DOHS Program Fact Sheet

Fiscal Year 2023 State and Local
Cybersecurity Grant Program Fact Sheet 
Release Date: Aug 7, 2023
Download a PDF copy of this webpage.
In fiscal year 2023, through the Infrastructure Investment and Jobs Act, the U.S.
Department of Homeland Security (DHS) is providing $374.9 million to address
cybersecurity risks and threats to information systems owned, operated by, or on
behalf of state, local, tribal and territorial governments. 
Overview
The goal of the State and Local Cybersecurity Grant Program (SLCGP) is to help
states and territories, specifically rural and local communities, address
cybersecurity risks and cybersecurity threats. The SLCGP enables DHS to make
targeted cybersecurity investments in state, local, tribal and territorial (SLTT)
government agencies, thus improving the security of critical infrastructure and
resilience of the services SLT governments provide to their community.
Goals and Objectives
The Federal Emergency Management Agency (FEMA) and the Cybersecurity and
Infrastructure Security Agency (CISA) created a series of overarching goals and
objectives for the SLCGP based on input from SLTT stakeholders and
associations, and consideration of national priorities, frameworks, and the national
cyber threat environment:  
1. Implement cyber governance and planning; 
2. Assess and evaluate systems and capabilities;
3. Mitigate prioritized issues; and 
4. Build a cybersecurity workforce.
Funding 
Page 1 of 5
Page printed at fema.gov/fact-sheet/fiscal-year-2023-state-and-local-cybersecurity-grant-
program-fact-sheet
06/05/2024

In FY 2023, $374.9 million is available under the SLCGP. Each state and
territory will receive a funding allocation as determined by the statutory formula.
Allocations for states and territories include a base level as defined for each entity:
1% for each state, the District of Columbia, and the Commonwealth of Puerto
Rico; and 0.25% for American Samoa, the Commonwealth of the Northern
Mariana Islands, Guam, and the U.S. Virgin Islands. State allocations include
additional funds based on a combination of state and rural population totals. 80%
of total state or territory allocations must support local entities, while 25% of the
total state or territory allocations must support rural entities.
Eligibility
All 56 states and territories, including any state of the United States, the District of
Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam,
American Samoa, and the Commonwealth of the Northern Mariana Islands, are
eligible to apply for SLCGP funds. The Governor-designated SLCGP State
Administrative Agency (SAA) is the only entity eligible to submit SLCGP
applications to DHS/FEMA.
Funding Guidelines
Pass-Through Requirements 
The SLCGP SAA recipient must pass through at least 80% of the federal funds
provided under the grant to local governments, and 25% of the federal funds must
be provided to local jurisdictions within rural areas of the state or territory. The
pass-through to rural entities is part of the overall 80% pass-through requirement
to local governments. All pass-through entities must meet all program and grant
administration requirements. See 2 C.F.R. § 200.332. For a description of eligible
subrecipients, please see Section C.1.b. of the FY 2023 SLCGP Notice of Funding
Opportunity (NOFO).
FEMA interprets the date that an entity “receives a grant” to be the date upon
which FEMA releases the funding hold in the ND Grants system. Therefore, the
45-day pass through requirement starts on the date when the amendment is
issued in ND Grants and FEMA makes the funding available to the SAA for
drawdown. After the funds have been released, FY 2023 SLCGP recipients must
Page 2 of 5
Page printed at fema.gov/fact-sheet/fiscal-year-2023-state-and-local-cybersecurity-grant-
program-fact-sheet
06/05/2024

submit a letter to FEMA signed by the Authorized Official listed on the grant award
certifying that they have met the 45-day pass-through requirement and collected
any signed local government consents. Local consents must be signed by the
Authorized Official, or designee, for the local government entity receiving the
items, services, capabilities, or activities in lieu of funding, and the consent must
specify the amount and intended use of the funds. This letter is due no later than
10 calendar days after the 45-day period for issuing pass-through funding has
passed. The letter should be emailed to FEMA-SLCGP@fema.dhs.gov. FEMA will
send a copy of the letter to CISA.
Pass-through is defined as an obligation on the part of the entity or multi-entity
group to make funds available to local units of government, combinations of local
units, Tribal Nations, or other specific groups or organizations. Four requirements
must be met to pass-through grant funds:
The SLCGP SAA must make a firm written commitment to passing through
grant funds or equivalent services to local government subrecipients;
The SLCGP SAA’s commitment must be unconditional (i.e., no contingencies
for the availability of eligible entity funds).
There must be documentation (i.e., subgrant award document with terms and
conditions) of the commitment; and
The award terms must be communicated to the local subrecipient.
Multi-Entity Projects
Multiple eligible entities (states or territories) can group together to address
cybersecurity risks and threats to information systems within the eligible entities’
jurisdictions. There is no separate funding for multi-entity projects. Instead, these
investments would be considered as group projects: each group member
contributes an agreed-upon funding amount from their SLCGP award to the
overall project. Each group member’s financial contribution is then funded from
their individual SLCGP award. Each participating state or territory in the group
should include the multi-entity project in their individual Investment Justification
(IJ) submissions with their application. It is expected that IJs for multi-entity
projects will be almost identical. Any differences should be as a result of alignment
with each group member’s respective Cybersecurity Plan.
Cost-Share Requirements
Page 3 of 5
Page printed at fema.gov/fact-sheet/fiscal-year-2023-state-and-local-cybersecurity-grant-
program-fact-sheet
06/05/2024

Eligible entities must meet a 20% cost share requirement for the FY 2023 SLCGP
except for Multi-Entity Projects which require a 10% cost share. The recipient
contribution can be cash (hard match) or third-party in-kind (soft match). Eligible
applicants must agree to make available non-federal funds to carry out an SLCGP
award in an amount not less than 20% of the total project costs (federal award
amount plus cost share amount). For FY 2023, in accordance with 48 U.S.C. §
1469a, cost share requirements are waived for the following: American Samoa,
Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana
Islands.
Unless otherwise authorized by law, federal funds cannot be matched with other
federal funds. The recipient’s contribution should be specifically identified. These
non-federal contributions have the same eligibility requirements as the federal
share. 
The Secretary of Homeland Security may waive or modify the non-federal share
for an individual entity if the entity demonstrates economic hardship. More
information on what constitutes economic hardship, and how to request a cost-
share waiver, will be forthcoming. 
For a multi-entity group project, the cost share is 10% for the FY 2023 SLCGP.
Application Process
Applying for an award under the SLCGP is a multi-step process. Applicants are
encouraged to register early, as the registration process can take four weeks or
more to complete. Registration should be done in sufficient time to ensure it does
not impact your ability to meet required submission deadline. 
Eligible applicants should submit their initial application at least one week before
the final application submission through the grants.gov portal at www.grants.gov.
Applicants needing Grants.gov support may contact the Grants.gov customer
support hotline at (800) 518-4726, which is available 24 hours per day, seven
days per week except federal holidays. Please refer to Section D in the FY 2023
SLCGP funding notice for detailed information and instructions. 
Page 4 of 5
Page printed at fema.gov/fact-sheet/fiscal-year-2023-state-and-local-cybersecurity-grant-
program-fact-sheet
06/05/2024

Eligible applicants will be notified by FEMA within one to two business days and
asked to proceed with submitting their complete application package in the Non-
Disaster (ND) Grants System by the application deadline. Applicants needing
technical support with the ND Grants System should contact 
ndgrants@fema.dhs.gov or (800) 865-4076, Monday through Friday from 9 a.m. –
6 p.m. ET (ET). Completed applications must be submitted no later than 5 p.m. ET
on Friday, October 6, 2023. 
SLCGP Resources
There are a variety of resources available to address programmatic, technical and
financial questions, which can assist with SLCGP applications:
The FY 2023 SLCGP funding notice is located online at grants.gov .
For additional program-specific information, please email FEMA-
SLCGP@fema.dhs.gov.
For support regarding financial grants management and budgetary technical
assistance, applicants may contact the FEMA Award Administration Help Desk,
via e-mail at ASK-GMD@fema.dhs.gov.
 
Page 5 of 5
Page printed at fema.gov/fact-sheet/fiscal-year-2023-state-and-local-cybersecurity-grant-
program-fact-sheet
06/05/2024