Opportunity Information: Apply for DHS 20 CISA 128 SLT001
The State, Local, Tribal and Territorial (SLTT) Indicators of Compromise (IOC) - Automation Pilot is a Department of Homeland Security (DHS) cooperative agreement managed under CISA that extends the period of performance for a previously selected grant recipient. The core idea is to keep an already-awarded project going long enough to apply automation in practical, real-world SLTT environments, with the goal of speeding up how state and local governments evaluate, prioritize, and act on cybersecurity threat indicators. Rather than funding a brand-new open competition, this opportunity functions as an extension of an earlier award (referenced as DHS-19-CISA-128-SLT001), continuing work that is already underway and focused on implementation and measurable operational improvements.
The pilot centers on automating the handling of Indicators of Compromise, which are artifacts that can signal malicious activity such as suspicious IP addresses, domains, file hashes, email indicators, or behavioral patterns seen in logs. In many SLTT organizations, IOC intake and follow-up still involves a lot of manual review, copying indicators into tools, running lookups, correlating across systems, and then deciding whether to block, contain, or investigate. This cooperative agreement is aimed at reducing that manual burden and shrinking response timelines so that participating jurisdictions can move from receiving an IOC to taking action within minutes, not hours or days. A major emphasis is on making IOC information more immediately usable by standardizing and automating key steps like validation, enrichment, and scoring (for example, pulling context from threat intelligence sources, adding asset criticality context, and rating the confidence and severity of an indicator).
A key deliverable theme is the development of model processes, methods, and the policies and procedures that make automation sustainable in government environments. The pilot is intended to identify where human effort is being spent on repetitive, low-value tasks and then show how orchestration and automation can reliably handle those steps while still keeping appropriate oversight and governance. The work also targets the full IOC lifecycle: receipt of IOCs, enrichment and scoring, remediation and response actions, and the feedback loop that improves future handling. The purpose is not only technical integration but also operational alignment, so SLTT organizations can apply consistent playbooks and decision logic across teams and, where feasible, across jurisdictions.
The opportunity explicitly highlights the use of Security Orchestration, Automation, and Response (SOAR) capabilities combined with information sharing. In practice, that means building and demonstrating repeatable workflows (often called playbooks) that can ingest indicators from partners or feeds, automatically query internal and external data sources, correlate with local telemetry, and then trigger approved response actions such as blocking a domain, quarantining an endpoint, creating or updating a ticket, notifying relevant staff, or escalating for deeper investigation. The pilot also seeks to identify the orchestration services needed to connect the broader set of activities involved in cyber defense: sensing (collecting data and indicators), understanding (analysis and correlation), decision-making (triage and prioritization), and acting (response and remediation). A major objective is to produce repeatable orchestration and automation processes that bridge existing SLTT policies with SOAR capabilities, meaning the automation should reflect how SLTT agencies are required to operate rather than forcing them into unrealistic workflows.
Participation is limited and structured: the grant recipient may select up to five states and/or localities to take part in the pilot. That setup suggests the project will test approaches in a small number of real operating environments, document what works, and produce reusable guidance and procedures that other SLTT organizations can adopt later. In addition to improving speed, the pilot is designed to improve consistency and actionability of shared cyber data across enterprises and SLTT partners, so that when threat information is distributed, it can be acted on in a predictable way rather than being handled ad hoc by each organization.
From the funding and administrative standpoint, this is a discretionary DHS funding opportunity offered as a cooperative agreement, which typically implies substantial federal involvement or collaboration during execution compared to a standard grant. The funding activity category is listed as science and technology and other research and development, reflecting that the pilot is intended to develop, test, and demonstrate operationally relevant automation methods rather than simply purchasing routine services. The opportunity number is DHS 20 CISA 128 SLT001, the CFDA number is 97.128, the award ceiling is $500,000, and DHS expected to make one award. The posting shows an original creation date of July 20, 2020, with an original closing date of August 10, 2020, but the narrative makes clear that this NOFO is an extension of a previously awarded project rather than a new multi-award competition.Apply for DHS 20 CISA 128 SLT001
- The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot" and is now available to receive applicants.
- Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
- This funding opportunity was created on Jul 20, 2020.
- Applicants must submit their applications by Aug 10, 2020. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
- Each selected applicant is eligible to receive up to $500,000.00 in funding.
- The number of recipients for this funding is limited to 1 candidate(s).
- Eligible applicants include: Others (see text field entitled Additional Information on Eligibility for clarification).
[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal:
Frequently Asked Questions (FAQs)
What is the SLTT Indicators of Compromise (IOC) - Automation Pilot?
The State, Local, Tribal and Territorial (SLTT) Indicators of Compromise (IOC) - Automation Pilot is a Department of Homeland Security (DHS) cooperative agreement managed under CISA. It is designed to continue an already-awarded project so it can be implemented and tested in real SLTT operating environments, with a focus on measurable improvements in how quickly and consistently SLTT organizations can act on cybersecurity threat indicators.
Is this a new open grant competition?
No. The opportunity is described as an extension of a previously selected grant recipient, not a brand-new open competition. It continues work already underway (referenced as DHS-19-CISA-128-SLT001) to support implementation and operational outcomes.
What is the main goal of this pilot?
The central goal is to speed up how SLTT governments evaluate, prioritize, and respond to Indicators of Compromise by automating key steps that are often manual. The pilot aims to shrink the timeline from receiving an IOC to taking action to minutes rather than hours or days.
What are Indicators of Compromise (IOCs) in this context?
IOCs are artifacts that may indicate malicious activity. Examples mentioned include suspicious IP addresses, domains, file hashes, email indicators, or behavioral patterns observed in logs.
What problems in SLTT cybersecurity operations is the pilot trying to address?
The pilot targets common manual workflows such as reviewing indicator emails or reports, copying indicators into tools, running lookups, correlating across systems, and deciding whether to block, contain, or investigate. The intent is to reduce repetitive, low-value manual effort and improve response timelines and consistency.
What does "automation" mean here?
Automation in this pilot refers to making IOC handling more immediately usable and less manual by standardizing and automating steps like validation, enrichment, and scoring. It also includes building repeatable workflows that can move from intake to response actions under approved policies and oversight.
What kinds of automated steps are emphasized?
The opportunity highlights automating validation, enrichment, and scoring. Examples provided include pulling context from threat intelligence sources, adding asset criticality context, and rating the confidence and severity of an indicator to help prioritize action.
Which parts of the IOC lifecycle does the pilot cover?
The work targets the full IOC lifecycle, including receipt of IOCs, enrichment and scoring, remediation and response actions, and the feedback loop that improves future handling.
What is SOAR, and why is it central to this pilot?
SOAR stands for Security Orchestration, Automation, and Response. The pilot explicitly highlights using SOAR capabilities with information sharing to build repeatable workflows (playbooks) that can ingest indicators, query data sources, correlate with local telemetry, and trigger approved response actions.
What are "playbooks" in this pilot?
Playbooks are repeatable workflows that automate steps such as ingesting indicators from partners or feeds, enriching and correlating them using internal and external data sources, and triggering response actions aligned with SLTT policies and procedures.
What types of response actions are mentioned as outcomes of automation?
Examples include blocking a domain, quarantining an endpoint, creating or updating a ticket, notifying relevant staff, or escalating an incident for deeper investigation.
How does the pilot balance automation with oversight and governance?
A major theme is identifying repetitive tasks suitable for orchestration and automation while maintaining appropriate oversight and governance. The pilot is intended to show how automation can reliably handle routine steps while still operating within sustainable government policies and procedures.
Is the work only technical integration, or does it include operational changes?
It includes both. The opportunity emphasizes operational alignment so SLTT organizations can apply consistent playbooks and decision logic across teams and, where feasible, across jurisdictions. It also calls out developing model processes, methods, and sustainable policies and procedures.
What does "orchestration" mean in the pilot description?
Orchestration refers to coordinating the broader set of cyber defense activities so they work together end-to-end: sensing (collecting data and indicators), understanding (analysis and correlation), decision-making (triage and prioritization), and acting (response and remediation).
How many SLTT participants can be involved?
Participation is limited. The grant recipient may select up to five states and/or localities to participate in the pilot.
Does the pilot include Tribal and territorial governments as participants?
The pilot is framed for SLTT organizations broadly (state, local, tribal, and territorial). However, the participation detail provided states the recipient may select up to five states and/or localities to take part in the pilot.
What is expected to come out of the pilot for broader SLTT use?
A key outcome is reusable guidance: model processes, methods, and policies and procedures that help make automation sustainable in government environments. The pilot aims to document what works in real environments and improve the consistency and actionability of shared cyber data so other SLTT organizations can adopt approaches later.
How does information sharing fit into the pilot?
The pilot combines SOAR with information sharing so indicators distributed among partners or feeds can be ingested and acted upon in a predictable, repeatable way rather than being handled ad hoc by each organization.
What is the funding mechanism for this opportunity?
This is a discretionary DHS funding opportunity offered as a cooperative agreement, managed under CISA.
What does it mean that this is a cooperative agreement?
The opportunity notes that a cooperative agreement typically implies substantial federal involvement or collaboration during execution compared to a standard grant.
What is the funding activity category?
The funding activity category is listed as science and technology and other research and development, reflecting that the pilot is intended to develop, test, and demonstrate operationally relevant automation methods rather than simply purchasing routine services.
What is the opportunity number and CFDA number?
The opportunity number is DHS 20 CISA 128 SLT001, and the CFDA number is 97.128.
How much funding is available, and how many awards are expected?
The award ceiling is $500,000, and DHS expected to make one award.
What are the posted dates for this opportunity?
The posting shows an original creation date of July 20, 2020, and an original closing date of August 10, 2020. The narrative indicates the purpose is to extend a previously awarded project rather than run a new multi-award competition.
What does success look like for participating jurisdictions?
Based on the description, success is reflected in practical, measurable operational improvements such as reduced manual workload, faster response timelines (moving toward minutes), and more consistent application of standardized playbooks for IOC handling and response.
How does this pilot help with prioritization of threats?
The pilot emphasizes enrichment and scoring so IOCs can be evaluated with added context (for example, threat intelligence context and asset criticality) and assigned confidence and severity ratings. That information is intended to help jurisdictions triage and prioritize actions more quickly and consistently.
Why does the opportunity emphasize "real-world SLTT environments"?
The stated intent is to apply automation in practical operating environments, not just in theory, and to demonstrate implementation approaches that align with how SLTT agencies actually operate under their policies and procedures.
Browse more opportunities from the same category: Science and Technology and other Research and Development
Next opportunity: Rural Health Network Development Planning Program
Previous opportunity: Watershed Assessments for the National Water Quality Initiative
Applicant Portal:
Are you interested in learning about about how to apply for this government funding opportunity? You can create a free applicant account and receive instant access to our applicant portal that many business owners like you have benefited from.
Apply for DHS 20 CISA 128 SLT001
Applicants also applied for:
Applicants who have applied for this opportunity (DHS 20 CISA 128 SLT001) also looked into and applied for these:
| Funding Opportunity |
|---|
| Exchange program for biotechnology experts Apply for STX 100 FY20 003 Funding Number: STX 100 FY20 003 Agency: Department of State, U.S. Mission to Turkmenistan Category: Science and Technology and other Research and Development Funding Amount: $55,000 |
| Evaluating Non-floodplain Wetlands for Flood-Risk Reduction and Nutrient Mediation in the Mississippi River Basin Apply for W81EWF 20 SOI 0037 Funding Number: W81EWF 20 SOI 0037 Agency: Department of Defense, Engineer Research and Development Center Category: Science and Technology and other Research and Development Funding Amount: $250,000 |
| Re-entry to Active Research Program Apply for 20 586 Funding Number: 20 586 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $300,000 |
| DoD Combat Readiness, Rapid Development and Translational Research Award Apply for W81XWH 20 S CRRP Funding Number: W81XWH 20 S CRRP Agency: Department of Defense, Dept. of the Army -- USAMRAA Category: Science and Technology and other Research and Development Funding Amount: Case Dependent |
| Computer and Information Science and Engineering (CISE): Core Programs Apply for 20 591 Funding Number: 20 591 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: Case Dependent |
| Cooperative Ecosystem Studies Unit, Great Rivers CESU Apply for G20AS00128 Funding Number: G20AS00128 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $46,200 |
| Cooperative Ecosystem Studies Unit, Piedmont South Atlantic Coast CESU Apply for G20AS00131 Funding Number: G20AS00131 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $200,000 |
| Notice of Intent to Award Apply for BOR DO 20 N008 Funding Number: BOR DO 20 N008 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $499,797 |
| 2020 HERO Appendix B: NASA Human Research Program Omnibus Opportunity Apply for 80JSC020N0001 OMNIBUS1 Funding Number: 80JSC020N0001 OMNIBUS1 Agency: National Aeronautics and Space Administration, NASA Johnson Space Center Category: Science and Technology and other Research and Development Funding Amount: $150,000 |
| 2020 HERO Appendix A: NASA Research and Technology Development to Support Crew Health and Performance in Space Exploration Missions Apply for 80JSC020N0001 FLAGSHIP Funding Number: 80JSC020N0001 FLAGSHIP Agency: National Aeronautics and Space Administration, NASA Johnson Space Center Category: Science and Technology and other Research and Development Funding Amount: $1,200,000 |
| Cooperative Ecosystem Studies Unit, Great Basin CESU Apply for G20AS00133 Funding Number: G20AS00133 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $20,000 |
| Cooperative Ecosystem Studies Unit, Southern Appalachian CESU Apply for G20AS00132 Funding Number: G20AS00132 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $133,629 |
| Computer and Information Science and Engineering (CISE) Research Initiation Initiative Apply for 20 593 Funding Number: 20 593 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $175,000 |
| Cooperative Ecosystem Studies Unit, Rocky Mountain CESU Apply for G20AS00135 Funding Number: G20AS00135 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $47,000 |
| Water Reclamation and Reuse Research Projects Apply for BOR DO 20 F009 Funding Number: BOR DO 20 F009 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $750,000 |
| Community Instruments and Facilities Apply for 20 596 Funding Number: 20 596 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $1,250,000 |
| Innovations in Graduate Education (IGE) Program Apply for 20 595 Funding Number: 20 595 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $500,000 |
| Computational and Data-Enabled Science and Engineering in Mathematical and Statistical Sciences Apply for PD 20 8069 Funding Number: PD 20 8069 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $1,000,000 |
| 2020 DHS SLA for Minority Serving Institutions Apply for DHS 20 ST 062 001 Funding Number: DHS 20 ST 062 001 Agency: Department of Homeland Security, Office of Procurement Operations - Grants Division Category: Science and Technology and other Research and Development Funding Amount: $470,000 |
| International Research Experiences for Students Apply for 20 598 Funding Number: 20 598 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: Case Dependent |
Grant application guides and resources
It is always free to apply for government grants. However the process may be very complex depending on the funding opportunity you are applying for. Let us help you!
Apply for Grants
Inside Our Applicants Portal
Access Applicants Portal
- Grants Repository - Access current and historic funding opportunities with ease. Thousands of funding opportunities are published every week. We can help you sort through the database and find the eligible ones to apply for.
- Applicant Video Guides - The grant application process can be challenging to follow. We can help you with intuitive video guides to speed up the process and eliminate errors in submissions.
- Grant Proposal Wizard - We have developed a network of private funding organizations and investors across the United States. We can reach out and submit your proposal to these contacts to maximize your chances of getting the funding you need.
Premium leads for funding administrators, grant writers, and loan issuers
Thousands of people visit our website for their funding needs every day. When a user creates a grant proposal and files for submission, we pass the information on to funding administrators, grant writers, and government loan issuers.
If you manage government grant programs, provide grant writing services, or issue personal or government loans, we can help you reach your audience.
Learn More
Request more information:
Would you like to learn more about this funding opportunity, similar opportunities to "DHS 20 CISA 128 SLT001", eligibility, application service, and/or application tips? Submit an inquiry below:
Don't forget to subscribe to our grant alerts mailing list to receive weekly alerts on new and updated grant funding opportunities like this one in your email.