2012 nstic pilot grant ffo amendment 3 - final.pdf

March 26, 2012

THIRD AMENDED ANNOUNCEMENT OF FEDERAL FUNDING OPPORTUNITY FOR THE

NIST NATIONAL STRATEGY FOR TRUSTED IDENTITIES IN CYBERSPACE (NSTIC)

PILOT GRANT PROGRAM

SUMMARY OF AMENDMENT

Background

On February 1, 2012, the National Institute of Standards and Technology (NIST) posted an Announcement of Federal Funding Opportunity (FFO) (2012-NIST-NSTIC-01) on Grants.gov and on the NIST National Strategy for Trusted Identities in Cyberspace (NSTIC) Web site (http://www.nist.gov/nstic/2012-nstic-ffo-01.pdf) announcing the solicitation of proposals for the fiscal year 2012 NSTIC Pilot Grant Program competition. On February 24, 2012, and March 5, 2012, NIST issued amendments changing certain requirements related to formatting and dates, and updating agency contacts.

NIST is now issuing a third amendment to change the dates of the expected completion of the review of the abbreviated proposals and the submission of full proposals found in the Dates section of the Executive Summary on page 2 (both dates), in Section IV.3. on page 11 (deadline for full proposals), and Section V.4. on page 16 (review completion date).1

Description of Amendment to FFO

As set forth herein, NIST is issuing an amendment to the FFO to:

1. Revise the date that NIST intends to complete its review of the abbreviated proposals in the Dates section of the Executive Summary on page 2 and in Section V.4. on page 16 from Thursday, March 29, 2012, to Friday, April 6, 2012.

2. Revise the due date for submission of full proposals in the Dates section of the Executive Summary on page 2 and in Section IV.3. on page 11 from 5:00 p.m. Eastern Time on Monday, April 30, 2012 to 5:00 p.m. Eastern Time on Thursday, May 10, 2012.

No other revisions are being made by this amendment. The full text of the Amended FFO, including the revisions being made herein and all prior amendments, is set forth below.

All page number references are to the full text of the Amended FFO, including the revisions being made herein.

http://www.nist.gov/nstic/2012-nstic-ffo-01.pdf

ANNOUNCEMENT OF FEDERAL FUNDING OPPORTUNITY (FFO)

National Strategy for Trusted Identities in Cyberspace (NSTIC) Pilot Grant Program

EXECUTIVE SUMMARY

Federal Agency Name: National Institute of Standards and Technology (NIST), United States Department of Commerce (DoC)

Funding Opportunity Title: National Strategy for Trusted Identities in Cyberspace (NSTIC) Pilot Grant Program

Announcement Type: Initial

Funding Opportunity Number: 2012-NIST-NSTIC-01

Catalog of Federal Domestic Assistance (CFDA) Number: 11.609, Measurement and Engineering Research and Standards

Dates: Abbreviated proposals, paper and electronic, must be received no later than 5:00 p.m. Eastern Time on Wednesday, March 7, 2012. Abbreviated proposals received after this deadline will not be reviewed or considered. Review of abbreviated proposals and selection of finalists is expected to be completed by Friday, April 6, 2012. Full proposals, paper and electronic, must be received no later than 5:00 p.m. Eastern Time on Thursday, May 10, 2012. Full proposals received after this deadline will not be reviewed or considered. Review of full proposals, selection of successful proposers, and award processing is expected to be completed in July 2012. The earliest anticipated start date for awards under this FFO is expected to be September 1, 2012.

Proposal Submission Address:

a. Abbreviated Proposals: Abbreviated proposals may be submitted in paper format or electronically by e-mail as follows:

Paper Submission: Dr. Barbara Cuthill

National Institute of Standards and Technology NSTIC Pilot Grant Program 100 Bureau Drive, Mail Stop 2000 Gaithersburg, MD 20899-2000

Phone: 301-975-3273

E-mail Submission: nsticpilots@nist.gov

b. Full Proposals: Proposers whose abbreviated proposals are selected as finalists and who are invited by NIST to submit full proposals may submit them in paper format or electronically as follows:

Paper Submission: Dr. Barbara Cuthill

NSTIC Pilot Grant Program mailto:nsticpilots@nist.gov

100 Bureau Drive, Mail Stop 2000

Electronic Submission: www.grants.gov

Funding Opportunity Description: NIST is soliciting proposals from eligible proposers to pilot on-line identity solutions that embrace and advance the NSTIC vision: that individuals and organizations utilize secure, efficient, easy-to-use, and interoperable identity credentials to access online services in a manner that promotes confidence, privacy, choice, and innovation. Specifically, the Federal government seeks to initiate and support pilots that address the needs of individuals, private sector organizations and all levels of government in accordance with the NSTIC Guiding Principles that identity solutions will be (1) privacy-enhancing and voluntary, (2) secure and resilient, (3) interoperable, and (4) cost-effective and easy-to-use. NIST will fund pilot projects that are intended to test or demonstrate new solutions, models or frameworks that do not exist in the marketplace today.

Total Amount to be Awarded: Approximately $10,000,000 may be available to fund the first year of new multi-year awards.

Anticipated Amounts: NIST anticipates funding five (5) to eight (8) projects for up to two

(2) years in the range of approximately $1,250,000 to $2,000,000 per year per project, consistent with the multi-year funding policy described in Section II. Award Information, of this FFO.

Funding Instrument: Cooperative agreement.

Who Is Eligible: Accredited institutions of higher education; hospitals; non-profit organizations; commercial organizations; and state, local, and Indian tribal governments located in the United States and its territories. An eligible organization may work individually or include proposed subawards or contracts with others in a project proposal, effectively forming a team or consortium.

Cost Sharing Requirements: This Program does not require cost sharing.

Public Meetings (Proposers’ Conference): NIST will hold a public meeting (Proposers’ Conference) in Washington, D.C. to provide general information regarding NSTIC, to offer guidance on preparing proposals, and to answer questions. Proprietary technical discussions about specific project ideas with NIST staff are not permitted at this conference or at any time before submitting the proposal to NIST. Therefore, proposers should not expect to have proprietary issues addressed at the Proposers’ Conference. Also, NIST/NSTIC staff will not critique or provide feedback on project ideas while they are being developed by a proposer. However, NIST/NSTIC staff will answer questions about the NSTIC eligibility requirements, evaluation criteria, selection process, and the general characteristics of a competitive NSTIC proposal. Attendance at the NSTIC Proposers’ Conference is not required. The Proposers’ Conference will be held on Wednesday, February 15, 2012, 9:00 a.m. – 12:00 p.m. Eastern Time at the Department of Commerce Main Auditorium, 14th and Constitution Avenue, N.W., Washington, D.C. 20230. The Proposers’ Conference will also be webcast at http://www.nist.gov/allevents.cfm. Web http://www.grants.gov/ http://www.nist.gov/allevents.cfm participants may live tweet using #NSTIC as the event hashtag to ask questions during the event. Pre-registration is required by 5:00 p.m. Eastern Time on Monday, February 13, 2012, at https://www-s.nist.gov/CRS/. Due to increased security at the Department of Commerce, all attendees MUST be pre-registered; NO on-site registrations will be accepted.

No registration fee will be charged.

FULL ANNOUNCEMENT TEXT

I. Funding Opportunity Description

The statutory authority for the NSTIC Program is 15 U.S.C, 272(b)(1), (b)(4), (c)(12), and (c)(14).

In April, 2011, President Obama signed the National Strategy for Trusted Identities in Cyberspace (NSTIC or Strategy), which charts a course for the public and private sectors to collaborate to raise the level of trust associated with the identities of individuals, organizations, networks, services, and devices involved in online transactions. The NSTIC can be found at:

http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf.

The Strategy’s vision is: Individuals and organizations utilize secure, efficient, easy-to-use, and interoperable identity solutions to access online services in a manner that promotes confidence, privacy, choice, and innovation.

The NSTIC acknowledges and addresses three major challenges in cyberspace:

1. A lack of confidence and assurance that people, organizations, and businesses are who they say they are online. Both businesses and governments are unable to offer many services online because they cannot effectively identify the individuals with whom they interact.

2. A de-facto requirement in the current online environment for individuals to maintain dozens of different usernames and passwords, typically one for each Web site with which they interact. The complexity of this approach is a burden to individuals, and it encourages behavior – like the reuse of passwords – that makes online fraud and identity theft easier.

This requirement has created a number of problems for online businesses who face ever-increasing costs for managing customer accounts and the loss of business that results from individuals’ unwillingness to create yet another account, consequences of online fraud.

Spoofed Web sites, stolen passwords, and compromised accounts are all symptoms of inadequate authentication mechanisms.

3. A growing list of online privacy challenges, ranging from minor nuisances and unfair surprises, to disclosure of sensitive information in violation of individual rights, injury or discrimination based on sensitive personal attributes that are improperly disclosed, actions and decisions in response to misleading or inaccurate information, and costly and potentially life-disrupting identity theft. In the aggregate, even the harms at the less severe end of this spectrum have significant adverse effects, because they undermine consumer trust in the Internet environment. Diminished trust, in turn, may cause consumers to hesitate before adopting new services and may impede innovative and productive uses of new technologies.

https://www-s.nist.gov/CRS/ http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf

NSTIC envisions addressing these challenges through a user-centric Identity Ecosystem, defined in the Strategy as: "an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities—and the digital identities of devices.”

NSTIC specifies four guiding principles to which the Identity Ecosystem must adhere:

1. Identity solutions will be privacy-enhancing and voluntary;

2. Identity solutions will be secure and resilient;

3. Identity solutions will be interoperable; and

4. Identity solutions will be cost-effective and easy to use.

The Strategy will only be a success – and the ideal of the Identity Ecosystem will only be achieved – if identity solutions fulfill all of these guiding principles. Achieving them separately will not only lead to an inadequate solution but could serve as a hindrance to the broader evolution of cyberspace.

The Identity Ecosystem is designed to securely support transactions that range from anonymous to fully-authenticated and from low- to high-value. The Identity Ecosystem, as envisioned by NSTIC, will increase:

Privacy protections for individuals, who will be able to trust that their personal data is handled fairly and transparently;

Convenience for individuals, who may choose to manage fewer passwords or accounts than they do today;

Efficiency for organizations, which will benefit from a reduction in paper-based and account management processes;

Ease-of-use, by automating identity solutions whenever possible and basing them on technology that is simple to operate;

Security, by making it more difficult for criminals to compromise online transactions;

Confidence that digital identities are adequately protected, thereby promoting the use of online services;

Innovation, by lowering the risk associated with sensitive services and by enabling service providers to develop or expand their online presence; and

Choice, as service providers offer individuals different—yet interoperable—identity credentials and media.

NSTIC emphasizes that some parts of the Identity Ecosystem exist today but recognizes that there is still much work to be done. NIST has established a National Program Office (NPO) to lead the implementation of NSTIC, with a focus on promoting private-sector involvement and engagement; supporting interagency collaboration and coordinate interagency efforts associated with achieving programmatic goals; building consensus on policy frameworks necessary to achieve the vision; identifying areas for the government to lead by example in developing and supporting the Identity Ecosystem, particularly in the Executive Branch’s role as a provider and validator of key credentials; actively participating within and across relevant public- and private-sector fora; and assessing progress against the goals, objectives and milestones of NSTIC.

In implementing the Strategy, the NSTIC NPO seeks to promote the existing marketplace, encourage new solutions where none exist, and establish a baseline of privacy, security, interoperability, and ease of use that will enable the market to flourish.

More information about the NSTIC NPO is available at http://www.nist.gov/nstic/

Pilot Program Focus Area: Building Identity Ecosystem Foundations and Frameworks to Address Barriers

The purpose of the NSTIC Pilot Program is to advance the NSTIC vision, objectives and guiding principles; demonstrate innovative frameworks that can provide a foundation for the Identity Ecosystem, and tackle barriers that have, to date, impeded the Identity Ecosystem from being fully realized. NIST will fund pilot projects that are intended to test or demonstrate new solutions, models or frameworks that do not exist in the marketplace today.

The identity solutions marketplace has struggled, in part, due to a number of barriers that market forces alone have been unable to overcome. These barriers include, but are not limited to:

A lack of commonly accepted technical standards to ensure interoperability among different authentication solutions.

No clarity on liability and other complex economic issues (i.e., “who is liable if something goes wrong in a transaction?” “How – if at all – should transactions be monetized?”)

No common standards for privacy protections and data re-use.

Challenges with usability of some strong authentication technologies.

The NSTIC NPO seeks to overcome these barriers, in part, through funding pilot programs that provide creative solutions to address one or more of these barriers and demonstrate the feasibility of solutions to them in a manner consistent with the NSTIC vision and guiding principles.

Specifically, the NSTIC NPO is interested in funding pilot projects with innovative approaches to address some or all of these barriers and do so in a way that aligns with and advances the NSTIC’s four guiding principles. These pilots can thus provide a foundation upon which the Identity Ecosystem can be constructed.

Examples of objectives that pilots may strive to achieve include, but are not limited to:

1. Demonstrate the feasibility of the Identity Ecosystem, via projects that link multiple sectors, including multiple Identity providers and relying parties.

2. Create and demonstrate solutions that can help public and private sector entities alike more easily jumpstart adoption of trusted strong authentication technologies in lieu of passwords at public-facing websites. For example, identity exchange hubs that can quickly validate and process strong credentials for relying parties.

3. Create solutions to address the limitations and barriers that have inhibited consumer demand for strong authentication technologies, and that could prompt consumers to obtain a strong credential.

4. Create and demonstrate a viable framework, capable of being accepted by all stakeholders, that provides certainty on liability and other economic issues.

http://www.nist.gov/nstic/

5. Create and demonstrate a viable framework, capable of being accepted by all stakeholders, that provides a strong set of user-centric privacy protections for all Identity Ecosystem participants. This framework should focus on addressing the issues outlined in Objective

1.1 of the NSTIC, “Establish improved privacy protection mechanisms” (see p. 29-30 at http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf).

6. Demonstrate that privacy-enhancing technologies can support viable business models, current security requirements, and generally accepted performance standards.

7. Demonstrate interoperability across multiple-solution stacks (i.e., smart cards, one time passwords, other technologies) in an identity ecosystem.

8. Create and demonstrate better user-centric frameworks for enabling the exchange of specific attributes associated with identities.

9. Expand the acceptance and use of trust frameworks and trusted third party credential providers by new Relying Parties.

10. Demonstrate that end-user choice can align with usability through innovative presentations of choice and new types of interfaces.

11. Demonstrate how advances in usability and accessibility can improve user uptake of strong authentication technologies.

12. Demonstrate the role public sector entities can play in helping individuals prove their identity to private sector credential providers and/or relying parties.

Proposers and team members must possess the education, experience, and training to pursue and advance implementation of the NSTIC. In addition, the proposers and team members must possess a demonstrated record of excellence in Identity Management efforts.

A successful proposer will include in its proposal a clear statement detailing the challenge (or challenges) the pilot will address, as well as clear, measurable performance objectives that can be used to determine the success of the pilot project.

II. Award Information

1. Funding Instrument

The funding instrument that will be used is a cooperative agreement. The nature of NIST’s “substantial involvement” will generally be collaboration between NIST and the recipient organizations. This includes NIST collaboration with a recipient on the scope of work.

Additional forms of substantial involvement that may arise are described in the Department of Commerce (DoC) Grants and Cooperative Agreements Interim Manual, which is available at http://www.osec.doc.gov/oam/grants_management/policy/doc_grants_manual/default.htm.

2. Multi-Year Funding Policy

When a proposal for a multi-year award is approved, funding will usually be provided for only the first year of the program. If a project is selected for funding, NIST has no obligation to provide any additional funding in connection with that award. Continuation of an award to increase funding or extend the period of performance is at the sole discretion of NIST.

Continued funding will be contingent upon satisfactory performance, continued relevance to the mission and priorities of NSTIC, and the availability of funds.

3. Funding Availability http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf http://www.osec.doc.gov/oam/grants_management/policy/doc_grants_manual/default.htm

NIST plans that a total of $10,000,000 may be made available in FY 2012 to award five (5) to eight (8) multi-year awards to eligible proposers for the first year. New awards are expected to range from approximately $1,250,000 to $2,000,000 each with project performance periods of up to two (2) years, consistent with the multi-year funding policy described in Section II. Award Information, of this FFO. Therefore, proposers may propose multi-year projects for up to two (2) years in the range of approximately $1,250,000 to $2,000,000 per year, or smaller or larger amounts based on the project scope.

III. Eligibility Information

1. Eligible Proposers

Eligible proposers are accredited institutions of higher education; hospitals; non-profit organizations; commercial organizations; and state, local, and Indian tribal governments located in the United States and its territories. An eligible organization may work individually or include proposed subawards or contracts with others in a project proposal, effectively forming a team or consortium.

2. Cost Sharing or Matching

Cost sharing and matching are not required under this program.

3. Other

Abbreviated Proposals. NIST requires abbreviated proposals under the NSTIC Pilot Grant Program.

IV. Application/Proposal and Submission Information

1. Address to Request Application Package

The standard application package, consisting of the standard forms, i.e., SF-424, SF-424A, SF- 424B, SF-LLL, and the CD-511, is available at www.grants.gov. The standard application package may be requested by contacting:

Dr. Barbara Cuthill

NSTIC Pilot Grant Program 100 Bureau Drive, Mail Stop 2000

2. Content and Format of Application/Proposal Submission

a. Required Abbreviated Proposal Form and Documents

Abbreviated proposals must be submitted under the NSTIC Pilot Grant Program in order to be considered for funding. The abbreviated proposal must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the proposer organization. The FFO number 2012-NIST- NSTIC-01 must be identified in item 12 of the SF-424. The list of certifications and assurances referenced in item 21 of the SF-424 is contained in the SF-424B.

(2) A word-processed document written by the proposer of no more than four (4) pages describing the proposed project that includes sufficient information to address the evaluation criteria (see Section V.1. of this FFO).

b. Required Full Proposal Forms and Document

Only proposers whose proposals have been selected by NIST as “finalists” and who have been requested to submit a full proposal are permitted to submit full proposals to NIST for the NSTIC Pilot Grant Program. Full proposals submitted by proposers that have not been selected as finalists will be returned to the proposer without review. The full proposal must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the proposer organization. The FFO number 2012-NIST- NSTIC-01 must be identified in item 12 of the SF-424. The list of certifications and assurances referenced in item 21 of the SF-424 is contained in the SF-424B.

(2) SF-424A, Budget Information - Non-Construction Programs. (The budget should reflect anticipated expenses for each year of the project of no more than two (2) years, considering all potential cost increases, including cost of living adjustments.)

(3) SF-424B, Assurances - Non-Construction Programs

(4) CD-511, Certification Regarding Lobbying

(5) SF-LLL, Disclosure of Lobbying Activities (if applicable)

(6) Technical Proposal. The Technical Proposal is a word-processed document of no more than twenty-five (25) pages responsive to the program description (see Section I. of this FFO) and the evaluation criteria (see Section V.1. of this FFO). It should contain the following information:

(a) Executive Summary. An executive summary of the proposed approach, consistent with the evaluation criteria (see Section V.1. of this FFO). The executive summary should not exceed one (1) single-sided page.

(b) Project Approach. A description of the proposed approach, sufficient to permit evaluation of the proposal, in accordance with the evaluation criteria (see Section V.1. of this FFO).

(c) Statement of Work. A statement of work that discusses the specific tasks proposed to be carried out, including a schedule of measurable events and milestones. This section should be the primary, but not only, means by which the proposal will be evaluated according to the Rationality and Feasibility and Merit of Contribution evaluation criteria (see Section V.1. of this FFO).

(d) Qualifications. A description of the qualifications and proposed operational or management activities of key personnel who will be assigned to work on the proposed project, including examples of past experience working with state government representatives and related organizations. This section should be the primary, but not only, means by which the proposal will be evaluated according to the Qualifications of Personnel and Ability to Deliver evaluation criterion (see Section V.1. of this FFO).

(e) Resource Availability. A description of the facilities and overall support available to accomplish the project objectives. This section should be the primary, but not only, means by which the proposal will be evaluated according to the Resource Availability and Planning evaluation criterion (see Section V.1. of this FFO).

(7) Budget Narrative. There is no set format for the Budget Narrative; however, it should provide a detailed breakdown of each of the object class categories as reflected on the SF-424A. NIST will require that award recipients report on their projects twice a year to the Identify Ecosystem Steering Group (http://www.nist.gov/nstic/nstic-frn-noi.pdf).

Therefore, proposers should include travel costs to these meetings. Additionally, for awards to commercial organizations, audits must be conducted by an external auditor (CPA or cognizant Federal audit agency) at after the first year and at the end of a two (2)-year project. If a recipient has never received Federal funding from any Federal agency, a certification will be required from a CPA to determine whether the recipient has a functioning financial management system that meets the provisions of 15 C.F.R. §

14.21. Therefore, costs for these audits and certification should be included in the budget accordingly.

(8) Indirect Cost Rate Agreement. If indirect costs are included in the proposed budget, provide a copy of the approved negotiated agreement if this rate was negotiated with a cognizant Federal audit agency. If the rate was not established by a cognizant Federal audit agency, provide a statement to this effect. Successful proposers will be required to obtain such a rate.

If submitting the proposal electronically via Grants.gov, items IV.2.b.(1) through IV.2.b.(5) above are part of the standard application package in Grants.gov and can be completed through the download application process. Items IV.2.b.(6) through IV.2.b.(8) must be completed and attached by clicking on “Add Attachments” found in item 15 of the SF-424, Application for Federal Assistance. This will create a zip file that allows for transmittal of the documents electronically via Grants.gov. Proposers should carefully follow specific Grants.gov instructions at www.grants.gov to ensure the attachments will be accepted by the Grants.gov system. A receipt from Grants.gov indicating a proposal is received does not provide information about whether attachments have been received.

If submitting a proposal by paper, all of the required proposal documents should be submitted in the order listed above.

c. Proposal Format

(1) Double-sided copy. For paper submissions, print on both sides of the paper (front to back counts as two (2) pages).

(2) E-mail submissions. Abbreviated proposals will be accepted by email and must contain a scanned signed SF-424. Full proposals will not be accepted by email.

(3) Facsimile submissions (fax). Will not be accepted.

(4) Figures, graphs, images, and pictures. Should be of a size that is easily readable or viewable and may be landscape orientation.

(5) Font. Easy to read font (10-point minimum). Smaller type may be used in figures and tables but must be clearly legible.

(6) Line spacing. Abbreviated and full proposals may be single-spaced.

http://www.nist.gov/nstic/nstic-frn-noi.pdf

(7) Margins. One (1) inch top, bottom, left, and right.

(8) Number of paper copies. For paper abbreviated and full proposal submissions, one

(1) signed stapled original and two (2) stapled copies. If original proposal is in color, the two (2) copies must also be in color. If submitting electronically via e-mail or through Grants.gov, paper copies are not required.

(9) Page layout. Portrait orientation only except for figures, graphs, images, and pictures

(see Section IV.2.c.(4)).

(10) Page Limit. Abbreviated proposals are limited to four (4) pages. Full proposals are limited to twenty-five (25) pages.

Page limit includes: Table of contents (if included), Technical Proposal with all required sections, including management information and qualifications, resumes, figures, graphs, tables, images, and pictures.

Page limit excludes: SF-424, Application for Federal Assistance; SF-424A, Budget Information – Non-Construction Programs; SF-424B, Assurances – Non-Construction Programs; SF-LLL, Disclosure of Lobbying Activities; CD-511, Certification Regarding Lobbying; Budget Narrative; and Indirect Cost Rate Agreement.

(11) Page numbering. Number pages sequentially.

(12) Paper size. 21.6 by 27.9 centimeters (8 ½ by 11 inches).

(13) Proposal language. English.

(14) Stapled paper submission. For paper submissions, staple the original signed proposal and each of the two (2) copies securely with one (1) staple in the upper left-hand corner.

(15) Typed document. All proposals, including forms, must be typed.

3. Submission Dates and Times

Abbreviated proposals must be received by NIST no later than 5:00 p.m. Eastern Time on Wednesday, March 7, 2012. This deadline applies to all modes of abbreviated proposal submission, including courier services, express mailing, and electronic.

Full proposals from proposers whose abbreviated proposals are selected as finalists must be received no later than 5:00 p.m. Eastern Time on Thursday, May 10, 2012. This deadline applies to all modes of full proposal submission, including courier services, express mailing, and electronic.

Abbreviated and full proposals not received by the specified due dates and times will not be considered and will be returned without review. NIST determines whether proposals submitted by paper have been timely received by the deadline by the date and time receipt they are physically received by NIST at its Gaithersburg, Maryland campus. For electronic abbreviated proposal submissions via e-mail, NIST will consider the date and time of the e-mail. For electronic full proposal submissions via Grants.gov, NIST will consider the date and time stamped on the validation generated by www.grants.gov as the official submission time.

NIST strongly recommends that proposers do not wait until the last minute to submit a proposal.

NIST will not make any allowances for late submissions, including but not limited to incomplete Grants.gov registration, delays in mail delivery caused by Federal Government security screening for U.S. Postal Service mail, or for delays by guaranteed express mailing and/or couriers. To avoid any potential processing backlogs due to last minute Grants.gov registrations, proposers are highly encouraged to start their Grants.gov registration process at least four (4) weeks prior to the proposal due date.

Important: All proposers, both electronic and paper submitters, should be aware that adequate time must be factored into proposers’ schedules for delivery of their proposal. Submitters of electronic proposals are advised that volume on Grants.gov may be extremely heavy on the deadline date, and if Grants.gov is unable to accept proposals electronically in a timely fashion, proposers are encouraged to exercise their option to submit proposals in paper format.

Submitters of paper proposals should allow adequate time to ensure a paper proposal will be received on time, taking into account that Federal Government security screening for U.S.

Postal Service mail may delay receipt of mail for up to two (2) weeks and that guaranteed express mailings and/or couriers are not always able to fulfill their guarantees.

In the event of a natural disaster that interferes with timely proposal submissions, NIST may issue an amendment to this FFO to change the proposal submission due date.

4. Executive Order 12372 (Intergovernmental Review of Federal Programs)

Proposals under this Program are not subject to Executive Order 12372.

5. Funding Restrictions

Profit or fee is not an allowable cost.

6. Other Submission Requirements

a. Abbreviated Proposals: Abbreviated proposals may be submitted in paper format or electronically by e-mail as follows:

(1) Paper Submission: Dr. Barbara Cuthill

National Institute of Standards and Technology NSTIC Pilot Grant Program 100 Bureau Drive, Mail Stop 2000

(2) E-mail Submission: nsticpilots@nist.gov

b. Full Proposals: Proposers whose abbreviated proposals are selected as finalists and who are invited by NIST to submit full proposals may submit them in paper format or electronically as follows:

mailto:nsticpilots@nist.gov

(1) Paper Submission: Dr. Barbara Cuthill

NSTIC Pilot Grant Program 100 Bureau Drive, Mail Stop 2000

(2) Electronic Submission: www.grants.gov

Submitters of electronic full proposals through Grants.gov (www.grants.gov) should carefully follow specific Grants.gov instructions to ensure the attachments will be accepted by the Grants.gov system. A receipt from Grants.gov indicating a full proposal is received does not provide information about whether attachments have been received. For further information or questions regarding applying electronically for the 2012-NIST-NSTIC-01 announcement, contact Christopher Hunton by phone at 301-975- 5718 or by e-mail at christopher.hunton@nist.gov.

Proposers are strongly encouraged to start early and not wait until the approaching due date before logging on and reviewing the instructions for submitting a full proposal through Grants.gov. The Grants.gov registration process must be completed before a new registrant can apply electronically. If all goes well, the registration process takes three (3) to five (5) business days. If problems are encountered, the registration process can take up to two (2) weeks or more. Proposers must have a Dun and Bradstreet Data Universal Numbering System (DUNS) number and must be registered with the Federal Central Contractor Registry and with a Credential Provider, as explained on the Grants.gov Web site. After registering, it may take several days or longer from the initial log-on before a new Grants.gov system user can submit a proposal. Only authorized individual(s) will be able to submit the proposal, and the system may need time to process a submitted proposal. Proposers should save and print the proof of submission they receive from Grants.gov. If problems occur while using Grants.gov, the proposer is advised to (a) print any error message received and (b) call Grants.gov directly for immediate assistance. If calling from within the United States or from a U.S. territory, please call 800-518-4726. If calling from a place other than the United States or a U.S.

territory, please call 606-545-5035. Assistance from the Grants.gov Help Desk will be available around the clock every day, with the exception of Federal holidays. Help Desk service will resume at 7:00 a.m. Eastern Time the day after Federal holidays. For assistance using Grants.gov, you may also contact support@grants.gov.

Information essential to successful submission of proposals on the Grants.gov system is detailed in the For Applicants section found in red on the left side of the www.grants.gov home page, and all potential proposers should pay close attention to the information contained therein. The All About Grants, Applicant FAQs, and Submit Application FAQs sections found under the Applicant Resources option are particularly important.

Refer to important information in Section IV.3. Submission Dates and Times, to help ensure your proposal is received on time.

c. Any amendments to this FFO will be announced through Grants.gov. Proposers can sign up for Grants.gov FFO amendments or alternatively may call Dr. Barbara Cuthill at 301-975- 3273, to request copies.

http://www.grants.gov/ http://www.grants.gov/ mailto:christopher.hunton@nist.gov mailto:support@grants.gov

V. Application/Proposal Review Information

1. Evaluation Criteria

The evaluation criteria that will be used in evaluating abbreviated and full proposals are as follows:

a. Rationality and Feasibility (0 to 40 points). Coherence of the proposer’s approach and the extent to which the proposal effectively addresses the NSTIC Guiding Principles.

Factors that may be considered include:

(1) demonstration of long-term commitment to project success;

(2) demonstrated alignment of pilot to NSTIC guiding principles;

(3) the thoughtful integration of usability principles and user-centered design;

(4) how enhancement of end-user privacy is designed into the project;

(5) the ability to address differences between conformity and interoperability;

(6) the ability to identify clearly, technology versus policy interoperability efforts;

(7) the ability to address identified barriers to the Identity Ecosystem and provide a foundation to address one or more of them;

(8) the likelihood that the pilot would be successful;

(9) the likelihood that the pilot, if successful, could continue into production; and

(10) the quality and comprehensiveness of a plan to transition a pilot into ongoing operations, i.e., “production.”

b. Merit of Contribution (0 to 30 points). Potential effectiveness of the proposal and the value it would contribute to furthering the development of the Identity Ecosystem in accordance with the NSTIC Guiding Principles. Factors that may be considered include:

(1) the likelihood that the proposed project will help meet NSTIC near-term or long-term benchmarks;

(2) the contribution of the project to development of the Identity Ecosystem Framework;

(3) the number of end users potentially impacted by the proposed project; and

(4) the ability of the proposed project to develop new or strengthen existing digital identity services.

c. Qualifications of Personnel and Ability to Deliver (0 to 20 points). Professional accomplishments, skills and training of the proposed personnel to perform the work described in the project. Factors that may be considered include:

(1) the qualifications of key and supporting personnel;

(2) demonstration of the ability to achieve positive outcomes in pilot programs and similar endeavors; and

(3) stakeholder outreach and coordination.

d. Resource Availability and Planning (0 to 10 points). Extent to which the proposer has access to the necessary facilities and overall support to accomplish the project objectives.

Factors that may be considered include:

(1) the degree to which requested resources are appropriate for the proposed project’s scope;

(2) the quality of organizational resources proposed to be used on the project;

(3) the rationality of acquisition plans;

(4) the plan to obtain and/or leverage additional or external resources or support as needed to complete the project and/or to engage in post-project commercialization to move the project results into routine use;

(5) the effectiveness of the organizational proposed team structure if contracts and/or sub-awards are included; and

(6) proposed collaborations with other Identity Ecosystem stakeholders.

2. Selection Factors

The Selecting Official shall select proposals for award based upon the rank order of the proposals, and may select a proposal out of rank based on one or more of the following selection factors:

a. The availability of Federal funds.

b. The project duplicates other projects funded by NIST, DoC, or by other Federal agencies.

c. Proposer’s performance under current or previous Federal financial assistance awards.

d. Diversity of technical approaches to providing a foundation for the Identity Ecosystem, and tackling barriers that have, to date, impeded the Identity Ecosystem from being fully realized.

3. Review and Selection Process

a. Initial Administrative Review of Abbreviated and Full Proposals. An initial review of timely received abbreviated and full proposals will be conducted to determine eligibility, completeness, and responsiveness to this FFO and the scope of the stated program objectives. Proposals determined to be ineligible, incomplete, and/or non-responsive may be eliminated from further review.

b. Full Review of Eligible, Complete, and Responsive Abbreviated and Full Proposals.

Abbreviated and full proposals determined to be eligible, complete, and responsive will proceed for full reviews in accordance with the review and selection process below:

(1) Abbreviated Proposals. Each abbreviated proposal will be reviewed by at least three

(3) independent, objective reviewers, who are Federal employees, knowledgeable in the subject matter of this FFO and its objectives and who are able to conduct a review based on the evaluation criteria (see Section V.1. of this FFO). Based on the average of the reviewers’ scores, a rank order will be prepared and provided to the Selecting Official for further consideration.

The Selecting Official, who is the NSTIC NPO Program Manager, will then select finalists based upon the rank order and the selection factors (see Section V.2. of this FFO).

(2) Full Proposals. Each full proposal submitted by a proposer whose abbreviated proposal was selected as a finalist will be reviewed by at least three (3) independent, objective reviewers, who are Federal employees, knowledgeable in the subject matter of this FFO and its objectives and who are able to conduct a review based on the evaluation criteria (see Section V.1. of this FFO). Based on the average of the reviewers’ scores, a preliminary rank order will be prepared.

An Evaluation Board, a committee comprised of Federal employees, will consider the finalists’ full proposals in the preliminary rank order along with the reviewers’ written evaluations based on the evaluation criteria (see Section V.1.of this FFO). The Evaluation Board will prepare a final numerical ranking of the finalists’ full proposals for the Selecting Official for further consideration.

In making final selections, the Selecting Official will select funding recipients based upon the Evaluation Board’s rank order of the finalists’ full proposals and the selection factors.

The selection of funding recipients by the Selecting Official is final.

NIST reserves the right to negotiate the budget costs with the proposers that have been selected to receive awards, which may include requesting that the proposer remove certain costs. Additionally, NIST may request that the proposer modify objectives or work plans and provide supplemental information required by the agency prior to award. NIST also reserves the right to reject a proposal where information is uncovered that raises a reasonable doubt as to the responsibility of the proposer. NIST may select part, some, all, or none of the proposals. The award decisions of the NIST Grants Officer are final.

4. Anticipated Announcement and Award Dates

Review of abbreviated proposals and selection of finalists is expected to be completed by Friday, April 6, 2012. Review of full proposals, selection of successful proposers, and award processing is expected to be completed in July 2012. The earliest anticipated start date for awards made under this FFO is expected to be September 1, 2012.

5. Additional Information

a. Proposal Replacement Pages. Proposers may not submit replacement pages and/or missing documents once a proposal, abbreviated or full, has been submitted. Any revisions must be made by submission of a new abbreviated or full proposal that must be received by NIST by the submission deadline for abbreviated or full proposals, respectively.

b. Notification to Unsuccessful Proposers. Unsuccessful proposers will be notified in writing.

c. Notification to Finalists. Proposers whose abbreviated proposals are selected by NIST as “finalists” will be notified in writing and invited by NIST to submit full proposals.

d. Retention of Unsuccessful Proposals. One (1) of each non-selected abbreviated and full proposal will be retained for three (3) years for record keeping purposes and the other two

(2) copies will be destroyed. After three (3) years the remaining copy will be destroyed.

VI. Award Administration Information

1. Award Notices. Successful proposers will receive an award from the NIST Grants Officer.

The award cover page, i.e., CD-450, Financial Assistance Award, is available at http://ocio.os.doc.gov/s/groups/public/@doc/@os/@ocio/@oitpp/documents/content/dev01_ 002513.pdf and the DoC Financial Assistance Standard Terms and Conditions (March http://ocio.os.doc.gov/s/groups/public/@doc/@os/@ocio/@oitpp/documents/content/dev01_002513.pdf http://ocio.os.doc.gov/s/groups/public/@doc/@os/@ocio/@oitpp/documents/content/dev01_002513.pdf

2008), which may be updated by the time of award, are available at http://www.osec.doc.gov/oam/archive/docs/GRANTS/DOC%20STCsMAR08Rev.pdf.

2. Administrative and National Policy Requirements

a. DoC Pre-Award Notification Requirements. The DoC Pre-Award Notification

Requirements for Grants and Cooperative Agreements, which are contained in the Federal Register notice of February 11, 2008 (73 FR 7696), are applicable to this FFO and are available at http://www2.ntia.doc.gov/files/DOC_pre-award_notification_requirements_73_FR_7696.pdf.

b. Employer/Taxpayer Identification Number (EIN/TIN), Dun and Bradstreet Data

Universal Numbering System (DUNS), and Central Contractor Registration (CCR). All proposers for Federal financial assistance are required to obtain a universal identifier in the form of DUNS number and maintain a current registration in the CCR database. On the form SF-424 items 8.b. and 8.c., the proposer’s 9-digit EIN/TIN and 9-digit DUNS number must be consistent with the information on the CCR (www.ccr.gov) and Automated Standard Application for Payment System (ASAP). For complex organizations with multiple EIN/TIN and DUNS numbers, the EIN/TIN and DUNS numbers MUST be the numbers for the applying organization. Organizations that provide incorrect/inconsistent EIN/TIN and DUNS numbers may experience significant delays in receiving funds if their proposal is selected for funding. Confirm that the EIN/TIN and DUNS numbers are consistent with the information on the CCR and ASAP.

Per the requirements of 2 C.F.R. Part 25, each proposer must:

(1) Be registered in the CCR before submitting a proposal;

(2) Maintain an active CCR registration with current information at all times during which it has an active Federal award or a proposal under consideration by an agency; and

(3) Provide its DUNS number in each application or proposal it submits to the agency.

See also the Federal Register notice published on September 14, 2010, at 75 FR 55671.

c. Collaborations with NIST Employees. All proposals should include a description of any work proposed to be performed by an entity other than the proposer, and the cost of such work should ordinarily be included in the budget.

If a proposer proposes collaboration with NIST, the statement of work should include a statement of this intention, a description of the collaboration, and prominently identify the NIST employee(s) involved, if known. Any collaboration by a NIST employee must be approved by appropriate NIST management and is at the sole discretion of NIST. Prior to beginning the merit review process, NIST will verify the approval of the proposed collaboration. Any unapproved collaboration will be stricken from the proposal prior to the merit review.

d. Use of NIST Intellectual Property. If the proposer anticipates using any NIST-owned intellectual property to carry out the work proposed, the proposer should identify such intellectual property. This information will be used to ensure that no NIST employee involved in the development of the intellectual property will participate in the review process for that competition. In addition, if the proposer intends to use NIST-owned intellectual property, the proposer must comply with all statutes and regulations governing the licensing http://www.osec.doc.gov/oam/archive/docs/GRANTS/DOC%20STCsMAR08Rev.pdf http://www2.ntia.doc.gov/files/DOC_pre-award_notification_requirements_73_FR_7696.pdf http://www2.ntia.doc.gov/files/DOC_pre-award_notification_requirements_73_FR_7696.pdf http://www.ccr.gov/ of Federal government patents and inventions, described in 35 U.S.C. §§ 200-212, 37 C.F.R. Part 401, 15 C.F.R. § 14.36, and in Section B.21 of the DoC Pre-Award Notification Requirements, 73 FR 7696 (February 11, 2008). Questions about these requirements may be directed to the Chief Counsel for NIST, (301) 975-2803.

Any use of NIST-owned intellectual property by a proposer is at the sole discretion of NIST and will be negotiated on a case-by-case basis if a project is deemed meritorious. The proposer should indicate within the statement of work whether it already has a license to use such intellectual property or whether it intends to seek one.

If any inventions made in whole or in part by a NIST employee arise in the course of an award made pursuant to this FFO, the United States government may retain its ownership rights in any such invention. Licensing or other disposition of NIST's rights in such inventions will be determined solely by NIST, and include the possibility of NIST putting the intellectual property into the public domain.

e. Research Projects Involving Human Subjects, Human Tissue, Data or Recordings Involving Human Subjects including Software Testing. Any proposal that includes research involving human subjects, human tissue/cells, data or recordings involving human subjects, including software testing, must meet the requirements of the Common Rule for the Protection of Human Subjects (“Common Rule”), codified for the Department of Commerce (DoC) at 15 C.F.R. Part 27.