---
kind: "section"
citation: "6 U.S.C. § 665g"
title: "6"
title_heading: "Domestic Security"
number: "665g"
heading: "State and Local Cybersecurity Grant Program"
release: "119-102"
url: "https://uscodex.org/usc/6/665g"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §665g. State and Local Cybersecurity Grant Program

- (a) **Definitions—** In this section:
  - (1) **Cybersecurity Plan—** The term “Cybersecurity Plan” means a plan submitted by an [eligible entity](#a-2) under [subsection (e)(1)](#e-1).
  - (2) **Eligible entity—** The term “eligible entity” means a—
    - (A) [State](/usc/6/101.md?p=17); or
    - (B) [Tribal government](#a-7).
  - (3) **Multi-entity group—** The term “multi-entity group” means a group of 2 or more [eligible entities](#a-2) desiring a grant under this section.
  - (4) **Online service—** The term “online service” means any internet-facing service, including a website, email, virtual private network, or custom application.
  - (5) **Rural area—** The term “rural area” has the meaning given the term in [section 5302 of title 49](/usc/49/5302.md).
  - (6) **State and Local Cybersecurity Grant Program—** The term “State and Local Cybersecurity Grant Program” means the program established under [subsection (b)](#b).
  - (7) **Tribal government—** The term “Tribal government” means the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent list published pursuant to [section 5131 of title 25](/usc/25/5131.md).
- (b) **Establishment—**
  - (1) **In general—** There is established within the [Department](/usc/6/101.md?p=5) a program to award grants to [eligible entities](#a-2) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](#a-7).
  - (2) **Application—** An [eligible entity](#a-2) desiring a grant under the [State and Local Cybersecurity Grant Program](#a-6) shall submit to the [Secretary](/usc/6/101.md?p=16) an application at such time, in such manner, and containing such information as the [Secretary](/usc/6/101.md?p=16) may require.
- (c) **Administration—** The [State and Local Cybersecurity Grant Program](#a-6) shall be administered in the same [office](/usc/6/590.md?p=3) of the [Department](/usc/6/101.md?p=5) that administers grants made under sections [604](/usc/6/604.md) and [605](/usc/6/605.md) of this title.
- (d) **Use of funds—** An [eligible entity](#a-2) that receives a grant under this section and a [local government](/usc/6/101.md?p=13) that receives [funds](/usc/6/677a.md?p=5) from a grant under this section, as appropriate, shall use the grant to—
  - (1) implement the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2);
  - (2) develop or revise the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2);
  - (3) pay expenses directly relating to the administration of the grant, which shall not exceed 5 percent of the amount of the grant;
  - (4) assist with activities that address imminent [cybersecurity threats](/usc/6/650.md?p=8-A), as confirmed by the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), to the [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2) or a [local government](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2); or
  - (5) [fund](/usc/6/677a.md?p=5) any other appropriate activity determined by the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10).
- (e) **Cybersecurity plans—**
  - (1) **In general—** An [eligible entity](#a-2) applying for a grant under this section shall submit to the [Secretary](/usc/6/101.md?p=16) a [Cybersecurity Plan](#a-1) for review in accordance with [subsection (i)](#i).
  - (2) **Required elements—** A [Cybersecurity Plan](#a-1) of an [eligible entity](#a-2) shall—
    - (A) incorporate, to the extent practicable—
      - (i) any existing plans of the [eligible entity](#a-2) to protect against [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](#a-7); and
      - (ii) if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), consultation and feedback from [local governments](/usc/6/101.md?p=13) and associations of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2);
    - (B) describe, to the extent practicable, how the [eligible entity](#a-2) will—
      - (i) manage, [monitor](/usc/6/650.md?p=19), and track [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), and the information technology deployed on those [information systems](/usc/6/650.md?p=14), including legacy [information systems](/usc/6/650.md?p=14) and information technology that are no longer supported by the manufacturer of the systems or technology;
      - (ii) [monitor](/usc/6/650.md?p=19), audit, and,[^1] track network traffic and activity transiting or traveling to or from [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2);
      - (iii) enhance the preparation, response, and resiliency of [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), against [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A);
      - (iv) implement a process of continuous [cybersecurity vulnerability](/usc/6/659.md?p=a) assessments and threat mitigation practices prioritized by degree of risk to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) on [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2);
      - (v) ensure that the [eligible entity](#a-2) and, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), adopt and use best practices and methodologies to enhance cybersecurity, such as—
        - (I) the practices set forth in the cybersecurity framework developed by the National Institute of Standards and Technology;
        - (II) cyber chain supply chain risk management best practices identified by the National Institute of Standards and Technology; and
        - (III) knowledge bases of adversary tools and tactics;
      - (vi) promote the delivery of safe, recognizable, and trustworthy [online services](#a-4) by the [eligible entity](#a-2) and, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), including through the use of the .gov internet domain;
      - (vii) ensure continuity of operations of the [eligible entity](#a-2) and, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), in the event of a cybersecurity [incident](/usc/6/650.md?p=12), including by conducting exercises to practice responding to a cybersecurity [incident](/usc/6/650.md?p=12);
      - (viii) use the National Initiative for Cybersecurity Education Workforce Framework for Cybersecurity developed by the National Institute of Standards and Technology to identify and mitigate any gaps in the cybersecurity workforces of the [eligible entity](#a-2) and, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), enhance recruitment and retention efforts for those workforces, and bolster the knowledge, skills, and abilities of [personnel](/usc/6/101.md?p=15) of the [eligible entity](#a-2) and, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A), such as through cybersecurity hygiene training;
      - (ix) if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), ensure continuity of communications and data networks within the jurisdiction of the [eligible entity](#a-2) between the [eligible entity](#a-2) and [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2) in the event of an [incident](/usc/6/650.md?p=12) involving those communications or data networks;
      - (x) assess and mitigate, to the greatest degree possible, [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) relating to [critical infrastructure](/usc/6/101.md?p=4) and [key resources](/usc/6/101.md?p=12), the degradation of which may impact the performance of [information systems](/usc/6/650.md?p=14) within the jurisdiction of the [eligible entity](#a-2);
      - (xi) enhance capabilities to share [cyber threat indicators](/usc/6/650.md?p=5) and related information between the [eligible entity](#a-2) and—
        - (I) if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2), including by expanding information [sharing](/usc/6/650.md?p=26) agreements with the [Department](/usc/6/101.md?p=5); and
        - (II) the [Department](/usc/6/101.md?p=5);
      - (xii) leverage cybersecurity services offered by the [Department](/usc/6/101.md?p=5);
      - (xiii) implement an information technology and operational technology modernization cybersecurity review process that ensures alignment between information technology and operational technology cybersecurity objectives;
      - (xiv) develop and coordinate strategies to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) in consultation with—
        - (I) if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) and associations of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2); and
        - (II) as applicable—
          - (aa) [eligible entities](#a-2) that neighbor the jurisdiction of the [eligible entity](#a-2) or, as appropriate, members of an [Information Sharing and Analysis Organization](/usc/6/650.md?p=13); and
          - (bb) countries that neighbor the jurisdiction of the [eligible entity](#a-2);
      - (xv) ensure adequate access to, and participation in, the services and programs described in this subparagraph by [rural areas](#a-5) within the jurisdiction of the [eligible entity](#a-2); and
      - (xvi) distribute [funds](/usc/6/677a.md?p=5), items, services, capabilities, or activities to [local governments](/usc/6/101.md?p=13) under [subsection (n)(2)(A)](#n-2-A), including the fraction of that distribution the [eligible entity](#a-2) plans to distribute to [rural areas](#a-5) under [subsection (n)(2)(B)](#n-2-B);
    - (C) assess the capabilities of the [eligible entity](#a-2) relating to the actions described in [subparagraph (B)](#e-2-B);
    - (D) describe, as appropriate and to the extent practicable, the individual responsibilities of the [eligible entity](#a-2) and [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2) in implementing the plan;
    - (E) outline, to the extent practicable, the necessary [resources](/usc/6/741.md?p=12) and a timeline for implementing the plan; and
    - (F) describe the metrics the [eligible entity](#a-2) will use to measure progress towards—
      - (i) implementing the plan; and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2).
  - (3) **Discretionary elements—** In drafting a [Cybersecurity Plan](#a-1), an [eligible entity](#a-2) may—
    - (A) consult with the Multi-[State](/usc/6/101.md?p=17) Information [Sharing](/usc/6/650.md?p=26) and Analysis [Center](/usc/6/681.md?p=1);
    - (B) include a description of cooperative programs developed by groups of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A); and
    - (C) include a description of programs provided by the [eligible entity](#a-2) to support [local governments](/usc/6/101.md?p=13) and owners and operators of [critical infrastructure](/usc/6/101.md?p=4) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A).
- (f) **Multi-entity grants—**
  - (1) **In general—** The [Secretary](/usc/6/101.md?p=16) may award grants under this section to a [multi-entity group](#a-3) to support multi-entity efforts to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) within the jurisdictions of the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3).
  - (2) **Satisfaction of other requirements—** In order to be eligible for a multi-entity grant under this subsection, each [eligible entity](#a-2) that comprises a [multi-entity group](#a-3) shall have—
    - (A) a [Cybersecurity Plan](#a-1) that has been reviewed by the [Secretary](/usc/6/101.md?p=16) in accordance with [subsection (i)](#i); and
    - (B) a cybersecurity planning committee established in accordance with [subsection (g)](#g).
  - (3) **Application—**
    - (A) **In general—** A [multi-entity group](#a-3) applying for a multi-entity grant under [paragraph (1)](#f-1) shall submit to the [Secretary](/usc/6/101.md?p=16) an application at such time, in such manner, and containing such information as the [Secretary](/usc/6/101.md?p=16) may require.
    - (B) **Multi-entity project plan—** An application for a grant under this section of a [multi-entity group](#a-3) under [subparagraph (A)](#f-3-A) shall include a plan describing—
      - (i) the division of responsibilities among the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3);
      - (ii) the distribution of funding from the grant among the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3); and
      - (iii) how the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3) will work together to implement the [Cybersecurity Plan](#a-1) of each of those [eligible entities](#a-2).
- (g) **Planning committees—**
  - (1) **In general—** An [eligible entity](#a-2) that receives a grant under this section shall establish a cybersecurity planning committee to—
    - (A) assist with the development, implementation, and revision of the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2);
    - (B) approve the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2); and
    - (C) assist with the determination of effective funding priorities for a grant under this section in accordance with subsections [(d)](#d) and [(j)](#j).
  - (2) **Composition—** A committee of an [eligible entity](#a-2) established under [paragraph (1)](#g-1) shall—
    - (A) be comprised of representatives from—
      - (i) the [eligible entity](#a-2);
      - (ii) if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), counties, cities, and towns within the jurisdiction of the [eligible entity](#a-2); and
      - (iii) institutions of public education and health within the jurisdiction of the [eligible entity](#a-2); and
    - (B) include, as appropriate, representatives of rural, suburban, and high-population jurisdictions.
  - (3) **Cybersecurity expertise—** Not less than one-half of the representatives of a committee established under [paragraph (1)](#g-1) shall have professional experience relating to cybersecurity or information technology.
  - (4) **Rule of construction regarding existing planning committees—** Nothing in this subsection shall be construed to require an [eligible entity](#a-2) to establish a cybersecurity planning committee if the [eligible entity](#a-2) has established and uses a multijurisdictional planning committee or commission that—
    - (A) meets the requirements of this subsection; or
    - (B) may be expanded or leveraged to meet the requirements of this subsection, including through the formation of a cybersecurity planning subcommittee.
  - (5) **Rule of construction regarding control of information systems of eligible entities—** Nothing in this subsection shall be construed to permit a cybersecurity planning committee of an [eligible entity](#a-2) that meets the requirements of this subsection to make decisions relating to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2).
- (h) **Special rule for Tribal governments—** With respect to any requirement under subsection [(e)](#e) or [(g)](#g), the [Secretary](/usc/6/101.md?p=16), in consultation with the [Secretary](/usc/6/101.md?p=16) of the Interior and [Tribal governments](#a-7), may prescribe an alternative substantively similar requirement for [Tribal governments](#a-7) if the [Secretary](/usc/6/101.md?p=16) finds that the alternative requirement is necessary for the effective delivery and administration of grants to [Tribal governments](#a-7) under this section.
- (i) **Review of plans—**
  - (1) **Review as condition of grant—**
    - (A) **In general—** Subject to [paragraph (3)](#i-3), before an [eligible entity](#a-2) may receive a grant under this section, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall—
      - (i) review the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2), including any revised [Cybersecurity Plans](#a-1) of the [eligible entity](#a-2); and
      - (ii) determine that the [Cybersecurity Plan](#a-1) reviewed under [clause (i)](#i-1-A-i) satisfies the requirements under [paragraph (2)](#i-2).
    - (B) **Duration of determination—** In the case of a determination under [subparagraph (A)(ii)](#i-1-A-ii) that a [Cybersecurity Plan](#a-1) satisfies the requirements under [paragraph (2)](#i-2), the determination shall be effective for the 2-year period beginning on the date of the determination.
    - (C) **Annual renewal—** Not later than 2 years after the date on which the [Secretary](/usc/6/101.md?p=16) determines under [subparagraph (A)(ii)](#i-1-A-ii) that a [Cybersecurity Plan](#a-1) satisfies the requirements under [paragraph (2)](#i-2), and annually thereafter, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall—
      - (i) determine whether the [Cybersecurity Plan](#a-1) and any revisions continue to meet the criteria described in [paragraph (2)](#i-2); and
      - (ii) renew the determination if the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), makes a positive determination under [clause (i)](#i-1-C-i).
  - (2) **Plan requirements—** In reviewing a [Cybersecurity Plan](#a-1) of an [eligible entity](#a-2) under this subsection, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall ensure that the [Cybersecurity Plan](#a-1)—
    - (A) satisfies the requirements of [subsection (e)(2)](#e-2); and
    - (B) has been approved by—
      - (i) the cybersecurity planning committee of the [eligible entity](#a-2) established under [subsection (g)](#g); and
      - (ii) the Chief Information Officer, the Chief Information Security Officer, or an equivalent official of the [eligible entity](#a-2).
  - (3) **Exception—** Notwithstanding [subsection (e)](#e) and paragraph (1) of this subsection, the [Secretary](/usc/6/101.md?p=16) may award a grant under this section to an [eligible entity](#a-2) that does not submit a [Cybersecurity Plan](#a-1) to the [Secretary](/usc/6/101.md?p=16) for review before September 30, 2023, if the [eligible entity](#a-2) certifies to the [Secretary](/usc/6/101.md?p=16) that—
    - (A) the activities that will be supported by the grant are—
      - (i) integral to the development of the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2); or
      - (ii) necessary to assist with activities described in [subsection (d)(4)](#d-4), as confirmed by the [Director](/usc/6/650.md?p=10); and
    - (B) the [eligible entity](#a-2) will submit to the [Secretary](/usc/6/101.md?p=16) a [Cybersecurity Plan](#a-1) for review under this subsection by September 30, 2023.
  - (4) **Rule of construction—** Nothing in this subsection shall be construed to provide authority to the [Secretary](/usc/6/101.md?p=16) to—
    - (A) regulate the manner by which an [eligible entity](#a-2) or [local government](/usc/6/101.md?p=13) improves the cybersecurity of the [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2) or [local government](/usc/6/101.md?p=13); or
    - (B) condition the receipt of grants under this section on—
      - (i) participation in a particular Federal program; or
      - (ii) the use of a specific product or technology.
- (j) **Limitations on uses of funds—**
  - (1) **In general—** Any entity that receives [funds](/usc/6/677a.md?p=5) from a grant under this section may not use the grant—
    - (A) to supplant [State](/usc/6/101.md?p=17) or local [funds](/usc/6/677a.md?p=5);
    - (B) for any recipient cost-[sharing](/usc/6/650.md?p=26) contribution;
    - (C) to pay a ransom;
    - (D) for recreational or social purposes; or
    - (E) for any purpose that does not address [cybersecurity risks](/usc/6/650.md?p=7) or [cybersecurity threats](/usc/6/650.md?p=8-A) on [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2) that receives the grant or a [local government](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2).
  - (2) **Compliance oversight—** In addition to any other remedy available, the [Secretary](/usc/6/101.md?p=16) may take such actions as are necessary to ensure that a recipient of a grant under this section uses the grant for the purposes for which the grant is awarded.
  - (3) **Rule of construction—** Nothing in [paragraph (1)(A)](#j-1-A) shall be construed to prohibit the use of [funds](/usc/6/677a.md?p=5) from a grant under this section awarded to a [State](/usc/6/101.md?p=17), local, or [Tribal government](#a-7) for otherwise permissible uses under this section on the basis that the [State](/usc/6/101.md?p=17), local, or [Tribal government](#a-7) has previously used [State](/usc/6/101.md?p=17), local, or Tribal [funds](/usc/6/677a.md?p=5) to support the same or similar uses.
- (k) **Opportunity to amend applications—** In considering applications for grants under this section, the [Secretary](/usc/6/101.md?p=16) shall provide applicants with a reasonable opportunity to correct any defects in those applications before making final awards, including by allowing applicants to revise a submitted [Cybersecurity Plan](#a-1).
- (l) **Apportionment—** For fiscal year 2022 and each fiscal year thereafter, the [Secretary](/usc/6/101.md?p=16) shall apportion amounts appropriated to carry out this section among [eligible entities](#a-2) as follows:
  - (1) **Baseline amount—** The [Secretary](/usc/6/101.md?p=16) shall first apportion—
    - (A) 0.25 percent of such amounts to each of American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, and the [United States](/usc/6/101.md?p=19-A) Virgin Islands;
    - (B) 1 percent of such amounts to each of the remaining [States](/usc/6/101.md?p=17); and
    - (C) 3 percent of such amounts to [Tribal governments](#a-7).
  - (2) **Remainder—** The [Secretary](/usc/6/101.md?p=16) shall apportion the remainder of such amounts to [States](/usc/6/101.md?p=17) as follows:
    - (A) 50 percent of such remainder in the ratio that the population of each [State](/usc/6/101.md?p=17), bears to the population of all [States](/usc/6/101.md?p=17); and
    - (B) 50 percent of such remainder in the ratio that the population of each [State](/usc/6/101.md?p=17) that resides in [rural areas](#a-5), bears to the population of all [States](/usc/6/101.md?p=17) that resides in [rural areas](#a-5).
  - (3) **Apportionment among Tribal governments—** In determining how to apportion amounts to [Tribal governments](#a-7) under [paragraph (1)(C)](#l-1-C), the [Secretary](/usc/6/101.md?p=16) shall consult with the [Secretary](/usc/6/101.md?p=16) of the Interior and [Tribal governments](#a-7).
  - (4) **Multi-entity grants—** An amount received from a multi-entity grant awarded under [subsection (f)(1)](#f-1) by a [State](/usc/6/101.md?p=17) or [Tribal government](#a-7) that is a member of the [multi-entity group](#a-3) shall qualify as an apportionment for the purpose of this subsection.
- (m) **Federal share—**
  - (1) **In general—** The Federal share of the cost of an activity carried out using [funds](/usc/6/677a.md?p=5) made available with a grant under this section may not exceed—
    - (A) in the case of a grant to an [eligible entity](#a-2)—
      - (i) for fiscal year 2022, 90 percent;
      - (ii) for fiscal year 2023, 80 percent;
      - (iii) for fiscal year 2024, 70 percent; and
      - (iv) for fiscal year 2025, 60 percent; and
    - (B) in the case of a grant to a [multi-entity group](#a-3)—
      - (i) for fiscal year 2022, 100 percent;
      - (ii) for fiscal year 2023, 90 percent;
      - (iii) for fiscal year 2024, 80 percent; and
      - (iv) for fiscal year 2025, 70 percent.
  - (2) **Waiver—**
    - (A) **In general—** The [Secretary](/usc/6/101.md?p=16) may waive or modify the requirements of [paragraph (1)](#m-1) if an [eligible entity](#a-2) or [multi-entity group](#a-3) demonstrates economic hardship.
    - (B) **Guidelines—** The [Secretary](/usc/6/101.md?p=16) shall establish and publish guidelines for determining what constitutes economic hardship for the purposes of this subsection.
    - (C) **Considerations—** In developing guidelines under [subparagraph (B)](#m-2-B), the [Secretary](/usc/6/101.md?p=16) shall consider, with respect to the jurisdiction of an [eligible entity](#a-2)—
      - (i) changes in rates of unemployment in the jurisdiction from previous years;
      - (ii) changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the Food and Nutrition Act of 2008 ([7 U.S.C. 2011](/usc/7/2011.md) et seq.) from previous years; and
      - (iii) any other factors the [Secretary](/usc/6/101.md?p=16) considers appropriate.
  - (3) **Waiver for Tribal governments—** Notwithstanding [paragraph (2)](#m-2), the [Secretary](/usc/6/101.md?p=16), in consultation with the [Secretary](/usc/6/101.md?p=16) of the Interior and [Tribal governments](#a-7), may waive or modify the requirements of [paragraph (1)](#m-1) for 1 or more [Tribal governments](#a-7) if the [Secretary](/usc/6/101.md?p=16) determines that the waiver is in the public interest.
- (n) **Responsibilities of grantees—**
  - (1) **Certification—** Each [eligible entity](#a-2) or [multi-entity group](#a-3) that receives a grant under this section shall certify to the [Secretary](/usc/6/101.md?p=16) that the grant will be used—
    - (A) for the purpose for which the grant is awarded; and
    - (B) in compliance with subsections [(d)](#d) and [(j)](#j).
  - (2) **Availability of funds to local governments and rural areas—**
    - (A) **In general—** Subject to [subparagraph (C)](#n-2-C), not later than 45 days after the date on which an [eligible entity](#a-2) or [multi-entity group](#a-3) receives a grant under this section, the [eligible entity](#a-2) or [multi-entity group](#a-3) shall, without imposing unreasonable or unduly burdensome requirements as a condition of receipt, obligate or otherwise make available to [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2) or the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3), consistent with the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2) or the [Cybersecurity Plans](#a-1) of the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3)—
      - (i) not less than 80 percent of [funds](/usc/6/677a.md?p=5) available under the grant;
      - (ii) with the consent of the [local governments](/usc/6/101.md?p=13), items, services, capabilities, or activities having a value of not less than 80 percent of the amount of the grant; or
      - (iii) with the consent of the [local governments](/usc/6/101.md?p=13), grant [funds](/usc/6/677a.md?p=5) combined with other items, services, capabilities, or activities having the total value of not less than 80 percent of the amount of the grant.
    - (B) **Availability to rural areas—** In obligating [funds](/usc/6/677a.md?p=5), items, services, capabilities, or activities to [local governments](/usc/6/101.md?p=13) under [subparagraph (A)](#n-2-A), the [eligible entity](#a-2) or [eligible entities](#a-2) that comprise the [multi-entity group](#a-3) shall ensure that [rural areas](#a-5) within the jurisdiction of the [eligible entity](#a-2) or the [eligible entities](#a-2) that comprise the [multi-entity group](#a-3) receive not less than—
      - (i) 25 percent of the amount of the grant awarded to the [eligible entity](#a-2);
      - (ii) items, services, capabilities, or activities having a value of not less than 25 percent of the amount of the grant awarded to the [eligible entity](#a-2); or
      - (iii) grant [funds](/usc/6/677a.md?p=5) combined with other items, services, capabilities, or activities having the total value of not less than 25 percent of the grant awarded to the [eligible entity](#a-2).
    - (C) **Exceptions—** This paragraph shall not apply to—
      - (i) any grant awarded under this section that solely supports activities that are integral to the development or revision of the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2); or
      - (ii) the District of Columbia, the Commonwealth of Puerto Rico, American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, the [United States](/usc/6/101.md?p=19-A) Virgin Islands, or a [Tribal government](#a-7).
  - (3) **Certifications regarding distribution of grant funds to local governments—** An [eligible entity](#a-2) or [multi-entity group](#a-3) shall certify to the [Secretary](/usc/6/101.md?p=16) that the [eligible entity](#a-2) or [multi-entity group](#a-3) has made the distribution to [local governments](/usc/6/101.md?p=13) required under [paragraph (2)](#n-2).
  - (4) **Extension of period—**
    - (A) **In general—** An [eligible entity](#a-2) or [multi-entity group](#a-3) may request in writing that the [Secretary](/usc/6/101.md?p=16) extend the period of time specified in [paragraph (2)](#n-2) for an additional period of time.
    - (B) **Approval—** The [Secretary](/usc/6/101.md?p=16) may approve a request for an extension under [subparagraph (A)](#n-4-A) if the [Secretary](/usc/6/101.md?p=16) determines the extension is necessary to ensure that the obligation and expenditure of grant [funds](/usc/6/677a.md?p=5) align with the purpose of the [State and Local Cybersecurity Grant Program](#a-6).
  - (5) **Direct funding—** If an [eligible entity](#a-2) does not make a distribution to a [local government](/usc/6/101.md?p=13) required under [paragraph (2)](#n-2) in a timely fashion, the [local government](/usc/6/101.md?p=13) may petition the [Secretary](/usc/6/101.md?p=16) to request the [Secretary](/usc/6/101.md?p=16) to provide [funds](/usc/6/677a.md?p=5) directly to the [local government](/usc/6/101.md?p=13).
  - (6) **Limitation on construction—** A grant awarded under this section may not be used to acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities.
  - (7) **Consultation in allocating funds—** An [eligible entity](#a-2) applying for a grant under this section shall agree to consult the Chief Information Officer, the Chief Information Security Officer, or an equivalent official of the [eligible entity](#a-2) in allocating [funds](/usc/6/677a.md?p=5) from a grant awarded under this section.
  - (8) **Penalties—** In addition to other remedies available to the [Secretary](/usc/6/101.md?p=16), if an [eligible entity](#a-2) violates a requirement of this subsection, the [Secretary](/usc/6/101.md?p=16) may—
    - (A) terminate or reduce the amount of a grant awarded under this section to the [eligible entity](#a-2); or
    - (B) distribute grant [funds](/usc/6/677a.md?p=5) previously awarded to the [eligible entity](#a-2)—
      - (i) in the case of an [eligible entity](#a-2) that is a [State](/usc/6/101.md?p=17), directly to the appropriate [local government](/usc/6/101.md?p=13) as a replacement grant in an amount determined by the [Secretary](/usc/6/101.md?p=16); or
      - (ii) in the case of an [eligible entity](#a-2) that is a [Tribal government](#a-7), to another [Tribal government](#a-7) or [Tribal governments](#a-7) as a replacement grant in an amount determined by the [Secretary](/usc/6/101.md?p=16).
- (o) **Consultation with State, local, and Tribal representatives—** In carrying out this section, the [Secretary](/usc/6/101.md?p=16) shall consult with [State](/usc/6/101.md?p=17), local, and Tribal representatives with professional experience relating to cybersecurity, including representatives of associations representing [State](/usc/6/101.md?p=17), local, and [Tribal governments](#a-7), to inform—
  - (1) guidance for applicants for grants under this section, including guidance for [Cybersecurity Plans](#a-1);
  - (2) the study of risk-based formulas required under [subsection (q)(4)](#q-4);
  - (3) the development of guidelines required under [subsection (m)(2)(B)](#m-2-B); and
  - (4) any modifications described in [subsection (q)(2)(D)](#q-2-D).
- (p) **Notification to Congress—** Not later than 3 business days before the date on which the [Department](/usc/6/101.md?p=5) announces the award of a grant to an [eligible entity](#a-2) under this section, including an announcement to the [eligible entity](#a-2), the [Secretary](/usc/6/101.md?p=16) shall provide to the [appropriate congressional committees](/usc/6/650.md?p=2) notice of the announcement.
- (q) **Reports, study, and review—**
  - (1) **Annual reports by grant recipients—**
    - (A) **In general—** Not later than 1 year after the date on which an [eligible entity](#a-2) receives a grant under this section for the purpose of implementing the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2), including an [eligible entity](#a-2) that comprises a [multi-entity group](#a-3) that receives a grant for that purpose, and annually thereafter until 1 year after the date on which [funds](/usc/6/677a.md?p=5) from the grant are expended or returned, the [eligible entity](#a-2) shall submit to the [Secretary](/usc/6/101.md?p=16) a report that, using the metrics described in the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2), describes the progress of the [eligible entity](#a-2) in—
      - (i) implementing the [Cybersecurity Plan](#a-1) of the [eligible entity](#a-2); and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the [eligible entity](#a-2) or, if the [eligible entity](#a-2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the [eligible entity](#a-2).
    - (B) **Absence of plan—** Not later than 1 year after the date on which an [eligible entity](#a-2) that does not have a [Cybersecurity Plan](#a-1) receives [funds](/usc/6/677a.md?p=5) under this section, and annually thereafter until 1 year after the date on which [funds](/usc/6/677a.md?p=5) from the grant are expended or returned, the [eligible entity](#a-2) shall submit to the [Secretary](/usc/6/101.md?p=16) a report describing how the [eligible entity](#a-2) obligated and expended grant [funds](/usc/6/677a.md?p=5) to—
      - (i) develop or revise a [Cybersecurity Plan](#a-1); or
      - (ii) assist with the activities described in [subsection (d)(4)](#d-4).
  - (2) **Annual reports to Congress—** Not less frequently than annually, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall submit to Congress a report on—
    - (A) the use of grants awarded under this section;
    - (B) the proportion of grants used to support cybersecurity in [rural areas](#a-5);
    - (C) the effectiveness of the [State and Local Cybersecurity Grant Program](#a-6);
    - (D) any necessary modifications to the [State and Local Cybersecurity Grant Program](#a-6); and
    - (E) any progress made toward—
      - (i) developing, implementing, or revising [Cybersecurity Plans](#a-1); and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](#a-7) as a result of the award of grants under this section.
  - (3) **Public availability—**
    - (A) **In general—** The [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall make each report submitted under [paragraph (2)](#q-2) publicly available, including by making each report available on the website of the [Agency](/usc/6/650.md?p=1).
    - (B) **Redactions—** In making each report publicly available under [subparagraph (A)](#q-3-A), the [Director](/usc/6/650.md?p=10) may make redactions that the [Director](/usc/6/650.md?p=10), in consultation with each [eligible entity](#a-2), determines necessary to protect classified or other information exempt from disclosure under [section 552 of title 5](/usc/5/552.md) (commonly referred to as the “Freedom of Information Act”).
  - (4) **Study of risk-based formulas—**
    - (A) **In general—** Not later than September 30, 2024, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall submit to the [appropriate congressional committees](/usc/6/650.md?p=2) a study and legislative recommendations on the potential use of a risk-based formula for apportioning [funds](/usc/6/677a.md?p=5) under this section, including—
      - (i) potential components that could be included in a risk-based formula, including the potential impact of those components on support for [rural areas](#a-5) under this section;
      - (ii) potential sources of data and information necessary for the implementation of a risk-based formula;
      - (iii) any obstacles to implementing a risk-based formula, including obstacles that require a legislative solution;
      - (iv) if a risk-based formula were to be implemented for fiscal year 2026, a recommended risk-based formula for the [State and Local Cybersecurity Grant Program](#a-6); and
      - (v) any other information that the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), determines necessary to help Congress understand the progress towards, and obstacles to, implementing a risk-based formula.
    - (B) **Inapplicability of Paperwork Reduction Act—** The requirements of [chapter 35](/usc/44/ch35.md) of title 44 (commonly referred to as the “Paperwork Reduction Act”), shall not apply to any action taken to carry out this paragraph.
  - (5) **Tribal cybersecurity needs report—** Not later than 2 years after November 15, 2021, the [Secretary](/usc/6/101.md?p=16), acting through the [Director](/usc/6/650.md?p=10), shall submit to Congress a report that—
    - (A) describes the cybersecurity needs of [Tribal governments](#a-7), which shall be determined in consultation with the [Secretary](/usc/6/101.md?p=16) of the Interior and [Tribal governments](#a-7); and
    - (B) includes any recommendations for addressing the cybersecurity needs of [Tribal governments](#a-7), including any necessary modifications to the [State and Local Cybersecurity Grant Program](#a-6) to better serve [Tribal governments](#a-7).
  - (6) **GAO review—** Not later than 3 years after November 15, 2021, the Comptroller General of the [United States](/usc/6/101.md?p=19-A) shall conduct a review of the [State and Local Cybersecurity Grant Program](#a-6), including—
    - (A) the grant selection process of the [Secretary](/usc/6/101.md?p=16); and
    - (B) a sample of grants awarded under this section.
- (r) **Authorization of appropriations—**
  - (1) **In general—** There are authorized to be appropriated for activities under this section—
    - (A) for fiscal year 2022, $200,000,000;
    - (B) for fiscal year 2023, $400,000,000;
    - (C) for fiscal year 2024, $300,000,000; and
    - (D) for fiscal year 2025, $100,000,000.
  - (2) **Transfers authorized—**
    - (A) **In general—** During a fiscal year, the [Secretary](/usc/6/101.md?p=16) or the head of any component of the [Department](/usc/6/101.md?p=5) that administers the [State and Local Cybersecurity Grant Program](#a-6) may transfer not more than 5 percent of the amounts appropriated pursuant to [paragraph (1)](#r-1) or other amounts appropriated to carry out the [State and Local Cybersecurity Grant Program](#a-6) for that fiscal year to an account of the [Department](/usc/6/101.md?p=5) for salaries, expenses, and other administrative costs incurred for the management, administration, or evaluation of this section.
    - (B) **Additional appropriations—** Any [funds](/usc/6/677a.md?p=5) transferred under [subparagraph (A)](#r-2-A) shall be in addition to any [funds](/usc/6/677a.md?p=5) appropriated to the [Department](/usc/6/101.md?p=5) or the components described in [subparagraph (A)](#r-2-A) for salaries, expenses, and other administrative costs.
- (s) **Termination—**
  - (1) **In general—** Subject to [paragraph (2)](#s-2), the requirements of this section shall terminate on September 30, 2026.
  - (2) **Exception—** The reporting requirements under [subsection (q)](#q) shall terminate on the date that is 1 year after the date on which the final [funds](/usc/6/677a.md?p=5) from a grant under this section are expended or returned.

## Footnotes

[^1]: So in original. The comma probably should not appear.

## Source credit

(Pub. L. 107–296, title XXII, § 2220A, formerly § 2218, as added Pub. L. 117–58, div. G, title VI, § 70612(a), Nov. 15, 2021, 135 Stat. 1272; renumbered § 2220A and amended Pub. L. 117–81, div. A, title XV, § 1547(b)(1)(A)(viii), Dec. 27, 2021, 135 Stat. 2061; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(K), Dec. 23, 2022, 136 Stat. 3660; Pub. L. 119–75, div. I, § 5009, Feb. 3, 2026, 140 Stat. 630.)

## Notes

### Editorial Notes

### References in Text

The Food and Nutrition Act of 2008, referred to in subsec. (m)(2)(C)(ii), is Pub. L. 88–525, Aug. 31, 1964, 78 Stat. 703, which is classified generally to chapter 51 (§ 2011 et seq.) of Title 7, Agriculture. For complete classification of this Act to the Code, see Short Title note set out under section 2011 of Title 7 and Tables.

### Amendments

2026—Subsec. (s)(1). Pub. L. 119–75 substituted “September 30, 2026” for “September 30, 2025”.

2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(K)(i), redesignated pars. (3), (4), and (8) to (12) as (1) to (7), respectively, and struck out former pars. (1), (2), and (5) to (7) which defined appropriate committees of Congress, cyber threat indicator, incident, information sharing and analysis organization, and information system, respectively.

Subsec. (e)(2)(B)(xiv)(II)(aa). Pub. L. 117–263, § 7143(b)(2)(K)(ii), substituted “Information Sharing and Analysis Organization” for “information sharing and analysis organization”.

Subsec. (p). Pub. L. 117–263, § 7143(b)(2)(K)(iii), substituted “appropriate congressional committees” for “appropriate committees of Congress”.

Subsec. (q)(4)(A). Pub. L. 117–263, § 7143(b)(2)(K)(iv), which directed amendment of subsec. (q)(4) by substituting “appropriate congressional committees” for “appropriate committees of Congress” “in the matter preceding clause (i)”, was executed by making the substitution in the introductory provisions of subsec. (q)(4)(A), to reflect the probable intent of Congress.

2021—Pub. L. 117–81 reenacted section catchline.