How to Meet FY 2023 U.S. State and Local Cybersecurity Grant Program Objectives

This is the first of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.

In 2021, the U.S. Infrastructure Investment and Jobs Act created the State and Local Cybersecurity Grant Program (SLCGP) to help state, local, tribal and territorial (SLTT) governments address an ever-evolving cybersecurity threat landscape. The four-year, $1 billion program provides funding for SLTT governments to implement cybersecurity solutions that address the growing threats and risks to their information systems.

The 2023 Notice of Funding Opportunity (NOFO), released in August, provides $374.9 million to SLTT governments. This is the second installment of the four-year program. Applications must be submitted by October 6, 2023.

SLGCP Program goals for FY23

While the following objectives of the program remain the same, the focus for SLTTs shifts in FY 23.

• Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
• Objective 3: Implement security protections commensurate with risk.
• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

As the program moves into year two, applicants are required to focus on Objectives 2-4 from the above list, which are statutory conditions for receiving grant funding. Below, we provide more details on how the Tenable One Exposure Management Platform can help agencies meet the requirements of Objective 2.

Objective 2 is aimed at helping SLTT agencies continuously evaluate their cybersecurity posture and risk. The goals are to ensure that all assets and applications are continuously identified and their risk understood, and to ensure a risk-based vulnerability management program is put in place for monitoring all assets and vulnerabilities.

Tenable is uniquely positioned to help SLTTs meet this objective through the Tenable One Exposure Management Platform. Going beyond traditional IT, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory, and more — including highly dynamic IT assets like mobile devices, virtual machines, containers and cloud instances. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLTT agencies to successfully meet each of the sub-objectives outlined in Objective 2.

Source: Tenable, October 2023

Tenable One deployment options offer flexibility for SLTT agencies

Tenable offers SLTT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

• Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
• Multi-entity projects
• Decentralized deployments of Tenable One managed by individual municipalities,
• Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

CISA Cybersecurity Performance Goals (CPGs)

A new component of the SLCGP program is for SLTT agencies to adopt key cybersecurity best practices. To do this, they are required to consult the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding. The CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to both critical infrastructure operations and the American people. In part two of this series, we’ll discuss how Tenable One can help agencies meet the CISA CPGs.

Learn more

• Download the white paper: Meeting CISA Cybersecurity Performance Goals
• Review the guidance: CISA: State and Local Cybersecurity Grant Program
• View the SLCGP NOFO: FY 23 Notice of Funding Opportunity
• Read the blogs: Meeting State and Local Cybersecurity Grant Program (SLCGP) Requirements with Tenable Technologies and Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach