State Local Tribal Territorial Indicators of Compromise Automation Pilot | PD SLP 19 001

Opportunity Information: Apply for PD SLP 19 001

The "State Local Tribal Territorial Indicators of Compromise Automation Pilot" is a Department of Homeland Security (DHS) cooperative agreement opportunity designed to help state, local, tribal, and territorial (SLTT) government environments evaluate cyber threat Indicators of Compromise (IOCs) faster and more consistently by using automation. The core idea is to move IOC handling away from slow, manual, analyst-by-analyst processes and toward workflows that can ingest, triage, enrich, validate, and distribute actionable threat information at machine speed, while still keeping humans in the loop where judgment is necessary. The project is framed as a pilot, meaning it is intended to test approaches in real operational conditions, document what works, and identify what needs to be standardized or built out for broader adoption.

A central deliverable of the pilot is identifying where automation can realistically replace or reduce repetitive human tasks in the IOC lifecycle. That typically includes steps like deduplicating indicators, correlating them with internal telemetry, enriching them with context (such as reputation data, known threat actor associations, or observed behavior patterns), scoring or prioritizing them, and turning them into defensive actions (for example, blocking a malicious domain, quarantining a host, or triggering an investigation ticket). Alongside the automation focus, the opportunity emphasizes actionable information sharing across enterprises and across SLTT partners. In practice, that points to building or refining processes and technical mechanisms so that when one participating organization validates an IOC or discovers useful context, that information can be packaged and shared quickly in a way others can apply without extensive rework.

Another major focus is orchestration: determining what orchestration services are needed to integrate the end-to-end activities of sensing, understanding, decision-making, and acting. "Sensing" generally refers to collecting security-relevant signals (logs, alerts, network data, endpoint detections). "Understanding" involves analysis and enrichment to determine meaning and relevance. "Decision-making" involves policy-based choices, prioritization, and approvals. "Acting" is the execution of defensive measures in tools like firewalls, endpoint security platforms, email gateways, and ticketing systems. The pilot is meant to surface the gaps between these stages and specify the orchestration layer or services needed to connect them so that an IOC can move from detection to response quickly, reliably, and with auditability.

The funding opportunity is discretionary and uses a cooperative agreement instrument, which typically means DHS expects substantial involvement during the period of performance, such as technical collaboration, shared decision-making on pilot direction, and iterative review of outcomes. The activity category is listed under science and technology and other research and development, reinforcing that this is not just a procurement of a finished product, but an applied R&D-style effort to test automation approaches, define best practices, and produce insights that can be reused by other jurisdictions.

Eligibility is limited to for-profit organizations other than small businesses, indicating DHS was targeting larger commercial entities that can assemble the technical capabilities, integration experience, and program management needed to run a multi-jurisdiction pilot. The recipient is allowed to select up to five states and/or localities to participate, which implies the awardee would be responsible for coordinating stakeholders, aligning requirements, handling deployment or integration planning, and ensuring pilot activities produce comparable results across multiple environments rather than being a one-off implementation.

Key administrative details include the opportunity title and number (PD SLP 19 001), the CFDA number (97.128), and that it was released by the DHS Office of Procurement Operations - Grants Division. The posting was created on Aug 12, 2019, with an original closing date of Aug 28, 2019. The award ceiling listed is $2,000,000. The source data also notes "ExpectedAwards: 20," which suggests DHS anticipated making multiple awards under the opportunity, potentially to test different automation strategies, technology stacks, or implementation models, though any individual project would still be constrained by the stated ceiling.

Overall, the opportunity is best understood as an effort to modernize how SLTT organizations operationalize threat intelligence and IOC handling by proving out automation and orchestration approaches in real government settings, documenting where manual work can be reduced without sacrificing quality, and improving how validated, usable cyber threat information is shared across organizations so defenses can be applied faster and more uniformly.

• The Department of Homeland Security, Office of Procurement Operations - Grants Division in the science and technology and other research and development sector is offering a public funding opportunity titled "State Local Tribal Territorial Indicators of Compromise Automation Pilot" and is now available to receive applicants.
• Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 97.128.
• This funding opportunity was created on Aug 12, 2019.
• Applicants must submit their applications by Aug 28, 2019. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
• Each selected applicant is eligible to receive up to $2,000,000.00 in funding.
• The number of recipients for this funding is limited to 20 candidate(s).
• Eligible applicants include: For profit organizations other than small businesses.

Apply for PD SLP 19 001

[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal: