State and Local Cybersecurity Grant Program Tribal Cybersecurity Grant Program
Program Funding
Annual program obligations reported to SAM.gov.
Funded Projects
Examples of what this program has supported.
Program Objective
The goal of the State and Local Cybersecurity Grant Program (SLCGP) and the Tribal Cybersecurity Grant Program (TCGP) is to assist state, local, tribal and territorial (SLTT) governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the Period of Performance (POP) as applicants focus on their Cybersecurity Plans, priorities, projects, and implementation toward addressing the program objectives.
Program Objectives for SLCGP and TCGP include:
1. Develop and establish appropriate governance structures, as well as plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations;
2. SLTT agencies understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments;
3. Implement security protections commensurate with risk (outcomes of Objectives 1 & 2); and
4. Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.
Performance Measures:
• Percentage of entities with CISA approved state-wide Cybersecurity Plans
• Percentage of entities with statewide Cybersecurity Planning Committees that meet the Homeland Security Act of 2002 and SLCGP funding notice requirements
• Percentage of entities conducting annual table-top and full-scope exercises to test Cybersecurity Plans
• Percent of the entities’ SLCGP budget allocated to exercises
• Average dollar amount expended on exercise planning for entities
• Percentage of entities conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement
• Percentage of entities performing phishing training
• Percentage of entities conducting awareness campaigns
• Percent of entities providing role-based cybersecurity awareness training to employees
• Percentage of entities adopting the Workforce Framework for Cybersecurity (NICE Framework) as evidenced by established workforce development and training plans
• Percentage of entities with capabilities to analyze network traffic and activities related to potential threats
• Percentage of entities implementing multi-factor authentication (MFA) for all remote access and privileged accounts
• Percentage of entities with programs to anticipate and discontinue use of end-of-life software and hardware
• Percentage of entities prohibiting the use of known/fixed/default passwords and credentials
• Percentage of entities operating under the “.gov” internet domain
• Number of cybersecurity gaps or issues addressed annually by entities
Eligibility
Eligible Applicants
- State
- U.S. territories
- Federally recognized tribes
For SLCGP: States and U.S. Territories
All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds.
For TCGP: Federally Recognized Tribal Governments
Tribal governments may apply directly through the Tribal Cybersecurity Grant Program or may receive funds as subrecipients of the State and Local Cybersecurity Grant Program.
“Tribal government” is defined as the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent published list of federally recognized tribes.
Beneficiaries
- 4
- 5
- 10
- 9
State, Local, U.S. Territories, & Federally Recognized Indian Tribal Governments
How to Apply
Award Procedure
TBD by program
TBD by program
Program details & compliance
Description
The State and Local Cybersecurity Grant Program and Tribal Cybersecurity Grant Program provide grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of SLTT governments.
Use of Funds
Allowed Uses
SLTT governments shall use the grant funds to: (1) implement the Cybersecurity Plan of the eligible entity; (2) revise the Cybersecurity Plan of the eligible entity; (3) pay expenses directly relating to the management and administration of the grant, up to 5 percent of the grant amount; (4) assist with activities that address imminent cybersecurity threats to the information systems owned or operated by, or on behalf of, the SLTT government; (5) fund any other appropriate activity determined by the Department of Homeland Security.
An eligible entity applying for a grant shall agree to consult the Chief Information Officer (or equivalent), the Chief Information Security Officer, or an equivalent official of the eligible entity, in allocating grant funds under this program.
Required Documentation
Eligible entities applying for a grant under this Assistance Listing must have an approved Cybersecurity Plan, Project Worksheet, and Investment Justification to have funds released. Eligible entities should also refer to the Notices of Funding Opportunity, once published, for additional documents required to apply for a grant.
Matching Requirements
SLCGP: For FY 2023, eligible entities must meet a 20% cost share requirement. The recipient contribution can be cash (hard match) or third-party in-kind (soft match). For FY 2023, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands. The Secretary of Homeland Security may waive or modify the non-federal share if an eligible entity demonstrates an economic hardship and meets the requirements as outlined in the FY 2023 SLCGP Notice of Funding Opportunity.
TCGP: The Secretary of Homeland Security, in consultation with the Secretary of the Interior and tribal governments, waived the cost share requirement for TCGP applicants applying for FY 2022 and FY 2023 TCGP funding.
Measures of Effectiveness (MOE) requirements are not applicable to this assistance listing
Reporting & Compliance
Applicable 2 CFR 200 Subparts
- Subpart B — General Provisions
- Subpart C — Pre-Federal Award Requirements
- Subpart D — Post-Federal Award Requirements
- Subpart E — Cost Principles
- Subpart F — Audit Requirements
Formula
Statutory Formula: For FY 2023, DHS will award funds to states and territories based on baseline minimums and population as required by section 2200A(l) of the Homeland Security Act of 2002 (codified at 6 U.S.C. § 665g(l)) and described below.
Each state and territory will receive a baseline allocation using thresholds established in section 2200A(l) of the Homeland Security Act of 2002 (codified at 6 U.S.C. § 665g(l)). All 50 States, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $4,082,282 each, equaling 1% of total funds appropriated to DHS in FY 2023. Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $1,020,570, equaling 0.25% of the total funds appropriated to DHS in FY 2023. $79,310,190, 50% of the remaining amount, will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories. The remaining $79,310,190, equaling the other 50% of the remaining amount, will be apportioned based on the ratio that the population of each state that resides in rural areas bears to the population of all states that resides in rural areas.