2016-NIST-NSTIC-01 FFO.pdf

Friday, December 18, 2015

ANNOUNCEMENT OF FEDERAL FUNDING OPPORTUNITY (FFO)

National Strategy for Trusted Identities in Cyberspace (NSTIC)

State Pilots Cooperative Agreement Program

EXECUTIVE SUMMARY

Federal Agency Name: National Institute of Standards and Technology (NIST), United States Department of Commerce (DoC)

Funding Opportunity Title: National Strategy for Trusted Identities in Cyberspace (NSTIC) State Pilots Cooperative Agreement Program

Announcement Type: Initial

Funding Opportunity Number: 2016-NIST-NSTIC-01

Catalog of Federal Domestic Assistance (CFDA) Number: 11.619, Arrangements for Interdisciplinary Research Infrastructure

Dates: Abbreviated Applications must be received at Grants.gov no later than 11:59 p.m. Eastern Time, Thursday, February 18, 2016. Abbreviated Applications received after this deadline will not be reviewed or considered. Applicants should be aware, and factor in their application submission planning, that the Grants.gov system is expected to be closed for routine maintenance at these times: from 12:01 a.m. Eastern Time, Saturday, January 16, 2016 until Tuesday, January 19, 2016, at 6:00 a.m. Eastern Time; and from 12:01 a.m.

Eastern Time, Saturday, February 20, 2016 until Monday, February 22, 2016 at 6:00 a.m. Eastern Time; and from 12:01 a.m. Eastern Time, Saturday, April 16, 2016 until Monday, April 18, 2016 at 6:00 a.m. Eastern Time; and from 12:01 a.m. Eastern Time, Saturday, May 21, 2016 until Monday, May 23, 2016 at 6:00 a.m. Eastern Time. Applications cannot be submitted when Grants.gov is closed. NIST expects to complete its review of Abbreviated Applications and selection of finalists by Friday, March 25, 2016. Full Applications must be received electronically at Grants.gov no later than 11:59 p.m. Eastern Time, Wednesday, May 25, 2016. Full Applications received after this deadline will not be reviewed or considered. Full Applications received from applicants who were not invited to submit a Full Application will not be reviewed or considered. NIST expects to complete its review of Full Applications, selection of successful applicants, and award processing in August 2016. NIST expects the earliest anticipated start date for awards under this FFO to be September 1, 2016.

When developing your submission timeline, please keep in mind that (1) all applicants are required to have a current registration in the System for Award Management (SAM.gov); (2) the free annual registration process in the electronic

System for Award Management (SAM.gov) (see Section IV.3. and Section IV.7.a.(1).b. of this FFO) may take between three and five business days or as long as more than two weeks; and (3) electronic applicants are required to have a current registration in Grants.gov; and (4) applicants using Grants.gov will receive a series of e-mail messages over a period of up to two business days before learning whether a Federal agency’s electronic system has received its application. Please note that a federal assistance award cannot be issued if the designated recipient’s registration in the System for Award Management (SAM.gov) is not current at the time of the award.

Application Submission Address: Applications must be submitted using Grants.gov.

Funding Opportunity Description: NIST is soliciting applications from eligible applicants to pilot online identity solutions that embrace the Identity Ecosystem Steering Group’s (IDESG) Identity Ecosystem Framework (IDEF).1 Specifically, identity solutions must:

1. Enable online access to one or more state, local, or tribal government service(s).

2. Provide for a federated, verified digital identity that enables multi-factor authentication and an effective identity proofing process meeting the risk needs of the service(s).

3. Aligns with the Identity Ecosystem Framework Requirements.

4. Allow for interoperability with other federations in use in the public and private sectors.

NIST encourages pilots that maximize their contribution to the ongoing development and adoption of the Identity Ecosystem Framework, the OpenID Foundation iGov Working Group, and other public fora.

Anticipated Amounts: NIST anticipates funding up to four (4) awards; each award will be in the range of approximately $1,000,000 to $1,250,000 per year for up to three years, consistent with the multi-year funding policy described in Section II.2.

of this FFO. NIST will consider applications that propose lower funding amounts.

NIST anticipates funding new pilots with total FY2016 funding of up to approximately $4 million.

Funding Instrument: Cooperative agreement.

Who Is Eligible: All applicants must meet one of the following conditions to be eligible:

1 https://www.idesg.org/The-ID-Ecosystem/Identity-Ecosystem-Framework/IDEF-Core-Documents https://www.idesg.org/The-ID-Ecosystem/Identity-Ecosystem-Framework/IDEF-Core-Documents o State, local, or Indian tribal governments located in the United States and its territories, or o Commercial or nonprofit organizations or institutions of higher education located in the United States that have at least two state, local, or tribal government agencies representing two different governmental jurisdictions participating in the pilot through enabling online access to one or more state, local, or tribal government service(s).

Federal agencies may participate in projects but may not receive NIST funding.

Cost Sharing Requirements: This program does not require cost sharing.

Public Meetings (Applicants’ Conference): NIST will hold a webinar (Applicants’ Conference) to provide general information regarding the NSTIC, to offer general guidance on preparing applications, and to answer questions. Proprietary technical discussions about specific project ideas with NIST staff are not permitted at this conference or at any time before submitting an application to NIST. Therefore, applicants should not expect to have proprietary issues addressed at the Applicants’ Conference. Also, NIST/NSTIC Program Office staff will not critique or provide feedback on specific project ideas while they are being developed by an applicant. However, NIST/NSTIC Program Office staff will answer questions about the National Strategy for Trusted Identities in Cyberspace (NSTIC) State Pilots Cooperative Agreement Program (NSTIC State Pilots Cooperative Agreement Program) eligibility requirements, evaluation and award criteria, selection process, and the general characteristics of a competitive application at the Applicants’ Conference and by phone and email. Attendance at the Applicants’ Conference is not required. Information on the Applicants’ Conference is available at http://www.nist.gov/nstic/funding-opportunities.html.

Table of Contents

I. Program Description

II. Federal Award Information

III. Eligibility Information

IV. Application Submission Information

V. Application Review Information

VI. Federal Award Administration Information

VII. Federal Awarding Agency Contact(s)

VIII. Other Information http://www.nist.gov/nstic/funding-opportunities.html

FULL ANNOUNCEMENT TEXT

I. Program Description

The statutory authority for the National Strategy for Trusted Identities in Cyberspace (NSTIC) State Pilots Cooperative Agreement Program is 15 U.S.C. §§ 272(b)(1), (b)(4), (c)(12), and (c)(14).

In April 2011, President Obama signed the National Strategy for Trusted Identities in Cyberspace (NSTIC or Strategy), which charts a course for the public and private sectors to collaborate to raise the level of trust associated with the identities of individuals, organizations, networks, services, and devices involved in online transactions. The Strategy can be found at:

http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf.

The Strategy envisions a user-centric Identity Ecosystem, defined as "an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities—and the digital identities of devices.”2

NSTIC specifies four guiding principles to which the Identity Ecosystem must adhere:

1. Identity solutions will be privacy-enhancing and voluntary;

2. Identity solutions will be secure and resilient;

3. Identity solutions will be interoperable; and

4. Identity solutions will be cost-effective and easy to use.

The Strategy will only be a success – and the ideal of the Identity Ecosystem will only be achieved – if identity solutions fulfill all of these guiding principles. Achieving them separately will not only lead to an inadequate solution but could serve as a hindrance to the broader evolution of cyberspace.

The Strategy emphasizes that some parts of the Identity Ecosystem exist today but recognizes that there is still much work to be done. NIST has established a National Program Office (NPO) to lead the implementation of NSTIC, with a focus on promoting private sector involvement and engagement; supporting interagency collaboration and coordinating interagency efforts associated with achieving programmatic goals;

building consensus on policy frameworks necessary to achieve the vision; identifying areas for the government to lead by example in developing and supporting the Identity Ecosystem, particularly in the Executive Branch’s role as a provider and validator of key credentials and attributes; actively participating within and across relevant public-

2 National Strategy for Trusted Identities in Cyberspace at http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf, p. 2 http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf and private-sector forums; and assessing progress against the goals, objectives, and milestones of the NSTIC.

More information about the NSTIC NPO is available at http://www.nist.gov/nstic/.

NIST Funded Projects Advancing the NSTIC Strategy

In implementing the Strategy, the NSTIC NPO seeks to build upon the existing marketplace, encourage new solutions, and establish a baseline of privacy, security, interoperability, and ease-of-use of trusted digital identity credentials that will improve trust in online transactions while enabling the market in online credentials to flourish.

NIST began funding pilot projects under the NSTIC Pilots Cooperative Agreement Program in 2012 and has made awards for pilot projects in each of the subsequent years. Descriptions of the pilot projects funded in the past are available on the NSTIC website at http://www.nist.gov/nstic/pilot-projects.html. As the role of online identity evolves, the NSTIC NPO is transitioning the Pilots Cooperative Agreement Program to fill more critical gaps in the Identity Ecosystem; for example, the NPO released a solicitation in 2015 specifically focused on advancing privacy-enhancing technologies, the first NPO effort to dedicate funding to a single aspect of identity solutions. The current funding opportunity continues this transition as the NSTIC NPO seeks to target specific impediments to the market through a more diverse set of opportunities.

To further advance the development of the Identity Ecosystem Framework and to build on the existing marketplace in online credentials, NIST has provided financial assistance to the Identity Ecosystem Steering Group (IDESG). The IDESG is the only private sector organization currently committed to managing the development of the Identity Ecosystem Framework. More information on the IDESG is available at http://www.idecosystem.org.

State Pilots Program Focus Area: Digitally Delivering Trustworthy Constituent Services

The purpose of the NSTIC State Pilots Cooperative Agreement Program is to pilot online identity solutions that embrace and advance the NSTIC vision of an Identity Ecosystem. Specifically, identity solutions must:

1. Enable online access to one or more state, local, or tribal government service(s).

2. Provide for a federated, verified identity that enables multi-factor authentication and an effective identity proofing process meeting the risk needs of the service(s).

3. Align with the Identity Ecosystem Framework Requirements.

4. Allow for interoperability with other federations in use in the public and private sectors.

http://www.nist.gov/nstic/ http://www.nist.gov/nstic/pilot-projects.html http://www.idecosystem.org/

Pilots are encouraged to maximize their contribution to the ongoing development and adoption of the Identity Ecosystem Framework, the OpenID Foundation iGov Working Group, and other public fora.

NIST will fund projects that will introduce innovative solutions that would otherwise not occur in the marketplace, for instance, projects that will deploy pilots to test or demonstrate new solutions that are not widely adopted today. The NSTIC NPO defines pilots as systems deployed in production environments that include real users conducting real transactions with real data. The pilot system may be segregated legally or technically from the operations of a full production system.

The NSTIC NPO envisions the pilots as key contributors to the ongoing development of the Identity Ecosystem Framework. The NSTIC pilots provide examples of real world achievements addressing identity-related challenges.

Many past efforts to enable the use of strong online credentials for access to government services have encountered a number of barriers, including:

1. Concerns about applicant and beneficiary privacy, including risks that arise from the crossing of contextual boundaries (e.g., risks to privacy created by entities in different sectors linking individuals’ transactions) and the capacity for more tracking and profiling of individuals.

2. Difficulties conducting effective identity proofing and ensuring that selected identity proofing approaches cover the full beneficiary population.

3. Concerns that the identity management process may place additional burdens on the target audience and increase barriers to accessing state services.

4. Lack of implementation of alternative identity proofing methods beyond those that rely solely on knowledge-based schemes.

5. Balancing transparency to individual users and ease-of-use especially of strong authentication technologies.

Specifically, the NSTIC NPO is interested in funding projects with innovative approaches that overcome these barriers and advance NSTIC’s four guiding principles.

Because these barriers work in concert with each other, the NSTIC NPO anticipates that the best projects will address most or all of them. By doing so, the projects can provide a foundation for improving identity verification for, and increasing the efficiency of, government services.

Priority will be given to projects that demonstrate the potential for interoperability of identity credentials issued in partnership with a private provider with both state and Federal programs. The goal is to encourage partnerships between private sector providers and governments at all levels.

While the solutions may be vendor-supplied proprietary solutions, NIST requires that the solutions be interoperable within the Identity Ecosystem and not preclude integration with other public or private sector federations. The pilots must demonstrate that the approach could be replicated across multiple agencies, programs, and jurisdictions.

To further demonstrate the benefits of the solutions to both the government agencies involved and the individual users, NIST will be contracting for an independent evaluation of projects funded under this program for the efficacy of the approach in facilitating constituent access to government programs and services.

Project participants (the project lead, contractors, subawardees and other collaborators) must demonstrate that they have the education, experience, and training to pursue and advance implementation of the NSTIC. Project participants should demonstrate the strength of the partnership and highlight any prior collaborations among the participants.

II. Federal Award Information

1. Funding Instrument. The funding instrument that will be used is a cooperative agreement. The nature of NIST’s “substantial involvement” is described in Chapter 5.C of the Department of Commerce (DoC) Grants and Cooperative Agreements Manual, which is available at http://go.usa.gov/SNJd. Please note the Department of Commerce Grants and Cooperative Agreements Manual is expected to be updated after publication of this funding announcement and before awards are made under this FFO. Refer to Section VII. of this FFO, Federal Awarding Agency Contacts, Grant Rules and Regulations, if you seek the information at this link and it is no longer working or you need more information.

2. Multi-Year Funding Policy. When an application for a multi-year award is approved, funding will usually be provided for only the first year of the project. If a project is selected for funding, NIST has no obligation to provide any additional funding for that award beyond the initial obligation. Continuation of an award to increase funding or extend the period of performance is at the sole discretion of NIST. Continued funding will be contingent upon satisfactory performance, continued relevance to the mission and priorities of NIST, and the availability of funds.

3. Funding Availability. NIST anticipates funding up to four (4) awards; each award will be in the range of approximately $1,000,000 to $1,250,000 per year per project for up to three years, consistent with the multi-year funding policy described in Section II.2. of this FFO. Proposed funding levels must be consistent with project scope. NIST will consider applications that propose lower funding amounts. NIST http://go.usa.gov/SNJd anticipates funding new pilots with total FY2016 funding of up to approximately $4 million.

III. Eligibility Information

1. Eligible Applicants. All applicants must meet one of the following conditions to be eligible:

State, local, or Indian tribal governments located in the United States and its territories, or

Commercial or nonprofit organizations or universities located in the United States that have at least two state, local or tribal government agencies from two different governmental jurisdictions participating in the pilot.

Federal agencies may participate in projects but may not receive NIST funding.

2. Cost Sharing or Matching. This program does not require cost sharing.

IV. Application Submission Information

1. Address to Request Application Package. The application package for the Abbreviated Application is available at www.grants.gov under Funding Opportunity Number 2016-NIST-NSTIC-01. The instructions for retrieving the Full Application package from the Grants.gov website will be sent only to those invited to submit Full Applications.

2. Content and Format of Application Submission

a. Required Abbreviated Application Form and Documents

As described in Section IV.2.b., NIST requires Abbreviated Applications under the NSTIC State Pilots Cooperative Agreement Program, and the Selecting Official will select finalists from among the Abbreviated Applications. Only those applicants whose Abbreviated Applications are selected as finalists will be invited to submit Full Applications.

The Abbreviated Applications must be received electronically at Grants.gov in order to be considered for funding. The Abbreviated Application must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the applicant organization.

SF-424, Item 12, must list the FFO number 2016-NIST-NSTIC-01.

http://www.grants.gov/

SF-424, Item 18, should list the total Federal budget amount requested for the entire project.

For SF-424, Item 21, the list of certifications and assurances is contained in the

SF-424B.

(2) Abbreviated Proposal. Maximum four (4) page document describing the proposed project that includes sufficient information to determine that the project is within the scope of this funding opportunity and explains how the identity solution will:

a. Provide for a federated, verified identity that enables multi-factor authentication that meets the risk needs of the service(s);

b. Provide for an effective identity proofing process that meets the risk needs of the service(s);

c. Show alignment to the Identity Ecosystem Framework requirements;

d. Enable online access to at least two state, local, or tribal government services; and

e. Allow for interoperability with other federations in use in the public and private sectors.

(3) For applications led by non-governmental entities, Letters of Interest. To demonstrate that the required two state, local or tribal governmental entities are involved in the project, the applicant must attach letters of interest from each entity interested in participating in the project.

Item IV.2.a.(1) above is part of the standard application package in Grants.gov and can be completed through the download application process. Items IV.2.a.(2) and IV.2.a.(3) must be completed and attached by clicking on the “Add Attachments” button found in Item 15 of the SF-424. This will create a zip file that allows for transmittal of the documents electronically via Grants.gov.

Applicants should carefully follow specific Grants.gov instructions at www.grants.gov to ensure the attachments will be accepted by the Grants.gov system. A receipt from Grants.gov does not provide details concerning whether all attachments (or how many attachments) transferred successfully. Applicants will receive a series of e-mail messages over a period of up to two business days before learning whether a Federal agency’s electronic system has received its application.

b. Required Full Application Forms and Documents

Only applicants whose Abbreviated Applications have been selected by NIST as “finalists” and who have been invited to submit a Full Application are permitted to submit Full Applications to NIST for the NSTIC State Pilots Cooperative Agreement Program. NIST will not review Full Applications submitted by applicants who have not been selected as finalists or those submitted by applicants who did not submit an Abbreviated Application. The Full Application must contain the following:

(1) SF-424, Application for Federal Assistance. The SF-424 must be signed by an authorized representative of the applicant organization.

SF-424, Item 12, should list the FFO number provided in the special application instructions.

SF-424, Item 18, should list the total Federal budget amount requested for the entire project.

For SF-424, Item 21, the list of certifications and assurances is contained in the SF-424B.

(2) SF-424A, Budget Information - Non-Construction Programs. The budget should reflect anticipated expenses for each year of the project of no more than three years, considering all potential cost increases, including cost of living adjustments.

(3) SF-424B, Assurances - Non-Construction Programs

(4) CD-511, Certification Regarding Lobbying

(5) SF-LLL, Disclosure of Lobbying Activities (if applicable)

(6) Technical Proposal. The Technical Proposal is a document of no more than twenty-five (25) pages responsive to the program description (see Section I. of this FFO) and the evaluation criteria (see Section V.1. of this FFO). Applicants should include in their proposal a clear statement whether it is addressing all barriers to the emerging identity ecosystem, detailing how it will address those barriers, and providing clear, measurable performance objectives that can be used to determine the success of the proposed pilot project. If any barriers are not addressed, explain why addressing that specific barrier is not necessary to the pilot. Examples of clear, measurable success metrics include the expected number of users per pilot, false acceptance rates, false rejection rates, etc. The Technical Proposal should contain the following information:

(a) Executive Summary. An executive summary of the proposed project, including referencing the barriers to the Identity Ecosystem addressed, the use cases to be piloted, and the identity solution. If the application does not address all barriers from Section I, the applicant should explain why the omitted barriers are not applicable to the pilot. The executive summary should include information indicating how each evaluation criterion and its sub-factors are addressed. A table may be helpful in providing this information.

(b) Problem Statement and Use Cases. A problem statement that discusses the specific use cases to be piloted including the specific benefit programs and characteristics of the beneficiary populations, including the size. The applicant should clearly state the solution that this project would introduce to the marketplace and what would otherwise occur without the project. The applicant must provide a justification for why the problem(s) is (are) impeding the emergence of the Identity Ecosystem. This section should also provide information on any special characteristics of the benefit program including any waivers needed such as a waiver from a Federal program office allowing a state administered program to collect date of birth information from an applicant. The application should explain why those use cases were chosen. This section provides critical background for the discussion of the proposed operational pilot.

(c) Technical Architecture. A description of the technical architecture for the proposed operational pilot, sufficient to permit evaluation of the proposal in accordance with the evaluation criteria (see Section V.1. of this FFO). This should include information on all the components of the solution(s), how these components interconnect, and what information is exchanged among the components. An architecture diagram and data flow diagrams including data flows among project participants can be used to present this information and will not be counted within the page limit. The applicant should provide information on what needs to be done to initiate the pilot, complete the pilot, and evaluate the pilot including the number of beneficiaries, and the percentage this represents of the total potential beneficiary population, required to make the pilot successful. A mapping to the IDESG’s Identity Ecosystem Framework requirements (see http://www.idesg.org/IdentityRevolution) will help in the evaluation.

The solution description, including any architecture and data flow diagrams, should make clear how the solution mitigates privacy and civil liberties risks arising from the capability for greater identification, tracking or linkability of transactions, and personal data aggregation. Privacy and civil liberties protections may be enforced by either (or both) technical and policy means; however, technical means for mitigating privacy risks are preferable to policy mitigations. This section should explain how the technical and policy measures are applied in a risk-based approach to address privacy concerns - for example, NIST’s privacy risk model as documented in Privacy Risk Management for Federal Information http://www.idesg.org/IdentityRevolution

Systems, NISTIR 8062 (DRAFT) (http://csrc.nist.gov/projects/privacy_engineering/documents.html).

This section should address the Quality of the Proposed Technical Solution evaluation criterion (see Section V.2.a. of this FFO).

(d) Statement of Work and Implementation Plan. A complete statement of work covering all project participants including relying parties that includes the following:

Measurable performance objectives used to determine the success of the pilot project along with the required metrics to indicate success;

Specific proposed tasks;

Schedule of measurable events and realistic, measurable milestones including any state budget authorization actions required and Federal waivers required;

The project leadership’s plans to manage all project participants, including sub-recipients, contractors, etc., to ensure realization of project goals and objectives; and

Approach to ensure the project results will align to the IDESG’s IDEF.

All aspects discussed as part of the solution should be included in the implementation plan and have associated milestones with performance metrics specified. For example, milestones and metrics could include the dates of go-lives, the target number of users per pilot phase, and the maximum false accept rates. The schedule of tasks and events can be presented as a Gantt chart, work breakdown structure (WBS) or other formats. (Note that the Gantt chart, WBS, or other, similar planning documents are not counted within the page limit.)

This section should address the Quality of the Implementation Plan evaluation criterion (see Section V.1.b. of this FFO).

(e) Project Impact. A description of the plans to scale the pilot project into full production and self-sustaining, large scale use. This section should also describe the project participants’ planned role(s) in organizations developing the Identity Ecosystem Framework as envisioned in the NSTIC Strategy (e.g., the committees and working groups of the IDESG).

Include also any planned efforts to disseminate information and reach out to users. This section should address the Contribution to the Identity Ecosystem evaluation criterion (see Section V.1.c. of this FFO).

(f) Qualifications. A description of the qualifications, proposed roles, and level of planned effort of the project participants, including the proposed role of the project lead and of each subwardee, contractor or other collaborator, including the state, local or tribal governments participating in the project. Include past experience collaborating, if applicable.

http://csrc.nist.gov/projects/privacy_engineering/documents.html

All participating organizations are expected to identify at least one key person and that person’s time commitment to the project. It is anticipated that all key personnel will participate in biweekly project status discussions with the NPO. The key personnel should include the following:

At least one individual from each participant, with details of committed participation. It may be that multiple individuals are needed to represent all stakeholders within a participant (for example, individuals representing the relevant state IT organization and state program providing the service would likely both be needed).

A project manager or project leader with demonstrated experience leading projects of similar size and complexity and previously demonstrated ability to achieve positive outcomes in pilot programs and similar endeavors.

At least one privacy engineer with specialized knowledge of both privacy technology and policy issues is expected on all projects.

This individual(s) will be considered key to the project and shall ideally have at least 5-7 years’ experience in a cross-set of privacy and information technology skills. This individual may be an employee of the applicant, or he or she may be a consultant or employee of a contractor or subawardee. Although less preferable, this role could be filled by multiple individuals with complementary skillsets and experience. Experience may be demonstrated by education, certifications, and job skills. Qualifications for the privacy skillset could include certifications such as CIPT or CIPM and experience implementing privacy principles such as the Fair Information Practice Principles, identifying and mitigating privacy risks in the implementation of information technology systems.

Qualifications for the technical skillset could include advanced degrees in computer science, information science, or computer engineering and experience with architectural design for information systems; data, systems, or software engineering; and related aspects of technical privacy implementations. If multiple individuals are used to meet this qualification, the applicant must include a description of how the multiple individuals will work together to compensate for the lack of the combined skillset in a single individual.

At least one subject matter expert in addressing usability of the type of system envisioned for the project and the beneficiary population.

Resumes of all key personnel including the privacy engineer(s), usability expert(s), and project manager(s) are required and are not included in the page count. Resumes are to be a maximum of two (2) pages each.

This section, the budget narrative, letters of commitment and the resumes should address the Resource Availability evaluation criterion (see Section V.1.d. of this FFO).

(7) Budget Narrative. The Budget Narrative should provide a detailed breakdown of each of the object class categories as reflected on the SF-424A. The budget justification should address all of the budget categories (personnel, fringe benefits, equipment, travel, supplies, other direct costs and indirect costs). The written justification should include the necessity and the basis for the cost.

Proposed funding levels must be consistent with the project scope, and only allowable costs should be included in the budget. Information on cost allowability is available in the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards at 2 C.F.R. Part 200 (http://go.usa.gov/SBYh), which apply to awards in this program. Information needed for each category is as follows:

(a) Personnel – At a minimum, the budget justification for all personnel should include the following: name, job title, commitment of effort on the proposed project in terms of average number of hours per week or percentage of time, salary rate, total direct charges on the proposed project, description of the role of the individual on the proposed project and the work to be performed. Applicants can include in the budget the time to participate in forums (such as committees of the IDESG) developing elements of the Identity Ecosystem Framework as envisioned in the NSTIC strategy. The cost of the time required to prepare presentations to report on the progress of the project to the IDESG should also be included in this category.

(b) Fringe Benefits – Fringe benefits should be identified separately from salaries and wages and based on rates determined by organizational policy. The items included in the fringe benefit rate (e.g., health insurance, parking, etc.) should not be charged under another cost category.

(c) Equipment – Equipment is defined as an item of property that has an acquisition cost of $5,000 or more (unless the organization has established lower levels) and an expected service life of more than one year. Any items that do not meet the threshold for equipment can be included under the supplies line item. The budget justification should list each piece of equipment, the cost, and a description of how it will be used and why it is necessary to the successful completion of the proposed project. Please note that any general use equipment http://go.usa.gov/SBYh

(computers, etc.) charged directly to the award should be allocated to the award according to expected usage on the project.

(d) Travel – NIST will require that award recipients report on their projects twice a year to the Identity Ecosystem Steering Group (http://www.idecosystem.org/). Therefore, applicants should include travel costs for at least two meetings of the IDESG per year and may include costs for up to four IDESG meetings per year in their budget narrative. For travel costs associated with travel to these meetings, and additional travel required by the recipient to complete the project, the budget justification for travel should include the following: destination;

names/number of people traveling; dates and/or duration; mode of transportation, lodging and subsistence rates; and description of how the travel is directly related to the proposed project. For travel that is yet to be determined, please provide best estimates based on prior experience.

If a destination is not known, an approximate amount may be used with the assumptions given for the location of the meeting.

(e) Supplies – Provide a list of each supply, and the breakdown of the total costs by quantity or unit of cost. Include the necessity of the cost for the completion of the proposed project.

(f) Contracts/Subawards – Each contract or subaward should be treated as a separate item. Describe the services provided and the necessity of the subaward or contract to the successful performance of the proposed project. Contracts are for obtaining normal goods and services.

Subawardees perform part of the project scope of work. For each subaward, applicants must provide budget detail justifying the cost of the work performed on the project.

(g) Other Direct Costs – For costs that do not easily fit into the other cost categories, please list the cost, and the breakdown of the total costs by quantity or unit of cost. Include the necessity of the cost for the completion of the proposed project. Only allowable costs can be charged to the award.

(8) Indirect Cost Rate Agreement. If indirect costs are included in the proposed budget, provide a copy of the approved negotiated agreement if this rate was negotiated with a cognizant Federal audit agency. If the rate was not established by a cognizant Federal audit agency, provide a statement to this effect. If the successful applicant includes indirect costs in the budget and has not established an indirect cost rate with a cognizant Federal audit agency, the applicant will be required to obtain such a rate in accordance with the Department of Commerce Financial Assistance Standard Terms and Conditions (http://go.usa.gov/hKbj).

http://www.idecosystem.org/ http://go.usa.gov/hKbj

Alternatively, in accordance with 2 C.F.R. § 200.414(f), applicants that have never received a negotiated indirect cost rate may elect to charge indirect costs to an award pursuant to a de minimis rate of 10 percent of modified total direct costs (MTDC), in which case a negotiated indirect cost rate agreement is not required. Applicants proposing a 10 percent de minimis rate pursuant to 2 C.F.R. § 200.414(f) should note this election as part of the budget and budget narrative portion of the application.

(9) Letters of Commitment or Interest. Letters are not included in the page count.

(a) Letters of Commitment to participate. If the project is not led by a state, local, or tribal government agency, letters of commitment are required from at least two state, local, or tribal government agencies from two different governmental jurisdictions.

If the application identifies other third parties including contractors, subawardees, and/or other collaborators, who will participate in the proposed project, then the applicant must provide a letter from each currently known participant describing its participation. Each letter should indicate the organization’s willingness to participate, what they will be doing for the project, and the level of organizational commitment to the project. A letter is required whether or not the organization is receiving Federal funds. Note that the letters of commitment are part of the material addressing Resource Availability evaluation criterion (see Section V.1.d of this FFO).

(b) Letters of Interest, optional. Letters of interest may be provided from parties who might become customers for the solutions discussed in the proposed project.

(10) Resumes of Key Personnel including Privacy Experts. Resumes of all key personnel including the project’s privacy expert(s), usability expert(s), and project manager are required. These resumes are to be a maximum of two (2) pages each. Note that the resumes are part of the material addressing Resource Availability evaluation criterion (see Section V.1.d. of this FFO).

(11) Data Management Plan. In accordance with the Office of Science and Technology Memorandum for the Heads of Executive Departments and Agencies of February 22, 20133, Increasing Access to the Results of Federally Funded Scientific Research, and as implemented through NIST Policy 5700.004, Managing Public Access to Results of Federally Funded

3 https://www.whitehouse.gov/sites/default/files/microsites/ostp/ostp_public_access_memo_2013.pdf 4 http://www.nist.gov/open/upload/Final-P-5700.pdf https://www.whitehouse.gov/sites/default/files/microsites/ostp/ostp_public_access_memo_2013.pdf http://www.nist.gov/open/upload/Final-P-5700.pdf

Research, and NIST Order 5701.005, Managing Public Access to Results of Federally Funded Research”, applicants should include a Data Management Plan (DMP).

The DMP is a supplementary document of not more than two (2) pages that must include, at a minimum, a summary of proposed activities that are expected to generate data, a summary of the types of data expected to be generated by the identified activities, a plan for storage and maintenance of the data expected to be generated by the identified activities, and a plan describing whether and how data generated by the identified activities will be reviewed and made available to the public. As long as the DMP meets these NIST requirements, it may take the form specified by the applicant’s institution or some other entity (e.g., the National Science Foundation6 or the National Institutes of Health7). Some organizations’ templates are available on the Internet8.

All applications for activities that will generate scientific data using NIST funding are required to adhere to a DMP or explain why data sharing and/or preservation are not within the scope of the project.

For the purposes of the DMP, NIST adopted the definition of “research data” at 2 C.F.R. § 200.315(e)(3) (available at http://go.usa.gov/3sZvQ).

Reasonable costs for data preservation and access may be included in the application.

The sufficiency of the DMP will be considered as part of the administrative review (see Section V.4.a. of this FFO); however, the DMP will not be evaluated against any evaluation criteria.

Items IV.2.b.(1) through IV.2.b.(5) above are part of the standard application package in Grants.gov and can be completed through the download application process. Items IV.2.b.(6) through IV.2.b.(11) must be completed and attached by clicking on “Add Attachments” found in item 15 of the SF-424, Application for Federal Assistance. This will create a zip file that allows for transmittal of the documents electronically via Grants.gov.

Applicants should carefully follow specific Grants.gov instructions at www.grants.gov to ensure the attachments will be accepted by the Grants.gov system. A receipt from Grants.gov indicates only that an application was transferred to a system. It does not provide details concerning whether all

5 http://www.nist.gov/open/upload/Final-O-5701_0.pdf 6 http://www.nsf.gov/bfa/dias/policy/dmp.jsp 7 http://grants.nih.gov/grants/policy/data_sharing/data_sharing_guidance.htm 8 https://www.cic.net/projects/technology/shared-storage-services/data-management-plans http://go.usa.gov/3sZvQ http://www.grants.gov/ http://www.nist.gov/open/upload/Final-O-5701_0.pdf http://www.nsf.gov/bfa/dias/policy/dmp.jsp http://grants.nih.gov/grants/policy/data_sharing/data_sharing_guidance.htm https://www.cic.net/projects/technology/shared-storage-services/data-management-plans attachments (or how many attachments) transferred successfully. Applicants using Grants.gov will receive a series of e-mail messages over a period of up to two business days before learning whether a Federal agency’s electronic system has received its application.

The Grants.gov Online Users Guide available at the Grants.gov site

(http://go.usa.gov/cjaEh) provides vital information on checking the status of applications. See especially the “Check My Application Status” option, found by clicking first on Applicants, and then by clicking on Applicant Actions.

Applicants can track their submission in the Grants.gov system by following the procedures at the Grants.gov site (http://go.usa.gov/cjamz). It can take up to two business days for an application to fully move through the Grants.gov system to NIST.

Checking the application status and tracking the submission are useful tools in the Abbreviated Application stage as well as in the Full Application stage.

NIST uses the Tracking Numbers assigned by Grants.gov, and does not issue

Agency Tracking Numbers.

c. Application Format

Note that these formatting requirements apply to both Abbreviated and Full Applications. Where there are differences, such differences are noted.

(1) Paper, E-mail and Facsimile (fax) Submissions. Will not be accepted.

(2) Figures, Graphs, Images, and Pictures. Should be of a size that is easily readable or viewable and may be landscape orientation.

(3) Font. Easy to read font (10-point minimum). Smaller type may be used in figures and tables but must be clearly legible.

(4) Page Limit. The Abbreviated Proposal for Abbreviated Applications is limited to four (4) pages, and the Technical Proposal for Full Applications is limited to twenty-five (25) pages.

(a) For Abbreviated Applications:

Page limit includes: Abbreviated Proposal addressing the criteria. This includes any figures, graphs, tables, images, and pictures.

Page limit excludes: SF-424, Application for Federal Assistance, Letters of Interest http://go.usa.gov/cjaEh http://go.usa.gov/cjamz

(b) For Full Applications:

Page limit includes: Table of contents (if included), Technical Proposal with all required information, including management information and qualifications, figures, graphs, tables, images, and pictures.

Page limit excludes: SF-424, Application for Federal Assistance; SF- 424A, Budget Information – Non-Construction Programs; SF-424B, Assurances – Non-Construction Programs; SF-LLL, Disclosure of Lobbying Activities; CD-511, Certification Regarding Lobbying; Cover Page; Gantt Chart, WBS, or other planning document (if included);

Architecture and data flow diagrams (if included); detailed analysis of the privacy risks of the solution (e.g., an analysis against NIST’s privacy risk model (see http://csrc.nist.gov/projects/privacy_engineering/documents.html); Budget Narrative; Indirect Cost Rate Agreement; Letters of Commitment or Interest; Resumes of Key Personnel including Privacy Experts; and Data Management Plan.

(5) Page size. 21.6 centimeters by 27.9 centimeters (8 ½ inches by 11 inches).

(6) Application language. English.

d. Application Replacement Pages. Applicants may not submit replacement pages and/or missing documents once an application has been submitted. Any revisions must be made by submission of a new application that must be received by NIST by the submission deadline.

e. Pre-Applications. NIST requires Abbreviated Applications under the NSTIC State Pilots Cooperative Agreement Program (see Section IV.2.a. of this FFO). The Selection Official will select from among the Abbreviated Applications a group of finalists to submit Full Applications.

f. Certifications Regarding Federal Felony and Federal Criminal Tax

Convictions, Unpaid Federal Tax Assessments and Delinquent Federal Tax Returns. In accordance with Federal appropriations law, an authorized representative of the selected applicant(s) may be required to provide certain pre-award certifications regarding federal felony and federal criminal tax convictions, unpaid federal tax assessments, and delinquent federal tax returns.

3. Unique Entity Identifier and System for Award Management (SAM). Pursuant to 2 C.F.R. part 25, applicants and recipients (as the case may be) are required to:

(i) be registered in SAM before submitting its application; (ii) provide a valid unique entity identifier in its application; and (iii) continue to maintain an active SAM registration with current information at all times during which it has an active Federal award or an application or plan under consideration by a Federal awarding http://csrc.nist.gov/projects/privacy_engineering/documents.html agency, unless otherwise excepted from these requirements pursuant to 2 C.F.R. §

25.110. NIST will not make a Federal award to an applicant until the applicant has complied with all applicable unique entity identifier and SAM requirements and, if an applicant has not fully complied with the requirements by the time that NIST is ready to make a Federal award pursuant to this FFO, NIST may determine that the applicant is not qualified to receive a Federal award and use that determination as a basis for making a Federal award to another applicant.

4. Submission Dates and Times. Abbreviated Applications must be received at Grants.gov no later than 11:59 p.m. Eastern Time, Thursday, February 18, 2016.

Abbreviated Applications received after this deadline will not be reviewed or considered. Applicants should be aware, and factor in their application submission planning, that the Grants.gov system is expected to be closed for routine maintenance at these times: from 12:01 a.m. Eastern Time, Saturday, January 16, 2016 until Tuesday, January 19, 2016, at 6:00 a.m. Eastern Time;

and from 12:01 a.m. Eastern Time, Saturday, February 20, 2016 until Monday, February 22, 2016 at 6:00 a.m. Eastern Time; and from 12:01 a.m. Eastern Time, Saturday, April 16, 2016 until Monday, April 18, 2016 at 6:00 a.m.

Eastern Time; and from 12:01 a.m. Eastern Time, Saturday, May 21, 2016 until Monday, May 23, 2016 at 6:00 a.m. Eastern Time. Applications cannot be submitted when Grants.gov is closed. Review of Abbreviated Applications and selection of finalists is expected to be completed by Friday, March 25, 2016. Full Applications must be received electronically at Grants.gov no later than 11:59 p.m.

Eastern Time, Wednesday, May 25, 2016. Full Applications received after this deadline will not be reviewed or considered. Full Applications received from applicants who were not invited to submit a Full Application will not be reviewed or considered. Review of Full Applications, selection of successful applicants, and award processing is expected to be completed in August 2016. The earliest anticipated start date for awards under this FFO is expected to be September 1, 2016.

When developing your submission timeline, please keep in mind that (1) all…