State and Local Cybersecurity Grant Program

State and Local Cybersecurity Grant Program
Name	State and Local Cybersecurity Grant Program
Established	2021
Administered by	Cybersecurity and Infrastructure Security Agency
Funding	Bipartisan Infrastructure Law
Country	United States

State and Local Cybersecurity Grant Program provides federal resources to strengthen cybersecurity for subnational entities across the United States. Launched under the Bipartisan Infrastructure Law and administered by the Cybersecurity and Infrastructure Security Agency, the program aims to reduce digital risk for municipalities, counties, tribal nations, and territorial governments. It coordinates with federal partners such as the Department of Homeland Security, Federal Emergency Management Agency, and National Institute of Standards and Technology to align investments with national strategies like the National Cybersecurity Strategy.

Overview and Purpose

The program's core mission is to bolster the cyber resilience of state governments, local governments, tribal governments, and territorial governments by funding capabilities aligned to standards including the NIST Cybersecurity Framework and initiatives from the Office of Management and Budget. It seeks to mitigate threats posed by actors linked to incidents such as those attributed to REvil, Russia, China-linked groups, and ransomware campaigns exemplified by the Colonial Pipeline cyberattack. The program also supports coordination with critical infrastructure sectors listed by Presidential Policy Directive 21 and partnerships with entities like the Multi-State Information Sharing and Analysis Center and Information Sharing and Analysis Organizations.

Eligibility and Funding Structure

Eligible recipients include the 50 states, territories, federally recognized Native American tribes, and units of local government such as counties and cities including Los Angeles, Chicago, and Houston. Allocations derive from the Bipartisan Infrastructure Law appropriations and are apportioned using formulas informed by factors like population and risk exposures similar to models used by the Federal Transit Administration and Health Resources and Services Administration. Funding categories mirror federal grant typologies seen in programs from the Department of Justice and Department of Transportation, with minimum pass-through requirements and match waivers for economically distressed jurisdictions comparable to provisions in the Community Development Block Grant program.

Program Administration and Governance

Administration is led by the Cybersecurity and Infrastructure Security Agency with oversight from the Department of Homeland Security and coordination with the Office of the Director of National Intelligence on threat information. State administrative agencies, often termed State Administrative Agencies in other federal grant contexts like the Edward Byrne Memorial Justice Assistance Grant program, act as subrecipients and distribute funds to localities. Governance structures incorporate advisory groups drawing expertise from organizations such as the National Governors Association, United States Conference of Mayors, National League of Cities, and tribal consortia like the National Congress of American Indians.

Grant Application and Award Process

Applications follow templates and compliance checks paralleling procedures used by the Federal Emergency Management Agency and the Department of Health and Human Services for disaster relief and public health grants. Applicants must submit cybersecurity strategic plans, risk assessments, and project budgets consistent with guidance from the National Institute of Standards and Technology and the Office of Management and Budget circulars. Award determinations consider criteria used in federal competitive grant programs such as those from the National Science Foundation and Department of Energy, including readiness, sustainability, and measurable outcomes. Appeals and audit processes reference standards from the Inspectors General community and Government Accountability Office audit practices.

Program Activities and Use of Funds

Permissible activities encompass investments in incident response capacity, workforce development, risk and vulnerability assessments, modernizing legacy systems akin to Federal Aviation Administration modernization programs, and deployment of tools for threat detection similar to systems used by the United States Cyber Command and National Security Agency. Funds support training partnerships with institutions such as SANS Institute, International Information System Security Certification Consortium, and academic centers like the Carnegie Mellon University CERT Division and Massachusetts Institute of Technology research labs. Eligible expenditures also include collaboration with private sector vendors that serve critical infrastructure operators, coordination with Sector Risk Management Agencies, and initiatives to protect elections infrastructure as seen in work involving the Federal Election Commission and Election Assistance Commission.

Impact, Outcomes, and Evaluation

The program tracks metrics comparable to performance frameworks used by the Office of Management and Budget and evaluation models from the RAND Corporation to measure reductions in incident frequency, mean time to detect, and mean time to remediate. Early awards enabled purchase of endpoint protection, network segmentation, and backup systems that reduced operational disruption for jurisdictions similar to those impacted by the Baltimore ransomware attack and the City of Atlanta cyberattack. Independent evaluations by academic partners such as Harvard Kennedy School and policy units like the Brookings Institution contribute to peer-reviewed assessments and policy recommendations.

Challenges, Criticisms, and Future Directions

Stakeholders cite challenges paralleling critiques of other federal grant programs such as delayed disbursement, burdensome compliance akin to concerns raised about HITECH Act grant implementation, and uneven capacity among small rural counties and tribal nations. Critics note potential overreliance on commercial vendors comparable to debates around privatization in public services and call for sustained workforce pipelines linked to initiatives from the Cybersecurity Workforce Alliance and National Initiative for Cybersecurity Education. Future directions emphasize integration with national efforts led by the White House and collaboration with international partners like NATO and the European Union on cross-border cyber norms, as well as alignment with emerging legislation from the United States Congress to refine funding permanence and oversight mechanisms.

Category:United States cybersecurity policy