This is the first of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.
In 2021, the U.S. Infrastructure Investment and Jobs Act created the State and Local Cybersecurity Grant Program (SLCGP) to help state, local, tribal and territorial (SLTT) governments address an ever-evolving cybersecurity threat landscape. The four-year, $1 billion program provides funding for SLTT governments to implement cybersecurity solutions that address the growing threats and risks to their information systems.
The 2023 Notice of Funding Opportunity (NOFO), released in August, provides $374.9 million to SLTT governments. This is the second installment of the four-year program. Applications must be submitted by October 6, 2023.
While the following objectives of the program remain the same, the focus for SLTTs shifts in FY 23.
As the program moves into year two, applicants are required to focus on Objectives 2-4 from the above list, which are statutory conditions for receiving grant funding. Below, we provide more details on how the Tenable One Exposure Management Platform can help agencies meet the requirements of Objective 2.
Objective 2 is aimed at helping SLTT agencies continuously evaluate their cybersecurity posture and risk. The goals are to ensure that all assets and applications are continuously identified and their risk understood, and to ensure a risk-based vulnerability management program is put in place for monitoring all assets and vulnerabilities.
Tenable is uniquely positioned to help SLTTs meet this objective through the Tenable One Exposure Management Platform. Going beyond traditional IT, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory, and more — including highly dynamic IT assets like mobile devices, virtual machines, containers and cloud instances. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLTT agencies to successfully meet each of the sub-objectives outlined in Objective 2.
Sub-objective |
How Tenable helps |
2.1.1: Establish and regularly update asset inventory |
Tenable One deploys purpose-built sensors across the environment to update inventories across assets, applications, users, vulnerabilities and exposures. |
2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited. |
Tenable One provides an accurate picture of both internal and external exposure. Tenable vulnerability data, threat intelligence and data science are combined to give agencies easy-to-understand risk scores. Built-in prioritization capabilities ensure high-risk vulnerabilities can be quickly mitigated. Elevating cyber risk management even further, Tenable One provides advanced prioritization metrics and capabilities, such as cyber exposure visualizations, asset criticality ratings, cyber exposure risk scoring and peer benchmarking, as well as providing the ability to track risk reduction over time. |
2.4.1 SLTT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats. |
Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to: • Services • User-agents • Application traffic |
2.5.1 SLTT agencies are able to respond to identified events and incidents, document root cause, and share information with partners. |
Tenable One allows agencies to deliver dashboards, reports and scorecards to help share important security data in meaningful ways. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. |
Source: Tenable, October 2023
Tenable offers SLTT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:
For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.
A new component of the SLCGP program is for SLTT agencies to adopt key cybersecurity best practices. To do this, they are required to consult the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding. The CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to both critical infrastructure operations and the American people. In part two of this series, we’ll discuss how Tenable One can help agencies meet the CISA CPGs.
In his role as Director of Security Engineering, U.S. Public Sector, Garrett Cook leads Tenable's efforts to reduce risk across U.S. civilian agencies, state governments and Department of Defense. Garrett has over 15 years of experience in cybersecurity, identity and access management, systems management, business intelligence and data protection.
Matt Kucik serves as Tenable's National Sales Director for Public Sector state, local and education (SLED) and public utility entities. Matt’s entry into IT started in 2000 and he's always kept his focus on helping government agencies.
Enter your email and never miss timely alerts and security guidance from the experts at Tenable.
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
65 assets
Choose Your Subscription Option:
Thank you for your interest in Tenable.io. A representative will be in touch soon.
FREE FOR 7 DAYS
Tenable Nessus is the most comprehensive vulnerability scanner on the market today.
Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.
Fill out the form below to continue with a Nessus Pro Trial.
Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.
Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
BUY
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
65 assets
Choose Your Subscription Option:
Thank you for your interest in Tenable.io. A representative will be in touch soon.
Formerly Tenable.io Web Application Scanning
Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.
Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.
Formerly Tenable.io Web Application Scanning
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.
Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.
Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.
Thank you for your interest in Tenable Lumin. A representative will be in touch soon.
Formerly Tenable.sc
Please fill out this form with your contact information.
A sales representative will contact you shortly to schedule a demo.
* Field is required
Formerly Tenable.ot
Get the Operational Technology Security You Need.
Reduce the Risk You Don’t.
Formerly Tenable.ad
Continuously detect and respond to Active Directory attacks. No agents. No privileges.
On-prem and in the cloud.
Exceptional unified cloud security awaits you!
We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.
Thank you for your interest in Tenable Cloud Security. A representative will be in touch soon.
Exposure management for the modern attack surface.
Formerly Tenable.asm
Know the exposure of every asset on any platform.
Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.