Developing the First DHS Cyber Grant Requirement for State and Local Partners

The Challenge:

States and territories have consistently rated cybersecurity as the least proficient core capability and the capability in greatest danger of decline in their State Preparedness Reports. The National Preparedness Report has highlighted cybersecurity as a national area for improvement for six consecutive years. Moreover, cybersecurity investment justifications have not adequately reflected the severity of the risk to critical information systems owned and operated by state and local governments. Finally, there is an increased need for cyber resilience—the ability to anticipate, withstand, recover, and evolve—in the face of persistent, stealthy, and sophisticated attacks and disruptions.

The Partnership:

Padrón USA teamed up with CISA to provide cyber expertise, state and local grant governance expertise, strategic planning, grant operations, and project management.

In FY17, our team worked closely with the teams at CISA to carve out a mandatory cyber spend requirement across DHS preparedness grants. This was the most significant change to the DHS preparedness grants since they were established in the post 9/11 environment.

The Impact:

As a result of Padrón USA’s efforts, our team helped DHS:

Transform Current Grant Operations

• Leverage expertise to establish a one-DHS effort

• Establish new processes and tools to support more complex coordination across and outside of DHS

• Develop a robust strategic communication strategy leveraging NASCIO and other associations to spread the word

Provide Technical Assistance

• Develop an agreement to support preparedness for grant officer requests to help adjudicate cyber grant inquiries

• Hold weekly cyber focused information sessions with all eligible grantees

• Train CISA regional teams on the new requirement and allowable spends

Strengthen SLTT Cyber Capabilities

• Distribute $37 million in cyber focused grant funds across 89 states and UASIs providing increased capabilities in the following areas: training/exercises, cyber plan development, encryption software, firewall enhancements, and identity management/access control

• Require every grantee to complete a Nationwide Cybersecurity Review (NCSR)

• Require emergency management teams to consult with their CIO/CISO to develop each cyber investment

• Encourage the use of CISA’s free resources