Opportunity Information: Apply for DHS 19 CISA 128 SLT001
The "State Local Tribal Territorial Indicators of Compromise Automation Pilot" (DHS 19 CISA 128 SLT001) is a Department of Homeland Security cooperative agreement designed to help state, local, tribal, and territorial (SLTT) governments move faster and more consistently when dealing with cyber threat Indicators of Compromise (IOCs). The core idea is to shift IOC handling away from slow, manual review and toward automation and orchestration so that recipients can evaluate and act on threat data within minutes rather than hours or days. In practice, the opportunity centers on building and proving out workflows that make IOC intake, analysis, prioritization, and response more repeatable and less dependent on human triage for every single alert.
A major focus of the pilot is identifying where manual labor is currently bogging down cyber defense work and then designing automated alternatives that still align with how SLTT organizations operate. That includes mapping out which steps can be safely automated, which require approvals or human validation, and how to standardize actions so they are consistent across agencies and jurisdictions. The effort also emphasizes "actionable information sharing," meaning the program is not just about receiving threat data, but about enriching it, scoring it, and packaging it in a way that makes it immediately usable across different enterprises and across multiple SLTT participants.
The recipient of the cooperative agreement is expected to run a pilot that can include up to five states and/or localities. Those participating jurisdictions serve as real-world test environments to develop model processes, methods, and the supporting policies and procedures that others can reuse. The deliverable is not only a set of technical integrations, but also a practical playbook for how SLTT organizations can implement automation in a way that matches their governance, risk tolerance, and operational realities. The intent is to produce repeatable approaches that can be scaled beyond the initial pilot sites.
The specific operational outcomes described in the opportunity include the ability to act on IOCs within minutes of receipt; reducing time spent on repetitive, high-volume tasks; and establishing mechanisms for IOC generation, enrichment, and scoring. It also covers the end-to-end lifecycle: receiving IOCs, remediating affected systems, and responding appropriately, with an emphasis on speed and consistency. The program is explicitly tied to demonstrating Security Orchestration, Automation, and Response (SOAR) capabilities and procedures, combined with information sharing, to make threat data more usable and to enable consistent execution across SLTT levels.
Another important element is the identification of orchestration services needed to connect the full chain of cyber operations: sensing (collecting signals and alerts), understanding (contextualizing and analyzing), decision-making (choosing a response), and acting (executing containment, blocking, notification, or remediation steps). Rather than treating each of those as separate tools or teams, the pilot aims to define how orchestration can integrate them into a coherent, automated pipeline. It also calls for developing repeatable processes for orchestration and automation services that bridge existing SLTT policies with SOAR capabilities, which signals a strong interest in governance-aware automation, not just technology deployment.
From the funding and administrative perspective, this was posted as a discretionary opportunity under the Science and Technology and other Research and Development activity category. The funding instrument is a cooperative agreement, which generally implies more collaboration and involvement from the federal agency than a standard grant. The award ceiling is listed at $2,000,000, and the opportunity anticipated up to 20 awards. The CFDA number is 97.128, and the eligible applicants listed are for-profit organizations other than small businesses. The opportunity was created on Aug 12, 2019, with an original closing date of Aug 28, 2019, and it was administered by DHS, Office of Procurement Operations - Grants Division.
Overall, this opportunity is best understood as a practical automation and SOAR demonstration effort aimed at SLTT cyber defense, with the expectation that the work will produce reusable operational models: documented workflows, governance-aligned procedures, and integration patterns that help SLTT entities turn IOC sharing into fast, standardized, and measurable security actions.Apply for DHS 19 CISA 128 SLT001
- The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State Local Tribal Territorial Indicators of Compromise Automation Pilot" and is now available to receive applicants.
- Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
- This funding opportunity was created on Aug 12, 2019.
- Applicants must submit their applications by Aug 28, 2019. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
- Each selected applicant is eligible to receive up to $2,000,000.00 in funding.
- The number of recipients for this funding is limited to 20 candidate(s).
- Eligible applicants include: For profit organizations other than small businesses.
[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal:
Frequently Asked Questions (FAQs)
What is the "State Local Tribal Territorial Indicators of Compromise Automation Pilot"?
It is a Department of Homeland Security (DHS) cooperative agreement opportunity (DHS 19 CISA 128 SLT001) focused on helping state, local, tribal, and territorial (SLTT) governments handle cyber threat Indicators of Compromise (IOCs) faster and more consistently by shifting from manual review to automation and orchestration.
What problem is this pilot trying to solve?
The pilot targets slow, manual IOC triage and response processes that can take hours or days. The goal is to design and prove workflows that allow recipients to evaluate and act on threat data within minutes, while reducing repetitive, high-volume manual tasks.
What are Indicators of Compromise (IOCs) in the context of this opportunity?
Within this program, IOCs are cyber threat indicators that SLTT defenders receive and must evaluate and act on. The opportunity emphasizes improving how these indicators are received, analyzed, prioritized, enriched, scored, shared, and used to drive response actions.
What does "automation and orchestration" mean here?
It refers to building repeatable, tool-assisted workflows that can intake IOCs, enrich and score them, prioritize them, and trigger appropriate response steps. Orchestration is described as connecting the full chain of cyber operations (sensing, understanding, decision-making, acting) into a coherent pipeline rather than leaving them as disconnected tools or teams.
What is SOAR, and how does it relate to this pilot?
SOAR stands for Security Orchestration, Automation, and Response. The opportunity explicitly calls for demonstrating SOAR capabilities and procedures combined with information sharing, with the intent of making threat data more usable and enabling consistent execution across SLTT levels.
What are the expected operational outcomes?
The opportunity describes outcomes such as acting on IOCs within minutes of receipt, reducing time spent on repetitive tasks, establishing mechanisms for IOC generation, enrichment, and scoring, and supporting the end-to-end lifecycle from receiving IOCs through remediation and appropriate response.
What parts of the IOC lifecycle does the pilot cover?
The scope spans the end-to-end IOC lifecycle: receiving indicators, analyzing and contextualizing them, prioritizing them, deciding on actions, and then executing response steps such as containment, blocking, notification, or remediation of affected systems, with an emphasis on speed and consistency.
Is the program only about receiving threat data?
No. A key emphasis is "actionable information sharing," meaning the program is about enriching, scoring, and packaging threat information so it is immediately usable across different enterprises and across multiple SLTT participants.
How many jurisdictions can be involved in the pilot?
The recipient is expected to run a pilot that can include up to five states and/or localities, which serve as real-world test environments for developing model processes and reusable approaches.
Are tribal and territorial governments included in the program focus?
Yes. The opportunity is explicitly framed around SLTT governments, which includes state, local, tribal, and territorial organizations, even though the pilot participation example mentions up to five states and/or localities.
What is meant by "governance-aware automation" in this opportunity?
The pilot is not positioned as technology deployment alone. It calls for mapping which steps can be safely automated, which require approvals or human validation, and how to align automated actions with SLTT governance, policies, risk tolerance, and operational realities.
What deliverables are expected from the recipient?
The expected deliverables include technical integrations and demonstrated workflows, plus a practical playbook with documented workflows, governance-aligned policies and procedures, and repeatable integration patterns that other SLTT organizations can reuse and scale beyond the pilot sites.
What types of workflows is the pilot expected to develop?
Workflows focused on IOC intake, analysis, enrichment, scoring, prioritization, and response. The program also emphasizes standardizing actions so they are consistent across agencies and jurisdictions and less dependent on human triage for every alert.
What does the opportunity mean by connecting "sensing, understanding, decision-making, and acting"?
It highlights the orchestration services needed to link the stages of cyber operations: collecting signals and alerts (sensing), contextualizing and analyzing (understanding), selecting a response (decision-making), and executing actions like containment or remediation (acting).
What kind of funding instrument is this?
The instrument is a cooperative agreement, which generally implies more federal agency collaboration and involvement than a standard grant.
Which federal agency and office administered the opportunity?
The opportunity was administered by DHS, Office of Procurement Operations - Grants Division.
How much funding is available per award?
The listed award ceiling is $2,000,000.
How many awards were anticipated?
The opportunity anticipated up to 20 awards.
What is the CFDA number for this opportunity?
The CFDA number listed is 97.128.
Who is eligible to apply based on the listing?
The eligible applicants listed are for-profit organizations other than small businesses.
What activity category was this posted under?
It was posted as a discretionary opportunity under the Science and Technology and other Research and Development activity category.
When was this opportunity created and when did it originally close?
It was created on Aug 12, 2019, and had an original closing date of Aug 28, 2019.
What makes this opportunity a "pilot" rather than a general implementation grant?
The focus is on building and proving out workflows in real-world SLTT environments (up to five participating jurisdictions) and producing reusable models and a playbook that can be scaled beyond the initial pilot sites.
Is the goal to eliminate human involvement entirely?
No. The program specifically calls for identifying which steps can be safely automated and which require approvals or human validation, indicating a balanced approach rather than fully hands-off automation.
What does "repeatable approaches that can be scaled" mean in this context?
It refers to developing standardized workflows, procedures, and integration patterns that are not unique to a single site, so other SLTT organizations can adopt them and achieve consistent, measurable security actions based on IOC sharing.
Browse more opportunities from the same category: Science and Technology and other Research and Development
Next opportunity: Planning, Educational, and Recreational Initiatives at SEF
Previous opportunity: Mapping Inventory of Priority Weeds
Applicant Portal:
Are you interested in learning about about how to apply for this government funding opportunity? You can create a free applicant account and receive instant access to our applicant portal that many business owners like you have benefited from.
Apply for DHS 19 CISA 128 SLT001
Applicants also applied for:
Applicants who have applied for this opportunity (DHS 19 CISA 128 SLT001) also looked into and applied for these:
| Funding Opportunity |
|---|
| Assessing Status of Residual Populations of Threatened Bats Apply for P19AS00501 Funding Number: P19AS00501 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $72,500 |
| CAVE Cultural Landscapes Inventory Update for Rattlesnake Sprin Apply for P19AS00527 Funding Number: P19AS00527 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $112,415 |
| Research Efforts in Support of Investigation, Documentation and A Apply for P19AS00529 Funding Number: P19AS00529 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $195,000 |
| NSF/DOE Partnership in Basic Plasma Science and Engineering Apply for 19 596 Funding Number: 19 596 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $250,000 |
| Cooperative Ecosystems Studies Unit Apply for F19AS00345 Funding Number: F19AS00345 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $80,000 |
| Naval Medical Research Center: Research and Development of Protective Vaccines and Other Countermeasures Against Infectious Disease Agents of Military Importance. Apply for N62645 PA 19 2 Funding Number: N62645 PA 19 2 Agency: Department of Defense, NAVAL MEDICAL LOGISTICS COMMAND Category: Science and Technology and other Research and Development Funding Amount: $56,826,775 |
| FY19 Pilot Safety Culture Assessment on a Passenger Railroad Apply for FR RRD 19 003 Funding Number: FR RRD 19 003 Agency: Department of Transportation, DOT/Federal Railroad Administration Category: Science and Technology and other Research and Development Funding Amount: $60,000 |
| Research & Write an Administrative History of Tuskegee NHS Apply for P19AS00558 Funding Number: P19AS00558 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $63,305 |
| Cooperative Ecosystem Studies Unit, Piedmont-South Atlantic Coast CESU Apply for G19AS00132 Funding Number: G19AS00132 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $25,000 |
| Cooperative Ecosystem Studies Unit, Rocky Mountain CESU Apply for G19AS00131 Funding Number: G19AS00131 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $48,000 |
| Salt Basin Assessment of Water Resources and Groundwater Withdrawal Apply for BOR UC 19 N005 Funding Number: BOR UC 19 N005 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $436,790 |
| Migratory Bird Monitoring, Assessment and Conservation Apply for F19AS00352 Funding Number: F19AS00352 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $60,000 |
| Salt Basin to Pecos Basin Pipeline Alignment Apply for BOR UC 19 N006 Funding Number: BOR UC 19 N006 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $750,000 |
| PIT Tag antenna systems and data analysis Apply for BOR UC 19 N004 Funding Number: BOR UC 19 N004 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $479,826 |
| 15.678 Cooperative Ecosystem Studies Units Apply for F19AS00354 Funding Number: F19AS00354 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $80,000 |
| Endangered Species Conservation Recovery Implementation Funds Apply for F19AS00356 Funding Number: F19AS00356 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $49,816 |
| Use of the NASA Physical Sciences Informatics System - Appendix F Apply for NNH17ZTT001N 17PSI F Funding Number: NNH17ZTT001N 17PSI F Agency: National Aeronautics and Space Administration, NASA Headquarters Category: Science and Technology and other Research and Development Funding Amount: Case Dependent |
| Cooperative Ecosystem Studies Unit Apply for F19AS00364 Funding Number: F19AS00364 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $109,000 |
| Cooperative Ecosystem Studies Unit, Great Lakes Northern Forests CESU Apply for G19AS00133 Funding Number: G19AS00133 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $37,000 |
| Migratory Bird Monitoring, Assessment and Conservation Apply for F19AS00368 Funding Number: F19AS00368 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $100,000 |
Grant application guides and resources
It is always free to apply for government grants. However the process may be very complex depending on the funding opportunity you are applying for. Let us help you!
Apply for Grants
Inside Our Applicants Portal
Access Applicants Portal
- Grants Repository - Access current and historic funding opportunities with ease. Thousands of funding opportunities are published every week. We can help you sort through the database and find the eligible ones to apply for.
- Applicant Video Guides - The grant application process can be challenging to follow. We can help you with intuitive video guides to speed up the process and eliminate errors in submissions.
- Grant Proposal Wizard - We have developed a network of private funding organizations and investors across the United States. We can reach out and submit your proposal to these contacts to maximize your chances of getting the funding you need.
Premium leads for funding administrators, grant writers, and loan issuers
Thousands of people visit our website for their funding needs every day. When a user creates a grant proposal and files for submission, we pass the information on to funding administrators, grant writers, and government loan issuers.
If you manage government grant programs, provide grant writing services, or issue personal or government loans, we can help you reach your audience.
Learn More
Request more information:
Would you like to learn more about this funding opportunity, similar opportunities to "DHS 19 CISA 128 SLT001", eligibility, application service, and/or application tips? Submit an inquiry below:
Don't forget to subscribe to our grant alerts mailing list to receive weekly alerts on new and updated grant funding opportunities like this one in your email.