,,ii #aagth ,,congress #ast ,session ,s4 #behe ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #c1 #bjba,ms4 ,hassan 7for herself1 ,mr4 ,cornyn1 ,ms4 ,sinema1 and ,mr4 ,tillis7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to authorize a grant program relating to the cybersecurity of ,state1 local1 ,tribal1 and territorial governments1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,state and ,local ,cybersecurity ,improvement ,act4 #b4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 #bbah4 ,state and ,local ,cybersecurity ,grant ,program 7a7 ,definitions ,in this section3 7#a7 ,appropriate committees of ,congress ,the term appropriate committees of ,congress means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#b7 ,cyber threat indicator ,the term cyber threat indicator has the meaning given the term in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#c7 ,cybersecurity ,plan ,the term ,cybersecurity ,plan means a plan submitted by an eligible entity under subsection 7e77#a74 7#d7 ,eligible entity ,the term eligible entity means a-- 7,a7 ,state2 or 7,b7 ,tribal government4 7#e7 ,incident ,the term incident has the meaning given the term in section #bbji4 7#f7 ,information sharing and analysis organization ,the term information sharing and analysis organization has the meaning given the term in section #bbbb4 7#g7 ,information system ,the term information system has the meaning given the term in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#h7 ,multi-entity group ,the term multi-entity group means a group of #b or more eligible entities desiring a grant under this section4 7#i7 ,online service ,the term online service means any internet-facing service1 including a website1 email1 virtual private network1 or custom application4 7#aj7 ,rural area ,the term rural area has the meaning given the term in section #ecjb of title #di1 ,united ,states ,code4 7#aa7 ,state and ,local ,cybersecurity ,grant ,program ,the term ,state and ,local ,cybersecurity ,grant ,program means the program established under subsection 7b74 7#ab7 ,tribal government ,the term ,tribal government means the recognized governing body of any ,indian or ,alaska ,native ,tribe1 band1 nation1 pueblo1 village1 community1 component band1 or component reservation1 that is individually identified 7including parenthetically7 in the most recent list published pursuant to ,section #ajd of the ,federally ,recognized ,indian ,tribe ,list ,act of #aiid 7#be ,u4,s4,c4 #eaca74 7b7 ,establishment 7#a7 ,in general ,there is established within the ,department a program to award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by1 or on behalf of1 ,state1 local1 or ,tribal governments4 7#b7 ,application ,an eligible entity desiring a grant under the ,state and ,local ,cybersecurity ,grant ,program shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require4 7c7 ,administration ,the ,state and ,local ,cybersecurity ,grant ,program shall be administered in the same office of the ,department that administers grants made under sections #bjjc and #bjjd4 7d7 ,use of funds ,an eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section1 as appropriate1 shall use the grant to-- 7#a7 implement the ,cybersecurity ,plan of the eligible entity2 7#b7 develop or revise the ,cybersecurity ,plan of the eligible entity2 7#c7 pay expenses directly relating to the administration of the grant1 which shall not exceed #e percent of the amount of the grant2 7#d7 assist with activities that address imminent cybersecurity threats1 as confirmed by the ,secretary1 acting through the ,director1 to the information systems owned or operated by1 or on behalf of1 the eligible entity or a local government within the jurisdiction of the eligible entity2 or 7#e7 fund any other appropriate activity determined by the ,secretary1 acting through the ,director4 7e7 ,cybersecurity plans 7#a7 ,in general ,an eligible entity applying for a grant under this section shall submit to the ,secretary a ,cybersecurity ,plan for review in accordance with subsection 7i74 7#b7 ,required elements ,a ,cybersecurity ,plan of an eligible entity shall-- 7,a7 incorporate1 to the extent practicable-- 7i7 any existing plans of the eligible entity to protect against cybersecurity risks and cybersecurity threats to information systems owned or operated by1 or on behalf of1 ,state1 local1 or ,tribal governments2 and 7ii7 if the eligible entity is a ,state1 consultation and feedback from local governments and associations of local governments within the jurisdiction of the eligible entity2 7,b7 describe1 to the extent practicable1 how the eligible entity will-- 7i7 manage1 monitor1 and track information systems1 applications1 and user accounts owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 and the information technology deployed on those information systems1 including legacy information systems and information technology that are no longer supported by the manufacturer of the systems or technology2 7ii7 monitor1 audit1 and1 track network traffic and activity transiting or traveling to or from information systems1 applications1 and user accounts owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity2 7iii7 enhance the preparation1 response1 and resiliency of information systems1 applications1 and user accounts owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 against cybersecurity risks and cybersecurity threats2 7iv7 implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address cybersecurity risks and cybersecurity threats on information systems1 applications1 and user accounts owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity2 7v7 ensure that the eligible entity and1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 adopt and use best practices and methodologies to enhance cybersecurity1 such as-- 7,i7 the practices set forth in the cybersecurity framework developed by the ,national ,institute of ,standards and ,technology2 7,,ii7 cyber chain supply chain risk management best practices identified by the ,national ,institute of ,standards and ,technology2 and 7,,iii7 knowledge bases of adversary tools and tactics2 7vi7 promote the delivery of safe1 recognizable1 and trustworthy online services by the eligible entity and1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 including through the use of the 4gov internet domain2 7vii7 ensure continuity of operations of the eligible entity and1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 in the event of a cybersecurity incident1 including by conducting exercises to practice responding to a cybersecurity incident2 7viii7 use the ,national ,initiative for ,cybersecurity ,education ,workforce ,framework for ,cybersecurity developed by the ,national ,institute of ,standards and ,technology to identify and mitigate any gaps in the cybersecurity workforces of the eligible entity and1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 enhance recruitment and retention efforts for those workforces1 and bolster the knowledge1 skills1 and abilities of personnel of the eligible entity and1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 to address cybersecurity risks and cybersecurity threats1 such as through cybersecurity hygiene training2 7ix7 if the eligible entity is a ,state1 ensure continuity of communications and data networks within the jurisdiction of the eligible entity between the eligible entity and local governments within the jurisdiction of the eligible entity in the event of an incident involving those communications or data networks2 7x7 assess and mitigate1 to the greatest degree possible1 cybersecurity risks and cybersecurity threats relating to critical infrastructure and key resources1 the degradation of which may impact the performance of information systems within the jurisdiction of the eligible entity2 7xi7 enhance capabilities to share cyber threat indicators and related information between the eligible entity and-- 7,i7 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity1 including by expanding information sharing agreements with the ,department2 and 7,,ii7 the ,department2 7xii7 leverage cybersecurity services offered by the ,department2 7xiii7 implement an information technology and operational technology modernization cybersecurity review process that ensures alignment between information technology and operational technology cybersecurity objectives2 7xiv7 develop and coordinate strategies to address cybersecurity risks and cybersecurity threats in consultation with-- 7,i7 if the eligible entity is a ,state1 local governments and associations of local governments within the jurisdiction of the eligible entity2 and 7,,ii7 as applicable-- 7aa7 eligible entities that neighbor the jurisdiction of the eligible entity or1 as appropriate1 members of an information sharing and analysis organization2 and 7bb7 countries that neighbor the jurisdiction of the eligible entity2 7xv7 ensure adequate access to1 and participation in1 the services and programs described in this subparagraph by rural areas within the jurisdiction of the eligible entity2 and 7xvi7 distribute funds1 items1 services1 capabilities1 or activities to local governments under subsection 7n77#b77;,a71 including the fraction of that distribution the eligible entity plans to distribute to rural areas under subsection 7n77#b77;,b72 7,c7 assess the capabilities of the eligible entity relating to the actions described in subparagraph 7,b72 7,d7 describe1 as appropriate and to the extent practicable1 the individual responsibilities of the eligible entity and local governments within the jurisdiction of the eligible entity in implementing the plan2 7,e7 outline1 to the extent practicable1 the necessary resources and a timeline for implementing the plan2 and 7,f7 describe the metrics the eligible entity will use to measure progress towards-- 7i7 implementing the plan2 and 7ii7 reducing cybersecurity risks to1 and identifying1 responding to1 and recovering from cybersecurity threats to1 information systems owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity4 7#c7 ,discretionary elements ,in drafting a ,cybersecurity ,plan1 an eligible entity may-- 7,a7 consult with the ,multi-,state ,information ,sharing and ,analysis ,center2 7,b7 include a description of cooperative programs developed by groups of local governments within the jurisdiction of the eligible entity to address cybersecurity risks and cybersecurity threats2 and 7,c7 include a description of programs provided by the eligible entity to support local governments and owners and operators of critical infrastructure to address cybersecurity risks and cybersecurity threats4 7f7 ,multi-,entity grants 7#a7 ,in general ,the ,secretary may award grants under this section to a multi-entity group to support multi-entity efforts to address cybersecurity risks and cybersecurity threats to information systems within the jurisdictions of the eligible entities that comprise the multi-entity group4 7#b7 ,satisfaction of other requirements ,in order to be eligible for a multi-entity grant under this subsection1 each eligible entity that comprises a multi-entity group shall have-- 7,a7 a ,cybersecurity ,plan that has been reviewed by the ,secretary in accordance with subsection 7i72 and 7,b7 a cybersecurity planning committee established in accordance with subsection 7g74 7#c7 ,application 7,a7 ,in general ,a multi-entity group applying for a multi-entity grant under paragraph 7#a7 shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require4 7,b7 ,multi-entity project plan ,an application for a grant under this section of a multi-entity group under subparagraph 7,a7 shall include a plan describing-- 7i7 the division of responsibilities among the eligible entities that comprise the multi-entity group2 7ii7 the distribution of funding from the grant among the eligible entities that comprise the multi-entity group2 and 7iii7 how the eligible entities that comprise the multi-entity group will work together to implement the ,cybersecurity ,plan of each of those eligible entities4 7g7 ,planning committees 7#a7 ,in general ,an eligible entity that receives a grant under this section shall establish a cybersecurity planning committee to-- 7,a7 assist with the development1 implementation1 and revision of the ,cybersecurity ,plan of the eligible entity2 7,b7 approve the ,cybersecurity ,plan of the eligible entity2 and 7,c7 assist with the determination of effective funding priorities for a grant under this section in accordance with subsections 7d7 and 7j74 7#b7 ,composition ,a committee of an eligible entity established under paragraph 7#a7 shall-- 7,a7 be comprised of representatives from-- 7i7 the eligible entity2 7ii7 if the eligible entity is a ,state1 counties1 cities1 and towns within the jurisdiction of the eligible entity2 and 7iii7 institutions of public education and health within the jurisdiction of the eligible entity2 and 7,b7 include1 as appropriate1 representatives of rural1 suburban1 and high-population jurisdictions4 7#c7 ,cybersecurity expertise ,not less than one-half of the representatives of a committee established under paragraph 7#a7 shall have professional experience relating to cybersecurity or information technology4 7#d7 ,rule of construction regarding existing planning committees ,nothing in this subsection shall be construed to require an eligible entity to establish a cybersecurity planning committee if the eligible entity has established and uses a multijurisdictional planning committee or commission that-- 7,a7 meets the requirements of this subsection2 or 7,b7 may be expanded or leveraged to meet the requirements of this subsection1 including through the formation of a cybersecurity planning subcommittee4 7#e7 ,rule of construction regarding control of information systems of eligible entities ,nothing in this subsection shall be construed to permit a cybersecurity planning committee of an eligible entity that meets the requirements of this subsection to make decisions relating to information systems owned or operated by1 or on behalf of1 the eligible entity4 7h7 ,special rule for ,tribal governments ,with respect to any requirement under subsection 7e7 or 7g71 the ,secretary1 in consultation with the ,secretary of the ,interior and ,tribal governments1 may prescribe an alternative substantively similar requirement for ,tribal governments if the ,secretary finds that the alternative requirement is necessary for the effective delivery and administration of grants to ,tribal governments under this section4 7i7 ,review of plans 7#a7 ,review as condition of grant 7,a7 ,in general ,subject to paragraph 7#c71 before an eligible entity may receive a grant under this section1 the ,secretary1 acting through the ,director1 shall-- 7i7 review the ,cybersecurity ,plan of the eligible entity1 including any revised ,cybersecurity ,plans of the eligible entity2 and 7ii7 determine that the ,cybersecurity ,plan reviewed under clause 7i7 satisfies the requirements under paragraph 7#b74 7,b7 ,duration of determination ,in the case of a determination under subparagraph 7,a77ii7 that a ,cybersecurity ,plan satisfies the requirements under paragraph 7#b71 the determination shall be effective for the #b-year period beginning on the date of the determination4 7,c7 ,annual renewal ,not later than #b years after the date on which the ,secretary determines under subparagraph 7,a77ii7 that a ,cybersecurity ,plan satisfies the requirements under paragraph 7#b71 and annually thereafter1 the ,secretary1 acting through the ,director1 shall-- 7i7 determine whether the ,cybersecurity ,plan and any revisions continue to meet the criteria described in paragraph 7#b72 and 7ii7 renew the determination if the ,secretary1 acting through the ,director1 makes a positive determination under clause 7i74 7#b7 ,plan requirements ,in reviewing a ,cybersecurity ,plan of an eligible entity under this subsection1 the ,secretary1 acting through the ,director1 shall ensure that the ,cybersecurity ,plan-- 7,a7 satisfies the requirements of subsection 7e77#b72 and 7,b7 has been approved by-- 7i7 the cybersecurity planning committee of the eligible entity established under subsection 7g72 and 7ii7 the ,chief ,information ,officer1 the ,chief ,information ,security ,officer1 or an equivalent official of the eligible entity4 7#c7 ,exception ,notwithstanding subsection 7e7 and paragraph 7#a7 of this subsection1 the ,secretary may award a grant under this section to an eligible entity that does not submit a ,cybersecurity ,plan to the ,secretary for review before ,september #cj1 #bjbc1 if the eligible entity certifies to the ,secretary that-- 7,a7 the activities that will be supported by the grant are-- 7i7 integral to the development of the ,cybersecurity ,plan of the eligible entity2 or 7ii7 necessary to assist with activities described in subsection 7d77#d71 as confirmed by the ,director2 and 7,b7 the eligible entity will submit to the ,secretary a ,cybersecurity ,plan for review under this subsection by ,september #cj1 #bjbc4 7#d7 ,rule of construction ,nothing in this subsection shall be construed to provide authority to the ,secretary to-- 7,a7 regulate the manner by which an eligible entity or local government improves the cybersecurity of the information systems owned or operated by1 or on behalf of1 the eligible entity or local government2 or 7,b7 condition the receipt of grants under this section on-- 7i7 participation in a particular ,federal program2 or 7ii7 the use of a specific product or technology4 7j7 ,limitations on uses of funds 7#a7 ,in general ,any entity that receives funds from a grant under this section may not use the grant-- 7,a7 to supplant ,state or local funds2 7,b7 for any recipient cost-sharing contribution2 7,c7 to pay a ransom2 7,d7 for recreational or social purposes2 or 7,e7 for any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by1 or on behalf of1 the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity4 7#b7 ,compliance oversight ,in addition to any other remedy available1 the ,secretary may take such actions as are necessary to ensure that a recipient of a grant under this section uses the grant for the purposes for which the grant is awarded4 7#c7 ,rule of construction ,nothing in paragraph 7#a77;,a7 shall be construed to prohibit the use of funds from a grant under this section awarded to a ,state1 local1 or ,tribal government for otherwise permissible uses under this section on the basis that the ,state1 local1 or ,tribal government has previously used ,state1 local1 or ,tribal funds to support the same or similar uses4 7k7 ,opportunity ,to amend applications ,in considering applications for grants under this section1 the ,secretary shall provide applicants with a reasonable opportunity to correct any defects in those applications before making final awards1 including by allowing applicants to revise a submitted ,cybersecurity ,plan4 7l7 ,apportionment ,for fiscal year #bjbb and each fiscal year thereafter1 the ,secretary shall apportion amounts appropriated to carry out this section among eligible entities as follows3 7#a7 ,baseline amount ,the ,secretary shall first apportion-- 7,a7 #j4be percent of such amounts to each of ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 and the ,united ,states ,virgin ,islands2 7,b7 #a percent of such amounts to each of the remaining ,states2 and 7,c7 #c percent of such amounts to ,tribal governments4 7#b7 ,remainder ,the ,secretary shall apportion the remainder of such amounts to ,states as follows3 7,a7 #ej percent of such remainder in the ratio that the population of each ,state1 bears to the population of all ,states2 and 7,b7 #ej percent of such remainder in the ratio that the population of each ,state that resides in rural areas1 bears to the population of all ,states that resides in rural areas4 7#c7 ,apportionment among ,tribal governments ,in determining how to apportion amounts to ,tribal governments under paragraph 7#a77;,c71 the ,secretary shall consult with the ,secretary of the ,interior and ,tribal governments4 7#d7 ,multi-entity grants ,an amount received from a multi-entity grant awarded under subsection 7f77#a7 by a ,state or ,tribal government that is a member of the multi-entity group shall qualify as an apportionment for the purpose of this subsection4 7m7 ,federal share 7#a7 ,in general ,the ,federal share of the cost of an activity carried out using funds made available with a grant under this section may not exceed-- 7,a7 in the case of a grant to an eligible entity-- 7i7 for fiscal year #bjbb1 #ij percent2 7ii7 for fiscal year #bjbc1 #hj percent2 7iii7 for fiscal year #bjbd1 #gj percent2 and 7iv7 for fiscal year #bjbe1 #fj percent2 and 7,b7 in the case of a grant to a multi-entity group-- 7i7 for fiscal year #bjbb1 #ajj percent2 7ii7 for fiscal year #bjbc1 #ij percent2 7iii7 for fiscal year #bjbd1 #hj percent2 and 7iv7 for fiscal year #bjbe1 #gj percent4 7#b7 ,waiver 7,a7 ,in general ,the ,secretary may waive or modify the requirements of paragraph 7#a7 if an eligible entity or multi-entity group demonstrates economic hardship4 7,b7 ,guidelines ,the ,secretary shall establish and publish guidelines for determining what constitutes economic hardship for the purposes of this subsection4 7,c7 ,considerations ,in developing guidelines under subparagraph 7,b71 the ,secretary shall consider1 with respect to the jurisdiction of an eligible entity-- 7i7 changes in rates of unemployment in the jurisdiction from previous years2 7ii7 changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaa et seq47 from previous years2 and 7iii7 any other factors the ,secretary considers appropriate4 7#c7 ,waiver for ,tribal governments ,notwithstanding paragraph 7#b71 the ,secretary1 in consultation with the ,secretary of the ,interior and ,tribal governments1 may waive or modify the requirements of paragraph 7#a7 for #a or more ,tribal governments if the ,secretary determines that the waiver is in the public interest4 7n7 ,responsibilities of grantees 7#a7 ,certification ,each eligible entity or multi-entity group that receives a grant under this section shall certify to the ,secretary that the grant will be used-- 7,a7 for the purpose for which the grant is awarded2 and 7,b7 in compliance with subsections 7d7 and 7j74 7#b7 ,availability of funds to local governments and rural areas 7,a7 ,in general ,subject to subparagraph 7,c71 not later than #de days after the date on which an eligible entity or multi-entity group receives a grant under this section1 the eligible entity or multi-entity group shall1 without imposing unreasonable or unduly burdensome requirements as a condition of receipt1 obligate or otherwise make available to local governments within the jurisdiction of the eligible entity or the eligible entities that comprise the multi-entity group1 consistent with the ,cybersecurity ,plan of the eligible entity or the ,cybersecurity ,plans of the eligible entities that comprise the multi-entity group-- 7i7 not less than #hj percent of funds available under the grant2 7ii7 with the consent of the local governments1 items1 services1 capabilities1 or activities having a value of not less than #hj percent of the amount of the grant2 or 7iii7 with the consent of the local governments1 grant funds combined with other items1 services1 capabilities1 or activities having the total value of not less than #hj percent of the amount of the grant4 7,b7 ,availability to rural areas ,in obligating funds1 items1 services1 capabilities1 or activities to local governments under subparagraph 7,a71 the eligible entity or eligible entities that comprise the multi-entity group shall ensure that rural areas within the jurisdiction of the eligible entity or the eligible entities that comprise the multi-entity group receive not less than-- 7i7 #be percent of the amount of the grant awarded to the eligible entity2 7ii7 items1 services1 capabilities1 or activities having a value of not less than #be percent of the amount of the grant awarded to the eligible entity2 or 7iii7 grant funds combined with other items1 services1 capabilities1 or activities having the total value of not less than #be percent of the grant awarded to the eligible entity4 7,c7 ,exceptions ,this paragraph shall not apply to-- 7i7 any grant awarded under this section that solely supports activities that are integral to the development or revision of the ,cybersecurity ,plan of the eligible entity2 or 7ii7 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,american ,samoa1 the ,commonwealth of the ,northern ,mariana ,islands1 ,guam1 the ,united ,states ,virgin ,islands1 or a ,tribal government4 7#c7 ,certifications regarding distribution of grant funds to local governments ,an eligible entity or multi-entity group shall certify to the ,secretary that the eligible entity or multi-entity group has made the distribution to local governments required under paragraph 7#b74 7#d7 ,extension of period 7,a7 ,in general ,an eligible entity or multi-entity group may request in writing that the ,secretary extend the period of time specified in paragraph 7#b7 for an additional period of time4 7,b7 ,approval ,the ,secretary may approve a request for an extension under subparagraph 7,a7 if the ,secretary determines the extension is necessary to ensure that the obligation and expenditure of grant funds align with the purpose of the ,state and ,local ,cybersecurity ,grant ,program4 7#e7 ,direct funding ,if an eligible entity does not make a distribution to a local government required under paragraph 7#b7 in a timely fashion1 the local government may petition the ,secretary to request the ,secretary to provide funds directly to the local government4 7#f7 ,limitation on construction ,a grant awarded under this section may not be used to acquire land or to construct1 remodel1 or perform alterations of buildings or other physical facilities4 7#g7 ,consultation in allocating funds ,an eligible entity applying for a grant under this section shall agree to consult the ,chief ,information ,officer1 the ,chief ,information ,security ,officer1 or an equivalent official of the eligible entity in allocating funds from a grant awarded under this section4 7#h7 ,penalties ,in addition to other remedies available to the ,secretary1 if an eligible entity violates a requirement of this subsection1 the ,secretary may-- 7,a7 terminate or reduce the amount of a grant awarded under this section to the eligible entity2 or 7,b7 distribute grant funds previously awarded to the eligible entity-- 7i7 in the case of an eligible entity that is a ,state1 directly to the appropriate local government as a replacement grant in an amount determined by the ,secretary2 or 7ii7 in the case of an eligible entity that is a ,tribal government1 to another ,tribal government or ,tribal governments as a replacement grant in an amount determined by the ,secretary4 7o7 ,consultation with state1 local1 and tribal representatives ,in carrying out this section1 the ,secretary shall consult with ,state1 local1 and ,tribal representatives with professional experience relating to cybersecurity1 including representatives of associations representing ,state1 local1 and ,tribal governments1 to inform-- 7#a7 guidance for applicants for grants under this section1 including guidance for ,cybersecurity ,plans2 7#b7 the study of risk-based formulas required under subsection 7q77#d72 7#c7 the development of guidelines required under subsection 7m77#b77;,b72 and 7#d7 any modifications described in subsection 7q77#b77;,d74 7p7 ,notification to ,congress ,not later than #c business days before the date on which the ,department announces the award of a grant to an eligible entity under this section1 including an announcement to the eligible entity1 the ,secretary shall provide to the appropriate committees of ,congress notice of the announcement4 7q7 ,reports1 study1 and review 7#a7 ,annual reports by grant recipients 7,a7 ,in general ,not later than #a year after the date on which an eligible entity receives a grant under this section for the purpose of implementing the ,cybersecurity ,plan of the eligible entity1 including an eligible entity that comprises a multi-entity group that receives a grant for that purpose1 and annually thereafter until #a year after the date on which funds from the grant are expended or returned1 the eligible entity shall submit to the ,secretary a report that1 using the metrics described in the ,cybersecurity ,plan of the eligible entity1 describes the progress of the eligible entity in-- 7i7 implementing the ,cybersecurity ,plan of the eligible entity2 and 7ii7 reducing cybersecurity risks to1 and identifying1 responding to1 and recovering from cybersecurity threats to1 information systems owned or operated by1 or on behalf of1 the eligible entity or1 if the eligible entity is a ,state1 local governments within the jurisdiction of the eligible entity4 7,b7 ,absence of plan ,not later than #a year after the date on which an eligible entity that does not have a ,cybersecurity ,plan receives funds under this section1 and annually thereafter until #a year after the date on which funds from the grant are expended or returned1 the eligible entity shall submit to the ,secretary a report describing how the eligible entity obligated and expended grant funds to-- 7i7 develop or revise a ,cybersecurity ,plan2 or 7ii7 assist with the activities described in subsection 7d77#d74 7#b7 ,annual reports to ,congress ,not less frequently than annually1 the ,secretary1 acting through the ,director1 shall submit to ,congress a report on-- 7,a7 the use of grants awarded under this section2 7,b7 the proportion of grants used to support cybersecurity in rural areas2 7,c7 the effectiveness of the ,state and ,local ,cybersecurity ,grant ,program2 7,d7 any necessary modifications to the ,state and ,local ,cybersecurity ,grant ,program2 and 7,e7 any progress made toward-- 7i7 developing1 implementing1 or revising ,cybersecurity ,plans2 and 7ii7 reducing cybersecurity risks to1 and identifying1 responding to1 and recovering from cybersecurity threats to1 information systems owned or operated by1 or on behalf of1 ,state1 local1 or ,tribal governments as a result of the award of grants under this section4 7#c7 ,public availability 7,a7 ,in general ,the ,secretary1 acting through the ,director1 shall make each report submitted under paragraph 7#b7 publicly available1 including by making each report available on the website of the ,agency4 7,b7 ,redactions ,in making each report publicly available under subparagraph 7,a71 the ,director may make redactions that the ,director1 in consultation with each eligible entity1 determines necessary to protect classified or other information exempt from disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly referred to as the ,freedom of ,information ,act74 7#d7 ,study of risk-based formulas 7,a7 ,in general ,not later than ,september #cj1 #bjbd1 the ,secretary1 acting through the ,director1 shall submit to the appropriate committees of ,congress a study and legislative recommendations on the potential use of a risk-based formula for apportioning funds under this section1 including-- 7i7 potential components that could be included in a risk-based formula1 including the potential impact of those components on support for rural areas under this section2 7ii7 potential sources of data and information necessary for the implementation of a risk-based formula2 7iii7 any obstacles to implementing a risk-based formula1 including obstacles that require a legislative solution2 7iv7 if a risk-based formula were to be implemented for fiscal year #bjbf1 a recommended risk-based formula for the ,state and ,local ,cybersecurity ,grant ,program2 and 7v7 any other information that the ,secretary1 acting through the ,director1 determines necessary to help ,congress understand the progress towards1 and obstacles to1 implementing a risk-based formula4 7,b7 ,inapplicability of ,paperwork ,reduction ,act ,the requirements of chapter #ce of title #dd1 ,united ,states ,code 7commonly referred to as the ,paperwork ,reduction ,act71 shall not apply to any action taken to carry out this paragraph4 7#e7 ,tribal cybersecurity needs report ,not later than #b years after the date of enactment of this section1 the ,secretary1 acting through the ,director1 shall submit to ,congress a report that-- 7,a7 describes the cybersecurity needs of ,tribal governments1 which shall be determined in consultation with the ,secretary of the ,interior and ,tribal governments2 and 7,b7 includes any recommendations for addressing the cybersecurity needs of ,tribal governments1 including any necessary modifications to the ,state and ,local ,cybersecurity ,grant ,program to better serve ,tribal governments4 7#f7 ,,gao review ,not later than #c years after the date of enactment of this section1 the ,comptroller ,general of the ,united ,states shall conduct a review of the ,state and ,local ,cybersecurity ,grant ,program1 including-- 7,a7 the grant selection process of the ,secretary2 and 7,b7 a sample of grants awarded under this section4 7r7 ,authorization of appropriations 7#a7 ,in general ,there are authorized to be appropriated for activities under this section-- 7,a7 for fiscal year #bjbb1 #bjj1jjj1jjj2 7,b7 for fiscal year #bjbc1 #djj1jjj1jjj2 7,c7 for fiscal year #bjbd1 #cjj1jjj1jjj2 and 7,d7 for fiscal year #bjbe1 #ajj1jjj1jjj4 7#b7 ,transfers authorized 7,a7 ,in general ,during a fiscal year1 the ,secretary or the head of any component of the ,department that administers the ,state and ,local ,cybersecurity ,grant ,program may transfer not more than #e percent of the amounts appropriated pursuant to paragraph 7#a7 or other amounts appropriated to carry out the ,state and ,local ,cybersecurity ,grant ,program for that fiscal year to an account of the ,department for salaries1 expenses1 and other administrative costs incurred for the management1 administration1 or evaluation of this section4 7,b7 ,additional appropriations ,any funds transferred under subparagraph 7,a7 shall be in addition to any funds appropriated to the ,department or the components described in subparagraph 7,a7 for salaries1 expenses1 and other administrative costs4 7s7 ,termination 7#a7 ,in general ,subject to paragraph 7#b71 the requirements of this section shall terminate on ,september #cj1 #bjbe4 7#b7 ,exception ,the reporting requirements under subsection 7q7 shall terminate on the date that is #a year after the date on which the final funds from a grant under this section are expended or returned4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace71 is amended by inserting after the item relating to section #bbag the following3 ,sec4 #bbah4 ,state and ,local ,cybersecurity ,grant ,program4 4