Cybersecurity Awareness Grant

Cybersecurity Awareness Grant is sponsored by Michigan Department of Technology, Management & Budget. Provides funding for public awareness campaigns to promote cybersecurity best practices in Michigan.

Our nation faces unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure.

Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities. The State and Local Cybersecurity Grant Program (SLCGP) is administered by the Department of Homeland Security (DHS) and funded by the Infrastructure Investment and Jobs Act (IIJA).

The SLCGP is a reimbursable pass-through grant program with an overall goal to improve the cybersecurity posture of state, local and territorial (SLT) government organizations by providing assistance for managing and reducing systemic cyber risk through the following objectives: **Objective 1:**Develop and establish appropriate governance structures, including developing, implementing, or revising cybersecurity plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

**Objective 2:** Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments. **Objective 3:** Implement security protections commensurate with risk. **Objective 4:**Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

In Michigan, the SLCGP is administered by the Department of Technology, Management & Budget Cybersecurity and Infrastructure Protection division and the Michigan State and Local Cybersecurity Grant Program Advisory Board established Oct. 19, 2022.

## State and Local Cybersecurity Grant Program (SLCGP) Funding Information The State of Michigan was awarded the following for federal fiscal years (FFY): * $4,777,219 initial allocation for FY 2022. * Required 10% cost share match. * Notification of subrecipient awards has been completed.

* $9,609,530 initial allocation for FY 2023. * Required 20% cost share match. * Notification of subrecipient awards has been completed.

* $7,178,365 initial allocation for FY 2024. * Required 30% cost share match. * Notification of subrecipient awards has been completed.

* $2,346,859 initial allocation for FY 2025. * Required 40% cost share match. * Open application period to award funds to be determined.

The SLCGP grant award application process is detailed below: * FY 2024 grant funds were awarded to subrecipient projects submitted through the FY 2023 application process. * FY 2025: Application available date and application submission deadline to be determined. The following projects were approved by the State and Local Cybersecurity Grant Program Advisory Board.

Subrecipients were awarded funding to implement and complete projects by the end of FY 2022 period of performance in August 2026 and November 2026 respectively. Funding for FY 2022 is closed, and no additional applications will be accepted. Please contact DTMB-CIP-SLCGP@michigan.

gov if you have questions regarding FY 2022 grant funds.

* Procure, implement, and distribute advanced detection and response licensing and services, including endpoint detection and response (EDR), managed detection and response (MDR), extended detection and response (XDR), network detection and response (NDR), identity threat detection and response (ITDR), data detection and response (DDR), machine learning detection and response (MLDR), or other specialized detection and response monitoring areas.

* Structured, grant-funded evaluations designed to help state, local, and territorial (SLT) governments identify, assess, and mitigate cyber risks to their information systems.

Procure and implement cybersecurity services up to but not limited to vulnerability scanning, penetration testing, maturity assessments, industrial control systems (ICS/OT) assessments, compliance assessments, incident response readiness assessments, human and specific threat assessments, specialized services designed to identify, evaluate, and mitigate risks within an organization's IT infrastructure.

## State and Local Cybersecurity Grant Program (SLCGP) FY 2023 Projects The following projects were approved by the State and Local Cybersecurity Grant Program Advisory Board. Subrecipients were awarded funding to implement and complete projects by the end of the FY 2023 period of performance in August 2027. Funding for FY 2023 is closed, and no additional applications will be accepted.

Please contact DTMB-CIP-SLCGP@michigan. gov if you have any questions regarding FY 2023 grant funds. * Where jurisdictions can receive funding to purchase backup software, cloud services, backup servers, storage devices, or other services that support the recovery and reconstitution of entity backup data.

* Where jurisdictions can receive funding to purchase an independent cybersecurity assessment or penetration testing for the organization using existing MiDEAL negotiated contractors or another contracted vendor following the organization's established procurement policies and within grant performance and spend time frames.

* Where jurisdictions can receive funding to purchase subscriptions for cybersecurity awareness training for employees to better understand cyber threats, best practices, incident response, compliance, and policies. * Where jurisdictions can receive funding to purchase professional cybersecurity training for those responsible for mitigation risk and maintaining resiliency in the organization's environment.

* Where jurisdictions can receive funding to purchase subscriptions for EDR/MDR/XDR licensing vendor selected utilizing entities established procurement policies and grant performance and spend period time frames.

* Where jurisdictions can receive funding to pay managed service providers for cybersecurity services that mitigate risk, improve cyber resiliency, and perform cybersecurity work where an organization does not have onsite staff to support. * Where jurisdictions can receive funding to pay for services that support the migration of the organization's domain to a . gov domain.

Managed service provider (MSP) services to pay support vendors to perform migration tasks to a . gov domain. * Where jurisdictions can receive funding to purchase authentication devices, MFA software, or other systems/hardware supporting MFA, such as identity and access management (IAM) systems.

## State and Local Cybersecurity Grant Program (SLCGP) FY 2024 Projects The following projects were approved by the State and Local Cybersecurity Grant Program Advisory Board. Subrecipients were awarded funding to implement and complete projects by the end of the FY 2024 period of performance in August 2028. Applications submitted in the FY 2023 process were used to award subrecipients funding from FY 2024 funds.

FY 2024 funding opportunity is closed. Please contact DTMB-CIP-SLCGP@michigan. gov if you have questions regarding FY 2024 grant funds.

* Where jurisdictions can receive funding to purchase backup software, cloud services, backup servers, storage devices, or other services that support the recovery and reconstitution of entity backup data.

* Where jurisdictions can receive funding to purchase an independent cybersecurity assessment or penetration testing for the organization using existing MiDEAL negotiated contractors or another contracted vendor following the organization's established procurement policies and within grant performance and spend time frames.

* Where jurisdictions can receive funding to purchase subscriptions for cybersecurity awareness training for employees to better understand cyber threats, best practices, incident response, compliance, and policies. * Where jurisdictions can receive funding to purchase professional cybersecurity training for those responsible for mitigation risk and maintaining resiliency in the organization's environment.

* Where jurisdictions can receive funding to purchase subscriptions for EDR/MDR/XDR licensing vendor selected utilizing entities established procurement policies and grant performance and spend period time frames.

* Where jurisdictions can receive funding to pay managed service providers for cybersecurity services that mitigate risk, improve cyber resiliency, and perform cybersecurity work where an organization does not have onsite staff to support. * Where jurisdictions can receive funding to pay for services that support the migration of the organization's domain to a . gov domain.

Managed service provider (MSP) services to pay support vendors to perform migration tasks to a . gov domain. * Where jurisdictions can receive funding to purchase authentication devices, MFA software, or other systems/hardware supporting MFA, such as identity and access management (IAM) systems.

## State and Local Cybersecurity Grant Program (SLCGP) FY 2025 Projects The State and Local Cybersecurity Grant Program Advisory Board will meet to review the approved statewide cybersecurity plan and approved project areas. The board will consider identifying and adopting new project areas for funding with the FY 2025 funds. FY 2025 grant application, submission deadline, and notification of award are to be determined.

The end of period of performance for FY 2025 projects is August 2029. Please contact DTMB-CIP-SLCGP@michigan. govif you have questions regarding FY 2025 grant funds.

SLCGP is a reimbursement grant with a 30% match requirement for FY 2024 and a 40% match requirement for FY 2025. ## Eligibility Requirements Local government is defined in 6 U.S.C. § 101(13) as: A.)

A county, municipality, city, town, township, local public authority, school district, special district, intrastate district, council of governments, regional or interstate government entity, or an agency or instrumentality of a local government. B.) An Indian tribe or authorized tribal organization, or in Alaska a Native village or Alaska Regional Native Corporation: and C.)

A rural community, unincorporated town or village, or other public entity. Please visit the SLCGP background pagefor more information on eligibility and grant requirements. The following Michigan State Police grant formsare required to submit a reimbursement package: EMD-056, EMD-057, and EMD-054.

To submit a reimbursement package, use the specific link for each grant year. * FY 2024 (not currently available) * FY 2025 (not currently available) Cybersecurity & Infrastructure Security Agency's (CISA) cyber hygiene services are required services for grant compliance. Learn more about CISA's cyber hygiene services and enrollment instructions.