Federal grant programs / Department of Homeland Security

State and Local Cybersecurity Grant Program Tribal Cybersecurity Grant Program (97.137)

Also known as State and Local Cybersecurity Grant Progam

• Awarded, FY 2021 to 2025$931 million
• Grant awards237
• Typical award$3.4 million
• Awarded in FY 2025$384 million
• Size rank270 of 1,823
• Type of assistanceGrant

Key findings

• It is the 270th largest of 1,823 federal grant programs by five-year awards.
• The 20 largest recipients received 51% of the money.
• Awards went to recipients in 55 states and territories.

What the program funds

The goal of the State and Local Cybersecurity Grant Program (SLCGP) is to assist states (including territories) and local governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the Period of Performance (POP) as applicants focus on their Cybersecurity Plans, priorities, projects, and implementation toward addressing the program objectives. Program Objectives for SLCGP and the Tribal Cybersecurity Grant Program (TCGP) include: 1. Develop and establish appropriate governance structures, as well as plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations; 2. SLTT agencies understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments; 3. Implement security protections commensurate with risk (outcomes of Objectives 1 & 2); and 4. Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility. Performance Measures: • Percentage of entities with Cybersecurity and Infrastructure Security Agency (CISA) approved state-wide Cybersecurity Plans • Percentage of entities with statewide Cybersecurity Planning Committees that meet the Homeland Security Act of 2002 and SLCGP funding notice requirements • Percentage of entities conducting annual table-top and full-scope exercises to test Cybersecurity Plans • Percent of the entities’ SLCGP budget allocated to exercises • Average dollar amount expended on exercise planning for entities • Percentage of entities conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement • Percentage of entities performing phishing training • Percentage of entities conducting awareness campaigns • Percent of entities providing role-based cybersecurity awareness training to employees • Percentage of entities adopting the Workforce Framework for Cybersecurity (NICE Framework) as evidenced by established workforce development and training plans • Percentage of entities with capabilities to analyze network traffic and activities related to potential threats • Percentage of entities implementing multi-factor authentication (MFA) for all remote access and privileged accounts • Percentage of entities with programs to anticipate and discontinue use of end-of-life software and hardware • Percentage of entities prohibiting the use of known/fixed/default passwords and credentials • Percentage of entities operating under the “.gov” internet domain • Number of cybersecurity gaps or issues addressed annually by entities

From the federal Assistance Listing. Read the full listing on SAM.gov.

Open opportunities

No opportunity under this program is open or forecast on Grants.gov right now. Programs often post once a year, so the funding history below shows what to expect.

Rules from the program listing

Who can apply

All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. The Governor-designated SLCGP State Administrative Agency (SAA) is the only entity eligible to submit SLCGP applications to DHS/FEMA. One or more states or territories may submit a multi-entity project. “State” is defined in Section 2 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(17)) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

What the money can and cannot pay for

Other: Spyware; cybersecurity insurance premiums; In general, any entity that receives funds from a grant under this section may not use the grant (A) to supplant state or local funds; (B) for any recipient cost-sharing contribution; (C) to pay a ransom; (D) for recreational or social purposes; or (E) for any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by, or on behalf of, the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity. The supplanting prohibition shall not be construed to prohibit the use of funds from a grant under this program for otherwise permissible uses on the basis that the SLTT government has previously used SLTT funds to support the same or similar uses. All costs charged to awards must comply with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements at 2 C.F.R. Part 200, unless otherwise indicated in the Notice of Funding Opportunity (“NOFO”), or the terms and conditions of the award. (1) IN GENERAL.

Continue reading on SAM.gov

Matching requirements

Statutory Formula: Title Homeland Security Act of 2002, Part 48, Subpart 1469a,Public Law Pub. L. No. 107-296, as amended (codified at 6 U.S.C. § 665g).Applicants selected for this award must agree to an acceptable cost share agreement. Otherwise, they will not be funded. For FY 2025, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands. Project-based Cost Share: Section 2220A of the Homeland Security Act of 2002 requires a State to meet a nonfederal matching requirement for an “activity” carried out under an SLCGP grant award. DHS interprets the term “activity” to be an approved “project” under an SLCGP grant award and administers the nonfederal matching requirement in accordance with 2 C.F.R. § 200.306. Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 40% of the total project costs (federal award amount plus cost share amount, rounded to the nearest whole dollar). The cost share for the multi-entity projects is 30% for FY 2025. MOE requirements are not applicable to this assistance listing.Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 40% of the total project costs (federal award amount plus cost share amount, rounded to the nearest whole dollar).

Continue reading on SAM.gov

Deadlines

All four fiscal years of SLCGP funding have been awarded. The FY 2025 application deadline was 8/15/2025 at 5:00 PM Eastern Time via an application in FEMA GO. No additional authorization has been made for SLCGP, at this time.

Award range and average, in the agency's words

For FY 2023 SLCGP, these are the estimates: All 50 States, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $4,082,282 each; Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $1,020,570; $79,310,190, 50% of the remaining amount, will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories.

Examples of funded projects

Fiscal Year2025: 2024: Development of Cybersecurity Plan; Cyber full-scale exercise; End of life equipment, hardware, and software; Endpoint Detection, Protection and Monitoring; Implementing multi-factor authentication (MFA); Workforce development and training; Conducting cybersecurity awareness campaigns; Migration to .gov internet domain; Cybersecurity assessments. 2025: Updates to the Cybersecurity Plan; Cyber full-scale exercise; End of life equipment, hardware, and software; Endpoint Detection, Protection and Monitoring; Implementing multi-factor authentication (MFA); Workforce development and training; Conducting cybersecurity awareness campaigns; Migration to .gov internet domain; Cybersecurity assessments.

Quoted from the program's federal Assistance Listing. The notice of funding opportunity is the official source for each competition's rules.

Who usually wins

State and local governments received 97% of the money, tribes 1.1% and nonprofits 0.9%.

By state

Each state below has its own page for this program, with its recipients and yearly totals.

Award amounts are federal obligations reported to USAspending.gov for fiscal 2021 to 2025; see how our data works.