State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot | DHS 20 CISA 128 SLT001

Opportunity Information: Apply for DHS 20 CISA 128 SLT001

The State, Local, Tribal and Territorial (SLTT) Indicators of Compromise (IOC) - Automation Pilot is a Department of Homeland Security (DHS) cooperative agreement managed under CISA that extends the period of performance for a previously selected grant recipient. The core idea is to keep an already-awarded project going long enough to apply automation in practical, real-world SLTT environments, with the goal of speeding up how state and local governments evaluate, prioritize, and act on cybersecurity threat indicators. Rather than funding a brand-new open competition, this opportunity functions as an extension of an earlier award (referenced as DHS-19-CISA-128-SLT001), continuing work that is already underway and focused on implementation and measurable operational improvements.

The pilot centers on automating the handling of Indicators of Compromise, which are artifacts that can signal malicious activity such as suspicious IP addresses, domains, file hashes, email indicators, or behavioral patterns seen in logs. In many SLTT organizations, IOC intake and follow-up still involves a lot of manual review, copying indicators into tools, running lookups, correlating across systems, and then deciding whether to block, contain, or investigate. This cooperative agreement is aimed at reducing that manual burden and shrinking response timelines so that participating jurisdictions can move from receiving an IOC to taking action within minutes, not hours or days. A major emphasis is on making IOC information more immediately usable by standardizing and automating key steps like validation, enrichment, and scoring (for example, pulling context from threat intelligence sources, adding asset criticality context, and rating the confidence and severity of an indicator).

A key deliverable theme is the development of model processes, methods, and the policies and procedures that make automation sustainable in government environments. The pilot is intended to identify where human effort is being spent on repetitive, low-value tasks and then show how orchestration and automation can reliably handle those steps while still keeping appropriate oversight and governance. The work also targets the full IOC lifecycle: receipt of IOCs, enrichment and scoring, remediation and response actions, and the feedback loop that improves future handling. The purpose is not only technical integration but also operational alignment, so SLTT organizations can apply consistent playbooks and decision logic across teams and, where feasible, across jurisdictions.

The opportunity explicitly highlights the use of Security Orchestration, Automation, and Response (SOAR) capabilities combined with information sharing. In practice, that means building and demonstrating repeatable workflows (often called playbooks) that can ingest indicators from partners or feeds, automatically query internal and external data sources, correlate with local telemetry, and then trigger approved response actions such as blocking a domain, quarantining an endpoint, creating or updating a ticket, notifying relevant staff, or escalating for deeper investigation. The pilot also seeks to identify the orchestration services needed to connect the broader set of activities involved in cyber defense: sensing (collecting data and indicators), understanding (analysis and correlation), decision-making (triage and prioritization), and acting (response and remediation). A major objective is to produce repeatable orchestration and automation processes that bridge existing SLTT policies with SOAR capabilities, meaning the automation should reflect how SLTT agencies are required to operate rather than forcing them into unrealistic workflows.

Participation is limited and structured: the grant recipient may select up to five states and/or localities to take part in the pilot. That setup suggests the project will test approaches in a small number of real operating environments, document what works, and produce reusable guidance and procedures that other SLTT organizations can adopt later. In addition to improving speed, the pilot is designed to improve consistency and actionability of shared cyber data across enterprises and SLTT partners, so that when threat information is distributed, it can be acted on in a predictable way rather than being handled ad hoc by each organization.

From the funding and administrative standpoint, this is a discretionary DHS funding opportunity offered as a cooperative agreement, which typically implies substantial federal involvement or collaboration during execution compared to a standard grant. The funding activity category is listed as science and technology and other research and development, reflecting that the pilot is intended to develop, test, and demonstrate operationally relevant automation methods rather than simply purchasing routine services. The opportunity number is DHS 20 CISA 128 SLT001, the CFDA number is 97.128, the award ceiling is $500,000, and DHS expected to make one award. The posting shows an original creation date of July 20, 2020, with an original closing date of August 10, 2020, but the narrative makes clear that this NOFO is an extension of a previously awarded project rather than a new multi-award competition.

• The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot" and is now available to receive applicants.
• Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
• This funding opportunity was created on Jul 20, 2020.
• Applicants must submit their applications by Aug 10, 2020. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
• Each selected applicant is eligible to receive up to $500,000.00 in funding.
• The number of recipients for this funding is limited to 1 candidate(s).
• Eligible applicants include: Others (see text field entitled Additional Information on Eligibility for clarification).

Apply for DHS 20 CISA 128 SLT001

[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal: