,,ib ,union ,calendar ,no4 #chd #aafth ,,congress #b;d ,session ,h4 ,r4 #ehbc ,report ,no4 #aaf-dgh ,,in ,,the ,,house ,,of ,,representatives ,february #aj1 #bjbj,mr4 ,richmond 7for himself1 ,mr4 ,katko1 ,mr4 ,kilmer1 ,mr4 ,mc,caul1 ,mr4 ,ruppersberger1 ,mr4 ,thompson of ,mississippi1 ,mr4 ,rogers of ,alabama1 ,ms4 ,slotkin1 ,mr4 ,rose of ,new ,york1 ,mr4 ,payne1 ,mrs4 ,watson ,coleman1 ,mr4 ,langevin1 ,mr4 ,cleaver1 ,ms4 ,underwood1 and ,ms4 ,titus7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,august #ah1 #bjbj;,additional sponsors3 ,ms4 ,eshoo1 ,ms4 ,sewell of ,alabama1 and ,ms4 ,jackson ,lee ,august #ah1 #bjbj,reported with an amendment2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed,strike out all after the enacting clause and insert the part printed in italic,for text of introduced bill1 see copy of bill as introduced on ,february #aj1 #bjbj ,a ,,bill ,to establish a program to make grants to ,states to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,state and ,local ,cybersecurity ,improvement ,act4 #b4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following new sections3 #bbae4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,establishment ,the ,secretary1 acting through the ,director1 shall establish a program to make grants to ,states to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments 7referred to as the ,state and ,local ,cybersecurity ,grant ,program in this section74 7b7 ,baseline requirements ,a grant awarded under this section shall be used in compliance with the following3 7#a7 ,the ,cybersecurity ,plan required under subsection 7d7 and approved pursuant to subsection 7g74 7#b7 ,the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required in accordance with section #bbaj1 when issued4 7c7 ,administration ,the ,state and ,local ,cybersecurity ,grant ,program shall be administered in the same program office that administers grants made under sections #bjjc and #bjjd4 7d7 ,eligibility 7#a7 ,in general ,a ,state applying for a grant under the ,state and ,local ,cybersecurity ,grant ,program shall submit to the ,secretary a ,cybersecurity ,plan for approval4 ,such plan shall-- 7,a7 incorporate1 to the extent practicable1 any existing plans of such ,state to protect against cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments2 7,b7 describe1 to the extent practicable1 how such ,state shall-- 7i7 enhance the preparation1 response1 and resiliency of information systems owned or operated by such ,state or1 if appropriate1 by local1 ,tribal1 or territorial governments1 against cybersecurity risks and cybersecurity threats2 7ii7 implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address cybersecurity risks and cybersecurity threats in information systems of such ,state1 local1 ,tribal1 or territorial governments2 7iii7 ensure that ,state1 local1 ,tribal1 and territorial governments that own or operate information systems within the ,state adopt best practices and methodologies to enhance cybersecurity1 such as the practices set forth in the cybersecurity framework developed by the ,national ,institute of ,standards and ,technology2 7iv7 promote the delivery of safe1 recognizable1 and trustworthy online services by ,state1 local1 ,tribal1 and territorial governments1 including through the use of the 4gov internet domain2 7v7 mitigate any identified gaps in the ,state1 local1 ,tribal1 or territorial government cybersecurity workforces1 enhance recruitment and retention efforts for such workforces1 and bolster the knowledge1 skills1 and abilities of ,state1 local1 ,tribal1 and territorial government personnel to address cybersecurity risks and cybersecurity threats2 7vi7 ensure continuity of communications and data networks within such ,state between such ,state and local1 ,tribal1 and territorial governments that own or operate information systems within such ,state in the event of an incident involving such communications or data networks within such ,state2 7vii7 assess and mitigate1 to the greatest degree possible1 cybersecurity risks and cybersecurity threats related to critical infrastructure and key resources1 the degradation of which may impact the performance of information systems within such ,state2 7viii7 enhance capability to share cyber threat indicators and related information between such ,state and local1 ,tribal1 and territorial governments that own or operate information systems within such ,state2 and 7ix7 develop and coordinate strategies to address cybersecurity risks and cybersecurity threats in consultation with-- 7,i7 local1 ,tribal1 and territorial governments within the ,state2 and 7,,ii7 as applicable-- 7aa7 neighboring ,states or1 as appropriate1 members of an information sharing and analysis organization2 and 7bb7 neighboring countries2 and 7,c7 include1 to the extent practicable1 an inventory of the information technology deployed on the information systems owned or operated by such ,state or by local1 ,tribal1 or territorial governments within such ,state1 including legacy information technology that is no longer supported by the manufacturer4 7e7 ,planning committees 7#a7 ,in general ,a ,state applying for a grant under this section shall establish a cybersecurity planning committee to assist in the following3 7,a7 ,the development1 implementation1 and revision of such ,state's ,cybersecurity ,plan required under subsection 7d74 7,b7 ,the determination of effective funding priorities for such grant in accordance with subsection 7f74 7#b7 ,composition ,cybersecurity planning committees described in paragraph 7#a7 shall be comprised of representatives from counties1 cities1 towns1 and ,tribes within the ,state receiving a grant under this section1 including1 as appropriate1 representatives of rural1 suburban1 and high-population jurisdictions4 7#c7 ,rule of construction regarding existing planning committees ,nothing in this subsection may be construed to require that any ,state establish a cybersecurity planning committee if such ,state has established and uses a multijurisdictional planning committee or commission that meets the requirements of this paragraph4 7f7 ,use of funds ,a ,state that receives a grant under this section shall use the grant to implement such ,state's ,cybersecurity ,plan1 or to assist with activities determined by the ,secretary1 in consultation with the ,director1 to be integral to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments1 as the case may be4 7g7 ,approval of plans 7#a7 ,approval as condition of grant ,before a ,state may receive a grant under this section1 the ,secretary1 acting through the ,director1 shall review and approve such ,state's ,cybersecurity ,plan required under subsection 7d74 7#b7 ,plan requirements ,in approving a ,cybersecurity ,plan under this subsection1 the ,director shall ensure such ,plan-- 7,a7 meets the requirements specified in subsection 7d72 and 7,b7 upon issuance of the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments authorized pursuant to section #bbaj1 complies1 as appropriate1 with the goals and objectives of such ,strategy4 7#c7 ,approval of revisions ,the ,secretary1 acting through the ,director1 may approve revisions to a ,cybersecurity ,plan as the ,director determines appropriate4 7#d7 ,exception ,notwithstanding the requirement under subsection 7d7 to submit a ,cybersecurity ,plan as a condition of apply for a grant under this section1 such a grant may be awarded to a ,state that has not so submitted a ,cybersecurity ,plan to the ,secretary if-- 7,a7 such ,state certifies to the ,secretary that it will submit to the ,secretary a ,cybersecurity ,plan for approval by ,september #cj1 #bjbb2 7,b7 such ,state certifies to the ,secretary that the activities that will be supported by such grant are integral to the development of such ,cybersecurity ,plan2 or 7,c7 such ,state certifies to the ,secretary1 and the ,director confirms1 that the activities that will be supported by the grant will address imminent cybersecurity risks or cybersecurity threats to the information systems of such ,state or of a local1 ,tribal1 or territorial government in such ,state4 7h7 ,limitations on uses of funds 7#a7 ,in general ,a ,state that receives a grant under this section may not use such grant-- 7,a7 to supplant ,state1 local1 ,tribal1 or territorial funds2 7,b7 for any recipient cost-sharing contribution2 7,c7 to pay a demand for ransom in an attempt to regain access to information or an information system of such ,state or of a local1 ,tribal1 or territorial government in such ,state2 7,d7 for recreational or social purposes2 or 7,e7 for any purpose that does not directly address cybersecurity risks or cybersecurity threats on an information systems of such ,state or of a local1 ,tribal1 or territorial government in such ,state4 7#b7 ,penalties ,in addition to other remedies available1 the ,secretary may take such actions as are necessary to ensure that a recipient of a grant under this section is using such grant for the purposes for which such grant was awarded4 7i7 ,opportunity ,to amend applications ,in considering applications for grants under this section1 the ,secretary shall provide applicants with a reasonable opportunity to correct defects1 if any1 in such applications before making final awards4 7j7 ,apportionment ,for fiscal year #bjbj and each fiscal year thereafter1 the ,secretary shall apportion amounts appropriated to carry out this section among ,states as follows3 7#a7 ,baseline amount ,the ,secretary shall first apportion #j4be percent of such amounts to each of ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 and the ,virgin ,islands1 and #j4ge percent of such amounts to each of the remaining ,states4 7#b7 ,remainder ,the ,secretary shall apportion the remainder of such amounts in the ratio that-- 7,a7 the population of each ,state2 bears to 7,b7 the population of all ,states4 7k7 ,federal share ,the ,federal share of the cost of an activity carried out using funds made available under the program may not exceed the following percentages3 7#a7 ,for fiscal year #bjba1 #ij percent4 7#b7 ,for fiscal year #bjbb1 #hj percent4 7#c7 ,for fiscal year #bjbc1 #gj percent4 7#d7 ,for fiscal year #bjbd1 #fj percent4 7#e7 ,for fiscal year #bjbe and each subsequent fiscal year1 #ej percent4 7l7 ,state responsibilities 7#a7 ,certification ,each ,state that receives a grant under this section shall certify to the ,secretary that the grant will be used for the purpose for which the grant is awarded and in compliance with the ,cybersecurity ,plan or other purpose approved by the ,secretary under subsection 7g74 7#b7 ,availability of funds to local1 ,tribal1 and territorial governments ,not later than #de days after a ,state receives a grant under this section1 such ,state shall1 without imposing unreasonable or unduly burdensome requirements as a condition of receipt1 obligate or otherwise make available to local1 ,tribal1 and territorial governments in such ,state1 consistent with the applicable ,cybersecurity ,plan-- 7,a7 not less than #hj percent of funds available under such grant2 7,b7 with the consent of such local1 ,tribal1 and territorial governments1 items1 services1 capabilities1 or activities having a value of not less than #hj percent of the amount of the grant2 or 7,c7 with the consent of the local1 ,tribal1 and territorial governments1 grant funds combined with other items1 services1 capabilities1 or activities having the total value of not less than #hj percent of the amount of the grant4 7#c7 ,certifications regarding distribution of grant funds to local1 ,tribal1 territorial governments ,a ,state shall certify to the ,secretary that the ,state has made the distribution to local1 ,tribal1 and territorial governments required under paragraph 7#b74 7#d7 ,extension of period ,a ,state may request in writing that the ,secretary extend the period of time specified in paragraph 7#b7 for an additional period of time4 ,the ,secretary may approve such a request if the ,secretary determines such extension is necessary to ensure the obligation and expenditure of grant funds align with the purpose of the grant program4 7#e7 ,exception ,paragraph 7#b7 shall not apply to the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 or the ,virgin ,islands4 7#f7 ,direct funding ,if a ,state does not make the distribution to local1 ,tribal1 or territorial governments in such ,state required under paragraph 7#b71 such a local1 ,tribal1 or territorial government may petition the ,secretary4 7#g7 ,penalties ,in addition to other remedies available to the ,secretary1 the ,secretary may terminate or reduce the amount of a grant awarded under this section to a ,state or transfer grant funds previously awarded to such ,state directly to the appropriate local1 ,tribal1 or territorial government if such ,state violates a requirement of this subsection4 7m7 ,advisory committee 7#a7 ,establishment ,the ,director shall establish a ,state and ,local ,cybersecurity ,resiliency ,committee to provide ,state1 local1 ,tribal1 and territorial stakeholder expertise1 situational awareness1 and recommendations to the ,director1 as appropriate1 regarding how to-- 7,a7 address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments2 and 7,b7 improve the ability of such governments to prevent1 protect against1 respond1 mitigate1 and recover from cybersecurity risks and cybersecurity threats4 7#b7 ,duties ,the ,state and ,local ,cybersecurity ,resiliency ,committee shall-- 7,a7 submit to the ,director recommendations that may inform guidance for applicants for grants under this section2 7,b7 upon the request of the ,director1 provide to the ,director technical assistance to inform the review of ,cybersecurity ,plans submitted by applicants for grants under this section1 and1 as appropriate1 submit to the ,director recommendations to improve such ,plans prior to the ,director's determination regarding whether to approve such ,plans2 7,c7 advise and provide to the ,director input regarding the ,homeland ,security ,strategy to ,improve ,cybersecurity for ,state1 ,local1 ,tribal1 and ,territorial ,governments required under section #bbaj2 and 7,d7 upon the request of the ,director1 provide to the ,director recommendations1 as appropriate1 regarding how to-- 7i7 address cybersecurity risks and cybersecurity threats on information systems of ,state1 local1 ,tribal1 or territorial governments2 and 7ii7 improve the cybersecurity resilience of such governments4 7#c7 ,membership 7,a7 ,number and appointment ,the ,state and ,local ,cybersecurity ,resiliency ,committee shall be composed of #ae members appointed by the ,director1 as follows3 7i7 ,two individuals recommended to the ,director by the ,national ,governors ,association4 7ii7 ,two individuals recommended to the ,director by the ,national ,association of ,state ,chief ,information ,officers4 7iii7 ,one individual recommended to the ,director by the ,national ,guard ,bureau4 7iv7 ,two individuals recommended to the ,director by the ,national ,association of ,counties4 7v7 ,two individuals recommended to the ,director by the ,national ,league of ,cities4 7vi7 ,one individual recommended to the ,director by the ,united ,states ,conference of ,mayors4 7vii7 ,one individual recommended to the ,director by the ,multi-,state ,information ,sharing and ,analysis ,center4 7viii7 ,four individuals who have educational and professional experience related to cybersecurity analysis or policy4 7,b7 ,terms ,each member of the ,state and ,local ,cybersecurity ,resiliency ,committee shall be appointed for a term of two years1 except that such term shall be three years only in the case of members who are appointed initially to the ,committee upon the establishment of the ,committee4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of such term4 ,a member may serve after the expiration of such member's term until a successor has taken office4 ,a vacancy in the ,commission shall be filled in the manner in which the original appointment was made4 7,c7 ,pay ,members of the ,state and ,local ,cybersecurity ,resiliency ,committee shall serve without pay4 7#d7 ,chairperson2 vice chairperson ,the members of the ,state and ,local ,cybersecurity ,resiliency ,committee shall select a chairperson and vice chairperson from among ,committee members4 7#e7 ,federal advisory committee act ,the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,state and ,local ,cybersecurity ,resilience ,committee4 7n7 ,reports 7#a7 ,annual reports by ,state grant recipients ,a ,state that receives a grant under this section shall annually submit to the ,secretary a report on the progress of the ,state in implementing the ,cybersecurity ,plan approved pursuant to subsection 7g74 ,if the ,state does not have a ,cybersecurity ,plan approved pursuant to subsection 7g71 the ,state shall submit to the ,secretary a report describing how grant funds were obligated and expended to develop a ,cybersecurity ,plan or improve the cybersecurity of information systems owned or operated by ,state1 local1 ,tribal1 or territorial governments in such ,state4 ,the ,secretary1 acting through the ,director1 shall make each such report publicly available1 including by making each such report available on the internet website of the ,agency1 subject to any redactions the ,director determines necessary to protect classified or other sensitive information4 7#b7 ,annual reports to ,congress ,at least once each year1 the ,secretary1 acting through the ,director1 shall submit to ,congress a report on the use of grants awarded under this section and any progress made toward the following3 7,a7 ,achieving the objectives set forth in the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments1 upon the strategy's issuance under section #bbaj4 7,b7 ,developing1 implementing1 or revising ,cybersecurity ,plans4 7,c7 ,reducing cybersecurity risks and cybersecurity threats to information systems owned or operated by ,state1 local1 ,tribal1 and territorial governments as a result of the award of such grants4 7o7 ,authorization of appropriations ,there are authorized to be appropriated for grants under this section-- 7#a7 for each of fiscal years #bjba through #bjbe1 #djj1jjj1jjj2 and 7#b7 for each subsequent fiscal year1 such sums as may be necessary4 7p7 ,definitions ,in this section3 7#a7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #b4 7#b7 ,cyber threat indicator ,the term cyber threat indicator has the meaning given such term in section #ajb of the ,cybersecurity ,act of #bjae4 7#c7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,incident ,the term incident has the meaning given such term in section #bbji4 7#e7 ,information sharing and analysis organization ,the term information sharing and analysis organization has the meaning given such term in section #bbbb4 7#f7 ,information system ,the term information system has the meaning given such term in section #ajb7i7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja7i774 7#g7 ,key resources ,the term key resources has the meaning given that term in section #b4 7#h7 ,online service ,the term online service means any internet-facing service1 including a website1 email1 virtual private network1 or custom application4 7#i7 ,state ,the term ,state-- 7,a7 means each of the several ,states1 the ,district of ,colombia1 and the territories and possessions of the ,united ,states2 and 7,b7 includes any federally recognized ,indian tribe that notifies the ,secretary1 not later than #abj days after the date of the enactment of this section or not later than #abj days before the start of any fiscal year in which a grant under this section is awarded1 that the tribe intends to develop a ,cybersecurity ,plan and agrees to forfeit any distribution under subsection 7l77#b74 #bbaf4 ,cybersecurity resource guide development for ,state1 local1 ,tribal1 and territorial government officials ,the ,secretary1 acting through the ,director1 shall develop a resource guide for use by ,state1 local1 ,tribal1 and territorial government officials1 including law enforcement officers1 to help such officials identify1 prepare for1 detect1 protect against1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents 7as such term is defined in section #bbji74 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb is amended by inserting after the item relating to section #bbad the following new items3 ,sec4 #bbae4 ,state and ,local ,cybersecurity ,grant ,program4 ,sec4 #bbaf4 ,cybersecurity resource guide development for ,state1 local1 ,tribal1 and territorial government officials4 4 #c4 ,strategy 7a7 ,homeland ,security ,strategy ,to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments ,section #bbaj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffj7 is amended by adding at the end the following new subsection3 7e7 ,homeland ,security ,strategy ,to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments 7#a7 ,in general ,not later than #bgj days after the date of the enactment of this subsection1 the ,secretary1 acting through the ,director1 shall1 in coordination with appropriate ,federal departments and agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee 7established under section #bbae71 and other stakeholders1 as appropriate1 develop and make publicly available a ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments that provides recommendations regarding how the ,federal ,government should support and promote the ability ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents 7as such term is defined in section #bbji7 and establishes baseline requirements and principles to which ,cybersecurity ,plans under such section shall be aligned4 7#b7 ,contents ,the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required under paragraph 7#a7 shall-- 7,a7 identify capability gaps in the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,b7 identify ,federal resources and capabilities that are available or could be made available to ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,c7 identify and assess the limitations of ,federal resources and capabilities available to ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents1 and make recommendations to address such limitations2 7,d7 identify opportunities to improve the ,agency's coordination with ,federal and non-,federal entities1 such as the ,multi-,state ,information ,sharing and ,analysis ,center1 to improve incident exercises1 information sharing and incident notification procedures1 the ability for ,state1 local1 ,tribal1 and territorial governments to voluntarily adapt and implement guidance in ,federal binding operational directives1 and opportunities to leverage ,federal schedules for cybersecurity investments under section #ejb of title #dj1 ,united ,states ,code2 7,e7 recommend new initiatives the ,federal ,government should undertake to improve the ability of ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,f7 set short-term and long-term goals that will improve the ability of ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 and 7,g7 set dates1 including interim benchmarks1 as appropriate for ,state1 local1 ,tribal1 territorial governments to establish baseline capabilities to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents4 7#c7 ,considerations ,in developing the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required under paragraph 7#a71 the ,director1 in coordination with appropriate ,federal departments and agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee1 and other stakeholders1 as appropriate1 shall consider-- 7,a7 lessons learned from incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 and exercises with ,federal and non-,federal entities2 7,b7 the impact of incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 including the resulting costs to such governments2 7,c7 the information related to the interest and ability of state and non-state threat actors to compromise information systems owned or operated by ,state1 local1 ,tribal1 and territorial governments2 7,d7 emerging cybersecurity risks and cybersecurity threats to ,state1 local1 ,tribal1 and territorial governments resulting from the deployment of new technologies2 and 7,e7 recommendations made by the ,state and ,local ,cybersecurity ,resilience ,committee4 4 7b7 ,responsibilities of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency ,subsection 7c7 of section #bbjb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #feb7 is amended-- 7#a7 by redesignating paragraphs 7#f7 through 7#aa7 as paragraphs 7#aa7 through 7#af71 respectively2 and 7#b7 by inserting after paragraph 7#e7 the following new paragraphs3 7#f7 develop program guidance1 in consultation with the ,state and ,local ,government ,cybersecurity ,resiliency ,committee established under section #bbae1 for the ,state and ,local ,cybersecurity ,grant ,program under such section or any other homeland security assistance administered by the ,department to improve cybersecurity2 7#g7 review1 in consultation with the ,state and ,local ,cybersecurity ,resiliency ,committee1 all cybersecurity plans of ,state1 local1 ,tribal1 and territorial governments developed pursuant to any homeland security assistance administered by the ,department to improve cybersecurity2 7#h7 provide expertise and technical assistance to ,state1 local1 ,tribal1 and territorial government officials with respect to cybersecurity2 7#i7 provide education1 training1 and capacity development to enhance the security and resilience of cybersecurity and infrastructure security2 7#aj7 provide information to ,state1 local1 ,tribal1 and territorial governments on the security benefits of 4gov domain name registration services2 4 7c7 ,feasibility study ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security shall conduct a study to assess the feasibility of implementing a short-term rotational program for the detail of approved ,state1 local1 ,tribal1 and territorial government employees in cyber workforce positions to the ,agency4 ,august #ah1 #bjbj,reported with an amendment2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed