NOTE: This article is not legal advice or a substitute for legal advice. It reflects the author’s understanding of published treasury guidance as of March 24, 2022.
Federal guidance is clear that cities may use American Rescue Plan Act Coronavirus State and Local Fiscal Recovery Funds (SLFRF) to pay for cybersecurity measures.
The Final Rule narrative states that government services include “modernization of cybersecurity, including hardware, software, and protection of critical infrastructure.” Investments in cybersecurity are eligible under the Eligible Use Category 6.1, Revenue Replacement, Provision of Government Services (see Appendix 1 in the Treasury Compliance and Reporting Guidance).
For more information about cybersecurity investments and ARPA funding, see Cities May Use ARP Funding for CyberSecurity, IT Services and Websites.
Funding Comes at Opportune Time
This opportunity for cities to use ARPA funds to invest in cybersecurity comes at a time when President Biden has issued a renewed warning based on intelligence that the Russian Government is exploring options for potential cyberattacks.
In addition to the warning from the White House, the Cybersecurity & Infrastructure Security Agency (CISA) launched Shields Up, stating “Russia’s invasion of Ukraine could . . . include malicious cyber activity against the U.S. homeland,” and urging all U.S. organizations to report strange cyber activity and/or cyber incidents immediately to CISA and adopt a “heightened posture when it comes to cybersecurity and protecting their most critical assets.”
Free services provided by CISA include vulnerability scanning and web application scanning, a phishing campaign assessment, and a remote penetration test. Most cities, however, will need to invest in cybersecurity to implement protective measures recommended by CISA, which are similar to the measures required to obtain cybercoverage, as described in Cyber Coverage Underwriting Requirements and ARPA Funds Prompt Investment in CyberSecurity.
Fortunately, thanks to SLFRF, 515 Georgia cities already have unprecedented amounts of federal money that can be used immediately to pay for investments in cybersecurity.