,,ib ,union ,calendar ,no4 #ca #aagth ,,congress #ast ,session ,h4 ,r4 #cach ,report ,no4 #aag-dh ,,in ,,the ,,house ,,of ,,representatives ,may #ab1 #bjba,ms4 ,clarke of ,new ,york 7for herself1 ,mr4 ,garbarino1 ,mr4 ,kilmer1 ,mr4 ,katko1 ,mr4 ,ruppersberger1 ,mr4 ,mc,caul1 and ,mr4 ,thompson of ,mississippi7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,june #a1 #bjba;,additional sponsor3 ,ms4 ,slotkin ,june #a1 #bjba,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed,strike out all after the enacting clause and insert the part printed in italic,for text of introduced bill1 see copy of bill as introduced on ,may #ab1 #bjba ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to authorize a grant program relating to the cybersecurity of ,state and local governments1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,state and ,local ,cybersecurity ,improvement ,act4 #b4 ,state and local cybersecurity grant program 7a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following new sections3 #bbbj;,a4 ,state and local cybersecurity grant program 7a7 ,definitions ,in this section3 7#a7 ,cyber threat indicator ,the term cyber threat indicator has the meaning given the term in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#b7 ,cybersecurity ,plan ,the term ,cybersecurity ,plan means a plan submitted by an eligible entity under subsection 7e77#a74 7#c7 ,eligible entity ,the term eligible entity means-- 7,a7 a ,state2 or 7,b7 an ,indian tribe that1 not later than #abj days after the date of the enactment of this section or not later than #abj days before the start of any fiscal year in which a grant under this section is awarded-- 7i7 notifies the ,secretary that the ,indian tribe intends to develop a ,cybersecurity ,plan2 and 7ii7 agrees to forfeit any distribution under subsection 7n77#b74 7#d7 ,incident ,the term incident has the meaning given the term in section #bbji4 7#e7 ,indian tribe2 ,tribal organization ,the term ,indian tribe or ,tribal organization has the meaning given that term in section #d7;e7 of the of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #ecjd7;e774 7#f7 ,information sharing and analysis organization ,the term information sharing and analysis organization has the meaning given the term in section #bbbb4 7#g7 ,information system ,the term information system has the meaning given the term in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#h7 ,online service ,the term online service means any internet-facing service1 including a website1 email1 virtual private network1 or custom application4 7#i7 ,ransomware incident ,the term ransomware incident means an incident that actually or imminently jeopardizes1 without lawful authority1 the integrity1 confidentiality1 or availability of information on an information system1 or actually or imminently jeopardizes1 without lawful authority1 an information system for the purpose of coercing the information system's owner1 operator1 or another person4 7#aj7 ,state and ,local ,cybersecurity ,grant ,program ,the term ,state and ,local ,cybersecurity ,grant ,program means the program established under subsection 7b74 7#aa7 ,state and ,local ,cybersecurity ,resilience ,committee ,the term ,state and ,local ,cybersecurity ,resilience ,committee means the committee established under subsection 7o77#a74 7b7 ,establishment 7#a7 ,in general ,the ,secretary1 acting through the ,director1 shall establish a program1 to be known as the the ,state and ,local ,cybersecurity ,grant ,program1 to award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 or ,tribal organizations4 7#b7 ,application ,an eligible entity seeking a grant under the ,state and ,local ,cybersecurity ,grant ,program shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require4 7c7 ,baseline requirements ,an eligible entity or multistate group that receives a grant under this section shall use the grant in compliance with-- 7#a7 7,a7 the ,cybersecurity ,plan of the eligible entity or the ,cybersecurity ,plans of the eligible entities that comprise the multistate group2 and 7,b7 the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments developed under section #bbaj7;e77#a72 or 7#b7 activities carried out under paragraphs 7#c71 7#d71 and 7#e7 of subsection 7h74 7d7 ,administration ,the ,state and ,local ,cybersecurity ,grant ,program shall be administered in the same office of the ,department that administers grants made under sections #bjjc and #bjjd4 7e7 ,cybersecurity plans 7#a7 ,in general ,an eligible entity applying for a grant under this section shall submit to the ,secretary a ,cybersecurity ,plan for approval4 7#b7 ,required elements ,a ,cybersecurity ,plan of an eligible entity shall-- 7,a7 incorporate1 to the extent practicable1 any existing plans of the eligible entity to protect against cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 or ,tribal organizations2 7,b7 describe1 to the extent practicable1 how the eligible entity will-- 7i7 manage1 monitor1 and track information systems1 applications1 and user accounts owned or operated by or on behalf of the eligible entity or by local or ,tribal organizations within the jurisdiction of the eligible entity and the information technology deployed on those information systems1 including legacy information systems and information technology that are no longer supported by the manufacturer of the systems or technology2 7ii7 monitor1 audit1 and track activity between information systems1 applications1 and user accounts owned or operated by or on behalf of the eligible entity or by local or ,tribal organizations within the jurisdiction of the eligible entity and between those information systems and information systems not owned or operated by the eligible entity or by local or ,tribal organizations within the jurisdiction of the eligible entity2 7iii7 enhance the preparation1 response1 and resilience of information systems1 applications1 and user accounts owned or operated by or on behalf of the eligible entity or local or ,tribal organizations against cybersecurity risks and cybersecurity threats2 7iv7 implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address cybersecurity risks and cybersecurity threats on information systems of the eligible entity or local or ,tribal organizations2 7v7 ensure that ,state1 local1 and ,tribal organizations that own or operate information systems that are located within the jurisdiction of the eligible entity-- 7,i7 adopt best practices and methodologies to enhance cybersecurity1 such as the practices set forth in the cybersecurity framework developed by1 and the cyber supply chain risk management best practices identified by1 the ,national ,institute of ,standards and ,technology2 and 7,,ii7 utilize knowledge bases of adversary tools and tactics to assess risk2 7vi7 promote the delivery of safe1 recognizable1 and trustworthy online services by ,state1 local1 and ,tribal organizations1 including through the use of the 4gov internet domain2 7vii7 ensure continuity of operations of the eligible entity and local1 and ,tribal organizations in the event of a cybersecurity incident 7including a ransomware incident71 including by conducting exercises to practice responding to such an incident2 7viii7 use the ,national ,initiative for ,cybersecurity ,education ,cybersecurity ,workforce ,framework developed by the ,national ,institute of ,standards and ,technology to identify and mitigate any gaps in the cybersecurity workforces of ,state1 local1 or ,tribal organizations1 enhance recruitment and retention efforts for such workforces1 and bolster the knowledge1 skills1 and abilities of ,state1 local1 and ,tribal organization personnel to address cybersecurity risks and cybersecurity threats1 such as through cybersecurity hygiene training2 7ix7 ensure continuity of communications and data networks within the jurisdiction of the eligible entity between the eligible entity and local and ,tribal organizations that own or operate information systems within the jurisdiction of the eligible entity in the event of an incident involving such communications or data networks within the jurisdiction of the eligible entity2 7x7 assess and mitigate1 to the greatest degree possible1 cybersecurity risks and cybersecurity threats related to critical infrastructure and key resources1 the degradation of which may impact the performance of information systems within the jurisdiction of the eligible entity2 7xi7 enhance capabilities to share cyber threat indicators and related information between the eligible entity and local and ,tribal organizations that own or operate information systems within the jurisdiction of the eligible entity1 including by expanding existing information sharing agreements with the ,department2 7xii7 enhance the capability of the eligible entity to share cyber threat indictors and related information with the ,department2 7xiii7 leverage cybersecurity services offered by the ,department2 7xiv7 develop and coordinate strategies to address cybersecurity risks and cybersecurity threats to information systems of the eligible entity in consultation with-- 7,i7 local and ,tribal organizations within the jurisdiction of the eligible entity2 and 7,,ii7 as applicable-- 7aa7 ,states that neighbor the jurisdiction of the eligible entity or1 as appropriate1 members of an information sharing and analysis organization2 and 7bb7 countries that neighbor the jurisdiction of the eligible entity2 and 7xv7 implement an information technology and operational technology modernization cybersecurity review process that ensures alignment between information technology and operational technology cybersecurity objectives2 7,c7 describe1 to the extent practicable1 the individual responsibilities of the eligible entity and local and ,tribal organizations within the jurisdiction of the eligible entity in implementing the plan2 7,d7 outline1 to the extent practicable1 the necessary resources and a timeline for implementing the plan2 and 7,e7 describe how the eligible entity will measure progress towards implementing the plan4 7#c7 ,discretionary elements ,a ,cybersecurity ,plan of an eligible entity may include a description of-- 7,a7 cooperative programs developed by groups of local and ,tribal organizations within the jurisdiction of the eligible entity to address cybersecurity risks and cybersecurity threats2 and 7,b7 programs provided by the eligible entity to support local and ,tribal organizations and owners and operators of critical infrastructure to address cybersecurity risks and cybersecurity threats4 7#d7 ,management of funds ,an eligible entity applying for a grant under this section shall agree to designate the ,chief ,information ,officer1 the ,chief ,information ,security ,officer1 or an equivalent official of the eligible entity as the primary official for the management and allocation of funds awarded under this section4 7f7 ,multistate grants 7#a7 ,in general ,the ,secretary1 acting through the ,director1 may award grants under this section to a group of two or more eligible entities to support multistate efforts to address cybersecurity risks and cybersecurity threats to information systems within the jurisdictions of the eligible entities4 7#b7 ,satisfaction of other requirements ,in order to be eligible for a multistate grant under this subsection1 each eligible entity that comprises a multistate group shall submit to the ,secretary-- 7,a7 a ,cybersecurity ,plan for approval in accordance with subsection 7i72 and 7,b7 a plan for establishing a cybersecurity planning committee under subsection 7g74 7#c7 ,application 7,a7 ,in general ,a multistate group applying for a multistate grant under paragraph 7#a7 shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require4 7,b7 ,multistate project description ,an application of a multistate group under subparagraph 7,a7 shall include a plan describing-- 7i7 the division of responsibilities among the eligible entities that comprise the multistate group for administering the grant for which application is being made2 7ii7 the distribution of funding from such a grant among the eligible entities that comprise the multistate group2 and 7iii7 how the eligible entities that comprise the multistate group will work together to implement the ,cybersecurity ,plan of each of those eligible entities4 7g7 ,planning committees 7#a7 ,in general ,an eligible entity that receives a grant under this section shall establish a cybersecurity planning committee to-- 7,a7 assist in the development1 implementation1 and revision of the ,cybersecurity ,plan of the eligible entity2 7,b7 approve the ,cybersecurity ,plan of the eligible entity2 and 7,c7 assist in the determination of effective funding priorities for a grant under this section in accordance with subsection 7h74 7#b7 ,composition ,a committee of an eligible entity established under paragraph 7#a7 shall-- 7,a7 be comprised of representatives from the eligible entity and counties1 cities1 towns1 ,tribes1 and public educational and health institutions within the jurisdiction of the eligible entity2 and 7,b7 include1 as appropriate1 representatives of rural1 suburban1 and high-population jurisdictions4 7#c7 ,cybersecurity expertise ,not less than #a_/b of the representatives of a committee established under paragraph 7#a7 shall have professional experience relating to cybersecurity or information technology4 7#d7 ,rule of construction regarding existing planning committees ,nothing in this subsection may be construed to require an eligible entity to establish a cybersecurity planning committee if the eligible entity has established and uses a multijurisdictional planning committee or commission that meets1 or may be leveraged to meet1 the requirements of this subsection4 7h7 ,use of funds ,an eligible entity that receives a grant under this section shall use the grant to-- 7#a7 implement the ,cybersecurity ,plan of the eligible entity2 7#b7 develop or revise the ,cybersecurity ,plan of the eligible entity2 or 7#c7 assist with activities that address imminent cybersecurity risks or cybersecurity threats to the information systems of the eligible entity or a local or ,tribal organization within the jurisdiction of the eligible entity4 7i7 ,approval of plans 7#a7 ,approval as condition of grant ,before an eligible entity may receive a grant under this section1 the ,secretary1 acting through the ,director1 shall review the ,cybersecurity ,plan1 or any revisions thereto1 of the eligible entity and approve such plan1 or revised plan1 if it satisfies the requirements specified in paragraph 7#b74 7#b7 ,plan requirements ,in approving a ,cybersecurity ,plan of an eligible entity under this subsection1 the ,director shall ensure that the ,cybersecurity ,plan-- 7,a7 satisfies the requirements of subsection 7e77#b72 7,b7 upon the issuance of the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments authorized pursuant to section #bbaj7;e71 complies1 as appropriate1 with the goals and objectives of the strategy2 and 7,c7 has been approved by the cybersecurity planning committee of the eligible entity established under subsection 7g74 7#c7 ,approval of revisions ,the ,secretary1 acting through the ,director1 may approve revisions to a ,cybersecurity ,plan as the ,director determines appropriate4 7#d7 ,exception ,notwithstanding subsection 7e7 and paragraph 7#a7 of this subsection1 the ,secretary may award a grant under this section to an eligible entity that does not submit a ,cybersecurity ,plan to the ,secretary if-- 7,a7 the eligible entity certifies to the ,secretary that-- 7i7 the activities that will be supported by the grant are integral to the development of the ,cybersecurity ,plan of the eligible entity2 and 7ii7 the eligible entity will submit by ,september #cj1 #bjbc1 to the ,secretary a ,cybersecurity ,plan for review1 and if appropriate1 approval2 or 7,b7 the eligible entity certifies to the ,secretary1 and the ,director confirms1 that the eligible entity will use funds from the grant to assist with the activities described in subsection 7h77#c74 7j7 ,limitations on uses of funds 7#a7 ,in general ,an eligible entity that receives a grant under this section may not use the grant-- 7,a7 to supplant ,state1 local1 or ,tribal funds2 7,b7 for any recipient cost-sharing contribution2 7,c7 to pay a demand for ransom in an attempt to-- 7i7 regain access to information or an information system of the eligible entity or of a local or ,tribal organization within the jurisdiction of the eligible entity2 or 7ii7 prevent the disclosure of information that has been removed without authorization from an information system of the eligible entity or of a local or ,tribal organization within the jurisdiction of the eligible entity2 7,d7 for recreational or social purposes2 or 7,e7 for any purpose that does not address cybersecurity risks or cybersecurity threats on information systems of the eligible entity or of a local or ,tribal organization within the jurisdiction of the eligible entity4 7#b7 ,penalties ,in addition to any other remedy available1 the ,secretary may take such actions as are necessary to ensure that a recipient of a grant under this section uses the grant for the purposes for which the grant is awarded4 7#c7 ,rule of construction ,nothing in paragraph 7#a7 may be construed to prohibit the use of grant funds provided to a ,state1 local1 or ,tribal organization for otherwise permissible uses under this section on the basis that a ,state1 local1 or ,tribal organization has previously used ,state1 local1 or ,tribal funds to support the same or similar uses4 7k7 ,opportunity to amend applications ,in considering applications for grants under this section1 the ,secretary shall provide applicants with a reasonable opportunity to correct defects1 if any1 in such applications before making final awards4 7l7 ,apportionment ,for fiscal year #bjbb and each fiscal year thereafter1 the ,secretary shall apportion amounts appropriated to carry out this section among ,states as follows3 7#a7 ,baseline amount ,the ,secretary shall first apportion #j4be percent of such amounts to each of ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 the ,u4,s4 ,virgin ,islands1 and #j4ge percent of such amounts to each of the remaining ,states4 7#b7 ,remainder ,the ,secretary shall apportion the remainder of such amounts in the ratio that-- 7,a7 the population of each eligible entity1 bears to 7,b7 the population of all eligible entities4 7#c7 ,minimum allocation to ,indian tribes 7,a7 ,in general ,in apportioning amounts under this section1 the ,secretary shall ensure that1 for each fiscal year1 directly eligible ,tribes collectively receive1 from amounts appropriated under the ,state and ,local ,cybersecurity ,grant ,program1 not less than an amount equal to three percent of the total amount appropriated for grants under this section4 7,b7 ,allocation ,of the amount reserved under subparagraph 7,a71 funds shall be allocated in a manner determined by the ,secretary in consultation with ,indian tribes4 7,c7 ,exception ,this paragraph shall not apply in any fiscal year in which the ,secretary-- 7i7 receives fewer than five applications from ,indian tribes2 or 7ii7 does not approve at least two application from ,indian tribes4 7m7 ,federal share 7#a7 ,in general ,the ,federal share of the cost of an activity carried out using funds made available with a grant under this section may not exceed-- 7,a7 in the case of a grant to an eligible entity-- 7i7 for fiscal year #bjbb1 #ij percent2 7ii7 for fiscal year #bjbc1 #hj percent2 7iii7 for fiscal year #bjbd1 #gj percent2 7iv7 for fiscal year #bjbe1 #fj percent2 and 7v7 for fiscal year #bjbf and each subsequent fiscal year1 #ej percent2 and 7,b7 in the case of a grant to a multistate group-- 7i7 for fiscal year #bjbb1 #ie percent2 7ii7 for fiscal year #bjbc1 #he percent2 7iii7 for fiscal year #bjbd1 #ge percent2 7iv7 for fiscal year #bjbe1 #fe percent2 and 7v7 for fiscal year #bjbf and each subsequent fiscal year1 #ee percent4 7#b7 ,waiver ,the ,secretary may waive or modify the requirements of paragraph 7#a7 for an ,indian tribe if the ,secretary determines such a waiver is in the public interest4 7n7 ,responsibilities of grantees 7#a7 ,certification ,each eligible entity or multistate group that receives a grant under this section shall certify to the ,secretary that the grant will be used-- 7,a7 for the purpose for which the grant is awarded2 and 7,b7 in compliance with1 as the case may be-- 7i7 the ,cybersecurity ,plan of the eligible entity2 7ii7 the ,cybersecurity ,plans of the eligible entities that comprise the multistate group2 or 7iii7 a purpose approved by the ,secretary under subsection 7h7 or pursuant to an exception under subsection 7i74 7#b7 ,availability of funds to local and ,tribal organizations ,not later than #de days after the date on which an eligible entity or multistate group receives a grant under this section1 the eligible entity or multistate group shall1 without imposing unreasonable or unduly burdensome requirements as a condition of receipt1 obligate or otherwise make available to local and ,tribal organizations within the jurisdiction of the eligible entity or the eligible entities that comprise the multistate group1 and as applicable1 consistent with the ,cybersecurity ,plan of the eligible entity or the ,cybersecurity ,plans of the eligible entities that comprise the multistate group-- 7,a7 not less than #hj percent of funds available under the grant2 7,b7 with the consent of the local and ,tribal organizations1 items1 services1 capabilities1 or activities having a value of not less than #hj percent of the amount of the grant2 or 7,c7 with the consent of the local and ,tribal organizations1 grant funds combined with other items1 services1 capabilities1 or activities having the total value of not less than #hj percent of the amount of the grant4 7#c7 ,certifications regarding distribution of grant funds to local and ,tribal organizations ,an eligible entity or multistate group shall certify to the ,secretary that the eligible entity or multistate group has made the distribution to local1 ,tribal1 and territorial governments required under paragraph 7#b74 7#d7 ,extension of period 7,a7 ,in general ,an eligible entity or multistate group may request in writing that the ,secretary extend the period of time specified in paragraph 7#b7 for an additional period of time4 7,b7 ,approval ,the ,secretary may approve a request for an extension under subparagraph 7,a7 if the ,secretary determines the extension is necessary to ensure that the obligation and expenditure of grant funds align with the purpose of the ,state and ,local ,cybersecurity ,grant ,program4 7#e7 ,exception ,paragraph 7#b7 shall not apply to the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 the ,virgin ,islands1 or an ,indian tribe4 7#f7 ,direct funding ,if an eligible entity does not make a distribution to a local or ,tribal organization required in accordance with paragraph 7#b71 the local or ,tribal organization may petition the ,secretary to request that grant funds be provided directly to the local or ,tribal organization4 7#g7 ,penalties ,in addition to other remedies available to the ,secretary1 the ,secretary may terminate or reduce the amount of a grant awarded under this section to an eligible entity or distribute grant funds previously awarded to such eligible entity directly to the appropriate local or ,tribal organization as a replacement grant in an amount the ,secretary determines appropriate if such eligible entity violates a requirement of this subsection4 7o7 ,advisory committee 7#a7 ,establishment ,not later than #abj days after the date of enactment of this section1 the ,director shall establish a ,state and ,local ,cybersecurity ,resilience ,committee to provide ,state1 local1 and ,tribal stakeholder expertise1 situational awareness1 and recommendations to the ,director1 as appropriate1 regarding how to-- 7,a7 address cybersecurity risks and cybersecurity threats to information systems of ,state1 local1 or ,tribal organizations2 and 7,b7 improve the ability of ,state1 local1 and ,tribal organizations to prevent1 protect against1 respond to1 mitigate1 and recover from such cybersecurity risks and cybersecurity threats4 7#b7 ,duties ,the committee established under paragraph 7#a7 shall-- 7,a7 submit to the ,director recommendations that may inform guidance for applicants for grants under this section2 7,b7 upon the request of the ,director1 provide to the ,director technical assistance to inform the review of ,cybersecurity ,plans submitted by applicants for grants under this section1 and1 as appropriate1 submit to the ,director recommendations to improve those plans prior to the approval of the plans under subsection 7i72 7,c7 advise and provide to the ,director input regarding the ,homeland ,security ,strategy to ,improve ,cybersecurity for ,state1 ,local1 ,tribal1 and ,territorial ,governments required under section #bbaj2 7,d7 upon the request of the ,director1 provide to the ,director recommendations1 as appropriate1 regarding how to-- 7i7 address cybersecurity risks and cybersecurity threats on information systems of ,state1 local1 or ,tribal organizations2 and 7ii7 improve the cybersecurity resilience of ,state1 local1 or ,tribal organizations2 and 7,e7 regularly coordinate with the ,state1 ,local1 ,tribal and ,territorial ,government ,coordinating ,council1 within the ,critical ,infrastructure ,partnership ,advisory ,council1 established under section #hga4 7#c7 ,membership 7,a7 ,number and appointment ,the ,state and ,local ,cybersecurity ,resilience ,committee established pursuant to paragraph 7#a7 shall be composed of #ae members appointed by the ,director1 as follows3 7i7 ,two individuals recommended to the ,director by the ,national ,governors ,association4 7ii7 ,two individuals recommended to the ,director by the ,national ,association of ,state ,chief ,information ,officers4 7iii7 ,one individual recommended to the ,director by the ,national ,guard ,bureau4 7iv7 ,two individuals recommended to the ,director by the ,national ,association of ,counties4 7v7 ,one individual recommended to the ,director by the ,national ,league of ,cities4 7vi7 ,one individual recommended to the ,director by the ,united ,states ,conference of ,mayors4 7vii7 ,one individual recommended to the ,director by the ,multi-,state ,information ,sharing and ,analysis ,center4 7viii7 ,one individual recommended to the ,director by the ,national ,congress of ,american ,indians4 7viii7 ,four individuals who have educational and professional experience relating to cybersecurity work or cybersecurity policy4 7,b7 ,terms 7i7 ,in general ,subject to clause 7ii71 each member of the ,state and ,local ,cybersecurity ,resilience ,committee shall be appointed for a term of two years4 7ii7 ,requirement ,at least two members of the ,state and ,local ,cybersecurity ,resilience ,committee shall also be members of the ,state1 ,local1 ,tribal and ,territorial ,government ,coordinating ,council1 within the ,critical ,infrastructure ,partnership ,advisory ,council1 established under section #hga4 7iii7 ,exception ,a term of a member of the ,state and ,local ,cybersecurity ,resilience ,committee shall be three years if the member is appointed initially to the ,committee upon the establishment of the ,committee4 7iv7 ,term remainders ,any member of the ,state and ,local ,cybersecurity ,resilience ,committee appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of such term4 ,a member may serve after the expiration of such member's term until a successor has taken office4 7v7 ,vacancies ,a vacancy in the ,state and ,local ,cybersecurity ,resilience ,committee shall be filled in the manner in which the original appointment was made4 7,c7 ,pay ,members of the ,state and ,local ,cybersecurity ,resilience ,committee shall serve without pay4 7#d7 ,chairperson2 vice chairperson ,the members of the ,state and ,local ,cybersecurity ,resilience ,committee shall select a chairperson and vice chairperson from among members of the committee4 7#e7 ,permanent authority ,notwithstanding section #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app471 the ,state and ,local ,cybersecurity ,resilience ,committee shall be a permanent authority4 7p7 ,reports 7#a7 ,annual reports by grant recipients 7,a7 ,in general ,not later than one year after an eligible entity or multistate group receives funds under this section1 the eligible entity or multistate group shall submit to the ,secretary a report on the progress of the eligible entity or multistate group in implementing the ,cybersecurity ,plan of the eligible entity or ,cybersecurity ,plans of the eligible entities that comprise the multistate group1 as the case may be4 7,b7 ,absence of plan ,not later than #ahj days after an eligible entity that does not have a ,cybersecurity ,plan receives funds under this section for developing its ,cybersecurity ,plan1 the eligible entity shall submit to the ,secretary a report describing how the eligible entity obligated and expended grant funds during the fiscal year to-- 7i7 so develop such a ,cybersecurity ,plan2 or 7ii7 assist with the activities described in subsection 7h77#c74 7#b7 ,annual reports to ,congress ,not less frequently than once per year1 the ,secretary1 acting through the ,director1 shall submit to ,congress a report on the use of grants awarded under this section and any progress made toward the following3 7,a7 ,achieving the objectives set forth in the ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments1 upon the date on which the strategy is issued under section #bbaj4 7,b7 ,developing1 implementing1 or revising ,cybersecurity ,plans4 7,c7 ,reducing cybersecurity risks and cybersecurity threats to information systems1 applications1 and user accounts owned or operated by or on behalf of ,state1 local1 and ,tribal organizations as a result of the award of such grants4 7q7 ,authorization of appropriations ,there are authorized to be appropriated for grants under this section-- 7#a7 for each of fiscal years #bjbb through #bjbf1 #ejj1jjj1jjj2 and 7#b7 for each subsequent fiscal year1 such sums as may be necessary4 #bbbj;,b4 ,cybersecurity resource guide development for state1 local1 tribal1 and territorial government officials ,the ,secretary1 acting through the ,director1 shall develop1 regularly update1 and maintain a resource guide for use by ,state1 local1 ,tribal1 and territorial government officials1 including law enforcement officers1 to help such officials identify1 prepare for1 detect1 protect against1 respond to1 and recover from cybersecurity risks 7as such term is defined in section #bbji71 cybersecurity threats1 and incidents 7as such term is defined in section #bbji74 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb1 as amended by section #d1 is further amended by inserting after the item relating to section #bbbj the following new items3 ,sec4 #bbbj;,a4 ,state and ,local ,cybersecurity ,grant ,program4 ,sec4 #bbbj;,b4 ,cybersecurity resource guide development for ,state1 local1 ,tribal1 and territorial government officials4 4 #c4 ,strategy 7a7 ,homeland security strategy to improve the cybersecurity of state1 local1 tribal1 and territorial governments ,section #bbaj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffj7 is amended by adding at the end the following new subsection3 7e7 ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments 7#a7 ,in general 7,a7 ,requirement ,not later than one year after the date of the enactment of this subsection1 the ,secretary1 acting through the ,director1 shall1 in coordination with the heads of appropriate ,federal agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee established under section #bbbj;,a1 and other stakeholders1 as appropriate1 develop and make publicly available a ,homeland ,security ,strategy to ,improve the ,cybersecurity of ,state1 ,local1 ,tribal1 and ,territorial ,governments4 7,b7 ,recommendations and requirements ,the strategy required under subparagraph 7,a7 shall-- 7i7 provide recommendations relating to the ways in which the ,federal ,government should support and promote the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 mitigate against1 protect against1 detect1 respond to1 and recover from cybersecurity risks 7as such term is defined in section #bbji71 cybersecurity threats1 and incidents 7as such term is defined in section #bbji72 and 7ii7 establish baseline requirements for cybersecurity plans under this section and principles with which such plans shall align4 7#b7 ,contents ,the strategy required under paragraph 7#a7 shall-- 7,a7 identify capability gaps in the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents2 7,b7 identify ,federal resources and capabilities that are available or could be made available to ,state1 local1 ,tribal1 and territorial governments to help those governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents2 7,c7 identify and assess the limitations of ,federal resources and capabilities available to ,state1 local1 ,tribal1 and territorial governments to help those governments identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents and make recommendations to address such limitations2 7,d7 identify opportunities to improve the coordination of the ,agency with ,federal and non-,federal entities1 such as the ,multi-,state ,information ,sharing and ,analysis ,center1 to improve-- 7i7 incident exercises1 information sharing and incident notification procedures2 7ii7 the ability for ,state1 local1 ,tribal1 and territorial governments to voluntarily adapt and implement guidance in ,federal binding operational directives2 and 7iii7 opportunities to leverage ,federal schedules for cybersecurity investments under section #ejb of title #dj1 ,united ,states ,code2 7,e7 recommend new initiatives the ,federal ,government should undertake to improve the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents2 7,f7 set short-term and long-term goals that will improve the ability of ,state1 local1 ,tribal1 and territorial governments to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents2 and 7,g7 set dates1 including interim benchmarks1 as appropriate for ,state1 local1 ,tribal1 and territorial governments to establish baseline capabilities to identify1 protect against1 detect1 respond to1 and recover from cybersecurity risks1 cybersecurity threats1 incidents1 and ransomware incidents4 7#c7 ,considerations ,in developing the strategy required under paragraph 7#a71 the ,director1 in coordination with the heads of appropriate ,federal agencies1 ,state1 local1 ,tribal1 and territorial governments1 the ,state and ,local ,cybersecurity ,resilience ,committee established under section #bbbj;,a1 and other stakeholders1 as appropriate1 shall consider-- 7,a7 lessons learned from incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 and exercises with ,federal and non-,federal entities2 7,b7 the impact of incidents that have affected ,state1 local1 ,tribal1 and territorial governments1 including the resulting costs to such governments2 7,c7 the information related to the interest and ability of state and non-state threat actors to compromise information systems 7as such term is defined in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja77 owned or operated by ,state1 local1 ,tribal1 and territorial governments2 7,d7 emerging cybersecurity risks and cybersecurity threats to ,state1 local1 ,tribal1 and territorial governments resulting from the deployment of new technologies2 and 7,e7 recommendations made by the ,state and ,local ,cybersecurity ,resilience ,committee established under section #bbbj;,a4 7#d7 ,exemption ,chapter #ce of title #dd1 ,united ,states ,code 7commonly known as the ,paperwork ,reduction ,act71 shall not apply to any action to implement this subsection4 4 7b7 ,responsibilities of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency ,section #bbjb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #feb7 is amended-- 7#a7 by redesignating subsections 7d7 through 7i7 as subsections 7e7 through 7j71 respectively2 and 7#b7 by inserting after subsection 7c7 the following new subsection3 7d7 ,additional responsibilities ,in addition to the responsibilities under subsection 7c71 the ,director shall-- 7#a7 develop program guidance1 in consultation with the ,state and ,local ,government ,cybersecurity ,resilience ,committee established under section #bbbj;,a1 for the ,state and ,local ,cybersecurity ,grant ,program under such section or any other homeland security assistance administered by the ,department to improve cybersecurity2 7#b7 review1 in consultation with the ,state and ,local ,cybersecurity ,resilience ,committee1 all cybersecurity plans of ,state1 local1 ,tribal1 and territorial governments developed pursuant to any homeland security assistance administered by the ,department to improve cybersecurity2 7#c7 provide expertise and technical assistance to ,state1 local1 ,tribal1 and territorial government officials with respect to cybersecurity2 and 7#d7 provide education1 training1 and capacity development to enhance the security and resilience of cybersecurity and infrastructure security4 4 7c7 ,feasibility study ,not later than #bgj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security of the ,department of ,homeland ,security shall conduct a study to assess the feasibility of implementing a short-term rotational program for the detail to the ,agency of approved ,state1 local1 ,tribal1 and territorial government employees in cyber workforce positions4 #d4 ,title ,,xxii technical and clerical amendments 7a7 ,technical amendments 7#a7 ,homeland ,security ,act of #bjjb ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7,a7 in the first section #bbae 7#f ,u4,s4,c4 #ffe2 relating to the duties and authorities relating to 4gov internet domain71 by amending the section enumerator and heading to read as follows3 #bbae4 ,duties and authorities relating to 4gov internet domain 2 7,b7 in the second section #bbae 7#f ,u4,s4,c4 #ffe;b2 relating to the joint cyber planning office71 by amending the section enumerator and heading to read as follows3 #bbaf4 ,joint cyber planning office 2 7,c7 in the third section #bbae 7#f ,u4,s4,c4 #ffe;c2 relating to the ,cybersecurity ,state ,coordinator71 by amending the section enumerator and heading to read as follows3 #bbag4 ,cybersecurity ,state ,coordinator 2 7,d7 in the fourth section #bbae 7#f ,u4,s4,c4 #ffe;d2 relating to ,sector ,risk ,management ,agencies71 by amending the section enumerator and heading to read as follows3 #bbah4 ,sector ,risk ,management ,agencies 2 7,e7 in section #bbaf 7#f ,u4,s4,c4 #ffe;e2 relating to the ,cybersecurity ,advisory ,committee71 by amending the section enumerator and heading to read as follows3 #bbai4 ,cybersecurity ,advisory ,committee 2 and 7,f7 in section #bbag 7#f ,u4,s4,c4 #ffe;f2 relating to ,cybersecurity ,education and ,training ,programs71 by amending the section enumerator and heading to read as follows3 #bbbj4 ,cybersecurity ,education and ,training ,programs 4 7#b7 ,consolidated ,appropriations ,act1 #bjba ,paragraph 7#a7 of section #ijd7;b7 of division ,u of the ,consolidated ,appropriations ,act1 #bjba 7,public ,law #aaf-bfj7 is amended1 in the matter preceding subparagraph 7,a71 by inserting of #bjjb after ,homeland ,security ,act4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb is amended by striking the items relating to sections #bbad through #bbag and inserting the following new items3 ,sec4 #bbad4 ,national ,asset ,database4 ,sec4 #bbae4 ,duties and authorities relating to 4gov internet domain4 ,sec4 #bbaf4 ,joint cyber planning office4 ,sec4 #bbag4 ,cybersecurity ,state ,coordinator4 ,sec4 #bbah4 ,sector ,risk ,management ,agencies4 ,sec4 #bbai4 ,cybersecurity ,advisory ,committee4 ,sec4 #bbbj4 ,cybersecurity ,education and ,training ,programs4 4 ,june #a1 #bjba,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed