Federal grant programs / Department of Homeland Security

CISA Cyber Security Awareness Campaign (97.128)

Also known as Cybersecurity Awareness Campaign

• Awarded, FY 2021 to 2025$2.2 million
• Grant awards3
• Typical award$549,996
• Awarded in FY 2025$0
• Size rank1,747 of 1,823
• Type of assistanceCooperative agreements

Key findings

• It is the 1747th largest of 1,823 federal grant programs by five-year awards.
• Awards went to recipients in 1 states and territories.

What the program funds

CISA’s mission is to lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. In carrying out this mission, Section 2202 of the Homeland Security Act of 2002 assigns CISA with the responsibilities to coordinate a national effort to secure and protect against critical infrastructure risks, carry out cybersecurity and critical infrastructure stakeholder outreach and engagement, and encourage and build cybersecurity awareness and competency across the United States. In carrying out its mission and pursuant to these authorities, CISA provides financial assistance under the CAC Program to non-federal entities to perform cybersecurity awareness activities to reduce cybersecurity risks through messaging, tools, and resources to encourage individuals and organizations to reduce their exposure to malicious cyber activity. Through strategies implemented year-round with a focal point of the Cybersecurity Awareness Month in October, a recipient under this federal award engaged in efforts to improve the public’s understanding of cyber threats, amplify opportunities that individuals and non-federal entities can leverage to strengthen their own cybersecurity posture, and encourage discussion, engagement, and actions that can be taken to reduce cyber risk. For the CAC program, CISA established the following six goals: 1. Strengthen the security and resilience of critical infrastructure; 2. Assess and counter evolving cybersecurity risks through actions that promote threat risk reduction; 3. Build a national culture of preparedness for all Americans, ensuring equity and accessibility in our efforts to increase online and digital safety; 4. Build stakeholder relationships that encourage and support data-driven actions by governments, the private sector, tribes, non-profits, and the public that reduce cybersecurity risk; 5. Reinforce the importance of secure by default and secure by design industry practices that do not place the first line of cyber threat risk reduction on those with the least capabilities and resources; and 6. Encourage activities supported by data which result in key behavior change that reduce cyber risk. CISA established the following six objectives for the CAC Program: 1. Educate the public, small businesses, and industry about the dangers of cyber threats and key actions that can be taken to mitigate risks; 2. Promote sustainable cybersecurity and encourage the technology industry to provide secure-by-default technology products with strong security features right out of the box, without added costs; and technology that is secure-by-design, purposefully developed, built, and tested to significantly reduce the number of exploitable flaws before they are introduced into the market for broad use; 3. Identify effective approaches to increase cybersecurity awareness among the general public and target audiences, including vulnerable populations and those with disabilities that may make it challenging to take actions that reduce risk; 4. Build relationships and coalitions across cybersecurity stakeholders to support Cybersecurity Awareness Month; 5. Develop a baseline from which to measure the impact Cybersecurity Awareness Month campaign strategies and messaging has on changing behavior and increasing public awareness of cybersecurity risk; and 6. Contribute to the agency’s efforts to build a culture of preparedness, by informing and empowering communities and individuals to obtain the skills and take the preparatory actions necessary to become more resilient against threats and hazards Americans face.

From the federal Assistance Listing. Read the full listing on SAM.gov.

Open opportunities

No opportunity under this program is open or forecast on Grants.gov right now. Programs often post once a year, so the funding history below shows what to expect.

Rules from the program listing

Who can apply

Nonprofit organizations, other than institutions of higher education, with an effective ruling letter from the U.S. Internal Revenue Service granting tax exemption under Section 501(c)(3) of the Internal Revenue Code of 1986 A recipient under the Cybersecurity Awareness Campaign Program must be a nonprofit organization with an effective ruling letter from the U.S. Internal Revenue Service granting tax exemption under Section 501(c)(3) of the Internal Revenue Code of 1986. A “nonprofit organization” means any organization that: (1) is operated primarily for scientific, educational, service, charitable, or similar purposes in the public interest; (2) is not organized primarily for profit; (3) uses net proceeds to maintain, improve, or expand the organization’s operations; and (4) is not an institution of higher education as defined at 20 U.S.C. § 1001.

What the money can and cannot pay for

The CAC Program provides financial assistance for a nonprofit organization to carry out public awareness activities concerning cybersecurity risks and messaging, tools, and resources to encourage individuals and non-federal entities to reduce their exposure to malicious cyber activity. See above.;

Matching requirements

This program has no statutory formula. Matching requirements are not applicable to this assistance listing. MOE requirements are not applicable to this assistance listing.

Deadlines

The Notice of Funding Opportunity will identify the open application period and deadline for applying for a Cybersecurity Awareness Campaign Program cooperative agreement. The application period is generally at least 61 days and extends from on or about May 1 to July 1. As it relates to the deadline for a recipient under an existing cooperative agreement to request funding for an additional budget period, CISA will notify the recipient as to the availability of continuation funding for an additional budget period on or about July 1 and, if making such funds available, will provide the recipient with 60 days to submit its continuation funding request.

Award range and average, in the agency's words

CISA awarded a competitive cooperative agreement to a single non-profit organization in FY 2023 with a 29-month period of performance comprised of three budget periods. The funding awarded for the initial 1-year budget period was $549,996 and projected continuation funding to be awarded for the second 1-year budget period is $549,996. Therefore, the range of financial assistance per 1-year budget period is $549,996 and the average is $549,996.

Examples of funded projects

Fiscal Year2025: Cybersecurity Awareness Month (October 2025) Cyber Partnership Engagement Cybersecurity Research Cyber Promotions (campaign, programs, resources, careers) Cyber Outreach (social media, newsletter) Website Updates

Quoted from the program's federal Assistance Listing. The notice of funding opportunity is the official source for each competition's rules.

Who usually wins

Almost all of the money went to nonprofits.

By state

Each state below has its own page for this program, with its recipients and yearly totals.

Award amounts are federal obligations reported to USAspending.gov for fiscal 2021 to 2025; see how our data works.