Download a PDF copy of this webpage.
In fiscal year 2023, through the Infrastructure Investment and Jobs Act, the U.S. Department of Homeland Security (DHS) is providing $374.9 million to address cybersecurity risks and threats to information systems owned, operated by, or on behalf of state, local, tribal and territorial governments.
Overview
The goal of the State and Local Cybersecurity Grant Program (SLCGP) is to help states and territories, specifically rural and local communities, address cybersecurity risks and cybersecurity threats. The SLCGP enables DHS to make targeted cybersecurity investments in state, local, tribal and territorial (SLTT) government agencies, thus improving the security of critical infrastructure and resilience of the services SLT governments provide to their community.
Goals and Objectives
The Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA) created a series of overarching goals and objectives for the SLCGP based on input from SLTT stakeholders and associations, and consideration of national priorities, frameworks, and the national cyber threat environment:
- Implement cyber governance and planning;
- Assess and evaluate systems and capabilities;
- Mitigate prioritized issues; and
- Build a cybersecurity workforce.
Funding
In FY 2023, $374.9 million is available under the SLCGP. Each state and territory will receive a funding allocation as determined by the statutory formula. Allocations for states and territories include a base level as defined for each entity: 1% for each state, the District of Columbia, and the Commonwealth of Puerto Rico; and 0.25% for American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, and the U.S. Virgin Islands. State allocations include additional funds based on a combination of state and rural population totals. 80% of total state or territory allocations must support local entities, while 25% of the total state or territory allocations must support rural entities.
Eligibility
All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. The Governor-designated SLCGP State Administrative Agency (SAA) is the only entity eligible to submit SLCGP applications to DHS/FEMA.
Funding Guidelines
Pass-Through Requirements
The SLCGP SAA recipient must pass through at least 80% of the federal funds provided under the grant to local governments, and 25% of the federal funds must be provided to local jurisdictions within rural areas of the state or territory. The pass-through to rural entities is part of the overall 80% pass-through requirement to local governments. All pass-through entities must meet all program and grant administration requirements. See 2 C.F.R. § 200.332. For a description of eligible subrecipients, please see Section C.1.b. of the FY 2023 SLCGP Notice of Funding Opportunity (NOFO).
FEMA interprets the date that an entity “receives a grant” to be the date upon which FEMA releases the funding hold in the ND Grants system. Therefore, the 45-day pass through requirement starts on the date when the amendment is issued in ND Grants and FEMA makes the funding available to the SAA for drawdown. After the funds have been released, FY 2023 SLCGP recipients must submit a letter to FEMA signed by the Authorized Official listed on the grant award certifying that they have met the 45-day pass-through requirement and collected any signed local government consents. Local consents must be signed by the Authorized Official, or designee, for the local government entity receiving the items, services, capabilities, or activities in lieu of funding, and the consent must specify the amount and intended use of the funds. This letter is due no later than 10 calendar days after the 45-day period for issuing pass-through funding has passed. The letter should be emailed to FEMA-SLCGP@fema.dhs.gov. FEMA will send a copy of the letter to CISA.
Pass-through is defined as an obligation on the part of the entity or multi-entity group to make funds available to local units of government, combinations of local units, Tribal Nations, or other specific groups or organizations. Four requirements must be met to pass-through grant funds:
- The SLCGP SAA must make a firm written commitment to passing through grant funds or equivalent services to local government subrecipients;
- The SLCGP SAA’s commitment must be unconditional (i.e., no contingencies for the availability of eligible entity funds).
- There must be documentation (i.e., subgrant award document with terms and conditions) of the commitment; and
- The award terms must be communicated to the local subrecipient.
Multi-Entity Projects
Multiple eligible entities (states or territories) can group together to address cybersecurity risks and threats to information systems within the eligible entities’ jurisdictions. There is no separate funding for multi-entity projects. Instead, these investments would be considered as group projects: each group member contributes an agreed-upon funding amount from their SLCGP award to the overall project. Each group member’s financial contribution is then funded from their individual SLCGP award. Each participating state or territory in the group should include the multi-entity project in their individual Investment Justification (IJ) submissions with their application. It is expected that IJs for multi-entity projects will be almost identical. Any differences should be as a result of alignment with each group member’s respective Cybersecurity Plan.
Cost-Share Requirements
Eligible entities must meet a 20% cost share requirement for the FY 2023 SLCGP except for Multi-Entity Projects which require a 10% cost share. The recipient contribution can be cash (hard match) or third-party in-kind (soft match). Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 20% of the total project costs (federal award amount plus cost share amount). For FY 2023, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the following: American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands.
Unless otherwise authorized by law, federal funds cannot be matched with other federal funds. The recipient’s contribution should be specifically identified. These non-federal contributions have the same eligibility requirements as the federal share.
The Secretary of Homeland Security may waive or modify the non-federal share for an individual entity if the entity demonstrates economic hardship. More information on what constitutes economic hardship, and how to request a cost-share waiver, will be forthcoming.
For a multi-entity group project, the cost share is 10% for the FY 2023 SLCGP.
Application Process
Applying for an award under the SLCGP is a multi-step process. Applicants are encouraged to register early, as the registration process can take four weeks or more to complete. Registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadline.
Eligible applicants should submit their initial application at least one week before the final application submission through the grants.gov portal at www.grants.gov. Applicants needing Grants.gov support may contact the Grants.gov customer support hotline at (800) 518-4726, which is available 24 hours per day, seven days per week except federal holidays. Please refer to Section D in the FY 2023 SLCGP funding notice for detailed information and instructions.
Eligible applicants will be notified by FEMA within one to two business days and asked to proceed with submitting their complete application package in the Non-Disaster (ND) Grants System by the application deadline. Applicants needing technical support with the ND Grants System should contact ndgrants@fema.dhs.gov or (800) 865-4076, Monday through Friday from 9 a.m. – 6 p.m. ET (ET). Completed applications must be submitted no later than 5 p.m. ET on Friday, October 6, 2023.
SLCGP Resources
There are a variety of resources available to address programmatic, technical and financial questions, which can assist with SLCGP applications:
- The FY 2023 SLCGP funding notice is located online at grants.gov .
- For additional program-specific information, please email FEMA-SLCGP@fema.dhs.gov.
- For support regarding financial grants management and budgetary technical assistance, applicants may contact the FEMA Award Administration Help Desk, via e-mail at ASK-GMD@fema.dhs.gov.