State Local Tribal Territorial Indicators of Compromise Automation Pilot | DHS 19 CISA 128 SLT001

Opportunity Information: Apply for DHS 19 CISA 128 SLT001

The "State Local Tribal Territorial Indicators of Compromise Automation Pilot" (DHS 19 CISA 128 SLT001) is a Department of Homeland Security cooperative agreement designed to help state, local, tribal, and territorial (SLTT) governments move faster and more consistently when dealing with cyber threat Indicators of Compromise (IOCs). The core idea is to shift IOC handling away from slow, manual review and toward automation and orchestration so that recipients can evaluate and act on threat data within minutes rather than hours or days. In practice, the opportunity centers on building and proving out workflows that make IOC intake, analysis, prioritization, and response more repeatable and less dependent on human triage for every single alert.

A major focus of the pilot is identifying where manual labor is currently bogging down cyber defense work and then designing automated alternatives that still align with how SLTT organizations operate. That includes mapping out which steps can be safely automated, which require approvals or human validation, and how to standardize actions so they are consistent across agencies and jurisdictions. The effort also emphasizes "actionable information sharing," meaning the program is not just about receiving threat data, but about enriching it, scoring it, and packaging it in a way that makes it immediately usable across different enterprises and across multiple SLTT participants.

The recipient of the cooperative agreement is expected to run a pilot that can include up to five states and/or localities. Those participating jurisdictions serve as real-world test environments to develop model processes, methods, and the supporting policies and procedures that others can reuse. The deliverable is not only a set of technical integrations, but also a practical playbook for how SLTT organizations can implement automation in a way that matches their governance, risk tolerance, and operational realities. The intent is to produce repeatable approaches that can be scaled beyond the initial pilot sites.

The specific operational outcomes described in the opportunity include the ability to act on IOCs within minutes of receipt; reducing time spent on repetitive, high-volume tasks; and establishing mechanisms for IOC generation, enrichment, and scoring. It also covers the end-to-end lifecycle: receiving IOCs, remediating affected systems, and responding appropriately, with an emphasis on speed and consistency. The program is explicitly tied to demonstrating Security Orchestration, Automation, and Response (SOAR) capabilities and procedures, combined with information sharing, to make threat data more usable and to enable consistent execution across SLTT levels.

Another important element is the identification of orchestration services needed to connect the full chain of cyber operations: sensing (collecting signals and alerts), understanding (contextualizing and analyzing), decision-making (choosing a response), and acting (executing containment, blocking, notification, or remediation steps). Rather than treating each of those as separate tools or teams, the pilot aims to define how orchestration can integrate them into a coherent, automated pipeline. It also calls for developing repeatable processes for orchestration and automation services that bridge existing SLTT policies with SOAR capabilities, which signals a strong interest in governance-aware automation, not just technology deployment.

From the funding and administrative perspective, this was posted as a discretionary opportunity under the Science and Technology and other Research and Development activity category. The funding instrument is a cooperative agreement, which generally implies more collaboration and involvement from the federal agency than a standard grant. The award ceiling is listed at $2,000,000, and the opportunity anticipated up to 20 awards. The CFDA number is 97.128, and the eligible applicants listed are for-profit organizations other than small businesses. The opportunity was created on Aug 12, 2019, with an original closing date of Aug 28, 2019, and it was administered by DHS, Office of Procurement Operations - Grants Division.

Overall, this opportunity is best understood as a practical automation and SOAR demonstration effort aimed at SLTT cyber defense, with the expectation that the work will produce reusable operational models: documented workflows, governance-aligned procedures, and integration patterns that help SLTT entities turn IOC sharing into fast, standardized, and measurable security actions.

• The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State Local Tribal Territorial Indicators of Compromise Automation Pilot" and is now available to receive applicants.
• Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
• This funding opportunity was created on Aug 12, 2019.
• Applicants must submit their applications by Aug 28, 2019. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
• Each selected applicant is eligible to receive up to $2,000,000.00 in funding.
• The number of recipients for this funding is limited to 20 candidate(s).
• Eligible applicants include: For profit organizations other than small businesses.

Apply for DHS 19 CISA 128 SLT001

[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal: