Key Takeaways
- The CISA State and Local Cybersecurity Grant Program (SLCGP) allocated $1 billion over 4 years (2022–2026) — states must pass at least 80% to local governments and tribal organizations
- State CIOs and homeland security agencies administer SLCGP sub-awards — local governments apply to their state, not CISA directly
- NSF Secure and Trustworthy Cyberspace (SaTC) funds academic cybersecurity research — up to $500K per award for universities and research institutions
- Small businesses can access SBA's cybersecurity training pilot and DOD SBIR/STTR programs for cyber technology development
- Water utilities, hospitals, and critical infrastructure operators have sector-specific CISA programs separate from SLCGP
CISA State and Local Cybersecurity Grant Program (SLCGP)
The Infrastructure Investment and Jobs Act (2021) created the SLCGP — the first dedicated federal cybersecurity grant program for state and local governments. CISA administers the program; states receive formula allocations and must competitively award at least 80% to local government entities, multi-entity groups, and tribal organizations.
What SLCGP Funds
- Developing and implementing a state cybersecurity plan
- Cybersecurity assessments, penetration testing, and vulnerability remediation
- Multi-factor authentication (MFA) and identity management systems
- Security operations center (SOC) development or enhancement
- Cybersecurity workforce training and certification programs
- Incident response planning and tabletop exercises
To access SLCGP funds: contact your state's homeland security or emergency management agency. Each state publishes its own sub-award RFP — search "[your state] SLCGP grants 2026" to find current opportunities.
NSF Secure and Trustworthy Cyberspace (SaTC)
NSF's SaTC program (CFDA: 47.070) funds foundational cybersecurity research at universities and research institutions. Award types:
- Small projects (SMALL): Up to $500K over 3 years — single PI, focused research question
- Medium projects (MEDIUM): $500K–$1.2M over 4 years — multi-investigator teams
- Frontiers (LARGE): $1.5M–$3M over 5 years — transformative research agendas
Priority research areas in 2026: AI/ML security, post-quantum cryptography, hardware security, privacy-enhancing technologies, and cybersecurity education. Annual deadline cycle: typically January–March for full proposals.
DOD SBIR/STTR for Cyber Technology
Small businesses developing cybersecurity technology for defense applications can apply for DOD SBIR/STTR grants. Relevant DOD components with active cyber SBIR topics:
- DARPA: Advanced cyber operations, AI-assisted cyber defense, automated vulnerability research
- Army SBIR: Cyber situational awareness, supply chain risk management technology
- Navy SBIR: Network resilience, zero-trust architecture implementation tools
- AFWERX (Air Force): Open SBIR topics for dual-use cyber technology with commercial potential
Phase I awards: up to $300K for 6 months. Phase II: up to $2M for 2 years. Apply at sbir.gov during open solicitation windows.
SBA Cybersecurity for Small Business Pilot Program
The SBA launched a cybersecurity pilot program in 2024 with $3 million in initial funding distributed to Small Business Development Centers (SBDCs) and Women's Business Centers (WBCs) to provide cybersecurity training and assessment services to small businesses at no cost. Services include:
- Cybersecurity vulnerability assessments for small businesses
- Incident response planning assistance
- NIST Cybersecurity Framework implementation guidance
- Cyber insurance readiness evaluation
Access this program through your local SBDC — find your center at sbdc.net. Services are free to qualifying small businesses.
Critical Infrastructure Sector-Specific Programs
CISA and sector-specific agencies operate targeted cybersecurity programs for critical infrastructure operators:
EPA and CISA jointly fund the WaterISAC and provide free cybersecurity assessments to water utilities. The Water Infrastructure Act requires water systems serving 3,300+ people to conduct risk/resilience assessments.
HHS/OCR provides HIPAA security rule compliance resources and CISA offers voluntary cybersecurity performance goals for healthcare. HPH-specific CISA assessments are available to hospitals at no cost.
CISA's K-12 Cybersecurity Act resources and the MS-ISAC (Multi-State Information Sharing Center) provide free threat intelligence and incident response support to public schools — funded through DHS.
Action Checklist
- Local government: Contact your state homeland security agency — ask about current SLCGP sub-award RFPs and application deadlines
- University/research institution: Review NSF SaTC solicitation at nsf.gov — current program deadline and priority topics
- Small business with cyber technology: Review DOD SBIR open solicitations at sbir.gov/solicitations — search "cyber" and "cybersecurity" topics
- Small business needing help: Contact your local SBDC for free cybersecurity assessment — find at sbdc.net
- Critical infrastructure: Request a free CISA cybersecurity assessment at cisa.gov/cyber-hygiene-services — no cost, no obligation
◆ Primary Sources & Further Reading
Related Articles
Frequently Asked Questions
What is the State and Local Cybersecurity Grant Program?
SLCGP is a $1 billion, four-year DHS/CISA program helping state, local, and tribal governments improve cybersecurity. Funds flow through state administrative agencies, which must pass at least 80 percent to local governments. Eligible uses include planning, assessments, training, and security tooling.
Can private companies get federal cybersecurity grants?
Direct grants to private companies are limited, but small businesses can pursue cybersecurity R&D through NSF and DHS SBIR programs, and defense contractors can access some DoD cybersecurity assistance. Most federal cyber grant money targets government entities and critical infrastructure.
Are there cybersecurity grants for schools and hospitals?
School districts qualify as local governments under SLCGP, and the FCC has piloted a cybersecurity program for schools and libraries. Hospitals can use HHS preparedness funding for cyber resilience, and rural hospitals have access to specific HHS cybersecurity initiatives.
What do cybersecurity grant applications typically require?
Most programs require a cybersecurity plan aligned with the NIST Cybersecurity Framework, a self-assessment of current posture, adoption of baseline practices like multi-factor authentication, and participation in information sharing organizations such as MS-ISAC.