Maryland State and Local Cybersecurity Grant Program

The Maryland State and Local Cybersecurity Grant Program is administered in Maryland through the Maryland Department of Emergency Management, the Maryland Department of Information Technology, and the Maryland State and Local Cybersecurity Grant Program Planning Committee. Congress established the program through the Infrastructure Investment and Jobs Act to provide funding to eligible entities to address cybersecurity risks and threats to information systems owned or operated by, or on behalf of, state, local, or tribal governments. At the federal level, the Cybersecurity and Infrastructure Security Agency provides cybersecurity subject-matter expertise and determines allowable activities, while the Federal Emergency Management Agency conducts eligibility reviews and administers federal awards. Maryland operates the funding as a reimbursable subgrant program for eligible jurisdictions. Funding supports cybersecurity projects and services that improve cyber resilience and align with CISA priorities and the Maryland SLCGP plan. Maryland's project categories include adoption or enhancement of priority cybersecurity best practices; adoption or enhancement of general cybersecurity best practices; cybersecurity policy and governance; projects addressing specific jurisdictional cybersecurity needs; and cybersecurity workforce development. Priority practices include asset discovery and vulnerability management, multi-factor authentication, endpoint detection and response, email security, and security awareness training. Other supported practices include enhanced logging, data encryption, end-of-use processes for software and hardware, strong password controls, system backups and recovery, migration to the .gov domain, and related cybersecurity practices. The program can also support incident response plans, continuity planning, risk and threat assessments, technology modernization, and workforce recruitment and development. All Maryland local governments are eligible to apply. The definition includes counties, municipalities, cities, towns, townships, local public authorities, school districts, special districts, intrastate districts, councils of governments, regional or interstate government entities, and agencies or instrumentalities of local governments. Rural communities, unincorporated towns or villages, and other qualifying public entities are also included. FEMA defines a rural area as an area with fewer than 50,000 people that has not been designated as an urbanized area in the most recent decennial census. Maryland also permits a local government to establish rural status using adequate evidence such as a planning and zoning designation or mapping. Evidence supporting Maryland rural classification must accompany the application when applicable. More than $4.9 million is announced as available through the current State and Local Cybersecurity Grant Program opportunity, consisting of Maryland's FFY 2024 funding and additional funds remaining for disbursement from FFY 2023. Maryland received approximately $4.9 million for FFY 2024. At least 80 percent of SLCGP funding supports local jurisdictions, and 25 percent of the award is reserved for rural jurisdictions. The sources do not establish a minimum or maximum individual subgrant award, number of awards, or an applicant matching requirement, so individual award floor and ceiling values cannot be reliably stated. FFY 2023 second-round funding is intended for short-term projects and is described as being accepted on a rolling basis. FFY 2023 projects must be completed by September 2027, while FFY 2024 projects must be completed by September 2028. Applicants must prepare and submit the applicable Maryland SLCGP project proposal materials. The FFY 2024 application package identifies the Maryland FFY2024 SLCGP Subgrant Project Proposal Application and Maryland SLCGP FFY2024 Additional Application Documents Packet, including the Budget Narrative and Justification and Appendix E Measurable Milestones. A W-9 is required when applicable, an itemized vendor-services quote is required when a vendor or contractor will be used, and Maryland rural classification evidence is required when applicable. The proposal requires information concerning the project, requested funding, jurisdiction, operational technology, project dates, contacts, project categories and best practices, compliance certifications, rural alignment when applicable, and a proposal narrative. Completed application materials are submitted by email to slcgp.grant@maryland.gov. The current announcement states that applications will be accepted through September 22, 2026. Applications are evaluated by the Maryland State and Local Cybersecurity Grant Program Planning Committee based on statutory requirements, demonstrated need, application quality, and the applicant's ability to maintain federal and state grant compliance. The funding guide further evaluates project proposal and management quality, including clarity and quality, feasibility, timeliness, monitoring and evaluation, and the likelihood of successful implementation and long-term sustainment. Applicants should explain how the project improves their cybersecurity posture, identify outputs and outcomes, describe relevant partners and beneficiaries, address sustainability, demonstrate financial and oversight capacity, and establish measurable milestones and performance indicators. Rural status and alignment with Maryland's priority cybersecurity categories receive particular consideration in the competitive process. The current funding announcement was issued August 24, 2026, and applications are accepted through September 22, 2026. This later official announcement supersedes the earlier FFY 2024 Funding Guide deadline of August 21, 2026 for purposes of the current application close date. Award notification is sent by the State Administrative Agency to the application's designated primary contact if a project is approved, and recipients must accept or decline an award within 30 days of the award date. The project performance period begins when the State Administrative Agency notifies the subrecipient of approval and releases the funds or services. FFY 2024 projects must be completed by September 30, 2028, while the announcement states that FFY 2023 projects must be completed by September 2027. Applicants can obtain application information from the Cyber Preparedness Unit funding page at https://mdem.maryland.gov/Pages/cyber-preparedness-funding.aspx or contact the program at slcgp.grant@maryland.gov.

Clearly define the cybersecurity problem project scope mission and intended outcomes; demonstrate sufficient expertise and resources to implement the project; show that outputs and outcomes can be achieved within the performance period; provide measurable tasks milestones baselines targets and monitoring indicators; explain sustainability beyond the grant period; align the proposal with Maryland priority cybersecurity best practices where applicable; provide required procurement documentation for vendor services; substantiate Maryland rural status with evidence when claiming the expanded rural classification.