HR 5823 RFS
(2), such a local, Tribal, or territorial government 
may petition the Secretary. 
‘‘(7) PENALTIES.—In addition to other rem-
edies available to the Secretary, the Secretary may 
terminate or reduce the amount of a grant awarded 
under this section to a State or transfer grant funds 
previously awarded to such State directly to the ap-
propriate local, Tribal, or territorial government if 
such State violates a requirement of this subsection. 
‘‘(m) ADVISORY COMMITTEE.— 
‘‘(1) ESTABLISHMENT.—The Director shall es-
tablish a State and Local Cybersecurity Resiliency 
Committee to provide State, local, Tribal, and terri-
torial stakeholder expertise, situational awareness, 
and recommendations to the Director, as appro-
priate, regarding how to— 
‘‘(A) address cybersecurity risks and cyber-
security threats to information systems of 
State, local, Tribal, or territorial governments; 
and 
‘‘(B) improve the ability of such govern-
ments to prevent, protect against, respond, 
mitigate, and recover from cybersecurity risks 
and cybersecurity threats. 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(2) DUTIES.—The State and Local Cybersecu-
rity Resiliency Committee shall— 
‘‘(A) submit to the Director recommenda-
tions that may inform guidance for applicants 
for grants under this section; 
‘‘(B) upon the request of the Director, pro-
vide to the Director technical assistance to in-
form the review of Cybersecurity Plans sub-
mitted by applicants for grants under this sec-
tion, and, as appropriate, submit to the Direc-
tor recommendations to improve such Plans 
prior to the Director’s determination regarding 
whether to approve such Plans; 
‘‘(C) advise and provide to the Director 
input regarding the Homeland Security Strat-
egy to Improve Cybersecurity for State, Local, 
Tribal, and Territorial Governments required 
under section 2210; and 
‘‘(D) upon the request of the Director, pro-
vide to the Director recommendations, as ap-
propriate, regarding how to— 
‘‘(i) address cybersecurity risks and 
cybersecurity threats on information sys-
tems of State, local, Tribal, or territorial 
governments; 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(ii) and improve the cybersecurity re-
silience of such governments. 
‘‘(3) MEMBERSHIP.— 
‘‘(A) NUMBER
AND
APPOINTMENT.—The 
State and Local Cybersecurity Resiliency Com-
mittee shall be composed of 15 members ap-
pointed by the Director, as follows: 
‘‘(i) Two individuals recommended to 
the Director by the National Governors As-
sociation. 
‘‘(ii) Two individuals recommended to 
the Director by the National Association of 
State Chief Information Officers. 
‘‘(iii) One individual recommended to 
the Director by the National Guard Bu-
reau. 
‘‘(iv) Two individuals recommended to 
the Director by the National Association of 
Counties. 
‘‘(v) Two individuals recommended to 
the Director by the National League of 
Cities. 
‘‘(vi) One individual recommended to 
the Director by the United States Con-
ference of Mayors. 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(vii) One individual recommended to 
the Director by the Multi-State Informa-
tion Sharing and Analysis Center. 
‘‘(viii) Four individuals who have edu-
cational and professional experience related 
to cybersecurity analysis or policy. 
‘‘(B) TERMS.—Each member of the State 
and Local Cybersecurity Resiliency Committee 
shall be appointed for a term of two years, ex-
cept that such term shall be three years only in 
the case of members who are appointed initially 
to the Committee upon the establishment of the 
Committee. Any member appointed to fill a va-
cancy occurring before the expiration of the 
term for which the member’s predecessor was 
appointed shall be appointed only for the re-
mainder of such term. A member may serve 
after the expiration of such member’s term 
until a successor has taken office. A vacancy in 
the Commission shall be filled in the manner in 
which the original appointment was made. 
‘‘(C) PAY.—Members of the State and 
Local Cybersecurity Resiliency Committee shall 
serve without pay. 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(4) CHAIRPERSON; VICE CHAIRPERSON.—The 
members of the State and Local Cybersecurity Resil-
iency Committee shall select a chairperson and vice 
chairperson from among Committee members. 
‘‘(5) FEDERAL
ADVISORY
COMMITTEE
ACT.— 
The Federal Advisory Committee Act (5 U.S.C. 
App.) shall not apply to the State and Local Cyber-
security Resilience Committee. 
‘‘(n) REPORTS.— 
‘‘(1) ANNUAL REPORTS BY STATE GRANT RE-
CIPIENTS.—A State that receives a grant under this 
section shall annually submit to the Secretary a re-
port on the progress of the State in implementing 
the Cybersecurity Plan approved pursuant to sub-
section (g). If the State does not have a Cybersecu-
rity Plan approved pursuant to subsection (g), the 
State shall submit to the Secretary a report describ-
ing how grant funds were obligated and expended to 
develop a Cybersecurity Plan or improve the cyberse-
curity of information systems owned or operated by 
State, local, Tribal, or territorial governments in 
such State. The Secretary, acting through the Direc-
tor, shall make each such report publicly available, 
including by making each such report available on 
the internet website of the Agency, subject to any 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
redactions the Director determines necessary to pro-
tect classified or other sensitive information. 
‘‘(2) ANNUAL
REPORTS
TO
CONGRESS.—At 
least once each year, the Secretary, acting through 
the Director, shall submit to Congress a report on 
the use of grants awarded under this section and 
any progress made toward the following: 
‘‘(A) Achieving the objectives set forth in 
the Homeland Security Strategy to Improve the 
Cybersecurity of State, Local, Tribal, and Ter-
ritorial 
Governments, 
upon 
the 
strategy’s 
issuance under section 2210. 
‘‘(B) Developing, implementing, or revising 
Cybersecurity Plans. 
‘‘(C) Reducing cybersecurity risks and cy-
bersecurity threats to information systems 
owned or operated by State, local, Tribal, and 
territorial governments as a result of the award 
of such grants. 
‘‘(o) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated for grants under this 
section— 
‘‘(1) for each of fiscal years 2021 through 
2025, $400,000,000; and 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(2) for each subsequent fiscal year, such sums 
as may be necessary. 
‘‘(p) DEFINITIONS.—In this section: 
‘‘(1) CRITICAL
INFRASTRUCTURE.—The term 
‘critical infrastructure’ has the meaning given that 
term in section 2. 
‘‘(2) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given such 
term in section 102 of the Cybersecurity Act of 
2015. 
‘‘(3) DIRECTOR.—The term ‘Director’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency. 
‘‘(4) INCIDENT.—The term ‘incident’ has the 
meaning given such term in section 2209. 
‘‘(5) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘information sharing and 
analysis organization’ has the meaning given such 
term in section 2222. 
‘‘(6) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given such term in 
section 102(9) of the Cybersecurity Act of 2015 (6 
U.S.C. 1501(9)). 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(7) KEY
RESOURCES.—The term ‘key re-
sources’ has the meaning given that term in section 
2. 
‘‘(8) ONLINE SERVICE.—The term ‘online serv-
ice’ means any internet-facing service, including a 
website, email, virtual private network, or custom 
application. 
‘‘(9) STATE.—The term ‘State’— 
‘‘(A) means each of the several States, the 
District of Colombia, and the territories and 
possessions of the United States; and 
‘‘(B) includes any federally recognized In-
dian tribe that notifies the Secretary, not later 
than 120 days after the date of the enactment 
of this section or not later than 120 days before 
the start of any fiscal year in which a grant 
under this section is awarded, that the tribe in-
tends to develop a Cybersecurity Plan and 
agrees to forfeit any distribution under sub-
section (l)(2). 
‘‘SEC. 2216. CYBERSECURITY RESOURCE GUIDE DEVELOP-
MENT FOR STATE, LOCAL, TRIBAL, AND TER-
RITORIAL GOVERNMENT OFFICIALS. 
‘‘The Secretary, acting through the Director, shall 
develop a resource guide for use by State, local, Tribal, 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
and territorial government officials, including law enforce-
ment officers, to help such officials identify, prepare for, 
detect, protect against, respond to, and recover from cy-
bersecurity risks, cybersecurity threats, and incidents (as 
such term is defined in section 2209).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by inserting after the item relating to section 
2214 the following new items: 
‘‘Sec. 2215. State and Local Cybersecurity Grant Program. 
‘‘Sec. 2216. Cybersecurity resource guide development for State, local, Tribal, 
and territorial government officials.’’. 
SEC. 3. STRATEGY. 
(a) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL
GOVERNMENTS.—Section 2210 of the 
Homeland Security Act of 2002 (6 U.S.C. 660) is amend-
ed by adding at the end the following new subsection: 
‘‘(e) HOMELAND SECURITY STRATEGY TO IMPROVE 
THE CYBERSECURITY OF STATE, LOCAL, TRIBAL, AND 
TERRITORIAL GOVERNMENTS.— 
‘‘(1) IN GENERAL.—Not later than 270 days 
after the date of the enactment of this subsection, 
the Secretary, acting through the Director, shall, in 
coordination with appropriate Federal departments 
and agencies, State, local, Tribal, and territorial 
governments, the State and Local Cybersecurity Re-
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
silience Committee (established under section 2215), 
and other stakeholders, as appropriate, develop and 
make publicly available a Homeland Security Strat-
egy to Improve the Cybersecurity of State, Local, 
Tribal, and Territorial Governments that provides 
recommendations regarding how the Federal Gov-
ernment should support and promote the ability 
State, local, Tribal, and territorial governments to 
identify, protect against, detect respond to, and re-
cover from cybersecurity risks, cybersecurity threats, 
and incidents (as such term is defined in section 
2209) and establishes baseline requirements and 
principles to which Cybersecurity Plans under such 
section shall be aligned. 
‘‘(2) 
CONTENTS.—The 
Homeland 
Security 
Strategy to Improve the Cybersecurity of State, 
Local, Tribal, and Territorial Governments required 
under paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents; 
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
available to State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help such governments identify, protect 
against, detect, respond to, and recover from 
cybersecurity risks, cybersecurity threats, and 
incidents, and make recommendations to ad-
dress such limitations; 
‘‘(D) identify opportunities to improve the 
Agency’s coordination with Federal and non- 
Federal entities, such as the Multi-State Infor-
mation Sharing and Analysis Center, to im-
prove incident exercises, information sharing 
and incident notification procedures, the ability 
for State, local, Tribal, and territorial govern-
ments to voluntarily adapt and implement guid-
ance in Federal binding operational directives, 
and opportunities to leverage Federal schedules 
for cybersecurity investments under section 502 
of title 40, United States Code; 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(E) recommend new initiatives the Fed-
eral Government should undertake to improve 
the ability of State, local, Tribal, and territorial 
governments to help such governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
and incidents; 
‘‘(F) set short-term and long-term goals 
that will improve the ability of State, local, 
Tribal, and territorial governments to help such 
governments identify, protect against, detect, 
respond to, and recover from cybersecurity 
risks, cybersecurity threats, and incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
territorial governments to establish baseline ca-
pabilities to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity threats, and incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
Homeland Security Strategy to Improve the Cyber-
security of State, Local, Tribal, and Territorial Gov-
ernments required under paragraph (1), the Direc-
tor, in coordination with appropriate Federal depart-
ments and agencies, State, local, Tribal, and terri-
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
torial governments, the State and Local Cybersecu-
rity Resilience Committee, and other stakeholders, 
as appropriate, shall consider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial gov-
ernments, including the resulting costs to such 
governments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
to compromise information systems owned or 
operated by State, local, Tribal, and territorial 
governments; 
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and 
Local 
Cybersecurity 
Resilience 
Com-
mittee.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGEN-
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
CY.—Subsection (c) of section 2202 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 652) is amended— 
(1) by redesignating paragraphs (6) through 
(11) as paragraphs (11) through (16), respectively; 
and 
(2) by inserting after paragraph (5) the fol-
lowing new paragraphs: 
‘‘(6) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resiliency Committee established under section 
2215, for the State and Local Cybersecurity Grant 
Program under such section or any other homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(7) review, in consultation with the State and 
Local Cybersecurity Resiliency Committee, all cyber-
security plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(8) provide expertise and technical assistance 
to State, local, Tribal, and territorial government of-
ficials with respect to cybersecurity; 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS
HR 5823 RFS
‘‘(9) provide education, training, and capacity 
development to enhance the security and resilience 
of cybersecurity and infrastructure security; 
‘‘(10) provide information to State, local, Trib-
al, and territorial governments on the security bene-
fits of .gov domain name registration services;’’. 
(c) FEASIBILITY STUDY.—Not later than 180 days 
after the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security Agency 
of the Department of Homeland Security shall conduct a 
study to assess the feasibility of implementing a short- 
term rotational program for the detail of approved State, 
local, Tribal, and territorial government employees in 
cyber workforce positions to the Agency. 
Passed the House of Representatives September 30, 
2020. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
03:29 Oct 02, 2020
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5823.RFS
H5823
pbinns on DSKJLVW7X2PROD with BILLS