State Cyber Resiliency Act

I 116TH CONGRESS 1ST SESSION H. R. 2130 To provide grants to assist States in developing and implementing plans to address cybersecurity threats or vulnerabilities, and for other purposes. IN THE HOUSE OF REPRESENTATIVES APRIL 8, 2019 Mr. KILMER (for himself and Mr. MCCAUL) introduced the following bill; which was referred to the Committee on Homeland Security, and in addi- tion to the Committee on Transportation and Infrastructure, for a period to be subsequently determined by the Speaker, in each case for consider- ation of such provisions as fall within the jurisdiction of the committee concerned A BILL To provide grants to assist States in developing and imple- menting plans to address cybersecurity threats or vulnerabilities, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘State Cyber Resiliency 4 Act’’. 5 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 2 •HR 2130 IH SEC. 2. ESTABLISHMENT OF CYBER RESILIENCY GRANT 1 PROGRAM. 2 (a) ESTABLISHMENT.—There is established the State 3 Cyber Resiliency Grant Program to assist State, local, and 4 tribal governments in preventing, preparing for, protecting 5 against, and responding to cyber threats, which shall be 6 administered by the Administrator. 7 (b) ELIGIBILITY.—Each State shall be eligible to 8 apply for grants under the Program. 9 (c) GRANTS AUTHORIZED FOR EACH STATE.—Sub- 10 ject to the funds available under a funding allocation de- 11 termined under subsection (f) for a State, the Secretary 12 of Homeland Security may award to the State— 13 (1) up to 2 planning grants under subsection 14 (e) to develop or revise a cyber resiliency plan; and 15 (2) up to 2 implementation grants under sub- 16 section (f) to implement an active cyber resiliency 17 plan. 18 (d) APPROVAL OF CYBER RESILIENCY PLANS.— 19 (1) IN GENERAL.—The Secretary shall approve 20 a cyber resiliency plan submitted by a State if the 21 Secretary determines, after considering the rec- 22 ommendations of the Review Committee established 23 under subsection (i), that the plan meets all of the 24 following criteria: 25 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 3 •HR 2130 IH (A) The plan incorporates, to the extent 1 practicable, any existing plans of such State to 2 protect against cybersecurity threats or 3 vulnerabilities. 4 (B) The plan is designed to achieve each of 5 the following objectives, with respect to the es- 6 sential functions of such State: 7 (i) Enhancing the preparation, re- 8 sponse, and resiliency of computer net- 9 works, industrial control systems, and com- 10 munications systems performing such func- 11 tions against cybersecurity threats or 12 vulnerabilities. 13 (ii) Implementing a process of contin- 14 uous cybersecurity vulnerability assess- 15 ments and threat mitigation practices to 16 prevent the disruption of such functions by 17 an incident within the State. 18 (iii) Ensuring that entities performing 19 such functions within the State adopt gen- 20 erally recognized best practices and meth- 21 odologies with respect to cybersecurity, 22 such as the practices provided in the cyber- 23 security framework developed by the Na- 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 4 •HR 2130 IH tional Institute of Standards and Tech- 1 nology. 2 (iv) Mitigating talent gaps in the 3 State government cybersecurity workforce, 4 enhancing recruitment and retention ef- 5 forts for such workforce, and bolstering the 6 knowledge, skills, and abilities of State 7 government personnel to protect against 8 cybersecurity threats and vulnerabilities. 9 (v) Protecting public safety answering 10 points and other emergency communica- 11 tions and data networks from cybersecurity 12 threats or vulnerabilities. 13 (vi) Ensuring continuity of commu- 14 nications and data networks between enti- 15 ties performing such functions within the 16 State, in the event of a catastrophic dis- 17 ruption of such communications or net- 18 works. 19 (vii) Accounting for and mitigating, to 20 the greatest degree possible, cybersecurity 21 threats or vulnerabilities related to critical 22 infrastructure or key resources, the deg- 23 radation of which may impact the perform- 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 5 •HR 2130 IH ance of such functions within the State or 1 threaten public safety. 2 (viii) Providing appropriate commu- 3 nications capabilities to ensure cybersecu- 4 rity intelligence information-sharing and 5 the command and coordination capabilities 6 among entities performing such functions. 7 (ix) Developing and coordinating 8 strategies with respect to cybersecurity 9 threats or vulnerabilities in consultation 10 with— 11 (I) neighboring States or mem- 12 bers of an information sharing and 13 analysis organization; and 14 (II) as applicable, neighboring 15 countries. 16 (2) DURATION OF APPROVAL.— 17 (A) INITIAL DURATION.—An approval 18 under paragraph (1) shall be initially effective 19 for the 2-year period beginning on the date of 20 the determination described in such paragraph. 21 (B) ANNUAL EXTENSION.—The Secretary 22 may annually extend such approval for a 1-year 23 period, if the Secretary determines, after con- 24 sidering the recommendations of the Review 25 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 6 •HR 2130 IH Committee, that the plan continues to meet the 1 criteria described in paragraph (1) after the 2 State makes such revisions as the Secretary 3 may determine to be necessary. 4 (3) ESSENTIAL FUNCTIONS.—For purposes of 5 this subsection, the term ‘‘essential functions’’ in- 6 cludes, with respect to a State, those functions that 7 enhance the cybersecurity posture of the State, local 8 and tribal governments of the State, and the public 9 services they provide. 10 (e) PLANNING GRANTS.— 11 (1) INITIAL PLANNING GRANT.—The Secretary 12 shall require, as a condition of awarding an initial 13 planning grant, that the State seeking the grant— 14 (A) agrees to use the funds to develop a 15 cyber resiliency plan designed to meet the cri- 16 teria described in subsection (d)(1); and 17 (B) submits an application including such 18 information as the Secretary may determine to 19 be necessary. 20 (2) ELIGIBILITY FOR INITIAL PLANNING 21 GRANT.—A State shall not be eligible to receive an 22 initial planning grant after the date on which the 23 State first submits a cyber resiliency plan to the 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 7 •HR 2130 IH Secretary for a determination under subsection 1 (d)(1). 2 (3) ADDITIONAL PLANNING GRANT.—The Sec- 3 retary may award an additional planning grant to a 4 State if the State agrees to use the funds to revise 5 a cyber resiliency plan in order to receive an exten- 6 sion in accordance with subsection (d)(2)(B), and 7 submits an application including such information as 8 the Secretary may determine to be necessary. 9 (4) LIMITATIONS ON NUMBER AND TIMING OF 10 GRANTS.—A State shall not be eligible to receive— 11 (A) more than 2 planning grants under 12 this subsection; or 13 (B) an additional planning grant for the 14 fiscal year following the fiscal year for which it 15 receives an initial planning grant. 16 (f) IMPLEMENTATION GRANTS.— 17 (1) APPLICATION REQUIREMENTS.—The Sec- 18 retary shall require, as a condition of awarding a bi- 19 ennial implementation grant, that the State seeking 20 the grant submits an application including the fol- 21 lowing: 22 (A) A proposal, including a description and 23 timeline, of the activities to be funded by the 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 8 •HR 2130 IH grant as described by a cyber resiliency plan of 1 the State approved under subsection (d). 2 (B) A description of how each activity pro- 3 posed to be funded by the grant would achieve 4 one or more of the objectives described in sub- 5 section (d)(1)(B). 6 (C) A description, if applicable, of how any 7 prior biennial implementation grant awarded 8 under this section was spent, and to what ex- 9 tent the criteria described in subsection (d)(1) 10 were met. 11 (D) The share of any amounts awarded as 12 a biennial implementation grant proposed to be 13 distributed to local or tribal governments within 14 such State. 15 (E) Such other information as the Sec- 16 retary may determine to be necessary in con- 17 sultation with the chief information officer, 18 emergency managers, and senior public safety 19 officials of the State. 20 (2) APPROVAL OF APPLICATION.—The Sec- 21 retary shall consider the recommendations of the Re- 22 view Committee in approving or disapproving an ap- 23 plication for a biennial implementation grant. 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 9 •HR 2130 IH (3) DISTRIBUTION TO LOCAL AND TRIBAL GOV- 1 ERNMENTS.— 2 (A) IN GENERAL.—Not later than 45 days 3 after the date that a biennial implementation 4 grant is awarded, not less than 50 percent of 5 any share proposed under paragraph (1)(D) 6 shall be distributed to local or tribal govern- 7 ments, in the same manner that amounts 8 awarded under section 2004 of the Homeland 9 Security Act of 2002 (6 U.S.C. 605) are dis- 10 tributed to such governments, except that— 11 (i) no such distribution may be made 12 to a federally recognized Indian tribe that 13 is a State under subsection (k)(11)(B); 14 and 15 (ii) in applying section 2004(c)(1) of 16 such Act with respect to distributions 17 under this subparagraph, ‘‘100 percent’’ 18 shall be substituted for ‘‘80 percent’’ each 19 place that term appears. 20 (B) CONSULTATION.—In determining how 21 an implementation grant is distributed within a 22 State, the State shall consult with local and re- 23 gional chief information officers, emergency 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 10 •HR 2130 IH managers, and senior public safety officials of 1 the State. 2 (4) COMPETITIVE AWARD.—Except as provided 3 in subsection (h), biennial implementation grants 4 shall be awarded— 5 (A) exclusively on a competitive basis; and 6 (B) based on the recommendations of the 7 Review Committee. 8 (5) LIMITATION ON NUMBER OF GRANTS.—The 9 Secretary may award to a State not more than 2 bi- 10 ennial implementation grants under this section. 11 (g) USE OF GRANT FUNDS.— 12 (1) LIMITATIONS.—Any grant awarded under 13 this section shall supplement and not supplant State 14 or local funds or, as applicable, funds supplied by 15 the Bureau of Indian Affairs, and may not be 16 used— 17 (A) to provide any Federal cost-sharing 18 contribution on behalf of a State; or 19 (B) for any recreational or social purpose. 20 (2) APPROVED ACTIVITIES FOR IMPLEMENTA- 21 TION GRANTS.—A State or a government entity that 22 receives funds through a biennial implementation 23 grant may use such funds for one or more of the fol- 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 11 •HR 2130 IH lowing activities, to the extent that such activities 1 are proposed under subsection (f)(1)(A): 2 (A) Supporting or enhancing information 3 sharing and analysis organizations. 4 (B) Implementing or coordinating systems 5 and services that use cyber threat indicators (as 6 such term is defined in section 102 of the Cy- 7 bersecurity Information Sharing Act of 2015 (6 8 U.S.C. 1501)) to address cybersecurity threats 9 or vulnerabilities. 10 (C) Supporting dedicated cybersecurity 11 and communications coordination planning, in- 12 cluding the coordination of— 13 (i) emergency management elements 14 of such State; 15 (ii) National Guard units, as appro- 16 priate; 17 (iii) entities associated with critical in- 18 frastructure or key resources; 19 (iv) information sharing and analysis 20 organizations; 21 (v) public safety answering points; or 22 (vi) nongovernmental organizations 23 engaged in cybersecurity research as a for- 24 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 12 •HR 2130 IH mally designated information analysis and 1 sharing organization. 2 (D) Establishing programs, such as schol- 3 arships or apprenticeships, to provide financial 4 assistance to State residents who— 5 (i) pursue formal education, training, 6 and industry-recognized certifications for 7 careers in cybersecurity as identified by the 8 National Initiative for Cybersecurity Edu- 9 cation; and 10 (ii) commit to working for State gov- 11 ernment for a specified period of time. 12 (h) FUNDING ALLOCATIONS.— 13 (1) IN GENERAL.—From any amount appro- 14 priated for a fiscal year that is not reserved for use 15 by the Secretary in carrying out this section, the 16 Secretary shall allocate the entire amount among the 17 States (including the District of Columbia) eligible 18 for grants under this section taking into consider- 19 ation the factors specified in paragraph (2) and con- 20 sistent with the following: 21 (A) ALLOCATIONS FOR THE SEVERAL 22 STATES.—Of the amount subject to allocation, 23 a funding allocation for any of such States shall 24 be— 25 VerDate Sep 11 2014 03:50 Apr 18, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2130.IH H2130 kjohnson on DSK79L0C42 with BILLS 13 •HR 2130 IH (i) not less than 0.001 percent, with 1 respect to an initial planning grant, and 2 not more than 0.001 percent, with respect 3 to any additional planning grants; and 4 (ii) not less than 0.5 percent and not 5 more than 3 percent, with respect to bien- 6 nial implementation grants. 7 (B) ALLOCATIONS FOR THE TERRITORIES 8 AND POSSESSIONS.—Of the amount subject to 9 allocation, a funding allocation for any of the 10 territories and possessions of the United States 11 eligible for grants [Text truncated for display. Full text available on Congress.gov.]