FY2023 SLCGP NOFO_OMB approved_508c_FINAL_08.03.23.pdf

FY 2023 SLCGP NOFO

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

Fiscal Year 2023 State and Local Cybersecurity Grant Program (SLCGP)

All entities wishing to do business with the federal government must have a unique entity identifier (UEI). The UEI number is issued by the system. Instructions for requesting a UEI using Sam.gov can be found at: https://sam.gov/content/entity-registration.

Grants.gov registration information can be found at:

https://www.grants.gov/web/grants/register.html.

Planned UEI Updates in Grant Application Forms:

On April 4, 2022, the Data Universal Numbering System (DUNS) Number was replaced by a new, non-proprietary identifier requested in, and assigned by, the System for Award Management (SAM.gov). This new identifier is the Unique Entity Identifier (UEI).

Additional Information can be found on Grants.gov:

https://www.grants.gov/web/grants/forms/planned-uei-updates.html

Table of Contents Planned UEI Updates in Grant Application Forms:

A. Program Description

1. Issued By

2. Assistance Listings Number

3. Assistance Listings Title

4. Funding Opportunity Title

5. Funding Opportunity Number

6. Authorizing Authority for Program

7. Appropriation Authority for Program

8. Announcement Type

9. Program Category

10. Program Overview, Objectives, and Priorities

a. Overview 5

b. Objectives 6

c. Priorities 7

11. Performance Measures B. Federal Award Information

1. Available Funding for the NOFO: $374,981,324

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

4. Projected Period of Performance Start Date(s): Dec. 1, 2023

5. Projected Period of Performance End Date(s): Nov. 30, 2027

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

a. Eligible Entity 14 https://sam.gov/content/entity-registration https://www.grants.gov/web/grants/register.html https://www.grants.gov/web/grants/forms/planned-uei-updates.html

b. Eligible Subrecipient Entities 14

c. Educational Institutions 14

2. Applicant Eligibility Criteria

3. Other Eligibility Criteria/Restrictions

4. Cost Share or Match

a. Types of Cost Share/Match 16

b. Cost Share Documentation 16

c. Calculating Cost Share for the Application 17

d. Calculating Cost Share for Projects 17

e. Future Cost Share Amounts 17

f. Cost Share Waiver 18

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: Aug. 7, 2023, at 8:45 a.m. ET

b. Application Submission Deadline: Oct. 6, 2023, at 5:00 p.m. ET

c. Anticipated Award Date: No later than Dec. 1, 2023

d. Other Key Dates 20

2. Agreeing to Terms and Conditions of the Award

3. Address to Request Application Package

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM)

5. Steps Required to Obtain a Unique Entity Identifier, Register in System for Award

Management (SAM), and Submit an Application

6. Electronic Delivery

7. How to Register to Apply through Grants.gov

a. General Instructions: 22

b. Obtain an UEI Number: 23

c. Obtain Employer Identification Number: 23

d. Create a login.gov account: 23

e. Register with SAM: 23

f. Create a Grants.gov Account: 24

g. Add a Profile to a Grants.gov Account: 24

h. EBiz Point of Contact (POC) Authorized Profile Roles: 24

i. Track Role Status: 25

j. Electronic Signature: 25

8. How to Submit an Initial Application to FEMA via Grants.gov

a. Create a Workspace: 25

b. Complete a Workspace: 25

c. Adobe Reader: 25

d. Mandatory Fields in Forms: 26

e. Complete SF-424 Fields First: 26

f. Submit a Workspace: 26

g. Track a Workspace: 26

h. Additional Training and Applicant Support: 26

9. Submitting the Final Application in ND Grants

10. Timely Receipt Requirements and Proof of Timely Submission

11. Content and Form of Application Submission

a. Standard Required Application Forms and Information 27

b. Program-Specific Required Forms and Information 28

12. Intergovernmental Review

13. Funding Restrictions and Allowable Costs

a. Prohibitions on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services 31

b. Pre-Award Costs 33

c. Management and Administration (M&A) Costs 33

d. Indirect Facilities and Administrative (F&A) Costs 34

e. Other Direct Costs 35

E. Application Review Information

1. Application Evaluation Criteria

a. Programmatic Criteria 35

b. Financial Integrity Criteria 35

c. Supplemental Financial Integrity Criteria and Review 36

2. Review and Selection Process F. Federal Award Administration Information

1. Notice of Award

2. Pass-Through Requirements

a. Documenting the Pass-Through 37

b. Rural Area Pass-Through 38

c. Exceptions to the Pass-Through Requirement 38

d. Timing 38

e. Other Guidance and Requirements for Passing Through Items, Services, Capabilities, or Activities in Lieu of Funding 39

3. Administrative and National Policy Requirements

a. DHS Standard Terms and Conditions 40

b. Ensuring the Protection of Civil Rights 40

c. Environmental Planning and Historic Preservation (EHP) Compliance 40

d. SAFECOM Guidance Compliance 42

e. Requirement for using CISA Services 42

4. Reporting

a. Financial Reporting Requirements 43

b. Programmatic Performance Reporting Requirements 44

c. Closeout Reporting Requirements 44

d. Additional Reporting Requirements 46

5. Program Evaluation

6. Monitoring and Oversight

G. DHS Awarding Agency Contact Information

1. Contact and Resource Information

a. FEMA SLCGP Preparedness Officers 49

b. CISA Grant Program Office 49

c. FEMA Grant Programs Directorate (GPD) Award Administration Division (AAD)

d. FEMA Grants News 49

e. Equal Rights 49

f. Environmental Planning and Historic Preservation 50

2. Systems Information

a. Grants.gov 50

b. Non-Disaster (ND) Grants 50

c. Payment and Reporting System (PARS) 50

H. Additional Information

1. Termination Provisions

a. Noncompliance 50

b. With the Consent of the Recipient 51

c. Notification by the Recipient 51

2. Program Evaluation

3. Period of Performance Extensions

4. Disability Integration

5. Conflicts of Interest in the Administration of Federal Awards or Subawards

6. Procurement Integrity

a. Important Changes to Procurement Standards in 2 C.F.R. Part 200 54

b. Competition and Conflicts of Interest 55

c. Supply Schedules and Purchasing Programs 56

d. Procurement Documentation 58

7. Financial Assistance Programs for Infrastructure

a. Build America, Buy America Act 58

b. Waivers 59

c. Definitions 59

8. Record Retention

a. Record Retention Period 60

b. Types of Records to Retain 61

9. Actions to Address Noncompliance

10. Audits

11. Payment Information

12. Whole Community Preparedness

13. Continuity Capability

14. Appendices

Appendix A: Program Goals and Objectives 66 Appendix B: Cybersecurity Planning Committee and Charter 70 Appendix C: Cybersecurity Plan 74 Appendix D: POETE Solution Areas for Investments 82 Appendix E. SLCGP Requirements Matrix 85 Appendix F: Required, Encouraged, and Optional Services, Memberships, and Resources 87

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA)/Resilience/Grant Programs Directorate (GPD)

2. Assistance Listings Number 97.137

3. Assistance Listings Title State and Local Cybersecurity Grant Program

4. Funding Opportunity Title Fiscal Year 2023 State and Local Cybersecurity Grant Program (SLCGP)

5. Funding Opportunity Number

DHS-23-GPD-137-00-01

6. Authorizing Authority for Program Section 2220A of the Homeland Security Act of 2002, as amended (Pub. L. No. 107-296) (6 U.S.C. § 665g)

7. Appropriation Authority for Program Infrastructure Investment and Jobs Act (Pub. L. No. 117-58, Division J, Title V)

8. Announcement Type Initial

9. Program Category Preparedness: Infrastructure Security

10. Program Overview, Objectives, and Priorities

a. Overview

Our nation faces unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure. Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of state, local and territorial (SLT) governments is an important homeland security mission and the primary focus of SLCGP. Through funding from the Infrastructure Investment and Jobs Act referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies, thus improving the security of critical infrastructure and improving the resilience of the services SLT governments provide their communities.

The Fiscal Year (FY) 2023 SLCGP aligns with the National Cybersecurity Strategy by addressing three of the five pillars:

• Pillar One – Defend Critical Infrastructure,

• Pillar Two – Disrupt and Dismantle Threat Actors, and

• Pillar Four – Invest in a Resilient Future.

The FY 2023 SLCGP also addresses the 2020-2024 DHS Strategic Plan by helping DHS achieve Goal 3: Secure Cyberspace and Critical Infrastructure. This includes Objective 3.3:

Assess and Counter Evolving Cybersecurity Risks.

Additionally, the FY 2023 SLCGP supports the 2022-2026 FEMA Strategic Plan, which outlines a bold vision with three ambitious goals, including Goal 3: Promote and Sustain a Ready FEMA and Prepared Nation, under which falls Objective 3.2: Posture FEMA to meet current and emergent threats. The FY 2023 SLCGP also aligns with the Cybersecurity and Infrastructure Security Agency’s (CISA) 2023–2025 Strategic Plan, which encompasses Goal 1: Cyber Defense, Goal 2: Risk Reduction and Resilience and Goal 3: Operational Collaboration.

b. Objectives

The goal of SLCGP is to assist SLT governments with managing and reducing systemic cyber risk. This goal can be achieved over the course of the four years of SLCGP funding as applicants focus their Cybersecurity Plans, priorities, projects, and implementation toward addressing the SLCGP objectives. Once CISA confirms that a recipient has met their objective requirements for each fiscal year, the recipient moves to the next set of program objective(s).

During FY 2022, applicants focused on Program Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure continuity of operations.

In FY 2023, applicants are required to focus on addressing the following program objectives in their applications:

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

Applicants should refer to Appendix A, “Program Goals and Objectives” for more information on SLCGP program goals, objectives, sub-objectives, and desired outcomes required in their FY 2023 SLCGP application.

https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 https://www.fema.gov/about/strategic-plan https://www.cisa.gov/resources-tools/resources/2023-2025-strategic-plan

Eligible subrecipients include local governments, Indian tribes or authorized tribal organizations, rural communities, unincorporated towns or villages, and other public entities.

Nonprofit and private organizations are not eligible subrecipients.

c. Priorities

I. CYBERSECURITY PLANS, COMMITTEES AND CHARTER

The Homeland Security Act of 2002, as amended by the BIL, requires SLCGP grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the plan, and identify projects to implement using SLCGP funding.

With the FY 2022 SLCGP, recipients were directed to accomplish the following:

• Establish a Cybersecurity Planning Committee;

• Develop a state-wide Cybersecurity Plan, unless the recipient already has a state-wide

Cybersecurity Plan; and

• Use SLCGP funds to implement or revise a state-wide Cybersecurity Plan.

For those states that did not apply for FY 2022 SLCGP funding, or for FY 2022 SLCGP recipients that were unable to meet the requirements listed above, please refer to Appendix A, “Program Goals and Objectives” and Appendix B, “Cybersecurity Planning Committee and Charter” for more information on the FY 2022 requirements that must be met before development of applications for FY 2023.

For FY 2023, there are no new Cybersecurity Planning Committee and Cybersecurity Plan requirements. CISA considers the plans as living documents that states and territories may update and resubmit, if desired. Eligible applicants must coordinate with the appropriate CISA Regional Representatives before submitting or updating their Cybersecurity Plan, Investment Justifications (IJ) and/or Project Worksheets (PW) (See Section G of this funding notice for relevant contact information).

For FY 2024, states and territories can anticipate additional guidance for updating their Cybersecurity Planning Committees and Cybersecurity Plans.

II. CYBERSECURITY ACTIVITIES, BEST PRACTICES, INVESTMENTS AND PROJECTS

Cybersecurity Activities The State Administrative Agency (SAA) must consult with its Chief Information Officer (CIO) and the Chief Information Security Officer (CISO) (or an equivalent official of the eligible entity) regarding the plans for allocating SLCGP funds. To support the FY 2023 SLCGP requirements, Cybersecurity Plans must include the following activities:

a. Conducting assessment and evaluations as the basis for individual projects throughout the life of the program; and

b. Adopting key cybersecurity best practices and consulting Cybersecurity Performance Goals (CPGs).

i. The CPGs are a prioritized subset of information technology and operational technology cybersecurity practices aimed at meaningfully reducing risks to both critical infrastructure operations and the American people.

ii. These goals are applicable across all critical infrastructure sectors and are informed by the most common and impactful threats and adversary tactics, https://www.cisa.gov/cross-sector-cybersecurity-performance-goals techniques, and procedures observed by CISA and its government and industry partners, making them a common set of protections that all critical infrastructure entities – from large to small – should implement.

iii. The CPGs do not reflect an all-encompassing cybersecurity program – rather, they are a minimum set of practices that organizations should implement toward ensuring a strong cybersecurity posture.

iv. The Cross-Sector Cybersecurity Performance Goals are regularly updated, with a targeted revision cycle of at least every 6 to 12 months.

Key Cybersecurity Best Practices for Individual Projects To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, SLT governments must take decisive steps to modernize their approach to cybersecurity. As states, territories, and local entities increase their cybersecurity maturity, CISA recommends they move toward implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing. To assist in the revision of SLT cyber planning efforts, the following Cybersecurity Best Practices are provided. As appropriate, the strategic elements listed in the table below should be included in FY 2023 individual projects:

Cybersecurity Best Practices for Individual Projects

Implement multi-factor authentication Implement enhanced logging Data encryption for data at rest and in transit End use of unsupported/end of life software and hardware that are accessible from the internet Prohibit use of known/fixed/default passwords and credentials Ensure the ability to reconstitute systems (backups) Actively engage in bidirectional sharing between CISA and SLT entities in cyber relevant time frames to drive down cyber risk Migration to the .gov internet domain

Cybersecurity Investments and Projects Given the Cybersecurity Plan is a strategic document, it should not identify specific vulnerabilities but instead capture the broad level of capability across the jurisdiction. The Cybersecurity Plan must also show how the implementation of the individual projects and activities over time will help achieve the goals and objectives of the plan. The summary of projects using FY 2023 SLCGP funds associated with each required and discretionary element provides a helpful snapshot of state- and territory-wide capabilities and capacity that will be achieved as a result of this funding. Details for each project using SLCGP funds must be included in the Investment Justifications (IJs).

Each IJ must provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces, which have influenced the development of the IJ. The IJ must include a summary of the current capabilities within the applicant jurisdiction to address these threats and risks. The IJ should also include a description of how the proposed project addresses gaps identified in or sustainment of the approved Cybersecurity Plan and how the project aligns to the cybersecurity elements in this NOFO. Finally, the IJ should include implementation planning data to assist in project management.

The Project Worksheet (PW) will be used to identify the budget details and budget narrative portion of the application. Eligible applicants should submit only one PW as part of the overall application and must include information for each IJ submitted as part of the application for funding. More information on the IJ Form, PW and instructions can be found in Section D.11 in this funding notice.

III. MULTI-ENTITY PROJECTS

Multiple eligible entities (states or territories) can group together to address cybersecurity risks and threats to information systems within the states and territories which are the eligible entities. There is no separate funding for multi-entity projects. Instead, these investments would be considered as group projects: each group member contributing an agreed-upon funding amount from their SLCGP award to the overall project. Each group member’s financial contribution is then funded from their individual SLCGP award. Each participating state or territory in the group should include the multi-entity project in their individual IJ submissions with their application. It is expected that IJs for multi-entity projects will be almost identical. Any differences should reflect alignment with the entities’ respective Cybersecurity Plan.

The multi-entity project submissions must be approved by each of the participating state or territory’s Cybersecurity Planning Committees, and each of the multi-entity project submissions must be aligned with each of the participating state or territory’s respective Cybersecurity Plan. For multi-entity groups, each participating state or territory must have a CISA-approved Cybersecurity Plan. The project must improve or sustain capabilities identified in the respective Cybersecurity Plan for each eligible entity.

Multi-Entity Project Requirements and Process Overview The following must be included in each of the participating state or territory group members’ Cybersecurity Plans, the Investment Justifications and Project Worksheets for the multi-entity project:

• A detailed description of the overall project;

• The division of responsibilities among each participating state or territory group member entity;

• The distribution of funding among the participating state or territory group member entities; and

• Overview of how implementation of the multi-entity project will help achieve the goals and objectives in the Cybersecurity Plan of each participating entity.

Multi-Entity Project Benefits A multi-entity project is funded from each participating state or territory group members’ SLCGP award in accordance with their agreed-upon contribution amounts. Since the multi-entity group may be comprised of state and territory governments, each can benefit from information sharing and awareness opportunities. Multi-entity projects may permit smaller state and territory entities to combine resources with larger state and territory entities to reap the benefits associated with larger acquisitions. At the same time, all parties to a multi-entity project may realize cost savings due to volume purchases. Lastly, the non-federal cost share in FY 2023 SLCGP for the projects in a multi-entity project is 10%.

IV. IMMINENT CYBERSECURITY THREAT

SLCGP is primarily a security preparedness program focused on reducing cyber risks by helping SLT entities address cybersecurity vulnerabilities and build cybersecurity capabilities. Over time, the program activities and investments reduce the potential impact of cybersecurity threats and incidents. The Homeland Security Act of 2002, as amended in 6 U.S.C. § 665g(d)(4), provides that “An eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section, as appropriate, shall use the grant to…(4) assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the [CISA] Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.”

The following provides a general overview of the processes for the FY 2023 grant cycle from a grant management perspective. Specific details on CISA’s criteria and process for confirming an imminent cybersecurity threat are not included here. The following also does not supersede or replace existing threat notification procedures or existing methods to collaborate on operational cybersecurity matters.

Process Overview

• Any eligible entity seeking to use SLCGP funds to address an imminent cybersecurity threat, as confirmed by the Secretary, acting through the CISA Director, must have a Cybersecurity Plan approved by CISA.

• DHS, through CISA, will determine if an incident constitutes as an imminent cybersecurity threat.

• Upon confirmation, DHS will notify the SLCGP SAA and the SAA must notify the state or territory Cybersecurity Planning Committee and CIO/ CISO/equivalent.

• DHS will notify impacted SLT entities, as appropriate, of permissible imminent cybersecurity threat fund usage.

• FEMA will issue an Information Bulletin detailing the impacted entities and procedures for reprograming SLCGP funds in support of the specific imminent cybersecurity threat. The scope of the Information Bulletin will be dependent on the nature of the imminent cybersecurity threat.

11. Performance Measures

DHS will communicate with all SLCGP SAA recipients on the information collection process related to performance measures data. DHS will measure the recipient’s performance by comparing the number of activities and projects needed and requested in its IJs with the number of activities and projects acquired and delivered by the end of the period of performance (POP) using the following programmatic metrics:

Performance Measures

Percentage of entities with CISA approved state-wide Cybersecurity Plans

Percentage of entities with statewide Cybersecurity Planning Committees that meet the Homeland Security Act of 2002 and SLCGP funding notice requirements Percentage of entities conducting annual table-top and full-scope exercises to test Cybersecurity Plans Percent of the entities’ SLCGP budget allocated to exercises Average dollar amount expended on exercise planning for entities Percentage of entities conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement Percentage of entities performing phishing training Percentage of entities conducting awareness campaigns Percent of entities providing role-based cybersecurity awareness training to employees Percentage of entities adopting the Workforce Framework for Cybersecurity (NICE Framework) as evidenced by established workforce development and training plans Percentage of entities with capabilities to analyze network traffic and activities related to potential threats Percentage of entities implementing multi-factor authentication (MFA) for all remote access and privileged accounts Percentage of entities with programs to anticipate and discontinue use of end-of-life software and hardware

Percentage of entities prohibiting the use of known/fixed/default passwords and credentials Percentage of entities operating under the “.gov” internet domain Number of cybersecurity gaps or issues addressed annually by entities

B. Federal Award Information

1. Available Funding for the NOFO: $374,981,324

For FY 2023, DHS will award funds to states and territories based on baseline minimums and population as required by section 2200A(l) of the Homeland Security Act of 2002 (codified at 6 U.S.C. § 665g(l)) and described below.

Each state and territory will receive a baseline allocation using thresholds established in section 2200A(l) of the Homeland Security Act of 2002 (codified at 6 U.S.C. § 665g(l)). All 50 States, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $4,082,282 each, equaling 1% of total funds appropriated to DHS in FY 2023.

Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $1,020,570, equaling 0.25% of the total funds appropriated to DHS in FY 2023. $79,310,190, 50% of the remaining amount, will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories. The remaining $79,310,190, equaling the other 50% of the remaining amount, will be apportioned based on the ratio that the population of each state that resides in rural areas bears to the population of all states that resides in rural areas.

FY 2023 SLCGP Allocations State/Territory FY 2023 SLCGP

Allocation State/Territory FY 2023 SLCGP

Allocation

Alabama $7,840,285 Nevada $5,072,822

Alaska $4,567,677 New Hampshire $5,096,082

Arizona $6,776,692 New Jersey $6,858,348

Arkansas $6,402,359 New Mexico $5,178,907

California $15,879,497 New York $11,588,894

Colorado $6,553,216 North Carolina $10,813,417

Connecticut $5,465,875 North Dakota $4,666,397

Delaware $4,546,985 Ohio $10,042,553

District of Columbia $4,240,457 Oklahoma $6,665,123

Florida $11,997,340 Oregon $6,047,316

Georgia $9,873,903 Pennsylvania $10,463,799

Hawaii $4,567,336 Rhode Island $4,467,229

Idaho $5,210,589 South Carolina $7,428,446

Illinois $8,834,866 South Dakota $4,766,558

Indiana $7,977,398 Tennessee $8,606,142

Iowa $6,228,366 Texas $17,418,110

Kansas $5,707,130 Utah $5,348,368

Kentucky $7,413,939 Vermont $4,717,850

Louisiana $6,732,858 Virginia $8,712,723

Maine $5,439,273 Washington $7,403,503

Maryland $6,514,533 West Virginia $5,620,962

Massachusetts $6,419,112 Wisconsin $7,666,939

Michigan $9,609,530 Wyoming $4,477,270

Minnesota $7,270,657 Puerto Rico $5,068,610

Mississippi $6,639,551 U.S. Virgin Islands $1,046,957

Missouri $7,748,105 American Samoa $1,039,880

Montana $4,947,036 Guam $1,068,051

Nebraska $5,188,485 Northern Mariana Islands

$1,037,018

Total $374,981,324

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

Extensions to the period of performance are allowed. Refer to Section I.3 of this NOFO, for additional information on period of performance extensions. FEMA awards under most programs, including this program, only include one budget period, so it will be same as the period of performance. See 2 C.F.R. § 200.1 for definitions of “budget period” and “period of performance.”

4. Projected Period of Performance Start Date(s): Dec. 1, 2023

5. Projected Period of Performance End Date(s): Nov. 30, 2027

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. The Governor-designated SLCGP SAA is the only entity eligible to submit SLCGP applications to DHS/FEMA.

a. Eligible Entity “State” is defined in 6 U.S.C. § 101(17) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

b. Eligible Subrecipient Entities “Local government” is defined in 6 U.S.C. § 101(13) as:

a. A county, municipality, city, town, township, local public authority, school district, special district, intrastate district, council of governments (regardless of whether the council of governments is incorporated as a nonprofit corporation under state law), regional or interstate government entity, or agency or instrumentality of a local government;

b. *An Indian tribe or authorized tribal organization, or in Alaska a Native village or Alaska Regional Native Corporation; and

c. A rural community, unincorporated town or village, or other public entity.

*Although tribes are not eligible to apply directly for SLCGP funding, they may be eligible subrecipients, and can receive SLCGP funding as a local government. Each individual SAA may determine whether and how much SLCGP funding to pass through to tribal entities.

DHS does not have the authority to mandate that a certain percentage of SLCGP funds are directed to tribal governments. Additionally, funding will be directly available to eligible tribal entities under the forthcoming Tribal Cybersecurity Grant Program, for which DHS will expects to publish the funding notice this year.

Ineligible subrecipient entities include:

a. Nonprofit organizations; and

b. Private corporations.

c. Educational Institutions

A public educational institution (e.g., elementary school, secondary school, or institution of higher education) is generally eligible to receive assistance under SLCGP if it is an agency or instrumentality of a state or local government under state and/or local law. In contrast, a private educational institution would not be eligible to receive SLCGP assistance because it is not an agency or instrumentality of a state or local government. “Assistance” means either funding, non-funding assistance (i.e., items, services, capabilities, or activities), or a combination of both. The eligibility of charter schools depends on the function of the charter school – it will be eligible if, and only if, it is an agency or an instrumentality of the state or local government. This will be a determination for the SAA to make (and to justify, if necessary), based on state or local law. The SAA for an SLCGP grant award is responsible for demonstrating the eligibility of each entity receiving assistance and should consult with FEMA if there is uncertainty regarding eligibility for a particular entity.

2. Applicant Eligibility Criteria

Applicants must be one of the 56 states and territories that are eligible for the program. One or more states or territories may submit a multi-entity project.

3. Other Eligibility Criteria/Restrictions

Each eligible entity is required to meet the following criteria for FY 2023:

a. Submit a Cybersecurity Plan, Cybersecurity Planning Committee Membership List and a Cybersecurity Charter that aligns with the criteria detailed in this NOFO, unless the applicant has a CISA-approved Cybersecurity Plan, Committee Membership List and Charter;

b. FEMA will not release funds to a recipient until CISA approves the entity’s Cybersecurity Plan; and

c. Details on the requirements for the Cybersecurity Plan, Committee Membership List and Charter can be found in Appendix A - C in this funding notice.

4. Cost Share or Match

Eligible entities must meet a 20% cost share requirement for the FY 2023 SLCGP. The recipient contribution can be cash (hard match) or third-party in-kind (soft match). Eligible applicants must agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 20% of the total project costs (federal award amount plus cost share amount). For FY 2023, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S.

Virgin Islands, and the Commonwealth of the Northern Mariana Islands.

DHS/FEMA administers cost-matching requirements in accordance with 2 C.F.R. § 200.306.

To meet matching requirements, the recipient contributions must be verifiable, reasonable, allocable, and necessary, and otherwise allowable under the grant program, and in compliance with all applicable federal requirements and regulations. The non-federal cost share requirement cannot be matched with other federal funds, unless specifically authorized by the legislation governing that other source of federal funding.

By statute, the cost share applies to each individual project funded by the grant award rather than just to the cumulative total. Recipients must ensure that each activity’s cost share is met.

DHS interprets “activity” to mean all projects approved as part of the submitted Project Worksheets. The Project Worksheets must include cost share and Management and Administration (M&A) for each project objective. Also, the Project Worksheet must include a description of the source of the cost share/match. Note for post-award documentation of cost share, if funds or services are to be provided by a third party for in-kind match, a dated letter of commitment is required to document the donation.

a. Types of Cost Share/Match Hard Match (Cash) Cash or hard matching includes cash spent for project-related costs. The allowable cash match must include costs that are necessary, reasonable, and allowable under the SLCGP.

i. Examples: State or local general fund monies.

Soft Match (In-kind) Soft match refers to contributions of the reasonable value of property or services in lieu of cash which benefit a federally assisted project or program. This type of match may only be used if not restricted or prohibited by program statute, regulation or guidance and must be supported with source documentation. Only property or services that comply with program guidance and/or program regulations, are allowable. In other words, a recipient cannot use a source for the soft match that is completely unrelated to the SLCGP program’s goals, objectives, NOFO, etc. The same contribution cannot be used if it is already used as match for another grant program or paid from other grant funds. Below are some examples of allowable soft match:

i. Example 1: The dollar value of the salary and fringe benefits of the CIO position paid by state, territory or local government general fund monies who is working on cybersecurity efforts within the state, territory, or local entity government.

ii. Example 2: A hotel offers a room or space to conduct a cybersecurity training event or tabletop exercise. The hotel manager should provide the SAA with written documentation of the room rental (dollar value), date/time of the donation, signed by the hotel manager. This should align with the date/time of the training or exercise event. And, per 2 C.F.R. 200.306, “The value of donated space must not exceed the fair rental value of comparable space as established by an independent appraisal of comparable space and facilities in a privately-owned building in the same locality.”

iii. Example 3: Contributions of salary, travel, equipment, supplies, and other budget areas that are from third party sources (in compliance with 2 C.F.R. 200.306) and include voluntary contributions such as emergency personnel, lawyers, etc., who donate their time to a federal grant program. The normal per hour rate for these professionals (acting in their professional capacity) can be used to meet the matching requirement. The value of the services provided is taken into consideration when determining the value of the contribution and not who is providing the service. For example, if a lawyer is volunteering his/her services to assist the Cybersecurity Planning Committee with preparing and filing legal paperwork for their Charter, the lawyer’s normal hourly rate is allowable. However, if the lawyer is volunteering his/her time and services to conduct cybersecurity needs assessments as part of the state’s cyber plan implementation, the lawyer’s hourly rate would not be applicable;

instead, the hourly rate for an information technology specialist would be more reasonable and applicable.

b. Cost Share Documentation

The source documentation is very important, as it is with hard match. The source of the soft match should be:

1. Valued at the time of the donation—value must not exceed the fair market value of the equipment of the same age and condition at the time of donation.

2. Signed and dated by the donating company, person, etc.

3. For third-party in-kind contributions, the fair market value of goods and services must be documented and, to the extent feasible, supported by the same methods used internally by the non-federal entity.

c. Calculating Cost Share for the Application

Applicants must make available non-federal funds to carry out an SLCGP award in an amount not less than 20% of the total project costs (federal award amount plus cost share amount). The cost share for the multi-entity projects is 10%.

Formula: Federal Award Amount / Federal Share Percentage = Total Project Cost;

Total Project Cost x Cost Share Percentage = Cost Share Amount

i. Example: If the federal award is $100,000 with an 80% federal share percentage and a 20% cost share percentage, the cost share amount is calculated below:

• $100,000 (Federal Award Amount) / .80 = $125,000 (Total Project Cost)

• $125,000 x .20 = $25,000 (Cost Share Amount)

d. Calculating Cost Share for Projects

Cost share must be provided on a project basis. To calculate cost share for a project, please see the following formula and example:

Formula: Total Project Cost x Cost Share Percentage of the Project = Cost Share Amount;

Total Project Cost x Federal Percentage Share of the Project = Federal Amount for the Project

i. Example: If the total project cost is $125,000, the cost share percentage of the project is 20% and the federal percentage share of the project is 80%, the cost share amount for the project and federal amount for the project is calculated below:

• $125,000 x .20 = $25,000 (Cost Share Amount for Project)

• $125,000 x .80 = $100,000 (Federal Share Amount for Project)

e. Future Cost Share Amounts

With the exception for multi-entity projects, for SLCGP planning purposes, the following chart indicates the federal share and cost share percentages for SLCGP FY 2022 - 2025:

Federal fiscal year

(FFY)

Federal share percentage

Non-federal cost share percentage

2022 90% 10% 2023 80% 20% 2024 70% 30% 2025 60% 40%

f. Cost Share Waiver

The Secretary of Homeland Security (or designee) may waive or modify the non-federal share for an individual entity if the entity demonstrates economic hardship. The Homeland Security Act of 2002, as amended, requires SLCGP recipients in FY 2023 to provide a non-federal cost share of 20% if they are applying as a single entity (6 U.S.C. § 665g(m)(1)).

However, DHS is not able to provide additional funds even if it does grant a cost share waiver. The federal funding will remain at the same amount as indicated by the statutory formula.

Additionally, in accordance with 48 U.S.C. § 1469a cost share requirements for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands are waived, provided the cost share is less than $200,000.

Economic Hardship Factors 6 U.S.C. § 665g(m)(2)(C) requires the Secretary of Homeland Security (or designee) to consider the following factors when determining economic hardship:

a. Changes in rates of unemployment in the jurisdiction from previous years;

b. Changes in the percentage of individuals who are eligible to receive benefits under the supplemental nutrition assistance program established under the Food and Nutrition Act of 2008 (7 U.S.C. § 2011 et seq.) from previous years; and

c. Any other factors the Secretary considers appropriate.

In addition, for FY 2023, the Secretary of Homeland Security (or designee) will also consider the following factors in determining economic hardship:

a. Demonstration that the rate of unemployment has exceeded the annual national average rate of unemployment for three of the past five years;

b. Demonstration that the entity has filed for bankruptcy or been placed under third-party financial oversight or receivership within the past three years; and

c. For local units of government only, demonstration that those localities have areas within them that are designated as either “high” or “very high” on the Centers for Disease Control and Prevention’s Social Vulnerability Index.

To be considered for a cost share waiver, eligible entities must meet at least one of the five criteria described above, but do not necessarily need to meet all of them. Requests for waivers will be considered on a case-by-case basis and evaluated holistically.

Cost Share Waiver Request Requirements To request a waiver, an eligible entity should submit a written narrative, including the following three (3) categories to demonstrate economic hardship, with its FY 2023 SLCGP application submission in the Non-Disaster (ND) Grants System:

a. History: A description of the entity’s background/history of economic hardship.

b. Austerity: Describe any measures the entity has taken to address economic hardship.

c. Operational Impact: Describe how the lack of a waiver will impact the entity’s ability to develop, implement, or revise a Cybersecurity Plan or address imminent cybersecurity threats.

A detailed justification explaining why the state (or specific local government(s) or specific project(s) if requesting only a partial waiver) is unable to fulfill the cost share requirement.

The applicant must identify specific economic hardship(s) and address the factors listed above.

Approval Process Once a decision on a waiver request is made, the SLCGP SAA will be notified in writing. If approved, the award package will indicate that the cost share has been waived in full or in part and might indicate a requirement for the state to submit a revised budget and/or scope (as applicable) for the identified project(s). If the waiver request is approved after the award has been issued, FEMA will amend the award package to indicate that the cost share has been waived in full or in part and whether the recipient must submit a revised budget and/or scope (as applicable) for the identified project(s).

Questions regarding the cost share waiver process may be directed to your FEMA Preparedness Officer by emailing FEMA-SLCGP@fema.dhs.gov.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date:

b. Application Submission Deadline:

Aug. 7, 2023, at 8:45 a.m. ET

Oct. 6, 2023, at 5:00 p.m. ET

All applications must be received by the established deadline.

The ND Grants System has a date stamp that indicates when an application is submitted.

Applicants will receive an electronic message confirming receipt of their submission. For additional information on how an applicant will be notified of application receipt, see the subsection titled “Timely Receipt Requirements and Proof of Timely Submission” in Section D of this notice.

FEMA will not review applications that are received after the deadline or consider these late applications for funding. FEMA may, however, extend the application deadline on request for any applicant who can demonstrate that good cause exists to justify extending the deadline. Good cause for an extension may include technical problems outside of the mailto:FEMA-SLCGP@fema.dhs.gov applicant’s control that prevent submission of the application by the deadline, or other exigent or emergency circumstances.

Applicants experiencing technical problems outside of their control must notify FEMA as soon as possible and before the application deadline. Failure to timely notify FEMA of the issue that prevented the timely filing of the application may preclude consideration of the award. “Timely notification” of FEMA means prior to the application deadline and within 48 hours after the applicant became aware of the issue.

A list of FEMA contacts can be found in Section H of this NOFO, “DHS Awarding Agency Contact Information.” For additional assistance using the ND Grants System, please contact the ND Grants Service Desk at (800) 865-4076 or NDGrants@fema.dhs.gov. The ND Grants Service Desk is available Monday through Friday, 9:00 AM – 6:00 p.m. Eastern Time (ET).

For programmatic or grants management questions, please contact your Program Analyst or Grants Specialist. If applicants do not know who to contact or if there are programmatic questions or concerns, please contact the Centralized Scheduling and Information Desk (CSID) by phone at (800) 368-6498 or by e-mail at askcsid@fema.dhs.gov, Monday through Friday, 9:00 AM – 5:00 p.m. ET.

c. Anticipated Award Date: No later than Dec. 1, 2023

d. Other Key Dates

2. Agreeing to Terms and Conditions of the Award

By submitting an application, applicants agree to comply with the requirements of this NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package Initial applications are processed through the Grants.gov portal. Final applications are completed and submitted through FEMA’s ND Grants System. Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov.

Event Suggested Deadline for Completion Initial registration in SAM.gov includes UEI issuance

Four weeks before actual submission deadline

Obtaining a valid Employer Identification Number (EIN) Four weeks before actual submission deadline

Creating an account with login.gov Four weeks before actual submission deadline Registering in the System for Award Management (SAM) or Updating SAM registration

Four weeks before actual submission deadline

Registering in Grants.gov Four weeks before actual submission deadline Registering in ND Grants Four weeks before actual submission deadline Starting application in Grants.gov One week before actual submission deadline Submitting the final application in ND Grants By the submission deadline mailto:NDGrants@fema.dhs.gov mailto:askcsid@fema.dhs.gov https://www.grants.gov/ https://www.grants.gov/

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM) Each applicant, unless they have a valid exception under 2 C.F.R. 25.110, must:

1. Be registered in Sam.Gov before application submission;

2. Provide a valid Unique Entity Identifier (UEI) in its application; and

3. Continue to always maintain an active System for Award Management (SAM) registration with current information during the Federal Award process.

5. Steps Required to Obtain a Unique Entity Identifier, Register in System for Award

Management (SAM), and Submit an Application Applying for an award under this program is a multi-step process, and applicants are encouraged to register early as the registration process can take four weeks or more to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadlines.

Please review the table above for estimated deadlines to complete each of the steps listed.

Failure of an applicant to comply with any of the required steps before the deadline for submitting an application may disqualify that application from funding.

To apply for an award under this program, all applicants must:

a. Apply for, update, or verify their Unique Entity Identifier (UEI) number from SAM.gov and Employer Identification Number (EIN) from the Internal Revenue Service;

b. In the application, provide an UEI number;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before submitting the application;

e. Create a Grants.gov account;

f. Add a profile to a Grants.gov account;

g. Establish an Authorized Organizational Representative (AOR) in Grants.gov;

h. Register in ND Grants

i. Submit an initial application in Grants.gov;

j. Submit the final application in ND Grants, including electronically signing applicable forms; and

k. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency. As part of this, applicants must also provide information on an applicant’s immediate and highest-level owner and subsidiaries, as well as on all predecessors that have been awarded federal contracts or federal financial assistance within the past three years, if applicable.

Specific instructions on how to apply for, update, or verify an UEI number or SAM registration or establish an AOR are included below in the steps for applying through Grants.gov.

https://www.login.gov/

Applicants are advised that FEMA may not make a federal award until the applicant has complied with all applicable SAM requirements. Therefore, an applicant’s SAM registration must be active not only at the time of application, but also during the application review period and when FEMA is ready to make a federal award. Further, as noted above, an applicant’s or recipient’s SAM registration must remain active for the duration of an active federal award.