IB 
Union Calendar No. 31 
117TH CONGRESS 
1ST SESSION H. R. 3138 
[Report No. 117–48] 
To amend the Homeland Security Act of 2002 to authorize a grant program 
relating to the cybersecurity of State and local governments, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 12, 2021 
Ms. CLARKE of New York (for herself, Mr. GARBARINO, Mr. KILMER, Mr. 
KATKO, Mr. RUPPERSBERGER, Mr. MCCAUL, and Mr. THOMPSON of Mis-
sissippi) introduced the following bill; which was referred to the Com-
mittee on Homeland Security 
JUNE 1, 2021 
Additional sponsor: Ms. SLOTKIN 
JUNE 1, 2021 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on May 12, 2021] 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
a grant program relating to the cybersecurity of State 
and local governments, and for other purposes. 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyberse-
curity Improvement Act’’. 
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 
amended by adding at the end the following new sections: 
‘‘SEC. 2220A. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given the 
term in section 102 of the Cybersecurity Act of 2015 
(6 U.S.C. 1501). 
‘‘(2) CYBERSECURITY PLAN.—The term ‘Cyberse-
curity Plan’ means a plan submitted by an eligible 
entity under subsection (e)(1). 
‘‘(3) ELIGIBLE ENTITY.—The term ‘eligible enti-
ty’ means— 
‘‘(A) a State; or 
‘‘(B) an Indian tribe that, not later than 
120 days after the date of the enactment of this 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
section or not later than 120 days before the 
start of any fiscal year in which a grant under 
this section is awarded— 
‘‘(i) notifies the Secretary that the In-
dian tribe intends to develop a Cybersecu-
rity Plan; and 
‘‘(ii) agrees to forfeit any distribution 
under subsection (n)(2). 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given the term in section 2209. 
‘‘(5) INDIAN TRIBE; TRIBAL ORGANIZATION.—The 
term ‘Indian tribe’ or ‘Tribal organization’ has the 
meaning given that term in section 4(e) of the of the 
Indian Self-Determination and Education Assistance 
Act (25 U.S.C. 5304(e)). 
‘‘(6) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given the 
term in section 2222. 
‘‘(7) INFORMATION SYSTEM.—The term ‘informa-
tion system’ has the meaning given the term in sec-
tion 102 of the Cybersecurity Act of 2015 (6 U.S.C. 
1501). 
‘‘(8) ONLINE SERVICE.—The term ‘online service’ 
means any internet-facing service, including a 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
website, email, virtual private network, or custom ap-
plication. 
‘‘(9) 
RANSOMWARE
INCIDENT.—The 
term 
‘ransomware incident’ means an incident that actu-
ally or imminently jeopardizes, without lawful au-
thority, the integrity, confidentiality, or availability 
of information on an information system, or actually 
or imminently jeopardizes, without lawful authority, 
an information system for the purpose of coercing the 
information system’s owner, operator, or another per-
son. 
‘‘(10) STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM.—The term ‘State and Local Cybersecurity 
Grant Program’ means the program established under 
subsection (b). 
‘‘(11) STATE AND LOCAL CYBERSECURITY RESIL-
IENCE COMMITTEE.—The term ‘State and Local Cy-
bersecurity Resilience Committee’ means the com-
mittee established under subsection (o)(1). 
‘‘(b) ESTABLISHMENT.— 
‘‘(1) 
IN
GENERAL.—The 
Secretary, 
acting 
through the Director, shall establish a program, to be 
known as the ‘the State and Local Cybersecurity 
Grant Program’, to award grants to eligible entities 
to address cybersecurity risks and cybersecurity 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
threats to information systems of State, local, or Trib-
al organizations. 
‘‘(2) APPLICATION.—An eligible entity seeking a 
grant under the State and Local Cybersecurity Grant 
Program shall submit to the Secretary an application 
at such time, in such manner, and containing such 
information as the Secretary may require. 
‘‘(c) BASELINE REQUIREMENTS.—An eligible entity or 
multistate group that receives a grant under this section 
shall use the grant in compliance with— 
‘‘(1)(A) the Cybersecurity Plan of the eligible en-
tity or the Cybersecurity Plans of the eligible entities 
that comprise the multistate group; and 
‘‘(B) the Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and 
Territorial Governments developed under section 
2210(e)(1); or 
‘‘(2) activities carried out under paragraphs (3), 
(4), and (5) of subsection (h). 
‘‘(d) ADMINISTRATION.—The State and Local Cyberse-
curity Grant Program shall be administered in the same 
office of the Department that administers grants made 
under sections 2003 and 2004. 
‘‘(e) CYBERSECURITY PLANS.— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—An eligible entity applying 
for a grant under this section shall submit to the Sec-
retary a Cybersecurity Plan for approval. 
‘‘(2) REQUIRED
ELEMENTS.—A Cybersecurity 
Plan of an eligible entity shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of the eligible entity to protect 
against cybersecurity risks and cybersecurity 
threats to information systems of State, local, or 
Tribal organizations; 
‘‘(B) describe, to the extent practicable, how 
the eligible entity will— 
‘‘(i) manage, monitor, and track infor-
mation systems, applications, and user ac-
counts owned or operated by or on behalf of 
the eligible entity or by local or Tribal or-
ganizations within the jurisdiction of the el-
igible entity and the information technology 
deployed on those information systems, in-
cluding legacy information systems and in-
formation technology that are no longer 
supported by the manufacturer of the sys-
tems or technology; 
‘‘(ii) monitor, audit, and track activity 
between information systems, applications, 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
and user accounts owned or operated by or 
on behalf of the eligible entity or by local or 
Tribal organizations within the jurisdiction 
of the eligible entity and between those in-
formation systems and information systems 
not owned or operated by the eligible entity 
or by local or Tribal organizations within 
the jurisdiction of the eligible entity; 
‘‘(iii) enhance the preparation, re-
sponse, and resilience of information sys-
tems, applications, and user accounts owned 
or operated by or on behalf of the eligible 
entity or local or Tribal organizations 
against cybersecurity risks and cybersecu-
rity threats; 
‘‘(iv) implement a process of contin-
uous cybersecurity vulnerability assessments 
and threat mitigation practices prioritized 
by degree of risk to address cybersecurity 
risks and cybersecurity threats on informa-
tion systems of the eligible entity or local or 
Tribal organizations; 
‘‘(v) ensure that State, local, and Trib-
al organizations that own or operate infor-
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
mation systems that are located within the 
jurisdiction of the eligible entity— 
‘‘(I) adopt best practices and 
methodologies to enhance cybersecurity, 
such as the practices set forth in the 
cybersecurity framework developed by, 
and the cyber supply chain risk man-
agement best practices identified by, 
the National Institute of Standards 
and Technology; and 
‘‘(II) utilize knowledge bases of 
adversary tools and tactics to assess 
risk; 
‘‘(vi) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, and Tribal organizations, 
including through the use of the .gov inter-
net domain; 
‘‘(vii) ensure continuity of operations 
of the eligible entity and local, and Tribal 
organizations in the event of a cybersecurity 
incident (including a ransomware inci-
dent), including by conducting exercises to 
practice responding to such an incident; 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(viii) use the National Initiative for 
Cybersecurity 
Education 
Cybersecurity 
Workforce Framework developed by the Na-
tional Institute of Standards and Tech-
nology to identify and mitigate any gaps in 
the cybersecurity workforces of State, local, 
or Tribal organizations, enhance recruit-
ment 
and 
retention 
efforts 
for 
such 
workforces, and bolster the knowledge, skills, 
and abilities of State, local, and Tribal or-
ganization personnel to address cybersecu-
rity risks and cybersecurity threats, such as 
through cybersecurity hygiene training; 
‘‘(ix) ensure continuity of communica-
tions and data networks within the jurisdic-
tion of the eligible entity between the eligible 
entity and local and Tribal organizations 
that own or operate information systems 
within the jurisdiction of the eligible entity 
in the event of an incident involving such 
communications or data networks within 
the jurisdiction of the eligible entity; 
‘‘(x) assess and mitigate, to the greatest 
degree possible, cybersecurity risks and cy-
bersecurity threats related to critical infra-
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
structure and key resources, the degradation 
of which may impact the performance of in-
formation systems within the jurisdiction of 
the eligible entity; 
‘‘(xi) enhance capabilities to share 
cyber threat indicators and related informa-
tion between the eligible entity and local 
and Tribal organizations that own or oper-
ate information systems within the jurisdic-
tion of the eligible entity, including by ex-
panding 
existing 
information 
sharing 
agreements with the Department; 
‘‘(xii) enhance the capability of the eli-
gible entity to share cyber threat indictors 
and related information with the Depart-
ment; 
‘‘(xiii) leverage cybersecurity services 
offered by the Department; 
‘‘(xiv) develop and coordinate strate-
gies to address cybersecurity risks and cy-
bersecurity threats to information systems 
of the eligible entity in consultation with— 
‘‘(I) local and Tribal organiza-
tions within the jurisdiction of the eli-
gible entity; and 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS
‘‘(E) describe how the eligible entity will 
measure progress towards implementing the 
plan. 
‘‘(3) DISCRETIONARY ELEMENTS.—A Cybersecu-
rity Plan of an eligible entity may include a descrip-
tion of— 
‘‘(A) cooperative programs developed by 
groups of local and Tribal organizations within 
the jurisdiction of the eligible entity to address 
cybersecurity risks and cybersecurity threats; 
and 
‘‘(B) programs provided by the eligible enti-
ty to support local and Tribal organizations and 
owners and operators of critical infrastructure to 
address cybersecurity risks and cybersecurity 
threats. 
‘‘(4) MANAGEMENT OF FUNDS.—An eligible enti-
ty applying for a grant under this section shall agree 
to designate the Chief Information Officer, the Chief 
Information Security Officer, or an equivalent official 
of the eligible entity as the primary official for the 
management and allocation of funds awarded under 
this section. 
‘‘(f) MULTISTATE GRANTS.— 
VerDate Sep 11 2014 
21:36 Jun 01, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3138.RH
H3138
kjohnson on DSK79L0C42PROD with BILLS