Maryland organizations and jurisdictions have access to multiple funding streams to support their development, resilience, and cyber maturity.
Read on to learn more about what's available!
Note:
This page contains links to external websites. Those links are marked with this icon: . Pages targeted by those links are not managed by the State of Maryland and may not be fully digitally accessible. The State of Maryland provides them as suggested resources only, and not through any contractual, licensing, or other formal arrangement; and disclaims any liability relating to their accessibility status.
State + Local Cybersecurity Grant Program
IMPORTANT NEWS: An additional funding opportunity for short-term projects has opened!
See
"Upcoming Opportunities" to learn more.
General Info:
The goal of the State and Local Cybersecurity Grant Program (SLCGP) is to help states, local governments, rural areas, and territories address cybersecurity risks and cybersecurity threats to information systems. Through this program, the Department of Homeland Security (DHS) can direct strategic investments to enhance the cybersecurity posture of government agencies, bolstering the protection of critical infrastructure and the resilience of essential public services.
(Read the official FEMA Notice of Funding for this grant here)
Background & Purpose
In Maryland, the strategy for prioritizing and approving projects using SLCGP funds will be developed and maintained by the
State of Maryland SLCGP Planning Committee.
The
Cybersecurity and Infrastructure Security Agency (CISA) and
Federal Emergency Management Agency (FEMA) jointly manage the SLCGP. CISA provides subject-matter expertise and determines allowable activities, whileFEMA conducts eligibility reviews and issues/administers the grant awards consistent with all applicable laws, regulations, and policies.
The
Maryland Department of Emergency Management (MDEM) is the state’s lead agency for the State and Local Cybersecurity Grant Program (SLCGP). MDEM manages the program on behalf of the State of Maryland, provides administrative oversight, and serves as the main point of contact for eligible applicants. Once projects are awarded, MDEM also helps subrecipients by processing reimbursement requests and making sure all grant requirements are met.
The
Maryland Department of Information Technology (DoIT) serves as the program’s subject-matter expert. DoIT reviews project proposals, provides technical guidance, and ensures projects align with the state’s cybersecurity
priorities.
Together, MDEM and DoIT co-chair the
Maryland State Cybersecurity Planning Committee, which includes representatives from state and local governments. This committee is responsible for developing strategies, reviewing applications, and approving projects. The committee has also created Maryland’s Cybersecurity Plan, which guides how SLCGP funding isused to strengthen cybersecurity across the state.
State agencies and local governments that receive SLCGP funding are subrecipients of the grant. Subrecipients must follow all federal and state compliance requirements, including proper reporting and documentation. MDEM and DoIT will provide guidance and support throughout this process.
The goals of the program are to ensure that resources reach the jurisdictions that need them most and to build long-term cybersecurity capacity across Maryland.
Current Subrecipient Resources
For FY2022 Subrecipients:
Congratulations to all FY22 subrecipients! Please check the "General Information" section below to find the continuing requirements for completing your project.
Please note that all FY2022 projects must be completed by September 30, 2026.
For ISO (aka Local Support Program) Shared Service Recipients:
The Maryland Department of Information Technology (DoIT) oversees the Local Support program. Information for this program was sent to your project's designated primary point of contact.
For FY2023 Subrecipients:
Congratulations to all FY23 subrecipients! Please check the "General Information" section below to find the continuing requirements for completing your project.
Please note that all FY2022 projets must be completed by September 30, 2027.
Applications Available Now!
FY2023 Second Round Applications
A second-round application for FY23 SLCGP funds is open!
We will accept applications on a rolling basis. Please note that all FY2023 projects
must be completed by September 30, 2027.
To apply for the second-round opportunity, please fill out and submit the following application documents:
Step-by-Step Process: How To Apply
Information Guides
Application Documents
To apply, please follow the instructions below:
- Review all information guides provided above
- Download and complete the following documents:
- Email completed forms to
[email protected]. Subject line MUST be formatted as follows:
- FY[Funding Year] SLCGP - [Subrecipient Name] [Project Title] Application Forms
- Example: FY[23] SLCGP - [MDEM] - [SLCGP Project] Application Forms
- Committee submits projects to FEMA
- FEMA approves/rejects projects
- Receive Committee Project Disposition
- If approved, funds are awarded to the pass-through entity (MDEM) upon signature of this subrecipient subaward agreement.
- Submit Letter of Intent to Accept or Reject Funding within 30 days to
[email protected]. Subject line MUST be formatted as follows:
-
FY[Funding Year] SLCGP - [Subrecipient Name] [Project Title] Letter of Intent
-
Example: FY[23] SLCGP - [MDEM] - [SLCGP Project] Letter of Intent
The scoring criteria for the applications are included in the Maryland FFY2023 SLCGP Subrecipient Funding Guide – applicants should review the scoring criteria to understand how the Committee will score the applications.
Unique Entity Identifier (UEI)
Entities doing business with the federal government must obtain and use the Unique Entity Identifier (UEI) created in SAM.gov. For current applicants, if you have a UEI, enter it in the application template where it is indicated. If you do not yet have a UEI you may leave that field in the application template blank, and your application will be accepted. However, please continue your efforts to get a UEI, as MDEM must have a UEI for all successful applicants in order to issue subrecipient awards in the coming months. Please refer to the UEI instructions at
SAM.gov.
REMINDER: Do not submit applications to FEMA or grants.gov. MDEM will do that on behalf of the State of Maryland.
If you submitted a project by the October 3, 2024 deadline and were approved for SLCGP funding please find more information on ongoing project requirements, in the “General Information” section.
FY2024 New Applications
FY2024 SLCGP funding is now available!
Projects must be completed by September 30, 2028.
To apply for the FFY2024, please fill out and submit the following application documents:
Step-by-Step Process: How To Apply
Information Guides
Application Documents
To apply, please follow the instructions below:
- Review all information guides provided above
- Download and complete the following documents:
- Email completed forms to
[email protected]. Subject line MUST be formatted as follows:
- FY[Funding Year] SLCGP - [Subrecipient Name] [Project Title] Application Forms
- Example: FY[24] SLCGP - [MDEM] - [SLCGP Project] Application Forms
- Committee submits projects to FEMA
- FEMA approves/rejects projects
- Receive Committee Project Disposition
- If approved, funds are awarded to the pass-through entity (MDEM) upon signature of this subrecipient subaward agreement.
- Submit Letter of Intent to Accept or Reject Funding within 30 days to
[email protected]. Subject line MUST be formatted as follows:
-
FY[Funding Year] SLCGP - [Subrecipient Name] [Project Title] Letter of Intent
-
Example: FY[24] SLCGP - [MDEM] - [SLCGP Project] Letter of Intent
DO NOT START your project until you receive notification of FEMA approval (from MDEM) AND have a fully executed Subrecipient Agreement (SRA) contract in place.
The scoring criteria for the applications are included in the Maryland FFY2024 SLCGP Subrecipient Funding Guide – applicants should review the scoring criteria to understand how the Committee will score the applications.
Unique Entity Identifier (UEI)
Entities doing business with the federal government must obtain and use the Unique Entity Identifier (UEI) created in SAM.gov. For current applicants, if you have a UEI, enter it in the application template where it is indicated. If you do not yet have a UEI you may leave that field in the application template blank, and your application will be accepted. However, please continue your efforts to get a UEI, as MDEM must have a UEI for all successful applicants in order to issue subrecipient awards in the coming months. Please refer to the UEI instructions at
SAM.gov.
REMINDER: Do not submit applications to FEMA or grants.gov. MDEM will do that on behalf of the State of Maryland.
Upcoming Opportunities
This section contains information regarding grant funds that will soon be available.
FY2025:
More information coming soon!
General Information
This section contains basic compliance & reporting information for approved projects only.
Getting Started
IMPORTANT: DO NOT START your project until you receive notification of FEMA approval (from MDEM) AND have a fully executed Subrecipient Agreement (SRA) contract in place.
If you have received approval for SLCGP funding, you MUST have a signed SRA contract in place, and acknowledge the Terms & Conditions document.
For a more comprehensive list of instructions, refer to:
- The email you received with your award notification
- the Funding Guide for your specific fiscal year (FY)
Period of Performance (POP)
Your project must be completed within the period of performance for your grant cycle. The performance dates each fiscal year of funding are:
-
FY2022 - December 1, 2022 to August 31, 2026
-
FY2023 - June 25, 2025 to August 31, 2027
-
FY2024 - September 1, 2026 to September 31, 2028
-
FY2025 - More information to come!
NOTE: As a subrecipient, your POP may differ from the information indicated in the federal Notice of Funding Opportunity. Check your project's SRA for the most accurate information, and reach out to MDEM ([email protected]) with any questions.
Grant Compliance Requirements & Programmatic Reporting
Step 1: Register for the Cyber Hygiene (CyHy) service.
Cyber Hygiene is a free cybersecurity service provided by CISA to help organizations reduce their exposure to threats.
CyHy registration is a one-time requirement.
All subrecipients MUST send a PDF copy of their CyHy acceptance email to MDEM at
[email protected].
Please visit the Cyber Hygiene Services page for access and additional information.
Step 2: Complete & submit programmatic reports quarterly.
Subrecipients are required to submit Quarterly Status Reports (QSRs) with financial and programmatic information about your project until your project is complete, at which time you will use different instructions to submit a Close-out Report (CSR). Due dates for each quarterly reporting period are listed below.
-
For the reporting period of July 1 to September 30,
reports are due October 15.
- For the reporting period of October 1 to December 31,
reports are due January 15.
- For the reporting period of January 1 to March 31,
reports are due April 15.
- For the reporting period of April 1 to June 30,
reports are due July 15.
NOTE: If your project is a one-time expense, you will not need to complete quarterly reports. Instead, you will complete a one-time closeout report using the QSR template.
Please be aware that
reimbursements and/or future awards may be withheld if these reports are delinquent. Additionally, subrecipients should retain copies of these reports (along with any additional documentation supporting the project's financial expenditures) for at least 3 years after the end of the project's period of performance.
Be sure to follow all QSR instructions provided, and include:
- Expenditure & obligation details
- Brief narrative of the project(s) status
- Summary of project expenditures
- Description of any potential issues that may affect project completion
- Data collected for any additional Committee performance measure requirements
- Recipients are also required to submit an updated SCLGP Measureable Milestones document (included in QSR template).
Be sure to follow all CSR instructions provided, and include:
- Final Expenditures
- Brief narrative of the final status of the project(s)
- Description of any potential issues that affected milestone completion
- Data collected for any additional Committee performance measure requirements
Reimbursement Process
The SLCGP is a reimbursement-based grant program. Subrecipients must submit requests to the SAA for approved grant project-related expenses.
When submitting a reimbursement request, subrecipients must ensure that all documentation is complete and accurate to prevent delays in the payment process. Documentation should clearly demonstrate an allowable purchase that is directly related to the scope of work from your approved proposal, and include both proof of purchase and proof of payment.
MDEM has instituted a standard Reimbursement Request Form template for all reimbursement requests. Please
download the SLCGP Reimbursement Request Form template and use it when submitting your request(s).
Reimbursement requests and accompanying documentation must be emailed to [email protected].
If you have questions about the SLCGP or the application documents,
please email [email protected].
We'd love to hear from you, and we're here to help!
SLCGP Planning Committee Minutes & Agendas
Find these on MDEM's Public Meetings page!