FY 2024 SLCGP NOFO_Final_92524.pdf

FY 2024 SLCGP NOFO

The U. S. Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

Fiscal Year 2024 State and Local Cybersecurity Grant Program

All entities wishing to do business with the federal government must have a unique entity identifier (UEI). The UEI number is issued by the system. Requesting a UEI using System for Award Management (SAM.gov) can be found at: https://sam.gov/content/entity-registration.

Grants.gov registration information can be found at: https://www.grants.gov/register

Updates in Grant Application Forms:

The Data Universal Numbering System (DUNS) Number was replaced by a new, non-proprietary identifier requested in, and assigned by SAM.gov. This new identifier is the Unique Entity Identifier.

Additional Information can be found on Grants.gov: https://www.grants.gov/forms/forms-development/planned-uei-updates.

https://sam.gov/content/entity-%20registration https://sam.gov/content/entity-%20registration https://www.grants.gov/register https://www.grants.gov/forms/forms-development/planned-uei-updates https://www.grants.gov/forms/forms-development/planned-uei-updates

Table of Contents Updates in Grant Application Forms:

A. Program Description

1. Issued By

2. Assistance Listings Number

3. Assistance Listings Title

4. Funding Opportunity Title

5. Funding Opportunity Number

6. Authorizing Authority for Program

7. Appropriation Authority for Program

8. Announcement Type

9. Program Category

10. Program Overview, Objectives, and Priorities

a. Overview

b. Goals, Objectives, and Priorities

c. Alignment to Program Purpose and the DHS and FEMA Strategic Plan

11. Performance Measures B. Federal Award Information

1. Available Funding for the NOFO: $279,873,562

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

4. Projected Period of Performance Start Date: 2/01/2025

5. Projected Period of Performance End Date: 1/31/2029

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

2. Applicant Eligibility Criteria

3. Subawards and Beneficiaries

a. Subaward Allowability

b. Subrecipient Eligibility C. Other Subaward Information: Public Educational Institutions

d. Beneficiaries or Participants

4. Other Eligibility Criteria/Restrictions

5. Cost Share or Match

a. Types of Cost Share/Match

b. Cost Share Documentation

c. Calculating Cost Share for the Application

d. Calculating Cost Share for Projects

e. Future Cost Share Amounts

f. Cost Share Waiver

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: 09/23/2024 at 9:00 AM ET

b. Application Submission Deadline: 12/3/2024 at 5:00 PM ET

c. Anticipated Award Date: No later than 02/01/2025

d. Other Key Dates

2. Agreeing to Terms and Conditions of the Award

3. Address to Request Application Package

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM.gov)

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application

6. Electronic Delivery

7. How to Register to Apply

a. General Instructions:

b. Obtain an UEI Number:

c. Obtain Employer Identification Number

d. Create a login.gov account:

e. Register with SAM:

f. Register in FEMA GO, Add the Organization to the System, and Establish the AOR:

8. Submitting the Application

9. Timely Receipt Requirements and Proof of Timely Submission

10. Content and Form of Application Submission

a. Standard Required Application Forms and Information

b. Program-Specific Required Forms and Information

11. Other Submission Requirements

12. Intergovernmental Review

13. Funding Restrictions and Allowable Costs

a. Prohibitions on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services

b. Pre-Award Costs

c. Management and Administration (M&A) Costs

d. Indirect Facilities & Administrative (F&A) Costs

e. Evaluation Costs

f. Other Direct Costs

E. Application Review Information

1. Application Evaluation Criteria

a. Programmatic Criteria

b. Financial Integrity Criteria

c. Supplemental Financial Integrity Criteria and Review

2. Review and Selection Process F. Federal Award Administration Information

1. Notice of Award

2. Pass-Through Requirements

a. Documenting the Pass-Through

b. Rural Area Pass-Through

c. Exceptions to the Pass-Through Requirement

d. Timing

e. Other Guidance and Requirements for Passing Through Items, Services, Capabilities, or Activities in Lieu of Funding

3. Administrative and National Policy Requirements

a. DHS Standard Terms and Conditions

b. Ensuring the Protection of Civil Rights

c. Environmental Planning and Historic Preservation (EHP) Compliance

d. SAFECOM Guidance Compliance

e. Requirement for Using CISA Services

f. Mandatory Disclosures

e. Uniform Administrative Requirements, Cost Principles, and Audit Requirements .. 42

4. Reporting

a. Financial Reporting Requirements

b. Programmatic Performance Reporting Requirements

c. Closeout Reporting Requirements

d. Additional Reporting Requirements

5. Monitoring and Oversight G. DHS Awarding Agency Contact Information

1. Contact and Resource Information

a. FEMA Program Office Contact

b. CISA Grant Program Office Contact

c. FEMA Grants News

d. Grant Programs Directorate (GPD) Award Administration Division

e. Equal Rights

f. Environmental Planning and Historic Preservation

2. Systems Information

a. FEMA GO

H. Additional Information

1. Termination Provisions

a. Noncompliance

b. With the Consent of the Recipient

c. Notification by the Recipient

2. Program Evaluation

3. Period of Performance Extensions

4. Disability Integration

5. Conflicts of Interest in the Administration of Federal Awards or Subawards

6. Procurement Integrity

a. Important Changes to Procurement Standards in 2 C.F.R. Part 200

b. Competition and Conflicts of Interest

c. Supply Schedules and Purchasing Programs

d. Procurement Documentation

7. Financial Assistance Programs for Infrastructure

a. Build America, Buy America Act

b. Waivers

c. Definitions

8. Record Retention

a. Record Retention Period

b. Types of Records to Retain

9. Actions to Address Noncompliance

10. Audits

11. Payment Information

12. Whole Community Preparedness

13. Report issues of fraud, waste, abuse

14. Continuity Capability

15. Hazard-Resistant Building Codes

16. Appendices

Appendix A: Program Goals and Objectives Appendix B: Cybersecurity Planning Committee and Charter Appendix C: Cybersecurity Plan Appendix D: POETE Solution Areas for Investments Appendix E. SLCGP Requirements Matrix Appendix F: Required, Encouraged, and Optional Services, Memberships, and Resources

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA)/Grant Programs Directorate (GPD)

2. Assistance Listings Number

97.137

3. Assistance Listings Title State and Local Cybersecurity Grant Program

4. Funding Opportunity Title Fiscal Year 2024 State and Local Cybersecurity Grant Program (SLCGP)

5. Funding Opportunity Number

DHS-24-GPD-137-00-99

6. Authorizing Authority for Program Homeland Security Act of 2002, Pub. L. No. 107-296, § 2220A codified as amended at 6 U.S.C. § 665g

7. Appropriation Authority for Program

Infrastructure Investment and Jobs Act, Pub. L. No. 117-58, Division J, Title V

8. Announcement Type Initial

9. Program Category

Preparedness: Infrastructure Security

10. Program Overview, Objectives, and Priorities

a. Overview

Our nation faces unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure. Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities in critical infrastructure.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of state, local, and territorial (SLT) governments is an important homeland security mission and the primary focus of the State and Local Cybersecurity Grant Program (SLCGP). Through funding from the Infrastructure Investment and Jobs Act, referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies to strengthen the security of critical infrastructure and improve the resilience of services SLT governments provide their communities.

b. Goals, Objectives, and Priorities Goal: The goal of the SLCGP is to assist SLT governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the four years of SLCGP funding as applicants focus their Cybersecurity Plans, priorities, projects, and implementation toward addressing SLCGP objectives.

Objectives: Applicants are required to submit applications that address at least one of the following program objectives in their applications:

• Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

Applicants should refer to Appendix A, “Program Goals and Objectives” for more information on SLCGP program goals, objectives, sub-objectives, and desired outcomes required in their Fiscal Year (FY) 2024 SLCGP application.

Priorities:

CYBERSECURITY PLANS, COMMITTEES, AND CHARTER

The Homeland Security Act of 2002, as amended by the BIL, requires SLCGP grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the plan, and identify projects to implement using SLCGP funding. With the FY 2022 SLCGP, recipients were directed to accomplish the following:

• Establish a Cybersecurity Planning Committee;

• Develop a state-wide Cybersecurity Plan, unless the recipient already has a state-wide Cybersecurity Plan; and

• Use SLCGP funds to implement or revise a state-wide Cybersecurity Plan.

For those states that did not apply for FY 2022 or FY 2023 SLCGP funding, or for FY 2022 SLCGP recipients that were unable to meet the requirements listed above, please refer to Appendix A, “Program Goals and Objectives” and Appendix B, “Cybersecurity Planning Committee and Charter” for more information on the FY 2022 requirements that must be met before development of applications for FY 2024.

Cybersecurity Plan Renewals and Revisions All applicants with a Cybersecurity and Infrastructure Security Agency (CISA) approved Cybersecurity Plan must submit their current Cybersecurity Plan to CISA via the FEMA SLCGP Inbox at FEMA-SLCGP@fema.dhs.gov no later than January 30, 2025, and annually thereafter on the same date throughout the grant's period of performance. When submitting a Cybersecurity Plan, applicants must inform CISA if they revised their plan since CISA’s last approval of it. If the Cybersecurity Plan has been revised, applicants must provide a brief explanation of the revisions. Applicants are not required to revise a Cybersecurity Plan that CISA has approved unless CISA notifies the applicant that the plan does not meet plan requirements.

Eligible applicants must coordinate with the appropriate Cybersecurity and CISA Regional Representatives before submitting their Cybersecurity Plan, Investment Justifications (IJ), and/or Project Worksheet (PW) (See Section G of this funding notice for relevant contact information). Additionally, all updated plans must be approved by the entity’s respective Cybersecurity Planning Committee. For information on Cybersecurity Plans and recommended areas for updates, committees, and charter, please refer to Appendices A-C.

CYBERSECURITY ACTIVITIES

The State Administrative Agency (SAA) must consult with its Chief Information Officer (CIO) and the Chief Information Security Officer (CISO) (or an equivalent official of the eligible entity) regarding the plans for allocating SLCGP funds. To support the FY 2024 SLCGP requirements, Cybersecurity Plans must include the following activities:

a. Conducting assessment and evaluations as the basis for individual projects throughout the life of the program; and

b. Prioritizing key cybersecurity best practices and consulting Cybersecurity Performance Goals (CPGs).

i. The CPGs are a prioritized subset of information technology and operational technology cybersecurity practices aimed at meaningfully reducing risks to both critical infrastructure operations and the American people.

ii. These goals are applicable across all critical infrastructure sectors and are informed by the most common and impactful threats and adversary tactics, techniques, and procedures observed by CISA and its government and industry partners, making them a common set of protections that all critical infrastructure entities—from large to small—should implement.

iii. The CPGs do not reflect an all-encompassing cybersecurity program.

Rather, they are a minimum set of practices that organizations should implement toward ensuring a strong cybersecurity posture.

iv. The Cross-Sector CPGs are regularly updated, with a targeted revision cycle of at least every 6 to 12 months.

mailto:FEMA-SLCGP@fema.dhs.gov https://www.cisa.gov/cross-sector-cybersecurity-performance-goals https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

KEY CYBERSECURITY BEST PRACTICES FOR INDIVIDUAL PROJECTS

To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, state, local, territorial (SLT) governments must take decisive steps to modernize their approach to cybersecurity. As SLT governments increase their cybersecurity maturity, CISA recommends they move toward implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing. To assist in the revision of SLT cyber planning efforts, the following Cybersecurity Best Practices are provided. As appropriate, the strategic elements listed in the table below should be included in FY 2024 individual projects:

Cybersecurity Best Practices for Individual Projects Implement multi-factor authentication.

Implement enhanced logging.

Data encryption for data at rest and in transit.

End use of unsupported/end of life software and hardware that are accessible from the internet.

Prohibit use of known/fixed/default passwords and credentials.

Ensure the ability to reconstitute systems (backups).

Actively engage in bidirectional sharing between CISA and SLT entities in cyber relevant time frames to drive down cyber risk.

Migration to the .gov internet domain.

CYBERSECURITY INVESTMENTS AND PROJECTS

Given the Cybersecurity Plan is a strategic document, it should not identify specific vulnerabilities but instead capture the broad level of capability across the jurisdiction.

The Cybersecurity Plan must also show how the implementation of the individual projects and activities over time will help achieve the goals and objectives of the plan.

The summary of projects using FY 2024 SLCGP funds associated with each required and discretionary element provides a helpful snapshot of state and territory-wide capabilities and capacity that will be achieved as a result of this funding. Details for each project using SLCGP funds must be included in the IJs.

Each IJ must provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces, which have influenced the development of the IJ. The IJ must include a summary of the current capabilities within the applicant jurisdiction to address these threats and risks. The IJ should also include a description of how the proposed project addresses gaps identified in or sustainment of the approved Cybersecurity Plan, and how the project aligns to the cybersecurity elements in this NOFO. Finally, the IJ should include implementation planning data to assist in project management.

The PW will be used to identify the budget details and budget narrative portion of the application. Eligible applicants should submit only one PW as part of the overall application and must include information for each IJ submitted as part of the application for funding. More information on the IJ Form, PW, and instructions can be found in Section D.11 in this funding notice.

MULTI-ENTITY PROJECTS

Multiple eligible entities (states or territories) can group together to address cybersecurity risks and threats to information systems within the states and territories which are the eligible entities. There is no separate funding for multi-entity projects.

Instead, these investments would be considered as group projects: each group member contributing an agreed upon funding amount from their SLCGP award to the overall project. Each group member’s financial contribution is then funded from their individual SLCGP award. Each participating state or territory in the group should include the multi-entity project in their individual IJ submissions with their application. It is expected that IJs for multi-entity projects will be almost identical.

Any differences should reflect alignment with the entities’ respective Cybersecurity Plan.

The multi-entity project submissions must be approved by each of the participating state or territory’s Cybersecurity Planning Committees, and each of the multi-entity project submissions must be aligned with each of the participating state or territory’s respective Cybersecurity Plan. For multi-entity groups, each participating state or territory must have a CISA-approved Cybersecurity Plan. The project must improve or sustain capabilities identified in the respective Cybersecurity Plan for each eligible entity.

Multi-Entity Project Requirements and Process Overview The following must be included in each of the participating state or territory group members’ Cybersecurity Plans, the IJs, and PWs for the multi-entity project:

• A detailed description of the overall project;

• The division of responsibilities among each participating state or territory group member entity;

• The distribution of funding among the participating state or territory group member entities; and

• Overview of how implementation of the multi-entity project will help achieve the goals and objectives in the Cybersecurity Plan of each participating entity.

Multi-Entity Project Benefits A multi-entity project is funded from each participating state or territory group members’ SLCGP award in accordance with their agreed-upon contribution amounts.

Since the multi-entity group may be comprised of state and territory governments, each can benefit from information sharing and awareness opportunities. Multi-entity projects may permit smaller state and territory entities to combine resources with larger state and territory entities to reap the benefits associated with larger acquisitions. At the same time, all parties to a multi-entity project may realize cost savings due to volume purchases. Lastly, the non-federal cost share in FY 2024 SLCGP for the projects in a multi-entity project is 20%.

IMMINENT CYBERSECURITY THREAT

The SLCGP is primarily a security preparedness program focused on reducing cyber risks by helping SLT entities address cybersecurity vulnerabilities and build cybersecurity capabilities. Over time, the program activities and investments reduce the potential impact of cybersecurity threats and incidents. Section 2220A(d)(4) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(d)(4)) provides that “An eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section” may also use the grant to “assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the [CISA] Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.”

The following provides an overview of the imminent cybersecurity threat process for the FY 2024 grant cycle. Details on CISA’s criteria and process for confirming an imminent cybersecurity threat are not included here. The following also does not supersede or replace existing threat notification procedures or existing methods to collaborate on operational cybersecurity matters.

Process Overview

• Any eligible entity using SLCGP funds to address an imminent cybersecurity threat, as confirmed by the Secretary, acting through the CISA Director, must have a Cybersecurity Plan approved by CISA.

• DHS, through CISA, will determine if an incident constitutes as an imminent cybersecurity threat.

• Upon confirmation, DHS will notify the SLCGP SAA, and the SAA must notify the state or territory Cybersecurity Planning Committee and CIO/ CISO/equivalent.

• DHS will notify impacted SLT entities, as appropriate, of permissible activities to address imminent cybersecurity threats to the information systems owned or operated by, or on behalf of, SLT entities.

• FEMA will issue an Information Bulletin detailing the impacted entities and procedures for reprogramming SLCGP funds in support of the specific imminent cybersecurity threat. The scope of the Information Bulletin will be dependent on the nature of the imminent cybersecurity threat.

c. Alignment to Program Purpose and the DHS and FEMA Strategic Plan

The FY 2024 SLCGP aligns with the National Cybersecurity Strategy by addressing three of the five pillars:

• Pillar One – Defend Critical Infrastructure;

• Pillar Two – Disrupt and Dismantle Threat Actors; and

• Pillar Four – Invest in a Resilient Future.

The FY 2024 SLCGP also addresses the 2020–2024 DHS Strategic Plan by helping DHS achieve Goal 3: Secure Cyberspace and Critical Infrastructure. This includes Objective 3.2: Strengthen the Security and Resilience of Critical Infrastructure.

Additionally, the FY 2024 SLCGP supports the 2022–2026 FEMA Strategic Plan, which outlines a bold vision with three ambitious goals, including Goal 3: Promote https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 https://www.fema.gov/about/strategic-plan and Sustain a Ready FEMA and Prepared Nation, under which falls Objective 3.2:

Posture FEMA to Meet Current and Emergent Threats.

The FY 2024 SLCGP also aligns with the 2023–2025 CISA Strategic Plan, which encompasses Goal 1: Cyber Defense, Goal 2: Risk Reduction and Resilience, and Goal 3: Operational Collaboration.

11. Performance Measures DHS will communicate with all SLCGP SAA recipients on the information collection process related to performance measures data. To gauge overall program performance, recipients are required to report on the performance measures that are relevant to their plan implementation.

https://www.cisa.gov/resources-tools/resources/2023-2025-strategic-plan

Performance Measures

Number of satisfactory annual tabletop and full-scale exercises to test Cybersecurity Plans.

Amount of grant funds budgeted for cybersecurity exercises.

Percentage of grant funds expended on exercise plans for entities.

Number of annual cyber risk assessments conducted to identify cyber risk management gaps and areas for improvement.

Number of employees that successfully completed phishing training.

Number of employees that attended and successfully completed awareness campaign training.

Number of employees that received role-based cybersecurity awareness training.

Number of employees that completed continuous learning activities on current cyber threats.

Number of employees that completed education or training on software security concepts.1 Number of supporting capabilities implemented to analyze network traffic and activities related to potential threats.

Number of multi-factor authentication (MFA) instances that were implemented for all remote access and privileged accounts.

Number of supporting programs created to anticipate and discontinue end-of-life software and hardware.

Number of known/fixed/default passwords and credentials prohibited for use on networks.

Number of unique sites that transitioned to a .gov internet domain.

Number of CISA-identified cybersecurity vulnerabilities that were addressed.

Number of Endpoint Detection Response Systems that were funded for implementation.

Number of capabilities ratings improved.

Number of funding improvements that were made for Continuity of Operations Plans.

Number of SAA performance metrics that were met.

Percent of increase in the use of CISA Services.

Numbers of instances of increased use of Data Encryption.

Numbers of instances of increased use of Enhanced Logging.

Numbers of systems adopting System Reconstitution.

Percentage of increase in the membership in the Multi-State Information Sharing and Analysis Center (MS-ISAC).

B. Federal Award Information

1. Available Funding for the NOFO: $279,873,562

1 For the purpose of this grant, the term “software security concepts” refers to knowledge and understanding necessary to build secure software, including threat modeling, memory-safe languages, common classes of software defects, and adversarial thinking and training.

For FY 2024, DHS will award funds to states and territories based on baseline minimums and population as required by section 2200A(l) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(l)), described below.

Each state and territory will receive a baseline allocation using thresholds established in section 2200A(l) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(l)). All 50 States, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $3,047,666 each, equaling 1% of total funds made available for the SLCGP in FY 2024. Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $761,916, equaling 0.25% of the total funds made available for the SLCGP in FY 2024. $59,173,633, 50% of the remaining amount, will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories. The remaining $59,173,633, equaling the other 50% of the remaining amount, will be apportioned based on the ratio that the population of each state that resides in rural areas bears to the population of all states that resides in rural areas.

FY 2024 SLCGP Allocations State/Territory FY 2024 SLCGP

Allocation State/Territory FY 2024 SLCGP

Allocation Alabama $5,825,678 Nevada $3,771,437 Alaska $3,399,745 New Hampshire $3,808,572 Arizona $5,032,682 New Jersey $5,184,599 Arkansas $4,778,475 New Mexico $3,893,800 California $11,845,702 New York $8,723,252 Colorado $4,791,605 North Carolina $8,037,374 Connecticut $4,122,302 North Dakota $3,454,693 Delaware $3,377,360 Ohio $7,598,799 District of Columbia $3,166,373 Oklahoma $5,005,631 Florida $8,620,815 Oregon $4,515,523 Georgia $7,456,494 Pennsylvania $8,015,678 Hawaii $3,469,262 Rhode Island $3,326,808 Idaho $3,899,009 South Carolina $5,454,484 Illinois $6,724,174 South Dakota $3,545,617 Indiana $5,987,571 Tennessee $6,368,577 Iowa $4,654,856 Texas $12,616,798 Kansas $4,288,916 Utah $3,947,782 Kentucky $5,489,622 Vermont $3,530,689 Louisiana $5,017,296 Virginia $6,446,009 Maine $4,038,646 Washington $5,546,984 Maryland $4,924,161 West Virginia $4,232,345 Massachusetts $4,816,189 Wisconsin $5,806,564 Michigan $7,178,365 Wyoming $3,345,507 Minnesota $5,474,363 Puerto Rico $3,830,330 Mississippi $4,975,106 U.S. Virgin Islands $780,956 Missouri $5,805,583 American Samoa $781,333

State/Territory FY 2024 SLCGP Allocation

State/Territory FY 2024 SLCGP Allocation

Montana $3,695,624 Guam $803,899 Nebraska $3,864,098 Northern Mariana

Islands $779,450

Total $279,873,562

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

Extensions to the period of performance are allowed. For additional information on period of performance extensions, please refer to Section H of this NOFO.

4. Projected Period of Performance Start Date: 2/01/2025

5. Projected Period of Performance End Date: 1/31/2029

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

a. States and U.S. Territories

2. Applicant Eligibility Criteria

All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. The Governor-designated SLCGP SAA is the only entity eligible to submit SLCGP applications to DHS/FEMA. One or more states or territories may submit a multi-entity project.

“State” is defined in Section 2 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(17)) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

3. Subawards and Beneficiaries

a. Subaward Allowability Subawards are allowed for the SLCGP.

b. Subrecipient Eligibility Eligible subrecipients include local governments and do not include nonprofit and for-profit organizations. Section 2(13) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(13)) defines a local government as:

a. A county, municipality, city, town, township, local public authority, school district, special district, intrastate district, council of governments (regardless of whether the council of governments is incorporated as a nonprofit corporation under state law), regional or interstate government entity, or agency or instrumentality of a local government;

b. An Indian tribe or authorized tribal organization, or in Alaska a Native village or Alaska Regional Native Corporation2; and

c. A rural community, unincorporated town or village, or other public entity.

c. Other Subaward Information: Public Educational Institutions A public educational institution (e.g., elementary school, secondary school, or institution of higher education) is generally eligible to receive assistance under SLCGP if it is an agency or instrumentality of a state or local government under state and/or local law. In contrast, a private educational institution would not be eligible to receive SLCGP assistance because it is not an agency or instrumentality of a state or local government. “Assistance” means either funding, non-funding assistance (i.e., items, services, capabilities, or activities), or a combination of both. The eligibility of charter schools depends on the function of the charter school—it will be eligible if, and only if, it is an agency or an instrumentality of the state or local government.

The SAA for an SLCGP grant award is responsible for demonstrating the eligibility of each entity receiving assistance and should consult with FEMA if there is uncertainty regarding eligibility for a particular entity.

d. Beneficiaries or Participants This NOFO and any subsequent federal awards create no rights or causes of action for any participant or beneficiary. There are no beneficiaries or other participants beyond recipients and subrecipients that benefit or participate in federal awards under this

NOFO.

4. Other Eligibility Criteria/Restrictions All applicants with a CISA-approved Cybersecurity Plan must submit their current Cybersecurity Plan to CISA via the FEMA SLCGP Inbox at FEMA-SLCGP@fema.dhs.gov no later than January 30, 2025, and annually thereafter on the same date throughout the

2 Although tribes are not eligible to apply directly for SLCGP funding, they may be eligible subrecipients, and can receive SLCGP funding as a local government. Each individual SAA may determine whether and how much SLCGP funding to pass through to tribal entities. DHS does not have the authority to mandate that a certain percentage of SLCGP funds are directed to tribal governments.

grant's period of performance. Additional information on plan updates is described in Appendix C, “Cybersecurity Plan.”

5. Cost Share or Match Eligible entities must meet a 30% cost share requirement for the FY 2024 SLCGP. The cost share for multi-entity projects is 20%.

The recipient contribution can be cash (hard match) or third-party in-kind (soft match).

Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 30% of the total project costs (federal award amount plus cost share amount). For FY 2024, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands.

DHS/FEMA administers cost-matching requirements in accordance with 2 C.F.R. § 200.306.

To meet matching requirements, the recipient contributions must be verifiable, reasonable, allocable, and necessary, and otherwise allowable under the grant program, and in compliance with all applicable federal requirements and regulations. The non-federal cost share requirement cannot be matched with other federal funds, unless specifically authorized by the legislation governing that other source of federal funding.

The cost share applies to each activity funded by the grant award rather than just to the cumulative total of all activities. Recipients must ensure that each activity’s cost share is met.

DHS interprets “activity” to mean each individual project under the submitted PW. A PW must include cost share for each project as well as Management and Administration (M&A).

M&A must be included as a separate row in the PW. Also, the PW must include a description of the source of the cost share. Note for post-award documentation of cost share, if funds or services are to be provided by a third party for in-kind match, a dated letter of commitment is required to document the donation.

a. Types of Cost Share/Match

Hard Match (Cash) Cash or hard matching includes cash spent for project-related costs. The allowable cash match must include costs that are necessary, reasonable, and allowable under the SLCGP.

i. Examples: State or local general fund monies.

Soft Match (In-kind) Soft match refers to contributions of the reasonable value of property or services in lieu of cash which benefit a federally assisted project or program. This type of match may only be used if not restricted or prohibited by program statute, regulation or guidance and must be supported with source documentation. Only property or services that comply with program guidance and/or program regulations, are allowable. In other words, a recipient cannot use a source for the soft match that is completely unrelated to the SLCGP program’s goals, objectives, NOFO, etc. The same contribution cannot be used if it is already used as match for another grant program or paid from other grant funds.

Below are some examples of allowable soft match:

i. Example 1: A hotel offers a room or space to conduct a cybersecurity training event or tabletop exercise. The hotel manager should provide the SAA with written documentation of the room rental (dollar value), date/time of the donation, signed by the hotel manager. This should align with the date/time of the training or exercise event. And, per 2 C.F.R. 200.306, “The value of donated space must not exceed the fair rental value of comparable space as established by an independent appraisal of comparable space and facilities in a privately-owned building in the same locality.”

ii. Example 2: Contributions of salary, travel, equipment, supplies, and other budget areas that are from third party sources (in compliance with 2 C.F.R. 200.306) and include voluntary contributions such as emergency personnel, lawyers, etc., who donate their time to a federal grant program. The normal per hour rate for these professionals (acting in their professional capacity) can be used to meet the matching requirement. The value of the services provided is taken into consideration when determining the value of the contribution and not who is providing the service. For example, if a lawyer is volunteering his/her services to assist the Cybersecurity Planning Committee with preparing and filing legal paperwork for their Charter, the lawyer’s normal hourly rate is allowable.

However, if the lawyer is volunteering his/her time and services to conduct cybersecurity needs assessments as part of the state’s cybersecurity plan implementation, the lawyer’s hourly rate would not be applicable. Instead, the hourly rate for an information technology specialist would be more reasonable and applicable.

Unrecovered Indirect Costs With prior approval by FEMA, recipients may use unrecovered indirect costs for the cost share for FY 2024 SLCGP awards, as well as future SLCGP awards. All requests to use unrecovered indirect costs for cost share must be submitted to your FEMA SLCGP Preparedness Officer for consideration and approval. Recipients will be notified in writing if approval is granted. For additional information regarding indirect costs reference Section D.13.

b. Cost Share Documentation The source documentation for the cost share should be:

1. Valued at the time of the donation—value must not exceed the fair market value of the equipment of the same age and condition at the time of donation.

2. Signed and dated by the donating company, person, etc.

3. For third-party in-kind contributions, the fair market value of goods and services must be documented and, to the extent feasible, supported by the same methods used internally by the non-federal entity.

c. Calculating Cost Share for the Application

Applicants must make available non-federal funds or soft match (in-kind contributions) to carry out an SLCGP award in an amount not less than 30% of the total project costs (federal award amount plus cost share amount). The cost share for the multi-entity projects is 20% for

FY 2024.

Formula: Federal Award Amount / Federal Share Percentage = Total Project Cost Total Project Cost x Cost Share Percentage = Cost Share Amount

i. Example: If the federal award is $1,000,000 with a 70% federal share percentage and a 30% cost share percentage, the cost share amount is calculated below:

• $1,000,000 (Federal Award Amount) / .70 = $1,428,571 (Total Project Cost)

• $1,428,571 x .30 = $428,571 (Cost Share Amount)

d. Calculating Cost Share for Projects

Cost share must be provided on a project basis. To calculate cost share for a project, please see the following formula and example:

Formula: Total Project Cost x Cost Share Percentage of the Project = Cost Share Amount;

Total Project Cost x Federal Percentage Share of the Project = Federal Amount for the Project

i. Example: If the total project cost is $125,000, the cost share percentage of the project is 30% and the federal percentage share of the project is 70%, the cost share amount for the project and federal amount for the project is calculated below:

• $125,000 x .30 = $37,500 (Cost Share Amount for Project)

• $125,000 x .70 = $87,500 (Federal Share Amount for Project)

e. Future Cost Share Amounts

For SLCGP planning purposes, the following chart indicates the federal share and cost share percentages for SLCGP FY 2022 - 2025:

Federal fiscal year (FFY)

Single Entity Project Multi-Entity Project Federal share percentage

Non-federal cost share percentage

Federal share percentage

Non-federal cost share percentage

2022 90% 10% 100% 0% 2023 80% 20% 90% 10% 2024 70% 30% 80% 20% 2025 60% 40% 70% 30%

f. Cost Share Waiver

The Secretary of Homeland Security (or designee) may waive or modify the non-federal share for an individual entity if the entity demonstrates economic hardship. The Homeland Security Act of 2002, as amended, requires SLCGP recipients in FY 2024 to provide a non-federal cost share of 30% if they are applying as a single entity (6 U.S.C. § 665g(m)(1)).

However, DHS is not able to provide additional funds even if it does grant a cost share waiver. The federal funding will remain at the same amount as indicated by the statutory formula.

Additionally, in accordance with 48 U.S.C. § 1469a cost share requirements for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands are waived.

Economic Hardship Factors 6 U.S.C. § 665g(m)(2)(C) requires the Secretary of Homeland Security (or designee) to consider the following factors when determining economic hardship:

a. Changes in rates of unemployment in the jurisdiction from previous years;

b. Changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the Food and Nutrition Act of 2008 (7 U.S.C. § 2011 et seq.) from previous years; and

c. Any other factors the Secretary considers appropriate.

For FY 2024, the Secretary (or designee) will consider the following additional factors in determining economic hardship:

a. Demonstration that the rate of unemployment has exceeded the annual national average rate of unemployment for three of the past five years;

b. Demonstration that the entity has filed for bankruptcy or been placed under third-party financial oversight or receivership within the past three years; and

c. For local units of government only, demonstration that those localities have areas within them that are designated as “disadvantaged” on the Climate and Economic Justice Screening Tool (CEJST).

To be considered for a cost share waiver, eligible entities must meet at least one of the five factors described above, but do not necessarily need to meet all of them. Requests for waivers will be considered on a case-by-case basis and evaluated holistically. The applicant is required to submit documentation supporting their request for an Economic Hardship Waiver at the award level at time of the application by attaching the supporting document to the grant application.

Cost Share Waiver Request Requirements To request a waiver, an eligible entity must submit a written narrative, including the following three categories to demonstrate economic hardship, with its FY 2024 SLCGP application submission in FEMA GO:

a. History: A description of the entity’s background/history of economic hardship.

b. Austerity: Describe any measures the entity has taken to address economic hardship.

c. Operational Impact: Describe how the lack of a waiver will impact the entity’s ability to develop, implement, or revise a Cybersecurity Plan or address imminent cybersecurity threats.

A detailed justification explaining why the state (or specific local government(s) or specific project(s) if requesting only a partial waiver) is unable to fulfill the cost share requirement.

The applicant must identify specific economic hardship(s) and address the factors listed above.

Approval Process Once a decision on a waiver request is made, the SLCGP SAA will be notified in writing. If approved, the award package will indicate that the cost share has been waived in full or in part and might indicate a requirement for the state to submit a revised budget and/or scope (as applicable) for the identified project(s). If the waiver request is approved after the award has been issued, FEMA will amend the award package to indicate that the cost share has been waived in full or in part and whether the recipient must submit a revised budget and/or scope (as applicable) for the identified project(s).

Questions regarding the cost share waiver process may be directed to your FEMA Preparedness Officer by emailing FEMA-SLCGP@fema.dhs.gov.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: 09/23/2024 at 9:00 AM ET

b. Application Submission Deadline: 12/3/2024 at 5:00 PM ET

All applications must be received by the established deadline.

FEMA’s Grants Outcomes System (FEMA GO) automatically records proof of timely submission and the system generates an electronic date/time stamp when FEMA GO successfully receives the application. The individual with the Authorized Organization Representative role that submitted the application will also receive the official date/time stamp and a FEMA GO tracking number in an email serving as proof of their timely submission. For additional information on how an applicant will be notified of application receipt, see the subsection titled “Timely Receipt Requirements and Proof of Timely Submission” in Section D of this NOFO.

FEMA will not review applications that are received after the deadline or consider these late applications for funding. FEMA may, however, extend the application deadline on request for any applicant who can demonstrate that good cause exists to justify extending the deadline. Good cause for an extension may include technical problems outside of the applicant’s control that prevent submission of the application by the deadline, other exigent or emergency circumstances, or statutory requirements for FEMA to make an award.

Applicants experiencing technical problems outside of their control must notify FEMA as soon as possible and before the application deadline. Failure to timely notify FEMA of the issue that prevented the timely filing of the application may preclude consideration of the award. “Timely notification” of FEMA means the following: prior to the application deadline and within 48 hours after the applicant became aware of the issue.

A list of FEMA contacts can be found in Section G of this NOFO, “DHS Awarding Agency Contact Information.” For technical assistance with the FEMA GO system, please contact the FEMA GO Helpdesk at femago@fema.dhs.gov or (877) 585-3242, Monday through Friday, 9:00 AM – 6:00 PM ET. For programmatic or grants management questions, please contact mailto:FEMA-SLCGP@fema.dhs.gov https://go.fema.gov/ mailto:femago@fema.dhs.gov your Preparedness Officer or Grants Management Specialist. If applicants do not know who to contact or if there are programmatic questions or concerns, please contact FEMA Grants News at fema-grants-news@fema.dhs.gov, Monday through Friday, 9:00 AM – 5:00 PM ET.

c. Anticipated Award Date: No later than 02/01/2025

d. Other Key Dates

2. Agreeing to Terms and Conditions of the Award

By submitting an application, applicants agree to comply with the requirements of this NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package Applications are processed through the FEMA GO system. To access the system, go to https://go.fema.gov/.

Hard copies of the NOFO can be downloaded at Grants.gov or obtained via email from the Awarding Office points of contact listed in Section G of this NOFO, “DHS Awarding Agency Contact Information” or by TTY (800) 462-7585.

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for Award Management (SAM.gov) Each applicant, unless they have a valid exception under 2 C.F.R.§25.110, must:

a. Be registered in SAM.gov before application submission.

b. Provide a valid UEI in its application.

c. Continue to always maintain an active SAM registration with current information during the federal award process. Note: Per 2 C.F.R. § 25.300, subrecipients are NOT required to go through the full SAM registration process. First-tier subrecipients (meaning entities receiving funds directly from the recipient) are only required to obtain a UEI through SAM, but they are not required to complete the full SAM registration in order to obtain a UEI. Recipients may not make subawards unless the subrecipient has obtained and provided the UEI.

Event Suggested Deadline for Completion Obtaining Unique Entity Identifier (UEI) number

Four weeks before actual submission deadline

Obtaining a valid Employer Identification Number (EIN) Four weeks before actual submission deadline

Creating an account with login.gov Four weeks before actual submission deadline Registering in SAM or updating SAM registration Four weeks before actual submission deadline

Registering Organization in FEMA GO Prior to beginning application

Submitting complete application in FEMA GO One week before actual submission deadline mailto:fema-grants-news@fema.dhs.gov https://go.fema.gov/ https://www.grants.gov/ https://sam.gov/content/home

Lower-tier subrecipients (meaning entities receiving funds passed through by a higher-tier subrecipient) are not required to have a UEI and are not required to register in SAM.

Applicants are also not permitted to require subrecipients to complete a full registration in SAM beyond obtaining the UEI.

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application Applying for an award under this program is a multi-step process and requires time to complete. Applicants are encouraged to register early as the registration process can take four weeks or more to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadlines.

Please review the table above for estimated deadlines to complete each of the steps listed.

Failure of an applicant to comply with any of the required steps before the deadline for submitting an application may disqualify that application from funding.

To apply for an award under this program, all applicants must:

a. Apply for, update, or verify their UEI number and Employer Identification Number (EIN) from the Internal Revenue Service;

b. In the application, provide an UEI number;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before submitting the…