Program Overview/Background
In the Bipartisan Infrastructure Law, also known as the Infrastructure Investment and Jobs Act (IIJA), Congress established the State and Local Cybersecurity Grant Program (SLCGP) to “award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of, state, local, or tribal governments.”
Grant Year |
State Application |
Federal Award |
Local Sub-Recipient Application |
Local Award |
Period of Performance/ End Date |
| SLCGP – 2022 | State Application Complete |
Pending Federal Approval |
Pending- Available May 2023 |
Pending – Available June-July 2023 | 8/31/2026 |
| SLCGP – 2023 | State Application Available September 2023 |
Pending – Available December 2023 |
Available September 2023 |
Available January 2024 | 08/31/2027 |
Most Common Questions
Can my organization apply for this grant?
The only eligible entities that can apply for the SLCGP are States and Territories. Each State/Territory will submit a single application through the Governor designated State Administrative Agency (SAA) and funding will go directly to the SAA, who will then be responsible for distribution of the funds.
The Division of Technology Services (DTS) City/County Cybersecurity Outreach Program is acting in this capacity for the State of Utah and will apply for and manage the SLCGP funds each year.
As noted in additional FAQs below, several local government entities are eligible to receive benefit of the SLCGP, but they do not submit applications through the federal process. They will be able to submit applications for local projects to the State at a later date.
What types of organizations are eligible to receive funding through the SLCGP?
Counties, cities, towns, school districts, higher education institutions, individual state agencies, branches of state governments, quasi-governmental public utilities, special districts, public health, and non-profit organizations are all eligible to receive benefit of the grant.
How much money is available to Utah through the SLCGP and for how many years?
The amount available varies each year but for the first year there will be approximately $2.6 million available for this first year of the grant cycle. The SLCGP will be awarded to Utah each year for the next four years starting with FY2022.
Funds are limited and are not able to support all of the needs of all of the eligible entities. The SLCGP is meant to act as a way for the Federal Government through the State to help kick off cybersecurity programs that will later need to be sustained through other methods, including through state and local funds and projects.
How will the SLCGP funds be allocated?
80% of the funds received by the State must pass-through to benefit the local governments, including 25% of those funds to rural areas. The grant can be allocated in the form of funds, services, items, and capabilities. Ultimately, it is up to the State with the assistance of the Utah Cybersecurity Commission to decide the most effective use of the pass-through, whether that is items, capabilities, services, or funds. The Commission will also play an active role in deciding which local projects are accepted in accordance with approved uses in the SLCGP guidance.
The remaining 20% of the funds go to the State of Utah to manage the grant and improve cybersecurity for the State government in the same manner as the local government entities. The State intends to use the apportioned 20% to benefit local entities in the same manner as the rest of the funds. Effectively 100% of the funds are intended to be used to help improve cybersecurity within local governments according to the cybersecurity guidelines outlined in the SLCGP Guidance.
Who makes up the Utah Cybersecurity Commission?
The Utah Cybersecurity Commission is outlined in Utah Code under Title 63C Chapter 27. The Commission is made up of representatives from several state entities, the State Senate and House, Utah League of Cities and Towns, Utah Association of Counties, among others. It also includes several subject matter expert advisors from the DHS Cybersecurity & Infrastructure Security Agency (CISA) and several private entities. The majority of the representatives on the Commission have cybersecurity experience.
Are there any funding match requirements?
For applications made by an individual eligible entity, the FY 2022 non-federal cost-share or match requirement is 10%. For example, if a local entity estimates the total cost of a project is $100,000, the local entity’s cost share will be 10% or $10,000. The cost share must be at the activity (i.e., project(s)) level. The cost share cannot be spread across multiple activities, or a project(s) supporting different Investments, requested by the same entity. This cost share will increase in following grant awards years.
Are there any requirements for receiving funds from the SLCGP?
Yes. Local entities that are awarded funds are expected to participate in several free services offered by the Cybersecurity & Infrastructure Security Agency (CISA), as well as participate in the Nationwide Cybersecurity Review (NCSR).
What steps need to take place before funds can be allocated to local entities?
In order for the funds to be released the State needs to complete an assessment (snapshot) of the cybersecurity maturity of Utah entities. Then develop a Statewide Cybersecurity Plan outlining the gaps and needs that exist throughout the state and how the funds will meet the goals and objectives within the SLCGP guidance and help to fill those gaps.
In addition to the above, the City/County Cybersecurity Outreach team is reaching out to IT professionals within the local entities to provide an anonymous 1 to 2 minute survey to capture the needs and desires of the local government entities.
When can we expect to know more details on how to apply for funds locally?
Once the Statewide Cybersecurity Plan/Assessment is complete, which is slated for March 2023 the funds will be available for use. Just prior to this time the City/County Cybersecurity Outreach team will send out information to eligible entities, with application forms, detailing fund availability amounts and details for submission.
How can we indicate to our state that we are interested in being a part of the grant at the local level?
Reach out to us via our contact page to express your interest. We will keep a list of interested parties to send information to as details are further worked out.
Additional Questions?
Additional Resources
For an extensive list of commonly asked questions and information about the SLCGP please visit, https://www.cisa.gov/cybergrants-faq.
