Tribal Cybersecurity Grant Program

The goal of the Tribal Cybersecurity Grant Program (TCGP) is to assist tribal governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the Period of Performance (POP) as applicants focus on their Cybers

The Tribal Cybersecurity Grant Program provides funding to eligible entities to address cybersecurity risks and threats to information systems owned or operated by, or on behalf of tribal governments.

Federally Recognized Tribal Governments may apply directly through the Tribal Cybersecurity Grant Program or may receive funds as subrecipients of the State and Local Cybersecurity Grant Program. Eligible entities are "Tribal government" under Section 2220A(a)(7) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(a)(7). This statute defines "Tribal government" as the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent list published pursuant to Section 104 of the Federally Recognized Indian Tribe List of 1994 (25 U.S.C. § 5131). Tribal governments that apply must submit a Cybersecurity Plan, Cybersecurity Planning Committee List, Charter, TCGP Investment Justification (IJ) form, and a Project Worksheet form. These requirements must be fulfilled before a Tribal government may receive TCGP award funding. Two or more Tribal governments may apply together as a Tribal consortium and submit one application for the consortium.

Refer to Notice of Opportunity

FY 2025 does not allow extensions to the period of performance, per the NOFO. Period of time assistance normally available: 48 months Funds are obligated at time of award, but funding is released as projects are submitted by the recipients and approved by CISA. Individual payment requests for FY25 are submitted for approval before payment. Refer to Notice of Opportunity

Limitation on Construction: A grant awarded under this section may not be used to acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities. Grant funds, including funds used to meet a cost share, may not be used for lobbying or intervention in federal regulatory or adjudicatory proceedings. In addition, federal funds may not be used to sue the federal government or any other government entity. In general, any entity that receives funds from a grant under this section may not use the grant (A) to supplant state or local funds; (B) for any recipient cost-sharing contribution; (C) to pay a ransom; (D) for recreational or social purposes; or (E) for any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by, or on behalf of, the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity. The supplanting prohibition shall not be construed to prohibit the use of funds from a grant under this program for otherwise permissible uses on the basis that the SLTT government has previously used SLTT funds to support the same or similar uses

Tribal Cybersecurity Grant Program funds are available to eligible applicants for the duration of the period of performance, which will be up to 48 months. FEMA interprets the date that an entity "receives a grant" to be the date upon which FEMA releases the funding hold in the FEMA Grants Outcomes (GO) system.

FEMA Preparedness Officers conduct the first review of applications for eligibility and completeness. CISA subject matter experts then review each of the governance materials for relevance to the program objectives as described in the NOFO. Once both reviews are complete, awards are dispersed to recipients. https://www.fema.gov/grants/preparedness/tribal-cybersecurity-grant-program

Refer to the NOFO for this program for a description of the award procedure. The NOFO can be accessed at: https://www.fema.gov/grants/preparedness/tribal-cybersecurity-grant-program/fy-25-nofo

The FY 2025 application deadline was 8/15/2025 at 5:00 PM Eastern Time via an application in FEMA GO. No additional authorization has been made for TCGP at this time.

Please refer to the NOFO https://www.fema.gov/grants/preparedness/tribal-cybersecurity-grant-program

For additional information on POP extensions, please refer to Section H of the NOFO. For FY 2025 TCGP, extensions to the POP are not allowed. POP are not allowed.

Where applicable, when FEMA terminates the federal award, the written notification of termination will provide the opportunity, and describe the process, to object and provide information challenging the action, pursuant to 2 C.F.R. § 200.342.