,i #aafth ,,congress #b;d ,session ,h4 ,r4 #hjdh ,,in ,,the ,,house ,,of ,,representatives ,august #ad1 #bjbj,mr4 ,langevin 7for himself1 ,mr4 ,gallagher1 ,mr4 ,ruppersberger1 ,mr4 ,hurd of ,texas1 ,mr4 ,richmond1 ,mr4 ,mc,caul1 ,mr4 ,rose of ,new ,york1 and ,mr4 ,bacon7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security1 and in addition to the ,committees on ,oversight and ,reform1 and ,energy and ,commerce1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to establish in the ,department of ,homeland ,security a program to make grants for emergency information technology expenses1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,state and ,local ,,it ,modernization and ,cybersecurity ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#c7 ,covered information technology ,in this section1 the term covered information technology includes the following information technology3 7,a7 ,enterprise productivity tools1 including-- 7i7 email services2 7ii7 computer software for the purposes of managing payroll and budget2 7iii7 personnel management solutions2 and 7iv7 customer relationship management software relating to the provision of services to users of such services4 7,b7 ,cybersecurity services and tools4 7,c7 ,computer networking equipment4 7#d7 ,covered information technology services ,the term covered information technology services means any service necessary to install1 implement1 maintain1 or upgrade covered information technology4 7#e7 ,department ,the term ,department means the ,department of ,homeland ,security4 7#f7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security4 7#g7 ,emergency information technology expenses ,the term emergency information technology expenses means expenses related to-- 7,a7 improving covered information technology2 7,b7 conducting covered information technology services2 7,c7 subsidizing payroll for information technology staff to maintain the current staffing level2 or 7,d7 government employees having the necessary covered information technology to telework4 7#h7 ,fiscal year ,the term fiscal year has the meaning given the term under the ,state or local law of the relevant grant recipient4 7#i7 ,information technology ,the term information technology has the meaning given the term in section #aaaja of title #dj1 ,united ,states ,code4 7#aj7 ,public health emergency ,the term public health emergency means the public health emergency declared by the ,secretary of ,health and ,human ,services pursuant to section #cai of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bdg;d7 on ,january #ca1 #bjbj1 with respect to ,,covid-#ai4 7#aa7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#ab7 ,state ,the term ,state has the meaning given the term in section #caa of title #e1 ,united ,states ,code4 7#ac7 ,tribal government ,the term ,tribal government has the meaning given the term in section #dba7ac7 of the ,congressional ,budget and ,impoundment ,control ,act of #aigd 7#b ,u4,s4,c4 #feh7ac774 #c4 ,public health emergency information technology grant program 7a7 ,establishment ,there is established in the ,department a program to be known as the ,public ,health ,emergency ,information ,technology ,grant ,program 7in this section referred to as the ,public ,health ,emergency ,,it ,grant ,program71 under which the ,secretary may award grants to ,states for emergency information technology expenses during the public health emergency4 7b7 ,application ,each ,state may apply for a grant under the ,public ,health ,emergency ,,it ,grant ,program1 and shall submit such information in support of such a grant as the ,secretary may require4 7c7 ,allocation of funds 7#a7 ,tribal ,governments ,grants to ,tribal governments under the ,public ,health ,emergency ,,it ,grant ,program may not exceed #be1jjj1jjj in the aggregate4 7#b7 ,administration and ,oversight ,the ,secretary may not expend more than #aj1jjj1jjj for administration of the ,public ,health ,emergency ,,it ,grant ,program4 7d7 ,conditions on receipt of grant 7#a7 ,management of funds ,to be eligible for a grant under the ,public ,health ,emergency ,,it ,grant ,program1 a ,state shall agree to designate the ,chief ,information ,officer1 or an equivalent official1 of the ,state as the primary official for the management and allocation of funds awarded under the ,public ,health ,emergency ,,it ,grant ,program4 7#b7 ,security standards and certifications 7,a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary1 in consultation with the ,secretary of ,commerce1 shall select commonly accepted security standards and certifications with respect to covered information technology4 7,b7 ,security standards and certifications required ,to be eligible for a grant under the ,public ,health ,emergency ,,it ,grant ,program1 a ,state shall agree to procure only covered information technology that meets or exceeds the standards and certifications selected pursuant to paragraph 7#a7 with funds made available under such ,program4 7e7 ,grants 7#a7 ,single grant ,a ,state may not receive more than one grant under the ,public ,health ,emergency ,,it ,grant ,program4 7#b7 ,grant amounts ,the ,secretary may award grants to ,states under the ,public ,health ,emergency ,,it ,grant ,program on the basis of the population of such ,state1 except no grant awarded under such ,program may be less than #e1jjj1jjj4 7f7 ,subgrants ,each ,state that receives a grant under the ,public ,health ,emergency ,,it ,grant ,program shall reserve not less than #dj percent of amounts received for the purpose of making subgrants to local governments within such ,state-- 7#a7 for emergency information technology expenses2 or 7#b7 to purchase licenses for covered information technology on behalf of such local governments4 7g7 ,return of funds ,amounts received by ,states under the ,public ,health ,emergency ,,it ,grant ,program that are not expended by the date that is two years after the date of the receipt of such funds shall be returned to the ,treasury of the ,united ,states4 7h7 ,reports 7#a7 ,reports by grant recipients ,not later than #ahj days after receiving a grant under the ,public ,health ,emergency ,,it ,grant ,program1 a recipient of such grant shall submit to the ,secretary a report that-- 7,a7 describes how grant funds were obligated or expended1 including the use of funds made available as subgrants2 and 7,b7 demonstrates compliance by such recipient and subgrantee with the requirements of such ,program4 7#b7 ,annual report to ,congress ,not later than #a year after the date of the enactment of this ,act and annually thereafter until all funds under the ,public ,health ,emergency ,,it ,grant ,program are expended or returned to the ,treasury of the ,united ,states1 the ,secretary shall submit to the appropriate congressional committees a report that-- 7,a7 describes how grant funds were obligated or expended1 including the use of funds made available as subgrants2 and 7,b7 demonstrates compliance by each recipient and subgrantee with the requirements of such ,program4 7i7 ,authorization of appropriations ,there is authorized to be appropriated #a1jjj1jjj1jjj for grants under the ,public ,health ,emergency ,,it ,grant ,program4 ,amounts authorized to be appropriated pursuant to this subsection are authorized to remain available until ,september #cj1 #bjbb4 #d4 ,modernizing ,,it grant program 7a7 ,establishment ,there is established in the ,department a program to be known as the ,modernizing ,,it ,grant ,program1 under which the ,secretary may make grants to ,states to modernize information technology for the purpose of securely enabling digital delivery of government services1 including the digital delivery of-- 7#a7 emergency services2 7#b7 government benefit and entitlement programs2 and 7#c7 administrative services performed by a ,state4 7b7 ,eligibility ,to be eligible for a grant under the ,modernizing ,,it ,grant ,program1 a ,state shall-- 7#a7 with respect to fiscal years #bjba1 #bjbb1 and #bjbc1 maintain the funding levels of the lesser of fiscal year #bjai1 or the average of fiscal years #bjag1 #bjah1 and #bjai1 with respect to information technology support and modernization2 and 7#b7 provide matching funds equal to #e percent of the amount of any grant received under the ,modernizing ,,it ,grant ,program4 7c7 ,application 7#a7 ,in general ,each ,state may apply for a grant under the ,modernizing ,,it ,grant ,program1 and shall submit such information in support of such a grant as the ,secretary may require1 including the following3 7,a7 ,a ,state information technology modernization plan1 including-- 7i7 a description of existing information technology2 7ii7 the costs related to maintenance of existing information technology2 7iii7 a compilation of recent security audits of existing information technology2 7iv7 a compilation of recent operational performance reports of existing information technology2 7v7 a methodology to prioritize projects and procurement to account for-- 7,i7 security gains2 7,,ii7 operational gains2 and 7,,iii7 cost2 and 7vi7 a transition plan to modernize existing information technology1 including-- 7,i7 a comparative analysis of cloud-based versus on-premise solutions2 and 7,,ii7 an estimate of operation and maintenance costs for the information technology to be procured under such transition plan4 7,b7 ,a local government information technology modernization plan describing how grants awarded under the ,modernizing ,,it ,grant ,program will be used to provide-- 7i7 subgrants to local governments to modernize their information technology supporting digital delivery of government services2 or 7ii7 shared services to local governments to support the digital delivery of government services4 7#b7 ,application evaluation ,the ,secretary1 acting through the ,director1 and in consultation with the ,administrator of ,general ,services1 shall evaluate each application for a grant under the ,modernizing ,,it ,grant ,program with respect to the appropriateness of the information technology modernization plan to improve cybersecurity and enhance the capability to effectively deliver digital government services4 7#c7 ,technical assistance ,the ,director may provide technical assistance to ,states applying for a grant under the ,modernizing ,,it ,grant ,program with respect to ,state and local government information technology modernization plans described in paragraph 7#a77;,b74 7d7 ,conditions on receipt of grant 7#a7 ,management of funds ,to be eligible for a grant under the ,modernizing ,,it ,grant ,program1 a ,state shall agree to designate the ,chief ,information ,officer1 or an equivalent official1 of the ,state as the primary official for the management and allocation of funds awarded under the ,modernizing ,,it ,grant ,program4 7#b7 ,security standards and certifications 7,a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,secretary1 in consultation with the ,secretary of ,commerce1 shall select commonly accepted security standards and certifications with respect to information technology4 7,b7 ,security standards and certifications required ,to be eligible for a grant under the ,modernizing ,,it ,grant ,program1 a ,state shall agree to procure only information technology that meets or exceeds the standards and certifications described in paragraph 7#a7 with funds made available under such ,program4 7e7 ,grants 7#a7 ,single grant ,a ,state may not receive more than one grant under the ,modernizing ,,it ,grant ,program4 7#b7 ,grant amounts 7,a7 ,state governments ,the ,secretary may determine the amount of a grant to be awarded to a ,state1 excluding ,tribal governments1 under the ,modernizing ,,it ,grant ,program based on the population of such ,state1 except no grant awarded under such ,program may be less than #ajj1jjj1jjj4 7,b7 ,tribal governments ,grants to ,tribal governments under the ,modernization ,grant ,program may not exceed #ejj1jjj1jjj in the aggregate4 7#c7 ,disbursement of funds ,grant funds awarded under the ,modernizing ,,it ,grant ,program shall be dispersed in structured payments over a period of five years1 in such increments as the ,secretary determines appropriate for the project or procurement to be carried out using the funds4 7f7 ,subgrants ,each ,state that receives a grant under the ,modernizing ,,it ,grant ,program shall reserve not less than #dj percent of amounts received under such grant for the purpose of making a subgrant to local governments to implement the local government information technology modernization plan required under subsection 7c77#a77;,b74 7g7 ,return of funds ,amounts received under the ,modernizing ,,it ,grant ,program that are not expended by the date that is five years after the date of the receipt of such funds shall be returned to the ,treasury of the ,united ,states4 7h7 ,administrative costs ,the ,secretary may not expend more than #be1jjj1jjj for administration of the ,modernizing ,,it ,grant ,program4 7i7 ,reports 7#a7 ,reports by grant recipients ,not later than #ahj days after receiving a grant under the ,modernizing ,,it ,grant ,program1 a recipient of such grant shall submit to the ,secretary a report that-- 7,a7 describes how grant funds were obligated or expended1 including the use of funds made available as subgrants2 and 7,b7 demonstrates compliance by each recipient and subgrantee with the requirements of such ,program4 7#b7 ,annual report to ,congress ,not later than #a year after the date of the first grant awarded under the ,modernizing ,,it ,grant ,program and annually thereafter until all funds are expended or returned to the ,treasury of the ,united ,states1 the ,secretary shall submit to the appropriate congressional committees a report that-- 7,a7 describes how grant funds were obligated or expended1 including the use of funds made available as subgrants2 and 7,b7 demonstrates compliance by each recipient and subgrantee with the requirements of such ,program4 7j7 ,authorization of appropriations ,there is authorized to be appropriated #be1jjj1jjj1jjj for grants under the ,modernizing ,,it ,grant ,program4 ,amounts authorized to be appropriated pursuant to this subsection are authorized to remain available until ,september #cj1 #bjbg4 #e4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following new sections3 #bbae4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,establishment ,the ,secretary1 acting through the ,director1 shall establish a program to make grants to ,states to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments 7referred to as the ,state and ,local ,cybersecurity ,grant ,program in this section74 7b7 ,baseline requirements ,a grant awarded under this section shall be used in compliance with the following3 7#a7 ,the ,cybersecurity ,plan required under subsection 7d7 and approved pursuant to subsection 7g74 7#b7 ,the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required in accordance with section #bbaj1 when issued4 7c7 ,administration ,the ,state and ,local ,cybersecurity ,grant ,program shall be administered in the same program office that administers grants made under sections #bjjc and #bjjd4 7d7 ,eligibility 7#a7 ,in general ,a ,state applying for a grant under the ,state and ,local ,cybersecurity ,grant ,program shall submit to the ,secretary a ,cybersecurity ,plan for approval4 ,such plan shall-- 7,a7 incorporate1 to the extent practicable1 any existing plans of such ,state to protect against cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments2 7,b7 describe1 to the extent practicable1 how such ,state shall-- 7i7 enhance the preparation1 response1 and resiliency of information systems owned or operated by such ,state or1 if appropriate1 by local1 ,tribal1 or territorial governments1 against cybersecurity risks and cybersecurity threats2 7ii7 implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address cybersecurity risks and cybersecurity threats in information systems of such ,state1 local1 ,tribal1 or territorial governments2 7iii7 ensure that ,state1 local1 ,tribal1 and territorial governments that own or operate information systems within the ,state adopt best practices and methodologies to enhance cybersecurity1 such as the practices set forth in the cybersecurity framework developed by the ,national ,institute of ,standards and ,technology2 7iv7 promote the delivery of safe1 recognizable1 and trustworthy online services by ,state1 local1 ,tribal1 and territorial governments1 including through the use of the 4gov internet domain2 7v7 mitigate any identified gaps in the ,state1 local1 ,tribal1 or territorial government cybersecurity workforces1 enhance recruitment and retention efforts for such workforces1 and bolster the knowledge1 skills1 and abilities of ,state1 local1 ,tribal1 and territorial government personnel to address cybersecurity risks and cybersecurity threats2 7vi7 ensure continuity of communications and data networks within such ,state between such ,state and local1 ,tribal1 and territorial governments that own or operate information systems within such ,state in the event of an incident involving such communications or data networks within such ,state2 7vii7 assess and mitigate1 to the greatest degree possible1 cybersecurity risks and cybersecurity threats related to critical infrastructure and key resources1 the degradation of which may impact the performance of information systems within such ,state2 7viii7 enhance capability to share cyber threat indicators and related information between such ,state and local1 ,tribal1 and territorial governments that own or operate information systems within such ,state2 and 7ix7 develop and coordinate strategies to address cybersecurity risks and cybersecurity threats in consultation with-- 7,i7 local1 ,tribal1 and territorial governments within the ,state2 and 7,,ii7 as applicable-- 7aa7 neighboring ,states or1 as appropriate1 members of an information sharing and analysis organization2 and 7bb7 neighboring countries2 and 7,c7 include1 to the extent practicable1 an inventory of the information technology deployed on the information systems owned or operated by such ,state or by local1 ,tribal1 or territorial governments within such ,state1 including legacy information technology that is no longer supported by the manufacturer4 7#b7 ,discretionary elements ,the ,cybersecurity ,plan of a ,state described in paragraph 7#a7 may include-- 7,a7 cooperative programs developed by groups of local1 ,tribal1 and territorial governments within such ,state to address cybersecurity risks and cybersecurity threats2 and 7,b7 programs provided by such ,state to support local1 ,tribal1 and territorial governments and critical infrastructure owners and operators to address cybersecurity risks and cybersecurity threats4 7e7 ,planning committees 7#a7 ,in general ,a ,state applying for a grant under this section shall establish a cybersecurity planning committee to assist in the following3 7,a7 ,the development1 implementation1 and revision of such ,state's ,cybersecurity ,plan required under subsection 7d74 7,b7 ,the determination of effective funding priorities for such grant in accordance with subsection 7f74 7#b7 ,composition ,cybersecurity planning committees described in paragraph 7#a7 shall be comprised of representatives from counties1 cities1 towns1 and ,tribes within the ,state receiving a grant under this section1 including1 as appropriate1 representatives of rural1 suburban1 and high-population jurisdictions4 7#c7 ,rule of construction regarding existing planning committees ,nothing in this subsection may be construed to require that any ,state establish a cybersecurity planning committee if such ,state has established and uses a multijurisdictional planning committee or commission that meets the requirements of this paragraph4 7f7 ,use of funds ,a ,state that receives a grant under this section shall use the grant to implement such ,state's ,cybersecurity ,plan1 or to assist with activities determined by the ,secretary1 in consultation with the ,director1 to be integral to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments1 as the case may be4 7g7 ,approval of plans 7#a7 ,approval as condition of grant ,before a ,state may receive a grant under this section1 the ,secretary1 acting through the ,director1 shall review and approve such ,state's ,cybersecurity ,plan required under subsection 7d74 7#b7 ,plan requirements ,in approving a ,cybersecurity ,plan under this subsection1 the ,director shall ensure such ,plan-- 7,a7 meets the requirements specified in subsection 7d72 and 7,b7 upon issuance of the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments authorized pursuant to section #bbaj1 complies1 as appropriate1 with the goals and objectives of such ,strategy4 7#c7 ,approval of revisions ,the ,secretary1 acting through the ,director1 may approve revisions to a ,cybersecurity ,plan as the ,director determines appropriate4 7#d7 ,exception ,notwithstanding the requirement under subsection 7d7 to submit a ,cybersecurity ,plan as a condition of apply for a grant under this section1 such a grant may be awarded to a ,state that has not so submitted a ,cybersecurity ,plan to the ,secretary if-- 7,a7 such ,state certifies to the ,secretary that it will submit to the ,secretary a ,cybersecurity ,plan for approval by ,september #cj1 #bjbb2 7,b7 such ,state certifies to the ,secretary that the activities that will be supported by such grant are integral to the development of such ,cybersecurity ,plan2 or 7,c7 such ,state certifies to the ,secretary1 and the ,director confirms1 that the activities that will be supported by the grant will address imminent cybersecurity risks or cybersecurity threats to the information systems of such ,state or of a local1 ,tribal1 or territorial government in such ,state4 7h7 ,limitations on uses of funds 7#a7 ,in general ,a ,state that receives a grant under this section may not use such grant-- 7,a7 to supplant ,state1 local1 ,tribal1 or territorial funds2 7,b7 for any recipient cost-sharing contribution2 7,c7 to pay a demand for ransom in an attempt to regain access to information or an information system of such ,state or of a local1 ,tribal1 or territorial government in such ,state2 7,d7 for recreational or social purposes2 or 7,e7 for any purpose that does not directly address cybersecurity risks or cybersecurity threats on an information systems of such ,state or of a local1 ,tribal1 or territorial government in such ,state4 7#b7 ,penalties ,in addition to other remedies available1 the ,secretary may take such actions as are necessary to ensure that a recipient of a grant under this section is using such grant for the purposes for which such grant was awarded4 7i7 ,opportunity ,to amend applications ,in considering applications for grants under this section1 the ,secretary shall provide applicants with a reasonable opportunity to correct defects1 if any1 in such applications before making final awards4 7j7 ,apportionment ,for fiscal year #bjbj and each fiscal year thereafter1 the ,secretary shall apportion amounts appropriated to carry out this section among ,states as follows3 7#a7 ,baseline amount ,the ,secretary shall first apportion #j4be percent of such amounts to each of ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 and the ,virgin ,islands1 and #j4ge percent of such amounts to each of the remaining ,states4 7#b7 ,remainder ,the ,secretary shall apportion the remainder of such amounts in the ratio that-- 7,a7 the population of each ,state2 bears to 7,b7 the population of all ,states4 7k7 ,federal share ,the ,federal share of the cost of an activity carried out using funds made available under the program may not exceed the following percentages3 7#a7 ,for fiscal year #bjba1 #ij percent4 7#b7 ,for fiscal year #bjbb1 #hj percent4 7#c7 ,for fiscal year #bjbc1 #gj percent4 7#d7 ,for fiscal year #bjbd1 #fj percent4 7#e7 ,for fiscal year #bjbe and each subsequent fiscal year1 #ej percent4 7l7 ,state responsibilities 7#a7 ,certification ,each ,state that receives a grant under this section shall certify to the ,secretary that the grant will be used for the purpose for which the grant is awarded and in compliance with the ,cybersecurity ,plan or other purpose approved by the ,secretary under subsection 7g74 7#b7 ,availability of funds to local1 ,tribal1 and territorial governments ,not later than #de days after a ,state receives a grant under this section1 such ,state shall1 without imposing unreasonable or unduly burdensome requirements as a condition of receipt1 obligate or otherwise make available to local1 ,tribal1 and territorial governments in such ,state1 consistent with the applicable ,cybersecurity ,plan-- 7,a7 not less than #hj percent of funds available under such grant2 7,b7 with the consent of such local1 ,tribal1 and territorial governments1 items1 services1 capabilities1 or activities having a value of not less than #hj percent of the amount of the grant2 or 7,c7 with the consent of the local1 ,tribal1 and territorial governments1 grant funds combined with other items1 services1 capabilities1 or activities having the total value of not less than #hj percent of the amount of the grant4 7#c7 ,certifications regarding distribution of grant funds to local1 ,tribal1 territorial governments ,a ,state shall certify to the ,secretary that the ,state has made the distribution to local1 ,tribal1 and territorial governments required under paragraph 7#b74 7#d7 ,extension of period ,a ,state may request in writing that the ,secretary extend the period of time specified in paragraph 7#b7 for an additional period of time4 ,the ,secretary may approve such a request if the ,secretary determines such extension is necessary to ensure the obligation and expenditure of grant funds align with the purpose of the grant program4 7#e7 ,exception ,paragraph 7#b7 shall not apply to the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 or the ,virgin ,islands4 7#f7 ,direct funding ,if a ,state does not make the distribution to local1 ,tribal1 or territorial governments in such ,state required under paragraph 7#b71 such a local1 ,tribal1 or territorial government may petition the ,secretary4 7#g7 ,penalties ,in addition to other remedies available to the ,secretary1 the ,secretary may terminate or reduce the amount of a grant awarded under this section to a ,state or transfer grant funds previously awarded to such ,state directly to the appropriate local1 ,tribal1 or territorial government if such ,state violates a requirement of this subsection4 7m7 ,advisory committee 7#a7 ,establishment ,the ,director shall establish a ,state and ,local ,cybersecurity ,resiliency ,committee to provide ,state1 local1 ,tribal1 and territorial stakeholder expertise1 situational awareness1 and recommendations to the ,director1 as appropriate1 regarding how to-- 7,a7 address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 ,tribal1 or territorial governments2 and 7,b7 improve the ability of such governments to prevent1 protect against1 respond1 mitigate1 and recover from cybersecurity risks and cybersecurity threats4 7#b7 ,duties ,the ,state and ,local ,cybersecurity ,resiliency ,committee shall-- 7,a7 submit to the ,director recommendations that may inform guidance for applicants for grants under this section2 7,b7 upon the request of the ,director1 provide to the ,director technical assistance to inform the review of ,cybersecurity ,plans submitted by applicants for grants under this section1 and1 as appropriate1 submit to the ,director recommendations to improve such ,plans prior to the ,director's determination regarding whether to approve such ,plans2 7,c7 advise and provide to the ,director input regarding the ,homeland ,security ,strategy to ,improve ,cybersecurity for ,state1 ,local1 ,tribal1 and ,territorial ,governments required under section #bbaj2 and 7,d7 upon the request of the ,director1 provide to the ,director recommendations1 as appropriate1 regarding how to-- 7i7 address cybersecurity risks and cybersecurity threats on information systems of ,state1 local1 ,tribal1 or territorial governments2 and 7ii7 improve the cybersecurity resilience of such governments4 7#c7 ,membership 7,a7 ,number and appointment ,the ,state and ,local ,cybersecurity ,resiliency ,committee shall be composed of #ae members appointed by the ,director1 as follows3 7i7 ,two individuals recommended to the ,director by the ,national ,governors ,association4 7ii7 ,two individuals recommended to the ,director by the ,national ,association of ,state ,chief ,information ,officers4 7iii7 ,one individual recommended to the ,director by the ,national ,guard ,bureau4 7iv7 ,two individuals recommended to the ,director by the ,national ,association of ,counties4 7v7 ,two individuals recommended to the ,director by the ,national ,league of ,cities4 7vi7 ,one individual recommended to the ,director by the ,united ,states ,conference of ,mayors4 7vii7 ,one individual recommended to the ,director by the ,multi-,state ,information ,sharing and ,analysis ,center4 7viii7 ,four individuals who have educational and professional experience related to cybersecurity analysis or policy4 7,b7 ,terms ,each member of the ,state and ,local ,cybersecurity ,resiliency ,committee shall be appointed for a term of two years1 except that such term shall be three years only in the case of members who are appointed initially to the ,committee upon the establishment of the ,committee4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of such term4 ,a member may serve after the expiration of such member's term until a successor has taken office4 ,a vacancy in the ,commission shall be filled in the manner in which the original appointment was made4 7,c7 ,pay ,members of the ,state and ,local ,cybersecurity ,resiliency ,committee shall serve without pay4 7#d7 ,chairperson2 vice chairperson ,the members of the ,state and ,local ,cybersecurity ,resiliency ,committee shall select a chairperson and vice chairperson from among ,committee members4 7#e7 ,federal advisory committee act ,the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,state and ,local ,cybersecurity ,resilience ,committee4 7n7 ,reports 7#a7 ,annual reports by ,state grant recipients ,a ,state that receives a grant under this section shall annually submit to the ,secretary a report on the progress of the ,state in implementing the ,cybersecurity ,plan approved pursuant to subsection 7g74 ,if the ,state does not have a ,cybersecurity ,plan approved pursuant to subsection 7g71 the ,state shall submit to the ,secretary a report describing how grant funds were obligated and expended to develop a ,cybersecurity ,plan or improve the cybersecurity of information systems owned or operated by ,state1 local1 ,tribal1 or territorial governments in such ,state4 ,the ,secretary1 acting through the ,director1 shall make each such report publicly available1 including by making each such report available on the internet website of the ,agency1 subject to any redactions the ,director determines necessary to protect classified or other sensitive information4 7#b7 ,annual reports to ,congress ,at least once each year1 the ,secretary1 acting through the ,director1 shall submit to ,congress a report on the use of grants awarded under this section and any progress made toward the following3 7,a7 ,achieving the objectives set forth in the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments1 upon the strategy's issuance under section #bbaj4 7,b7 ,developing1 implementing1 or revising ,cybersecurity ,plans4 7,c7 ,reducing cybersecurity risks and cybersecurity threats to information systems owned or operated by ,state1 local1 ,tribal1 and territorial governments as a result of the award of such grants4 7o7 ,authorization of appropriations ,there are authorized to be appropriated for grants under this section-- 7#a7 for each of fiscal years #bjba through #bjbe1 #djj1jjj1jjj2 and 7#b7 for each subsequent fiscal year1 such sums as may be necessary4 7p7 ,definitions ,in this section3 7#a7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #b4 7#b7 ,cyber threat indicator ,the term cyber threat indicator has the meaning given such term in section #ajb of the ,cybersecurity ,act of #bjae4 7#c7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,incident ,the term incident has the meaning given such term in section #bbji4 7#e7 ,information sharing and analysis organization ,the term information sharing and analysis organization has the meaning given such term in section #bbbb4 7#f7 ,information system ,the term information system has the meaning given such term in section #ajb7i7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja7i774 7#g7 ,key resources ,the term key resources has the meaning given that term in section #b4 7#h7 ,online service ,the term online service means any internet-facing service1 including a website1 email1 virtual private network1 or custom application4 7#i7 ,state ,the term ,state-- 7,a7 means each of the several ,states1 the ,district of ,columbia1 and the territories and possessions of the ,united ,states2 and 7,b7 includes any federally recognized ,indian tribe that notifies the ,secretary1 not later than #abj days after the date of the enactment of this section or not later than #abj days before the start of any fiscal year in which a grant under this section is awarded1 that the tribe intends to develop a ,cybersecurity ,plan and agrees to forfeit any distribution under subsection 7l77#b74 #bbaf4 ,cybersecurity resource guide development for ,state1 local1 ,tribal1 and territorial government officials ,the ,secretary1 acting through the ,director1 shall develop a resource guide for use by ,state1 local1 ,tribal1 and territorial government officials1 including law enforcement officers1 to help such officials identify1 prepare for1 detect1 protect against1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents 7as such term is defined in section #bbji74 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb is amended by inserting after the item relating to section #bbad the following new items3 ,sec4 #bbae4 ,state and ,local ,cybersecurity ,grant ,program4 ,sec4 #bbaf4 ,cybersecurity resource guide development for ,state1 local1 ,tribal1 and territorial government officials4 4 #f4 ,strategy 7a7 ,homeland ,security ,strategy ,to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments ,section #bbaj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffj7 is amended by adding at the end the following new subsection3 7e7 ,homeland ,security ,strategy ,to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments 7#a7 ,in general ,not later than #bgj days after the date of the enactment of this subsection1 the ,secretary1 acting through the ,director1 shall1 in coordination with appropriate ,federal departments and agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee 7established under section #bbae71 and other stakeholders1 as appropriate1 develop and make publicly available a ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments that provides recommendations regarding how the ,federal ,government should support and promote the ability ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents 7as such term is defined in section #bbji7 and establishes baseline requirements and principles to which ,cybersecurity ,plans under such section shall be aligned4 7#b7 ,contents ,the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required under paragraph 7#a7 shall-- 7,a7 identify capability gaps in the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,b7 identify ,federal resources and capabilities that are available or could be made available to ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,c7 identify and assess the limitations of ,federal resources and capabilities available to ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents1 and make recommendations to address such limitations2 7,d7 identify opportunities to improve the ,agency's coordination with ,federal and non-,federal entities1 such as the ,multi-,state ,information ,sharing and ,analysis ,center1 to improve incident exercises1 information sharing and incident notification procedures1 the ability for ,state1 local1 ,tribal1 and territorial governments to voluntarily adapt and implement guidance in ,federal binding operational directives1 and opportunities to leverage ,federal schedules for cybersecurity investments under section #ejb of title #dj1 ,united ,states ,code2 7,e7 recommend new initiatives the ,federal ,government should undertake to improve the ability of ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 7,f7 set short-term and long-term goals that will improve the ability of ,state1 local1 ,tribal1 and territorial governments to help such governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents2 and 7,g7 set dates1 including interim benchmarks1 as appropriate for ,state1 local1 ,tribal1 territorial governments to establish baseline capabilities to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 and incidents4 7#c7 ,considerations ,in developing the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments required under paragraph 7#a71 the ,director1 in coordination with appropriate ,federal departments and agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee1 and other stakeholders1 as appropriate1 shall consider-- 7,a7 lessons learned from incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 and exercises with ,federal and non-,federal entities2 7,b7 the impact of incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 including the resulting costs to such governments2 7,c7 the information related to the interest and ability of state and non-state threat actors to compromise information systems owned or operated by ,state1 local1 ,tribal1 and territorial governments2 7,d7 emerging cybersecurity risks and cybersecurity threats to ,state1 local1 ,tribal1 and territorial governments resulting from the deployment of new technologies2 and 7,e7 recommendations made by the ,state and ,local ,cybersecurity ,resilience ,committee4 4 7b7 ,responsibilities of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency ,subsection 7c7 of section #bbjb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #feb7 is amended-- 7#a7 by redesignating paragraphs 7#f7 through 7#aa7 as paragraphs 7#aa7 through 7#af71 respectively2 and 7#b7 by inserting after paragraph 7#e7 the following new paragraphs3 7#f7 develop program guidance1 in consultation with the ,state and ,local ,government ,cybersecurity ,resiliency ,committee established under section #bbae1 for the ,state and ,local ,cybersecurity ,grant ,program under such section or any other homeland security assistance administered by the ,department to improve cybersecurity2 7#g7 review1 in consultation with the ,state and ,local ,cybersecurity ,resiliency ,committee1 all cybersecurity plans of ,state1 local1 ,tribal1 and territorial governments developed pursuant to any homeland security assistance administered by the ,department to improve cybersecurity2 7#h7 provide expertise and technical assistance to ,state1 local1 ,tribal1 and territorial government officials with respect to cybersecurity2 7#i7 provide education1 training1 and capacity development to enhance the security and resilience of cybersecurity and infrastructure security2 7#aj7 provide information to ,state1 local1 ,tribal1 and territorial governments on the security benefits of 4gov domain name registration services2 4 7c7 ,feasibility study ,not later than #ahj days after the date of the enactment of this ,act1 the ,director shall conduct a study to assess the feasibility of implementing a short-term rotational program for the detail of approved ,state1 local1 ,tribal1 and territorial government employees in cyber workforce positions to the ,agency4