State and Local Cybersecurity Grant Program (SLCGP)

State and Local Cybersecurity Grant Program (SLCGP) is sponsored by New Jersey Office of Homeland Security and Preparedness (NJOHSP) / New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). A federal grant program administered by DHS and funded by the Infrastructure Investment and Jobs Act (IIJA). The goal is to improve the cybersecurity posture of state, local, and territorial government organizations.

NJ's Current Cyber Alert Level: "ELEVATED". More . .

. OFFICIAL SITE OF THE STATE OF NEW JERSEYGovernor Mikie Sherrill ReportCareersPortal LoginMembership LEARN MORE Learn More about * Report a Cybersecurity Incident * Guidance and Best Practices * Multi-Factor Authentication * Passwords, Passwords, Passwords * Artificial Intelligence * ChatGPT and Its Impact on Cybersecurity * Is Seeing Believing?

A Look into Deepfakes * Seeing AI to AI: Artificial Intelligence and its Impact on Cybersecurity * Identity and Access Management & Patch Management * NJCCIC Resources Overview * Be Prepared: NJCCIC Cybersecurity Survival Guide * Cybersecurity for Small & Medium-Sized Businesses * Business Beware: The Growing Threat of Fake Client Schemes * Cyber Threats to Houses of Worship and Faith-Based Organizations * Importance of Digital Spring Cleaning and Practical Tips * Back-to-School Cybersecurity * Backups: The Cure to Viral Cyber Infections * Stay Cyber Safe During the Holidays * How Big is Your Footprint?

* Information Asset Management * Securing All Your Shiny New Connected Devices * The Nefarious Use of Bluetooth Tracking Devices * IoT Device Security and Privacy * Guide to Accessing Your Android Device’s Security & Privacy Settings * User Beware: Your Smartphone Is Tracking Your Every Move * Compromised Email Accounts * Phishing and Other Social Engineering Attacks * Sender Policy Framework - SPF Guide * Identity Theft & Privacy * Tax Scams and Identity Theft: What You Need to Know * Privacy and Security Concerns of Software and Services * Compromised PII and Identity Theft Resources and Recommendations * Keeping Children Safe Online * Malvertising: More than a Nuisance * Browser Push Notifications * Doxing: Threat Mitigation Guide * Swatting: Threat Mitigation Guide * Resources for Businesses & Government * SaaS Terms and Conditions - Contracting Tips * Cloud Incident Response * Don't Be Fooled: Ways to Prevent BEC Victimization * Considering Cyber Insurance?

What You Need to Know * Guide to Accessing TikTok’s Security & Privacy Settings * Guide to Accessing Facebook’s Security & Privacy Settings * Guide to Accessing Instagram’s Security & Privacy Settings * Guide to Accessing X’s Security & Privacy Settings * Tips for Teleworkers, Remote Access Security * Preventing Zoom Bombing * Securely Using Video Teleconferencing Platforms * Wi-Fi & Network Security * Configuring & Securing a Home Wi-Fi Router * Virtual Private Networks * New Jersey Civilian Cyber Resilience Corps * Critical Infrastructure Cybersecurity Outreach Program * Safe Drinking Water Cybersecurity Grant Program (SDWCGP) * State and Local Cybersecurity Grant Program (SLCGP) * E-Learning for Students * FIFA World Cup 2026 Resources * FIFA World Cup 2026 Cyber Threat and Risk Outlook * Cybersecurity Best Practices for Organizations * Cybersecurity Best Practices for Fans * Statewide Information Security Manual (SISM) * Guidance on Responsible Use of Generative AI * Prohibited Information and Communication Technology or Services * Cybersecurity Program Controls Assessment (CPCA) * Vendor Due Diligence Security Reviews * Training and Certifications * Latest Alerts and Advisories * 2026 Cyber Threat Assessment * DDOS Attack Types and Mitigation Strategies * Threat Actors Ride the Extortion Waves of RDDOS Attacks * Defending Against DDOS Attacks * Cryptocurrency-Mining Malware * Industrial Control Systems (ICS) Malware * Point-of-Sale (POS) Malware * Ransomware: The Current Threat Landscape * The Evolution of Ransomware: A 5-Year Perspective * Ransomware: Risk Mitigation Strategies * Ransomware Remains a Pervasive Threat — What Have We Learned?

* Ransomware Remains Prominent Threat * Phishing & Online Scams * Business Email Compromise (BEC) * Financial Payment Scams * CISA's Known Exploited Vulnerabilities Catalog * Apache Log4j Vulnerability Guidance * Critical Infrastructure Sector Reports * Nation State Threat Analysis Reports * AI, APT Campaigns, and Urgent Threats to Critical Infrastructure * China-Linked Cyber Operations Targeting US Critical Infrastructure * Iran Cyber Threat Operations * Russia Cyber Threat Operations * Cybersecurity Awareness Month (CAM) * Cyber Resilience Symposium * Cybersecurity Education in New Jersey * New Jersey Civilian Cyber Resilience Corps * Critical Infrastructure Cybersecurity Outreach Program+ "Expand/Collapse subpages under Critical Infrastructure Cybersecurity Outreach Program") * Cybersecurity Glossary+ "Expand/Collapse subpages under Cybersecurity Glossary") * Grants- "Expand/Collapse subpages under Grants") * Safe Drinking Water Cybersecurity Grant Program (SDWCGP)+ "Expand/Collapse subpages under Safe Drinking Water Cybersecurity Grant Program (SDWCGP)") * State and Local Cybersecurity Grant Program (SLCGP)- "Expand/Collapse subpages under State and Local Cybersecurity Grant Program (SLCGP)") * Online Learning+ "Expand/Collapse subpages under Online Learning") * E-Learning for Students * Partner Resources+ "Expand/Collapse subpages under Partner Resources") * FIFA World Cup 2026 Resources+ "Expand/Collapse subpages under FIFA World Cup 2026 Resources") * FIFA World Cup 2026 Cyber Threat and Risk Outlook * Cybersecurity Best Practices for Organizations * Cybersecurity Best Practices for Fans * State Resources+ "Expand/Collapse subpages under State Resources") * Statewide Information Security Manual (SISM) * Guidance on Responsible Use of Generative AI * Prohibited Information and Communication Technology or Services * Cybersecurity Program Controls Assessment (CPCA) * Vendor Due Diligence Security Reviews * Templates+ "Expand/Collapse subpages under Templates") * Training and Certifications ## Applying For NJ SLCGP Grant Resources Sample copy of the SLCGP Resource Request form Sample copy of the Local Consent Form Sample copy of the Cost Share Agreement Sample copy of the Memorandum of Agreement Please note that these are read-only samples.

Organizations must complete these forms online. **Cybersecurity Resources Available to all NJ State and Local Government Organizations** **Additional SLCGP Information** NJ SLCGP Planning Committee Charter NJ SLCGP PowerPoint Slide Deck DHS FFY25 Notice of Funding Opportunity Infrastructure Investment and Jobs Act If you have any questions regarding the SLCGP, please contact us.

; "Rotate Image has no Title") Grants and Resources » Grants # State and Local Cybersecurity Grant Program (SLCGP) Font Size:; "default font size")+; "larger font size")-; "smaller font size") The application window for the State and Local Cybersecurity Grant Program (SLCGP) is currently open. Please click here to begin your application. The application deadline is September 30, 2026.

The State and Local Cybersecurity Grant Program (SLCGP) is a federal grant program administered by the United States Department of Homeland Security (DHS) and funded by the Infrastructure Investment and Jobs Act (IIJA).

The overall goal of the SLCGP is to improve the cybersecurity posture of state, local, and territorial (SLT) government organizations by providing assistance for managing and reducing systemic cyber risk through the following 4 objectives: **Objective 1:** Develop and establish appropriate governance structures, as well as develop, implement, or revise cybersecurity plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

**Objective 2:** SLT agencies understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments. **Objective 3:** Implement security protections commensurate with risk. **Objective 4:** Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

In New Jersey, the SLCGP is administered by the New Jersey Office of Homeland Security and Preparedness (NJOHSP) through its New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). The following 4 projects have been approved by SLCGP Planning Committee, DHS and FEMA, and funds from the SLCGP will be used to implement them.

To ensure as many New Jersey entities can benefit from the limited SLCGP funds, the software, hardware, and services procured with the grant funds will be passed through to state and local government entities by the NJCCIC. Below is a list and descriptions of the approved projects.

Cybersecurity Governance and Planning ### Cybersecurity Governance and Planning This project aims to help state and local government organizations develop and establish governance structures, including developing and implementing cybersecurity plans, and documented policies and standards that promote the implementation of security controls, address capabilities to respond to cybersecurity incidents, and ensure continuity of operations.

#### Cybersecurity Governance To help SLT organizations, the NJCCIC will develop cybersecurity policy templates that are intended to assist state and local organizations in applying a risk–based approach to information security while establishing the required behaviors and controls necessary to protect information technology resources, secure personal information, safeguard privacy, and maintain the physical safety of individuals.

These policy templates have been derived from and reasonably conform to industry standard frameworks such as the Center for Internet Security's Critical Security Controls and the National Institute of Standards and Technology's Cybersecurity Framework. All levels of government have a responsibility to provide accurate information and provide trusted services to the public.

An effective step in that direction is migrating vanity and other government domains using . COM, . NET, .

ORG, etc. top-level domains (TLDs ) to . GOV, particularly now that . GOV TLDs are managed by the US Department of Homeland Security and are free to verified government organizations.

This project aims to increase trust in NJ government organizations by providing support and guidance to organizations wishing to adopt the . GOV TLD. Cybersecurity Risk Management ### Cybersecurity Risk Management This project will allow state and local government organizations to identify, assess, and prioritize risk remediation efforts while also driving areas for improvements to their overall cybersecurity posture.

#### NJCCIC Cybersecurity and Program Controls Assessment (CPCA) The CPCA is an online cybersecurity self-assessment managed by the NJCCIC that allows the participating organization to evaluate their current cybersecurity posture, identify potential vulnerabilities and gaps, and develop a plan for improving security measures.

The CPCA can help an organization understand its cybersecurity strengths and weaknesses, prioritize areas for improvement, and guide decision-making about future investments in cybersecurity measures. It can also be used to help demonstrate compliance with regulatory requirements and provide a baseline for measuring progress over time.

#### Continuous Cybersecurity Ratings and Risk Monitoring The NJCCIC manages a continuous cybersecurity ratings and risk monitoring service that provides organizations with an easy-to-understand assessment of their cybersecurity posture. The platform offers a range of features designed to help organizations understand, manage, and improve their cybersecurity risk profile.

Benefits to organizations that use the platform include: * Security Ratings: The platform uses a data-driven approach to evaluate an organization's security performance across ten key risk factors, including network security, DNS health, patching cadence, and more.

These ratings offer a clear, easy-to-understand overview of an organization's cybersecurity strengths and weaknesses, allowing for more informed decision-making and prioritization of security efforts. * Continuous Monitoring: The platform continuously monitors and updates an organization's security ratings, providing real-time visibility into their cybersecurity posture.

This helps organizations stay up-to-date with the latest threats and vulnerabilities and enables them to respond quickly to emerging risks. * Third-Party Risk Management: The platform can also be used to assess and monitor the security posture of their third-party vendors and partners. By proactively identifying risks in their vendor ecosystem, organizations can take the necessary steps to mitigate potential security incidents.

* Improved Collaboration and Communication: The platform's user-friendly interface and clear, concise ratings make it easy for both technical and non-technical stakeholders to understand an organization's security posture. This helps to foster collaboration and communication across teams and departments, ensuring that security is a shared responsibility and promoting a proactive approach to risk management.

By leveraging these benefits, organizations can gain better visibility into their cybersecurity posture, mitigate potential risks, and enhance their overall security resilience. Enhance Cybersecurity Resilience ### Enhance Cybersecurity Resilience Two cybersecurity resilience enhancement initiatives will be funded and supported. These initiatives address endpoint, application, and access control threats.

#### Advanced Endpoint Protection The NJCCIC Advanced Endpoint Protection (AEP) solution provides comprehensive visibility into endpoint activity, advanced threat detection, and automated response. It consists of a lightweight endpoint agent and scalable cloud-native management and administration platform that leverages artificial intelligence (AI) and machine learning (ML) to detect and respond to threats on endpoints in real time.

The NJCCIC AEP solution includes several modules that together provide a comprehensive, integrated, and proactive approach to security for an organization's laptops, desktops, and servers. The AEP solution includes the following modules and services: * Next-Generation Antivirus: This module provides comprehensive malware and malicious activity protection.

It uses advanced techniques such as machine learning, artificial intelligence, and behavioral analysis to identify and block known and unknown malware, ransomware, and fileless attacks. * Endpoint Detection and Response: This module helps organizations quickly detect, investigate, and respond to threats on their endpoints (computers, servers, and other devices).

It continuously monitors and records endpoint activities, making it easier for security teams to identify suspicious behavior and respond to incidents. * IT Hygiene: This module helps organizations maintain a clean and secure Information Technology environment by providing visibility into their network, devices, and applications.

It helps identify vulnerabilities, unauthorized applications, and outdated software, enabling security teams to prioritize and address potential risks. * Managed Threat Hunting: Managed Threat Hunting is conducted by a team of cybersecurity experts that proactively hunt for threats within an organization's environment.

The team works 24/7 to identify and help stop advanced cyberattacks that might otherwise go undetected by automated security tools. * Vulnerability Management: This module scans the organization's endpoints for vulnerabilities and provides prioritized recommendations for patching and remediation. It helps organizations stay ahead of potential attacks by fixing security gaps before they can be exploited.

* USB Device Control: This module enables organizations to granularly control USB devices to ensure they are used appropriately and safely in their environments. * Threat Intelligence: This module provides actionable threat intelligence by analyzing data from various sources, including malware, ransomware, and other cyber threats.

It helps organizations understand the tactics, techniques, and procedures used by cyber adversaries, enabling them to strengthen their defenses. #### Multi-Factor Authentication Hardware Tokens According to the 2022 Verizon Data Breach Investigation Report approximately 80% of cyber breaches were due to weak or compromised passwords.

Passwords alone are not sufficient authenticators for remote or privileged access to critical systems or sensitive information. Multi-factor authentication (MFA) is a security process in which a user is only granted access to a system after successfully presenting two or more pieces of evidence to an authentication mechanism: knowledge, possession, and inherence.

Knowledge factors are things that the user knows, such as a password or PIN. Possession factors are things that the user has, such as a security token or smartphone. Inherence factors are things that the user is, such as a fingerprint or facial scan.

There are many different MFA solutions available, and the best solution for a particular organization will depend on the specific needs of that organization.

In an effort to help better secure remote and privileged access logins, SLCGP funds will be utilized to purchase MFA hardware tokens that are to be distributed to state and local government organizations and provided to users in cases where the use of other MFA methods is not a viable solution.

### Workforce Development This project provides IT and cybersecurity personnel with training resources and opportunities to develop knowledge, skills and abilities to address evolving cyber challenges.

High-quality, hands-on, in-person and remote online training covering a wide range of cybersecurity topics, including but not limited to network, application, and cloud security, IT and cyber operations, incident response, threat and vulnerability management, and more.

The cyber range is an online cybersecurity training and simulation platform administered by the NJCCIC that provides IT and cybersecurity professionals with several benefits: * Realistic simulation: The cyber range provides realistic cybersecurity simulations, allowing trainees to experience and respond to real-world cyber threats in a safe and controlled environment.

* Customizable scenarios: The platform allows users to create and customize training scenarios, tailored to their organization's specific needs and threat landscape. * Skill-building: The cyber range provides a range of training modules to help users develop and enhance their cybersecurity skills and knowledge.

* Team training: The platform enables team-based training, fostering collaboration and communication among team members, which is critical in real-world incident response scenarios. * Performance analytics: The cyber range provides detailed performance analytics, allowing trainees to track their progress and identify areas for improvement.

#### Security Awareness Training Security Awareness Training is a cybersecurity educational program designed to help organizations educate their employees about various cyber threats and improve their security posture. It aims to reduce the human risk factor in cybersecurity by cultivating a security-conscious culture. ## Frequently Asked Questions The application window is open.

Please click here to begin your application. Local government entities (e.g., municipalities, counties, school districts, etc.) must complete and submit the NJ SLCGP Local Consent Agreement. Upon submission of your application, you will receive a PDF copy of your submission and a link to complete the local consent form.

A sample can be viewedhere. When Is The Application Deadline? The application window for SLCGP 2025 will close on September 30, 2026 at 5pm.

How Much Money Will I Receive? The SLCGP provides services to state and local agencies. Applicants will not receive monies directly from the grant but will receive services and resources through the NJCCIC, allowing us to provide more with the limited funding from the grant.

What If I Want All or Only Some Services? One application suffices for either one, some, or all of the offered projects. There is no obligation to accept all the services and resources; applicants may pick and choose.

What If I'm not Confident In My Application Answers? The SLCGP application will act as a baseline of information necessary for the NJCCIC to determine your interest and the capabilities in certain areas of your current cybersecurity program. The applicant reserves the right to deny services or resources as needed.

Please answer the questions to the best of your ability. When Will I Know If I Will Receive Services? We aim to notify applicants whether their requested services can be fulfilled within several weeks after the application window has closed for each federal fiscal year.

Implementation may take days or weeks if awarded and depending on which program. Some services will require memorandums of understating (MOUs) to be established. Free viewers are required for some of the attached documents.

They can be downloaded by clicking on the icons below. Download Acrobat Reader Download Windows Media Player Download Word Viewer Download Excel Viewer Download PowerPoint Viewer 2 Schwarzkopf Dr. Ewing Township, NJ 08628njccic@cyber. nj.

gov WEBSITE DESIGN BY Granicus - Connecting People and Government