Federal cyber grants could foster greater cooperation between state, local governments
GettyImages/gremlin
States can provide cybersecurity services to local governments in lieu of cash funding, DHS said, while required planning committees can comprise many stakeholders.
As state and local governments prepare to apply for federal cybersecurity grants, observers said the money could foster better cooperation across the various levels of government – even as many questions remain unanswered.
The Department of Homeland Security last week unveiled more details about its long-awaited cybersecurity program, part of the Bipartisan Infrastructure Law that provides $1 billion over four years. With the release of an official Notice of Funding Opportunity, state and local governments have more clarity on what will be expected of their applications.
The State and Local Cybersecurity Grant Program requires states to allocate at least 80% of their funding to local and rural communities, but the NOFO said that states can provide localities with “items, services, capabilities, or activities on a state-wide basis” instead of cash, with those governments’ permission.
“That might be cyber assessments, it might be helping address vulnerabilities in migrating to better data management, or helping implement multifactor authentication,” Alex Whitaker, director of government affairs at the National Association of State Chief Information Officers, said, citing examples of the types of services states could provide.
However, Whitaker said while there is still uncertainty on what constitutes a local government giving consent for those services to be passed down from the states, the mandate to form a cybersecurity planning committee could help formalize that.
States will receive at least $2 million apiece for FY 22 for their planning committees, which will be required to include local governments as well as representatives of other sectors like public health and education.
The NOFO also “strongly encourages” others to be named to the planning committee, like those responsible for critical infrastructure, law enforcement or any other entity “with expertise and skillsets that best represent the cybersecurity interests across the eligible entity.”
“We are excited for the work that can happen between these stakeholders that haven't historically had much conversation about cybersecurity,” Whitaker said. “In addition to the money, it's improving the trust and improving the relationships, and I think that'll be effective.”
Others warned that cybersecurity planning should already be underway, otherwise some governments could find themselves left behind.
“Expect states that have coordinated with local governments already to prepare formal plans and establish the required cybersecurity governance committees, to be first in line to receive and distribute funding this year,” Jim Richberg, public sector field chief information security officer and vice president of information security at cybersecurity software company Fortinet, said in an email.
Some states have already looked to better coordinate their approach to cybersecurity across departments and with local governments by appointing chief cyber officers. Colin Ahern, CCO for New York, said previously that centralized planning helps bolster that cooperation.
“We're actively players, in addition to being coaches and referees,” he said. “The state is looking to be in the game with you.”
This round of grant funding, which Whitaker said is possibly the largest federal investment ever in cybersecurity, comes as state and local governments face ever-increasing cyberthreats, including to critical infrastructure. The Los Angeles Unified School District was one of the latest high-profile victims of an attack disrupting systems, while Fremont County, Colorado, was impacted by what officials there called a “cybersecurity event” that took many government services offline.
Observers said this DHS funding will not be the last for cybersecurity in state and local governments. Richberg said the infrastructure law represents a “priming of the pump on the investments needed to address existing cyber problems.” Lawmakers echoed those sentiments.
“This funding is a vital down payment toward addressing our state and local cybersecurity challenges, and Congress must ensure that we continue to build on this support in the future,” said Rep. Bennie G. Thompson (D-Miss.), chairman of the House Committee on Homeland Security, and Rep. Yvette D. Clarke (D-N.Y.), chairwoman of the Subcommittee on Cybersecurity, Infrastructure Protection, & Innovation, in a joint statement.
NEXT STORY: Ransomware task force outlines threat response