IIJA on Cybersecurity: Broadband Internet Access, Cyber Defenses – The National Law Review
Tuesday, November 30, 2021
On November 15, 2021, President Joe Biden signed into law the Infrastructure Investment and Jobs Act (IIJA), unleashing over $1 trillion of federal money to strengthen the nation’s infrastructure and fund other key programs and initiatives. In addition to appropriating billions of dollars to improving transportation networks, expanding broadband internet accessibility and promoting clean energy projects, the bill allocates $2 billion to strengthening the nation’s cyber defenses. As we explain below, this is part of a broad whole-of-government approach on cybersecurity—implicating both public and private entities.
The IIJA’s notable cybersecurity appropriations include:
-
$1 billion for grants to improve state and local government cybersecurity;
-
$250 million to fund the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program—a program designed to support public utilities and other eligible entities;
-
$250 million to develop “advanced cybersecurity applications and technologies for the energy sector”;
-
$20 million per year for fiscal year 2022, and every year thereafter until 2028, to create a Cyber Response and Recovery Fund to help public and private entities respond to a significant cyber incident;
-
$157.5 million for the US Department of Homeland Security’s Science and Technology Directorate (DHS-S&T) to fund “critical infrastructure security and resilience research, development, test, and evaluation”;
-
$35 million for the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) for “risk management operations and stakeholder engagement and requirements”; and
-
$21 million to fund the recently created Office of the National Cyber Director (ONCD).
IN DEPTH
STATE AND LOCAL CYBERSECURITY GRANTS
The largest appropriation funds a $1 billion grant program for state and local governments. Dispersed over the course of four years, this money will support efforts to enhance the cybersecurity of state and local government information systems. The IIJA appropriates $200 million in federal grants under this program for fiscal year 2022; it appropriates $400 million, $300 million and $100 million, respectively, for fiscal years 2023, 2024 and 2025.
The funds, however, come with a catch: State and local governments must provide matching funds from their own coffers, with the federal share capped each fiscal year. For fiscal year 2022, the federal share of the cost of an activity carried out under the grant program cannot exceed 90%. Maximum federal contributions then decrease each fiscal year by 10%, requiring state and local governments to …….