2015-NIST-NSTIC-01 FINAL.pdf

February 11, 2015

ANNOUNCEMENT OF FEDERAL FUNDING OPPORTUNITY (FFO)

National Strategy for Trusted Identities in Cyberspace (NSTIC)

Pilots Cooperative Agreement Program

EXECUTIVE SUMMARY

• Federal Agency Name: National Institute of Standards and Technology (NIST), United States Department of Commerce (DoC)

• Funding Opportunity Title: National Strategy for Trusted Identities in Cyberspace

(NSTIC) Pilots Cooperative Agreement Program

• Announcement Type: Initial

• Funding Opportunity Number: 2015-NIST-NSTIC-01

• Catalog of Federal Domestic Assistance (CFDA) Number: 11.619, Arrangements for Interdisciplinary Research Infrastructure

• Dates: Abbreviated Applications must be received through Grants.gov no later than

11:59 p.m. Eastern Time, Tuesday, March 17, 2015. Abbreviated Applications received after this deadline will not be reviewed or considered. Review of Abbreviated Applications and selection of finalists is expected to be completed by Friday, April 17, 2015. Full Applications must be received electronically through Grants.gov no later than 11:59 p.m. Eastern Time, Tuesday, May 21, 2015. Full Applications received after this deadline will not be reviewed or considered. Full Applications received from applicants who were not invited to submit a Full Application will not be reviewed or considered. Review of Full Applications, selection of successful applicants, and award processing is expected to be completed in August 2015. The earliest anticipated start date for awards under this FFO is expected to be September 1, 2015.

Keep in mind when developing your submission timeline the following:

1) In order to register in Grants.gov, your organization must have a current registration in the System for Award Management (SAM) (see Section VI.4.b. of this FFO). The registration process in SAM may take more than two weeks. Note that SAM requires annual registration renewal.

2) Applicants using Grants.gov will receive email notifications over a period of up to two business days as the application moves through intermediate systems before the applicant learns via a validation or rejection notification whether NIST has received the application.

• Application Submission Address: Applications will only be accepted using Grants.gov.

• Funding Opportunity Description: NIST is soliciting applications from eligible applicants to pilot online identity solutions that embrace and advance the NSTIC vision of an Identity Ecosystem Framework. Specifically, the Federal government seeks to initiate and support pilots that address the needs of individuals, private sector organizations, and all levels of government in accordance with the NSTIC Guiding Principles that identity solutions will be (1) privacy-enhancing and voluntary,

(2) secure and resilient, (3) interoperable, and (4) cost-effective and easy-to-use.

Pilots that maximize their contribution to the development of the broader Identity Ecosystem Framework through public forums such as the Identity Ecosystem Steering Group (IDESG) (see page 6) are encouraged. NIST will fund projects that are intended to demonstrate or deploy new solutions, models, and frameworks that either do not exist or are not widely adopted in the marketplace today.

• Anticipated Amounts: NIST anticipates that awards will be in the range of approximately $1,000,000 to $2,000,000 per year per project for up to two (2) years, consistent with the multi-year funding policy described in Section II.2 of this FFO.

Proposed funding levels must be consistent with project scope. NIST will consider applications that propose lower funding amounts. In FY 2015, NIST anticipates funding new pilots with total funding of up to approximately $5 million.

• Funding Instrument: Cooperative agreement.

• Who Is Eligible: Accredited institutions of higher education; non-profit organizations; commercial organizations; and state, local, and Indian tribal governments located in the United States and its territories. While the applicant must be located in the United States, the applicant may have a parent organization outside the United States. An eligible organization may work individually or include proposed subawardees, contractors or other collaborators in a project, effectively forming a team or consortium. An organization may submit more than one application but each must be on a distinct topic. Federal agencies may participate in projects but may not receive NIST funding.

• Cost Sharing Requirements: This program does not require cost sharing.

• Public Meetings (Applicants’ Conference): NIST will hold a public meeting (Applicants’ Conference) to provide general information regarding NSTIC, to offer general guidance on preparing applications, and to answer questions. Proprietary technical discussions about specific project ideas with NIST staff are not permitted at this conference or at any time before submitting the application to NIST. Therefore, applicants should not expect to have proprietary issues addressed at the Applicants’ Conference. Also, NIST/NSTIC Program Office staff will not critique or provide feedback on specific project ideas while they are being developed by an applicant.

However, NIST/NSTIC Program Office staff will answer questions about the NSTIC

Pilots Cooperative Agreement Program eligibility requirements, evaluation and award criteria, selection process, and the general characteristics of a competitive application at the Applicants’ Conference and by phone and email. Attendance at the Applicants’ Conference is not required. Information on the Applicants’ Conference is available at www.nist.gov/nstic.

Table of Contents

I. Program Description

II. Federal Award Information

III. Eligibility Information

IV. Application Submission Information

V. Application Review Information

VI. Federal Award Administration Information

VII. Federal Awarding Agency Contact(s)

VIII. Other Information

FULL ANNOUNCEMENT TEXT

I. Program Description

The statutory authority for the National Strategy for Trusted Identities in Cyberspace (NSTIC) Cooperative Agreement Program is 15 U.S.C. §§ 272(b)(1), (b)(4), (c)(12), and (c)(14).

In April 2011, President Obama signed the National Strategy for Trusted Identities in Cyberspace (NSTIC or Strategy), which charts a course for the public and private sectors to collaborate to raise the level of trust associated with the identities of individuals, organizations, networks, services, and devices involved in online transactions. The Strategy can be found at:

http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf.

The Strategy’s vision is: Individuals and organizations utilize secure, efficient, easy-to-use, and interoperable identity solutions to access online services in a manner that promotes confidence, privacy, choice, and innovation.

NSTIC acknowledges and addresses three major challenges in cyberspace:

http://www.nist.gov/nstic http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf

1. A lack of confidence and assurance that people, organizations, and businesses are who they say they are online and that devices are trusted and authentic.

Both businesses and governments are unable to offer many services online because they cannot effectively identify the individuals with whom they interact.

2. The current online environment presents a de facto requirement that individuals maintain dozens of different usernames and passwords, typically one for each Web site with which they interact. The complexity of this approach is a burden to individuals, and it encourages behavior – like the reuse of passwords – that makes online fraud and identity theft easier. At the same time, online businesses face ever-increasing costs for securely managing customer accounts, consequences of online fraud, and the loss of business that results from individuals’ unwillingness to create yet another account. Spoofed Web sites, stolen passwords, and compromised accounts are all symptoms of inadequate authentication mechanisms.

3. There is a growing list of online privacy challenges, ranging from minor nuisances and unfair surprises to injury or discrimination based on sensitive personal data that are improperly disclosed or unnecessarily aggregated, actions and decisions in response to misleading or inaccurate information, and costly and potentially life-disrupting identity theft. In the aggregate, even the harms at the less severe end of this spectrum have significant adverse effects, because they continue to undermine consumer trust in the Internet environment.

Diminished trust causes consumers to hesitate before adopting new services and impedes innovative and productive uses of new technologies.

NSTIC envisions addressing these challenges through a user-centric Identity Ecosystem, defined in the Strategy as: "an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities—and the digital identities of devices.”1

NSTIC specifies four guiding principles to which the Identity Ecosystem must adhere:

1. Identity solutions will be privacy-enhancing and voluntary;

2. Identity solutions will be secure and resilient;

3. Identity solutions will be interoperable; and

4. Identity solutions will be cost-effective and easy to use.

The Strategy will only be a success – and the ideal of the Identity Ecosystem will only be achieved – if identity solutions fulfill all of these guiding principles. Achieving them separately will not only lead to an inadequate solution but could serve as a hindrance to the broader evolution of cyberspace.

1 National Strategy for Trusted Identities in Cyberspace at http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf, p. 2 http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf

The Identity Ecosystem is designed to securely support transactions that range from anonymous to fully-authenticated and from low- to high-value. The Identity Ecosystem, as envisioned by NSTIC, will increase:

• Privacy protections for individuals, who will be able to trust that their personal data is handled fairly and transparently;

• Convenience for individuals, who may choose to manage fewer passwords or accounts than they do today;

• Efficiency for organizations, which will benefit from a reduction in paper-based and account management processes;

• Ease-of-use, by automating identity solutions whenever possible and basing them on technology that is simple to operate;

• Security, by making it more difficult for criminals to compromise online transactions;

• Confidence that digital identities are adequately protected, thereby promoting the use of online services;

• Innovation, by lowering the risk associated with sensitive services and by enabling service providers to develop or expand their online presence; and

• Choice, as service providers offer individuals different—yet interoperable— identity credentials and media.

The Strategy emphasizes that some parts of the Identity Ecosystem exist today but recognizes that there is still much work to be done. NIST has established a National Program Office (NPO) to lead the implementation of NSTIC, with a focus on promoting private sector involvement and engagement; supporting interagency collaboration and coordinating interagency efforts associated with achieving programmatic goals; building consensus on policy frameworks necessary to achieve the vision; identifying areas for the government to lead by example in developing and supporting the Identity Ecosystem, particularly in the Executive Branch’s role as a provider and validator of key credentials and attributes; actively participating within and across relevant public- and private-sector forums; and assessing progress against the goals, objectives, and milestones of NSTIC.

More information about the NSTIC NPO is available at http://www.nist.gov/nstic/.

NIST Funded Projects Advancing the NSTIC Strategy

In implementing the Strategy, the NSTIC NPO seeks to build upon the existing marketplace, encourage new solutions, and establish a baseline of privacy, security, interoperability, and easy to use trusted digital identity credentials that will improve trust in online transactions while enabling the market in online credentials to flourish.

NIST began funding pilot projects under the NSTIC Pilot Cooperative Agreement Program in 2012 and has made awards under this program in each of the subsequent years. NIST funded five pilot projects in the initial round of the NSTIC Pilots Cooperative http://www.nist.gov/nstic/

Agreement Program in 2012. In 2013, NIST funded five additional pilot projects in the program’s second round. In 2014, NIST funded three additional pilot projects under the program. Descriptions of the pilot projects funded in the past are available on the NSTIC website at http://www.nist.gov/nstic/pilot-projects.html.

To further advance the development of the Identity Ecosystem Framework and to build on the existing marketplace in online credentials, NIST has provided financial assistance to the Identity Ecosystem Steering Group (IDESG). The IDESG is the only private sector organization currently committed to developing the Identity Ecosystem Framework. More information on the IDESG is available at http://www.idecosystem.org.

Pilots Program Focus Area: Building Identity Ecosystem Foundations and Frameworks to Address Barriers

The purpose of the NSTIC Pilots Cooperative Agreement Program is to advance the NSTIC vision, objectives and guiding principles, and tackle barriers that have, to date, impeded the Identity Ecosystem from being fully realized. NIST will fund pilot projects that will make something happen that otherwise would not (i.e., the projects will deploy pilots to test or demonstrate new solutions, models and frameworks that either do not exist or are not widely adopted in the marketplace today). The NSTIC NPO defines pilots as systems deployed in production environments which include real users conducting real transactions with real data. The pilot system may be segregated legally or technically from the operations of a full production system.

The NSTIC NPO envisions the pilots as key contributors to the development of the Identity Ecosystem Framework. The pilots provide examples of real world achievements that provide key contributions to public forums such as the committees of the IDESG.

The identity solutions marketplace has struggled, in part, due to a number of barriers that market forces alone have been unable to overcome. These barriers include, but are not limited to:

• Concerns about the impact on privacy and civil liberties arising from the crossing of contextual boundaries and the capacity for more tracking and profiling inherent in federated identity solutions

• The usability of strong authentication technologies

• Balancing transparency to individual users and ease-of-use

• Building security, privacy, and usability into commonly used architectures (e.g., RESTful API architectures) to manage access to personal data

• Limited deployment of successful trust frameworks—especially addressing multiple sectors

• Lack of commonly accepted technical standards for interoperability among solutions

• Lack of strong authentication solutions that can be used across multiple sectors and relying parties (RPs).

http://www.nist.gov/nstic/pilot-projects.html http://www.idecosystem.org/

• Lack of clarity on liability and other complex economic issues (e.g., “who is liable if something goes wrong in a transaction?” “How – if at all – should transactions be monetized?”).

Specifically, the NSTIC NPO is interested in funding projects with innovative approaches that address some or all of these barriers in a way that aligns with and advances the NSTIC’s four guiding principles. These projects can thus provide a foundation upon which the Identity Ecosystem can be constructed and the Identity Ecosystem Framework can be developed.

Examples of objectives that projects may strive to achieve include, but are not limited to:

1. Demonstrate privacy-enhancing technologies or system architectures that mitigate privacy and civil liberties risks, such as increased tracking and personal data aggregation in today’s online environment, and can also support viable business models, current security requirements, and generally accepted performance standards.

2. Create and demonstrate frameworks, methodologies, or solutions for enabling the exchange of specific attributes associated with identities while minimizing the sharing of incidental personal information.

3. Create user-centric solutions to address the limitations and barriers that have inhibited consumer demand for strong authentication technologies and incentivize consumers to obtain a strong credential. For example, demonstrate how advances in usability and accessibility can improve user comfort with and uptake of strong authentication technologies.

4. Create and demonstrate solutions that can help public and private sector entities alike more easily jumpstart adoption of trusted strong authentication technologies in lieu of passwords at public-facing websites, for example, pilots have included secure and reliable identity exchange hubs that can quickly validate and process strong credentials across multiple trust frameworks, while enabling enhanced privacy and civil liberties protections.

5. Create and demonstrate a framework of policies, rules of behavior, and agreements among Identity Ecosystem stakeholders that can be applied across multiple trust frameworks and provides:

a. increased certainty on liability and other economic issues;

b. a strong set of privacy and civil liberties protections for all Identity

Ecosystem participants, focused on fully addressing the issues outlined in Objective 1.1 of NSTIC, “Establish improved privacy protection mechanisms” (see p. 29-30 of the Strategy identified in Section I. of this FFO); and

c. a means for establishing and implementing quantifiable and reproducible levels of assurance for credentials.

6. Demonstrate interoperability across multiple solution types (e.g., smart cards, one time passwords, other technologies) in an identity ecosystem.

7. Demonstrate the feasibility of the Identity Ecosystem and reusable credentials via projects that interoperably and securely link multiple sectors via trust frameworks, including multiple identity providers (IDPs) and relying parties.

8. Expand the acceptance and use of trust frameworks and third-party credential providers by RPs.

9. Demonstrate the role that public sector entities can play in helping individuals prove their identity to private sector credential providers and/or RPs.

Project participants (the project lead, contractors, subawardees and other collaborators) must demonstrate that they have the education, experience, and training to pursue and advance implementation of NSTIC. Project participants should demonstrate the strength of the partnership and highlight any prior collaborations.

II. Federal Award Information

1. Funding Instrument. The funding instrument that will be used is a cooperative agreement. The nature of NIST’s “substantial involvement” will generally be collaboration between NIST and the recipient organizations. This includes NIST collaboration with a recipient on the scope of work. Additional forms of substantial involvement that may arise are described in Chapter 5.C of the Department of Commerce (DoC) Grants and Cooperative Agreements Manual, which is available at http://go.usa.gov/SNJd . Please note the DoC Grants and Cooperative Agreements Manual is expected to be updated after publication of this funding announcement and before October 1, 2015. Refer to Section VII. of this FFO, Federal Awarding Agency Contacts, Grant Rules and Regulations, if you seek the information at this link and it is no longer working or you need more information

2. Multi-Year Funding Policy. When an application for a multi-year award is approved, funding will usually be provided for only the first year of the project. If a project is selected for funding, NIST has no obligation to provide any additional funding in connection with that award. Continuation of an award to increase funding or extend the period of performance is at the sole discretion of NIST. Continued funding will be contingent upon satisfactory performance, continued relevance to the mission and priorities of NSTIC, and the availability of funds.

3. Funding Availability. NIST anticipates that awards will be in the range of approximately $1,000,000 to $2,000,000 per year per project for up to two (2) years, consistent with the multi-year funding policy described in Section II.2 of this FFO.

Proposed funding levels must be consistent with project scope. NIST will consider applications that propose lower funding amounts. NIST anticipates funding new pilots with total funding of up to approximately $5 million. Recipients of existing awards under this program may submit applications for new projects, including follow on projects, under this FFO. Such applications will compete with all other applications for this FFO. Applications for continuation, renewal or supplemental funding of existing projects will not be considered under this FFO.

III. Eligibility Information http://go.usa.gov/SNJd

1. Eligible Applicants. Accredited institutions of higher education; non-profit organizations; commercial organizations; and state, local, and Indian tribal governments located in the United States and its territories. While the applicant must be located in the United States, the applicant may have a parent organization outside the United States. An eligible organization may work individually or include proposed subawardees, contractors or other collaborators in a project, effectively forming a team or consortium. An organization may submit more than one application but each must be on a distinct topic. Federal agencies may participate in projects but may not receive NIST funding.

2. Cost Sharing or Matching. This program does not require cost sharing.

IV. Application Submission Information

1. Address to Request Application Package. The application package for the Abbreviated Application is available at www.grants.gov. The instructions for retrieving the Full Application package from the Grants.gov website will be sent only to those invited to submit Full Applications.

2. Content and Form of Application Submission

a. Required Abbreviated Application Form and Documents

As described in Section IV.2.b., NIST requires Abbreviated Applications under the NSTIC Pilots Cooperative Agreement Program, and the Selection Official will then select finalists from among the Abbreviated Applications. Only those applicants whose Abbreviated Applications are selected as finalists will be invited to submit Full Applications.

The Abbreviated Applications must be received electronically through Grants.gov in order to be considered for funding. The Abbreviated Application must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the applicant organization.

SF-424, Item 12, should list the FFO number 2015-NIST-NSTIC-01.

SF-424, Item 18, should list the total budget information for the duration of the project.

The list of certifications and assurances referenced in Item 21 of the SF-424 is not needed for the Abbreviated Application.

http://www.grants.gov/

(2) Abbreviated Proposal. A word-processed document written by the applicant of no more than four (4) pages describing the proposed project that includes sufficient information to address the evaluation criteria (see Section V.1. of this FFO). Typically, the details of the technical solution will take up at least half of the document. The Abbreviated Proposal should be attached by clicking on “Add Attachments” found in Item 15 of the SF-424, Application for Federal Assistance. This will create a zip file that allows for transmittal of the documents electronically via Grants.gov.

b. Required Full Application Forms and Documents

Only applicants whose Abbreviated Applications have been selected by NIST as “finalists” and who have been invited to submit a Full Application for their “finalist” application are permitted to submit Full Applications to NIST for the NSTIC Pilots Cooperative Agreement Program. NIST will not review Full Applications submitted by applicants who have not been selected as finalists and those submitted by applicants who did not submit an Abbreviated Application. The Full Application must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the applicant organization.

SF-424, Item 12, should list the FFO number provided in the special application instructions.

SF-424, Item 18, should list the total budget information for the duration of the project.

The list of certifications and assurances referenced in Item 21 of the SF-424 is contained in the SF-424B.

(2) SF-424A, Budget Information - Non-Construction Programs. The budget should reflect anticipated expenses for each year of the project of no more than two (2) years, considering all potential cost increases, including cost of living adjustments.

(3) SF-424B, Assurances - Non-Construction Programs

(4) CD-511, Certification Regarding Lobbying

(5) SF-LLL, Disclosure of Lobbying Activities (if applicable)

(6) Technical Proposal. The Technical Proposal is a word-processed document of no more than twenty-five (25) pages responsive to the program description (see Section I. of this FFO) and the evaluation criteria (see Section V.1. of this FFO). Applicants should include in their proposal a clear statement detailing the challenge (or challenges) the pilot will address, as well as clear, measurable performance objectives that can be used to determine the potential success of the proposed pilot project. The Technical Proposal should contain the following information:

(a) Executive Summary. An executive summary of the proposed approach including references to the challenge(s) or barrier(s) to the Identity Ecosystem addressed in the proposal and the use cases to be piloted.

The executive summary should include information indicating how each evaluation criterion and its sub-factors are addressed. A table may be helpful in providing this information.

(b) Problem Statement and Use Cases. A problem statement that discusses the barrier(s) or challenge(s) to the Identity Ecosystem and how the specific objectives of the project will address the barrier(s) or challenge(s). Be clear about what this project would fund that otherwise would not happen. The NSTIC NPO has identified barriers and challenges in Section I. of this FFO. If the proposed project addresses barrier(s) or challenge(s) not listed in Section I. of this FFO, the applicant must provide a justification for why the barrier(s) or challenge(s) is (are) impeding the emergence of the Identity Ecosystem. This section should also provide information on the use cases that the solution addresses and the use cases that will actually be demonstrated during the proposed project. The application should explain why those use cases were chosen. This section establishes that the proposed project is within the scope of the FFO and provides critical background for the discussion of the proposed operational pilot.

(c) Operational pilot. A description of the proposed operational pilot, sufficient to permit evaluation of the proposal in accordance with the evaluation criteria (see Section V.1. of this FFO). This should include information on all the components of the solution(s) discussed in the pilot project, how these components interconnect, and what key information is exchanged among the components. An architecture diagram and data flow diagrams including data flows among project participants can be used to present this information and will not be counted within the page limit.

The applicant should provide information on what needs to be done to initiate the pilot, complete the pilot, and evaluate the pilot. A mapping to the derived NSTIC requirements may help describe how the pilot implements the NSTIC Guiding Principles. (For more on the NSTIC derived requirements see http://nstic.blogs.govdelivery.com/2013/09/11/what-does-it-mean-to-embrace-the-nstic-guiding-principles/.) This section should also provide an estimate of the planned number of end users and the minimum number of end users needed to be successful, including both credentials issued and relying parties, in each phase of the pilot.

http://nstic.blogs.govdelivery.com/2013/09/11/what-does-it-mean-to-embrace-the-nstic-guiding-principles/ http://nstic.blogs.govdelivery.com/2013/09/11/what-does-it-mean-to-embrace-the-nstic-guiding-principles/

The solution description, including any architecture and data flow diagrams, should make clear how the solution mitigates privacy and civil liberties risks arising from the capability for greater identification, tracking or linkability of transactions, and personal data aggregation. Privacy and civil liberties protections may be enforced by either (or both) technical and policy means, however, technical means for mitigating privacy risks are preferable to policy mitigations. This section should explain how the technical and/or policy measures are applied in a risk-based approach to address all eight Fair Information Privacy Principles listed in Appendix A of the Strategy identified in Section I. of this FFO. For example, see the Privacy Engineering Methodology (PEM) (https://www.idecosystem.org/content/pem-archive), or NIST’s privacy risk model (http://csrc.nist.gov/projects/privacy_engineering/documents.html).

This section should address the Adherence to the NSTIC Guiding Principles evaluation criterion (see Section V.1.a. of this FFO).

(d) Statement of Work and Implementation Plan. A complete statement of work covering all project participants including RPs that includes the following:

• The specific proposed tasks,

• A schedule of measurable events and milestones as well as clear, measurable performance objectives that can be used to determine the success of the pilot project,

• The project leadership’s plans to manage all project participants, including sub-recipients, contractors etc. to ensure realization of project goals and objectives,

• The approach to ensure the project results will align to all four NSTIC Guiding Principles,

• Realistic, measurable milestones tied to metrics for the entire project demonstrating progress in all areas relevant to the overall pilot.

All aspects discussed as part of the solution should be included in the implementation plan and have associated milestones. The schedule of tasks and events can be presented as a Gantt Chart, Work Breakdown Structure (WBS) or other formats. (Note that the Gantt Chart, Work Breakdown Structure or other, similar planning documents are not counted within the page limit.)

This section should address the Quality of the Implementation Plan evaluation criterion (see Section V.1.b of this FFO).

(e) Project Impact. A description of the plans to scale the pilot project into full production and self-sustaining, large scale use. This section should https://www.idecosystem.org/content/pem-archive http://csrc.nist.gov/projects/privacy_engineering/documents.html also describe the project participants’ planned role(s) in organizations developing the Identity Ecosystem Framework as envisioned in the NSTIC Strategy (e.g., the committees and working groups of the IDESG). Include also any planned efforts to disseminate information and reach out to users. This section should address the Contribution to the Identity Ecosystem evaluation criterion (see Section V.1.c. of this FFO).

(f) Qualifications. A description of the qualifications and proposed roles of the project participants, including the proposed role of the project lead and of each subwardee, contractor or other collaborator, including RPs, in the project. Include past experience collaborating, if applicable.

All participating organizations are expected to identify at least one key person and that person’s time commitment to the project. This section should also document the scope of the RP’s involvement in the project including the involvement of personnel committed to participating in the project. The key personnel should include the following:

• At least one individual from each participant, with details of committed participation, provided.

• A project manager or project leader with demonstrated experience leading projects of similar size and complexity and previously demonstrated ability to achieve positive outcomes in pilot programs and similar endeavors.

• At least one subject matter expert with specialized knowledge of both privacy technology and policy issues is expected on all projects. This individual(s) will be considered key to the project and shall ideally have at least 5-7 years’ experience in a cross-set of privacy and information technology skills. This individual may be an employee of the applicant, or he or she may be a consultant or employee of a contractor or subawardee. Alternatively, this role could be filled by multiple individuals with complementary skillsets and experience. Experience may be demonstrated by education, certifications, and job skills. Qualifications for the privacy skillset could include certifications such as CIPP or CIPM and experience implementing privacy principles such as the Fair Information Practice Principles, identifying and mitigating privacy risks in the implementation of information technology systems. Qualifications for the technical skillset could include advanced degrees in computer science, information science, or computer engineering and experience with architectural design for information systems;

data, systems, or software engineering; and related aspects of technical privacy implementations.

• At least one subject matter expert in usability of the type of system envisioned for the project.

Resumes of all key personnel including the privacy engineer(s), usability expert(s), and project manager(s) are required and are not included in the page count. Resumes are to be a maximum of two pages each.

This section, the budget narrative, letters of commitment and the resumes should address the Resource Availability evaluation criterion (see Section V.1.d of this FFO).

(7) Budget Narrative. The Budget Narrative should provide a detailed breakdown of each of the object class categories as reflected on the SF-424A. The budget justification should address all of the budget categories (personnel, fringe benefits, equipment, travel, supplies, other direct costs and indirect costs). The written justification should include the necessity and the basis for the cost. Only allowable costs should be included in the budget. Information on cost allowability is available in the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards at 2 C.F.R. Part 200, which apply to awards in this program. More information is available at http://go.usa.gov/SBYh and http://go.usa.gov/SBg4. Information needed for each category is as follows:

(a) Personnel – At a minimum, the budget justification for all personnel should include the following: name, job title, commitment of effort on the proposed project in terms of average number of hours per week or percentage of time, salary rate, total direct charges on the proposed project, description of the role of the individual on the proposed project and the work to be performed. Applicants can include in the budget the time to participate in forums (such as committees of the IDESG) developing elements of the Identity Ecosystem Framework as envisioned in the NSTIC strategy.

(b) Fringe Benefits – Fringe benefits should be identified separately from salaries and wages and based on rates determined by organizational policy. The items included in the fringe benefit rate (health insurance, parking) should not be charged under another cost category.

(c) Equipment – Equipment is defined as an item of property that has an acquisition cost of $5,000 or more (unless the organization has established lower levels) and an expected service life of more than one year. Any items that do not meet the threshold for equipment can be included under the supplies line item. The budget justification should list each piece of equipment, the cost, and a description of how it will be used and why it is necessary to the successful completion of the proposed project. Please note that any general use equipment (computers, etc.)

that is charged directly to the award, should be allocated to the award according to expected usage on the project.

http://go.usa.gov/SBYh http://go.usa.gov/SBg4

(d) Travel – NIST will require that award recipients report on their projects twice a year to the Identity Ecosystem Steering Group (http://www.idecosystem.org/). Therefore, applicants should include travel costs, as well as the cost of preparation, to at least two meetings of the IDESG per year and may include costs for up to four IDESG meetings per year in their budget narrative. For travel costs associated with travel to these meetings, and additional travel required by the recipient to complete the project, the budget justification for travel should include the following:

destination; names/number of people traveling; dates and/or duration;

mode of transportation, lodging and subsistence rates; and description of how the travel is directly related to the proposed project. For travel that is yet to be determined, please provide best estimates based on prior experience. If a destination is not known, an approximate amount may be used with the assumptions given for the location of the meeting.

(e) Supplies – Provide a list of each supply, and the breakdown of the total costs by quantity or unit of cost. Include the necessity of the cost for the completion of the proposed project.

(f) Contracts/Subawards – Each contract or subaward should be treated as a separate item. Describe the services provided and the necessity of the subaward or contract to the successful performance of the proposed project. Contracts are for obtaining normal goods and services.

Subawardees perform part of the project scope of work. For each subaward, applicants must provide budget detail justifying the cost of the work performed on the project.

(g) Other Direct Costs – For costs that do not easily fit into the other cost categories, please list the cost, and the breakdown of the total costs by quantity or unit of cost. Include the necessity of the cost for the completion of the proposed project. Only allowable costs can be charged to the award.

(8) Indirect Cost Rate Agreement. If indirect costs are included in the proposed budget, provide a copy of the approved negotiated agreement if this rate was negotiated with a cognizant Federal audit agency. If the rate was not established by a cognizant Federal audit agency, provide a statement to this effect. If the successful applicant includes indirect costs in the budget and has not established an indirect cost rate with a cognizant Federal audit agency, the applicant will be required to obtain such a rate in accordance with the Department of Commerce Financial Assistance Standard Terms and conditions, found at a link in Section VI.3. of this FFO.

(9) Letters of Commitment or Interest. Letters are not included in the page count.

http://www.idecosystem.org/

(a) Letters of Commitment to participate, as applicable. If the application identifies third parties including contractors, subawardees, and/or other collaborators, including relying parties, who will participate in the proposed project, effectively forming a team or consortium, then the applicant must provide a letter from each currently known participant describing its participation. Each letter should indicate the organization’s willingness to participate and what they will be doing for the project and the level of organizational commitment to the project. A letter is required whether or not the organization is receiving Federal funds. Note that the letters of commitment are part of the material addressing Resource Availability evaluation criterion (see Section V.1.d of this FFO).

(b) Letters of Interest, optional. Letters of interest may be provided from parties who might become customers for the solutions discussed in the proposed project.

(10) Resumes of Key Personnel including Privacy Experts. Resumes of all key personnel including the project’s privacy expert(s), usability expert(s), and project manager are required. These resumes are to be a maximum of two pages each. Note that the resumes are part of the material addressing Resource Availability evaluation criterion (see Section V.1.d of this FFO).

Items IV.2.b.(1) through IV.2.b.(5) above are part of the standard application package in Grants.gov and can be completed through the download application process. Items IV.2.b.(6) through IV.2.b.(10) must be completed and attached by clicking on “Add Attachments” found in item 15 of the SF-424, Application for Federal Assistance. This will create a zip file that allows for transmittal of the documents electronically via Grants.gov.

Applicants should carefully follow specific Grants.gov instructions at www.grants.gov to ensure the attachments will be accepted by the Grants.gov system. A receipt from Grants.gov indicates only that an application was transferred to a system. It does not provide details concerning whether all attachments (or how many attachments) transferred successfully. Applicants using Grants.gov will receive email notifications over a period of up to two business days as the application moves through intermediate systems before the applicant learns via a validation or rejection notification whether NIST has received the application.

c. Application Format

Note that these formatting requirements apply to both Abbreviated and Full Applications. Where there are differences in the formatting requirements between the two applications, such differences are noted.

(1) E-mail and Facsimile (fax) Submissions. Will not be accepted.

(2) Figures, Graphs, Images, and Pictures. Should be of a size that is easily readable or viewable and may be landscape orientation.

(3) Font. Easy to read font (10-point minimum). Smaller type may be used in figures and tables but must be clearly legible.

(4) Line Spacing. Applicants can use single spacing or double spacing.

(5) Margins. One (1) inch top, bottom, left, and right.

(6) Page layout. Portrait orientation only except for figures, graphs, images, and pictures.

(7) Page Limit. The Abbreviated Proposal for Abbreviated Applications is limited to four (4) pages, and the Technical Proposal for Full Applications is limited to twenty-five (25) pages.

(a) For Abbreviated Applications:

Page limit includes: Abbreviated Proposal addressing the criteria. This includes any figures, graphs, tables, images, and pictures.

Page limit excludes: SF-424, Application for Federal Assistance.

(b) For Full Applications:

Page limit includes: Table of contents (if included), Technical Proposal with all required information, including management information and qualifications, figures, graphs, tables, images, and pictures.

Page limit excludes: SF-424, Application for Federal Assistance; SF- 424A, Budget Information – Non-Construction Programs; SF-424B, Assurances – Non-Construction Programs; SF-LLL, Disclosure of Lobbying Activities; CD-511, Certification Regarding Lobbying; Cover Page, Gantt Chart or Work Breakdown Structure or other planning document (if included); Architecture and data flow diagrams (if included); -detailed analysis of the privacy risks of the solution (e.g., using the Privacy Evaluation Methodology (PEM) (see https://www.idecosystem.org/content/pem-archive), an analysis against NIST’s privacy risk model (see http://csrc.nist.gov/projects/privacy_engineering/documents.html); Budget Narrative; and Indirect Cost Rate Agreement; letters of interest and letters of commitment; and resumes.

(8) Page numbering. Number pages sequentially.

https://www.idecosystem.org/content/pem-archive http://csrc.nist.gov/projects/privacy_engineering/documents.html

(9) Page size. 21.6 centimeters by 27.9 centimeters (8 ½ inches by 11 inches).

(10) Application language. English.

d. Abbreviated Applications. NIST requires Abbreviated Applications under the NSTIC Pilots Cooperative Agreement Program (see Section IV.2.a. of this FFO).

The Selection Official will select from among the Abbreviated Applications, a group of finalists to submit Full Applications.

3. Dun and Bradstreet Universal Numbering System (DUNS) Number and System for Award Management (SAM). Applicants must have a Dun and Bradstreet Data Universal Numbering System (DUNS) number and must maintain a current registration in the Federal government’s primary registrant database, the System for Award Management (https://www.sam.gov/), as explained on the Grants.gov Web site. See also Sections IV.7.a.(2) and VI.4.b of this FFO for more details.

4. Submission Dates and Times. Abbreviated Applications must be received electronically through Grants.gov no later than 11:59 p.m. Eastern Time, Tuesday, March 17, 2015. Abbreviated Applications received after this deadline will not be reviewed or considered. Review of Abbreviated Applications and selection of finalists is expected to be completed by Friday, April 17, 2015. Full Applications must be received electronically through Grants.gov no later than 11:59 p.m. Eastern Time, Tuesday, May 21, 2015. Full Applications received after this deadline will not be reviewed or considered. Full Applications received from applicants who were not invited to submit a Full Application will not be reviewed or considered. Review of Full Applications, selection of successful applicants, and award processing is expected to be completed in August 2015. The earliest anticipated start date for awards under this FFO is expected to be September 1, 2015.

NIST strongly recommends that applicants do not wait until the last minute to submit an application. NIST will not make allowance for any late submissions. To avoid any potential processing backlogs due to last minute Grants.gov registrations, applicants are highly encouraged to begin their Grants.gov registration process early.

When developing your submission timeline, keep in mind that (1) a free annual registration process in the electronic System for Award Management (SAM) (see Section VI.4.b.) may take between three and five business days or as long as more than two weeks, and (2) applicants using Grants.gov will receive email notifications over a period of up to two business days as the application moves through intermediate systems before the applicant learns via a validation or rejection notification whether NIST has received the application.

5. Intergovernmental Review. Applications under this Program are not subject to Executive Order 12372.

6. Funding Restrictions. Profit or fee is not an allowable cost.

7. Other Submission Requirements

a. Applications must be submitted electronically. Electronic applications must be submitted via Grants.gov at www.grants.gov.

a. Applicants should carefully follow specific Grants.gov instructions to ensure that all attachments will be accepted by the Grants.gov system. A receipt from Grants.gov indicating an application is received does not provide information about whether attachments have been received. For further information or questions regarding applying electronically for the 2015-NIST-NSTIC-01 announcement, contact Christopher Hunton by phone at 301-975-5718 or by e-mail at christopher.hunton@nist.gov.

b. Applicants are strongly encouraged to start early and not wait until the approaching due date before logging on and reviewing the instructions for submitting an application through Grants.gov. The Grants.gov registration process must be completed before a new registrant can apply electronically. If all goes well, the registration process takes three (3) to five (5) business days. If problems are encountered, the registration process can take up to two (2) weeks or more. Applicants must have a Dun and Bradstreet Data Universal Numbering System (DUNS) number (see Section VI.4.b) and must maintain a current registration in the Federal government’s primary registrant database, the System for Award Management (https://www.sam.gov/), as explained on the Grants.gov Web site. After registering, it may take several days or longer from the initial log-on before a new Grants.gov system user can submit an application. Only authorized individual(s) will be able to submit the application, and the system may need time to process a submitted application. Applicants should save and print the proof of submission they receive from Grants.gov. If problems occur while using Grants.gov, the applicant is advised to (a) print any error message received and (b) call Grants.gov directly for immediate assistance. If calling from within the United States or from a U. S. territory, please call 800-518-4726. If calling from a place other than the United States or a U. S. territory, please call 606-545-5035. Assistance from the Grants.gov Help Desk will be available around the clock every day, with the exception of Federal holidays. Help Desk service will resume at 7:00 a.m. Eastern Time the day after Federal holidays. For assistance using Grants.gov, you may also contact support@grants.gov.

c. To find instructions on submitting an application on Grants.gov, Applicants should refer to the “Applicants” tab in the banner just below the top of the www.grants.gov home page. Clicking on the “Applicants” tab produces the “Grant Applicants” page.

mailto:christopher.hunton@nist.gov https://www.sam.gov/ mailto:support@grants.gov

In addition to following the “Steps” and instructions described in the “Applicant Actions” section and its sub-categories, further detailed…