State and Local Cybersecurity Grant Program Tribal Cybersecurity Grant Program

The goal of the State and Local Cybersecurity Grant Program (SLCGP) is to assist states (including territories) and local governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the Period of Performan

The State and Local Cybersecurity Grant Program provide grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of State, Local, Territorial and Tribal (SLTT) governments.

All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. The Governor-designated SLCGP State Administrative Agency (SAA) is the only entity eligible to submit SLCGP applications to DHS/FEMA. One or more states or territories may submit a multi-entity project. "State" is defined in Section 2 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(17)) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

State, Local, U.S. Territories

Other: Spyware; cybersecurity insurance premiums; In general, any entity that receives funds from a grant under this section may not use the grant (A) to supplant state or local funds; (B) for any recipient cost-sharing contribution; (C) to pay a ransom; (D) for recreational or social purposes; or (E) for any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by, or on behalf of, the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity. The supplanting prohibition shall not be construed to prohibit the use of funds from a grant under this program for otherwise permissible uses on the basis that the SLTT government has previously used SLTT funds to support the same or similar uses.

LIMITATION ON CONSTRUCTION: A grant awarded under this section may not be used to acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities. Grant funds, including funds used to meet a cost share, may not be used for lobbying or intervention in federal regulatory or adjudicatory proceedings. In addition, federal funds may not be used to sue the federal government or any other government entity.

State and Local Cybersecurity Grant Program funds are available to eligible applicants for the duration of the period of performance, which will be up to 48 months. For SLCGP: recipients in the 50 states must pass through at least 80% of the federal funds provided under the grant to local governments within 45 days of the release of the funds from FEMA. FEMA interprets the date that an entity "receives a grant" to be the date upon which FEMA releases the funding hold in the Non-Disaster Grants Management System (ND Grants) system. With the consent of the local governments, this pass-through may be in the form of in-kind services, capabilities, or activities, or a combination of funding and other services. 25% of the total federal award must also go to rural areas. This pass-through to rural areas is a part of the overall 80% pass-through; however, it should be emphasized that 25% of the total federal amount must be passed through to rural areas (defined in 49 U.S. C. 5305 as any area with a population of 50,000 or less). The local government pass-through requirement, including the rural area pass-through requirement, does not apply to the following: The District of Columbia, the Commonwealth of Puerto Rico, American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, the United States Virgin Islands, or a Tribal government.

Preapplication coordination is required. Environmental impact information is not required for this program. This program is eligible for coverage under Executive Order (E.O.) 12372, "Intergovernmental Review of Federal Programs." An applicant should consult the office or official designated as the single point of contact in his or her state for more information on the process the state requires to be followed in applying for assistance, if the state has selected the program for review. This program is eligible for coverage under E.O. 12372, "Intergovernmental Review of Federal Programs." An applicant should consult the office or official designated as the single point of contact in his or her state for more information on the process the state requires to be followed in applying for assistance if the state has selected the program for review. If applying for a grant to implement a Cybersecurity Plan, a state must consult and obtain feedback from local governments within its jurisdiction, to the extent practicable, regarding the elements of the state's Cybersecurity Plan. Similarly, if applying for a grant to implement a cybersecurity plan, states must consult with local governments and associations of local governments, and as applicable, neighboring states or tribal governments, information sharing and analysis organizations, and neighboring countries to develop and coordinate strategies to address cybersecurity risks and cybersecurity threats for that state's Cyber Plan

NOFO URL - https://www.fema.gov/grants/preparedness/state-local-cybersecurity-grant-program#nofos

Recipients shall use the grant funds to: (1) implement the Cybersecurity Plan of the eligible entity; (2) revise the Cybersecurity Plan of the eligible entity; (3) pay expenses directly relating to the management and administration of the grant, up to 5 percent of the grant amount; (4) assist with activities that address imminent cybersecurity threats to the information systems owned or operated by, or on behalf of, the recipient; and/or (5) fund any other appropriate activity determined by the Department of Homeland Security. An eligible entity applying for a grant shall agree to consult the Chief Information Officer (or equivalent), the Chief Information Security Officer, or an equivalent official of the eligible entity, in allocating grant funds under this program. All costs charged to awards must comply with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements at 2 C.F.R. Part 200, unless otherwise indicated in the Notice of Funding Opportunity ("NOFO"), or the terms and conditions of the award. Applicants must demonstrate how investments support closing capability gaps or sustaining capabilities. CISA will review Investment Justifications (IJ) and Project Worksheets (PW) at both the investment and project level. Projects rated as effective or promising are approved. All proposed investments will undergo a federal review by FEMA and CISA to verify compliance with all administrative and eligibility criteria identified in the NOFO. FEMA will conduct the federal review for compliance and the budget review of the IJ(s) and PW. FEMA will use a checklist to verify compliance with all administrative and eligibility criteria identified in the NOFO.

The Authorized Organization Representative (AOR) should carefully read the federal award package before accepting the federal award. The federal award package includes instructions on administering the federal award, as well as terms and conditions for the award. By submitting an application, applicants agree to comply with the prerequisites stated in this NOFO and the material terms and conditions of the federal award, should they receive an award. DHS will provide the federal award package to the applicant electronically via FEMA GO. Award packages include an Award Letter, Summary Award Memo, Agreement Articles, and Obligating Document. An award package notification email is sent via the grant application system to the submitting AOR. Funds will remain on hold until the recipient accepts the award via FEMA GO and all other conditions of the award have been satisfied, or until the award is otherwise rescinded. Failure to accept a grant award within the specified timeframe may result in a loss of funds.

All four fiscal years of SLCGP funding have been awarded. The FY 2025 application deadline was 8/15/2025 at 5:00 PM Eastern Time via an application in FEMA GO. No additional authorization has been made for SLCGP, at this time.

Recipients must accept their awards no later than 60 days from the award date. Recipients shall notify DHS of their intent to accept the award and proceed with work via the FEMA GO system.

For FY 2024 SLCGP, extensions to the Period of Performance (POP) are allowed. For additional information on POP extensions, please refer to Section H of the NOFO. For FY 2025 SLCGP, POP extensions are not allowed.

Where applicable, when FEMA terminates the federal award, the written notification of termination will provide the opportunity, and describe the process, to object and provide information challenging the action, pursuant to 2 C.F.R. § 200.342.