DHS FY2023 NOFO SLTT SOC_ISAC__Revised 6.21.23.pdf

FY 2023 NOFO SLTT SOC_ISAC

The Department of Homeland Security (DHS)

Notice of Funding Opportunity (NOFO) State, Local, Tribal and Territorial

Security Operations Center | Information Sharing and Analysis Center

All entities wishing to do business with the federal government must have a unique entity identifier (UEI). The UEI number is issued by the SAM system. Sam.gov information can be found at: https://sam.gov/content/entity-registration.

Grants.gov registration information can be found at:

https://www.grants.gov/web/grants/register.html.

Planned UEI Updates in Grant Application Forms

On April 4, 2022, the Data Universal Numbering System (DUNS) Number was replaced by a new, non-proprietary identifier requested in, and assigned by, the System for Award Management (SAM.gov). This new identifier is the Unique Entity Identifier (UEI).

Additional Information can be found on Grants.gov:

https://www.grants.gov/web/grants/forms/planned-uei-updates.html

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), Cybersecurity Division (CSD)

2. Assistance Listings Number

97.123

3. Assistance Listings Title State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) | Information Sharing and Analysis Center (ISAC)

4. Funding Opportunity Title State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) | Information Sharing and Analysis Center (ISAC)

5. Funding Opportunity Number

DHS-23-CISA-123-ISAC000001

https://sam.gov/content/entity-registration https://www.grants.gov/web/grants/register.html https://www.grants.gov/web/grants/forms/planned-uei-updates.html

6. Authorizing Authority for Program

Homeland Security Act of 2002, Pub. L. No. 107-296, § 102(b)(2) (codified as amended at 6 U.S.C. § 112(b)(2))

7. Appropriation Authority for Program

Consolidated Appropriations Act, 2023, Pub. L. No. 117-328, Division F – Department of Homeland Security Appropriations Act, 2023, Title III – Protection, Preparedness, Response, and Recovery, Cybersecurity and Infrastructure Security Agency

8. Announcement Type Initial (Year 1 of 2)

9. Program Overview, Objectives, and Priorities

Overview: Pulling together critical infrastructure communities is essential to the protection of critical infrastructure and to furthering cybersecurity for the nation.

This program addresses the DHS mission to Secure Cyberspace and Critical Infrastructure, as defined in the U.S. Department of Homeland Security Strategic Plan

– Fiscal Years 2020-2024, providing a funding methodology to support the state, local, tribal and territorial (SLTT) government, to include Elections, cyber ecosystem through capacity building and cyber threat information sharing among the nationwide trusted community of members. This program leverages the strength of market technology forces to spur innovative strategies within the Security and Operations Center (SOC) to enable a cyber-relevant Information Sharing and Analysis Center (ISAC) operating model that is consistent with section 2209 of the Homeland Security Act, Executive Order 13636, Executive Order 13691, and Presidential Decision Directive-63 (PDD-63). Specifically, section 2209(d)(1)(E) of the Homeland Security Act of 2002 requires the composition of the statutory national cybersecurity and communications center—a function now carried out by CISA’s Cybersecurity Division—to include “an entity that collaborates with State and local governments on cybersecurity risks and incidents”. This ISAC program convenes effective tools, managed services, analytic resources, and technology platforms for maintaining trust and collaboration across a coalition of SLTT and Elections members. It links the community to a nationwide cross domain threat information sharing capability, which enhances situational awareness and provides security readiness to face current threats in the digital battlefront. The short-term impact of services will allow SLTT and its subsector stakeholders to consume and exchange awareness of threats via technologies that serve to derive a more accurate and timelier picture of prioritized cyber defense actions.

Recognizing that DHS has complementary resources to support the ability of the SLTT sector (including critical sub-sectors such as Elections) to share cyber threat information, CISA is expanding its operational coordination with the ISAC in order to provide Federal level enrichment of cyber threats within the threat intelligence https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 platform, support risk prioritization, coordinate resilience efforts, and provide a communications infrastructure across national regions to include escalation and collaboration with appropriate law enforcement and intelligence agencies. The Recipient will work in partnership with and receive technical integration assistance from a CISA team. In addition, the Recipient must coordinate substantially with cyber threat experts from across the federal government. After the funding period has ended, the funding and supporting offices will continue to be available to provide technical assistance to ensure that information sharing, and collaboration continues.

The awardee will have access to sustained coordination with federal partners to defend forward and prevent or thwart malicious cyberspace actors and activities.

Thus, through these efforts, the awardee will make improvements in the SLTT cyber ecosystem and the development of its workforce; provide for a more efficient response and recovery time of systems during attack; and develop resilience capabilities for our nation’s SLTT government sector and critical subsectors (e.g., Elections).

Objectives: The purpose of this cooperative agreement is to expedite building an automated and streamlined capacity to share cyber threat information bi-directionally and collaboratively amongst the SLTT/Elections and CISA, as well as provide a mechanism for rapid adoption and methods to integrate with local activities in the SLTT environment that improve cyber security awareness and equip stakeholders to act in response to prioritized cyber threat information shared within the threat intelligence platform. Furthermore, this agreement will expand implementation of cyber managed services (e.g., National Prevention Pilot, End- Point Detection and Response Pilot, Malicious Domain Blocking and Reporting, Cyber Incident Response, Albert, Managed Email Security), for SLTT and the Elections subsector, and in so doing will impact the capabilities to create a more robust cyber defense and information sharing environment for the entire SLTT sector.

This Notice of Funding Opportunity Announcement (NOFO) is intended to fill a gap by providing supplemental resources to enable innovation, broaden centralized access to cyber threat information and communications platforms, provide for workforce development, and enhance cyber readiness and resilience, all while connecting the cyber ecosystems of the SLTT communities. By providing funds, technical assistance, and access to federal resources, it is expected that the Recipient will be able to:

a. Focus more of its business and resources on cyber threat information enrichment, scoring, and collaboration based on Indicators of Compromise (IOC)s derived from SLTT and its subsector infrastructure, ISAC information sources, open-source information, and external intelligence enrichment.

b. Create a lower entry cost for SLTT/subsector organizations (including elections infrastructure) who need help in managing cyber defenses and risk.

c. Expand the trusted SLTT/Elections subsector community) base that shares and collaborates on threat intelligence.

d. Provide some level of free managed security services and cyber threat information sharing services to the SLTT sector and its subsectors.

The government encourages developing the mechanism to collaborate on a single application if doing so would strengthen the overall capacity of the ISAC.

By technically integrating the SLTT cyber ecosystem and empowering cyber expertise and situational awareness across the SLTT trusted circle of members, the community will collaboratively serve to protect and improve defenses for the nation’s SLTT and its critical infrastructure sub-sectors, foremost Elections.

Priorities: CISA will leverage this Cooperative Agreement award to advance SLTT cybersecurity risk management and to help build a healthy and resilient SLTT cyber ecosystem via automated collective community action. Successful execution of this agreement will focus on expanding SLTT sector interrelationships within the community using rapid rollout technology to enhance cyber threat information exchange.

The priority is to provide a connective platform among the SLTT cyber coordinators for collaborative threat intelligence sharing. This enhanced technical model relies upon trusted SLTT collaboration, elastic infrastructure, managed security services and robust analytic orchestration and informed risk information to give cyber coordinators decision advantage, improve situational awareness and provide enhanced cyber defense.

See Appendix A for a detailed approach of priorities and metrics.

See Appendix B for major program status.

10. Performance Measures

Performance metrics will be implemented based on the detailed approach as defined in Appendix A, Task 10. The performance metrics program must routinely measure, analyze, and report qualitative and quantitative measures and metrics on SLTT member partnerships, the impact of SLTT cyber security incidents, the degree and effectiveness of sensor coverage, endpoint coverage, and consolidation of SLTT traffic across a prevention stack, as well as the effectiveness of the Recipient’s threat scoring and sharing methodology amongst the SLTT community.

The grants officer will oversee the execution of the cooperative agreement and the performance of cooperative agreement execution based on input from the CISA program office, discussion with the awardee, and Program Performance Reporting Requirements (found in section F).

B. Federal Award Information

1. Available Funding for the NOFO: $43,003,000

2. Projected number of Awards: 1

3. Maximum Award Amount: n/a

4. Period of Performance: 24 months

5. Projected Period of Performance Start Date(s): 09/30/2023

6. Projected Period of Performance End Date(s): 09/29/2025

Budget Period(s) for the NOFO: 09/30/2023 to 09/29/2024

a. The available funding for the NOFO described above is for an initial 12-month budget period from 09/30/2023 to 09/29/2024.

b. Funding for a second non-competitive continuation award for a 12-month budget period of 9/30/2024 to 9/29/2025 is conditioned on the availability of funds, satisfactory progress by the Recipient, program authority, compliance with the terms and conditions of the federal award, and a CISA determination that continued funding is in the best interests of the Government.

c. Extensions to the period of performance for this program are allowed. Recipients may request a no-cost extension to complete all project activities. The request must be submitted 60 days prior to the expiration of the performance period.

Requests for extensions are subject to approval by DHS.

1. Funding Instrument Type: Cooperative Agreement

The funding instrument used for this program will be the cooperative agreement, an assistance mechanism in which substantial CISA Program Office (PO) involvement is anticipated during the period of performance. Under the cooperative agreement, CISA supports and stimulates the Recipient’s activities by involvement in, and otherwise working jointly with the Recipient in a partnership role; it is not to assume direction, prime responsibility, or a dominant role in activities. Consistent with this premise, the dominant role and prime responsibility resides with the Recipient for the program.

a. To facilitate appropriate involvement, during the period of this cooperative agreement, CISA PO and the Recipient will be in contact monthly and more frequently as appropriate to ensure successful execution. Specific tasks and activities that may be shared between the Recipient and CISA PO include but are not limited to:

i. Providing strategic/tactical guidance and feedback in furtherance of the goals and objectives of the award.

ii. Providing access to key staff groups and other varied technical and programmatic resources, subject matter expertise, liaising with stakeholders and selecting meetings/panel members for carrying out the program.

iii. Reviewing and approving deliverables.

iv. Reviewing and approving substantive provisions of proposed subawards or contracts.

v. Ending an activity if performance specifications are not met.

vi. Exchanging bi-directional cyber threat information and building TTP (Tactics, Techniques and Procedures) context in furtherance of the objectives to enable a collective defense model.

vii. Exchanging unattributed and attributed cyber threat landscape information.

viii. Holding equity calls with federal officials on SLTT victim notifications.

b. CISA PO will be responsible for substantial involvement to include, but are not limited to the following:

i. CISA PO will provide substantial programmatic involvement during the performance period. Oversight services at the highest level are to keep CISA leadership apprised of the program status and to identify and quickly mitigate any threats to on-time and on-budget completion.

ii. Substantial federal involvement includes administrative activities such as monitoring and reviewing project phases. CISA PO will not direct or recommend that the Recipient enter a contract with a particular entity.

iii. CISA will provide promotional support of the SLTT SOC|ISAC program and its services with the goal of increasing SLTT trusted community interest and fulfilling the vision of an interconnected cyber ecosystem.

iv. CISA PO will provide administrative assistance related to security clearances to complete the approved scope of work.

v. CISA will allocate sufficient office space and communications, IT systems, telephones, and administrative supplies at CISA for cyber liaison officers to sit “side-by-side” with federal colleagues to facilitate effective unity of effort in the situational awareness assessment of the SLTT community that is used to prepare the national cyber assessment.

vi. CISA will provide reception and integration of the LNO team into CISA by identifying a single CISA staff member who is assigned the responsibility to assimilate the LNOs and provide the access they need to perform their functions.

vii. CISA will provide Homeland Security Information Network (HSIN) platform resources for trusted sharing of Sensitive but Unclassified Information with the SLTT community.

viii. CISA will assist in the establishment of partnerships, collaboration, and cooperation with SLTT, or private entities that may be necessary for carrying out the program.

ix. CISA will assist in the establishment of Federal interagency partnerships, collaboration and cooperation that may be necessary for carrying out the program.

x. CISA PO will provide, when appropriate, subject matter experts (SMEs) and other varied technical and programmatic resources to support each component of the program as defined in Appendix A.

xi. CISA PO representatives will attend and participate in meetings initiated by the Recipient, as defined by CISA.

xii. CISA will assist in the establishment of partnerships, collaboration, and cooperation with Federal, State, local, tribal, or territorial governments, or private entities that may be necessary for carrying out the project.

xiii. CISA and the Recipient (on behalf of the ISACs) will exchange bi-directional cyber threat indicators and information in furtherance of the objectives and priorities delineated in Appendix A to enable a collective defense model.

xiv. For purposes of maintaining cyber situational awareness of issues that affect reliability and resilience of the SLTT, CISA may exchange unattributed and attributed cyber threat landscape information with the ISACs.

xv. CISA will hold equity calls with federal officials and the ISACs on SLTT/Elections victim notification.

xvi. CISA will, as the program support deems necessary, facilitate coordination to address cybersecurity risks and incidents, in the form of email, site visits, teleconferences, workshops, webinars, technical exchanges, sharing cyber threat indicators and vulnerabilities, cyber analytic and awareness products, training opportunities, tabletop exercises, and technical assistance upon request.

xvii. CISA may halt an activity immediately if detailed performance specifications or requirements are not met.

xviii. CISA PO may review and approve one stage of work before the Recipient may begin a subsequent stage during the period covered by the Award.

xix. CISA PO may be involved in the key Recipient personnel assigned to perform work under the federal Award CISA PO and the Recipient will partner or collaborate in project activities.

xx. CISA PO may undertake monitoring that permit CISA PO to direct or redirect the work because of interrelationships with another program.

xxi. Substantial and direct operational involvement of or participation by CISA PO in the project is anticipated before the award is made to ensure compliance with such statutory requirements as civil rights, environmental protection, and provisions for the disabled. Such participation would exceed what is normally undertaken to comply with general statutory requirements that are a condition of every award.

xxii. CISA PO will provide substantial involvement in the form of technical collaboration or participation in carrying out the scope of work, joint development of outputs, and oversight.

xxiii. CISA PO will provide promotional support of the SLTT SOC|ISAC program and its services with the goal of increasing SLTT trusted community interest and fulfilling the vision of an interconnected cyber ecosystem.

xxiv. CISA PO will provide, when appropriate, subject matter experts (SMEs) and other varied technical and programmatic resources to support each component of the program as defined in Appendix A.

xxv. CISA PO representatives will attend and participate in appropriate meetings initiated by the Recipient.

xxvi. CISA PO will assist in the establishment of partnerships, collaboration, and cooperation with Federal, State, local, tribal, or territorial governments, or private entities that may be necessary for carrying out the project.

xxvii. CISA PO and the Recipient will exchange bi-directional cyber threat indicators and information in furtherance of the objectives and priorities delineated in Appendix A in order to enable a collective defense model.

xxviii. For purposes of maintaining cyber situational awareness of issues that affect reliability and resilience of the SLTT, CISA PO and the Recipient will exchange unattributed and attributed cyber threat landscape information.

xxix. CISA PO will make available office space at CISA PO for analysts to sit “side-by-side” with federal colleagues to provide the situational awareness assessment for the SLTT and Elections community that is used to prepare the national cyber assessment.

xxx. CISA PO provides a compartment on the HSIN platform for sharing information with the SLTT community and CISA staff populate the site with shared federal cyber awareness products.

xxxi. CISA will hold equity calls with federal officials and the ISAC on SLTT/Elections victim notification.

xxxii. CISA will, as the program support deems necessary, facilitate coordination to address cybersecurity risks and incidents, in the form of email, site visits, teleconferences, workshops, webinars, technical exchanges, sharing cyber threat indicators and vulnerabilities, cyber analytic and awareness products, training opportunities, tabletop exercises, and technical assistance upon request.

CISA will provide substantial technical involvement during the Period of Performance.

Multiple offices anticipate providing technical assistance and subject matter expertise support to the Recipient. The Recipient will anticipate receiving information directly from these offices and their and their contractors. The offices include but not limited to:

The Office of the Executive Assistant Director for Cybersecurity Division (CSD) and its sub-divisions of Capacity Building, Mission Engineering, Threat Hunting, Vulnerability Management, and Joint Cyber Defense Collaborative (JCDC); as well as other divisions of CISA, including National Risk Management Center (NRMC), Stakeholder

Engagement Division (SED), Integrated Operations Division (IOD), Emergency Communications Division (ECD), and Infrastructure Security Division (ISD).

C. Eligibility Information

1. Eligible Applicants

• For-profit organizations other than small businesses

• Small businesses

• Nonprofits with 501(c)(3) IRS status, other than institutions of higher education

• Nonprofits without 501(c)(3) IRS status, other than institutions of higher education

2. Applicant Eligibility Criteria (see above)

a. Entity needs to be performing some of the functions of a Cyber Information Sharing and Analysis Center.

b. Entity must possess the capacity to mature and expand a functioning 24x7x365 SOC to enable an ISAC.

c. Entity must be able to grow and unite stakeholder trust communities.

d. Entity must be able to retain cybersecurity analytic staff, including those with

TS/SCI clearance.

e. Entity must be able to provide scalable access to cybersecurity information, tools, and best practices.

f. Entity must be able to analyze huge amounts of information in real-time to identify trends and prioritize cyber information for actionable insights.

g. Entity must be able to sustain a communications model that allows critical cybersecurity information to quickly be disseminated across SLTT.

h. Entity must be capable of enabling reliable outcomes in managing cyber-relevant threat intelligence, with the benefit of improved customer resilience.

Entities that do not meet the eligibility criteria will be considered ineligible.

3. Other Eligibility Criteria/Restrictions DHS will not consider applications that do not adhere to one or more of the following requirements:

a. Deadlines. DHS will not accept late applications. Without exception, applications must be received by Grants.gov on or before the deadline in this announcement or they will not be considered.

b. Application relevance. Applications that do not address the purpose of this announcement will not be considered.

c. Compliance and completeness. Applications must substantially comply with the application submission instructions and requirements in this announcement, or they will not be considered.

d. Proof of non-profit status. Non-profit applicants and any proposed subrecipient of a non-profit must provide documentation of non-profit and/or public status. This requirement does not apply to for-profit applicants or proposed subrecipients. Any of the following constitutes acceptable proof of non-profit status:

i. A reference to the applicant organization’s listing in the Internal

Revenue Service’s (IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

ii. A copy of a currently valid IRS tax exemption certificate.

1. A statement from a State taxing body, State attorney general, or other appropriate State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

e. A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

f. Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

g. A signed statement on official letterhead by an official authorized to apply for cooperative agreement funds on behalf of the public entity will suffice.

h. In addition, DHS will not consider multiple applications from a single organization serving as the lead. If more than one application is submitted by a single organization as the lead, the later in time will be considered, unless the later application clearly indicates a unique role for that organization, other than as lead for this activity.

4. Cost Share or Match

The SLTT SOC ISAC Program has a 30% non-federal cost-share requirement.

The Recipient contribution may be cash (hard match) and/or in-kind (soft match).

Eligible SLTT SOC ISAC Program applicants must commit to the non-federal cost-share requirement at the time of application in an amount not less than 30% of the total project cost reflected in the application budget. If the total project ends up costing more, the Recipient is responsible for any additional costs. If the total project ends up costing less, the Recipient may owe CISA an amount required to ensure that the federal cost-share does not exceed 70%. Recipient For example, if CISA approves a Recipient total project cost under a federal award of $100,000, then the:

• Federal cost-share is 70 percent of $100,000 = $70,000

• Recipient cost-share is 30 percent of $100,000 = $30,000

Unless otherwise authorized by law, the Recipient may not use other federal grant funding towards the required non-federal cost-share under the SLTT SOC ISAC Program award. The Recipient’s contribution must be specifically identified in the application as part of the budget. The non-federal contribution, whether cash or in-kind, can only be used for authorized cooperative agreement purposes and has the same eligibility requirements as the federal assistance funds themselves. The basis for requiring a non-federal cost-share is to increase the amount of cybersecurity resources available to the SLTT community, assure local interest and involvement through financial participation, and hold down federal costs.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: 06/14/2023

b. Application Submission Deadline: 08/01/2023 at 11:59:59

PM [ET]

c. Other Key Dates

2. Agreeing to Terms and Conditions of the Award By submitting an application, applicants agree to comply with the requirements of this NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov.

For a hardcopy of the full NOFO, please write or fax a request to:

Shareef Prater Grants Officer, Grants and Financial Assistance Division

Email: shareef.prater@hq.dhs.gov Phone: 202-770-4776

In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice is:

1-800-518-4726 (Grants.gov Help Desk)

Applications will be processed through the Grants.gov portal.

Event Suggested Deadline for Completion Initial Registration at SAM.gov (includes UEI issuance) Four weeks before actual submission deadline

Obtaining a valid EIN Four weeks before actual submission deadline Updating SAM registration Four weeks before actual submission deadline Starting application in Grants.gov Two weeks before actual submission deadline http://www.grants.gov/ mailto:shareef.prater@hq.dhs.gov

4. Unique Entity identifier and System for Award Management (SAM)

Each applicant, unless they have a valid exception under 2 C.F.R. § 25.110, must:

a. Be registered in SAM.gov before application submission.

b. Provide a valid unique entity identifier in its application.

c. Continue to always maintain an active SAM registration with current information during the Federal Award process.

5. Steps Required to Submit an Application, Unique Entity Identifier, and System for Award Management (SAM)

To apply for an award under this program, all applicants must:

a. Have an account with https://login.gov/;

b. Register for, update, or verify their SAM account and ensure the account is active and

Employer ID Number (EIN) before submitting the application.

c. Create a Grants.gov account.

d. Add a profile to a Grants.gov account.

e. Establish an Authorized Organizational Representative (AOR) in Grants.gov.

f. Submit application in Grants.gov; and

g. Continue to maintain an active SAM registration with current information, including information on a Recipient’s immediate and highest-level owner and subsidiaries, as well on all predecessors that have been awarded a federal contract, grant, or cooperative agreement within the last 3 years, if applicable, at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency.

Applicants are advised that DHS may not make a federal award until the applicant has complied with all applicable SAM requirements. Therefore, an applicant’s SAM registration must be active not only at the time of application, but also during the application review period and when DHS is ready to make a federal award. Further, as noted above, an applicant’s or Recipient’s SAM registration must remain active for the duration of an active federal award. If an applicant’s SAM registration is expired at the time of application, expires during application review, or expires any other time before award, DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

6. Electronic Delivery DHS is participating in the Grants.gov initiative to provide the grant and cooperative agreement community with a single site to find and apply for grant funding and cooperative agreement opportunities. DHS encourages or requires applicants to submit their applications online through Grants.gov, depending on the funding opportunity. For this funding opportunity, the DHS Grants and Financial Assistance Division (GFAD) requires applicants to submit applications through Grants.gov.

https://login.gov/

7. How to Register to Apply through Grants.gov

a. Instructions: Registering in Grants.gov is a multi-step process. Read the instructions below about registering to apply for DHS funds. Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required application submission deadlines.

Organizations must have a Unique Entity Identifier (UEI) Number with an active System for Award Management (SAM) registration, and Grants.gov account to apply for grants and cooperative agreements. If individual applicants are eligible to apply for this funding opportunity, then you may begin with step 3, Create a Grants.gov account, listed below.

Creating a Grants.gov account can be completed online in minutes, but SAM registration may take several weeks. Therefore, an organization's registration should be done in sufficient time to ensure it does not impact the entity's ability to meet required application submission deadlines. Complete organization instructions can be found on Grants.gov here:

https://www.grants.gov/web/grants/applicants/organization-registration.html.

1) Register with SAM: All organizations applying online through Grants.gov must register with the System for Award Management (SAM). Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually. Organizations will be issued a UEI number with the completed SAM registration.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html.

2) Create a Grants.gov Account: The next step is to register an account with

Grants.gov. Follow the on-screen instructions or refer to the detailed instructions here: https://www.grants.gov/web/grants/applicants/registration.html.

3) Add a Profile to a Grants.gov Account: A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all your grant and cooperative agreement applications. To add an organizational https://www.grants.gov/web/grants/applicants/organization-registration.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/registration.html profile to your Grants.gov account, enter the UEI Number for the organization in the UEI field while adding a profile.

• For more detailed instructions about creating a profile on Grants.gov, refer to: https://www.grants.gov/web/grants/applicants/registration/add-profile.html.

4) EBiz POC Authorized Profile Roles: After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access are sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the AOR role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html.

5) Track Role Status: To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html.

6) Electronic Signature: When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature. The EBiz POC must authorize people who are able to make legally binding commitments on behalf of the organization as a user with the AOR role; this step is often missed, and it is crucial for valid and timely submissions.

8. How to submit an Application to DHS via Grants.gov Grants.gov applicants can apply online using Workspace. Workspace is a shared, online environment where members of a team may simultaneously access and edit different webforms within an application. For each NOFO, you can create individual instances of a workspace.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html.

a. Create a Workspace: Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

b. Complete a Workspace: Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission. The Workspace progress bar will display the state of your application process as you apply. As you apply using Workspace, you may https://www.grants.gov/web/grants/applicants/registration/add-profile.html https://www.grants.gov/web/grants/applicants/registration/add-profile.html https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html https://www.grants.gov/web/grants/applicants/registration/track-role-status.html https://www.grants.gov/web/grants/applicants/workspace-overview.html click the blue question mark icon near the upper-right corner of each page to access context-sensitive help.

c. Adobe Reader: If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at:

https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html.

d. Mandatory Fields in Forms: In the forms, you will note fields marked with an asterisk and a different background color. These fields are mandatory fields that must be completed to successfully submit your application.

e. Complete SF-424 Fields First: The forms are designed to fill in common required fields across other forms, such as the applicant’s name, address, and UEI number. To trigger this feature, an applicant must complete the SF-424 information first. Once it is completed, the information will transfer to the other forms.

f. Submit a Workspace: An application may be submitted through workspace by clicking the Sign and Submit button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24- 48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application submission.

g. Track a Workspace Submission: After successfully submitting a workspace application, a Grants.gov Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the Confirmation page that is generated after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

• For additional training resources, including video tutorials, refer to:

https://www.grants.gov/web/grants/applicants/applicant-training.html.

Applicant Support: Grants.gov provides applicants 24/7 support via the toll-free number 1-800-518-4726 and email at support@grants.gov. For questions related to the specific Cooperative Agreement opportunity, contact the number listed in the application package of the Cooperative Agreement to which you are applying.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html https://www.grants.gov/web/grants/applicants/applicant-training.html mailto:support@grants.gov number will assist DHS with tracking your issue and understanding background information on the issue.

9. Submitting the Final Application in [another grant system] N/A

10. Timely Receipt Requirements and Proof of Timely Submission

a. Online Submission. All applications must be received by MIDNIGHT Eastern time on the due date established for each program. Proof of timely submission is automatically recorded by Grants.gov. An electronic date/time stamp is generated within the system when the application is successfully received by Grants.gov. The applicant with the AOR role who submitted the application will receive an acknowledgement of receipt and a tracking number (XXXXXXXX) from Grants.gov with the successful transmission of their application. This applicant with the AOR role will also receive the official date/time stamp and Grants.gov Tracking number in an email serving as proof of their timely submission.

When DHS successfully retrieves the application from Grants.gov, and acknowledges the download of submissions, Grants.gov will provide an electronic acknowledgment of receipt of the application to the email address of the applicant with the AOR role who submitted the application. Again, proof of timely submission will be the official date and time that Grants.gov receives your application. Applications received by Grants.gov after the established due date for the program will be considered late and will not be considered for funding by DHS.

Applicants using slow internet, such as dial-up connections, should be aware that transmission can take some time before Grants.gov receives your application. Again, Grants.gov will provide either an error or a successfully received transmission in the form of an email sent to the applicant with the AOR role attempting to submit the application. The Grants.gov Support Center reports that some applicants end the transmission because they think that nothing is occurring during the transmission process. Please be patient and give the system time to process the application.

11. Content and Form of Application Submission

Applicant must submit all required documents listed in this section. See the Grants.gov Online Help for instructions on how to attach documents and complete forms. Applicant should ensure that the final submitted application package includes all required forms and documents.

Application Package The following documents comprise, as applicable, the continuation/supplement package.

Additional information regarding each of these documents is further provided.

a. Program Abstract

b. Program Narrative

c. Updated Plans to include:

https://www.grants.gov/help/html/help/index.htm#t=GetStarted%2FGetStarted.htm

1. Program Approach

2. Program Management Plan

d. Budget Narrative

e. Budget Forms updated as applicable: (Available on Grants.gov)

1. Form SF-424, Application for Federal Assistance

2. Form SF-424A, Budget Information for Non-Construction Programs

3. Form SF-424B, Assurances for Non-Construction Programs

4. Form SF-LLL, Disclosure of Lobbying Activities

f. Letters of Commitment

g. Draft Service Operational Plan

The Program Abstract, Program Narrative, Approach and Budget Narrative sections of the package must be double-spaced, on 8-1/2” x 11” plain white paper with 1” margins on all sides and use either Cambria or Times New Roman font size of not less than 11 points. Smaller font sizes may be used to fill in the Standard Forms, exhibits, and figures, though all text in forms, exhibits, and figures must not be smaller than 8-point font.

a. Program Abstract:

Recipient must include an abstract. This abstract is often distributed to the public and Congress and represents a high-level summary of the program. As a result, Recipient should prepare a clear accurate, concise abstract that can be understood without reference to other descriptions of the program, including: the program’s mission, objectives, overall approach, and anticipated outcomes.

b. Program Narrative:

The program narrative provides the most substantive information regarding the proposed program in a clear and concise manner. To that end, the program narrative should address the elements articulated in the Program Description / Program Overview, Objectives and Priorities criteria presented in this NOFO.

The program narrative should also align with the Performance Goals/Program Milestones and Performance Metrics presented in this NOFO.

c. Program Approach:

The Program Approach must be a clear and specific description of the Recipient’s approach to build upon their organization’s existing infrastructure in order to meet the objective of a streamlined cyber threat information sharing process that will allow the SLTT entity (foremost includes the critical subsector of Elections) to send cyber security threat information to a single entity and give that entity the responsibility to incorporate and integrate security orchestration, automation and response with other platforms and disseminate prioritized cyber information for the benefit of the entire SLTT sector on an equitable and timely basis.

Applicant should address the deployment of cyber managed services and use of the ISAC infrastructure to improve the sharing of cyber threat information amongst SLTT stakeholders to include:

i. The current infrastructure and resources that exist in their organization and how they will expand their infrastructure to achieve the proposed objectives and deliverables of the project.

ii. An assessment of the current state of the ISAC infrastructure’s technical readiness and information sharing activities and a discussion that illustrates how they are applied to advance interoperable SLTT IT systems.

iii. Identification of strategies to implement cybersecurity managed services/tools and disseminate those tools to the SLTT sector.

iv. The workflow associated with the program and how the organizations involved in the program will be integrating information using resources from across the SLTT and federal government.

v. A description of how the applicant will use CISA funds in the next few years of the cooperative agreement to build additional SLTT subject matter threat modeling expertise and capacity for educational outreach to the SLTT sector;

and

vi. A description of how the applicant will use additional threat information sources, provide technical capacity, to meet the objective to expand its capability to identify undetected threats, incorporate it into threat scoring, enable more automated defensive blocking

d. Program Management Plan:

Applicant is required to submit a Program Management Plan to CISA PO. The Project Plan must reflect, and be consistent with, the Program Narrative and Budget and must cover the duration of the projected period of performance. The Plan must also identify important objectives and deliverables associated with the Program, including:

i. The current infrastructure and resources that exist in their organization and how they will expand their infrastructure to achieve the proposed objectives and deliverables of the program.

ii. An assessment of the current state of the ISAC infrastructure’s technical readiness and information sharing activities and a discussion to illustrate how they are applied to advance interoperable SLTT/Election’s systems and cyber threat sharing.

iii. Identification of strategies to implement cybersecurity tools and disseminate those tools and services to the SLTT/Elections sector; and

iv. A sustainability plan that would allow for continuous sharing of cyber threat information.

The Program Management Plan must be broken out by each year and cover the duration of the cooperative agreement’s projected period of performance. For each activity/objective, the cost will be projected. For each major task or action step within the activity, the plan must identify timeframes involved, including start and end dates. Upon award, CISA PO will provide feedback on the Program Management Plan and may request revisions before Program work can commence.

The Program Management Plan must include baseline measurements for each of the established milestone objectives. The applicant should propose performance metrics for how the applicant will measure its progress toward each objective.

Metrics will include how the applicant would set goals and track progress on expanding its solutions over the phases of the award.

Applicant must, in their Program Management Plan, assess their current state of technical readiness and knowledge of the SLTT sector (includes critical sub-sectors, i.e., Elections) and demonstrate their understanding of the specific steps that need to be taken to meaningfully deliver robust solutions, protection and support, for SLTT members that range from small and medium to enterprise level organizations.

e. Budget Narrative/Justification

The Budget Narrative describes how the proposed budget, as articulated in the SF-424A, aligns with the applicant’s Project Narrative to ensure that costs are realistic (not artificially too low) and reasonable (not inflated) in view of programmatic requirements.

When more than 33% of a Project’s total budget falls under a contractual expense, a detailed Budget Narrative/Justification must be provided for each sub-contractor or sub-Recipient.

Whether direct or indirect, costs must be allowable, allocable, reasonable, and necessary under the applicable OMB Cost Circulars.

The period of performance for this award is 2 years. Recipient must submit a proposal which covers the full 2-year period. The budget and justification of costs should only include the initial 12-month budget period..

In subsequent years, Recipients will be able to revise their budgets, based on actual funding available from DHS, as part of their non-competing continuation applications which will be required from all Recipients prior to the end of each budget period. The budget proposal must include:

i. An explanation of how the proposed budget supports the proposed

Program and is reasonable to meet the Program’s needs.

ii. How proposed costs support Program activities; and

iii. A description of how the proposed expenditures align with the Program Management Plan.

f. Budget Forms:

The Recipient is required to maintain the following budget forms to include the costs associated with the proposed Program activities. These forms are available and will be submitted/maintained through grants.gov as part of the application package and will include the following:

1.Application for Federal Assistance SF-424 2.Budget Information for Non-Construction Programs SF-424A 3.Assurances for Non-Construction Programs SF-424B 4.Disclosure of Lobbying Activities SF-LLL

i. Form SF-424, Application for Federal Assistance

Please note that the SF-424 is used for a wide variety of Federal grant programs and cooperative agreements, and Federal agencies have the discretion to require some or all the information on these forms.

ii. Form SF-424A, Budget Information for Non-Construction Programs

Please note that the SF-424A is used for a wide variety of Federal grant programs and cooperative agreements, and Federal agencies have the discretion to require some or all the information on these forms.