116TH CONGRESS 
2D SESSION 
H. R. 5823 
AN ACT 
To establish a program to make grants to States to address 
cybersecurity risks and cybersecurity threats to informa-
tion systems of State, local, Tribal, or territorial govern-
ments, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber-
security Improvement Act’’. 
SEC. 2. STATE AND LOCAL CYBERSECURITY GRANT PRO-
GRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new sec-
tions: 
‘‘SEC. 2215. STATE AND LOCAL CYBERSECURITY GRANT 
PROGRAM. 
‘‘(a) 
ESTABLISHMENT.—The 
Secretary, 
acting 
through the Director, shall establish a program to make 
grants to States to address cybersecurity risks and cyber-
security threats to information systems of State, local, 
Tribal, or territorial governments (referred to as the 
‘State and Local Cybersecurity Grant Program’ in this 
section). 
‘‘(b) BASELINE REQUIREMENTS.—A grant awarded 
under this section shall be used in compliance with the 
following: 
‘‘(1) The Cybersecurity Plan required under 
subsection (d) and approved pursuant to subsection 
(g). 
‘‘(2) The Homeland Security Strategy to Im-
prove the Cybersecurity of State, Local, Tribal, and
Territorial Governments required in accordance with 
section 2210, when issued. 
‘‘(c) ADMINISTRATION.—The State and Local Cyber-
security Grant Program shall be administered in the same 
program office that administers grants made under sec-
tions 2003 and 2004. 
‘‘(d) ELIGIBILITY.— 
‘‘(1) IN
GENERAL.—A State applying for a 
grant under the State and Local Cybersecurity 
Grant Program shall submit to the Secretary a Cy-
bersecurity Plan for approval. Such plan shall— 
‘‘(A) incorporate, to the extent practicable, 
any existing plans of such State to protect 
against cybersecurity risks and cybersecurity 
threats to information systems of State, local, 
Tribal, or territorial governments; 
‘‘(B) describe, to the extent practicable, 
how such State shall— 
‘‘(i) enhance the preparation, re-
sponse, and resiliency of information sys-
tems owned or operated by such State or, 
if appropriate, by local, Tribal, or terri-
torial governments, against cybersecurity 
risks and cybersecurity threats;
‘‘(ii) implement a process of contin-
uous cybersecurity vulnerability assess-
ments and threat mitigation practices 
prioritized by degree of risk to address cy-
bersecurity risks and cybersecurity threats 
in information systems of such State, local, 
Tribal, or territorial governments; 
‘‘(iii) ensure that State, local, Tribal, 
and territorial governments that own or 
operate information systems within the 
State adopt best practices and methodolo-
gies to enhance cybersecurity, such as the 
practices set forth in the cybersecurity 
framework developed by the National Insti-
tute of Standards and Technology; 
‘‘(iv) promote the delivery of safe, rec-
ognizable, and trustworthy online services 
by State, local, Tribal, and territorial gov-
ernments, including through the use of the 
.gov internet domain; 
‘‘(v) mitigate any identified gaps in 
the State, local, Tribal, or territorial gov-
ernment cybersecurity workforces, enhance 
recruitment and retention efforts for such 
workforces, and bolster the knowledge,
skills, and abilities of State, local, Tribal, 
and territorial government personnel to ad-
dress cybersecurity risks and cybersecurity 
threats; 
‘‘(vi) ensure continuity of communica-
tions and data networks within such State 
between such State and local, Tribal, and 
territorial governments that own or operate 
information systems within such State in 
the event of an incident involving such 
communications or data networks within 
such State; 
‘‘(vii) assess and mitigate, to the 
greatest 
degree 
possible, 
cybersecurity 
risks and cybersecurity threats related to 
critical infrastructure and key resources, 
the degradation of which may impact the 
performance of information systems within 
such State; 
‘‘(viii) enhance capability to share 
cyber threat indicators and related infor-
mation between such State and local, Trib-
al, and territorial governments that own or 
operate information systems within such 
State; and
‘‘(ix) develop and coordinate strategies 
to address cybersecurity risks and cyberse-
curity threats in consultation with— 
‘‘(I) local, Tribal, and territorial 
governments within the State; and 
‘‘(II) as applicable— 
‘‘(aa) neighboring States or, 
as appropriate, members of an 
information sharing and analysis 
organization; and 
‘‘(bb) neighboring countries; 
and 
‘‘(C) include, to the extent practicable, an 
inventory of the information technology de-
ployed on the information systems owned or op-
erated by such State or by local, Tribal, or ter-
ritorial governments within such State, includ-
ing legacy information technology that is no 
longer supported by the manufacturer. 
‘‘(e) PLANNING COMMITTEES.— 
‘‘(1) IN
GENERAL.—A State applying for a 
grant under this section shall establish a cybersecu-
rity planning committee to assist in the following: