for grants under this sec-
tion, and, as appropriate, submit to the Direc-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
tor recommendations to improve those plans 
prior to the approval of the plans under sub-
section (i); 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strat-
egy to Improve Cybersecurity for State, Local, 
Tribal, and Territorial Governments required 
under section 2210; and 
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as ap-
propriate, regarding how to— 
‘‘(i) address cybersecurity risks and 
cybersecurity threats on information sys-
tems of State, local, or Tribal govern-
ments; and 
‘‘(ii) improve the cybersecurity resil-
ience of State, local, or Tribal govern-
ments. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resiliency Com-
mittee established pursuant to paragraph (1) 
shall be composed of 15 members appointed by 
the Director, as follows: 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bu-
reau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) One individual recommended to 
the Director by the National League of 
Cities. 
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
‘‘(vii) One individual recommended to 
the Director by the Multi-State Informa-
tion Sharing and Analysis Center. 
‘‘(viii) One individual recommended to 
the Director by the National Congress of 
American Indians. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(viii) Four individuals who have edu-
cational and professional experience relat-
ing to cybersecurity work or cybersecurity 
policy. 
‘‘(B) TERMS.— 
‘‘(i) IN GENERAL.—Subject to clause 
(ii), each member of the State and Local 
Cybersecurity Resiliency Committee shall 
be appointed for a term of two years. 
‘‘(ii) EXCEPTION.—A term of a mem-
ber of the State and Local Cybersecurity 
Resiliency Committee shall be three years 
if the member is appointed initially to the 
Committee upon the establishment of the 
Committee. 
‘‘(iii) TERM REMAINDERS.—Any mem-
ber of the State and Local Cybersecurity 
Resiliency Committee appointed to fill a 
vacancy occurring before the expiration of 
the term for which the member’s prede-
cessor was appointed shall be appointed 
only for the remainder of such term. A 
member may serve after the expiration of 
such member’s term until a successor has 
taken office. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iv) VACANCIES.—A vacancy in State 
and Local Cybersecurity Resiliency Com-
mittee shall be filled in the manner in 
which the original appointment was made. 
‘‘(C) PAY.—Members of the State and 
Local Cybersecurity Resiliency Committee shall 
serve without pay. 
‘‘(4) CHAIRPERSON; VICE CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
iency Committee shall select a chairperson and vice 
chairperson from among members of the committee. 
‘‘(5) 
PERMANENT
AUTHORITY.—Notwith-
standing section 14 of the Federal Advisory Com-
mittee Act (5 U.S.C. App.), the State and Local Cy-
bersecurity Resiliency Committee shall be a perma-
nent authority. 
‘‘(p) REPORTS.— 
‘‘(1) ANNUAL
REPORTS
BY
GRANT
RECIPI-
ENTS.— 
‘‘(A) IN
GENERAL.—Not later than 30 
days after the end of a fiscal year during which 
an eligible entity or multistate group receives 
funds under this section, the eligible entity or 
multistate group shall submit to the Secretary 
a report on the progress of the eligible entity or 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
multistate group in implementing the Cyberse-
curity Plan of the eligible entity or Cybersecu-
rity Plans of the eligible entities that comprise 
the multistate group, as the case may be. 
‘‘(B) ABSENCE OF PLAN.—Not later than 
30 days after the end of a fiscal year during 
which an eligible entity that does not have a 
Cybersecurity Plan receives funds under this 
section, the eligible entity shall submit to the 
Secretary a report describing how the eligible 
entity obligated and expended grant funds dur-
ing the fiscal year to— 
‘‘(i) develop a Cybersecurity Plan; or 
‘‘(ii) assist with the activities de-
scribed in subsection (h)(3). 
‘‘(C) PUBLIC
AVAILABILITY.—The Sec-
retary, acting through the Director, shall make 
each report submitted under subparagraphs (A) 
and (B) publicly available, including by making 
each such report available on the internet 
website of the Agency, subject to any redactions 
the Director determines necessary to protect 
classified or other sensitive information. 
‘‘(2) ANNUAL
REPORTS
TO
CONGRESS.—Not 
less than frequently than once per year, the Sec-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
retary, acting through the Director, shall submit to 
Congress a report on the use of grants awarded 
under this section and any progress made toward 
the following: 
‘‘(A) Achieving the objectives set forth in 
the Homeland Security Strategy to Improve the 
Cybersecurity of State, Local, Tribal, and Ter-
ritorial Governments, upon the date on which 
the strategy is issued under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems 
owned or operated by State, local, and Tribal 
governments as a result of the award of such 
grants. 
‘‘(q) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this 
section— 
‘‘(1) for each of fiscal years 2022 through 
2026, $500,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 2220B. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall 
develop, regularly update, and maintain a resource guide 
for use by State, local, Tribal, and territorial government 
officials, including law enforcement officers, to help such 
officials identify, prepare for, detect, protect against, re-
spond to, and recover from cybersecurity risks (as such 
term is defined in section 2209), cybersecurity threats, 
and incidents (as such term is defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002, as 
amended by section 4, is further amended by inserting 
after the item relating to section 2220 the following new 
items: 
‘‘Sec. 2220A. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2220B. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL
GOVERNMENTS.—Section 2210 of the 
Homeland Security Act of 2002 (6 U.S.C. 660) is amend-
ed by adding at the end the following new subsection: 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Not later than 270 
days after the date of the enactment of this 
subsection, the Secretary, acting through the 
Director, shall, in coordination with the heads 
of appropriate Federal agencies, State, local, 
Tribal, and territorial governments, the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A, and other 
stakeholders, as appropriate, develop and make 
publicly available a Homeland Security Strategy 
to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments. 
‘‘(B) RECOMMENDATIONS
AND
REQUIRE-
MENTS.—The strategy required under subpara-
graph (A) shall— 
‘‘(i) provide recommendations relating 
to the ways in which the Federal Govern-
ment should support and promote the abil-
ity of State, local, Tribal, and territorial 
governments to identify, protect against, 
detect, respond to, and recover from cyber-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
security risks (as such term is defined in 
section 2209), cybersecurity threats, and 
incidents (as such term is defined in sec-
tion 2209); and 
‘‘(ii) establish baseline requirements 
for cybersecurity plans under this section 
and principles with which such plans shall 
align. 
‘‘(2) CONTENTS.—The strategy required under 
paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents; 
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
available to State, local, Tribal, and territorial 
governments to help those governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
to help those governments identify, protect 
against, detect, respond to, and recover from 
cybersecurity risks, cybersecurity threats, and 
incidents, and make recommendations to ad-
dress such limitations; 
‘‘(D) identify opportunities to improve the 
coordination of the Agency with Federal and 
non-Federal entities, such as the Multi-State 
Information Sharing and Analysis Center, to 
improve— 
‘‘(i) incident exercises, information 
sharing and incident notification proce-
dures; 
‘‘(ii) the ability for State, local, Trib-
al, and territorial governments to volun-
tarily adapt and implement guidance in 
Federal binding operational directives; and 
‘‘(iii) opportunities to leverage Federal 
schedules for cybersecurity investments 
under section 502 of title 40, United 
States Code; 
‘‘(E) recommend new initiatives the Fed-
eral Government should undertake to improve 
the ability of State, local, Tribal, and territorial 
governments to identify, protect against, detect, 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
respond to, and recover from cybersecurity 
risks, cybersecurity threats, and incidents; 
‘‘(F) set short-term and long-term goals 
that will improve the ability of State, local, 
Tribal, and territorial governments to identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
and territorial governments to establish baseline 
capabilities to identify, protect against, detect, 
respond to, and recover from cybersecurity 
risks, cybersecurity threats, and incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
strategy required under paragraph (1), the Director, 
in coordination with the heads of appropriate Fed-
eral agencies, State, local, Tribal, and territorial 
governments, the State and Local Cybersecurity Re-
silience Committee established under section 2220A, 
and other stakeholders, as appropriate, shall con-
sider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial gov-
ernments, including the resulting costs to such 
governments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
to compromise information systems (as such 
term is defined in section 102 of the Cybersecu-
rity Act of 2015 (6 U.S.C. 1501)) owned or op-
erated by State, local, Tribal, and territorial 
governments; 
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGEN-
CY.—Section 2202(c) of the Homeland Security Act of 
2002 (6 U.S.C. 652(c)) is amended— 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
(1) by redesignating paragraphs (6), (7), (8), 
(9), (10), and (11) as paragraphs (10), (11), (12), 
(13), (14), and (15), respectively; and 
(2) by inserting after paragraph (5) the fol-
lowing new paragraphs: 
‘‘(6) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resiliency Committee established under section 
2220A, for the State and Local Cybersecurity Grant 
Program under such section or any other homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(7) review, in consultation with the State and 
Local Cybersecurity Resiliency Committee, all cyber-
security plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(8) provide expertise and technical assistance 
to State, local, Tribal, and territorial government of-
ficials with respect to cybersecurity; 
‘‘(9) provide education, training, and capacity 
development to enhance the security and resilience 
of cybersecurity and infrastructure security;’’. 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
(c) FEASIBILITY STUDY.—Not later than 180 days 
after the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security of the 
Department of Homeland Security shall conduct a study 
to assess the feasibility of implementing a short-term rota-
tional program for the detail to the Agency of approved 
State, local, Tribal, and territorial government employees 
in cyber workforce positions. 
SEC. 4. TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS. 
(a) TECHNICAL AMENDMENTS.— 
(1) HOMELAND SECURITY ACT OF 2002.—Sub-
title A of title XXII of the Homeland Security Act 
of 2002 (6 U.S.C. 651 et seq.) is amended— 
(A) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities relat-
ing to .gov internet domain), by amending the 
section enumerator and heading to read as fol-
lows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(B) in the second section 2215 (6 U.S.C. 
665b; relating to the joint cyber planning of-
fice), by amending the section enumerator and 
heading to read as follows: 
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(C) in the third section 2215 (6 U.S.C. 
665c; relating to the Cybersecurity State Coor-
dinator), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(D) in the fourth section 2215 (6 U.S.C. 
665d; relating to Sector Risk Management 
Agencies), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(E) in section 2216 (6 U.S.C. 665e; relat-
ing to the Cybersecurity Advisory Committee), 
by amending the section enumerator and head-
ing to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(F) in section 2217 (6 U.S.C. 665f; relat-
ing to Cybersecurity Education and Training 
Programs), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(2) 
CONSOLIDATED
APPROPRIATIONS
ACT, 
2021.—Paragraph (1) of section 904(b) of division U 
of the Consolidated Appropriations Act, 2021 (Pub-
lic Law 116–260) is amended, in the matter pre-
VerDate Sep 11 2014 
23:57 May 13, 2021
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.IH
H3138
kjohnson on DSK79L0C42PROD with BILLS