State and Local IT Modernization and Cybersecurity Act

I 116TH CONGRESS 2D SESSION H. R. 8048 To establish in the Department of Homeland Security a program to make grants for emergency information technology expenses, and for other purposes. IN THE HOUSE OF REPRESENTATIVES AUGUST 14, 2020 Mr. LANGEVIN (for himself, Mr. GALLAGHER, Mr. RUPPERSBERGER, Mr. HURD of Texas, Mr. RICHMOND, Mr. MCCAUL, Mr. ROSE of New York, and Mr. BACON) introduced the following bill; which was referred to the Committee on Homeland Security, and in addition to the Committees on Oversight and Reform, and Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee con- cerned A BILL To establish in the Department of Homeland Security a program to make grants for emergency information tech- nology expenses, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘State and Local IT 4 Modernization and Cybersecurity Act’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 2 •HR 8048 IH (1) AGENCY.—The term ‘‘Agency’’ means the 1 Cybersecurity and Infrastructure Security Agency of 2 the Department of Homeland Security. 3 (2) APPROPRIATE CONGRESSIONAL COMMIT- 4 TEES.—The term ‘‘appropriate congressional com- 5 mittees’’ means— 6 (A) the Committee on Homeland Security 7 and Governmental Affairs of the Senate; and 8 (B) the Committee on Homeland Security 9 of the House of Representatives. 10 (3) COVERED INFORMATION TECHNOLOGY.—In 11 this section, the term ‘‘covered information tech- 12 nology’’ includes the following information tech- 13 nology: 14 (A) Enterprise productivity tools, includ- 15 ing— 16 (i) email services; 17 (ii) computer software for the pur- 18 poses of managing payroll and budget; 19 (iii) personnel management solutions; 20 and 21 (iv) customer relationship manage- 22 ment software relating to the provision of 23 services to users of such services. 24 (B) Cybersecurity services and tools. 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 3 •HR 8048 IH (C) Computer networking equipment. 1 (4) COVERED INFORMATION TECHNOLOGY 2 SERVICES.—The term ‘‘covered information tech- 3 nology services’’ means any service necessary to in- 4 stall, implement, maintain, or upgrade covered infor- 5 mation technology. 6 (5) DEPARTMENT.—The term ‘‘Department’’ 7 means the Department of Homeland Security. 8 (6) DIRECTOR.—The term ‘‘Director’’ means 9 the Director of the Cybersecurity and Infrastructure 10 Security Agency of the Department of Homeland Se- 11 curity. 12 (7) EMERGENCY INFORMATION TECHNOLOGY 13 EXPENSES.—The term ‘‘emergency information 14 technology expenses’’ means expenses related to— 15 (A) improving covered information tech- 16 nology; 17 (B) conducting covered information tech- 18 nology services; 19 (C) subsidizing payroll for information 20 technology staff to maintain the current staff- 21 ing level; or 22 (D) government employees having the nec- 23 essary covered information technology to 24 telework. 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 4 •HR 8048 IH (8) FISCAL YEAR.—The term ‘‘fiscal year’’ has 1 the meaning given the term under the State or local 2 law of the relevant grant recipient. 3 (9) INFORMATION TECHNOLOGY.—The term 4 ‘‘information technology’’ has the meaning given the 5 term in section 11101 of title 40, United States 6 Code. 7 (10) PUBLIC HEALTH EMERGENCY.—The term 8 ‘‘public health emergency’’ means the public health 9 emergency declared by the Secretary of Health and 10 Human Services pursuant to section 319 of the Pub- 11 lic Health Service Act (42 U.S.C. 247d) on January 12 31, 2020, with respect to COVID–19. 13 (11) SECRETARY.—The term ‘‘Secretary’’ 14 means the Secretary of Homeland Security. 15 (12) STATE.—The term ‘‘State’’ has the mean- 16 ing given the term in section 311 of title 5, United 17 States Code. 18 (13) TRIBAL GOVERNMENT.—The term ‘‘Tribal 19 government’’ has the meaning given the term in sec- 20 tion 421(13) of the Congressional Budget and Im- 21 poundment Control Act of 1974 (2 U.S.C. 658(13)). 22 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 5 •HR 8048 IH SEC. 3. PUBLIC HEALTH EMERGENCY INFORMATION TECH- 1 NOLOGY GRANT PROGRAM. 2 (a) ESTABLISHMENT.—There is established in the 3 Department a program to be known as the ‘‘Public Health 4 Emergency Information Technology Grant Program’’ (in 5 this section referred to as the ‘‘Public Health Emergency 6 IT Grant Program’’), under which the Secretary may 7 award grants to States for emergency information tech- 8 nology expenses during the public health emergency. 9 (b) APPLICATION.—Each State may apply for a grant 10 under the Public Health Emergency IT Grant Program, 11 and shall submit such information in support of such a 12 grant as the Secretary may require. 13 (c) ALLOCATION OF FUNDS.— 14 (1) TRIBAL GOVERNMENTS.—Grants to Tribal 15 governments under the Public Health Emergency IT 16 Grant Program may not exceed $25,000,000 in the 17 aggregate. 18 (2) ADMINISTRATION AND OVERSIGHT.—The 19 Secretary may not expend more than $10,000,000 20 for administration of the Public Health Emergency 21 IT Grant Program. 22 (d) CONDITIONS ON RECEIPT OF GRANT.— 23 (1) MANAGEMENT OF FUNDS.—To be eligible 24 for a grant under the Public Health Emergency IT 25 Grant Program, a State shall agree to designate the 26 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 6 •HR 8048 IH Chief Information Officer, or an equivalent official, 1 of the State as the primary official for the manage- 2 ment and allocation of funds awarded under the 3 Public Health Emergency IT Grant Program. 4 (2) SECURITY STANDARDS AND CERTIFI- 5 CATIONS.— 6 (A) IN GENERAL.—Not later than 90 days 7 after the date of the enactment of this Act, the 8 Secretary, in consultation with the Secretary of 9 Commerce, shall select commonly accepted secu- 10 rity standards and certifications with respect to 11 covered information technology. 12 (B) SECURITY STANDARDS AND CERTIFI- 13 CATIONS REQUIRED.—To be eligible for a grant 14 under the Public Health Emergency IT Grant 15 Program, a State shall agree to procure only 16 covered information technology that meets or 17 exceeds the standards and certifications selected 18 pursuant to paragraph (1) with funds made 19 available under such Program. 20 (e) GRANTS.— 21 (1) SINGLE GRANT.—A State may not receive 22 more than one grant under the Public Health Emer- 23 gency IT Grant Program. 24 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 7 •HR 8048 IH (2) GRANT AMOUNTS.—The Secretary may 1 award grants to States under the Public Health 2 Emergency IT Grant Program on the basis of the 3 population of such State, except no grant awarded 4 under such Program may be less than $5,000,000. 5 (f) SUBGRANTS.—Each State that receives a grant 6 under the Public Health Emergency IT Grant Program 7 shall reserve not less than 40 percent of amounts received 8 for the purpose of making subgrants to local governments 9 within such State— 10 (1) for emergency information technology ex- 11 penses; or 12 (2) to purchase licenses for covered information 13 technology on behalf of such local governments. 14 (g) RETURN OF FUNDS.—Amounts received by 15 States under the Public Health Emergency IT Grant Pro- 16 gram that are not expended by the date that is two years 17 after the date of the receipt of such funds shall be re- 18 turned to the Treasury of the United States. 19 (h) REPORTS.— 20 (1) REPORTS BY GRANT RECIPIENTS.—Not 21 later than 180 days after receiving a grant under 22 the Public Health Emergency IT Grant Program, a 23 recipient of such grant shall submit to the Secretary 24 a report that— 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 8 •HR 8048 IH (A) describes how grant funds were obli- 1 gated or expended, including the use of funds 2 made available as subgrants; and 3 (B) demonstrates compliance by such re- 4 cipient and subgrantee with the requirements of 5 such Program. 6 (2) ANNUAL REPORT TO CONGRESS.—Not later 7 than 1 year after the date of the enactment of this 8 Act and annually thereafter until all funds under the 9 Public Health Emergency IT Grant Program are ex- 10 pended or returned to the Treasury of the United 11 States, the Secretary shall submit to the appropriate 12 congressional committees a report that— 13 (A) describes how grant funds were obli- 14 gated or expended, including the use of funds 15 made available as subgrants; and 16 (B) demonstrates compliance by each re- 17 cipient and subgrantee with the requirements of 18 such Program. 19 (i) AUTHORIZATION OF APPROPRIATIONS.—There is 20 authorized to be appropriated $1,000,000,000 for grants 21 under the Public Health Emergency IT Grant Program. 22 Amounts authorized to be appropriated pursuant to this 23 subsection are authorized to remain available until Sep- 24 tember 30, 2022. 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 9 •HR 8048 IH SEC. 4. MODERNIZING IT GRANT PROGRAM. 1 (a) ESTABLISHMENT.—There is established in the 2 Department a program to be known as the ‘‘Modernizing 3 IT Grant Program’’, under which the Secretary may make 4 grants to States to modernize information technology for 5 the purpose of securely enabling digital delivery of govern- 6 ment services, including the digital delivery of— 7 (1) emergency services; 8 (2) government benefit and entitlement pro- 9 grams; and 10 (3) administrative services performed by a 11 State. 12 (b) ELIGIBILITY.—To be eligible for a grant under 13 the Modernizing IT Grant Program, a State shall— 14 (1) with respect to fiscal years 2021, 2022, and 15 2023, maintain the funding levels of the lesser of fis- 16 cal year 2019, or the average of fiscal years 2017, 17 2018, and 2019, with respect to information tech- 18 nology support and modernization; and 19 (2) provide matching funds equal to 5 percent 20 of the amount of any grant received under the Mod- 21 ernizing IT Grant Program. 22 (c) APPLICATION.— 23 (1) IN GENERAL.—Each State may apply for a 24 grant under the Modernizing IT Grant Program, 25 and shall submit such information in support of 26 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 10 •HR 8048 IH such a grant as the Secretary may require, including 1 the following: 2 (A) A State information technology mod- 3 ernization plan, including— 4 (i) a description of existing informa- 5 tion technology; 6 (ii) the costs related to maintenance 7 of existing information technology; 8 (iii) a compilation of recent security 9 audits of existing information technology; 10 (iv) a compilation of recent oper- 11 ational performance reports of existing in- 12 formation technology; 13 (v) a methodology to prioritize 14 projects and procurement to account for— 15 (I) security gains; 16 (II) operational gains; and 17 (III) cost; and 18 (vi) a transition plan to modernize ex- 19 isting information technology, including— 20 (I) a comparative analysis of 21 cloud-based versus on-premise solu- 22 tions; and 23 (II) an estimate of operation and 24 maintenance costs for the information 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 11 •HR 8048 IH technology to be procured under such 1 transition plan. 2 (B) A local government information tech- 3 nology modernization plan describing how 4 grants awarded under the Modernizing IT 5 Grant Program will be used to provide— 6 (i) subgrants to local governments to 7 modernize their information technology 8 supporting digital delivery of government 9 services; or 10 (ii) shared services to local govern- 11 ments to support the digital delivery of 12 government services. 13 (2) APPLICATION EVALUATION.—The Sec- 14 retary, acting through the Director, and in consulta- 15 tion with the Administrator of General Services, 16 shall evaluate each application for a grant under the 17 Modernizing IT Grant Program with respect to the 18 appropriateness of the information technology mod- 19 ernization plan to improve cybersecurity and en- 20 hance the capability to effectively deliver digital gov- 21 ernment services. 22 (3) TECHNICAL ASSISTANCE.—The Director 23 may provide technical assistance to States applying 24 for a grant under the Modernizing IT Grant Pro- 25 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD with BILLS 12 •HR 8048 IH gram with respect to State and local government in- 1 formation technology modernization plans described 2 in paragraph (1)(B). 3 (d) CONDITIONS ON RECEIPT OF GRANT.— 4 (1) MANAGEMENT OF FUNDS.—To be eligible 5 for a grant under the Modernizing IT Grant Pro- 6 gram, a State shall agree to designate the Chief In- 7 formation Officer, or an equivalent official, of the 8 State as the primary official for the management 9 and allocation of funds awarded under the Modern- 10 izing IT Grant Program. 11 (2) SECURITY STANDARDS AND CERTIFI- 12 CATIONS.— 13 (A) IN GENERAL.—Not later than 1 year 14 after the date of the enactment of this Act, the 15 Secretary, in consultation with the Secretary of 16 Commerce, shall select commonly accepted secu- 17 rity standards and certifications with respect to 18 information technology. 19 (B) SECURITY STANDARDS AND CERTIFI- 20 CATIONS REQUIRED.—To be eligible for a grant 21 under the Modernizing IT Grant Program, a 22 State shall agree to procure only information 23 technology that meets or exceeds the standards 24 VerDate Sep 11 2014 00:26 Sep 02, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H8048.IH H8048 pbinns on DSKJLVW7X2PROD wit [Text truncated for display. Full text available on Congress.gov.]