HF 5324

as introduced - 93rd Legislature (2023 - 2024) Posted on 04/08/2024 02:16pm

A bill for an act
relating to state government; establishing a state-funded county and city
cybersecurity grant program; requiring a report; appropriating money; proposing
coding for new law in Minnesota Statutes, chapter 16E.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [16E.36] STATE-FUNDED COUNTY AND CITY CYBERSECURITY
GRANT PROGRAM.
new text end

new text begin Subdivision 1. new text end

new text begin Grant account established. new text end

new text begin A state-funded cybersecurity grant account
is established in the special revenue fund. Money in the account is appropriated to the
commissioner to provide grants to counties and cities that currently lack the resources to
directly benefit from other federal and state cybersecurity plans and programs. Money in
the account is available until expended.
new text end

new text begin Subd. 2. new text end

new text begin Authorized purchases. new text end

new text begin A county or city may apply to the commissioner to
receive a grant for the following expenditures:
new text end

new text begin (1) general information technology services for cybersecurity;
new text end

new text begin (2) equipment to secure operational technology, including industrial control systems;
new text end

new text begin (3) storage and backup solutions;
new text end

new text begin (4) cloud-based backup and data storage services;
new text end

new text begin (5) data management and data archiving solutions;
new text end

new text begin (6) secure email hosting and productivity and collaboration software;
new text end

new text begin (7) email filtering solutions;
new text end

new text begin (8) web filtering and DNS security solutions;
new text end

new text begin (9) antivirus and endpoint detection and response software;
new text end

new text begin (10) firewalls, network switches, and other networking hardware;
new text end

new text begin (11) monitoring and log management solutions; and
new text end

new text begin (12) consulting or other professional services necessary to implement any of the
expenditures identified in clauses (1) to (11).
new text end

new text begin Subd. 3. new text end

new text begin Application for grant; assessment of program priorities and local need. new text end

new text begin The
commissioner must establish an application to be used for the purpose of awarding grants.
The commissioner must also establish standards for application review. At a minimum, the
review must assess each proposed expenditure with a focus on reducing overall risk across
all counties and cities in the state, targeting the availability of systems that underpin critical
infrastructure and public services; protect government data; and promote compliance with
applicable state laws, rules, executive orders, and industry best practices. The commissioner
must also prioritize applications based on their demonstrated degree of local need, including
whether the county or city employs dedicated staff with cybersecurity expertise, and whether
the county or city has the capacity to access other local resources to support the proposed
expenditure. The application must require the county or city to provide sufficient information
necessary for the commissioner to make these assessments. In considering whether to award
a grant, the commissioner must ensure that money is distributed equitably among geographic
regions of the state.
new text end

new text begin Subd. 4. new text end

new text begin Amount of initial grant; supplemental grants. new text end

new text begin (a) Upon submitting an
application for an eligible expenditure that meets the standards required under subdivision
3, each county or city may receive an initial grant for the full cost of that expenditure, up
to $25,000.
new text end

new text begin (b) In addition to grants under paragraph (a), the commissioner may award supplemental
grants, including for proposed expenditures that exceed $25,000, provided that the
supplemental grant amount may not exceed 75 percent of the total cost of a proposed
expenditure above $25,000. A county or city may not receive a total of more than $1,000,000
in grant money under this section. If the commissioner determines that an application for a
supplemental grant meets the standards required under subdivision 3 for an eligible
expenditure, the commissioner may approve the application, either in whole or in part. The
commissioner may collaborate with counties and cities to establish additional criteria for
the consideration of applications and the awarding of grants.
new text end

new text begin Subd. 5. new text end

new text begin Grant accountability. new text end

new text begin As a condition of receiving a grant, the commissioner
must require the receiving county or city to agree to annual reporting on its use of the grant
funds and other appropriate standards for grant tracking and accountability. These standards
must be determined by the commissioner, in consultation with the commissioner of
administration.
new text end

new text begin Subd. 6. new text end

new text begin Report to legislature. new text end

new text begin No later than January 15, 2025, and annually thereafter
until available appropriations have been exhausted, the commissioner must submit a report
to the legislative committees with jurisdiction over state government finance on the grants
awarded by this section. The report must detail each grant awarded, including the jurisdiction,
the amount of the grant, and a general description of the expenditure for which each grant
was used.
new text end

Sec. 2. new text begin STATE-FUNDED COUNTY AND CITY CYBERSECURITY GRANT
PROGRAM; APPROPRIATION.
new text end

new text begin $20,000,000 in fiscal year 2025 is appropriated from the general fund to the state-funded
cybersecurity grant account in the special revenue fund.
new text end