State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) Information Sharing and Analysis Center (ISAC) | DHS 23 CISA 123 ISAC000001

Opportunity Information: Apply for DHS 23 CISA 123 ISAC000001

The State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) Information Sharing and Analysis Center (ISAC) opportunity is a Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) cooperative agreement designed to strengthen how cyber threat information is shared and acted on across the SLTT community and the U.S. elections subsector. At its core, the program is meant to speed up the creation of an automated, streamlined threat-intelligence sharing capability that works in both directions: from CISA to SLTT/elections partners and from SLTT/elections partners back to CISA. The emphasis is not just on collecting or distributing intelligence, but on enabling collaborative, operational information sharing that can be rapidly adopted and integrated into day-to-day local cybersecurity activities so stakeholders can respond faster and more effectively to prioritized threats.

A major focus of the award is building and maturing a threat intelligence platform and associated processes that improve cybersecurity awareness throughout the SLTT environment. The intent is to provide practical mechanisms that help organizations translate shared threat information into action, including better coordination, faster dissemination of relevant indicators, and smoother integration with local security operations. In practice, this points to standing up or enhancing an ISAC-like capability tied closely to SOC functions, so threat data, analysis, and operational response are connected rather than handled as separate activities.

The cooperative agreement also aims to expand implementation of cyber managed services for SLTT entities and the elections subsector. The description specifically mentions scaling efforts such as the National Prevention Pilot, End-Point Detection and Response (EDR) Pilot, Malicious Domain Blocking and Reporting (MDBR), cyber incident response support, Albert (network monitoring), and managed email security. Taken together, these services reflect a push toward more consistent baseline protections and shared defensive capabilities across jurisdictions that may have uneven resources, while also improving the overall defensive posture of the broader SLTT sector through more uniform access to monitoring, detection, blocking, and response support.

From a funding and administrative standpoint, this is a discretionary funding opportunity offered as a cooperative agreement, meaning the federal government expects substantial involvement in the project’s execution rather than a more hands-off grant relationship. The funding activity category is listed as science and technology and other research and development, aligning with the emphasis on building and operationalizing automated and integrated information-sharing and managed-security capabilities. The opportunity is identified as DHS 23 CISA 123 ISAC000001 under CFDA (Assistance Listing) 97.123.

Eligibility is broad in terms of organizational type, allowing applications from 501(c)(3) nonprofits (excluding institutions of higher education), nonprofits without 501(c)(3) status (excluding institutions of higher education), for-profit organizations other than small businesses, and small businesses. The program is structured to make a single award (expected awards: 1), with an award ceiling of $43,003,000, signaling a large, centralized effort intended to serve a wide SLTT and elections footprint rather than multiple smaller regional projects. The opportunity was created on June 14, 2023, with an original closing date of August 1, 2023, and is administered by DHS, Office of Procurement Operations - Grants Division.

Overall, the grant is aimed at materially improving the cyber defense and information-sharing environment for SLTT governments and election partners by combining (1) a more automated, bi-directional threat-intelligence sharing capability linked to operational SOC workflows, with (2) expanded adoption of managed cybersecurity services that provide real-world detection, blocking, monitoring, and incident response support. The anticipated outcome is a more robust, coordinated, and actionable cybersecurity ecosystem across the entire SLTT sector.

• The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) Information Sharing and Analysis Center (ISAC)" and is now available to receive applicants.
• Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.123.
• This funding opportunity was created on Jun 14, 2023.
• Applicants must submit their applications by Aug 01, 2023. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
• Each selected applicant is eligible to receive up to $43,003,000.00 in funding.
• The number of recipients for this funding is limited to 1 candidate(s).
• Eligible applicants include: Nonprofits having a 501(c)(3) status with the IRS, other than institutions of higher education, Nonprofits that do not have a 501(c)(3) status with the IRS, other than institutions of higher education, For profit organizations other than small businesses, Small businesses.

Apply for DHS 23 CISA 123 ISAC000001

[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal: