Our nation faces unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure. Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities in critical infrastructure.
Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of state, local, and territorial (SLT) governments is an important homeland security mission and the primary focus of the State and Local Cybersecurity Grant Program (SLCGP). Through funding from the Infrastructure Investment and Jobs Act, the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies to strengthen the security of critical infrastructure and improve the resilience of services SLT governments provide their communities.
Goal: The goal of the SLCGP is to assist SLT governments with managing andreducing systemic cyber risk. This goal can be achieved over the course of the four years of SLCGP funding as applicants focus their Cybersecurity Plans, priorities, projects, and implementation toward addressing SLCGP objectives.
Objectives: Applicants are required to submit applications that address at least one of the following program objectives in their applications:
- Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.
- Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
- Objective 3: Implement security protections commensurate with risk.
- Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.
FY24 State and Local Cybersecurity Grant Program:
The FY 2024 SLCGP aligns with the National Cybersecurity Strategy by addressing three of the five pillars:
- Pillar One – Defend Critical Infrastructure;
- Pillar Two – Disrupt and Dismantle Threat Actors; and
- Pillar Four – Invest in a Resilient Future.
The FY 2024 SLCGP also addresses the 2020–2024 DHS Strategic Plan ( https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 ) by helping DHS achieve Goal 3: Secure Cyberspace and Critical Infrastructure. This includes Objective 3.2: Strengthen the Security and Resilience of Critical Infrastructure.
Additionally, the FY 2024 SLCGP supports the 2022–2026 FEMA Strategic Plan ( https://www.fema.gov/about/strategic-plan ), which outlines a bold vision with three ambitious goals, including Goal 3: Promote FY 2024 SLCGP NOFO and Sustain a Ready FEMA and Prepared Nation, under which falls Objective 3.2: Posture FEMA to Meet Current and Emergent Threats.
The FY 2024 SLCGP also aligns with the 2023–2025 CISA Strategic Plan ( https://www.cisa.gov/resources-tools/resources/2023-2025-strategic-plan ) , which encompasses Goal 1: Cyber Defense, Goal 2: Risk Reduction and Resilience, and Goal 3: Operational Collaboration.
*All applicants with a Cybersecurity and Infrastructure Security Agency (CISA) approved Cybersecurity Plan must submit their current Cybersecurity Plan to CISA via the FEMA SLCGP Inbox at [email protected] no later than January 30, 2025, and annually thereafter on the same date throughout the grant's period of performance. When submitting a Cybersecurity Plan, applicants must inform CISA if they revised their plan since CISA's last approval of it.
Cybersecurity Best Practices for Individual Projects:
- Implement multi-factor authentication
- Implement enhanced logging
- Data encryption for data at rest and in transit
- End use of unsupported/end of life software and hardware that are accessible from the internet
- Prohibit use of known/fixed/default passwords and credentials
- Ensure the ability to reconstitute systems (backups)
- Actively engage in bidirectional sharing between CISA and SLT entities in cyber relevant time frames to drive down cyber risk
- Migration to the .gov internet domain
A total of $374,981,324 was available for FY23 to 56 states and territories.
Any entity that receives funds from a grant under this program may not use the grant: