finalized nofo-isao e.o. program-7.8.2015 edited.pdf

Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

Standards for ISAOs

NOTE: If you are going to apply for this funding opportunity and have not obtained a Data Universal Numbering System (DUNS) number and/or are not currently registered in the System for Award Management (SAM), please take immediate action to obtain a DUNS Number, if applicable, and then to register immediately in SAM . It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information. Information on obtaining a DUNS number and registering in SAM is available from Grants.gov at:

http://www.grants.gov/documents/19/18243/SAM_New_Grantee_Registration.pdf/8bf1c182 -8d35-47e0-99e2-a263fa3d9005

A. Notice of Funding Opportunity (NOFO) Description

Issued By

U.S. Department of Homeland Security (DHS), Office of Cybersecurity & Communications (CS&C)

Catalog of Federal Domestic Assistance (CFDA) Number

97.128

CFDA Title

National Cyber Security Awareness

Notice of Funding Opportunity Title

Initiative to Implement Section 3 of Executive Order 13691 “Promoting Private Sector Cybersecurity Information Sharing” of February 13, 2015: Standards for Information Sharing and Analysis Organizations (ISAO).

Short Title/Popular Name: Standards for ISAOs

NOFO Number

DHS-15-NPPD-128-001

Finalized_OMB agreed upon http://www.grants.gov/documents/19/18243/SAM_New_Grantee_Registration.pdf/8bf1c182-8d35-47e0-99e2-a263fa3d9005 http://www.grants.gov/documents/19/18243/SAM_New_Grantee_Registration.pdf/8bf1c182-8d35-47e0-99e2-a263fa3d9005

Authorizing Authority for Program

Homeland Security Act, National Cybersecurity Protection Act of 2014, Executive Order (EO) 13,636, PPD-21 Executive Order 13691 “Promoting Private Sector Cybersecurity Information Sharing” of February 13, 2015

Appropriation Authority for Program

Department of Homeland Security (DHS) Appropriations Act, P.L. 114-4, Title III, National Protection and Programs Directorate, Infrastructure Protection and Information Security.

Program Type

New

Program Overview, Objectives, and Priorities

For background on this requirement, please refer to the 2015 Presidential Executive Order -- Promoting Private Sector Cybersecurity Information Sharing.

https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari

On February 13, 2015, President Obama signed Executive Order (EO)13691, which is intended to enable and facilitate “private companies, nonprofit organizations, and executive departments and agencies …to share information related to cybersecurity risks and incidents and collaborate to respond in as close to real time as possible.”

As specified in the Quadrennial Homeland Security Review, this program addresses one of the five basic missions of DHS, “Safeguard and Secure Cyberspace.” In furtherance of this mission, this program is intended to strengthen the security and resilience of critical infrastructure, advance incident response and reporting capabilities, and overall, strengthen the cybersecurity ecosystem through enhanced cybersecurity information sharing and maturation of information sharing and analysis organizations.

The EO addresses several concerns the private sector has raised:

• If a company wants to join an Information Sharing and Analysis Centers (ISACs) or other information sharing organization, how does it readily assess the capabilities and effectiveness of that organization both to provide valuable information and to be a trustworthy steward of information provided to it by the

Finalized_OMB agreed upon https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari company? Lacking consistent baseline standards or evaluation criteria for ISAOs, companies may incur significant transaction costs that serve as a barrier to joining ISACs or other information sharing organizations.

• How can companies share information if they do not fit neatly into the sector-based structure of the existing ISACs?

• If a group of companies wants to start an information sharing organization, what model should they follow? What are the best practices for such an organization?

To this end, the EO directs the Secretary of Homeland Security to:

• Encourage the development and formation of Information Sharing and Analysis Organizations (ISAOs),

• Enter into an agreement with a nongovernmental organization (standards organization) to identify a common set of voluntary standards for the creation and functioning of ISAOs. The standards will address the baseline capabilities that ISAOs under this order should possess and be able to demonstrate if they self-certify as an ISAO.

To fulfill this requirement DHS will select a standards organization (SO) through an open and competitive process and enter into a cooperative agreement. The SO will create standards to assist in the widespread establishment of ISAOs and the mechanisms by which they function and interact with the government and across the private sector.

The establishment of ISAOs will allow private sector companies and other entities to share cyber threat information with each other on a voluntary basis and, if they so choose, to participate in DHS information sharing programs even if they do not fit into an existing critical infrastructure sector. As an example, ISAOs will accommodate entities who want to collaborate with others in their region rather than with others in their sector. ISAOs will, if they so choose, have the opportunity to participate in existing DHS cybersecurity information sharing programs, including the opportunity to contribute to near-real-time sharing of cyber threat indicators within those programs.

Under the cooperative agreement, that SO will be responsible for developing voluntary standards and guidelines for the creation and functioning of ISAOs, as contemplated under the EO. ISAOs will then self-certify to the standards identified and developed by the SO. The EO states:

The standards shall further the goal of creating robust information sharing related to cybersecurity risks and incidents with ISAOs and among ISAOs to create deeper and broader networks of information sharing nationally, and to foster the development and adoption of automated mechanisms for the sharing of information. The standards will address the baseline capabilities that ISAOs under this order should

Finalized_OMB agreed upon possess and be able to demonstrate. These standards shall address, but not be limited to, contractual agreements, business processes, operating procedures, technical means, and privacy protections, such as minimization, for ISAO operation and ISAO member participation.

As the EO envisaged a standards-setting process led by the private sector, DHS will move into the role of assisting the SO to assure:

1. The SO is developing a common set of voluntary standards or guidelines for the creation and functioning of ISAOs under this order.

2. All standards are consistent with voluntary international standards when such international standards will advance the objectives of this order, and shall meet the requirements of the National Technology Transfer and Advancement Act of 1995.

3. The SO engages in an open, public review and comment process for the development of the referenced standards soliciting the viewpoints of existing entities engaged in sharing information related to cybersecurity risks and incidents, owners and operators, of critical infrastructure, relevant agencies, and other public and private sector stakeholders.

The grants officer will oversee the execution of the grant and the performance of grant execution based on input from the DHS CS&C program office, discussion with the awardee, and Program Performance Reporting Requirements (found in section F).

Request for Proposals

In fiscal year (FY) 2015, a total of up to $2,200,000 in federal funding is available for eligible organizations to serve as the ISAO SO, and up to $11,000,000 over a five year period of performance to lead the identification, development and implementation of voluntary standards for ISAOs. (Subject to availability of funds)

Proposals must include the following four elements.

A description of the proposer’s background, qualifications, and expertise regarding cybersecurity information sharing and information sharing best practices so as to assure public trust in the proposer’s ability to serve as the

ISAO SO.

A description of the proposed process for identifying ISAO voluntary standards

• A description of the proposed activities of the SO that will result in the identification and development of ISAO voluntary standards

• A description of the process for developing ISAO standards consistent with voluntary international standards, to the extent that such international standards advance the objectives of E.O. 13691 and meet the requirements of the National Technology Transfer and Advancement Act of 1995 (Public Law 104-113), and OMB Circular A-119, as revised.

• An overview of already-existing requirements, best-practices, and standards that may be applicable regarding the identification of ISAO voluntary standards.

A description of proposed outreach and research

• At least four open and transparent coordination engagements with existing ISACs, ISAOs, associations, private companies, and subject matter experts engaged in cybersecurity-related information sharing.

• Public notice of all meetings and the establishment of an open public review and comment process for the development of voluntary standards to solicit the viewpoints of existing entities engaged in cybersecurity sharing information and cyber incident management.

• Coordination and engagement with owners, operators and regulators of critical infrastructure, relevant agencies, and other public and private sector stakeholders.

o Ongoing review, update and publication and related support, as necessary, of ISAO standards and best practices after initial voluntary standards are created. A description of the proposed plan to provide technical support and assist perspective ISAOs to implement standards and assure quality of conformance after the voluntary standards are developed.

A description of the proposed plan to assess the progress and challenges of ISAOs in implementing voluntary standards, in order to assist ISAOs to overcome those challenges.

o Effective methods to continuously inform the public about opportunities to become an ISAO across the 50 States and US territories.

B. Federal Award Information

Award Amounts, Important Dates, and Extensions

Available Funding for the NOFO: Up to $2, 200,000 per year per award, and up to 11,000,000 over 5 years. (Subject to the availability of funds)

Projected number of Awards: 1 (one) award.

Period of Performance: Up to 60 months.

Any period over 60 months is an “extension.” Extensions to the period of performance are allowable. Please refer to Section H. Additional Information – Extension, for more information regarding what steps recipients must follow and what information must be included in the justification for such request to be considered.

Projected Period of Performance Start Date(s): 08/10/2015

Projected Period of Performance End Date(s): 07/30/2020

First Budget Period Dates: 08/10/2015 – 07/30/2016

Funding Instrument: Discretionary – Competitive - Cooperative Agreement

DHS will exercise substantial programmatic involvement through this cooperative agreement. This includes monitoring project progress; providing technical assistance; disapproving and approving sub-projects, work plans or modifications thereto; holding kickoff meetings; conducting biennial reviews; conducting programmatic reviews; coordinating standards development activities; and coordinating self-certification activities. In addition, coordination/consultation through DHS with other relevant federal departments and agencies is required.

The grants officer will oversee the execution of the grant and the overall performance of the awardee from an administrative and financial perspective.

C. Eligibility Information

Eligible Applicants

For-profit organizations other than small businesses Nonprofits with 501(c) (3) IRS status, other than institution of higher education Nonprofits without 501(c) (3) IRS status, other than institution of higher education Private institutions of higher education Public and State controlled institutions of higher education Small businesses

Eligibility Criteria

To be eligible for this program, must meet the below requirements.

1. Applicants must not be a Government organization. Pursuant to EO 13691, “Promoting Private Sector Cybersecurity Information Sharing” of February 13, 2015, the standards organization selected must be non-governmental to be eligible. DHS has interpreted this restriction to exclude federal, state, local, territorial, tribal, and foreign governmental entities from making a proposal for this announcement.

2. At the time of application, applicants that propose to become the SO must have at least three years of experience developing cybersecurity best practices for Government or private sector organizations.

3. Applicants must have three years of experience conducting a participatory standards development process, or have demonstrated serving as a standards adjudication and validation organization.

4. Applicants must have deep knowledge of the National Infrastructure Protection Plan, Executive Order 13636, Executive Order 13691, and

PPD-21.

a. FFRDCs or laboratories funded by federal agencies may not apply.

b. FFRDC employees may cooperate or collaborate with eligible applicants within the limits imposed by applicable legislation, regulations, and DHS policies.

c. FFRDC employees are not eligible to serve in a principal leadership role on a grant or cooperative agreement, and may not receive salaries or in other ways augment their agency's appropriations through awards made by this program.

5. Applicant must be able to stand-up a functioning SO and host the first listening session/workshop with private sector stakeholders within 45 days of award.

6. National laboratory employees may participate in planning, conducting, and analyzing the activities directed by the standards organization applicant, but may not direct projects on behalf of the applicant organization.

7. The standards organization may provide funds through its assistance agreement with DHS to an FFRDC for project-specific, non-federal research personnel, supplies, equipment, facilities, data, and other expenses directly related to activities under this cooperative agreement.

8. Federal agencies may not apply. Federal employees are not eligible to serve in a principal leadership role on a grant or cooperative agreement, and may not receive salaries or in other ways augment their agency's appropriations through awards made by this program.

a. Nonetheless, federal employees may interact substantively with awardees in the form of cooperation.

b. Cooperation involves consulting on the planning, management, and coordination of standards organization and/or information sharing and analysis organization activities, sharing or comparing information, indicators, samples, equipment, facilities, data, models, or other support during the conduct of the standards development and related activities in which the interaction is substantial and requires the award of a cooperative agreement, rather than a grant.

c. Substantial involvement occurs when the collaboration or cooperation of a federal employee or facility is necessary to achieving the overall goals of the activities supported by this cooperative agreement.

Other Eligibility Criteria

DHS will not consider applications that do not adhere to one or more of the following requirements:

1. Deadlines. DHS will not accept late applications. Without exception, applications must be received by Grants.gov on or before the deadline in this announcement or they will not be considered.

2. Application relevance. Applications that do not address the purpose of this announcement will not be considered.

3. Compliance and completeness. Applications must substantially comply with the application submission instructions and requirements in this announcement or they will not be considered.

4. Funding limits. Applications exceeding the funding limits will not be considered.

5. Proof of non-profit status. Non-profit applicants and any proposed sub-awardee of a non-profit must provide documentation of non-profit and/or public status. This requirement does not apply to for-profit applicants. Any of the following constitutes acceptable proof of non-profit status:

• A reference to the applicant organization’s listing in the Internal Revenue Service’s (IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

• A copy of a currently valid IRS tax exemption certificate.

• A statement from a State taxing body, State attorney general, or other appropriate State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

• A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

• Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

• A signed statement on official letterhead by an official authorized to apply for grant funds on behalf of the public entity shall suffice.

In addition, DHS will not consider multiple applications from a single organization serving as the lead. If more than one application is submitted by a single organization as the lead, the later in time will be considered, unless the later application clearly indicates a unique role for that organization, other than as lead for this activity.

Non-Responsive Applications

Your application will be rejected if:

1. Form SF-424 – Application for Federal Assistance is missing.

2. Form SF-424A – Budget is missing.

3. Form SF-424B – Assurances - Non-Construction Programs is missing.

4. The applicant’s Authorized Organization Representative (AOR) is not registered with the System for Award Management (SAM).

5. The application does not include a Budget Narrative.

6. The application does not include a Project Abstract.

7. The Project Narrative is missing.

Maintenance of Effort

There is no maintenance of effort requirement for this program. Requests for funds under this announcement shall not be used to take the place of activities described in the application that are currently supported with other funding. Also, grant funds shall not be used to support activities that are a normal part of the organization’s operations.

Cost Share or Match

There is no cost share or match requirement for this program.

D. Application and Submission Information

Submission Dates and Other Key Dates and Times

NOFO Posted to Grants.gov:

05/26/2015 06:00:00 PM EST

Letter of Intent: 06/15/2015 Application Submission Deadline: 07/17/2015 11:59:59 PM EST Daylight savings time Anticipated Funding Selection Date: 07/31/2015 Anticipated Award Date: 08/10/2015

NOTE: The application must be received in Grants.gov by the date and time listed above. If an application is received after the deadline, it will not be considered. Applicants will receive a confirmation from Grants.gov once the application is successfully submitted.

All applications are time stamped by the Grants.gov system when submitted and recipients are notified accordingly. The federal office will download all applications that are received by the deadline date and time as indicated on the NOFO.

Other Key Dates

Event Suggested Deadline For Completion

Obtaining DUNS Number 06/15/2015

Obtaining a valid EIN 06/15/2015

Updating SAM registration 06/15/2015

Letter of Intent

The letter of intent should be emailed to the Grants Officer no later than 06/15/2015. The letter should be in the body of the email and not an attachment. It should state intent to apply for this opportunity and contain the name of your entity, contact information, legal business or non-profit status. In the subject line of email please state the following: Letter of Intent for NOFO Number DHS-15-NPPD-128-001

Email to:

Tamara Marshall-Jones

Tamara.Marshall-Jone@hq.dhs.gov

Address to Request Application Package

Applications will be processed through the Grants.gov portal. Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov , select “Applicants” then “Apply for Grants,” read the registration requirements and register if necessary (Allow up to four weeks after you submit before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information). In order to obtain the application package select “Download a Grant Application Package.” Enter the CFDA and/or the funding opportunity number located on the cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

Grant Application Package - Enter the CFDA and/or the funding opportunity number located on the cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

Applications will be processed through the Grants.gov portal. If you experience difficulties accessing information or have any questions, please call Grants.gov customer support at 1- 800-518-4726.

The Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Announcement is: 1-800-518-4726 (Grants.gov Help Desk).

To request a hardcopy of the full NOFO, please email or fax a request to:

Tamara Marshall-Jones Grants Officer Tamara.Marshall-Jone@hq.dhs.gov Phone: 202-447-0177

Content and Form of Application Submission

Content and Form of Application Submission Applicants must submit all required forms and required documents listed in this section.

See the Grants.gov Applicant User Guide for instructions on how to attach forms and documents. Applicant should ensure that the final submitted application package includes all required forms and documents. Applicants should avoid the use of special characters in attachment file names.

REQUIRED FORMS

mailto:Tamara.Marshall-Jone@hq.dhs.gov http://www.grants.gov/ mailto:Tamara.Marshall-Jone@hq.dhs.gov http://www.grants.gov/documents/19/18243/GrantsgovApplicantUserGuide.pdf

Complete the required forms in accordance with the application instructions on Grants.gov. If submitting any information that is deemed proprietary, privileged or confidential commercial or financial, please denote the beginning and ending of such information with asterisks (***).

1. Form SF-424 – Application for Federal Assistance

This form must be completed within the application package on Grants.gov. You must download and install Adobe Reader in order to view this form. Applicants are only required to complete fields which are highlighted.

2. Form SF-424A – Budget

This form must be completed within the application package on Grants.gov. You must download and install Adobe Reader in order to view this form. Applicants are only required to complete fields which are highlighted. Provide budget amounts by object class (personnel, fringe benefits, travel, etc.). Include all five years of budget amounts in Section E. Funds may be requested as long as the item and amount are necessary to perform the proposed work and are not precluded by the cost principles or program funding restrictions.

3. Certifications/Assurances

These forms must be completed within the application package on Grants.gov.

You must download and install Adobe Reader in order to view these forms.

Applicants must submit:

a. Form SF-424B – Assurances – Non-Construction Programs; and

b. Certification Regarding Lobbying. If paragraph two of the certification applies, then complete and submit the SF-LLL Disclosure of Lobbying which is provided as an optional form in the application package.

By signing and submitting an application under this announcement, the applicant is providing: Certification Regarding Drug-Free Workplace Requirements; Certification Regarding Debarment, Suspension, and Other Responsibility Matters – Primary Covered Transactions; and Certification that the applicant is not delinquent on any federal debt.

REQUIRED DOCUMENTS

Project Information

a. Project Abstract (3 single-spaced page maximum) Provide the information below in a separate document, suitable for public dissemination.

The project abstract must not include any proprietary/confidential information. Attach the Project Abstract to the application package.1

General Information

1. Organization legal name

2. Organization legal address (Number and street, city, state, zip code)

3. Head of the organization (Name, title, address, phone number, email address)

4. Authorized official, the person at the organization authorized to sign to receive award (Name, title, address, phone number, email address)

5. Grant project manager, the person who will manage the operations of the grant project and will serve as project manager primary point of contact (Name, title, address, phone number, email address)

6. Type of organization (e.g., non-profit, small business, private, public and state controlled institutions of higher education, etc.)

7. Project description (200 words or less) Provide a brief summary of the following:

• The organization’s experience developing cybersecurity standards or best practices and number of years providing services;

• A description of the specific cybersecurity subject area to include work with the private sector and Government cybersecurity programs.

• Proposed grant project activities and outcomes.

8. Total federal funding requested (Up to $11,000,000)

9. Congressional district (based on the legal address of the applicant organization)

10. Number of full-time equivalents (FTEs) Indicate the number of intended grant- funded FTEs. Include part-time work as percentages of FTEs. Include any grant-funded sub-awardee FTEs.

1 See the Grants.gov Applicant User Guide for instructions on how to attach forms and documents. The “Attachment” Section begins on page 88 of the Applicant User Guide.

http://www.grants.gov/documents/19/18243/GrantsgovApplicantUserGuide.pdf

Tips: Write for a general audience and avoid use of scientific/technical jargon to the extent possible. Please define any technical terminology that is discipline-specific and include a list of any acronyms used. Be concise and direct in descriptions.

4. Project Narrative (30 double-spaced page maximum) Provide a response for each item in the chart below following the order listed. Items 5.a. c. below are the mandatory headings that must be included in the Project Narrative. An application that is missing one or more of the three required headings will be deemed non-responsive and will not be reviewed. The items and attachments listed in each section are required, and any item or attachment that is omitted will result in points deducted.

Format Requirements

• You must follow the order specified below, using the required three headings:

a. ISAO Voluntary Standard Development

b. Management and Outreach

c. Standards Organization Operations

• Include the title “Project Narrative” at the top of the first page.

• Ensure that the application can be printed on 8 ½” x 11” single-sided paper.

• Use double-spacing.

• Font size must be at least 12 point, preferably Times New Roman font.

• Margins must be at least one (1) inch at the top, bottom, left and right of the paper.

• Project narrative pages must be numbered “1” of “XX.”

• Pages should be numbered consecutively and are limited to a total of 30 pages.

• Do not include any marks from the “Track Changes” tool in your word processing program.

• Attach the completed Project Narrative to the application package.

Project Narrative Items

a. ISAO Voluntary Standards Development (18 page max) Experience and Expertise Describe:

• Your non-governmental organization, leadership and management, and the organization’s experience/ ability to engage and work across the broad community of organizations engaged in sharing information related to cybersecurity risks and incidents, including ISACs, ISAOs, associations, private companies, and subject matter experts engaged in information sharing in support of their customers.

• Your organization’s experience in the identification, development, or implementation of cybersecurity best practices and/or cybersecurity standards. Indicate dates, total years of experience, the community served and relevant outcome of your activities.

• Describe your experience in the development of standards in a participatory environment, your experience in conducting standards implementation or adjudication, or any other experience in the development, maintenance, or implementation of formal standards in order to assure public trust in the proposer’s ability to serve as the ISAO SO.

• Describe your background with cybersecurity-related information sharing, cybersecurity and standards/best practice development that will assure public trust in the proposer’s ability to serve as the ISAO SO.

Plan to Develop Standards

Propose a plan to establish voluntary standards or guidelines for the creation and functioning of ISAOs under the EO, including a description of how:

Such standards or guidelines shall:

1. further the goal of creating robust information sharing related to cybersecurity risks and incidents with ISAOs and among ISAOs to create deeper and broader networks of information sharing nationally;

2. foster the development and adoption of automated mechanisms for the sharing of information, including STIX and TAXII;

3. articulate baseline capabilities that ISAOs should possess and be able to demonstrate, including consideration of the NIST Cybersecurity Framework;

4. address ISAO operation and ISAO member participation factors including, but not be limited to, contractual agreements, business processes, operating procedures, technical means, and privacy protections, such as minimization;

5. be consistent with voluntary international standards when such international standards will advance the objectives of this order; and meet the requirements of the National Technology Transfer and Advancement Act of 1995 (Public Law 104-113), and OMB Circular A-119, as revised.

b. Management and Outreach (7 page max)

Please describe:

• The proposed operations of the SO that effectively and efficiently identify voluntary standards for ISAOs under EO 13691.

• Plan to provide technical support to assist prospective ISAOs to implement standards and assure quality of conformance after the voluntary standards are developed.

• Plan to assure open and transparent coordination engagements with existing ISACs, ISAOs, academia, associations and private companies engaged in information sharing supporting their customers.

• Coordination and engagement with owners and operators and regulators of critical infrastructure, relevant agencies, and other public and private sector stakeholders.

• Public notice of all meetings and the establishment of an open public review and comment process for the development of voluntary standards to solicit the viewpoints of existing entities engaged in cybersecurity sharing information and cyber incident management.

• Ongoing review and publishing of best practices for ISAOs after voluntary standards are created.

• Plan to measure progress of ISAOs and challenges implementing voluntary standards that will inform the creation of written best practices / guidance assisting ISAOs to overcome those challenges.

• Effective methods to continuously inform the public about opportunities to become an ISAO across the 50 States and US territories.

c. Standards Organization Operation (5 page max) Please Describe:

• An overview of already-existing requirements, best-practices, and standards that may be applicable regarding the identification of ISAO voluntary standards.

• Existing or previously employed standards development, adjudication, or implementation infrastructure such as writing teams, certification committees, information collection and sharing tools, auditing procedures, adjudication handbooks, or other applicable materials.

• Plan to provide technical support to assist perspective ISAOs to implement standards and assure quality of conformance after the voluntary standards are

Finalized_OMB agreed upon

PERSONNEL

• Plan to provide technical support to assist perspective ISAOs to implement standards and assure quality of conformance after the voluntary standards are developed.

• Plan to measure progress of ISAOs and challenges related to the implementation of voluntary standards, in order to inform the assist ISAOs to overcome those challenges.

• Describe the staffing structure for the proposed standards organization. Provide a list of key personnel for the program. Key personnel include the grant project manager(s) and subject matter expert(s).

• For each person, provide the following information, preferably in a table format:

Name, or indicate if the position is vacant. If the position is vacant, provide a separate position description and target start date;

Title and brief position description;

Whether the position is paid or volunteer;

FTE charged to the grant; and Relevant experience, qualifications and training. Each staff member, whether a volunteer or paid, must have at least two year of cybersecurity experience in an operations or administrative role.

Sample Staff Table

Name Title and Position Description

Paid or Volunteer

FTE

charged to grant

Relevant experience, qualifications and training

Jim Smith

Cybersecurity Program Manager – provides SO operations management

Paid 0.3 FTE Accredited for 5 years, 3 years of experience with naturalization application services

Other Project Information

Applicants must complete the “Other Project Information” Items 1-6 on the form which include information regarding use of proprietary information, environmental impacts, historic place designation, international collaborators, etc.

Budget Narrative (Double-spaced, no page limit)

Attach your budget narrative to the application package.

Include costs for the each of five performance years. Separate the first performance year costs and each following performance year’s costs. Show a total of all requested federal grant funds. This total should match the total listed on the project abstract.

Budget categories b – i below should add up to this total.

Provide budget information in the order listed below. Budget detail is required for:

a. Personnel: Costs of employee salaries and wages. For each staff person, provide the name (if known), title, time commitment to the project as a percentage of a full-time equivalent (FTE), annual salary, and grant funded salary. Do not include the costs of consultants. Consultants are to be included under “Contractual.”

b. Fringe Benefits: Costs of employee fringe benefits unless treated as part of an approved indirect cost rate. Provide the method used to calculate the proposed rate amount. If a fringe benefit has been negotiated with, or approved by, a cognizant federal agency, attach a copy of the negotiated fringe benefit agreement. If no rate agreement exists, provide a breakdown of the amounts and percentages that comprise fringe benefit costs such as health insurance, FICA, retirement insurance, taxes, etc. Identify the base for allocating these fringe benefit expenses.

(Attach the agreement to the application package.)

c. Travel: Costs of project-related travel by employees of the applicant organization (do not include costs of sub-contractor or consultant travel). For each proposed trip, provide the purpose, number of travelers, travel origin and destination, number of days, and a breakdown of costs for airfare, lodging, meals, car rental, and incidentals. The basis for the airfare, lodging, meals, car rental, and incidentals must be provided, such as past trips, current quotations, Federal Travel Regulations, etc. Foreign travel is not permitted. The applicant must include costs for two staff members to attend a mandatory two-day grant recipient orientation training in Washington, D.C. the first year of the grant, and costs for one staff member to attend mandatory two-day training in Washington, D.C. the second through 5th year of the grant.

d. Equipment: Any article of nonexpendable, tangible personal property having a useful life of more than one year and an acquisition cost which equals or exceeds the lesser of (a) the capitalization level established by the organization for financial statement purposes, or (b) $500. For each type of equipment requested, provide a description of the equipment, the cost per unit, the number of units, the total cost, and a plan for use on the project, as well as use or disposal of the equipment after the project ends. An applicant organization that uses its own definition for equipment should provide a copy of its policy or section of its policy which includes the equipment definition.

NOTE 1: Acquisition cost means the net invoice unit price of an item of equipment, including the cost of any modifications, attachments, accessories, calibration and maintenance services, or auxiliary apparatus necessary to make it usable for the purpose for which it is acquired. Ancillary charges, such as taxes, duty, protective in-transit insurance, freight, and installation shall be included in or excluded from acquisition cost in accordance with the organization's regular written accounting practices.

NOTE 2: Prior to the purchase of equipment in the amount of $500 or more per unit cost, the Recipient must obtain the written approval from DHS. The Recipient shall maintain an annual inventory, which will include a brief description of the item, serial number and amount of purchase for equipment purchased with grant funds, or received under a grant, and having a $500 or more per unit cost. The inventory must also identify the sub-award under which the equipment was purchased. Maintenance and insurance will be the responsibility of the Recipient. Title of equipment will remain with the Recipient until closeout when disposition will be provided in writing by DHS within 120 days of submission of final reports.

e. Supplies: Costs of all tangible personal property other than that included in the equipment category. Specify general categories of supplies and their costs. Show computations and provide other information which supports the amount requested.

f. Contractual: Costs of all contracts for services and goods except for those that belong under other categories such as equipment, supplies, construction, etc.

Include third party evaluation contracts (if applicable) and contracts with secondary recipient organizations.

Demonstrate that all procurement transactions will be conducted in a manner to provide, to the maximum extent practical, open and free competition. Identify proposed sub-contractor work and the cost of each sub-contractor. Provide a detailed budget for each sub-contractor that is expected to perform work estimated to be $25,000 or more, or 50% of the total work effort, whichever is less.

• Identify each planned subcontractor and its total proposed budget. Each subcontractor's budget and supporting detail should be included as part of the applicant's budget narrative.

• Provide the following information for each planned subcontract: a brief description of the work to be subcontracted; the number of quotes solicited and received, if applicable; the cost or price analysis performed by the applicant;

names and addresses of the subcontractors tentatively selected and the basis for their selection; e.g., unique capabilities (for sole source subcontracts), low bidder, delivery schedule, technical competence; type of contract and estimated cost and fee or profit; and, affiliation with the applicant, if any.

• Recipient may be required to make pre-award review and procurement documents available to DHS, including request for proposals or invitations for bids, independent cost estimates, etc. This may include procurements expected to exceed the simplified acquisition threshold fixed at 41 USC 403(11) (currently set at $100,000) and expected to be awarded without competition or only one bid or offer is received in response to a solicitation.

• All required flow down provisions in the award must be included in any subcontract.

NOTE: Applicants may propose a sub-contract for specific tasks, such as hiring additional subject matter experts on a contractual basis. However, the applicant must demonstrate its ability to successfully manage all aspects of the grant- funded project, including financial management.

g. Other Direct Costs: Any other items proposed as direct costs. Provide an itemized list with costs, and state the basis for each proposed item.

h. Indirect Costs: Attach a copy of the latest indirect cost rate agreement negotiated with a cognizant federal agency. If the applicant is in the process of initially developing or renegotiating a rate, upon notification that an award will be made, it should immediately develop a tentative indirect cost rate proposal based on its most recently completed fiscal year, in accordance with the cognizant agency's guidelines for establishing indirect cost rates, and submit it to the cognizant agency. Applicants awaiting approval of their indirect cost proposals may also request indirect costs. When an indirect cost rate is requested, those costs included in the indirect cost pool should not also be charged as direct costs to the award. If the applicant is requesting a rate which is less than what is allowed under the program, the authorized representative of the applicant organization must submit a signed acknowledgement that the applicant is accepting a lower rate than allowed.

Any non-federal entity that has never received a negotiated indirect cost rate (except for those non-federal entities described in Appendix VII to Part 200 States and Local Government and Indian Tribe Indirect Cost Proposals, paragraph D.1.b) may elect to charge a de minimis rate of 10% of modified total direct costs (MTDC) which may be used indefinitely. As described in §200.403 Factors Affecting Allowability of Costs, costs must be consistently charged as either indirect or direct costs, but may not be double charged or inconsistently charged as both. If chosen, this methodology once elected must be used consistently for all federal awards until such time as a non-federal entity chooses to negotiate for a rate, which the non-federal entity may apply to do at any time. For more information, see 2 CFR Part 200.414.

5. Documentation of Non-profit and/or Public Status http://www.gpo.gov/fdsys/pkg/CFR-2014-title2-vol1/pdf/CFR-2014-title2-vol1-part200-appVII.pdf http://www.ecfr.gov/cgi-bin/text-idx?SID=fbb70fe83009e152ac327498f6ec18c4&node=se2.1.200_1403&rgn=div8 http://www.ecfr.gov/cgi-bin/text-idx?SID=b02738d16e4b0c1b82dc67a83ede6370&node=se2.1.200_1414&rgn=div8

The applicant must provide documentation of non-profit and/or public status. Any of the following constitutes acceptable proof of non-profit status:

• A reference to the applicant organization’s listing in the Internal Revenue Service’s (IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

• A copy of a currently valid IRS tax exemption certificate.

• A statement from a State taxing body, State attorney general, or other appropriate

State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

• A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

• Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

• A signed statement on official letterhead by an official authorized to apply for grant funds on behalf of the public entity shall suffice.

Attach documentation of non-profit and/or public status to the application package.

Dun and Bradstreet Universal Numbering System (DUNS) Number, System for Award Management (SAM), and Authorized Organizational Representative (AOR)

DHS is participating in the Grants.gov Initiative that provides the Grant Community a single site to find and apply for grant funding opportunities; therefore, applicants with electronic access are to submit their applications electronically through http://www.grants.gov/web/grants/applicants/apply-for-grants.html. Before you can apply for a DHS grant at grants.gov, you must have a DUNS number and must be registered in the System for Awards Management (SAM).

The DUNS number must be included in the data entry field labeled "Organizational DUNS" on the SF-424 form. Instructions for obtaining a DUNS number can be found at the following website: http://www.grants.gov//web/grants/applicants/organization-registration/step-1-obtain-duns-number.html

System for Award Management

In addition to having a DUNS number, applicants applying electronically through Grants.gov must register with the federal System for Award Management (SAM). Step-by-step instructions for registering with SAM can be found here:

http://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html. All applicants must register with SAM in order to apply online. Failure to http://www.grants.gov/web/grants/applicants/apply-for-grants.html http://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html http://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html http://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html http://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html http://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html http://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html register with the SAM will result in your application being rejected by Grants.gov during the submissions process.

Please give yourself plenty of time before your grant application submission deadline to obtain a DUNS number and then to register in SAM. It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information.

Authorized Organizational Representative

The next step in the registration process is creating a username and password with Grants.gov to become an Authorized Organizational Representative (AOR). AORs will need to know the DUNS number of the organization for which they will be submitting applications to complete this process. To read more detailed instructions for creating a profile on Grants.gov visit: http://www.grants.gov/web/grants/applicants/organization-registration/step-3-username-password.html.

AOR Authorization

After creating a profile on Grants.gov, the E-Biz Point of Contact (E-Biz POC) a representative from your organization who is the contact listed for SAM will receive an email to grant the AOR permission to submit applications on behalf of their organization.

The E-Biz POC will then log in to Grants.gov and approves an applicant as the AOR, thereby giving him or her permission to submit applications. To learn more about AOR Authorization visit: http://www.grants.gov/web/grants/applicants/organization-registration/step-4-aor-authorization.html. To track an AOR status visit:

http://www.grants.gov/web/grants/applicants/organization-registration/step-5-track-aor-status.html.

Applicants are, therefore, encouraged to register early. The registration process can take four weeks or more to be completed. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadlines. After you have been approved as an AOR you will be able to submit your application online.

Electronic Signature

Applications submitted through Grants.gov constitute a submission as electronically signed applications. The registration and account creation with Grants.gov with E-Biz POC approval, establishes an Authorized Organization Representative (AOR). When http://www.grants.gov/web/grants/applicants/organization-registration/step-3-username-password.html http://www.grants.gov/web/grants/applicants/organization-registration/step-3-username-password.html http://www.grants.gov/web/grants/applicants/organization-registration/step-3-username-password.html http://www.grants.gov/web/grants/applicants/organization-registration/step-4-aor-authorization.html http://www.grants.gov/web/grants/applicants/organization-registration/step-4-aor-authorization.html http://www.grants.gov/web/grants/applicants/organization-registration/step-4-aor-authorization.html http://www.grants.gov/web/grants/applicants/organization-registration/step-5-track-aor-status.html http://www.grants.gov/web/grants/applicants/organization-registration/step-5-track-aor-status.html http://www.grants.gov/web/grants/applicants/organization-registration/step-5-track-aor-status.html http://www.grants.gov/web/grants/applicants/organization-registration/step-5-track-aor-status.html you submit the application through Grants.gov, the name of your AOR on file will be inserted into the signature line of the…