tor, shall make each such report publicly available, 
including by making each such report available on 
the internet website of the Agency, subject to any 
redactions the Director determines necessary to pro-
tect classified or other sensitive information. 
‘‘(2) ANNUAL
REPORTS
TO
CONGRESS.—At 
least once each year, the Secretary, acting through 
the Director, shall submit to Congress a report on 
the use of grants awarded under this section and 
any progress made toward the following: 
‘‘(A) Achieving the objectives set forth in 
the Homeland Security Strategy to Improve the 
Cybersecurity of State, Local, Tribal, and Ter-
ritorial 
Governments, 
upon 
the 
strategy’s 
issuance under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems 
owned or operated by State, local, Tribal, and 
territorial governments as a result of the award 
of such grants. 
‘‘(o) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this 
section— 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(1) for each of fiscal years 2021 through 
2025, $400,000,000; and 
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘(p) DEFINITIONS.—In this section: 
‘‘(1) CRITICAL
INFRASTRUCTURE.—The term 
‘critical infrastructure’ has the meaning given that 
term in section 2. 
‘‘(2) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given such 
term in section 102 of the Cybersecurity Act of 
2015. 
‘‘(3) DIRECTOR.—The term ‘Director’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency. 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given such term in section 2209. 
‘‘(5) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given such 
term in section 2222. 
‘‘(6) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given such term in 
section 102(9) of the Cybersecurity Act of 2015 (6 
U.S.C. 1501(9)). 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(7) KEY
RESOURCES.—The term ‘key re-
sources’ has the meaning given that term in section 
2. 
‘‘(8) ONLINE SERVICE.—The term ‘online serv-
ice’ means any internet-facing service, including a 
website, email, virtual private network, or custom 
application. 
‘‘(9) STATE.—The term ‘State’— 
‘‘(A) means each of the several States, the 
District of Columbia, and the territories and 
possessions of the United States; and 
‘‘(B) includes any federally recognized In-
dian tribe that notifies the Secretary, not later 
than 120 days after the date of the enactment 
of this section or not later than 120 days before 
the start of any fiscal year in which a grant 
under this section is awarded, that the tribe in-
tends to develop a Cybersecurity Plan and 
agrees to forfeit any distribution under sub-
section (l)(2). 
‘‘SEC. 2216. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall 
develop a resource guide for use by State, local, Tribal, 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
and territorial government officials, including law enforce-
ment officers, to help such officials identify, prepare for, 
detect, protect against, respond to, and recover from cy-
bersecurity risks, cybersecurity threats, and incidents (as 
such term is defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by inserting after the item relating to section 
2214 the following new items: 
‘‘Sec. 2215. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2216. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 6. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL
GOVERNMENTS.—Section 2210 of the 
Homeland Security Act of 2002 (6 U.S.C. 660) is amend-
ed by adding at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.—Not later than 270 days 
after the date of the enactment of this subsection, 
the Secretary, acting through the Director, shall, in 
coordination with appropriate Federal departments 
and agencies, State, local, Tribal, and territorial 
governments, the State and Local Cybersecurity Re-
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
silience Committee (established under section 2215), 
and other stakeholders, as appropriate, develop and 
make publicly available a Homeland Security Strat-
egy to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments that provides 
recommendations regarding how the Federal Gov-
ernment should support and promote the ability 
State, local, Tribal, and territorial governments to 
identify, protect against, detect respond to, and re-
cover from cybersecurity risks, cybersecurity threats, 
and incidents (as such term is defined in section 
2209) and establishes baseline requirements and 
principles to which Cybersecurity Plans under such 
section shall be aligned. 
‘‘(2) 
CONTENTS.—The 
Homeland 
Security 
Strategy to Improve the Cybersecurity of State, 
Local, Tribal, and Territorial Governments required 
under paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents; 
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS
available to State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help such governments identify, protect 
against, detect, respond to, and recover from 
cybersecurity risks, cybersecurity threats, and 
incidents, and make recommendations to ad-
dress such limitations; 
‘‘(D) identify opportunities to improve the 
Agency’s coordination with Federal and non- 
Federal entities, such as the Multi-State Infor-
mation Sharing and Analysis Center, to im-
prove incident exercises, information sharing 
and incident notification procedures, the ability 
for State, local, Tribal, and territorial govern-
ments to voluntarily adapt and implement guid-
ance in Federal binding operational directives, 
and opportunities to leverage Federal schedules 
for cybersecurity investments under section 502 
of title 40, United States Code; 
VerDate Sep 11 2014 
00:26 Sep 02, 2020
Jkt 099200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H8048.IH
H8048
pbinns on DSKJLVW7X2PROD with BILLS