FY 2025 TCGP NOFO_508c Final 8-1-25.pdf

FEMA Version 25-01

The Department of Homeland Security (DHS)

Notice of Funding Opportunity (NOFO)

Fiscal Year (FY) 2025 Tribal Cybersecurity Grant Program (TCGP)

Fraud, waste, abuse, mismanagement, and other criminal or noncriminal misconduct related to this program may be reported to the Office of Inspector General (OIG) Hotline. The toll-free numbers to call are 1 (800) 323-8603 and TTY 1 (844) 889-4357.

Contents

1. Basic Information A. Agency Name B. NOFO Title C. Announcement Type D. Funding Opportunity Number E. Assistance Listing Number F. Expected Total Funding G. Anticipated Number of Awards H. Expected Award Range I. Projected Application Start Date J. Projected Application End Date K. Anticipated Funding Selection Date L. Anticipated Award Date M. Projected Period of Performance Start Date N. Projected Period of Performance End Date O. Executive Summary P. Agency Contact

2. Eligibility A. Eligible Entities/Entity Types B. Project Type Eligibility C. Requirements for Personnel, Partners, and Other Parties D. Maximum Number of Applications E. Additional Restrictions F. References for Eligibility Factors within the NOFO G. Cost Sharing Requirement H. Cost Share Description, Type and Restrictions I. Cost Sharing Calculation Example J. Required information for verifying Cost Share

3. Program Description A. Background, Program Purpose, and Program History B. Goal and Objectives and Priorities C. Program Rationale D. Federal Assistance Type E. Performance Measures and Targets F. General Funding Requirements

G. Indirect Costs (Facilities and Administrative Costs) H. Management and Administration (M&A) Costs I. Program-Specific Unallowable Costs J. Pre-Award Costs K. Beneficiary Eligibility L. Participant Eligibility M. Authorizing Authority N. Appropriation Authority O. Budget Period P. Prohibition on Covered Equipment or Services

4. Application Contents and Format A. Pre-Application, Letter of Intent, and Whitepapers B. Application Content and Format C. Application Components D. Program-Specific Required Documents and Information E. Post-Application Requirements for Successful Applicants

5. Submission Requirements and Deadlines A. Address to Request Application Package B. Application Deadline C. Pre-Application Requirements Deadline D. Post-Application Requirements Deadline E. Effects of Missing the Deadline

6. Intergovernmental Review A. Requirement Description and State Single Point of Contact

7. Application Review Information A. Threshold Criteria B. Application Criteria C. Financial Integrity Criteria D. Supplemental Financial Integrity Criteria and Review E. Reviewers and Reviewer Selection F. Merit Review Process G. Final Selection

8. Award Notices A. Notice of Award B. Pass-Through Requirements C. Note Regarding Pre-Award Costs D. Obligation of Funds E. Notification to Unsuccessful Applicants

9. Post-Award Requirements and Administration A. Administrative and National Policy Requirements B. DHS Standard Terms and Conditions C. Financial Reporting Requirements D. Programmatic Performance Reporting Requirements E. Closeout Reporting Requirements F. Disclosing Information per 2 C.F.R. § 180.335 G. Reporting of Matters Related to Recipient Integrity and Performance

H. Single Audit Report I. Monitoring and Oversight J. Program Evaluation K. Additional Performance Reporting Requirements L. Termination of the Federal Award by FEMA M. Best Practice N. Payment Information O. Immigration Conditions

10. Other Information A. Period of Performance Extension B. Other Information

11. Appendix A: TCGP Requirements Matrix

16. Appendix B: Post-Award Program-specific Required Documents, Forms and Information . 44

12. Appendix C: Required, Encouraged, and Optional Services and Resources

13. Appendix D: Sample Performance Progress Report (PPR) and Sample Cyber Performance Narrative for Progress Reporting

14. Appendix E: POETE Solution Areas for Investments

15. Appendix F: Sample Budget Worksheet and Budget Narrative

1. Basic Information A. Agency Name U.S. Department of Homeland Security (DHS), Federal Emergency

Management Agency (FEMA)

B. NOFO Title Fiscal Year (FY) 2025 Tribal Cybersecurity Grant Program (TCGP)

C. Announcement Type

Initial

D. Funding Opportunity Number

DHS-25-GPD-137-00-98

E. Assistance Listing Number

97.156

F. Expected Total Funding

$12,164,971

G. Anticipated Number of Awards

18 awards

H. Expected Award Range

$38,947 – $2,743,512

I. Projected Application Start Date

08/01/2025 4:00 p.m. Eastern Time (ET)

J. Projected Application End Date

08/15/2025 05:00 p.m. ET

K. Anticipated Funding Selection Date

09/04/2025

L. Anticipated Award Date

09/19/2025

M. Projected Period of Performance Start Date

09/01/2025

N. Projected Period of Performance End Date

08/31/2029

O. Executive Summary

Our nation faces unprecedented threats to the homeland from increasingly sophisticated criminal groups and nation-state actors.

State, local, Tribal, and territorial (SLTT) entities stand at the forefront of cyber defense. This partnership includes enforcing laws, assisting the federal government in securing borders and cyberspace, and dismantling transnational criminal organizations. Cybersecurity threats, including ransomware intrusions, and widespread software vulnerabilities affecting SLTT systems and critical infrastructure are increasingly exploited by malicious actors, operating both domestically and abroad. To strengthen the essential partnership DHS maintains with its SLTT partners in executing its mission, DHS is committed to supporting SLTT efforts to combat cybersecurity threats and mitigate risks that endanger these vital functions.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of Tribal governments is an important homeland security mission and the primary focus of TCGP. This program enables DHS to make targeted cybersecurity investments in Tribal governments, thus improving the security of critical infrastructure and improving the resilience of the services Tribal governments provide their communities.

P. Agency Contact a. TCGP Program Office Contact

The FEMA TCGP Program Office can provide general information on all FEMA grant programs and additional guidance surrounding questions on TCGP administration. Applicants and recipients may contact their FEMA Preparedness Officer, the Cyber Section Chief, or the Cyber Branch Chief for more information by email at FEMA- TCGP@fema.dhs.gov.

b. CISA Grant Program Office Contact The Cybersecurity and Infrastructure Security Agency (CISA) Grant Program Office, including programmatic and regional staff, are available to provide general information regarding the TCGP and additional guidance surrounding programmatic requirements and performance metrics. Applicants and recipients can contact their CISA grant program staff and regional staff for more information by email at TCGPinfo@mail.cisa.dhs.gov.

c. FEMA Grants News This channel provides general information on all FEMA grant programs and maintains a comprehensive database containing key personnel contact information at the federal, state, and local levels.

FEMA Grants News Team is reachable at fema-grants-news@fema.dhs.gov OR (800) 368-6498, Monday through Friday, 9:00 AM – 5:00 PM ET.

d. Grant Programs Directorate (GPD) Award Administration Division GPD’s Award Administration Division (AAD) provides support regarding financial matters and budgetary technical assistance. AAD can be contacted at ASK-GMD@fema.dhs.gov.

e. Civil Rights Consistent with Executive Order 14173, Ending Illegal Discrimination & Restoring Merit-Based Opportunity, the FEMA Office of Civil Rights is responsible for ensuring compliance with and enforcement of federal civil rights obligations in connection with programs and services conducted by FEMA. They are reachable at FEMA-CivilRightsOffice@fema.dhs.gov

f. Environmental Planning and Historic Preservation The FEMA Office of Environmental Planning and Historic Preservation (OEHP) provides guidance and information about the EHP review process to FEMA programs and recipients and subrecipients. Send any inquiries regarding compliance for FEMA mailto:FEMA-TCGP@fema.dhs.gov mailto:FEMA-TCGP@fema.dhs.gov mailto:TCGPinfo@mail.cisa.dhs.gov mailto:fema-grants-news@fema.dhs.gov mailto:fema-grants-news@fema.dhs.gov mailto:ASK-GMD@fema.dhs.gov mailto:FEMA-CivilRightsOffice@fema.dhs.gov grant projects under this NOFO to FEMA-OEHP- NOFOQuestions@fema.dhs.gov.

g. FEMA GO For technical assistance with the FEMA GO system, please contact the FEMA GO Helpdesk at femago@fema.dhs.gov or (877) 585-3242, Monday through Friday, 9:00 AM – 6:00 PM ET.

2. Eligibility A. Eligible Entities/Entity Types

Only the following entities or entity types are eligible to apply.

a. Applicants The only eligible Tribal applicants are those listed in Section 3 of this Notice of Funding Opportunity, “FY 2025 TCGP Target Allocations.”

FY 2025 TCGP applications are limited to only those meritorious applicant projects and investments as identified by FEMA in individual notifications to the eligible Tribal governments.

“Tribal government” is defined at Section 2220A(a)(7) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(a)(7)) as the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent published list of Federally Recognized Tribes.

b. Sub-applicants and subawards Sub-applicants and subawards are allowed for TCGP.

Subapplicants should not have foreign nationals or noncitizens included. If a sub-applicant has foreign nationals, they must be properly vetted and must adhere to all government statues, polices, and procedures including “staff American, stay in America” and security requirements. Eligible subrecipients to not include nonprofit or for-profit organizations.

B. Project Type Eligibility

a. Unallowable Project Types Unallowable project types are described in Section 3.G, “Program- Specific Unallowable Costs” in this NOFO.

b. Allowable Project Types Please see the Appendix E, “Planning, Organization, Equipment, Training, and/or Exercises (POETE) Solution Areas for Investment” for more information on allowable costs related to the POETE Solution Areas.

mailto:FEMA-OEHP-NOFOQuestions@fema.dhs.gov mailto:FEMA-OEHP-NOFOQuestions@fema.dhs.gov mailto:femago@fema.dhs.gov https://www.bia.gov/service/tribal-leaders-directory/federally-recognized-tribes

Allowable TCGP costs, pre-award costs, M&A costs, and indirect costs are described in Section 3.H - 3.J.

C. Requirements for Personnel, Partners, and Other Parties

Not applicable.

D. Maximum Number of Applications

The maximum number of applications that can be submitted is:

1. A maximum of one application per eligible tribal government.

E. Additional Restrictions

Applicants/subapplicants or recipients/subrecipients are required to certify their compliance with federal statutes, DHS directives, policies, and procedures.

F. References for Eligibility Factors within the NOFO

Please see the following references provided below:

1. “Responsiveness Review Criteria” subsection

2. “Financial Integrity Criteria” subsection

3. “Supplemental Financial Integrity Criteria and Review” subsection

4. FEMA may/will request financial information such as

Employer Identification Number (EIN) and bank information as part of the potential award selection. This will apply to everyone prospered, including subrecipients

G. Cost Sharing Requirement

Applicants selected for this award must agree to an acceptable cost share agreement. Otherwise, they will not be funded.

Project-based Cost Share: Section 2220A of the Homeland Security Act of 2002 requires recipients to meet a non-federal matching requirement for an “activity” carried out under an TCGP grant award.

DHS interprets the term “activity” to be an approved “project” under a TCGP grant award and administers the nonfederal matching requirement in accordance with 2 C.F.R. § 200.306.

Eligible applicants must agree to make available non-federal funds to carry out a TCGP award in an amount not less than 40% of the total project costs (federal award amount plus cost share amount, rounded to the nearest whole dollar). The cost share for the multi-entity projects is 30% for FY 2025.

Cost Share Waiver The Secretary of Homeland Security (or designee) may waive or modify the non-federal share for an individual entity if the entity demonstrates economic hardship. The Homeland Security Act of 2002, as amended, requires TCGP recipients in FY 2025 to provide a non-federal cost share of 40% if they are applying as a single entity (6 U.S.C. § 665g(m)(1)). However, DHS is not able to provide additional funds even if it does grant a cost share waiver. The federal funding will remain at the same amount as indicated by the statutory formula.

All Cost Share Waiver requests must be submitted post-award by the eligible entity by emailing the request and supporting documentation to FEMA-TCGP@fema.dhs.gov.

Economic Hardship Factors

The Secretary of Homeland Security (or designee) may consider the following factors when determining economic hardship or the Secretary may waive or modify the following requirements for 1 or more Tribal governments if the Secretary determines that a waiver is in the public interest:

a. Changes in rates of unemployment in the jurisdiction from previous years;

b. Changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the Food and Nutrition Act of 2008 (7 U.S.C. § 2011 et seq.) from previous years; and

c. Any other factors the Secretary considers appropriate.

To be considered for a cost share waiver, eligible entities must meet at least one of the three factors described above, but do not necessarily need to meet all of them. Requests for waivers will be considered on a case-by-case basis and evaluated holistically. The applicant is required to submit documentation supporting their request for an Economic Hardship Cost Share Waiver at the award level post-award by attaching the supporting document to the grant application.

Cost Share Waiver Request Requirements

To request a waiver, an eligible entity must submit a written narrative, including the following three categories to demonstrate economic hardship by emailing the request and supporting documentation to FEMA-TCGP@fema.dhs.gov:

a. History: A description of the entity’s background/history of economic hardship.

b. Austerity: Describe any measures the entity has taken to address economic hardship.

c. Operational Impact: Describe how the lack of a waiver will impact the entity’s ability to develop, implement, or revise a Cybersecurity Plan or address imminent cybersecurity threats.

A detailed justification explaining why the Tribal government (or specific project(s) if requesting only a partial waiver) is unable to fulfill the cost share requirement. The applicant must identify specific economic hardship(s) and address the factors listed above.

mailto:FEMA-TCGP@fema.dhs.gov

Approval Process

Once a decision on a waiver request is made, the Tribal government will be notified in writing. If approved, the award package will indicate that the cost share has been waived in full or in part. The cost share waiver will be included in the post-award requirements for submission of the Project Worksheet and detailed Budget Worksheet and Budget Narrative found in Appendix B. If the waiver request is approved after the award has been issued, FEMA will amend the award package to indicate that the cost share has been waived in full or in part and whether the recipient must submit a revised budget and/or scope (as applicable) for the identified project(s).

Questions regarding the cost share waiver process may be directed to your FEMA Preparedness Officer by emailing FEMA- TCGP@fema.dhs.gov.

H. Cost Share Description, Type and Restrictions

DHS administers cost-matching requirements in accordance with 2 C.F.R. § 200.306. To meet matching requirements, the recipient contributions must be verifiable, reasonable, allocable, and necessary, and otherwise allowable under the grant program, and in compliance with all applicable federal requirements and regulations. The non-federal cost share requirement cannot be matched with other federal funds, unless specifically authorized by the legislation governing that other source of federal funding.

The cost share applies to each project funded by the grant award rather than just to the cumulative total of all projects. Recipients must ensure that each project’s cost share is met. A Project Worksheet (PW) must include cost share for each project as well as Management and Administration (M&A). M&A must be included as a separate row in the PW. Also, the PW must include a description of the source of the cost share. Note for post-award documentation of cost share, if funds or services are to be provided by a third-party for in-kind match, a dated letter of commitment is required to document the donation.

The recipient contribution can be cash (hard match) or third-party in-kind (soft match).

Types of Cost Share/Match

1. Hard Match (Cash)

Cash or hard matching includes cash spent for project-related costs.

The allowable cash match must include costs that are necessary, reasonable, and allowable under the TCGP. Tribal general fund monies are an example of hard match.

2. Soft Match (In-kind)

Soft match refers to contributions of the reasonable value of property or services in lieu of cash which benefit a federally assisted project or program. This type of match may only be used if not restricted or prohibited by program statute, regulation, or guidance and must be supported with source documentation. Only property or services that comply with program guidance and/or program regulations, are allowable. In other words, a recipient cannot use a source for the soft match that is completely unrelated to the TCGP’s goals, objectives, and allowable costs identified in the NOFO, etc. The same contribution cannot be used if it is already used as match for another grant program or paid from other grant funds. Below are some examples of allowable soft match:

a. Example 1: A hotel offers a room or space to conduct a cybersecurity training event or tabletop exercise. The hotel manager should provide the Tribal government with written documentation of the room rental (dollar value), date/time of the donation, signed by the hotel manager. This should align with the date/time of the training or exercise event. And, per 2 C.F.R. 200.306, “The value of donated space must not exceed the fair rental value of comparable space as established by an independent appraisal of comparable space and facilities in a privately-owned building in the same locality.”

b. Example 2: Contributions of salary, travel, equipment, supplies, and other budget areas that are from third-party sources (in compliance with 2 C.F.R. 200.306) and include voluntary contributions such as emergency personnel, lawyers, etc., who donate their time to a federal grant program. The normal per hour rate for these professionals (acting in their professional capacity) can be used to meet the matching requirement. The value of the services provided is taken into consideration when determining the value of the contribution and not who is providing the service. For example, if a lawyer is volunteering his/her services to assist the Cybersecurity Planning Committee with preparing and filing legal paperwork for their Charter, the lawyer’s normal hourly rate is allowable. However, if the lawyer is volunteering his/her time and services to conduct cybersecurity needs assessments as part of the Tribal government’s cybersecurity plan implementation, the lawyer’s hourly rate would not be applicable. Instead, the hourly rate for an information technology specialist would be more reasonable and applicable.

I. Cost Sharing Calculation Example

Calculating Cost Share for the Application on the Project Worksheet

Formula: Federal Award Amount / Federal Share Percentage = Total Project Cost

Cost Share Percentage = Cost Share Amount (rounded up to the nearest whole dollar)

Example: If the federal award is $1,000,000 with a 60% federal share percentage and a 40% cost share percentage, the cost share amount is calculated below:

• $1,000,000 (Federal Award Amount) / .60 = $1,666,666.67 (Total Project Cost)

• $1,666,666.67 x .40 = $666,667 (Cost Share Amount rounded to the next whole dollar)

Calculating Cost Share for Projects on the Project Worksheet Cost share must be provided on a project basis. To calculate cost share for a project, please see the following formula and example:

Formula: Total Project Cost x Cost Share Percentage of the Project = Cost Share Amount; Total Project Cost x Federal Percentage Share of the Project = Federal Amount for the Project

Example: If the total project cost is $125,000, the cost share percentage of the project is 40% and the federal percentage share of the project is 60%, the cost share amount for the project and federal amount for the project is calculated below:

• $125,000 x .40 = $50,000 (Cost Share Amount for Project)

• $125,000 x .60 = $75,000 (Federal Share Amount for Project)

J. Required information for verifying Cost Share

Applicants are not required to submit documents to verify cost share (or match) in the pre-award phase. However, applicants will be required to include the source of the cost share on the Project Worksheet as part of their post-award documentation submission.

Cost Share Documentation for soft match: The source documentation for the cost share should be:

1. Valued at the time of the donation—value must not exceed the fair market value of the equipment of the same age and condition at the time of donation.

2. Signed and dated by the donating company, person, etc.

3. For third-party in-kind contributions, the fair market value of goods and services must be documented and, to the extent feasible, supported by the same methods used internally by the non-federal entity.

3. Program Description

A. Background, Program Purpose, and Program History Our nation faces unprecedented threats to the homeland from increasingly sophisticated criminal groups and nation-state actors. SLTT entities stand at the forefront of cyber defense. This partnership includes enforcing laws, assisting the federal government in securing borders and cyberspace, and dismantling transnational criminal organizations. Cybersecurity threats, including ransomware intrusions, and widespread software vulnerabilities affecting SLTT systems and critical infrastructure are increasingly exploited by malicious actors, operating both domestically and abroad. To strengthen the essential partnership DHS maintains with its SLTT partners in executing its mission, DHS is committed to supporting SLTT efforts to combat cybersecurity threats and mitigate risks that endanger these vital functions.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of Tribal governments is an important homeland security mission and the primary focus of TCGP. Through funding from the Infrastructure Investment and Jobs Act referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the TCGP enables DHS to make targeted cybersecurity investments in Tribal governments, thus improving the security of critical infrastructure and improving the resilience of the services Tribal governments provide their communities.

FY 2025 TCGP Allocations

The BIL appropriated $300 million in FY 2024 and $100 million in FY 2025 for the state, territorial, local, and tribal cybersecurity grant programs with 3% of the total appropriations being available under the TCGP to eligible recipients. The funding appropriated for the TCGP for FY 2024 and FY 2025 is $9,142,996 for FY 2024 and $3,021,975 for FY 2025. FEMA and CISA combined the funding from both fiscal years into this single TCGP NOFO, for a total of $12,164,971.

For the Fiscal Year 2022/2023 TCGP award cycle, CISA and FEMA created a discretionary allocation structure based on Tribal populations that elicited extensive interest from Tribal governments (e.g., 73 Tribal governments submitted applications for funding exceeding $100 million, far exceeding the available roughly $18 million). The statutory authorization for the TCGP expires on September 30, 2025, after which no new awards can be made. Insufficient time now remains to solicit and receive competitive applications, conduct review panels to evaluate, score and rank applications, and make awards, prior to the September 30, 2025, deadline.

Therefore, CISA and FEMA will allocate the remaining $12,164,971 of Fiscal Year 2024/2025 TCGP funding to make additional awards, to fund meritorious Tribal applicant projects which did not receive funding during the Fiscal Year 2022/2023 award cycle. This decision is consistent with and reflects extensive feedback from tribal governments after nation-to-nation consultations (August 2022, November 2023, and September 2024).

Eligible applicants will be notified by FEMA of the specific investments and allocations per investment no later than Monday, August 4, 2025. Final allocation amounts will be determined and applicants will be notified after the Application Deadline date of August 15, 2025. Target allocations are included below:

FY 2025 TCGP Target Allocations

Tribal Government Target Allocation Blackfeet Tribe Total $1,927,400 Chippewa Cree Total $2,743,512 Confederated Tribes of the Colville Reservation Total $643,903 Inupiat Community of the Arctic Slope Total $573,184 Kickapoo Traditional Tribe of Texas Total $45,000 Little Traverse Bay Bands of Odawa Indians Total $70,000 Metlakatla Indian Community Total $1,215,680 Mohegan Tribe of Indians of Connecticut Total $265,000 Native Village of Kluti-Kaah Total $62,973 Nottawaseppi Huron Band of the Potawatomi Total $1,030,270 Paskenta Band of Nomlaki Indians Total $247,235 Prairie Band Potawatomi Nation Total $1,034,938 Quapaw Tribe of Oklahoma Total $370,678 Saint Regis Mohawk Tribe Total $20,130 San Carlos Apache Tribal Council Total $570,815 Seminole Tribe of Florida Total $1,054,253 Southern Ute Indian Tribe Total $120,000 Swinomish Indian Tribal Community Total $170,000 Total $12,164,971

Additional information related to the formula allocation methodology is detailed in Section 7.B., “Application Review Information” of this funding notice.

B. Goal and Objectives and Priorities

a. Goal The goal of TCGP is to assist Tribal governments with managing and reducing systemic cyber risk. Accomplishment of this goal can be achieved by implementing or revising Cybersecurity Plans, priorities, projects, and addressing TCGP objectives.

b. Objectives Listed below are the objectives for the Tribal Cybersecurity Grant Program:

• Objective 1: Develop and establish appropriate governance structures, including by implementing or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure Tribal organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

FY 2025 Tribal applicants are limited to applying for the investment/objective number and federal amount included in Section 3. Applicants should refer to the TCGP CISA website for more information on TCGP program goals, objectives, sub-objectives, and desired outcomes required in their FY 2025 TCGP application.

c. Priorities Cybersecurity Plan, Committee Membership List, and Charter The Homeland Security Act of 2002, as amended by the BIL, requires TCGP grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the Cybersecurity Plan, and identify projects to implement using TCGP funding.

To support these efforts, recipients must prioritize the following activities using FY 2025 TCGP funds, all of which are statutorily required as a condition of receiving a grant:

• Establish a Cybersecurity Planning Committee;1 and

• Implement or revise a Cybersecurity Plan.2

Cybersecurity Activities The tribal government must consult with its CIO, CISO, or equivalent official to the CIO or CISO (who fulfills the duties of the CIO or CISO, even if their job includes other duties and responsibilities), in the plans for allocating TCGP funds. To support the FY 2025 TCGP requirements, Cybersecurity Plans must include the following activities:

i. An assessment of the capabilities of the tribal government relating to the 13 required cybersecurity plan elements;3 and

ii. Adopting key cybersecurity best practices and consulting Cybersecurity Performance Goals (CPGs).4

a. The CPGs are a prioritized subset of information technology and operational technology cybersecurity practices aimed at meaningfully reducing risks to critical infrastructure operations.

b. These goals are applicable across all critical infrastructure sectors and are informed by the most common and impactful threats and adversary tactics, techniques, and procedures (TTPs) observed by CISA and its government and industry partners, 1 6 U.S.C. § 665g(g). An existing Tribal Council/Governing Body that includes the participation of a designated Chief Information Officer (CIO), Chief Information Security Officer (CISO), or equivalent official to the CIO or CISO with expertise in information technology (IT) and systems. The CIO, CISO, or equivalent official to the CIO or CISO is one who fulfills the duties of the CIO, even if their job includes other duties and responsibilities. If the tribal government would prefer to establish a separate Cybersecurity Planning Committee, the required members of that committee must include the following: the grants administration office and a designated CIO, CISO, or equivalent official to the CIO or CISO with expertise in IT and systems. Additional members are encouraged but not required. 6 U.S.C. § 665g(h).

2 6 U.S.C. §§ 665g(e) and 665g(h).

3 6 U.S.C. §§ 665g(e)(2)(B)(i)-(xiii).

4 6 U.S.C. § 665g(e)(2)(B)(v).

https://www.cisa.gov/cybergrants/tcgp https://www.cisa.gov/cross-sector-cybersecurity-performance-goals making them a common set of protections that all critical infrastructure entities – from large to small – should implement.

c. The CPGs do not reflect an all-encompassing cybersecurity program – rather, they are a minimum set of practices that organizations should implement towards ensuring a strong cybersecurity posture.

d. The Cross-Sector Cybersecurity Performance Goals are regularly updated, with a targeted revision cycle of at least every 6 to 12 months.

Key Cybersecurity Best Practices for Individual Projects To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, Tribal governments must take decisive steps to modernize their approach to cybersecurity. As tribes increase their cybersecurity maturity, CISA recommends they move toward implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing. To assist in the revision of tribal cyber planning efforts, the following Cybersecurity Best Practices are provided. As appropriate, the strategic elements listed in the table below should be included in FY 2025 individual projects:

Cybersecurity Best Practices for Individual Projects Implement multi-factor authentication Implement enhanced logging Data encryption for data at rest and in transit End use of unsupported/end of life software and hardware that are accessible from the internet Prohibit use of known/fixed/default passwords and credentials Ensure the ability to reconstitute systems (backups) Actively engage in bidirectional sharing between CISA and Tribal governments in cyber relevant time frames to drive down cyber risk Migration to the .gov internet domain

Cybersecurity Investments and Projects Given the Cybersecurity Plan is a strategic document, it should not identify specific vulnerabilities but instead capture the broad level of capability across the tribal government. The Cybersecurity Plan must also show how the implementation of the individual projects and activities over time will help achieve the goals and objectives of the plan. A summary of projects using FY 2025 TCGP funds associated with each required and discretionary element provides a helpful snapshot of tribal capabilities and capacity that will be achieved as a result of this funding. Details for each project using TCGP funds must be included in the IJs.

Each IJ must provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces, which have influenced the development of the IJ. The IJ must include a summary of the current capabilities within the applicant tribal government to address these threats and risks. The IJ should also include a description of how the proposed project addresses gaps and/or sustainment in the Cybersecurity Plan and how the project aligns to the cybersecurity elements in this funding notice. Finally, the IJ should include implementation planning data to assist in project management.

The Project Worksheet (PW), Budget Worksheet and Budget Narrative will be used to identify the budget details portion of the application. As part of the post-award process found in Appendix B: Post-Award Program-specific Required Documents, Forms and Information, eligible applicants must submit only one PW as part of the overall application and must include information for each IJ submitted as part of the application for funding. More information on the IJ Template, PW and instructions can be found in Section 4.D., “Program Specific Required Documents and Information” in this funding notice.

Imminent Cybersecurity Threat TCGP is primarily a security preparedness program focused on reducing cyber risks by helping Tribal governments address cybersecurity vulnerabilities and build cybersecurity capabilities.

Over time, the program activities and investments reduce the potential impact of cybersecurity threats and incidents. Section 2220A(d)(4) of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665g(d)(4)) provides that:

An eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section, as appropriate, shall use the grant to assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the [CISA] Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.

The following provides an overview of the imminent cybersecurity threat process for the FY 2025 grant cycle. Specific details on CISA’s criteria and process for confirming an imminent cybersecurity threat are not included here. The following also does not supersede or replace existing threat notification procedures or existing methods to collaborate on operational cybersecurity matters.

Process Overview

• Any eligible entity seeking to use TCGP funds to address an imminent cybersecurity threat, as confirmed by the Secretary, acting through the CISA Director, must have a Cybersecurity Plan approved by CISA.

• DHS, through CISA, will determine whether an incident constitutes an imminent cybersecurity threat.

• Upon confirmation, DHS will notify the tribal recipient who will, in turn, notify the Cybersecurity Planning Committee and CIO, CISO, or equivalent official to the CIO or

CISO.

• DHS will notify impacted Tribal governments, as appropriate, of permissible imminent cybersecurity threat fund usage.

• FEMA will issue an Information Bulletin (IB) detailing the impacted governments and procedures for reprograming TCGP funds to support the specific imminent cybersecurity threat. The scope of the IB will be dependent on the nature of the imminent cybersecurity threat.

C. Program Rationale

FY 2025 TCGP is authorized under the Homeland Security Act of 2002, Pub. L. No. 107-296, § 2220A (codified as amended at 6 U.S.C. § 665g).

D. Federal Assistance Type Grant

E. Performance Measures and Targets

DHS will communicate with all TCGP recipients on the information collection process related to performance measures data. DHS will measure the recipient’s performance of the grant by comparing the number of activities and projects needed and requested in its IJs with the number of activities and projects acquired and delivered by the end of the period of performance (POP) using the following programmatic metrics:

Performance Measures 1 Percentage of tribes with CISA approved tribal Cybersecurity Plans (100% target range

– statutorily required) 2 Percentage of tribes with Tribal Cybersecurity Planning Committees that meet the

Homeland Security Act of 2002 and TCGP funding notice requirements (100% target range– statutorily required)

3 Percentage of tribes conducting annual table-top and full-scope exercises to test Cybersecurity Plans (40% target range)

4 Percent of the tribes’ TCGP budget allocated to exercises (10% target range)

5 Average dollar amount expended on exercise planning for tribes (10% target range) 6 Percentage of tribes conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement (70% target range) 7 Percentage of tribes performing phishing training (50% target range) 8 Percentage of tribes conducting awareness campaigns (90% target range)

9 Percent of tribes providing role-based cybersecurity awareness training to employees (60% target range)

10 Percentage of tribes with capabilities to analyze network traffic and activities related to potential threats (60% target range)

11 Percentage of tribes implementing multi-factor authentication (MFA) for all remote access and privileged accounts (70% target range)

12 Percentage of tribes with programs to anticipate and discontinue use of end-of-life software and hardware (60% target range)

13 Percentage of tribes prohibiting the use of known/fixed/default passwords and credentials (75% target range)

14 Percentage of tribes operating under the “.gov” internet domain (50% target range) 15 Number of cybersecurity gaps or issues addressed annually by tribes (50% target range) 16 Percentage of tribes-created performance metrics that were met (50% target range) 17 Percentage of tribes participating in CISA services (50% target range) 18 Percentage of tribes that have implemented data encryption projects (50% target range) 19 Percentage of tribes that have implemented enhanced logging projects (60% target range)

20 Percentage of tribes that have implemented system reconstitution projects (60% target range)

F. General Funding Requirements Costs charged to federal awards (including federal and non-federal cost share funds) must comply with applicable statutes, rules and regulations, policies, this NOFO, and the terms and conditions of the federal award. This includes, among other requirements, that costs must be incurred, and products and services must be delivered within the budget period. 2 C.F.R. § 200.403(h).

Recipients may not use federal funds or any cost share funds for the following activities:

1. Matching or cost sharing requirements for other federal grants and cooperative agreements (see 2 C.F.R. § 200.306).

2. Lobbying or other prohibited activities under 18 U.S.C. § 1913 or 2 C.F.R. § 200.450.

3. Prosecuting claims against the federal government or any other government entity (see 2

C.F.R. § 200.435).

G. Indirect Costs (Facilities and Administrative Costs) Indirect costs are allowed for recipients.

Indirect costs (IDC) are costs incurred for a common or joint purpose benefitting more than one cost objective and not readily assignable to specific cost objectives without disproportionate effort. Applicants with a current negotiated IDC rate agreement who desire to charge indirect costs to a federal award must provide a copy of their IDC rate agreement with their applications.

Not all applicants are required to have a current negotiated IDC rate agreement. Applicants that are not required to have a negotiated IDC rate agreement, but are required to develop an IDC rate proposal, must provide a copy of their proposal with their applications. Applicants without a current negotiated IDC rate agreement (including a provisional rate) and wish to charge the de minimis rate must reach out to FEMA for further instructions. Applicants who wish to use a cost allocation plan in lieu of an IDC rate proposal must reach out to FEMA for further instructions.

As it relates to the IDC for subrecipients, a recipient must follow the requirements of 2 C.F.R. §§

200.332 and 200.414 in approving the IDC rate for subawards.

Indirect Cost Agreement or Proposal Applicants should submit their unexpired, Negotiated Indirect Cost Rate Agreement as an attachment in FEMA GO, if the budget includes indirect costs. Contact the relevant FEMA staff identified in Section 1.P of this notice, “DHS Awarding Agency Contact Information” for further instructions.

Establishing Indirect Cost Rates The processes for establishing the indirect cost rate vary based on the type of entity and the amount of funding they receive:

1. If the entity is a non-governmental entity, and is a subrecipient, indirect cost rate procedures are outlined in 2 C.F.R. § 200.332(b)(4). These types of entities may either use the de minimis rate or negotiate a rate with the pass-through entity.

2. If the subrecipient is a governmental department or agency, indirect cost rate procedures are established in 2 C.F.R. Part 200, Appendix VII. Per Paragraph D.1.a. of Appendix https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRea20080eff2ea53/section-200.403 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRea20080eff2ea53/section-200.403 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-D/section-200.306 https://uscode.house.gov/view.xhtml?req=granuleid:USC-1999-title18-section1913&num=0&edition=1999 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRed1f39f9b3d4e72/section-200.450 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRed1f39f9b3d4e72/section-200.435 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-D/subject-group-ECFR031321e29ac5bbd/section-200.332 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-D/subject-group-ECFR031321e29ac5bbd/section-200.332 https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-E/subject-group-ECFRd93f2a98b1f6455/section-200.414

VII, all departments or agencies of the governmental unit desiring to claim indirect costs under Federal awards must prepare an indirect cost rate proposal and related documentation to support those costs.

3. If the governmental department or agency receives more than $35 million in grant funding in a fiscal year, the proposal must be approved by the cognizant agency. 2 C.F.R.

Part 200, Appendix VII, Paragraph D.1.b.

4. If a governmental department or agency receives $35 million or less in grant funding in a fiscal year, they must develop an indirect cost rate proposal, but that indirect cost rate proposal does not need to be approved by the cognizant agency. 2 C.F.R. Part 200, Appendix VII, Paragraph D.1.c.

5. If a state, local governmental, or tribal entity wants to use the de minimis rate (instead of developing an indirect cost rate proposal), they can request a case-by-case exception from FEMA (per 2 C.F.R. § 200.102(b)).

H. Management and Administration (M&A) Costs M&A costs are allowed.

A maximum of up to 5% of TCGP funds awarded may be used by the tribal government solely for M&A purposes associated with the TCGP award. Indirect costs and M&A costs are not the same and, therefore, should not be combined on the Project Worksheet application document.

For TCGP, allowable M&A are direct costs only. The M&A percentage, amount and purpose should be entered on the Project Worksheet. To request M&A costs, recipients will need to reduce their investment funding amount(s) on the PW and IJ to account for the M&A funding amounts. If an applicant wants to claim indirect costs for their TCGP application, please refer to Section G above and include indirect costs as a separate line item on the Project Worksheet.

M&A costs are for activities directly related to the management and administration of the award, such as financial management, reporting, and program and financial monitoring. Some examples of M&A costs include grants management training for M&A staff, membership fees for M&A staff, equipment and supplies for M&A staff to administer the grant award, travel costs for M&A staff to attend conferences or training related to the grant program, travel costs for the M&A staff to conduct project oversight and monitoring, contractual services to support the M&A staff with M&A activities, and auditing costs related to the grant award to the extent required or permitted by statute or 2 C.F.R. Part 200. All membership costs utilizing TCGP funding must be approved in advance by FEMA.

Characteristics of M&A expenses can include the following:

i. Direct costs that are incurred to administer a particular federal award;

ii. Identifiable and unique to each federal award;

iii. Charged based on the activity performed for that particular federal award; and

iv. Not duplicative of the same costs that are included in the approved Indirect Cost Rate

Agreement, if applicable.

I. Program-Specific Unallowable Costs For FY 2025 TCGP, grant funds may not be used for the following:

a. Spyware;

b. Construction;

c. Renovation;

d. To pay a ransom;

e. For recreational or social purposes;

f. To pay for cybersecurity insurance premiums;

g. Costs associated with the Tribal Information Sharing and Analysis Center (Tribal-ISAC), and the Center for Internet Security (e.g. Election Infrastructure Information Sharing and Analysis Center (EI-ISAC)), including but not limited to membership fees and services;

h. To acquire land or to construct, remodel, or perform alterations of buildings or other physical facilities. This prohibition does not include minor building modifications.

Unallowed “alterations” include permanent modifications that substantially affect the building’s structure, layout, or systems, affect critical aspects of a building’s safety (such as structural integrity, fire safety systems), or other modifications that materially increase the value or useful life of the building.

• Examples of the types of alterations that are unallowable with TCGP funding, or the non-federal cost share, are listed below:

o Updating an electrical system to a building which involves work to enhance or modernize the electrical infrastructure, such as replacing electrical panels, upgrading old or unsafe wiring, and replacing circuit breakers. This type of work is likely a modification that substantially affects the building’s systems and thus would comprise an alteration.

o Installing new walls or reconfiguring existing ones.

o Affixing equipment in such a way that it becomes a permanent part of a building

(as this would result in the equipment no longer being personal property).

i. For any purpose that does not address cybersecurity risks or cybersecurity threats on information systems owned or operated by, or on behalf of, the eligible entity that receives the grant or a local government within the jurisdiction of the eligible entity;

j. To supplant state or local funds; however, this shall not be construed to prohibit the use of funds from a grant under this NOFO for otherwise permissible uses on the basis that the SLTT has previously used SLTT funds to support the same or similar uses; and

k. For any recipient or subrecipient cost-sharing contribution.

J. Pre-Award Costs No pre-award costs are allowable for FY 2025 TCGP.

K. Beneficiary Eligibility This NOFO and any subsequent federal awards create no rights or causes of action for any beneficiary.

L. Participant Eligibility This NOFO and any subsequent federal awards create no rights or causes of action for any participant.

M. Authorizing Authority Homeland Security Act of 2002, Pub. L. No. 107-296, § 2220A codified as amended at 6 U.S.C. § 665g.

N. Appropriation Authority Infrastructure Investment and Jobs Act, Pub. L. No. 117-58, Division J, Title V

O. Budget Period There will be only a single budget period with the same start and end dates as the period of performance.

P. Prohibition on Covered Equipment or Services Recipients, sub-recipients, and their contractors or subcontractors must comply with the prohibitions set forth in Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, which restrict the purchase of covered telecommunications and surveillance equipment and services. Please see 2 C.F.R. §§ 200.216, 200.327, 200.471, and Appendix II to 2 C.F.R. Part 200, and FEMA Policy #405-143-1 - Prohibitions on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services for more information.

4. Application Contents and Format A. Pre-Application, Letter of Intent, and Whitepapers Not applicable.

B. Application Content and Format Not applicable.

All application forms are available on Grants.gov or FEMA’s TCGP website.

C. Application Components The following forms or information are required to be submitted via FEMA GO. The Standard Forms (SF) are also available at Forms | Grants.gov.

• SF-424, Application for Federal Assistance

• Grants.gov Lobbying Form, Certification Regarding…