State Cyber Resiliency Act

II 116TH CONGRESS 1ST SESSION S. 1065 To provide grants to assist States in developing and implementing plans to address cybersecurity threats or vulnerabilities, and for other purposes. IN THE SENATE OF THE UNITED STATES APRIL 8, 2019 Mr. WARNER (for himself and Mr. GARDNER) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs A BILL To provide grants to assist States in developing and imple- menting plans to address cybersecurity threats or vulnerabilities, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘State Cyber Resiliency 4 Act’’. 5 SEC. 2. ESTABLISHMENT OF CYBER RESILIENCY GRANT 6 PROGRAM. 7 (a) ESTABLISHMENT.—There is established the State 8 Cyber Resiliency Grant Program to assist State, local, and 9 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 2 •S 1065 IS tribal governments in preventing, preparing for, protecting 1 against, and responding to cyber threats, which shall be 2 administered by the Administrator. 3 (b) ELIGIBILITY.—Each State shall be eligible to 4 apply for grants under the Program. 5 (c) GRANTS AUTHORIZED FOR EACH STATE.—Sub- 6 ject to the funds available under a funding allocation de- 7 termined under subsection (f) for a State, the Secretary 8 of Homeland Security may award to the State— 9 (1) up to 2 planning grants under subsection 10 (e) to develop or revise a cyber resiliency plan; and 11 (2) up to 2 implementation grants under sub- 12 section (f) to implement an active cyber resiliency 13 plan. 14 (d) APPROVAL OF CYBER RESILIENCY PLANS.— 15 (1) IN GENERAL.—The Secretary shall approve 16 a cyber resiliency plan submitted by a State if the 17 Secretary determines, after considering the rec- 18 ommendations of the Review Committee established 19 under subsection (i), that the plan meets all of the 20 following criteria: 21 (A) The plan incorporates, to the extent 22 practicable, any existing plans of such State to 23 protect against cybersecurity threats or 24 vulnerabilities. 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 3 •S 1065 IS (B) The plan is designed to achieve each of 1 the following objectives, with respect to the es- 2 sential functions of such State: 3 (i) Enhancing the preparation, re- 4 sponse, and resiliency of computer net- 5 works, industrial control systems, and com- 6 munications systems performing such func- 7 tions against cybersecurity threats or 8 vulnerabilities. 9 (ii) Implementing a process of contin- 10 uous cybersecurity vulnerability assess- 11 ments and threat mitigation practices to 12 prevent the disruption of such functions by 13 an incident within the State. 14 (iii) Ensuring that entities performing 15 such functions within the State adopt gen- 16 erally recognized best practices and meth- 17 odologies with respect to cybersecurity, 18 such as the practices provided in the cyber- 19 security framework developed by the Na- 20 tional Institute of Standards and Tech- 21 nology. 22 (iv) Mitigating talent gaps in the 23 State government cybersecurity workforce, 24 enhancing recruitment and retention ef- 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 4 •S 1065 IS forts for such workforce, and bolstering the 1 knowledge, skills, and abilities of State 2 government personnel to protect against 3 cybersecurity threats and vulnerabilities. 4 (v) Protecting public safety answering 5 points and other emergency communica- 6 tions and data networks from cybersecurity 7 threats or vulnerabilities. 8 (vi) Ensuring continuity of commu- 9 nications and data networks between enti- 10 ties performing such functions within the 11 State, in the event of a catastrophic dis- 12 ruption of such communications or net- 13 works. 14 (vii) Accounting for and mitigating, to 15 the greatest degree possible, cybersecurity 16 threats or vulnerabilities related to critical 17 infrastructure or key resources, the deg- 18 radation of which may impact the perform- 19 ance of such functions within the State or 20 threaten public safety. 21 (viii) Providing appropriate commu- 22 nications capabilities to ensure cybersecu- 23 rity intelligence information-sharing and 24 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 5 •S 1065 IS the command and coordination capabilities 1 among entities performing such functions. 2 (ix) Developing and coordinating 3 strategies with respect to cybersecurity 4 threats or vulnerabilities in consultation 5 with— 6 (I) neighboring States or mem- 7 bers of an information sharing and 8 analysis organization; and 9 (II) as applicable, neighboring 10 countries. 11 (2) DURATION OF APPROVAL.— 12 (A) INITIAL DURATION.—An approval 13 under paragraph (1) shall be initially effective 14 for the 2-year period beginning on the date of 15 the determination described in such paragraph. 16 (B) ANNUAL EXTENSION.—The Secretary 17 may annually extend such approval for a 1-year 18 period, if the Secretary determines, after con- 19 sidering the recommendations of the Review 20 Committee, that the plan continues to meet the 21 criteria described in paragraph (1) after the 22 State makes such revisions as the Secretary 23 may determine to be necessary. 24 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 6 •S 1065 IS (3) ESSENTIAL FUNCTIONS.—For purposes of 1 this subsection, the term ‘‘essential functions’’ in- 2 cludes, with respect to a State, those functions that 3 enhance the cybersecurity posture of the State, local 4 and tribal governments of the State, and the public 5 services they provide. 6 (e) PLANNING GRANTS.— 7 (1) INITIAL PLANNING GRANT.—The Secretary 8 shall require, as a condition of awarding an initial 9 planning grant, that the State seeking the grant— 10 (A) agrees to use the funds to develop a 11 cyber resiliency plan designed to meet the cri- 12 teria described in subsection (d)(1); and 13 (B) submits an application including such 14 information as the Secretary may determine to 15 be necessary. 16 (2) ELIGIBILITY FOR INITIAL PLANNING 17 GRANT.—A State shall not be eligible to receive an 18 initial planning grant after the date on which the 19 State first submits a cyber resiliency plan to the 20 Secretary for a determination under subsection 21 (d)(1). 22 (3) ADDITIONAL PLANNING GRANT.—The Sec- 23 retary may award an additional planning grant to a 24 State if the State agrees to use the funds to revise 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 7 •S 1065 IS a cyber resiliency plan in order to receive an exten- 1 sion in accordance with subsection (d)(2)(B), and 2 submits an application including such information as 3 the Secretary may determine to be necessary. 4 (4) LIMITATIONS ON NUMBER AND TIMING OF 5 GRANTS.—A State shall not be eligible to receive— 6 (A) more than 2 planning grants under 7 this subsection; or 8 (B) an additional planning grant for the 9 fiscal year following the fiscal year for which it 10 receives an initial planning grant. 11 (f) IMPLEMENTATION GRANTS.— 12 (1) APPLICATION REQUIREMENTS.—The Sec- 13 retary shall require, as a condition of awarding a bi- 14 ennial implementation grant, that the State seeking 15 the grant submits an application including the fol- 16 lowing: 17 (A) A proposal, including a description and 18 timeline, of the activities to be funded by the 19 grant as described by a cyber resiliency plan of 20 the State approved under subsection (d). 21 (B) A description of how each activity pro- 22 posed to be funded by the grant would achieve 23 one or more of the objectives described in sub- 24 section (d)(1)(B). 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 8 •S 1065 IS (C) A description, if applicable, of how any 1 prior biennial implementation grant awarded 2 under this section was spent, and to what ex- 3 tent the criteria described in subsection (d)(1) 4 were met. 5 (D) The share of any amounts awarded as 6 a biennial implementation grant proposed to be 7 distributed to local or tribal governments within 8 such State. 9 (E) Such other information as the Sec- 10 retary may determine to be necessary in con- 11 sultation with the chief information officer, 12 emergency managers, and senior public safety 13 officials of the State. 14 (2) APPROVAL OF APPLICATION.—The Sec- 15 retary shall consider the recommendations of the Re- 16 view Committee in approving or disapproving an ap- 17 plication for a biennial implementation grant. 18 (3) DISTRIBUTION TO LOCAL AND TRIBAL GOV- 19 ERNMENTS.— 20 (A) IN GENERAL.—Not later than 45 days 21 after the date that a biennial implementation 22 grant is awarded, not less than 50 percent of 23 any share proposed under paragraph (1)(D) 24 shall be distributed to local or tribal govern- 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 9 •S 1065 IS ments, in the same manner that amounts 1 awarded under section 2004 of the Homeland 2 Security Act of 2002 (6 U.S.C. 605) are dis- 3 tributed to such governments, except that— 4 (i) no such distribution may be made 5 to a federally recognized Indian tribe that 6 is a State under subsection (k)(11)(B); 7 and 8 (ii) in applying section 2004(c)(1) of 9 such Act with respect to distributions 10 under this subparagraph, ‘‘100 percent’’ 11 shall be substituted for ‘‘80 percent’’ each 12 place that term appears. 13 (B) CONSULTATION.—In determining how 14 an implementation grant is distributed within a 15 State, the State shall consult with local and re- 16 gional chief information officer, emergency 17 managers, and senior public safety officials of 18 the State. 19 (4) COMPETITIVE AWARD.—Except as provided 20 in subsection (h), biennial implementation grants 21 shall be awarded— 22 (A) exclusively on a competitive basis; and 23 (B) based on the recommendations of the 24 Review Committee. 25 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 10 •S 1065 IS (5) LIMITATION ON NUMBER OF GRANTS.—The 1 Secretary may award to a State not more than 2 bi- 2 ennial implementation grants under this section. 3 (g) USE OF GRANT FUNDS.— 4 (1) LIMITATIONS.—Any grant awarded under 5 this section shall supplement and not supplant State 6 or local funds or, as applicable, funds supplied by 7 the Bureau of Indian Affairs, and may not be 8 used— 9 (A) to provide any Federal cost-sharing 10 contribution on behalf of a State; or 11 (B) for any recreational or social purpose. 12 (2) APPROVED ACTIVITIES FOR IMPLEMENTA- 13 TION GRANTS.—A State or a government entity that 14 receives funds through a biennial implementation 15 grant may use such funds for one or more of the fol- 16 lowing activities, to the extent that such activities 17 are proposed under subsection (f)(1)(A): 18 (A) Supporting or enhancing information 19 sharing and analysis organizations. 20 (B) Implementing or coordinating systems 21 and services that use cyber threat indicators (as 22 such term is defined in section 102 of the Cy- 23 bersecurity Information Sharing Act of 2015 (6 24 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 11 •S 1065 IS U.S.C. 1501)) to address cybersecurity threats 1 or vulnerabilities. 2 (C) Supporting dedicated cybersecurity 3 and communications coordination planning, in- 4 cluding the coordination of— 5 (i) emergency management elements 6 of such State; 7 (ii) National Guard units, as appro- 8 priate; 9 (iii) entities associated with critical in- 10 frastructure or key resources; 11 (iv) information sharing and analysis 12 organizations; 13 (v) public safety answering points; or 14 (vi) nongovernmental organizations 15 engaged in cybersecurity research as a for- 16 mally designated information analysis and 17 sharing organization. 18 (D) Establishing programs, such as schol- 19 arships or apprenticeships, to provide financial 20 assistance to State residents who— 21 (i) pursue formal education, training, 22 and industry-recognized certifications for 23 careers in cybersecurity as identified by the 24 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 12 •S 1065 IS National Initiative for Cybersecurity Edu- 1 cation; and 2 (ii) commit to working for State gov- 3 ernment for a specified period of time. 4 (h) FUNDING ALLOCATIONS.— 5 (1) IN GENERAL.—From any amount appro- 6 priated for a fiscal year that is not reserved for use 7 by the Secretary in carrying out this section, the 8 Secretary shall allocate the entire amount among the 9 States (including the District of Columbia) eligible 10 for grants under this section taking into consider- 11 ation the factors specified in paragraph (2) and con- 12 sistent with the following: 13 (A) ALLOCATIONS FOR THE SEVERAL 14 STATES.—Of the amount subject to allocation, 15 a funding allocation for any of such States shall 16 be— 17 (i) not less than 0.001 percent, with 18 respect to an initial planning grant, and 19 not more than 0.001 percent, with respect 20 to any additional planning grants; and 21 (ii) not less than 0.5 percent and not 22 more than 3 percent, with respect to bien- 23 nial implementation grants. 24 VerDate Sep 11 2014 05:38 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1065.IS S1065 kjohnson on DSK79L0C42 with BILLS 13 •S 1065 IS (B) ALLOCATIONS FOR THE TERRITORIES 1 AND POSSESSIONS.—Of the amount subject to 2 allocation, a funding allocation for any of the 3 territories and possessions of the United States 4 eligible for grants under this section shall be— 5 (i) not less than 0.001 percent, with 6 respect to an initial planning grant, and 7 not more than 0.001 percent, with respect 8 to any additional planning grant; and 9 (ii) not [Text truncated for display. Full text available on Congress.gov.]