Cybersecurity Policy Report, State, Local Governments Need Sustained Cyber Funding, Lawmakers Told, (Apr 1, 2025)

By Tom Leithauser

An executive order (EO) recently issued by President Trump that gives state and local governments more responsibility for defending themselves against cyber attacks is among the reasons Congress should reauthorize a grant program that helps fund state and local cyber defenses, a House subcommittee was told today.

Last month’s EO on emergency preparedness established a federal policy “that State and local governments and individuals [should] play a more active and significant role in national resilience and preparedness” (TR Daily, March 19).

The EO will place new pressure on state and local governments to find resources for cyber defense, Robert Huber, chief security officer at Tenable, Inc., told the House Homeland Security Committee’s cybersecurity and infrastructure protection subcommittee.

“Given the ongoing threats and increasing responsibilities of state and local governments in managing cybersecurity risks, the State and Local Cybersecurity Grant Program (SLCGP) is more important than ever,” Mr. Huber said in written testimony.

The purpose of today’s hearing was to consider the reauthorization of the SLCGP, which was launched in 2022 to provide $1 billion over four years to help state and local governments assess their cybersecurity needs and develop programs to address those needs (TR Daily, Sept. 12, 2022).

But the program expires at the end of September, and witnesses from state and local governments urged the subcommittee to support its reauthorization.

Alan Fuller, chief information officer for the state of Utah, told the panel that SLCGP funds helped the state block ransomware attacks on a regional airport and a 911 dispatch center.

Utah has used its grant funds to establish a “comprehensive cybersecurity initiative” across 140 state government bodies, Mr. Fuller said in written testimony.

“This encompasses 23 counties, 94 municipalities, and 23 special districts. Consequently, endpoint security has been provisioned for over 26,000 devices, and cybersecurity awareness training, augmented with simulated phishing exercises, is being delivered to 31,000 local government employees,” he testified.

All of the witnesses at today’s hearing agreed that the program should be reauthorized, possibly for longer than a four-year cycle, to enable state and local governments to continue building out their cyber defenses.

But some witnesses suggested minor changes to the program. Kevin Kramer, first vice president for the National League of Cities (NLC) and a member of the Louisville, Kentucky, Metro Council, said Congress should allow large cities to receive funds directly from the federal government rather than having to apply to their state governments.

“Larger jurisdictions such as Louisville Metro Government are well-positioned to apply directly for a competitive federal cybersecurity grant, and requiring all municipalities to apply for a state passthrough only increases the amount of public dollars spent on program administration,” Mr. Kramer said in written testimony.

“NLC encourages Congress to create a direct competitive grant fund within the SLCGP for larger municipalities to apply for directly,” he said.

One useful aspect of the SLCGP, according to Mark Raymond, CIO for the state of Connecticut, is that the Cybersecurity and Infrastructure Security Agency, which administers the program in partnership with the Federal Emergency Management Agency, requires state and local governments to establish cybersecurity plans before they receive funding.

“The process of developing the cybersecurity plan required by CISA to receive grant funding has meant that cyber incident responders and those tasked with protecting critical technology infrastructure are meeting and collaborating before attacks take place rather than during or after,” Mr. Raymond said in written testimony.

Reps. Andrew Garbarino (R., N.Y.), the subcommittee’s chairman, and Eric Swalwell (D., Calif.), its ranking member, also seemed to agree on the importance of the program.

“It’s important to remember that cyber attacks hit Republican districts and Democratic districts. They’re in blue states and red states. They’re in urban areas, suburban areas, and rural areas,” Rep. Swalwell said.

“Reauthorizing the cybersecurity grant program is necessary to ensure we do not take our foot off the gas at this critical time, and passing a reauthorization bill before this program expires in September is one of my top priorities on this committee,” he said.

Rep. Garbarino noted that many state and local governments operate critical infrastructure, such as municipal water systems.

“Despite often lacking resources and qualified talent for cybersecurity, state and local governments host the key pieces of critical infrastructure that keep our economy running. If left unprotected, this presents a huge vulnerability,” he said.

“With that said, we know that the program does not come without its challenges,” Rep. Garbarino added. “As we consider reauthorization, we want to understand any administrative burdens or barriers to ensure state, local, and territorial governments can focus on cyber resiliency and preparedness.”

MainStory: TopStory FederalLegislation DataSecurity