Opportunity Information: Apply for PD SLP 19 001
The "State Local Tribal Territorial Indicators of Compromise Automation Pilot" is a Department of Homeland Security (DHS) cooperative agreement opportunity designed to help state, local, tribal, and territorial (SLTT) government environments evaluate cyber threat Indicators of Compromise (IOCs) faster and more consistently by using automation. The core idea is to move IOC handling away from slow, manual, analyst-by-analyst processes and toward workflows that can ingest, triage, enrich, validate, and distribute actionable threat information at machine speed, while still keeping humans in the loop where judgment is necessary. The project is framed as a pilot, meaning it is intended to test approaches in real operational conditions, document what works, and identify what needs to be standardized or built out for broader adoption.
A central deliverable of the pilot is identifying where automation can realistically replace or reduce repetitive human tasks in the IOC lifecycle. That typically includes steps like deduplicating indicators, correlating them with internal telemetry, enriching them with context (such as reputation data, known threat actor associations, or observed behavior patterns), scoring or prioritizing them, and turning them into defensive actions (for example, blocking a malicious domain, quarantining a host, or triggering an investigation ticket). Alongside the automation focus, the opportunity emphasizes actionable information sharing across enterprises and across SLTT partners. In practice, that points to building or refining processes and technical mechanisms so that when one participating organization validates an IOC or discovers useful context, that information can be packaged and shared quickly in a way others can apply without extensive rework.
Another major focus is orchestration: determining what orchestration services are needed to integrate the end-to-end activities of sensing, understanding, decision-making, and acting. "Sensing" generally refers to collecting security-relevant signals (logs, alerts, network data, endpoint detections). "Understanding" involves analysis and enrichment to determine meaning and relevance. "Decision-making" involves policy-based choices, prioritization, and approvals. "Acting" is the execution of defensive measures in tools like firewalls, endpoint security platforms, email gateways, and ticketing systems. The pilot is meant to surface the gaps between these stages and specify the orchestration layer or services needed to connect them so that an IOC can move from detection to response quickly, reliably, and with auditability.
The funding opportunity is discretionary and uses a cooperative agreement instrument, which typically means DHS expects substantial involvement during the period of performance, such as technical collaboration, shared decision-making on pilot direction, and iterative review of outcomes. The activity category is listed under science and technology and other research and development, reinforcing that this is not just a procurement of a finished product, but an applied R&D-style effort to test automation approaches, define best practices, and produce insights that can be reused by other jurisdictions.
Eligibility is limited to for-profit organizations other than small businesses, indicating DHS was targeting larger commercial entities that can assemble the technical capabilities, integration experience, and program management needed to run a multi-jurisdiction pilot. The recipient is allowed to select up to five states and/or localities to participate, which implies the awardee would be responsible for coordinating stakeholders, aligning requirements, handling deployment or integration planning, and ensuring pilot activities produce comparable results across multiple environments rather than being a one-off implementation.
Key administrative details include the opportunity title and number (PD SLP 19 001), the CFDA number (97.128), and that it was released by the DHS Office of Procurement Operations - Grants Division. The posting was created on Aug 12, 2019, with an original closing date of Aug 28, 2019. The award ceiling listed is $2,000,000. The source data also notes "ExpectedAwards: 20," which suggests DHS anticipated making multiple awards under the opportunity, potentially to test different automation strategies, technology stacks, or implementation models, though any individual project would still be constrained by the stated ceiling.
Overall, the opportunity is best understood as an effort to modernize how SLTT organizations operationalize threat intelligence and IOC handling by proving out automation and orchestration approaches in real government settings, documenting where manual work can be reduced without sacrificing quality, and improving how validated, usable cyber threat information is shared across organizations so defenses can be applied faster and more uniformly.Apply for PD SLP 19 001
- The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State Local Tribal Territorial Indicators of Compromise Automation Pilot" and is now available to receive applicants.
- Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
- This funding opportunity was created on Aug 12, 2019.
- Applicants must submit their applications by Aug 28, 2019. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
- Each selected applicant is eligible to receive up to $2,000,000.00 in funding.
- The number of recipients for this funding is limited to 20 candidate(s).
- Eligible applicants include: For profit organizations other than small businesses.
[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal:
Frequently Asked Questions (FAQs)
What is the "State Local Tribal Territorial Indicators of Compromise Automation Pilot"?
It is a Department of Homeland Security (DHS) cooperative agreement opportunity focused on helping state, local, tribal, and territorial (SLTT) government environments evaluate cyber threat Indicators of Compromise (IOCs) faster and more consistently through automation. The effort is structured as a pilot to test approaches in real operational conditions, document what works, and identify what needs standardization for broader adoption.
What is the main goal of this pilot?
The main goal is to shift IOC handling away from slow, manual, analyst-by-analyst processes and toward automated workflows that can ingest, triage, enrich, validate, and distribute actionable threat information at machine speed, while keeping humans involved where judgment is needed.
What are Indicators of Compromise (IOCs) in the context of this opportunity?
In this opportunity, IOCs are cyber threat indicators that can be evaluated and operationalized to support defense. The pilot focuses on accelerating and standardizing how these indicators are processed, enriched with context, validated, prioritized, and ultimately turned into defensive actions.
Why does DHS describe this as a "pilot"?
The project is framed as a pilot because it is intended to test automation and orchestration approaches under real operational conditions, capture lessons learned, demonstrate what is feasible, and clarify what capabilities should be standardized or expanded to support wider use across SLTT organizations.
What parts of the IOC lifecycle does the pilot aim to automate?
The opportunity highlights automation that can replace or reduce repetitive tasks across the IOC lifecycle, including deduplicating indicators, correlating them with internal telemetry, enriching them with context (such as reputation data, threat actor associations, or observed behavior patterns), scoring or prioritizing indicators, and converting validated indicators into defensive actions.
What does "machine speed" IOC handling mean here?
It refers to building workflows that can process and move threat information through key steps (ingest, triage, enrichment, validation, and distribution) rapidly and consistently through automation, rather than relying solely on manual, case-by-case analyst review.
Does the pilot remove humans from decision-making?
No. The stated intent is to keep humans in the loop where judgment is necessary, while using automation to handle repetitive, time-consuming steps and to improve consistency and speed.
What kinds of defensive actions are mentioned as outcomes of IOC automation?
Examples include blocking a malicious domain, quarantining a host, or triggering an investigation ticket. The emphasis is on turning validated and prioritized indicators into actions that can be executed in operational security tools and processes.
How does this opportunity address information sharing?
It emphasizes actionable information sharing across enterprises and across SLTT partners. The intent is that when a participating organization validates an IOC or discovers useful context, that information can be packaged and shared quickly so other partners can apply it without extensive rework.
What does "actionable information sharing" mean in this pilot?
It means sharing threat information in a form that other organizations can use quickly and directly, rather than requiring significant additional analysis or translation. The pilot aims to improve both the processes and technical mechanisms that enable fast, usable sharing of validated IOCs and related context.
What is meant by "orchestration" in this program?
Orchestration refers to the services and integrations needed to connect end-to-end activities involved in handling IOCs: sensing, understanding, decision-making, and acting. The pilot is intended to identify gaps between these stages and define what orchestration layer or services are needed so an IOC can move from detection to response quickly, reliably, and with auditability.
What are the four stages mentioned: sensing, understanding, decision-making, and acting?
In the program description: sensing is collecting security-relevant signals (such as logs, alerts, network data, and endpoint detections); understanding is analyzing and enriching those signals to determine meaning and relevance; decision-making involves policy-based choices, prioritization, and approvals; and acting is executing defensive measures in tools like firewalls, endpoint security platforms, email gateways, and ticketing systems.
What types of data are included in "sensing"?
The description lists examples such as logs, alerts, network data, and endpoint detections. These represent the kinds of signals that can feed the IOC pipeline for evaluation and action.
What does "understanding" involve for IOCs?
Understanding involves analysis and enrichment to determine an IOC's meaning and relevance. The opportunity specifically references enrichment with context such as reputation data, known threat actor associations, or observed behavior patterns.
What does "decision-making" involve?
Decision-making includes policy-based choices, prioritization, and approvals. This is where the workflow determines what to do with an IOC and under what conditions actions should be taken.
What does "acting" involve?
Acting is the execution of defensive measures using operational tools and systems such as firewalls, endpoint security platforms, email gateways, and ticketing systems.
Why is auditability mentioned as a requirement?
The opportunity indicates that orchestration should support moving from detection to response quickly and reliably, with auditability. This implies the pilot should surface and specify mechanisms that allow actions and decisions to be tracked in a way that can be reviewed and verified.
What kind of funding instrument is being used?
The opportunity uses a cooperative agreement instrument.
What does a cooperative agreement imply for the relationship with DHS?
The description notes that a cooperative agreement typically means DHS expects substantial involvement during the period of performance, such as technical collaboration, shared decision-making on pilot direction, and iterative review of outcomes.
Is this opportunity intended to buy a finished product?
The activity category is listed under science and technology and other research and development, and the description emphasizes applied R&D-style testing and defining best practices. Based on that framing, it is positioned as an effort to test automation approaches and produce reusable insights rather than simply procure a finished, off-the-shelf product.
What is the activity category for this opportunity?
It is listed under science and technology and other research and development.
Who is eligible to apply?
Eligibility is limited to for-profit organizations other than small businesses.
Does the opportunity allow the recipient to choose participating jurisdictions?
Yes. The recipient is allowed to select up to five states and/or localities to participate.
How many participating states or localities can be included in the pilot?
Up to five states and/or localities can participate, selected by the recipient.
What does the "up to five states and/or localities" detail imply about project responsibilities?
It implies the awardee would be responsible for coordinating stakeholders across multiple jurisdictions, aligning requirements, managing deployment or integration planning, and ensuring pilot activities generate comparable results across different environments rather than being a one-off implementation.
What is the award ceiling?
The listed award ceiling is $2,000,000.
How many awards were expected?
The source data notes "ExpectedAwards: 20," suggesting DHS anticipated making multiple awards under the opportunity.
What might multiple expected awards indicate?
Based on the description, it could indicate DHS intended to test different automation strategies, technology stacks, or implementation models across multiple recipients, while each individual project remains constrained by the stated award ceiling.
What is the opportunity title and number?
The title is "State Local Tribal Territorial Indicators of Compromise Automation Pilot" and the opportunity number is PD SLP 19 001.
What is the CFDA number for this opportunity?
The CFDA number is 97.128.
Which DHS office released the posting?
It was released by the DHS Office of Procurement Operations - Grants Division.
When was the posting created and when did it originally close?
The posting was created on Aug 12, 2019, and the original closing date was Aug 28, 2019.
What kind of outcomes is DHS trying to achieve overall?
Overall, the opportunity aims to modernize how SLTT organizations operationalize threat intelligence and IOC handling by proving out automation and orchestration approaches in real government settings, documenting where manual work can be reduced without sacrificing quality, and improving how validated, usable cyber threat information is shared so defenses can be applied faster and more uniformly.
Browse more opportunities from the same category: Science and Technology and other Research and Development
Next opportunity: Bridging the Watershed
Previous opportunity: National Rural Transit Assistance Program
Applicant Portal:
Are you interested in learning about about how to apply for this government funding opportunity? You can create a free applicant account and receive instant access to our applicant portal that many business owners like you have benefited from.
Apply for PD SLP 19 001
Applicants also applied for:
Applicants who have applied for this opportunity (PD SLP 19 001) also looked into and applied for these:
| Funding Opportunity |
|---|
| National Cyber Security Awareness Apply for PD SLP 19 002 Funding Number: PD SLP 19 002 Agency: Department of Homeland Security, Office of Procurement Operations - Grants Division Category: Science and Technology and other Research and Development Funding Amount: $1,000,000 |
| DoD Reconstructive Transplant Research Program, Qualitative Research Award Apply for W81XWH 19 RTRP QRA Funding Number: W81XWH 19 RTRP QRA Agency: Department of Defense, Dept. of the Army -- USAMRAA Category: Science and Technology and other Research and Development Funding Amount: Case Dependent |
| FY2020 SBIR/STTR Phase I Release 1 Apply for DE FOA 0002145 Funding Number: DE FOA 0002145 Agency: Department of Energy - Office of Science, Office of Science Category: Science and Technology and other Research and Development Funding Amount: $200,000 |
| National Cyber Security Awareness Apply for DHS 19 CISA 128 SLT 002 Funding Number: DHS 19 CISA 128 SLT 002 Agency: Department of Homeland Security, Office of Procurement Operations - Grants Division Category: Science and Technology and other Research and Development Funding Amount: $1,000,000 |
| State Local Tribal Territorial Indicators of Compromise Automation Pilot Apply for DHS 19 CISA 128 SLT001 Funding Number: DHS 19 CISA 128 SLT001 Agency: Department of Homeland Security, Office of Procurement Operations - Grants Division Category: Science and Technology and other Research and Development Funding Amount: $2,000,000 |
| Assessing Status of Residual Populations of Threatened Bats Apply for P19AS00501 Funding Number: P19AS00501 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $72,500 |
| CAVE Cultural Landscapes Inventory Update for Rattlesnake Sprin Apply for P19AS00527 Funding Number: P19AS00527 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $112,415 |
| Research Efforts in Support of Investigation, Documentation and A Apply for P19AS00529 Funding Number: P19AS00529 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $195,000 |
| NSF/DOE Partnership in Basic Plasma Science and Engineering Apply for 19 596 Funding Number: 19 596 Agency: National Science Foundation Category: Science and Technology and other Research and Development Funding Amount: $250,000 |
| Cooperative Ecosystems Studies Unit Apply for F19AS00345 Funding Number: F19AS00345 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $80,000 |
| Naval Medical Research Center: Research and Development of Protective Vaccines and Other Countermeasures Against Infectious Disease Agents of Military Importance. Apply for N62645 PA 19 2 Funding Number: N62645 PA 19 2 Agency: Department of Defense, NAVAL MEDICAL LOGISTICS COMMAND Category: Science and Technology and other Research and Development Funding Amount: $56,826,775 |
| FY19 Pilot Safety Culture Assessment on a Passenger Railroad Apply for FR RRD 19 003 Funding Number: FR RRD 19 003 Agency: Department of Transportation, DOT/Federal Railroad Administration Category: Science and Technology and other Research and Development Funding Amount: $60,000 |
| Research & Write an Administrative History of Tuskegee NHS Apply for P19AS00558 Funding Number: P19AS00558 Agency: Department of the Interior, National Park Service Category: Science and Technology and other Research and Development Funding Amount: $63,305 |
| Cooperative Ecosystem Studies Unit, Piedmont-South Atlantic Coast CESU Apply for G19AS00132 Funding Number: G19AS00132 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $25,000 |
| Cooperative Ecosystem Studies Unit, Rocky Mountain CESU Apply for G19AS00131 Funding Number: G19AS00131 Agency: Department of the Interior, U. S. Geological Survey Category: Science and Technology and other Research and Development Funding Amount: $48,000 |
| Salt Basin Assessment of Water Resources and Groundwater Withdrawal Apply for BOR UC 19 N005 Funding Number: BOR UC 19 N005 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $436,790 |
| Migratory Bird Monitoring, Assessment and Conservation Apply for F19AS00352 Funding Number: F19AS00352 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $60,000 |
| Salt Basin to Pecos Basin Pipeline Alignment Apply for BOR UC 19 N006 Funding Number: BOR UC 19 N006 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $750,000 |
| PIT Tag antenna systems and data analysis Apply for BOR UC 19 N004 Funding Number: BOR UC 19 N004 Agency: Department of the Interior, Bureau of Reclamation Category: Science and Technology and other Research and Development Funding Amount: $479,826 |
| 15.678 Cooperative Ecosystem Studies Units Apply for F19AS00354 Funding Number: F19AS00354 Agency: Department of the Interior, Fish and Wildlife Service Category: Science and Technology and other Research and Development Funding Amount: $80,000 |
Grant application guides and resources
It is always free to apply for government grants. However the process may be very complex depending on the funding opportunity you are applying for. Let us help you!
Apply for Grants
Inside Our Applicants Portal
Access Applicants Portal
- Grants Repository - Access current and historic funding opportunities with ease. Thousands of funding opportunities are published every week. We can help you sort through the database and find the eligible ones to apply for.
- Applicant Video Guides - The grant application process can be challenging to follow. We can help you with intuitive video guides to speed up the process and eliminate errors in submissions.
- Grant Proposal Wizard - We have developed a network of private funding organizations and investors across the United States. We can reach out and submit your proposal to these contacts to maximize your chances of getting the funding you need.
Premium leads for funding administrators, grant writers, and loan issuers
Thousands of people visit our website for their funding needs every day. When a user creates a grant proposal and files for submission, we pass the information on to funding administrators, grant writers, and government loan issuers.
If you manage government grant programs, provide grant writing services, or issue personal or government loans, we can help you reach your audience.
Learn More
Request more information:
Would you like to learn more about this funding opportunity, similar opportunities to "PD SLP 19 001", eligibility, application service, and/or application tips? Submit an inquiry below:
Don't forget to subscribe to our grant alerts mailing list to receive weekly alerts on new and updated grant funding opportunities like this one in your email.