---
kind: "section"
citation: "6 U.S.C. § 665g"
title: "6"
title_heading: "Domestic Security"
number: "665g"
heading: "State and Local Cybersecurity Grant Program"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/665g"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §665g. State and Local Cybersecurity Grant Program

- (a) **Definitions—** In this section:
  - (1) **Cybersecurity Plan—** The term “Cybersecurity Plan” means a plan submitted by an eligible [entity](/usc/6/301c.md?p=2) under [subsection (e)(1)](#e-1).
  - (2) **Eligible entity—** The term “eligible [entity](/usc/6/301c.md?p=2)” means a—
    - (A) [State](/usc/6/101.md?p=17); or
    - (B) [Tribal government](/usc/6/601.md?p=14).
  - (3) **Multi-entity group—** The term “multi-[entity](/usc/6/301c.md?p=2) group” means a group of 2 or more eligible [entities](/usc/6/301c.md?p=2) desiring a grant under this section.
  - (4) **Online service—** The term “online service” means any internet-facing service, including a website, email, virtual private network, or custom application.
  - (5) **Rural area—** The term “rural area” has the meaning given the term in [section 5302 of title 49](/usc/49/5302.md).
  - (6) **State and Local Cybersecurity Grant Program—** The term “[State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program” means the program established under [subsection (b)](#b).
  - (7) **Tribal government—** The term “[Tribal government](/usc/6/601.md?p=14)” means the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent list published pursuant to [section 5131 of title 25](/usc/25/5131.md).
- (b) **Establishment—**
  - (1) **In general—** There is established within the [Department](/usc/6/641.md?p=1) a program to award grants to eligible [entities](/usc/6/301c.md?p=2) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](/usc/6/601.md?p=14).
  - (2) **Application—** An eligible [entity](/usc/6/301c.md?p=2) desiring a grant under the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program shall submit to the [Secretary](/usc/6/641.md?p=3) an application at such time, in such manner, and containing such information as the [Secretary](/usc/6/641.md?p=3) may require.
- (c) **Administration—** The [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program shall be administered in the same office of the [Department](/usc/6/641.md?p=1) that administers grants made under sections [604](/usc/6/604.md) and [605](/usc/6/605.md) of this title.
- (d) **Use of funds—** An eligible [entity](/usc/6/301c.md?p=2) that receives a grant under this section and a [local government](/usc/6/101.md?p=13) that receives [funds](/usc/6/677a.md?p=5) from a grant under this section, as appropriate, shall use the grant to—
  - (1) implement the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2);
  - (2) develop or revise the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2);
  - (3) pay expenses directly relating to the administration of the grant, which shall not exceed 5 percent of the amount of the grant;
  - (4) assist with activities that address imminent [cybersecurity threats](/usc/6/650.md?p=8-A), as confirmed by the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), to the [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or a [local government](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2); or
  - (5) [fund](/usc/6/677a.md?p=5) any other appropriate activity determined by the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10).
- (e) **Cybersecurity plans—**
  - (1) **In general—** An eligible [entity](/usc/6/301c.md?p=2) applying for a grant under this section shall submit to the [Secretary](/usc/6/641.md?p=3) a Cybersecurity Plan for review in accordance with [subsection (i)](#i).
  - (2) **Required elements—** A Cybersecurity Plan of an eligible [entity](/usc/6/301c.md?p=2) shall—
    - (A) incorporate, to the extent practicable—
      - (i) any existing plans of the eligible [entity](/usc/6/301c.md?p=2) to protect against [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](/usc/6/601.md?p=14); and
      - (ii) if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), consultation and feedback from [local governments](/usc/6/101.md?p=13) and associations of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2);
    - (B) describe, to the extent practicable, how the eligible [entity](/usc/6/301c.md?p=2) will—
      - (i) manage, [monitor](/usc/6/650.md?p=19), and track [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), and the information technology deployed on those [information systems](/usc/6/650.md?p=14), including legacy [information systems](/usc/6/650.md?p=14) and information technology that are no longer supported by the manufacturer of the systems or technology;
      - (ii) [monitor](/usc/6/650.md?p=19), audit, and,[^1] track network traffic and activity transiting or traveling to or from [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2);
      - (iii) enhance the preparation, response, and resiliency of [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), against [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A);
      - (iv) implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) on [information systems](/usc/6/650.md?p=14), applications, and user accounts owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2);
      - (v) ensure that the eligible [entity](/usc/6/301c.md?p=2) and, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), adopt and use best practices and methodologies to enhance cybersecurity, such as—
        - (I) the practices set forth in the cybersecurity framework developed by the National Institute of Standards and Technology;
        - (II) cyber chain supply chain risk management best practices identified by the National Institute of Standards and Technology; and
        - (III) knowledge bases of adversary tools and tactics;
      - (vi) promote the delivery of safe, recognizable, and trustworthy online services by the eligible [entity](/usc/6/301c.md?p=2) and, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), including through the use of the .gov internet domain;
      - (vii) ensure continuity of operations of the eligible [entity](/usc/6/301c.md?p=2) and, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), in the event of a cybersecurity [incident](/usc/6/650.md?p=12), including by conducting exercises to practice responding to a cybersecurity [incident](/usc/6/650.md?p=12);
      - (viii) use the National Initiative for Cybersecurity Education Workforce Framework for Cybersecurity developed by the National Institute of Standards and Technology to identify and mitigate any gaps in the cybersecurity workforces of the eligible [entity](/usc/6/301c.md?p=2) and, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), enhance recruitment and retention efforts for those workforces, and bolster the knowledge, skills, and abilities of [personnel](/usc/6/101.md?p=15) of the eligible [entity](/usc/6/301c.md?p=2) and, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A), such as through cybersecurity hygiene training;
      - (ix) if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), ensure continuity of communications and data networks within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) between the eligible [entity](/usc/6/301c.md?p=2) and [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) in the event of an [incident](/usc/6/650.md?p=12) involving those communications or data networks;
      - (x) assess and mitigate, to the greatest degree possible, [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) relating to [critical infrastructure](/usc/6/101.md?p=4) and [key resources](/usc/6/101.md?p=12), the degradation of which may impact the performance of [information systems](/usc/6/650.md?p=14) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2);
      - (xi) enhance capabilities to share [cyber threat indicators](/usc/6/650.md?p=5) and related information between the eligible [entity](/usc/6/301c.md?p=2) and—
        - (I) if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2), including by expanding information [sharing](/usc/6/650.md?p=26) agreements with the [Department](/usc/6/641.md?p=1); and
        - (II) the [Department](/usc/6/641.md?p=1);
      - (xii) leverage cybersecurity services offered by the [Department](/usc/6/641.md?p=1);
      - (xiii) implement an information technology and operational technology modernization cybersecurity review process that ensures alignment between information technology and operational technology cybersecurity objectives;
      - (xiv) develop and coordinate strategies to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) in consultation with—
        - (I) if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) and associations of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2); and
        - (II) as applicable—
          - (aa) eligible [entities](/usc/6/301c.md?p=2) that neighbor the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) or, as appropriate, members of an [Information Sharing and Analysis Organization](/usc/6/650.md?p=13); and
          - (bb) countries that neighbor the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2);
      - (xv) ensure adequate access to, and participation in, the services and programs described in this subparagraph by rural areas within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2); and
      - (xvi) distribute [funds](/usc/6/677a.md?p=5), items, services, capabilities, or activities to [local governments](/usc/6/101.md?p=13) under [subsection (n)(2)(A)](#n-2-A), including the fraction of that distribution the eligible [entity](/usc/6/301c.md?p=2) plans to distribute to rural areas under [subsection (n)(2)(B)](#n-2-B);
    - (C) assess the capabilities of the eligible [entity](/usc/6/301c.md?p=2) relating to the actions described in [subparagraph (B)](#e-2-B);
    - (D) describe, as appropriate and to the extent practicable, the individual responsibilities of the eligible [entity](/usc/6/301c.md?p=2) and [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) in implementing the plan;
    - (E) outline, to the extent practicable, the necessary resources and a timeline for implementing the plan; and
    - (F) describe the metrics the eligible [entity](/usc/6/301c.md?p=2) will use to measure progress towards—
      - (i) implementing the plan; and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2).
  - (3) **Discretionary elements—** In drafting a Cybersecurity Plan, an eligible [entity](/usc/6/301c.md?p=2) may—
    - (A) consult with the Multi-[State](/usc/6/101.md?p=17) Information [Sharing](/usc/6/650.md?p=26) and Analysis [Center](/usc/6/681.md?p=1);
    - (B) include a description of cooperative programs developed by groups of [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A); and
    - (C) include a description of programs provided by the eligible [entity](/usc/6/301c.md?p=2) to support [local governments](/usc/6/101.md?p=13) and owners and operators of [critical infrastructure](/usc/6/101.md?p=4) to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A).
- (f) **Multi-entity grants—**
  - (1) **In general—** The [Secretary](/usc/6/641.md?p=3) may award grants under this section to a multi-[entity](/usc/6/301c.md?p=2) group to support multi-[entity](/usc/6/301c.md?p=2) efforts to address [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [information systems](/usc/6/650.md?p=14) within the jurisdictions of the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group.
  - (2) **Satisfaction of other requirements—** In order to be eligible for a multi-[entity](/usc/6/301c.md?p=2) grant under this subsection, each eligible [entity](/usc/6/301c.md?p=2) that comprises a multi-[entity](/usc/6/301c.md?p=2) group shall have—
    - (A) a Cybersecurity Plan that has been reviewed by the [Secretary](/usc/6/641.md?p=3) in accordance with [subsection (i)](#i); and
    - (B) a cybersecurity planning committee established in accordance with [subsection (g)](#g).
  - (3) **Application—**
    - (A) **In general—** A multi-[entity](/usc/6/301c.md?p=2) group applying for a multi-[entity](/usc/6/301c.md?p=2) grant under [paragraph (1)](#f-1) shall submit to the [Secretary](/usc/6/641.md?p=3) an application at such time, in such manner, and containing such information as the [Secretary](/usc/6/641.md?p=3) may require.
    - (B) **Multi-entity project plan—** An application for a grant under this section of a multi-[entity](/usc/6/301c.md?p=2) group under [subparagraph (A)](#f-3-A) shall include a plan describing—
      - (i) the division of responsibilities among the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group;
      - (ii) the distribution of funding from the grant among the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group; and
      - (iii) how the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group will work together to implement the Cybersecurity Plan of each of those eligible [entities](/usc/6/301c.md?p=2).
- (g) **Planning committees—**
  - (1) **In general—** An eligible [entity](/usc/6/301c.md?p=2) that receives a grant under this section shall establish a cybersecurity planning committee to—
    - (A) assist with the development, implementation, and revision of the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2);
    - (B) approve the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2); and
    - (C) assist with the determination of effective funding priorities for a grant under this section in accordance with subsections [(d)](#d) and [(j)](#j).
  - (2) **Composition—** A committee of an eligible [entity](/usc/6/301c.md?p=2) established under [paragraph (1)](#g-1) shall—
    - (A) be comprised of representatives from—
      - (i) the eligible [entity](/usc/6/301c.md?p=2);
      - (ii) if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), counties, cities, and towns within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2); and
      - (iii) institutions of public education and health within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2); and
    - (B) include, as appropriate, representatives of rural, suburban, and high-[population](/usc/6/601.md?p=10) jurisdictions.
  - (3) **Cybersecurity expertise—** Not less than one-half of the representatives of a committee established under [paragraph (1)](#g-1) shall have professional experience relating to cybersecurity or information technology.
  - (4) **Rule of construction regarding existing planning committees—** Nothing in this subsection shall be construed to require an eligible [entity](/usc/6/301c.md?p=2) to establish a cybersecurity planning committee if the eligible [entity](/usc/6/301c.md?p=2) has established and uses a multijurisdictional planning committee or commission that—
    - (A) meets the requirements of this subsection; or
    - (B) may be expanded or leveraged to meet the requirements of this subsection, including through the formation of a cybersecurity planning subcommittee.
  - (5) **Rule of construction regarding control of information systems of eligible entities—** Nothing in this subsection shall be construed to permit a cybersecurity planning committee of an eligible [entity](/usc/6/301c.md?p=2) that meets the requirements of this subsection to make decisions relating to [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2).
- (h) **Special rule for Tribal governments—** With respect to any requirement under subsection [(e)](#e) or [(g)](#g), the [Secretary](/usc/6/641.md?p=3), in consultation with the [Secretary](/usc/6/641.md?p=3) of the Interior and [Tribal governments](/usc/6/601.md?p=14), may prescribe an alternative substantively similar requirement for [Tribal governments](/usc/6/601.md?p=14) if the [Secretary](/usc/6/641.md?p=3) finds that the alternative requirement is necessary for the effective delivery and administration of grants to [Tribal governments](/usc/6/601.md?p=14) under this section.
- (i) **Review of plans—**
  - (1) **Review as condition of grant—**
    - (A) **In general—** Subject to [paragraph (3)](#i-3), before an eligible [entity](/usc/6/301c.md?p=2) may receive a grant under this section, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall—
      - (i) review the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2), including any revised Cybersecurity Plans of the eligible [entity](/usc/6/301c.md?p=2); and
      - (ii) determine that the Cybersecurity Plan reviewed under [clause (i)](#i-1-A-i) satisfies the requirements under [paragraph (2)](#i-2).
    - (B) **Duration of determination—** In the case of a determination under [subparagraph (A)(ii)](#i-1-A-ii) that a Cybersecurity Plan satisfies the requirements under [paragraph (2)](#i-2), the determination shall be effective for the 2-year period beginning on the date of the determination.
    - (C) **Annual renewal—** Not later than 2 years after the date on which the [Secretary](/usc/6/641.md?p=3) determines under [subparagraph (A)(ii)](#i-1-A-ii) that a Cybersecurity Plan satisfies the requirements under [paragraph (2)](#i-2), and annually thereafter, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall—
      - (i) determine whether the Cybersecurity Plan and any revisions continue to meet the criteria described in [paragraph (2)](#i-2); and
      - (ii) renew the determination if the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), makes a positive determination under [clause (i)](#i-1-C-i).
  - (2) **Plan requirements—** In reviewing a Cybersecurity Plan of an eligible [entity](/usc/6/301c.md?p=2) under this subsection, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall ensure that the Cybersecurity Plan—
    - (A) satisfies the requirements of [subsection (e)(2)](#e-2); and
    - (B) has been approved by—
      - (i) the cybersecurity planning committee of the eligible [entity](/usc/6/301c.md?p=2) established under [subsection (g)](#g); and
      - (ii) the Chief Information Officer, the Chief Information Security Officer, or an equivalent official of the eligible [entity](/usc/6/301c.md?p=2).
  - (3) **Exception—** Notwithstanding [subsection (e)](#e) and paragraph (1) of this subsection, the [Secretary](/usc/6/641.md?p=3) may award a grant under this section to an eligible [entity](/usc/6/301c.md?p=2) that does not submit a Cybersecurity Plan to the [Secretary](/usc/6/641.md?p=3) for review before September 30, 2023, if the eligible [entity](/usc/6/301c.md?p=2) certifies to the [Secretary](/usc/6/641.md?p=3) that—
    - (A) the activities that will be supported by the grant are—
      - (i) integral to the development of the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2); or
      - (ii) necessary to assist with activities described in [subsection (d)(4)](#d-4), as confirmed by the [Director](/usc/6/650.md?p=10); and
    - (B) the eligible [entity](/usc/6/301c.md?p=2) will submit to the [Secretary](/usc/6/641.md?p=3) a Cybersecurity Plan for review under this subsection by September 30, 2023.
  - (4) **Rule of construction—** Nothing in this subsection shall be construed to provide authority to the [Secretary](/usc/6/641.md?p=3) to—
    - (A) regulate the manner by which an eligible [entity](/usc/6/301c.md?p=2) or [local government](/usc/6/101.md?p=13) improves the cybersecurity of the [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or [local government](/usc/6/101.md?p=13); or
    - (B) condition the receipt of grants under this section on—
      - (i) participation in a particular Federal program; or
      - (ii) the use of a specific product or technology.
- (j) **Limitations on uses of funds—**
  - (1) **In general—** Any [entity](/usc/6/301c.md?p=2) that receives [funds](/usc/6/677a.md?p=5) from a grant under this section may not use the grant—
    - (A) to supplant [State](/usc/6/101.md?p=17) or local [funds](/usc/6/677a.md?p=5);
    - (B) for any recipient cost-[sharing](/usc/6/650.md?p=26) contribution;
    - (C) to pay a ransom;
    - (D) for recreational or social purposes; or
    - (E) for any purpose that does not address [cybersecurity risks](/usc/6/650.md?p=7) or [cybersecurity threats](/usc/6/650.md?p=8-A) on [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) that receives the grant or a [local government](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2).
  - (2) **Compliance oversight—** In addition to any other remedy available, the [Secretary](/usc/6/641.md?p=3) may take such actions as are necessary to ensure that a recipient of a grant under this section uses the grant for the purposes for which the grant is awarded.
  - (3) **Rule of construction—** Nothing in [paragraph (1)(A)](#j-1-A) shall be construed to prohibit the use of [funds](/usc/6/677a.md?p=5) from a grant under this section awarded to a [State](/usc/6/101.md?p=17), local, or [Tribal government](/usc/6/601.md?p=14) for otherwise permissible uses under this section on the basis that the [State](/usc/6/101.md?p=17), local, or [Tribal government](/usc/6/601.md?p=14) has previously used [State](/usc/6/101.md?p=17), local, or Tribal [funds](/usc/6/677a.md?p=5) to support the same or similar uses.
- (k) **Opportunity to amend applications—** In considering applications for grants under this section, the [Secretary](/usc/6/641.md?p=3) shall provide applicants with a reasonable opportunity to correct any defects in those applications before making final awards, including by allowing applicants to revise a submitted Cybersecurity Plan.
- (l) **Apportionment—** For fiscal year 2022 and each fiscal year thereafter, the [Secretary](/usc/6/641.md?p=3) shall apportion amounts appropriated to carry out this section among eligible [entities](/usc/6/301c.md?p=2) as follows:
  - (1) **Baseline amount—** The [Secretary](/usc/6/641.md?p=3) shall first apportion—
    - (A) 0.25 percent of such amounts to each of American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, and the [United States](/usc/6/101.md?p=19-A) Virgin Islands;
    - (B) 1 percent of such amounts to each of the remaining [States](/usc/6/101.md?p=17); and
    - (C) 3 percent of such amounts to [Tribal governments](/usc/6/601.md?p=14).
  - (2) **Remainder—** The [Secretary](/usc/6/641.md?p=3) shall apportion the remainder of such amounts to [States](/usc/6/101.md?p=17) as follows:
    - (A) 50 percent of such remainder in the ratio that the [population](/usc/6/601.md?p=10) of each [State](/usc/6/101.md?p=17), bears to the [population](/usc/6/601.md?p=10) of all [States](/usc/6/101.md?p=17); and
    - (B) 50 percent of such remainder in the ratio that the [population](/usc/6/601.md?p=10) of each [State](/usc/6/101.md?p=17) that resides in rural areas, bears to the [population](/usc/6/601.md?p=10) of all [States](/usc/6/101.md?p=17) that resides in rural areas.
  - (3) **Apportionment among Tribal governments—** In determining how to apportion amounts to [Tribal governments](/usc/6/601.md?p=14) under [paragraph (1)(C)](#l-1-C), the [Secretary](/usc/6/641.md?p=3) shall consult with the [Secretary](/usc/6/641.md?p=3) of the Interior and [Tribal governments](/usc/6/601.md?p=14).
  - (4) **Multi-entity grants—** An amount received from a multi-[entity](/usc/6/301c.md?p=2) grant awarded under [subsection (f)(1)](#f-1) by a [State](/usc/6/101.md?p=17) or [Tribal government](/usc/6/601.md?p=14) that is a member of the multi-[entity](/usc/6/301c.md?p=2) group shall qualify as an apportionment for the purpose of this subsection.
- (m) **Federal share—**
  - (1) **In general—** The Federal share of the cost of an activity carried out using [funds](/usc/6/677a.md?p=5) made available with a grant under this section may not exceed—
    - (A) in the case of a grant to an eligible [entity](/usc/6/301c.md?p=2)—
      - (i) for fiscal year 2022, 90 percent;
      - (ii) for fiscal year 2023, 80 percent;
      - (iii) for fiscal year 2024, 70 percent; and
      - (iv) for fiscal year 2025, 60 percent; and
    - (B) in the case of a grant to a multi-[entity](/usc/6/301c.md?p=2) group—
      - (i) for fiscal year 2022, 100 percent;
      - (ii) for fiscal year 2023, 90 percent;
      - (iii) for fiscal year 2024, 80 percent; and
      - (iv) for fiscal year 2025, 70 percent.
  - (2) **Waiver—**
    - (A) **In general—** The [Secretary](/usc/6/641.md?p=3) may waive or modify the requirements of [paragraph (1)](#m-1) if an eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group demonstrates economic hardship.
    - (B) **Guidelines—** The [Secretary](/usc/6/641.md?p=3) shall establish and publish guidelines for determining what constitutes economic hardship for the purposes of this subsection.
    - (C) **Considerations—** In developing guidelines under [subparagraph (B)](#m-2-B), the [Secretary](/usc/6/641.md?p=3) shall consider, with respect to the jurisdiction of an eligible [entity](/usc/6/301c.md?p=2)—
      - (i) changes in rates of unemployment in the jurisdiction from previous years;
      - (ii) changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the Food and Nutrition Act of 2008 ([7 U.S.C. 2011](/usc/7/2011.md) et seq.) from previous years; and
      - (iii) any other factors the [Secretary](/usc/6/641.md?p=3) considers appropriate.
  - (3) **Waiver for Tribal governments—** Notwithstanding [paragraph (2)](#m-2), the [Secretary](/usc/6/641.md?p=3), in consultation with the [Secretary](/usc/6/641.md?p=3) of the Interior and [Tribal governments](/usc/6/601.md?p=14), may waive or modify the requirements of [paragraph (1)](#m-1) for 1 or more [Tribal governments](/usc/6/601.md?p=14) if the [Secretary](/usc/6/641.md?p=3) determines that the waiver is in the public interest.
- (n) **Responsibilities of grantees—**
  - (1) **Certification—** Each eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group that receives a grant under this section shall certify to the [Secretary](/usc/6/641.md?p=3) that the grant will be used—
    - (A) for the purpose for which the grant is awarded; and
    - (B) in compliance with subsections [(d)](#d) and [(j)](#j).
  - (2) **Availability of funds to local governments and rural areas—**
    - (A) **In general—** Subject to [subparagraph (C)](#n-2-C), not later than 45 days after the date on which an eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group receives a grant under this section, the eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group shall, without imposing unreasonable or unduly burdensome requirements as a condition of receipt, obligate or otherwise make available to [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) or the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group, consistent with the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2) or the Cybersecurity Plans of the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group—
      - (i) not less than 80 percent of [funds](/usc/6/677a.md?p=5) available under the grant;
      - (ii) with the consent of the [local governments](/usc/6/101.md?p=13), items, services, capabilities, or activities having a value of not less than 80 percent of the amount of the grant; or
      - (iii) with the consent of the [local governments](/usc/6/101.md?p=13), grant [funds](/usc/6/677a.md?p=5) combined with other items, services, capabilities, or activities having the total value of not less than 80 percent of the amount of the grant.
    - (B) **Availability to rural areas—** In obligating [funds](/usc/6/677a.md?p=5), items, services, capabilities, or activities to [local governments](/usc/6/101.md?p=13) under [subparagraph (A)](#n-2-A), the eligible [entity](/usc/6/301c.md?p=2) or eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group shall ensure that rural areas within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2) or the eligible [entities](/usc/6/301c.md?p=2) that comprise the multi-[entity](/usc/6/301c.md?p=2) group receive not less than—
      - (i) 25 percent of the amount of the grant awarded to the eligible [entity](/usc/6/301c.md?p=2);
      - (ii) items, services, capabilities, or activities having a value of not less than 25 percent of the amount of the grant awarded to the eligible [entity](/usc/6/301c.md?p=2); or
      - (iii) grant [funds](/usc/6/677a.md?p=5) combined with other items, services, capabilities, or activities having the total value of not less than 25 percent of the grant awarded to the eligible [entity](/usc/6/301c.md?p=2).
    - (C) **Exceptions—** This paragraph shall not apply to—
      - (i) any grant awarded under this section that solely supports activities that are integral to the development or revision of the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2); or
      - (ii) the District of Columbia, the Commonwealth of Puerto Rico, American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, the [United States](/usc/6/101.md?p=19-A) Virgin Islands, or a [Tribal government](/usc/6/601.md?p=14).
  - (3) **Certifications regarding distribution of grant funds to local governments—** An eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group shall certify to the [Secretary](/usc/6/641.md?p=3) that the eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group has made the distribution to [local governments](/usc/6/101.md?p=13) required under [paragraph (2)](#n-2).
  - (4) **Extension of period—**
    - (A) **In general—** An eligible [entity](/usc/6/301c.md?p=2) or multi-[entity](/usc/6/301c.md?p=2) group may request in writing that the [Secretary](/usc/6/641.md?p=3) extend the period of time specified in [paragraph (2)](#n-2) for an additional period of time.
    - (B) **Approval—** The [Secretary](/usc/6/641.md?p=3) may approve a request for an extension under [subparagraph (A)](#n-4-A) if the [Secretary](/usc/6/641.md?p=3) determines the extension is necessary to ensure that the obligation and expenditure of grant [funds](/usc/6/677a.md?p=5) align with the purpose of the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program.
  - (5) **Direct funding—** If an eligible [entity](/usc/6/301c.md?p=2) does not make a distribution to a [local government](/usc/6/101.md?p=13) required under [paragraph (2)](#n-2) in a timely fashion, the [local government](/usc/6/101.md?p=13) may petition the [Secretary](/usc/6/641.md?p=3) to request the [Secretary](/usc/6/641.md?p=3) to provide [funds](/usc/6/677a.md?p=5) directly to the [local government](/usc/6/101.md?p=13).
  - (6) **Limitation on construction—** A grant awarded under this section may not be used to acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities.
  - (7) **Consultation in allocating funds—** An eligible [entity](/usc/6/301c.md?p=2) applying for a grant under this section shall agree to consult the Chief Information Officer, the Chief Information Security Officer, or an equivalent official of the eligible [entity](/usc/6/301c.md?p=2) in allocating [funds](/usc/6/677a.md?p=5) from a grant awarded under this section.
  - (8) **Penalties—** In addition to other remedies available to the [Secretary](/usc/6/641.md?p=3), if an eligible [entity](/usc/6/301c.md?p=2) violates a requirement of this subsection, the [Secretary](/usc/6/641.md?p=3) may—
    - (A) terminate or reduce the amount of a grant awarded under this section to the eligible [entity](/usc/6/301c.md?p=2); or
    - (B) distribute grant [funds](/usc/6/677a.md?p=5) previously awarded to the eligible [entity](/usc/6/301c.md?p=2)—
      - (i) in the case of an eligible [entity](/usc/6/301c.md?p=2) that is a [State](/usc/6/101.md?p=17), directly to the appropriate [local government](/usc/6/101.md?p=13) as a replacement grant in an amount determined by the [Secretary](/usc/6/641.md?p=3); or
      - (ii) in the case of an eligible [entity](/usc/6/301c.md?p=2) that is a [Tribal government](/usc/6/601.md?p=14), to another [Tribal government](/usc/6/601.md?p=14) or [Tribal governments](/usc/6/601.md?p=14) as a replacement grant in an amount determined by the [Secretary](/usc/6/641.md?p=3).
- (o) **Consultation with State, local, and Tribal representatives—** In carrying out this section, the [Secretary](/usc/6/641.md?p=3) shall consult with [State](/usc/6/101.md?p=17), local, and Tribal representatives with professional experience relating to cybersecurity, including representatives of associations representing [State](/usc/6/101.md?p=17), local, and [Tribal governments](/usc/6/601.md?p=14), to inform—
  - (1) guidance for applicants for grants under this section, including guidance for Cybersecurity Plans;
  - (2) the study of risk-based formulas required under [subsection (q)(4)](#q-4);
  - (3) the development of guidelines required under [subsection (m)(2)(B)](#m-2-B); and
  - (4) any modifications described in [subsection (q)(2)(D)](#q-2-D).
- (p) **Notification to Congress—** Not later than 3 business days before the date on which the [Department](/usc/6/641.md?p=1) announces the award of a grant to an eligible [entity](/usc/6/301c.md?p=2) under this section, including an announcement to the eligible [entity](/usc/6/301c.md?p=2), the [Secretary](/usc/6/641.md?p=3) shall provide to the [appropriate congressional committees](/usc/6/650.md?p=2) notice of the announcement.
- (q) **Reports, study, and review—**
  - (1) **Annual reports by grant recipients—**
    - (A) **In general—** Not later than 1 year after the date on which an eligible [entity](/usc/6/301c.md?p=2) receives a grant under this section for the purpose of implementing the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2), including an eligible [entity](/usc/6/301c.md?p=2) that comprises a multi-[entity](/usc/6/301c.md?p=2) group that receives a grant for that purpose, and annually thereafter until 1 year after the date on which [funds](/usc/6/677a.md?p=5) from the grant are expended or returned, the eligible [entity](/usc/6/301c.md?p=2) shall submit to the [Secretary](/usc/6/641.md?p=3) a report that, using the metrics described in the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2), describes the progress of the eligible [entity](/usc/6/301c.md?p=2) in—
      - (i) implementing the Cybersecurity Plan of the eligible [entity](/usc/6/301c.md?p=2); and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, the eligible [entity](/usc/6/301c.md?p=2) or, if the eligible [entity](/usc/6/301c.md?p=2) is a [State](/usc/6/101.md?p=17), [local governments](/usc/6/101.md?p=13) within the jurisdiction of the eligible [entity](/usc/6/301c.md?p=2).
    - (B) **Absence of plan—** Not later than 1 year after the date on which an eligible [entity](/usc/6/301c.md?p=2) that does not have a Cybersecurity Plan receives [funds](/usc/6/677a.md?p=5) under this section, and annually thereafter until 1 year after the date on which [funds](/usc/6/677a.md?p=5) from the grant are expended or returned, the eligible [entity](/usc/6/301c.md?p=2) shall submit to the [Secretary](/usc/6/641.md?p=3) a report describing how the eligible [entity](/usc/6/301c.md?p=2) obligated and expended grant [funds](/usc/6/677a.md?p=5) to—
      - (i) develop or revise a Cybersecurity Plan; or
      - (ii) assist with the activities described in [subsection (d)(4)](#d-4).
  - (2) **Annual reports to Congress—** Not less frequently than annually, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall submit to Congress a report on—
    - (A) the use of grants awarded under this section;
    - (B) the proportion of grants used to support cybersecurity in rural areas;
    - (C) the effectiveness of the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program;
    - (D) any necessary modifications to the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program; and
    - (E) any progress made toward—
      - (i) developing, implementing, or revising Cybersecurity Plans; and
      - (ii) reducing [cybersecurity risks](/usc/6/650.md?p=7) to, and identifying, responding to, and recovering from [cybersecurity threats](/usc/6/650.md?p=8-A) to, [information systems](/usc/6/650.md?p=14) owned or operated by, or on behalf of, [State](/usc/6/101.md?p=17), local, or [Tribal governments](/usc/6/601.md?p=14) as a result of the award of grants under this section.
  - (3) **Public availability—**
    - (A) **In general—** The [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall make each report submitted under [paragraph (2)](#q-2) publicly available, including by making each report available on the website of the [Agency](/usc/6/650.md?p=1).
    - (B) **Redactions—** In making each report publicly available under [subparagraph (A)](#q-3-A), the [Director](/usc/6/650.md?p=10) may make redactions that the [Director](/usc/6/650.md?p=10), in consultation with each eligible [entity](/usc/6/301c.md?p=2), determines necessary to protect classified or other information exempt from disclosure under [section 552 of title 5](/usc/5/552.md) (commonly referred to as the “Freedom of Information Act”).
  - (4) **Study of risk-based formulas—**
    - (A) **In general—** Not later than September 30, 2024, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall submit to the [appropriate congressional committees](/usc/6/650.md?p=2) a study and legislative recommendations on the potential use of a risk-based formula for apportioning [funds](/usc/6/677a.md?p=5) under this section, including—
      - (i) potential components that could be included in a risk-based formula, including the potential impact of those components on support for rural areas under this section;
      - (ii) potential sources of data and information necessary for the implementation of a risk-based formula;
      - (iii) any obstacles to implementing a risk-based formula, including obstacles that require a legislative solution;
      - (iv) if a risk-based formula were to be implemented for fiscal year 2026, a recommended risk-based formula for the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program; and
      - (v) any other information that the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), determines necessary to help Congress understand the progress towards, and obstacles to, implementing a risk-based formula.
    - (B) **Inapplicability of Paperwork Reduction Act—** The requirements of [chapter 35](/usc/44/chch35.md) of title 44 (commonly referred to as the “Paperwork Reduction Act”), shall not apply to any action taken to carry out this paragraph.
  - (5) **Tribal cybersecurity needs report—** Not later than 2 years after November 15, 2021, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall submit to Congress a report that—
    - (A) describes the cybersecurity needs of [Tribal governments](/usc/6/601.md?p=14), which shall be determined in consultation with the [Secretary](/usc/6/641.md?p=3) of the Interior and [Tribal governments](/usc/6/601.md?p=14); and
    - (B) includes any recommendations for addressing the cybersecurity needs of [Tribal governments](/usc/6/601.md?p=14), including any necessary modifications to the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program to better serve [Tribal governments](/usc/6/601.md?p=14).
  - (6) **GAO review—** Not later than 3 years after November 15, 2021, the Comptroller General of the [United States](/usc/6/101.md?p=19-A) shall conduct a review of the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program, including—
    - (A) the grant selection process of the [Secretary](/usc/6/641.md?p=3); and
    - (B) a sample of grants awarded under this section.
- (r) **Authorization of appropriations—**
  - (1) **In general—** There are authorized to be appropriated for activities under this section—
    - (A) for fiscal year 2022, $200,000,000;
    - (B) for fiscal year 2023, $400,000,000;
    - (C) for fiscal year 2024, $300,000,000; and
    - (D) for fiscal year 2025, $100,000,000.
  - (2) **Transfers authorized—**
    - (A) **In general—** During a fiscal year, the [Secretary](/usc/6/641.md?p=3) or the head of any component of the [Department](/usc/6/641.md?p=1) that administers the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program may transfer not more than 5 percent of the amounts appropriated pursuant to [paragraph (1)](#r-1) or other amounts appropriated to carry out the [State](/usc/6/101.md?p=17) and Local Cybersecurity Grant Program for that fiscal year to an account of the [Department](/usc/6/641.md?p=1) for salaries, expenses, and other administrative costs incurred for the management, administration, or evaluation of this section.
    - (B) **Additional appropriations—** Any [funds](/usc/6/677a.md?p=5) transferred under [subparagraph (A)](#r-2-A) shall be in addition to any [funds](/usc/6/677a.md?p=5) appropriated to the [Department](/usc/6/641.md?p=1) or the components described in [subparagraph (A)](#r-2-A) for salaries, expenses, and other administrative costs.
- (s) **Termination—**
  - (1) **In general—** Subject to [paragraph (2)](#s-2), the requirements of this section shall terminate on September 30, 2026.
  - (2) **Exception—** The reporting requirements under [subsection (q)](#q) shall terminate on the date that is 1 year after the date on which the final [funds](/usc/6/677a.md?p=5) from a grant under this section are expended or returned.

## Footnotes

[^1]: So in original. The comma probably should not appear.

## Source credit

(Pub. L. 107–296, title XXII, § 2220A, formerly § 2218, as added Pub. L. 117–58, div. G, title VI, § 70612(a), Nov. 15, 2021, 135 Stat. 1272; renumbered § 2220A and amended Pub. L. 117–81, div. A, title XV, § 1547(b)(1)(A)(viii), Dec. 27, 2021, 135 Stat. 2061; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(K), Dec. 23, 2022, 136 Stat. 3660; Pub. L. 119–75, div. I, § 5009, Feb. 3, 2026, 140 Stat. 630.)

## Notes

### Editorial Notes

### References in Text

The Food and Nutrition Act of 2008, referred to in subsec. (m)(2)(C)(ii), is Pub. L. 88–525, Aug. 31, 1964, 78 Stat. 703, which is classified generally to chapter 51 (§ 2011 et seq.) of Title 7, Agriculture. For complete classification of this Act to the Code, see Short Title note set out under section 2011 of Title 7 and Tables.

### Amendments

2026—Subsec. (s)(1). Pub. L. 119–75 substituted “September 30, 2026” for “September 30, 2025”.

2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(K)(i), redesignated pars. (3), (4), and (8) to (12) as (1) to (7), respectively, and struck out former pars. (1), (2), and (5) to (7) which defined appropriate committees of Congress, cyber threat indicator, incident, information sharing and analysis organization, and information system, respectively.

Subsec. (e)(2)(B)(xiv)(II)(aa). Pub. L. 117–263, § 7143(b)(2)(K)(ii), substituted “Information Sharing and Analysis Organization” for “information sharing and analysis organization”.

Subsec. (p). Pub. L. 117–263, § 7143(b)(2)(K)(iii), substituted “appropriate congressional committees” for “appropriate committees of Congress”.

Subsec. (q)(4)(A). Pub. L. 117–263, § 7143(b)(2)(K)(iv), which directed amendment of subsec. (q)(4) by substituting “appropriate congressional committees” for “appropriate committees of Congress” “in the matter preceding clause (i)”, was executed by making the substitution in the introductory provisions of subsec. (q)(4)(A), to reflect the probable intent of Congress.

2021—Pub. L. 117–81 reenacted section catchline.