,i #aafth ,,congress #ast ,session ,h4 ,r4 #bacj ,,in ,,the ,,house ,,of ,,representatives ,april #h1 #bjai ,mr4 ,kilmer 7for himself and ,mr4 ,mc,caul7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security1 and in addition to the ,committee on ,transportation and ,infrastructure1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to provide grants to assist ,states in developing and implementing plans to address cybersecurity threats or vulnerabilities1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,state ,cyber ,resiliency ,act4 #b4 ,establishment of cyber resiliency grant program 7a7 ,establishment ,there is established the ,state ,cyber ,resiliency ,grant ,program to assist ,state1 local1 and tribal governments in preventing1 preparing for1 protecting against1 and responding to cyber threats1 which shall be administered by the ,administrator4 7b7 ,eligibility ,each ,state shall be eligible to apply for grants under the ,program4 7c7 ,grants authorized for each ,state ,subject to the funds available under a funding allocation determined under subsection 7f7 for a ,state1 the ,secretary of ,homeland ,security may award to the ,state-- 7#a7 up to #b planning grants under subsection 7e7 to develop or revise a cyber resiliency plan2 and 7#b7 up to #b implementation grants under subsection 7f7 to implement an active cyber resiliency plan4 7d7 ,approval of cyber resiliency plans 7#a7 ,in general ,the ,secretary shall approve a cyber resiliency plan submitted by a ,state if the ,secretary determines1 after considering the recommendations of the ,review ,committee established under subsection 7i71 that the plan meets all of the following criteria3 7,a7 ,the plan incorporates1 to the extent practicable1 any existing plans of such ,state to protect against cybersecurity threats or vulnerabilities4 7,b7 ,the plan is designed to achieve each of the following objectives1 with respect to the essential functions of such ,state3 7i7 ,enhancing the preparation1 response1 and resiliency of computer networks1 industrial control systems1 and communications systems performing such functions against cybersecurity threats or vulnerabilities4 7ii7 ,implementing a process of continuous cybersecurity vulnerability assessments and threat mitigation practices to prevent the disruption of such functions by an incident within the ,state4 7iii7 ,ensuring that entities performing such functions within the ,state adopt generally recognized best practices and methodologies with respect to cybersecurity1 such as the practices provided in the cybersecurity framework developed by the ,national ,institute of ,standards and ,technology4 7iv7 ,mitigating talent gaps in the ,state government cybersecurity workforce1 enhancing recruitment and retention efforts for such workforce1 and bolstering the knowledge1 skills1 and abilities of ,state government personnel to protect against cybersecurity threats and vulnerabilities4 7v7 ,protecting public safety answering points and other emergency communications and data networks from cybersecurity threats or vulnerabilities4 7vi7 ,ensuring continuity of communications and data networks between entities performing such functions within the ,state1 in the event of a catastrophic disruption of such communications or networks4 7vii7 ,accounting for and mitigating1 to the greatest degree possible1 cybersecurity threats or vulnerabilities related to critical infrastructure or key resources1 the degradation of which may impact the performance of such functions within the ,state or threaten public safety4 7viii7 ,providing appropriate communications capabilities to ensure cybersecurity intelligence information-sharing and the command and coordination capabilities among entities performing such functions4 7ix7 ,developing and coordinating strategies with respect to cybersecurity threats or vulnerabilities in consultation with-- 7,i7 neighboring ,states or members of an information sharing and analysis organization2 and 7,,ii7 as applicable1 neighboring countries4 7#b7 ,duration of approval 7,a7 ,initial duration ,an approval under paragraph 7#a7 shall be initially effective for the #b-year period beginning on the date of the determination described in such paragraph4 7,b7 ,annual extension ,the ,secretary may annually extend such approval for a #a-year period1 if the ,secretary determines1 after considering the recommendations of the ,review ,committee1 that the plan continues to meet the criteria described in paragraph 7#a7 after the ,state makes such revisions as the ,secretary may determine to be necessary4 7#c7 ,essential functions ,for purposes of this subsection1 the term essential functions includes1 with respect to a ,state1 those functions that enhance the cybersecurity posture of the ,state1 local and tribal governments of the ,state1 and the public services they provide4 7e7 ,planning grants 7#a7 ,initial planning grant ,the ,secretary shall require1 as a condition of awarding an initial planning grant1 that the ,state seeking the grant-- 7,a7 agrees to use the funds to develop a cyber resiliency plan designed to meet the criteria described in subsection 7d77#a72 and 7,b7 submits an application including such information as the ,secretary may determine to be necessary4 7#b7 ,eligibility for initial planning grant ,a ,state shall not be eligible to receive an initial planning grant after the date on which the ,state first submits a cyber resiliency plan to the ,secretary for a determination under subsection 7d77#a74 7#c7 ,additional planning grant ,the ,secretary may award an additional planning grant to a ,state if the ,state agrees to use the funds to revise a cyber resiliency plan in order to receive an extension in accordance with subsection 7d77#b77;,b71 and submits an application including such information as the ,secretary may determine to be necessary4 7#d7 ,limitations on number and timing of grants ,a ,state shall not be eligible to receive-- 7,a7 more than #b planning grants under this subsection2 or 7,b7 an additional planning grant for the fiscal year following the fiscal year for which it receives an initial planning grant4 7f7 ,implementation grants 7#a7 ,application requirements ,the ,secretary shall require1 as a condition of awarding a biennial implementation grant1 that the ,state seeking the grant submits an application including the following3 7,a7 ,a proposal1 including a description and timeline1 of the activities to be funded by the grant as described by a cyber resiliency plan of the ,state approved under subsection 7d74 7,b7 ,a description of how each activity proposed to be funded by the grant would achieve one or more of the objectives described in subsection 7d77#a77;,b74 7,c7 ,a description1 if applicable1 of how any prior biennial implementation grant awarded under this section was spent1 and to what extent the criteria described in subsection 7d77#a7 were met4 7,d7 ,the share of any amounts awarded as a biennial implementation grant proposed to be distributed to local or tribal governments within such ,state4 7,e7 ,such other information as the ,secretary may determine to be necessary in consultation with the chief information officer1 emergency managers1 and senior public safety officials of the ,state4 7#b7 ,approval of application ,the ,secretary shall consider the recommendations of the ,review ,committee in approving or disapproving an application for a biennial implementation grant4 7#c7 ,distribution to local and tribal governments 7,a7 ,in general ,not later than #de days after the date that a biennial implementation grant is awarded1 not less than #ej percent of any share proposed under paragraph 7#a77;,d7 shall be distributed to local or tribal governments1 in the same manner that amounts awarded under section #bjjd of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fje7 are distributed to such governments1 except that-- 7i7 no such distribution may be made to a federally recognized ,indian tribe that is a ,state under subsection 7k77#aa77;,b72 and 7ii7 in applying section #bjjd7;c77#a7 of such ,act with respect to distributions under this subparagraph1 #ajj percent shall be substituted for #hj percent each place that term appears4 7,b7 ,consultation ,in determining how an implementation grant is distributed within a ,state1 the ,state shall consult with local and regional chief information officers1 emergency managers1 and senior public safety officials of the ,state4 7#d7 ,competitive award ,except as provided in subsection 7h71 biennial implementation grants shall be awarded-- 7,a7 exclusively on a competitive basis2 and 7,b7 based on the recommendations of the ,review ,committee4 7#e7 ,limitation on number of grants ,the ,secretary may award to a ,state not more than #b biennial implementation grants under this section4 7g7 ,use of grant funds 7#a7 ,limitations ,any grant awarded under this section shall supplement and not supplant ,state or local funds or1 as applicable1 funds supplied by the ,bureau of ,indian ,affairs1 and may not be used-- 7,a7 to provide any ,federal cost-sharing contribution on behalf of a ,state2 or 7,b7 for any recreational or social purpose4 7#b7 ,approved activities for implementation grants ,a ,state or a government entity that receives funds through a biennial implementation grant may use such funds for one or more of the following activities1 to the extent that such activities are proposed under subsection 7f77#a77;,a73 7,a7 ,supporting or enhancing information sharing and analysis organizations4 7,b7 ,implementing or coordinating systems and services that use cyber threat indicators 7as such term is defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja77 to address cybersecurity threats or vulnerabilities4 7,c7 ,supporting dedicated cybersecurity and communications coordination planning1 including the coordination of-- 7i7 emergency management elements of such ,state2 7ii7 ,national ,guard units1 as appropriate2 7iii7 entities associated with critical infrastructure or key resources2 7iv7 information sharing and analysis organizations2 7v7 public safety answering points2 or 7vi7 nongovernmental organizations engaged in cybersecurity research as a formally designated information analysis and sharing organization4 7,d7 ,establishing programs1 such as scholarships or apprenticeships1 to provide financial assistance to ,state residents who-- 7i7 pursue formal education1 training1 and industry-recognized certifications for careers in cybersecurity as identified by the ,national ,initiative for ,cybersecurity ,education2 and 7ii7 commit to working for ,state government for a specified period of time4 7h7 ,funding allocations 7#a7 ,in general ,from any amount appropriated for a fiscal year that is not reserved for use by the ,secretary in carrying out this section1 the ,secretary shall allocate the entire amount among the ,states 7including the ,district of ,columbia7 eligible for grants under this section taking into consideration the factors specified in paragraph 7#b7 and consistent with the following3 7,a7 ,allocations for the several ,states ,of the amount subject to allocation1 a funding allocation for any of such ,states shall be-- 7i7 not less than #j4jja percent1 with respect to an initial planning grant1 and not more than #j4jja percent1 with respect to any additional planning grants2 and 7ii7 not less than #j4e percent and not more than #c percent1 with respect to biennial implementation grants4 7,b7 ,allocations for the territories and possessions ,of the amount subject to allocation1 a funding allocation for any of the territories and possessions of the ,united ,states eligible for grants under this section shall be-- 7i7 not less than #j4jja percent1 with respect to an initial planning grant1 and not more than #j4jja percent1 with respect to any additional planning grant2 and 7ii7 not less than #j4a percent and not more than #a percent1 with respect to biennial implementation grants4 7#b7 ,considerations for funding allocations ,in determining a funding allocation under paragraph 7#a7 for a ,state1 the ,secretary shall consider each of the following factors3 7,a7 ,the considerations described in section #ahji7;h77#a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #egi7;h77#a77 with respect to the ,state1 and the degree of exposure of the ,state and protected government entities within the ,state to threats1 vulnerabilities1 or consequences resulting from cybersecurity risks or incidents4 7,b7 ,the degree of exposure of the ,state and protected government entities within the ,state to threats1 vulnerabilities1 or consequences resulting from cybersecurity risks or incidents4 7,c7 ,the effectiveness of1 relative to evolving cyber threats against1 cybersecurity assets1 secure communications capabilities1 and data network protections1 of the ,state and its partners4 7,d7 ,the extent to which the ,state is vulnerable to cyber threats because it has not implemented best practices such as the cybersecurity framework developed by the ,national ,institute of ,standards and ,technology4 7,e7 ,the extent to which a ,state government may face low cybersecurity workforce supply and high cybersecurity workforce demand1 as identified by the ,national ,institute of ,standards and ,technology4 7i7 ,review ,committee for ,cyber ,resiliency ,grants 7#a7 ,establishment ,there is established a committee to be known as the ,review ,committee for ,cyber ,resiliency ,grants 7in this section referred to as the ,review ,committee74 7#b7 ,consideration of submissions ,the ,secretary shall forward a copy of each cyber resiliency plan submitted for approval under subsection 7d77#a71 each application for an additional planning grant submitted under subsection 7e77#c71 and each application for a biennial implementation grant submitted under subsection 7d77#a7 to the ,review ,committee for consideration under this subsection4 7#c7 ,duties ,the ,review ,committee shall-- 7,a7 promulgate guidance for the development of applications for grants under this section2 7,b7 review any plan or application forwarded under paragraph 7#b72 7,c7 provide to the ,state and to the ,secretary the recommendations of the ,review ,committee regarding the approval or disapproval of such plan or application and1 if applicable1 possible improvements to such plan or application2 7,d7 provide to the ,secretary an evaluation of any progress made by a ,state in implementing an active cyber resiliency plan using a prior biennial implementation grant2 and 7,e7 submit to ,congress an annual report on the progress made in implementing active cyber resiliency plans4 7#d7 ,membership 7,a7 ,number and appointment ,the ,review ,committee shall be composed of #ae members appointed by the ,secretary as follows3 7i7 ,at least #b individuals recommended to the ,secretary by the ,national ,governors ,association4 7ii7 ,at least #a individual recommended to the ,secretary by the ,national ,association of ,state ,chief ,information ,officers4 7iii7 ,at least #a individual recommended to the ,secretary by the ,national ,guard ,bureau4 7iv7 ,at least #a individual recommended to the ,secretary by the ,national ,association of ,counties4 7v7 ,at least #a individual recommended to the ,secretary by the ,national ,league of ,cities4 7vi7 ,not more than #i other individuals who have educational and professional experience related to cybersecurity analysis or policy4 7,b7 ,terms ,each member shall be appointed for a term of #a year4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of that term4 ,a member may serve after the expiration of that member's term until a successor has taken office4 ,a vacancy in the ,commission shall be filled in the manner in which the original appointment was made4 7,c7 ,pay ,members shall serve without pay4 7,d7 ,chairperson2 ,vice ,chairperson ,the ,secretary1 or a designee of the ,secretary1 shall serve as the ,chairperson of the ,review ,committee4 ,the ,administrator of the ,federal ,emergency ,management ,agency1 or a designee of the ,administrator1 shall serve as the ,vice ,chairperson of the ,review ,committee4 7#e7 ,staff and experts ,the ,review ,committee may-- 7,a7 appoint additional personnel as it considers appropriate1 without regard to the provisions of title #e1 ,united ,states ,code1 governing appointments in the competitive service2 7,b7 fix the pay of such additional personnel1 without regard to the provisions of chapter #ea and subchapter ,,iii of chapter #ec of such title relating to classification and ,general ,schedule pay rates2 and 7,c7 procure temporary and intermittent services under section #caji7;b7 of such title4 7#f7 ,detailees ,upon request of the ,review ,committee1 the head of any ,federal department or agency may detail1 on a reimbursable basis1 any of the personnel of that department or agency to the ,commission to assist it in carrying out the duties under this ,act4 7#g7 ,federal ,advisory ,committee ,act ,the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,review ,committee4 7#h7 ,termination ,the authority of the ,review ,committee shall terminate on the day after the end of the #e-;fiscal-year period described in subsection 7j74 7j7 ,funding ,there is authorized to be appropriated for grants under this section such sums as are necessary for fiscal years #bjbj through #bjbe4 7k7 ,definitions ,in this section3 7#a7 ,active cyber resiliency plan ,the term active cyber resiliency plan means a cyber resiliency plan for which an approval is in effect in accordance with subsection 7d77#b77;,a7 or for which the ,secretary extends such approval in accordance with subsection 7d77#b77;,b74 7#b7 ,administrator ,the term ,administrator means the ,administrator of the ,federal ,emergency ,management ,agency4 7#c7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #b of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja74 7#d7 ,cyber resiliency plan ,the term cyber resiliency plan means1 with respect to a ,state1 a plan that addresses the cybersecurity threats or vulnerabilities faced by the ,state through a statewide plan and decisionmaking process to respond to cybersecurity risks or incidents4 7#e7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given that term in section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei74 7#f7 ,incident ,the term incident has the meaning given that term in section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei74 7#g7 ,information sharing and analysis organization ,the term information sharing and analysis organization has the meaning given that term in section #bbbb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fga74 7#h7 ,key resources ,the term key resources has the meaning given that term in section #b of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja74 7#i7 ,program ,the term ,program means the ,state ,cyber ,resiliency ,grant ,program established by this section4 7#aj7 ,public safety answering points ,the term public safety answering points has the meaning given that term in section #bbb7;h7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb7;h774 7#aa7 ,state ,the term ,state-- 7,a7 means each of the several ,states1 the ,district of ,colombia1 and the territories and possessions of the ,united ,states2 and 7,b7 includes any federally recognized ,indian tribe that notifies the ,secretary1 not later than #abj days after the date of the enactment of this ,act or not later than #abj days before the start of any fiscal year during the #e-;fiscal-year period described in subsection 7j71 that the tribe intends to develop a cyber resiliency plan and agrees to forfeit any distribution under subsection 7f77#c74