FY 20 SLTT Extension NOFO_FINAL_7-17-2020.pdf

SLTT IOC Automation Pilot

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

State, Local, Tribal and Territorial Indicators of Compromise Automation Pilot

NOTE: If you are going to apply for this funding opportunity and have not obtained a Data Universal Numbering System (DUNS) number and/or are not currently registered in the System for Award Management (SAM), please take immediate action to obtain a DUNS Number, if applicable, and then to register immediately in SAM. It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information. Information on obtaining a DUNS number and registering in SAM is available from Grants.gov at:

http://www.grants.gov/web/grants/register.html Detailed information regarding DUNS and SAM is also provided in Section D of this NOFO, subsection, Content and Form of Application Submission.

A. Program Description

Issued By U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Stakeholder Engagement (SED)

Assistance Listings Number (formerly Catalog of Federal Domestic Assistance Number) 97.128

Assistance Listing Title (formerly CFDA Title) National Cybersecurity Awareness

Notice of Funding Opportunity Title State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot

NOFO Number DHS–20-CISA-128-SLT001 (previously DHS–19-CISA-128-SLT001)

Authorizing Authority for Program Homeland Security Act of 2002, as amended by the Cybersecurity and Infrastructure Security Agency Act of 2018, National Cybersecurity Protection Act of 2014, Executive Order (EO) 13636, Executive Order 13691, Presidential Policy Directive (PPD) 21

Appropriation Authority for Program Consolidated Appropriations Act, 2020, P.L. 116-93, Division D, Title III, Cybersecurity and Infrastructure Security Agency

Announcement Type Modification http://www.grants.gov/web/grants/register.html

Program Overview, Objectives, and Priorities The Cybersecurity and Infrastructure Security Agency, Cybersecurity Division, Stakeholder Engagement and Cyber Infrastructure Resilience (SECIR) extend a cooperative agreement for a pilot titled “State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot which was awarded in fiscal year 2019. This agreement supports implementation of the Homeland Security Act of 2002, as amended by the Cybersecurity and Infrastructure Security Agency Act of 2018, Subtitle A, SEC. 2209, specifically with respect to facilitating information sharing related to cybersecurity risks, incidents, analysis, and warnings, and providing technical assistance.

Justification: the nature of the cybersecurity threat to America is growing, and our nation’s cyber adversaries move with speed and stealth. To keep pace, all types of organizations, including those beyond traditional critical infrastructure sectors, need to be able to share information and respond to cyber risk in as close to real-time as possible. Organizations engaged in information sharing and responding to indicators of compromise in “real-time” play an invaluable role in the collective cybersecurity of the United States.

The purpose of this cooperative agreement is to extend the period of performance for the previously selected recipient to apply the usage of automation to enhance and speed the evaluation of threat Indicators of Compromise (IOC) at the state and local government levels. In addition, the pilot will identify key areas for potential reduction of manual tasks by humans and actionable information sharing across enterprises and SLTT. The pilot will also identify orchestration services needed to integrate the activities of sensing, understanding, decision-making, and acting. The grant recipient may select up to five states and/or localities to participate in the pilot project. The pilot project will focus on developing model processes, methods, and accompanying policies and procedures that can be applied by SLTT to accomplish the following:

• Action upon IOCs within minutes of receipt.

• Reduce time spent on repetitive tasks.

• Provide generation, enrichment and scoring of IOCs.

• Receipt, remediation and response to IOCs.

• Demonstrate the use of Security Orchestration, Automation, and Response (SOAR) operational procedures and capabilities combined with information sharing to make data more actionable and enable consistent execution at and across SLTT levels.

• Development of repeatable processes for orchestration and automation services that bridge existing SLTT policies with SOAR capabilities.

This NOFO is an extension of a previously awarded project selected via DHS–19-CISA-128-SLT001.

Metrics and Measures

Security Automation an Orchestration (SA&O) Operational Performance measures and metrics

Quarterly Performance Metrics must be submitted to the DHS Grants Officer no later than 30 days after the end of each quarter. Reports are due October 30, January 31, April 30 and July 31.

Reports shall be submitted via the GrantSolutions Grant Note feature using the Grant Note submission guidance found here: https://www.grantsolutions.gov/support/granteeUsers.html.

SA&O metrics and measures assist organizations in recognizing and refining how SA&O capabilities and techniques introduce benefits, value and effects. This document identifies metrics and measures that organizations may find beneficial to collect, assess, and compare over time.

Groupings

1. Operational Performance - evaluate & recognize SA&O value, benefits, issues and effects as it relates to security operations and performance.

2. System Performance - evaluate & recognize value, issues and effects as it relates to your Cyber security infrastructure, practices and SA&O support.

3. Process Performance – evaluate & recognize value, issues, and effects as it relates to organizational, practice and process dependencies that directly impact SA&O value.

4. Workflow Execution - assist organizations to design, develop, monitor, tune, troubleshoot and maintain SA&O capabilities.

* The groupings are general to highlight types of metrics and measures and are not comprehensive

As organizations apply SA&O capabilities, there is value in collecting information to help assess utility, applicability, (in) efficiency, and reliability of the implementations. It is also useful to collect information that identifies dependencies, opportunities for improvements, or changes in performance. Lastly, it may be important to collect audit information to support deployment testing or compliance verification.

Metrics and Measures may be tailored for performance indicators as:

• Quantitative – measure of value (number, time, $, ratio)

• Qualitative – measure of acceptability or health

• Thresholds – when an index reaches set targets or falls into set ranges

• Milestones – when a specific condition is reached

• Trends – results analyzed over time and volume

Metrics and Measures

The following tables provide insight into metrics and measures that can be captured or produced by SA&O systems. Each entry includes a description and rationale/utility examples.

http://www.grantsolutions.gov/support/granteeUsers.html

SA&O Operational Performance measures and metrics Assist organizations to evaluate and recognize SA&O value, benefits, issues and effects. They offer insights for how SA&O has been applied, efficiencies gained, cyber security operations effectiveness and overall Return on Investment (ROI) context. Because they are directly related to reasons that organizations invest in SA&O, most of these metrics and measures are already “provided” by orchestration providers and described in industry resources.

Measure/Metric Description Rationale/Utility Identifies or Informs

Operational Performance

1. Mean time to notification

Time between a potential malicious activity detected and an alert is provided to the person or system responsible for investigating.

• Summarize operational value when compared with prior practices

• Example: Time lapse notifying SOC tier 1 support

2. Mean time to investigation

Once an alert has been sent, how much time passes before the investigation begins and what is the duration of the investigation?

• Throughput

• Summarize operational value

• Ability to handle higher volumes of investigations, alerts and data

• Example: Time lapse between notification and when an automated workflow or analyst begins investigating

3. Mean time to remediation

From alert to investigation to remediation, total elapsed time.

• Summarize operational value

• If organization achieving quicker detection and response

• Example: Average time to resolve a number of major vs.

minor incidents

4. Remediation summary statistics

Statistics tracking manual, semi- automated and automated remediation

• Characterize the level of automation applied in operations

• Track progression for each type of remediation

• Summarize operational value

• Example: Summarize the types of incidents aided by workflows for remediation

5. Percent Investigated

vs. Alert Volume

Investigations vs. alert volume • Security Operations risk gap

• How SA&O aids investigations compared to the volume of alert data

6. Performance Improvements

Information collected to show how automation is improving processes and resource utilization.

• Operational value in terms of performance

• Resource savings

• Examples: speed of decision/resolution, resource utilization improvement (e.g., devices run faster due to less malware, increased network bandwidth due to blocking malware related traffic)

System Performance measures and metrics Assist organizations to evaluate & recognize value, issues and effects as it relates to your cyber security infrastructure, practices and SA&O support. They offer insights for how SA&O has been implemented, orchestration management, and cyber security product/service value as related to automation in operations.

System Performance and Utilization

7. Workflow utility Track how many incidents and types of incidents were aided by workflows.

• Utilization trends

• Operational value for incident and alert triage

• Operational practices and dependencies

• Example: Identify if workflows are or could address common incidents/alerts in part or whole.

8. Sensor utilization Track playbook/workflow dependencies on sensors, threat feeds and data sources.

• Potential impact of compromised or unavailable sensor(s)

• Heavily vs. underutilized sensor(s)

• Which sensors aid investigation and/or remediation actions

• Example: Which workflows rely on real- time packet capture analysis?

Impact if it were to become unavailable?

9. Sensor value Track which sensors, threat feeds and data (sources) aided an investigation or remediation

• Potential impact of compromised or unavailable sensor(s)

• High valued vs. underutilized sensor(s)

• Sensor tuning effectiveness

• Which sensors aid investigation and/or remediation actions

• Example: Types of logs or threat feeds and indicators proven effective

10. Threat Indicator or IOC value

Track which threat indicator(s) aided an investigation or remediation

• Types and sources of indicators aiding security operations

11. Queued workflows or actions

Number of playbooks, workflows, investigations queued

• Ability to scale and support demand

• Identify system bottlenecks

• Throughput

• System failures

• Examples: Understanding if the system is capable of supporting operational demand

12. Concurrency/ Parallel workflows

Number of playbooks, workflows or investigations executed per time period

• Ability to scale and support demand

• Examples: Comparing workflow executions with Incident triage in peak time periods

13. Workflow interface dependencies

Track which product integration interfaces were used in or are required for workflow execution

• Security infrastructure dependencies

• Common, duplicative vs.

purposely separated system interfaces

• Example: Common dependency on a logging interface and impact if it were to become compromised or unavailable.

14. Performance Degradation Information collected to show how automated processes are negatively impacting system or process performance.

• Counterproductive operational impact

• Example: boundary protection devices run slower due to increasingly large blacklists or decreased network bandwidth due to queries to support internal enrichment of IOCs

15. Custom Measures & Metrics

Enable admins and users to create and save measures or calculations for use in analysis

• Performance measures and Key Performance Indicators differ by organization, culture and goals.

Offer the flexibility for organizations to define and analyze performance and results.

• Examples: unauthorized software/devices identified in investigations, percentage of devices with current patches, detected non- compliance with business conduct policies, and number of reported vs. detected security incidents

Process Performance measures and metrics Assist organizations to evaluate & recognize value, issues, and effects as it relates to organizational, practice and process dependencies that directly impact SA&O value. They offer insights for how SA&O efficiency and effectiveness may be impacted by dependencies on external, manual, poorly-defined, and/or cross-organizational processes.

Process Performance

16. External process dependencies Identifies workflows that have a dependency on an external process or system

• Operational dependencies across organizations, systems, tools and practitioners

Examples: Third party service or cloud providers, inter-organizational relationships NOC/SOC/IT

17. Workflows Track playbook/workflow • Workflows that require an approval or human interaction as part of execution

• Workflows that can execute without human interaction

• Classifying how different types of workflows may benefit by manual or automated validation, verification and/or audit.

• Example: Identify frequently executed workflows with a history of high confidence execution still requiring human interaction.

requiring dependencies on human human interaction intervention

(as designed)

18. Workflow effectiveness

Track which workflows were effective for their intended goal

vs. required additional investigation or analysis.

• Poorly defined processes that cannot be automated consistently

• Opportunities to enhance workflows and reduce manual processing required

• Additional sensors, sources and/or analysis techniques relevant to the task

• Example: Percentage or number of investigations and workflows which required unanticipated analyst investigation support.

19. Analyst/ Practitioner/ Organization interactions

Track which organizations and staff were required to interact with a workflow to facilitate an end goal.

Track within and across connected workflows

• Organizational dependencies

• Opportunities to streamline operations across organizations

• Inform service level agreements between organizations

• Examples: SOC, NOC, IT, Helpdesk, and Legal

Workflow Execution measures and metrics Assist organizations in verifying that SA&O performance is achieving intended effects. As part of that, these metrics and measures assist organizations in the design, development, monitoring/auditing, tuning, troubleshooting, and maintenance of SA&O capabilities.

Workflow Execution

20. Frequency of workflow revisions

Statistics tracking the frequency of workflow/playbook revisions

• Stability of workflows

• Complexity of workflows

• Controlled administration, configuration & tuning

• Audit authorized & verified changes

• Automated tests to verify and validate results and intent.

• Example: Stable workflows suddenly revised or unapproved changes to operational practices.

21. Frequency of workflow execution

Statistics tracking the frequency of workflow/playbook execution

• Potential impact to operations if compromised or unavailable

• Frequency of initiating condition or alerts

• Example: Identify how often the workflow executes during business hours

22. Frequency of remediation actions taken

Statistics tracking the frequency of actions taken to remediate threats/risks

• Audit changes made to operational assets

• Frequency of changes made to certain operational assets

• Example: Identify how often the workflow executes different actions in response to same trigger

23. Workflow utilization Track how many times a workflow is selected manually

vs. automated and runs.

• Utilization trends (heavily vs.

underutilized)

• Operational practices and dependencies

• Example: Identify if and how analysts and/or automated responses are applying workflows.

24. Workflow value

Savings estimate by multiplying the cost of performing repetitive tasks manually by the estimated number of times the system performs those tasks automatically during a specific date/time range.

• Estimated time and/or cost savings

• Return on Investment (ROI)

25. Workflow confidence level

Statistics tracking the frequency automated recommendations are confirmed for execution

• Confidence in semi-automated/automated COA recommendations

• Potential workflows to enhance with automation

• Example: Workflow confidence score increases given the frequency analysts concur with recommendations.

26. Workflow idle time Statistics tracking times workflows were paused waiting for data, a decision, action or approval.

• Efficiency opportunities for processes and workflows

• Throughput/efficiency constraints

• Sources of bottlenecks

• Example: SOC workflow commonly requires network operations center (NOC) concurrence which is taking 24- 48hrs. Opportunity to accelerate between departments?

27. Workflow reliability Track successful vs.

unsuccessful executions.

(success, failure, error rates)

• Reliability trends

• Failures common across workflows

• Example: Workflow A is highly reliable while workflow B commonly requires unplanned manual intervention and should be considered for revision.

28. Workflow decision processing

Capture triggering condition, key values/decision points, and end state

• Verify that certain actions are taken if and only if certain conditions are true.

• Example: provide evidence that a critical server is not taken offline and reset unless another service is verified as online first.

29. Workflow dwell time Statistics tracking workflow execution times

• Performance (typical vs. abnormal)

• Change in system or capabilities

• Example: A workflow typically requires 1 minute to complete and is noted taking 2+ mins. Intended or unintended change?

30. Workflow deployment readiness

Evidence verifying and validating workflows are defined by compliant practices and execute as intended.

• Workflow dependencies

• If workflows can be verified, audited and validated

• Examples: verification that initiating feeds are working, timing information on how long certain paths or steps take, responses from sensors or actuators tasked

B. Federal Award Information

Award Amounts, Important Dates, and Extensions Available Funding for the NOFO: $500,000.00.

Projected number of Awards (Optional): 1 (one) award.

Period of Performance: 12 months.

This NOFO extends the current period of performance by 12 months to complete the pilot project as previously awarded.

No-cost extensions to the Performance Period may be considered but are not guaranteed.

Extension approvals will be based on the availability of funds within the award and acceptable performance.

Projected Period of Performance Start Date(s): 09/30/2019

Projected Period of Performance End Date(s): 09/30/2021

Funding Instrument: Discretionary – Competitive – Cooperative Agreement

DHS will exercise substantial programmatic involvement through this cooperative agreement.

This includes conducting site visits and quarterly monitoring of project progress; providing technical assistance; overseeing agency review and approval required at the completion of one stage of the work prior to moving on to subsequent phases; reviewing and approving of sub-grants that exceed standard regulatory approvals; work plans or modifications thereto; holding kickoff meetings; conducting bi-annual programmatic reviews; coordinating standards development and self-certification activities.

The grants officer will oversee the execution of the grant and the overall performance of the awardee from an administrative and financial perspective.

C. Eligibility Information

Eligible Applicants

This funding opportunity to extend the State Local Tribal and Territorial (SLTT) Indicators of Compromise

– Automation Pilot project is restricted to the current performer as previously selected under DHS–19-

CISA-128-SLT001.

Maintenance of Effort (MOE) There is no maintenance of effort requirement for this program. Requests for funds under this announcement shall not be used to take the place of activities described in the application that are currently supported with other funding. Also, grant funds shall not be used to support activities that are a normal part of the organization’s operations.

Cost Share or Match There is no cost share or match requirement for this program.

D. Application and Submission Information

Key Dates and Times

Date Posted to Grants.gov: 07/20/2020

Application Submission Deadline: 08/10/2020 at 11:59:59 /PM [EDT] Late applications will not be accepted

Anticipated Funding Selection Date: 08/24/2020 Anticipated Award Date: 08/31/2020

Address to Request Application Package

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov , select “Applicants” then “Apply for Grants.” In order to obtain the application package select “Download a Grant Application Package.” Enter the CFDA and/or the funding opportunity number located on the cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

For a hardcopy of the full NOFO, please write or fax a request to:

Stephanie Dawkins Grants Officer stephanie.dawkins@hq.dhs.gov Phone: 202-447-0495

In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice is: 1-800-518-4726 (Grants.gov Help Desk).

Applications will be processed through the Grants.gov portal. If you experience difficulties accessing information or have any questions, please call Grants.gov customer support at 1-800-518-4726.

Hard copy applications will not be accepted.

Content and Form of Application Submission Applicants must submit all required forms and required documents listed in this section. See the Grants.gov Applicant User Guide for instructions on how to attach forms and documents.

Applicant should ensure that the final submitted application package includes all required forms and documents. Applicants should avoid the use of special characters in attachment file names.

Unique Entity Identifier and System for Award Management (SAM) All applicants for this award must:

1. Be registered in SAM before submitting its application;

2. Provide a valid DUNS number in its application; and

3. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a DHS FAO.

DHS may not make a federal award to an applicant until the applicant has complied with all applicable DUNS and SAM requirements and, if an applicant has not fully complied with the requirements by the time DHS is ready to make a federal award. DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for http://www.grants.gov/ mailto:stephanie.dawkins@hq.dhs.gov https://www.grants.gov/help/html/help/index.htm#t=Applicants%2FGrantApplications.htm making a federal award to another applicant.

The Standard Language for Using Grants.gov Apply is provided to aid in fulfilling these requirements:

Electronic Delivery

DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages applicants to submit their applications online through Grants.gov.

How to Register to Apply through Grants.gov

1. Instructions: Read the instructions below about registering to apply for DHS funds.

Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required application submission deadlines.

Organizations must have a Data Universal Numbering System (DUNS) Number, active System for Award Management (SAM) registration, and Grants.gov account to apply for grants.

If individual applicants are eligible to apply for this grant funding opportunity, refer to: https://www.grants.gov/web/grants/applicants/registration.html

Organization applicants can find complete instructions here:

https://www.grants.gov/web/grants/applicants/organization-registration.html

2. Obtain a DUNS Number: All entities applying for funding, including renewal funding, must have a Data Universal Numbering System (DUNS) number from Dun & Bradstreet (D&B). Applicants must enter the DUNS number in the data entry field labeled "Organizational DUNS" on the SF-424 Form.

For more detailed instructions for obtaining a DUNS number, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html

3. Register with SAM: In addition to having a DUNS number, all organizations applying online through Grants.gov must register with the System for Award Management (SAM). Failure to register with SAM will prevent your organization from applying http://www.grants.gov/web/grants/applicants/registration.html http://www.grants.gov/web/grants/applicants/registration.html http://www.grants.gov/web/grants/applicants/organization-registration.html https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html through Grants.gov. SAM registration must be renewed annually.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html

4. Create a Grants.gov Account: The next step in the registration process is to create an account with Grants.gov. Applicants must know their organization's DUNS number to complete this process.

For more information, follow the on-screen instructions or refer to:

https://www.grants.gov/web/grants/applicants/registration.html

5. Add a Profile to a Grants.gov Account: A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, enter the DUNS Number for the organization in the DUNS field while adding a profile.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/add-profile.html

6. EBiz POC Authorized Profile Roles: After you register with Grants.gov and create an

Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the AOR role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html

7. Track Role Status: To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html

8. Electronic Signature: When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature.

The EBiz POC must authorize individuals who are able to make legally binding commitments on behalf of the organization as an AOR; this step is often missed and it is crucial for valid and timely submissions.

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/registration.html http://www.grants.gov/web/grants/applicants/registration/add-profile.html http://www.grants.gov/web/grants/applicants/registration/add-profile.html http://www.grants.gov/web/grants/applicants/registration/authorize-roles.html http://www.grants.gov/web/grants/applicants/registration/track-role-status.html http://www.grants.gov/web/grants/applicants/registration/track-role-status.html

How to Submit an Application to DHS via Grants.gov

Grants.gov applicants can apply online using Workspace. Workspace is a shared, online environment where members of a grant team may simultaneously access and edit different webforms within an application. For each funding opportunity announcement (FOA), you can create individual instances of a workspace.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html

1. Create a Workspace: Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

2. Complete a Workspace: Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission.

3. Adobe Reader: If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace so that they will appear similar to other Standard or DHS forms. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at:

https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

4. Mandatory Fields in Forms: In the forms, you will note fields marked with an asterisk and a different background color. These fields are mandatory fields that must be completed to successfully submit your application.

5. Complete SF-424 Fields First: The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and DUNS number.

To trigger this feature, an applicant must complete the SF-424 information first.

Once it is completed, the information will transfer to the other forms.

6. Submit a Workspace: An application may be submitted through workspace by clicking the “Sign and Submit” button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24- 48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application submission.

7. Track a Workspace: After successfully submitting a workspace package, a Grants.gov

Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the Confirmation page that is generated http://www.grants.gov/web/grants/applicants/workspace-overview.html http://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

For additional training resources, including video tutorials, refer to:

https://www.grants.gov/web/grants/applicants/applicant-training.html

Applicant Support: Grants.gov provides applicants 24/7 support via the toll-free number 1-800- 518-4726 and email at support@grants.gov. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist the DHS with tracking your issue and understanding background information on the issue.

Timely Receipt Requirements and Proof of Timely Submission

Online Submissions. All applications must be received by Midnight Eastern Daylight Time the due date established for each program. Proof of timely submission is automatically recorded by Grants.gov. An electronic date/time stamp is generated within the system when the application is successfully received by Grants.gov. The applicant with the AOR role who submitted the application will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from Grants.gov with the successful transmission of their application.

This applicant with the AOR role will also receive the official date/time stamp and Grants.gov Tracking number in an email serving as proof of their timely submission.

When DHS successfully retrieves the application from Grants.gov, and acknowledges the download of submissions, Grants.gov will provide an electronic acknowledgment of receipt of the application to the email address of the applicant with the AOR role who submitted the application. Again, proof of timely submission shall be the official date and time that Grants.gov receives your application. Applications received by Grants.gov after the established due date for the program will be considered late and will not be considered for funding by DHS.

Applicants using slow internet, such as dial-up connections, should be aware that transmission can take some time before Grants.gov receives your application. Again, Grants.gov will provide either an error or a successfully received transmission in the form of an email sent to the applicant with the AOR role. The Grants.gov Support Center reports that some applicants end the transmission because they think that nothing is occurring during the transmission process. Please be patient and give the system time to process the application.

Intergovernmental Review

An intergovernmental review may be required. Applicants must contact their state’s Single Point of Contact (SPOC) to comply with the state’s process under Executive Order 12372.

https://www.grants.gov/web/grants/applicants/applicant-training https://www.grants.gov/web/grants/applicants/applicant-training mailto:support@grants.gov

(See https://www.archives.gov/federal-register/codification/executive-order/12372.html;

https://www.whitehouse.gov/wp-content/uploads/2019/02/SPOC-February-2019.pdf).

Funding Restrictions Restrictions on Use of Award Funds

As well as any funding restrictions stated in the Budget Narrative section or any section within this document, the following are restrictions on use of award funds:

1. DHS cooperative agreement funds may only be used for the purpose set forth in the cooperative agreement, and must be consistent with the statutory authority for the award. Cooperative agreement funds and non-monetary support may not be used for matching contributions for other federal grants or cooperative agreements, lobbying, or intervention in federal regulatory or adjudicatory proceedings. Federal employees are prohibited from serving in any capacity (paid or unpaid) on any proposal submitted under this program. Federal employees may not receive funds under this award. In addition, federal funds may not be used to sue the Federal Government or any other government entity.

DHS substantial programmatic involvement and performance/progress reviews may result in funding restrictions in conjunction with initial and annual continuation awards.

Management and Administration (M&A) Costs.

M&A is allowable by the primary recipient, if applicable.

Indirect Facilities & Administrative (F&A) Costs.

Indirect Costs are allowable for the grantee and any proposed sub-awardee (if applicable). The applicant must attach a copy of the latest indirect cost rate agreement negotiated with a cognizant federal agency. If the applicant is in the process of initially developing or renegotiating a rate, upon notification that an award will be made, it should immediately develop a tentative indirect cost rate proposal based on its most recently completed fiscal year, in accordance with the cognizant agency's guidelines for establishing indirect cost rates, and submit it to the cognizant agency. Applicants awaiting approval of their indirect cost proposals may also request indirect costs. When an indirect cost rate is requested, those costs included in the indirect cost pool should not also be charged as direct costs to the award. If the applicant is requesting a rate which is less than what is allowed under the program, the authorized representative of the applicant organization must submit a signed acknowledgement that the applicant is accepting a lower rate than allowed.

Any non-Federal entity that has never received a negotiated indirect cost rate (except for those non-federal entities described in Appendix VII to Part 200 States and Local Government and Indian Tribe Indirect Cost Proposals, paragraph D.1.b) may elect to charge a de minimis rate of https://www.archives.gov/federal-register/codification/executive-order/12372.html https://www.whitehouse.gov/wp-content/uploads/2019/02/SPOC-February-2019.pdf

10% of modified total direct costs (MTDC) which may be used indefinitely. As described in §200.403 Factors Affecting Allowability of Costs, costs must be consistently charged as either indirect or direct costs, but may not be double charged or inconsistently charged as both. If chosen, this methodology once elected must be used consistently for all federal awards until such time as a non-federal entity chooses to negotiate for a rate, which the non-federal entity may apply to do at any time. For more information, see 2 CFR Part 200.414.

Other Submission Requirements

To access application forms and instructions for this funding opportunity, go to Grants.gov click on the “Search Grants” tab. Enter the FOA Number located on the cover of this announcement.

Click on the highlighted Funding Opportunity # that appears and then click on the various tabs to: read the Synopsis; review the Version History; read the Full Announcement; and, complete the Application Package. Please read the entire FOA Application Package carefully before preparing and submitting an application. Application must be submitted in electronic format only.

If you experience difficulties accessing information or have any questions please call the grants.gov customer support hotline at (800) 518-4726.

E. Application Review Information

Review and Selection Process

N/A - This NOFO is an extension of a previously awarded project selected via DHS–19-CISA-128- SLT001. No formal criteria and selection process will be used because this is a non-competing extension and continuation of an existing award. The original applications were reviewed by subject matter experts. Extension/Continuation applicants will be required to submit a new budget which will go through a program and cost analysis review by the Program and Grants Officer.

Financial Integrity Criteria Prior to making a federal award, the DHS Grants and Financial Assistance Division is required by 31

U.S.C. § 3321 note, 41 U.S.C. § 2313, and 2 C.F.R. § 200.205 to review information available through any OMB-designated repositories of government wide eligibility qualification or financial integrity information. Therefore, application evaluation criteria may include the following risk-based considerations of the applicant:

1) Financial stability.

2) Quality of management systems and ability to meet management standards.

3) History of performance in managing federal award.

4) Reports and findings from audits.

5) Ability to effectively implement statutory, regulatory, or other requirements.

Supplemental Financial Integrity Criteria and Review Prior to making a federal award where the anticipated total federal share will be greater than the simplified acquisition threshold, currently $250,000 (see Section 805 of the National Defense

Authorization Act for Fiscal Year 2018, Pub. L. No. 115-91, OMB Memorandum M-18-18 at https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-18.pdf):

1) DHS Grants and Financial Assistance Division is required to review and consider any information about the applicant that is in the designated integrity and performance system accessible through SAM, which is currently the Federal Awardee Performance and Integrity Information System (FAPIIS) and is accessible through the SAM website.

2) An applicant, at its option, may review information in FAPIIS and comment on any information about itself that a federal awarding agency previously entered.

3) DHS Grants and Financial Assistance Division will consider any comments by the applicant, in addition to the other information in FAPIIS, in making a judgment about the applicant’s integrity, business ethics, and record of performance under federal awards when completing the review of risk posed by applicants as described in 2 C.F.R. § 200.205.

F. Federal Award Administration Information

1. Notice of Award

DHS issues formal award notification documents following fulfillment of DHS Congressional notifications. All DHS grants and cooperative agreements are subject to the standard DHS Award Terms and Conditions, which are attached to this package.

A grant award will be executed by a DHS Grants Officer authorized to obligate DHS funding. Unsuccessful applicants will be contacted as well and will be encouraged to apply for future grant award programs. Announcements for future programs will be listed at http://www.grants.gov

2. Administrative and National Policy Requirements

All successful applicants for all DHS grant and cooperative agreements are required to comply with DHS Standard Administrative Terms and Conditions, which are available online at:

DHS Standard Terms and Conditions

The applicable DHS Standard Terms and Conditions will be for the last year specified at that URL, unless the application is for a continuation award. In that event, the terms and conditions in effect for the fiscal year that award was originally made will apply.

Before accepting the award, the AOR should carefully read the award package for instructions on administering the grant award and the terms and conditions associated with responsibilities under federal awards. Recipients must accept all conditions in this NOFO as well as any special terms and conditions in the Notice of Award to receive an award under this program.

3. Reporting

a. Federal Financial Reporting Requirements.

https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-18.pdf https://www.fapiis.gov/fapiis/index.action https://www.fapiis.gov/fapiis/index.action https://www.sam.gov/SAM/ http://www.grants.gov/ http://www.dhs.gov/publication/fy15-dhs-standard-terms-and-conditions

The Federal Financial Reporting Form (FFR) is available online at:

SF-425 OMB #4040-0014

b. Program Performance Reporting Requirements The recipient is required to submit the following performance reports:

Quarterly Performance Reports must be submitted to the DHS Grants Officer no later than 30 days after the end of each quarter. Reports are due October 30, January 31, April 30, and July 31.

Reports shall be submitted via the GrantSolutions Grant Notes feature using the Grant Note submission guidance found here: https://www.grantsolutions.gov/support/granteeUsers.html.

Performance reports must provide information on the overall progress of the pilot. These reports shall also include:

i. Summary reports on the strategic vision and activities; management efforts; performance reports on each funded project, along with explanations of any changes from the initially approved work plan, discussion of progress for each milestone and explanations of why milestones were not reached, the performance metrics used; budget expenditures and changes;

unanticipated problems and plans for addressing them; and information on how project outcomes will advance or impact current technologies or capabilities.

ii. Budget information categorized by both object class and project.

iii. If applicable, include a certification that no patentable inventions were created during the budget period.

iv. Updates to the Information Protection Plan and Researcher Safety Plan as needed.

If the performance report contains any information that is deemed proprietary, the Recipient will denote the beginning and ending of such information with the following heading: ******PROPRIETARY

INFORMATION******

Final Performance Report. The Recipient shall submit the Final Performance Report to the DHS Grants Officer no later than 90 days after the expiration of the Project Period (See Section I). The Final Performance Report must include an executive summary and final summary abstracts for each sub-project shall be submitted via the GrantSolutions Grant Notes feature using the Grant Note submission guidance found here: https://www.grantsolutions.gov/support/granteeUsers.html.

c. Close Out Reporting Requirements

Within 90 days after the end of the period of performance, or after an amendment has been issued to close out a grant, recipients must submit the following:

The final request for payment, if applicable;

1) The final FFR (SF-425);

2) The final progress report detailing all accomplishments;

3) A qualitative narrative summary of the impact of those accomplishments throughout the period of performance; and

4) Other documents required by this NOFO, terms and conditions of the award, or other DHS Grants and Financial Assistance Division guidance.

https://www.grants.gov/web/grants/forms/post-award-reporting-forms.html#sortby=1 https://www.grantsolutions.gov/support/granteeUsers.html https://www.grantsolutions.gov/support/granteeUsers.html

If applicable, an inventory of all construction projects that used funds from this program must be reported with the final progress report.

After these reports have been reviewed and approved by DHS Grants and Financial Assistance Division, a closeout notice will be completed to close out the grant. The notice will indicate the period of performance as closed, list any remaining funds that will be deobligated, and address the requirement of maintaining the grant records for three years from the date of the final FFR, unless a longer period applies, such as due to an audit or litigation, for equipment or real property used beyond the period of performance, or due to other circumstances outlined in 2 C.F.R. § 200.333.

In addition, any recipient that issues subawards to any subrecipient is responsible for closing out those subawards as described in 2 C.F.R. § 200.343. Recipients acting as pass-through entities must ensure that they complete the closeout of their subawards in time to submit all necessary documentation and information to DHS Grants and Financial Assistance during the closeout of their prime grant award.

The recipient is responsible for returning any funds that have been drawn down but remain as unliquidated on recipient financial records.

d. Disclosing Information per 2 C.F.R. § 180.335 This reporting requirement pertains to disclosing information related to government-wide suspension and debarment requirements. Before a recipient enters into a grant award with DHS Grants and Financial Assistance Division, the recipient must notify DHS Grants and Financial Assistance Division if it knows if it or any of the recipient’s principals under the award fall under one or more of the four criteria listed at 2 C.F.R. § 180.335:

1) Are presently excluded or disqualified;

2) Have been convicted within the preceding three years of any of the offenses listed in 2

C.F.R. § 180.800(a) or had a civil judgment rendered against it or any of the recipient’s principals for one of those offenses within that time period;

3) Are presently indicted for or otherwise criminally or civilly charged by a governmental entity (federal, state or local) with commission of any of the offenses listed in 2 C.F.R. § 180.800(a); or

4) Have had one or more public transactions (federal, state, or local) terminated within the preceding three years for cause or default.

At any time after accepting the award, if the recipient learns that it or any of its principals falls under one or more of the criteria listed at 2 C.F.R. § 180.335, the recipient must provide immediate written notice to DHS Grants and Financial Assistance Division in accordance with 2 C.F.R. § 180.350.

e. Reporting of Matters Related to Recipient Integrity and Performance (if applicable)

Per 2 C.F.R. Part 200, Appendix I § F.3, the additional post-award reporting requirements in 2 C.F.R.

Part 200, Appendix XII may apply to applicants who, if upon becoming recipients, have a total value of currently active grants, cooperative agreements, and procurement contracts from all federal awarding agencies that exceeds $10,000,000 for any period of time during the period of performance of an award under this funding opportunity. Recipients that meet these criteria must maintain current information reported in FAPIIS about civil, criminal, or administrative proceedings described in paragraph 2 of Appendix XII at the reporting frequency described in paragraph 4 of Appendix XII.

4. Monitoring Per 2 C.F.R. § 200.336, DHS Grants and Financial Assistance Division through…