1.1 	A bill for an act
1.2 	relating to state government; establishing a state-funded county and city 
1.3 	cybersecurity grant program; requiring a report; appropriating money;proposing 
1.4 	coding for new law in Minnesota Statutes, chapter 16E.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [16E.36] STATE-FUNDED COUNTY AND CITY CYBERSECURITY 
1.7 	GRANT PROGRAM.
1.8 		Subdivision 1.Grant account established. A state-funded cybersecurity grant account 
1.9 	is established in the special revenue fund. Money in the account is appropriated to the 
1.10 	commissioner to provide grants to counties and cities that currently lack the resources to 
1.11 	directly benefit from other federal and state cybersecurity plans and programs. Money in 
1.12 	the account is available until expended.
1.13 		Subd. 2.Authorized purchases. A county or city may apply to the commissioner to 
1.14 	receive a grant for the following expenditures:
1.15 	(1) general information technology services for cybersecurity;
1.16 	(2) equipment to secure operational technology, including industrial control systems;
1.17 	(3) storage and backup solutions;
1.18 	(4) cloud-based backup and data storage services;
1.19 	(5) data management and data archiving solutions;
1.20 	(6) secure email hosting and productivity and collaboration software;
1.21 	(7) email filtering solutions;
2.1 	(8) web filtering and DNS security solutions;
2.2 	(9) antivirus and endpoint detection and response software;
2.3 	(10) firewalls, network switches, and other networking hardware;
2.4 	(11) monitoring and log management solutions; and
2.5 	(12) consulting or other professional services necessary to implement any of the 
2.6 	expenditures identified in clauses (1) to (11).
2.7 		Subd. 3.Application for grant; assessment of program priorities and local need. The 
2.8 	commissioner must establish an application to be used for the purpose of awarding grants. 
2.9 	The commissioner must also establish standards for application review. At a minimum, the 
2.10 	review must assess each proposed expenditure with a focus on reducing overall risk across 
2.11 	all counties and cities in the state, targeting the availability of systems that underpin critical 
2.12 	infrastructure and public services; protect government data; and promote compliance with 
2.13 	applicable state laws, rules, executive orders, and industry best practices. The commissioner 
2.14 	must also prioritize applications based on their demonstrated degree of local need, including 
2.15 	whether the county or city employs dedicated staff with cybersecurity expertise, and whether 
2.16 	the county or city has the capacity to access other local resources to support the proposed 
2.17 	expenditure. The application must require the county or city to provide sufficient information 
2.18 	necessary for the commissioner to make these assessments. In considering whether to award 
2.19 	a grant, the commissioner must ensure that money is distributed equitably among geographic 
2.20 	regions of the state.
2.21 		Subd. 4.Amount of initial grant; supplemental grants. (a) Upon submitting an 
2.22 	application for an eligible expenditure that meets the standards required under subdivision 
2.23 	3, each county or city may receive an initial grant for the full cost of that expenditure, up 
2.24 	to $25,000.
2.25 	(b) In addition to grants under paragraph (a), the commissioner may award supplemental 
2.26 	grants, including for proposed expenditures that exceed $25,000, provided that the 
2.27 	supplemental grant amount may not exceed 75 percent of the total cost of a proposed 
2.28 	expenditure above $25,000. A county or city may not receive a total of more than $1,000,000 
2.29 	in grant money under this section. If the commissioner determines that an application for a 
2.30 	supplemental grant meets the standards required under subdivision 3 for an eligible 
2.31 	expenditure, the commissioner may approve the application, either in whole or in part. The 
2.32 	commissioner may collaborate with counties and cities to establish additional criteria for 
2.33 	the consideration of applications and the awarding of grants.
3.1 		Subd. 5.Grant accountability. As a condition of receiving a grant, the commissioner 
3.2 	must require the receiving county or city to agree to annual reporting on its use of the grant 
3.3 	funds and other appropriate standards for grant tracking and accountability. These standards 
3.4 	must be determined by the commissioner, in consultation with the commissioner of 
3.5 	administration.
3.6 		Subd. 6.Report to legislature. No later than January 15, 2025, and annually thereafter 
3.7 	until available appropriations have been exhausted, the commissioner must submit a report 
3.8 	to the legislative committees with jurisdiction over state government finance on the grants 
3.9 	awarded by this section. The report must detail each grant awarded, including the jurisdiction, 
3.10 	the amount of the grant, and a general description of the expenditure for which each grant 
3.11 	was used.

3.12 	Sec. 2. STATE-FUNDED COUNTY AND CITY CYBERSECURITY GRANT 
3.13 	PROGRAM; APPROPRIATION.
 3.14 	$20,000,000 in fiscal year 2025 is appropriated from the general fund to the state-funded 
3.15 	cybersecurity grant account in the special revenue fund.