FY 2025 SLCGP NOFO_508.pdf

The Department of Homeland Security (DHS)

Notice of Funding Opportunity (NOFO)

Fiscal Year (FY) 2025 State and Local Cybersecurity Grant Program (SLCGP)

Fraud, waste, abuse, mismanagement, and other criminal or noncriminal misconduct related to this program may be reported to the Office of Inspector General (OIG) Hotline. The toll-free numbers to call are 1 (800) 323-8603 and TTY 1 (844) 889-4357.

Contents

1. Basic Information

A. Agency Name B. NOFO Title C. Announcement Type D. Funding Opportunity Number E. Assistance Listing Number F. Expected Total Funding G. Anticipated Number of Awards H. Expected Award Range I. Projected Application Start Date J. Projected Application End Date K. Anticipated Funding Selection Date L. Anticipated Award Date M. Projected Period of Performance Start Date N. Projected Period of Performance End Date O. Executive Summary P. Agency Contact

2. Eligibility A. Eligible Entities/ Entity Types B. Project Type Eligibility C. Requirements for Personnel, Partners, and Other Parties D. Maximum Number of Applications E. Additional Restrictions F. References for Eligibility Factors within the NOFO G. Cost Sharing Requirement H. Cost Share Description, Type and Restrictions I. Cost Share Calculation Example J. Required information for verifying Cost Share

3. Program Description A. Background, Program Purpose, and Program History B. Goal, Objectives, and Priorities C. Program Rationale D. Federal Assistance Type E. Performance Measures and Targets F. Program-Specific Unallowable Costs

G. General Funding Requirements H. Indirect Costs (Facilities and Administrative Costs) I. Management and Administration Costs J. Pre-Award Costs K. Beneficiary Eligibility L. Participant Eligibility M. Authorizing Authority N. Appropriation Authority O. Budget Period P. Prohibition on Covered Equipment or Services

4. Application Contents and Format A. Pre-Application, Letter of Intent, and Whitepapers B. Application Content and Format C. Application Components D. Program-Specific Required Documents and Information E. Post-Application Requirements for Successful Applicants

5. Submission Requirements and Deadlines A. Address to Request Application Package B. Application Deadline C. Pre-Application Requirements Deadline D. Post-Application Requirements Deadline E. Effects of Missing the Deadline

6. Intergovernmental Review A. Requirement Description and State Single Point of Contact

7. Application Review Information A. Threshold Criteria B. Application Criteria

a. Programmatic Criteria

b. Review and Selection Process

c. Financial Integrity Criteria

d. Supplemental Financial Integrity Criteria and Review C. Reviewers and Reviewer Selection D. Merit Review Process E. Final Selection

8. Award Notices A. Notice of Award B. Pass-Through Requirements C. Note Regarding Pre-Award Costs D. Obligation of Funds E. Notification to Unsuccessful Applicants

9. Post-Award Requirements and Administration A. Administrative and National Policy Requirements B. DHS Standard Terms and Conditions C. Financial Reporting Requirements D. Programmatic Performance Reporting Requirements E. Closeout Reporting Requirements

F. Disclosing Information per 2 C.F.R. § 180.335 G. Reporting of Matters Related to Recipient Integrity and Performance H. Single Audit Report I. Monitoring and Oversight J. Program Evaluation K. Additional Performance Reporting Requirements L. Termination of the Federal Award M. Best Practice N. Payment Information O. Immigration Conditions]

10. Other Information A. Period of Performance Extension B. Other Information

11. Appendix A: SLCGP Requirements Matrix

12. Appendix B: Required, Encouraged, and Optional Services, Memberships, and Resources . 51

13. Appendix C: Sample Performance Progress Report (PPR) and Sample Cyber Performance

Narrative for Progress Reporting

14. Appendix D: POETE Solution Areas for Investments

1. Basic Information A. Agency Name U.S. Department of Homeland Security (DHS), Federal Emergency

Management Agency (FEMA) B. NOFO Title Fiscal Year (FY) 2025 State and Local Cybersecurity Grant Program

(SLCGP) Notice of Funding Opportunity (NOFO) C. Announcement Type

Initial

D. Funding Opportunity Number

DHS-25-GPD-137-00-99

E. Assistance Listing Number

97.137

F. Expected Total Funding

$91,750,000

G. Anticipated Number of Awards

56 awards

H. Expected Award Range

$255,679 – $4,174,163

I. Projected Application Start Date

08/1/2025 4:00 p.m. Eastern Time (ET)

J. Projected Application End Date

08/15/2025 5:00 p.m. Eastern Time (ET)

K. Anticipated Funding Selection Date

08/502025

L. Anticipated Award Date

09/09/2025

M. Projected Period of Performance Start Date

09/01/2025

N. Projected Period of Performance End Date

08/31/2029

O. Executive Summary

Our nation faces unprecedented threats to the homeland from increasingly sophisticated criminal groups and nation-state actors.

State, local, and territorial (SLT) entities stand at the forefront of cyber defense. This partnership includes enforcing laws, assisting the federal government in securing borders and cyberspace, and dismantling transnational criminal organizations. Cybersecurity threats, including ransomware intrusions, and widespread software vulnerabilities affecting SLT systems and critical infrastructure are increasingly exploited by malicious actors, operating both domestically and abroad. To strengthen the essential partnership DHS maintains with its SLT partners in executing its mission, DHS is committed to supporting SLT efforts to combat cybersecurity threats and mitigate risks that endanger these vital functions.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of SLT governments is the focus of the SLCGP. Through funding from the Infrastructure Investment and Jobs Act, referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies to that strengthen the security of critical infrastructure and improve the cybersecurity resilience of services SLT governments provide their communities.

P. Agency Contact a. FEMA SLCGP Program Office Contact The FEMA SLCGP Program Office can provide general information on all FEMA grant programs and additional guidance surrounding questions on SLCGP administration. Applicants and recipients may contact their FEMA Preparedness Officer, the Cyber Section Chief, or the Cyber Branch Chief for more information by email at FEMA- SLCGP@fema.dhs.gov.

b. CISA Grant Program Office Contact The Cybersecurity and Infrastructure Security Agency (CISA) Grant Program Office, including programmatic and regional staff, are available to provide general information regarding the SLCGP and additional guidance surrounding programmatic requirements and performance metrics. Applicants and recipients can contact their CISA grant program staff and regional staff for more information by email at SLCGPinfo@mail.cisa.dhs.gov.

c. FEMA Grants News This channel provides general information on all FEMA grant programs and maintains a comprehensive database containing key personnel contact information at the federal, state, and local levels.

FEMA Grants News Team is reachable at fema-grants-news@fema.dhs.gov OR (800) 368-6498, Monday through Friday, 9:00 AM – 5:00 PM ET.

d. FEMA Grant Programs Directorate (GPD) Award Administration Division FEMA GPD’s Award Administration Division (AAD) provides support regarding financial matters and budgetary technical assistance.

AAD can be contacted at ASK-GMD@fema.dhs.gov.

e. Civil Rights Consistent with Executive Order 14173, Ending Illegal Discrimination & Restoring Merit-Based Opportunity, the FEMA Office of Civil Rights is responsible for ensuring compliance with and mailto:FEMA-SLCGP@fema.dhs.gov mailto:FEMA-SLCGP@fema.dhs.gov mailto:SLCGPinfo@mail.cisa.dhs.gov mailto:fema-grants-news@fema.dhs.gov mailto:fema-grants-news@fema.dhs.gov mailto:ASK-GMD@fema.dhs.gov enforcement of federal civil rights obligations in connection with programs and services conducted by FEMA. They are reachable at FEMA-CivilRightsOffice@fema.dhs.gov.

e. Environmental Planning and Historic Preservation The FEMA Office of Environmental Planning and Historic Preservation (OEHP) provides guidance and information about the EHP review process to FEMA programs and recipients and subrecipients. Send any inquiries regarding compliance for FEMA grant projects under this NOFO to FEMA-OEHP- NOFOQuestions@fema.dhs.gov.

f. FEMA Grants Outcomes (GO) For technical assistance with the FEMA GO system, contact the FEMA GO Helpdesk at femago@fema.dhs.gov or (877) 585-3242, Monday through Friday, 9:00 AM – 6:00 PM ET.

2. Eligibility A. Eligible Entities/ Entity Types

Only the following entities or entity types are eligible to apply.

a. Applicants All 56 states and territories, as listed in the definition for “State” below, are eligible to apply for SLCGP funds. The Governor-designated SLCGP State Administrative Agency (SAA) is the only entity eligible to submit SLCGP applications to DHS.1 One or more states or territories may submit a multi-entity project.

“State” is defined in Section 2 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(17)) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

b. Subapplicants Subapplicants and subawards are allowed. Subapplicants should not have foreign nationals or noncitizens included. If a subapplicant has foreign nationals, they must be properly vetted and must adhere to all government statues, polices, and procedures including “staff American, stay in America” and security requirements.

1 As used in this NOFO, “DHS” includes CISA and FEMA, which are components of the U.S. Department of Homeland Security.

mailto:FEMA-CivilRightsOffice@fema.dhs.gov mailto:FEMA-OEHP-NOFOQuestions@fema.dhs.gov mailto:FEMA-OEHP-NOFOQuestions@fema.dhs.gov mailto:femago@fema.dhs.gov

Eligible subrecipients include local governments and do not include nonprofit and for-profit organizations. Section 2(13) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 101(11)) defines local government.

Other Subaward Information: Public Educational Institutions A public educational institution (e.g., elementary school, secondary school, or institution of higher education) is generally eligible to receive assistance under SLCGP if it is an agency or instrumentality of a state or local government under state and/or local law. In contrast, a private educational institution would not be eligible to receive SLCGP assistance because it is not an agency or instrumentality of a state or local government. “Assistance” means either funding, non-funding assistance (i.e., items, services, capabilities, or activities), or a combination of both. The eligibility of charter schools depends on the function of the charter school—it will be eligible if, and only if, it is an agency or an instrumentality of the state or local government.

The SAA for an SLCGP grant award is responsible for demonstrating the eligibility of each entity receiving assistance, as described in section 2b. above, and should consult with DHS if there is uncertainty regarding eligibility for a particular entity.

B. Project Type Eligibility

a. Unallowable Costs for SLCGP Projects Unallowable costs are described in Section 3.G, “Program-Specific Unallowable Costs” in this NOFO.

b. Allowable Costs for SLCGP Projects Please see the Appendix D, “Planning, Organization, Equipment, Training, and/or Exercises (POETE) Solution Areas for Investment” for more information on allowable costs related to the POETE Solution Areas.

Allowable SLCGP costs, pre-award costs, M&A costs and indirect costs are described in Section 3.H – 3.J.

C. Requirements for Personnel, Partners, and Other Parties

Subapplicants should not have foreign nationals or noncitizens included. If a subapplicant has foreign nationals, they must be properly vetted and must adhere to all government statues, polices, and procedures including “staff American, stay in America” and security requirements.

Subapplicants/subrecipients must submit short bios and resumes. This should include the type of entity, organizational leadership, and board members along with the both the names and addresses of the individuals. Resumes are subject to approval.

D. Maximum Number of Applications

The maximum number of applications that can be submitted is:

1. A maximum of one application per eligible entity.

https://uscode.house.gov/view.xhtml?req=granuleid:USC-2007-title6-section101&num=0&edition=2007 https://uscode.house.gov/view.xhtml?req=granuleid:USC-2007-title6-section101&num=0&edition=2007

E. Additional Restrictions

Applicants/subapplicants or recipients/subrecipients are required to certify their compliance with federal statutes, DHS directives, policies, and procedures.

F. References for Eligibility Factors within the NOFO

Please see the following references provided below:

1. “Responsiveness Review Criteria” subsection

2. “Financial Integrity Criteria” subsection

3. “Supplemental Financial Integrity Criteria and Review” subsection

4. FEMA may/will request financial information such as

Employer Identification Number (EIN) and bank information as part of the potential award selection. This will apply to everyone prospered, including subrecipients.

All recipients are required to submit the following documentation:

1. Cybersecurity Plan (resubmission, if required)

2. Cybersecurity Planning Committee Membership List and

Charter

All SLCGP recipients and subrecipients are required to participate in a limited number of free services by CISA, with specific requirements depending upon the entity and type of funding received.

Additional information on SLCGP requirements are detailed in Appendix A, “SLCGP Requirements Matrix” and Appendix B, “Required, Encouraged, and Optional Services, Memberships, and Resources.”

G. Cost Sharing Requirement

Applicants selected for this award must agree to an acceptable cost share agreement. Otherwise, they will not be funded. For FY 2025, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands.

Project-based Cost Share: Section 2220A of the Homeland Security Act of 2002 requires a state to meet a nonfederal matching requirement for an “activity” carried out under an SLCGP grant award. DHS interprets the term “activity” to be an approved “project” under an SLCGP grant award and administers the nonfederal matching requirement in accordance with 2 C.F.R. § 200.306.

Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 40% of the total project costs (federal award amount plus cost share amount, rounded to the nearest whole dollar). The cost share for the multi-entity projects is 30% for FY 2025.

H. Cost Share Description, Type and Restrictions

DHS administers cost-matching requirements in accordance with 2 C.F.R. § 200.306. To meet matching requirements, the recipient contributions must be verifiable, reasonable, allocable, and necessary, and otherwise allowable under the grant program, and in compliance with all applicable federal requirements and regulations. The non-federal cost share requirement cannot be matched with other federal funds, unless specifically authorized by the legislation governing that other source of federal funding.

The cost share applies to each project funded by the grant award rather than just to the cumulative total of all projects. Recipients must ensure that each project’s cost share is met. A Project Worksheet (PW) must include cost share for each project as well as Management and Administration (M&A). M&A must be included as a separate row in the PW. Also, the PW must include a description of the source of the cost share. Note for post-award documentation of cost share, if funds or services are to be provided by a third-party for in-kind match, a dated letter of commitment is required to document the donation.

The recipient contribution can be cash (hard match) or third-party in-kind (soft match).

Types of Cost Share/Match

1. Hard Match (Cash)

Cash or hard matching includes cash spent for project-related costs. The allowable cash match must include costs that are necessary, reasonable, and allowable under the SLCGP. State or local general fund monies is an example of hard match.

2. Soft Match (In-kind)

Soft match refers to contributions of the reasonable value of property or services in lieu of cash which benefit a federally assisted project or program. This type of match may only be used if not restricted or prohibited by program statute, regulation, or guidance and must be supported with source documentation. Only property or services that comply with program guidance and/or program regulations, are allowable. In other words, a recipient cannot use a source for the soft match that is completely unrelated to the SLCGP’s goals, objectives, and allowable costs identified in the NOFO, etc. The same contribution cannot be used if it is already used as match for another grant program or paid from other grant funds. Below are some examples of allowable soft match:

a. Example 1: A hotel offers a room or space to conduct a cybersecurity training event or tabletop exercise. The hotel manager should provide the SAA with written documentation of the room rental (dollar value), date/time of the donation, signed by the hotel manager. This should align with the date/time of the training or exercise event. And, per 2 C.F.R.

200.306, “The value of donated space must not exceed the fair rental value of comparable space as established by an independent appraisal of comparable space and facilities in a privately-owned building in the same locality.”

b. Example 2: Contributions of salary, travel, equipment, supplies, and other budget areas that are from third-party sources (in compliance with 2 C.F.R. 200.306) and include voluntary contributions such as emergency personnel, lawyers, etc., who donate their time to a federal grant program. The normal per hour rate for these professionals (acting in their professional capacity) can be used to meet the matching requirement. The value of the services provided is taken into consideration when determining the value of the contribution and not who is providing the service. For example, if a lawyer is volunteering his/her services to assist the Cybersecurity Planning Committee with preparing and filing legal paperwork for their Charter, the lawyer’s normal hourly rate is allowable.

However, if the lawyer is volunteering his/her time and services to conduct cybersecurity needs assessments as part of the state’s cybersecurity plan implementation, the lawyer’s hourly rate would not be applicable. Instead, the hourly rate for an information technology specialist would be more reasonable and applicable.

I. Cost Share Calculation Example

Calculating Cost Share for the Application on the Project Worksheet

Formula: Federal Award Amount / Federal Share Percentage = Total Project Cost

Cost Share Percentage = Cost Share Amount (rounded up to the nearest whole dollar)

Example: If the federal award is $1,000,000 with a 60% federal share percentage and a 40% cost share percentage, the cost share amount is calculated below:

• $1,000,000 (Federal Award Amount) / .60 = $1,666,667 (Total Project Cost)

• $1,666,667 x .40 = $666,667 (Cost Share Amount)

Calculating Cost Share for Projects on the Project Worksheet Cost share must be provided on a project basis. To calculate cost share for a project, please see the following formula and example:

Formula: Total Project Cost x Cost Share Percentage of the Project = Cost Share Amount; Total Project Cost x Federal Percentage Share of the Project = Federal Amount for the Project

Example: If the total project cost is $125,000, the cost share percentage of the project is 40% and the federal percentage share of the project is 60%, the cost share amount for the project and federal amount for the project is calculated below:

• $125,000 x .40 = $50,000 (Cost Share Amount for Project)

• $125,000 x .60 = $75,000 (Federal Share Amount for Project)

J. Required information for verifying Cost Share

Applicants are not required to submit documents to verify cost share (or match) in the pre-award phase. However, applicants are required to include the source of the cost share on the Project Worksheet as part of their application submission.

Cost Share Documentation for soft match: The source documentation for the cost share should be:

1. Valued at the time of the donation—value must not exceed the fair market value of the equipment of the same age and condition at the time of donation.

2. Signed and dated by the donating company, person, etc.

3. For third-party in-kind contributions, the fair market value of goods and services must be documented and, to the extent feasible, supported by the same methods used internally by the non-federal entity.

Please see the “Application Format and Contents” section for details.

3. Program Description A. Background, Program Purpose, and Program History

Our nation faces unprecedented threats to the homeland from increasingly sophisticated criminal groups and nation-state actors. SLT entities stand at the forefront of cyber defense, enforcing laws, assisting the federal government in securing borders, cyberspace, and dismantling transnational criminal organizations. Cybersecurity threats, including ransomware intrusions, and widespread software vulnerabilities affecting SLT systems and critical infrastructure, are increasingly exploited by malicious actors, operating both domestically and abroad. To strengthen the essential partnership DHS maintains with its SLT partners in executing its mission, DHS is committed to supporting SLT efforts to combat cybersecurity threats and mitigate risks that endanger these vital functions.

Considering the risk and potential consequences of cyber incidents, the focus of the SLCGP is strengthening the cybersecurity practices and resilience of SLT governments. Through funding from the Infrastructure Investment and Jobs Act, referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies to strengthen the security of critical infrastructure and improve the resilience of services SLT governments provide their communities.

FY 2025 SLCGP Allocations For FY 2025, DHS will award funds to states and territories based on baseline minimums and population as required by section 2200A(l) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(l)), described below.

Each state and territory will receive a baseline allocation using thresholds established in section 2200A(l) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(l)). All 50 states, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $1,000,000 each, equaling 1% of total funds made available for the SLCGP in FY 2025. Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $250,000 equaling 0.25% of the total funds made available for the SLCGP in FY 2025. Additionally, $19,375,000, 50% of the remaining amount, will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories. The remaining $19,375,000 equaling the other 50% of the remaining amount, will be apportioned based on the ratio that the population of each state that resides in rural areas bears to the population of all states that resides in rural areas.

If a state or territory does not apply, its initial allocation will be redistributed to the other states and territories per the statutory formula. Final allocation amounts will be determined after the Application Deadline date. Applicants will be notified of the final allocation amounts and required cost share after the Application Deadline.

State/Territory FY 2025 SLCGP Initial Allocation State/Territory FY 2025 SLCGP

Initial Allocation Alabama $1,906,331 Nevada $1,238,972 Alaska $1,114,897 New Hampshire $1,248,490 Arizona $1,657,942 New Jersey $1,703,280 Arkansas $1,563,226 New Mexico $1,275,083 California $3,872,566 New York $2,849,577 Colorado $1,572,832 North Carolina $2,638,773 Connecticut $1,351,842 North Dakota $1,132,581 Delaware $1,108,818 Ohio $2,480,716 District of Columbia $1,039,593 Oklahoma $1,639,860 Florida $2,864,442 Oregon $1,478,977 Georgia $2,448,068 Pennsylvania $2,612,850 Hawaii $1,137,967 Rhode Island $1,091,720 Idaho $1,280,792 South Carolina $1,793,404 Illinois $2,195,011 South Dakota $1,162,200 Indiana $1,958,035 Tennessee $2,090,099 Iowa $1,523,385 Texas $4,174,163 Kansas $1,403,652 Utah $1,298,406 Kentucky $1,795,927 Vermont $1,157,136

Louisiana $1,637,992 Virginia $2,109,454 Maine $1,323,383 Washington $1,821,882 Maryland $1,612,166 West Virginia $1,382,386 Massachusetts $1,581,107 Wisconsin $1,898,770 Michigan $2,346,859 Wyoming $1,096,930 Minnesota $1,791,614 Puerto Rico $1,251,691 Mississippi $1,625,367 U.S. Virgin Islands $256,150 Missouri $1,898,390 American Samoa $256,291 Montana $1,212,152 Guam $263,579

Nebraska $1,266,545 Northern Mariana Islands $255,679

Total $91,750,000

B. Goal, Objectives, and Priorities

a. Goal The goal of the SLCGP is to assist SLT governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the four years of SLCGP funding as applicants focus their Cybersecurity Plans, priorities, projects, and implementation toward addressing SLCGP objectives.

b. Objectives Applicants are required to submit applications that address at least one of the following program objectives in their applications:

• Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

Applicants should refer to the CISA website at www.cisa.gov/cybergrants/slcgp for more information on SLCGP priorities, cybersecurity plans, committees and charters, as well as the required program goals, objectives, sub-objectives and desired outcomes for the FY 2025 SLCGP application.

c. Priorities Cybersecurity Plans, Committees, and Charter The Homeland Security Act of 2002, as amended by the BIL, requires SLCGP grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the plan, and identify projects to implement using SLCGP funding.

With the FY 2022 SLCGP, recipients were directed to accomplish the following, and for any eligible entities who have not yet applied for SLCGP funding, the following also applies in FY 2025:

http://www.cisa.gov/cybergrants/slcgp

• Establish a Cybersecurity Planning Committee;

Members must include:

o The eligible entity;

o The Chief Information Officer (CIO), the Chief Information Security Officer

(CISO), or equivalent official (e.g., Chief Cyber Officer, Governor’s cabinet official overseeing cybersecurity) of the eligible entity;

o Representatives from counties, cities, and towns within the jurisdiction of the eligible entity;

o Institutions of public education and health within the jurisdiction of the eligible entity; and o As appropriate, representatives of rural, suburban, and high-population jurisdictions.

For updates to the state’s Cybersecurity Committees and Charters, CISA encourages members to include:

o Representatives from local law enforcement or emergency services; and o Representatives from other critical infrastructure sectors.

• Develop a state-wide Cybersecurity Plan, unless the recipient already has a state-wide Cybersecurity Plan; and

• Use SLCGP funds to implement or revise a state-wide Cybersecurity Plan.

Applicants should refer to the CISA website at www.cisa.gov/cybergrants/slcgp for further information about the Cybersecurity Plans, Committees, and Charters.

Cybersecurity Activities The SAA must consult with its Chief Information Officer (CIO) and the Chief Information Security Officer (CISO) (or an equivalent official of the eligible entity) regarding the plans for allocating SLCGP funds. To support the FY 2025 SLCGP requirements, Cybersecurity Plans must include the following activities:

• Conducting assessment and evaluations as the basis for individual projects throughout the life of the program; and

• Prioritizing, where applicable, key cybersecurity best practices and consulting the Cybersecurity Performance Goals (CPGs).

o The CPGs are a prioritized subset of information technology (IT) and operational technology (OT) cybersecurity practices aimed at meaningfully reducing risks to both critical infrastructure operations and the American people.

o These goals are applicable across all critical infrastructure sectors and are informed by the most common and impactful threats and adversary tactics, techniques, and procedures observed by CISA and its government and industry partners, making them a common set of protections that all critical infrastructure entities—from large to small—should implement.

o The CPGs do not reflect an all-encompassing cybersecurity program. Rather, they are a minimum set of practices that organizations should implement toward ensuring a strong cybersecurity posture.

o The Cross-Sector CPGs are regularly updated, with a targeted revision cycle of at least every 6 to 12 months.

https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

Key Cybersecurity Best Practices for Individual Projects To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, SLT governments must take decisive steps to modernize their approach to cybersecurity. As SLT governments increase their cybersecurity maturity, CISA recommends they move toward implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing. To assist in the revision of SLT cyber planning efforts, the following Cybersecurity Best Practices are provided. As appropriate, the strategic elements listed in the table below should be included in FY 2025 individual projects:

Cybersecurity Best Practices for Individual Projects Implement multi-factor authentication.

Implement enhanced logging.

Data encryption for data at rest and in transit.

End use of unsupported/end of life software and hardware that are accessible from the internet.

Prohibit use of known/fixed/default passwords and credentials.

Ensure the ability to reconstitute systems (backups).

Actively engage in bidirectional sharing between CISA and SLT entities in cyber relevant time frames to drive down cyber risk.

Migration to the .gov internet domain.

Cybersecurity Investments and Projects Given the Cybersecurity Plan is a strategic document, it should not identify specific vulnerabilities but instead capture the broad level of capability across the jurisdiction. The Cybersecurity Plan must also show how the implementation of the individual projects and activities over time will help achieve the goals and objectives of the plan. The summary of projects using FY 2025 SLCGP funds associated with each required and discretionary element provides a helpful snapshot of state and territory-wide capabilities and capacity that will be achieved as a result of this funding. Details for each project using SLCGP funds must be included in the Investment Justifications (IJs) and the corresponding Project Worksheet (PW).

Each IJ must provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces, which have influenced the development of the IJ. The IJ must include a summary of the current capabilities within the applicant jurisdiction to address these threats and risks. The IJ should also include a description of how the proposed project addresses gaps identified in or sustainment of the approved Cybersecurity Plan, and how the project aligns to the cybersecurity elements in this NOFO. Finally, the IJ should include implementation planning data to assist in project management.

The PW will be used to identify the budget details and budget narrative portion of the application. Eligible applicants should submit only one PW as part of the overall application and must include information for each IJ submitted as part of the application for funding. More information on the IJ Form, PW, and instructions can be found in Section 4. D in this funding notice.

Multi-Entity Projects Multiple eligible entities (states or territories) can group together to address shared cybersecurity risks and threats to information systems within the states and territories which are the eligible entities. There is no separate funding for multi-entity projects. Instead, these investments would be considered as group projects: each group member contributing an agreed upon funding amount from their SLCGP award to the overall project. Each group member’s financial contribution is then funded from their individual SLCGP award. Each participating state or territory in the group should include the multi-entity project in their individual IJ submissions with their application. It is expected that IJs for multi-entity projects will be almost identical.

Any differences should reflect alignment with the entities’ respective Cybersecurity Plan.

The multi-entity project submissions must be approved by each of the participating state or territory’s Cybersecurity Planning Committees, and each of the multi-entity project submissions must be aligned with each of the participating state or territory’s respective Cybersecurity Plan.

For multi-entity groups, each participating state or territory must have a CISA-approved Cybersecurity Plan. The project must improve or sustain capabilities identified in the respective Cybersecurity Plan for each eligible entity.

a. Timing Even though applications from each state and/or territory that are part of the multi-entity project may come in at different times, FEMA and CISA will need to approve the multi-entity projects in each separate application at the same time. This is because, unless both states and/or territories complete their respective responsibilities in the multi-entity project, then the project would not be successful. As a result, DHS will not award one state’s/territory’s portion of the multi-entity project in isolation without approving the other.

b. Nature of a Multi-Entity Project The states and/or territories must work together to implement each other’s Cybersecurity Plans to address cybersecurity risk and threats to their information systems in order to have a multi-entity project. If one state or territory can accomplish the scope of work under a project without any need to work with the other state and/or territory, then it is not a multi-entity project.

c. Cooperating Purchasing To foster greater economy and efficiency, two states may conduct a joint procurement or pursue some other type of cooperative purchasing arrangement to procure equipment, supplies, or services. Such a collaborative procurement action does not mean that the states are pursuing a multi-entity project. Rather, it is the substance of the underlying scope of work that makes a project a multi-entity project and not the manner in which a state is procuring services in accomplishing a project’s scope of work.

The following examples help illustrate the considerations above.

Example 1: State X and Y seek to jointly conduct cybersecurity training of their state personnel.

Rather than each state conducting its own $250K worth of training for their respective employees, they want to work together to have joint training sessions so that all trainees get $500K worth of training. There will be ten training sessions for all state X and Y employees and each state will be responsible for organizing and executing five sessions. The states, furthermore, jointly conduct a procurement to obtain a contractor that will provide services to help the state carry out all ten sessions. This would be a multi-entity project because both states have to work together to carry out the scope of work, each state is implementing the cybersecurity plan of each other’s by training the other state’s employees, and there is a shared project objective.

Example 2: State X and Y seek to conduct cybersecurity training for their own staffs. To obtain greater cost-savings, the states jointly procure a contractor to conduct their cybersecurity training. Following the procurement, each state runs their own training program and uses the same contractor in doing so. This is not a multi-entity project. This is because each state could accomplish their respective project without working together with the other state to carry out the scope of work, one state is not implementing the cybersecurity plan of the other state by carrying out activities to reduce cybersecurity threats and cybersecurity risks to the other state’s information systems, and there is no shared project objective.

Multi-Entity Project Requirements and Process Overview The following must be included in each of the participating state or territory group members’ Cybersecurity Plans, IJs, and PWs for the multi-entity project:

• A detailed description of the overall project;

• The division of responsibilities among each participating state or territory group member entity;

• The distribution of funding among the participating state or territory group member entities; and

• Overview of how implementation of the multi-entity project will help achieve the goals and objectives in the Cybersecurity Plan of each participating entity.

Multi-Entity Project Benefits A multi-entity project is funded from each participating state or territory group members’ SLCGP award in accordance with their agreed-upon contribution amounts. Since the multi-entity group may be comprised of state and territory governments, each can benefit from information sharing and awareness opportunities. Multi-entity projects may permit smaller state and territory entities to combine resources with larger state and territory entities to reap the benefits associated with larger acquisitions. At the same time, all parties to a multi-entity project may realize cost savings due to volume purchases. Lastly, the non-federal cost share in FY 2025 SLCGP for the projects in a multi-entity project is 30%.

Imminent Cybersecurity Threat The SLCGP is primarily a security preparedness program focused on reducing cyber risks by helping SLT entities address cybersecurity vulnerabilities and build cybersecurity capabilities.

Over time, the program activities and investments reduce the potential impact of cybersecurity threats and incidents. Section 2220A(d)(4) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(d)(4)) provides that “An eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section” may also use the grant to “assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the [CISA] Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.”

The following provides an overview of the imminent cybersecurity threat process for the FY 2025 grant cycle. Details on CISA’s criteria and process for confirming an imminent cybersecurity threat are not included here. The following also does not supersede or replace existing threat notification procedures or existing methods to collaborate on operational cybersecurity matters.

Process Overview

• Any eligible entity using SLCGP funds to address an imminent cybersecurity threat, as confirmed by the Secretary, acting through the CISA Director, must have a Cybersecurity Plan approved by CISA.

• DHS, through CISA, will determine if an incident constitutes as an imminent cybersecurity threat.

• Upon confirmation, DHS will notify the SLCGP SAA, and the SAA must notify the state or territory Cybersecurity Planning Committee and CIO/CISO/equivalent.

• DHS will notify impacted SLT entities, as appropriate, of permissible activities to address imminent cybersecurity threats to the information systems owned or operated by, or on behalf of, SLT entities.

• DHS will issue an Information Bulletin detailing the impacted entities and procedures for reprogramming SLCGP funds in support of the specific imminent cybersecurity threat.

The scope of the Information Bulletin will be dependent on the nature of the imminent cybersecurity threat.

C. Program Rationale SLCGP is authorized under the Homeland Security Act of 2002, Pub. L. No. 107-296, § 2220A (codified as amended at 6 U.S.C. § 665g).

D. Federal Assistance Type Grant

E. Performance Measures and Targets DHS will communicate with all SLCGP SAA recipients on the information collection process related to performance measures data. To gauge overall program performance, recipients are required to report on the performance measures that are relevant to their plan implementation.

No. Performance Measures 1 Percentage of entities conducting annual tabletop and full-scale exercises to test

Cybersecurity Plans (40% target range).

2 Amount of grant funds budgeted for cybersecurity exercises (10% target range).

3 Percentage of grant funds expended on exercise plans for entities (10% target range).

4 Percentage of entities conducting annual cyber risk assessments conducted to identify cyber risk management gaps and areas for improvement (80% target range).

5 Percentage of entities performing phishing training (70% target range).

6 Percentage of entities conducting awareness campaigns (90% target range).

No. Performance Measures 7 Percentage of entities providing role-based cybersecurity awareness training (90% target range).

8 Percentage of entities with capabilities to analyze network traffic and activities related to potential threats (60% target range).

9 Percentage of entities implementing multi-factor authentication (MFA) for all remote access and privileged accounts (70% target range).

10 Percentage of entities with programs to anticipate and discontinue end-of-life software and hardware (90% target range).

11 Percentage of entities prohibiting the use of known/fixed/default passwords and credentials

(90% target range).

12 Percentage of entities operating under the “.gov” internet domain (70% target range).

13 Percentage of entities that reported CISA-identified Cybersecurity Gaps (50% target range).

14 Percentage of entities with Endpoint Detection Response systems that were funded for implementation (90% target range).

15 Number of capabilities ratings improved (50% target range).

16 Percentage of state/territory-created performance metrics that were met (50% target range).

17 Percentage of entities participating in CISA services (50% target range).

18 Percentage of entities that have implemented data encryption projects (50% target range).

19 Percentage of entities that have implemented enhanced logging projects (60% target range).

20 Percentage of entities that have implemented system reconstitution projects (60% target range).

F. Program-Specific Unallowable Costs For FY 2025 SLCGP, grant funds may not be used for the following:

a. Spyware;

b. Construction;

c. Renovation;

d. To pay a ransom;

e. For recreational or social purposes;

f. To pay for cybersecurity insurance premiums;

g. Costs associated with the Center for Internet Security (e.g., Multi-State Information

Sharing and Analysis Center (MS-ISAC) and Election Infrastructure Information Sharing and Analysis (EI-ISAC)), including but not limited to membership fees and services;

h. For any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by, or on behalf of, the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity;

i. To supplant state or local funds; however, this shall not be construed to prohibit the use of funds from a grant under this NOFO for otherwise permissible uses on the basis that the SLT entity has previously used SLT funds to support the same or similar uses;

j. For any recipient or subrecipient cost-sharing contribution; and

k. To acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities (This prohibition does not include minor building modifications; see Minor Modifications Information Bulletin No. 523); Unallowed “alterations” include https://www.fema.gov/grants/preparedness/about/informational-bulletins permanent modifications that substantially affect the building’s structure, layout, or systems, affect critical aspects of a building’s safety (such as structural integrity, fire safety systems), or other modifications that materially increase the value or useful life of the building.

• Examples of the types of alterations that are unallowable with SLCGP funding, or the non-federal cost share, are listed below:

o Updating an electrical system to a building which involves work to enhance or modernize the electrical infrastructure, such as replacing electrical panels, upgrading old or unsafe wiring, and replacing circuit breakers. This type of work is likely a modification that substantially affects the building’s systems and thus would comprise an alteration.

o Installing new walls or reconfiguring existing ones.

o Affixing equipment in such a way that it becomes a permanent part of a building

(as this would result in the equipment no longer being personal property).

G. General Funding Requirements Costs charged to federal awards (including federal and non-federal cost share funds) must comply with applicable statutes, rules and regulations, policies, this NOFO, and the terms and conditions of the federal award. This includes, among other requirements, that costs must be incurred, and products and services must be delivered within the budget period. 2 C.F.R. § 200.403(h).

Recipients may not use federal funds or any cost share funds for the following activities:

1. Matching or cost sharing requirements for other federal grants and cooperative agreements (see 2 C.F.R. § 200.306).

2. Lobbying or other prohibited activities under 18 U.S.C. § 1913 or 2 C.F.R. § 200.450.

3. Prosecuting claims against the federal government or any other government entity (see 2

C.F.R. § 200.435).

Recipients and subrecipients may use SLCGP funding to perform minor modifications that do not substantially affect a building’s structure, layout, or systems, affect critical aspects of a building’s safety, or otherwise materially increase the value or useful life of the building. The prohibition would also apply to the nonfederal cost-sharing requirement borne by the recipient and/or subrecipient. As a reminder, all projects and associated SLCGP costs must support the approved Cybersecurity Plan and be approved in advance by CISA.

Examples of the types of minor modifications that could be allowable with SLCGP funding, and the non-federal cost share are listed below:

• Fastening equipment to walls where it does not become a permanent fixture (such as hanging a server rack with servers on a wall).

• Replacing an outdated existing electrical or internet outlet into which the equipment will connect.

o For example, replacing an electrical outlet would involve turning off power, unscrewing a cover plate and outlet itself, pulling the outlet from the electrical box, disconnecting wires from the old outlet, connecting the wires to the new outlet, placing the new outlet in the electrical box, securing it with screws, reattaching the https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRea20080eff2ea53/section-200.403 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRea20080eff2ea53/section-200.403 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-D/section-200.306 https://uscode.house.gov/view.xhtml?req=granuleid:USC-1999-title18-section1913&num=0&edition=1999 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRed1f39f9b3d4e72/section-200.450 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRed1f39f9b3d4e72/section-200.435 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRed1f39f9b3d4e72/section-200.435 cover plate, and turning the power back on. This work very clearly does not involve a substantial change to the building and does not comprise an alteration.

• Installing new cabling.

• Replacing existing cabling.

• Moving cabling.

• Installing and connecting information system equipment to the building’s network and power supply and internet.

• Making a hole in the wall to attach the equipment to the building’s network, power, or internet.

Minor modifications may be permitted under the SLCGP subject to Environmental and Historic Preservation (EHP) review. Therefore, recipients (and subrecipients through the SAA) are required to submit their projects for minor building modifications to the FEMA GPD EHP Branch. The protocol for EHP submittal is as follows:

1. The SAA submits the completed EHP Screening form and photos to the FEMA GPD EHP inbox…