FY2023 TCGP Investment Justification Form_508c_09-21-23.docx

Tribal Cybersecurity Grant Program (TCGP) Investment Justification (IJ) Template Introduction and Instructions Paperwork Burden Disclosure Notice:

Public reporting burden for this data collection is estimated to average 100 hours per response. The burden estimate includes the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and submitting this form. This collection of information is required to obtain or retain benefits. You are not required to respond to this collection of information unless a valid OMB control number is displayed on this form. Send comments regarding the accuracy of the burden estimate and any suggestions for reducing the burden to: Information Collections Management, Department of Homeland Security, Federal Emergency Management Agency, 500 C Street, SW., Washington, DC 20472-3100, Paperwork Reduction Project (1660-0125) NOTE: Do not send your completed form to this address.

Privacy Notice:

GENERAL: This information is being collected for the primary purpose of facilitating correspondence between the grant applicant and the Department of Homeland Security (DHS) and for determining eligibility and administration of the Tribal Cybersecurity Grant Program (TCGP).

AUTHORITY: The Homeland Security Act of 2002, Section 2220A (Pub. L. No. 107-296, as amended by the Infrastructure Investment and Jobs Act (Pub. L. No. 117-58)) (6 U.S.C. § 665g))

USES AND SHARING: The information on this form may be disclosed as generally permitted under 5 U.S.C. § 552a(b) of the Privacy Act of 1974, as amended. This includes using this information as necessary and authorized by the routine uses published in DHS/FEMA-004 Non-Disaster Grant Management Information Files System of Records, 87 FR 41141 (July 11, 2022), and upon written request, by agreement, or as required by law. Further information regarding FEMA’s use and sharing of information can be found with the DHS/FEMA/PIA – 013 Grants Management Programs Privacy Impact Assessment. The Department’s list of Privacy Impact Assessments can be found on the Department's website at https://www.dhs.gov/privacy-impact-assessments.

EFFECTS OF NONDISCLOSURE: The disclosure of information on this form is voluntary; however, failure to provide the information requested may delay or prevent the organization from receiving grant funding.

Security Warning: When opening the IJ Template, some users may see a note that says, "Security Warning: some active content has been disabled." Click on the [Options …] button next to the message, select "Enable this content," then click on the [OK] button. If this is not done, the text boxes may not function properly.

Tribal Cybersecurity Grant Program Investment Justification (IJ) Instructions:

The Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA) respect the sovereignty and self-determination of tribal governments and recognize the intent of Congress to provide flexibility to tribal governments to meet cybersecurity needs across Indian Country through the TCGP. The changes to the program were made as a result of nation-to-nation consultation with tribal representatives across the country and are intended to support tribal cybersecurity resiliency.

Only one application will be submitted by the eligible entity. Eligible applicants must include at least one IJ as part of the overall application submission through the ND Grants system, located at https://portal.fema.gov/famsVuWeb/home, no later than MONTH, DAY, TIME, TIMEZONE. Information on the TCGP goals and objectives are included in the Notice of Funding Opportunity (NOFO).

The IJ Template is useful for the Program Narrative portion of the application.

Requirements:

· Application level: Each application must include between one (1) and four (4) IJs. Each IJ must be associated with one of the four objectives outlined in the Notice of Funding Opportunity (NOFO). No more than four (4) IJs can be submitted with the application.

· Objective: Each TCGP objective requires no more than one IJ and at least one project and must be submitted via completion of this form

· Projects: Project-level information will vary based on the associated TCGP objectives and sub-objectives as outlined in the NOFO.

· Project Worksheet (PW): Applicants must submit only one Project Worksheet (PW with the application. Multi-entity projects must be included as individual projects within a PW, aligned to the applicable IJ and TCGP objectives.

· Use the following naming convention for the IJs and PWs: [Insert name of Tribal Nation] Objective [insert number of corresponding objectives – 1, 2, 3 or 4]. For example: “Tribal Nation Name PW Objective 2” or “Tribal Nation Name IJ Objective 2”.

The PW (submitted separately from this IJ form) is useful for the Budget Details and Budget Narrative portion of the application. Eligible applicants must submit one PW as part of the overall application submission through the ND Grants system. The PW must include information for each IJ submitted as part of the application for funding: IJ Number, Objective, Project Name, etc. The PW should be used to record all proposed projects with budget details, budget narrative, Management and Administrative (M&A) costs, amount and source of Cost Share, etc. The Planning, Organization, Equipment, Training, and/or Exercises (POETE) Solution Areas associated with the IJs and Projects should be indicated on the PW. Please keep in mind that the Federal Amount and Cost Share Amount must be included for each project within the PW.

The PW provides drop-down selections for several of the project attributes. All project attribute fields must be completed for the PW to be considered complete. Incomplete PWs will not be accepted. Information provided should primarily align to one objective to facilitate project review. If a project aligns to multiple objectives, then applicant must provide sufficient detail to determine which projects, POETE elements, and requested funds belong under which objective. The applicant may then use the information collected in the worksheet for rapid transfer to the ND Grants interface. Each project will be given a unique identifier as it is submitted via ND Grants. Applicants should keep a record of the project identifiers as they will be required to report on each project using that identifier. All requested funding must be associated with specific projects.

Helpful Hints:

Moving Through the Investment Justification Template: While entering information in the Template, applicants should try to minimize the use of the Tab and Enter keys to move between data entry fields. As the Template consists of a combination of text boxes and cells, using these keys may cause the cursor to move to an undesired location.

Copying & Pasting in the Investment Justification Template: Some applicants may find it helpful to begin drafting their IJ information in MS Word and then pasting this into the Template. However, please be aware that, when copying and pasting information from Word into the text boxes in the Template, any formatting may not carry over.

Character Count: The data entry fields included in the IJ allow for the maximum number of characters noted for that section, plus an additional number of characters to account for spaces. Once that limit has been reached, users will not be able to include any additional text.

Spell Check:

It is suggested that applicants use a word processor’s spell check software to ensure that the entered information is spelled correctly. FEMA and CISA recognize that tribal-specific words may not be recognized by a word processor’s spell check software. Please feel free to use the tribal government language in describing names or programs that are within the Tribe’s jurisdiction.

Self-Certification of Eligibility:

The TCGP will use a discretionary grant allocation method for FY 2023 applications, which includes dividing the 574 Federally Recognized tribes with membership of greater than one (1) into four (4) categories based on overall population, and then the discretionary awarding of funds to tribes within each category of population. The funding categories allow for applications to be evaluated from amongst applications from similarly populated tribes. In order to ensure fair and equitable dispersal of funding, applicants must self-certify as to whether they meet the eligibility requirements. Self-certification will be provided in this IJ form below. Please mark all that apply:

· Any Indian Tribe

(i) That is located in the continental United States; and,

(ii) That is identified in the most recent published list of Federally recognized Tribes published pursuant to Section 104 of the Federally Recognized Indian Tribe List Act of 1994 (25 U.S.C. 5131)

· A consortium of Indian Tribes if each Tribe satisfies the above requirements

Please provide the tribe’s population and sign the certification below to ensure accurate allocation of TCGP funds.

A) Population: ___________________________

B) Certification: I certify that I am an eligible tribe or consortium of tribes. I have read and will abide by the requirements of the FY 2023 TCGP NOFO.

C) Print signatory name: ______________________________

D) Please sign here: _________________________________

DEPARTMENT OF HOMELAND SECURITY

Federal Emergency Management Agency

This draft Investment Justification Template should be used until the final form is approved by OMB

OMB Control Number: TBD Expiration date: TBD

Tribal POC Name:

Tribal POC Title:

Tribal POC Address:

Tribal POC Phone Number:

Tribal POC Email Address:

PART I. BACKGROUND FOR PROJECT NARRATIVE

I. A. Provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces which have influenced the development of this investment justification. Also, please include a summary of the current capabilities within the applicant jurisdiction to address these threats and risks.

I. B. Describe how this IJ and the associated project(s) addresses gaps and/or sustainment in the approved Cybersecurity Plan.

PART II. SPECIFIC INVESTMENT INFORMATION

II. A. Investment Name: Provide the Investment Name (each application will consist of up to four (4) investments):

II. B. Investment Type: Please identify the corresponding TCGP Objective Number for this IJ (Objective 1, 2, 3 or 4). Each objective must have at least one project.

PART III. PROJECT INFORMATION

III. A. Project Name: Provide the name(s) of the project(s).

III. B. Project(s) Alignment to the 13 Required Cybersecurity Elements as detailed in the NOFO: Please describe how this project(s) aligns to the cybersecurity elements in the TCGP NOFO.

PART IV. PROJECT IMPLEMENTATION SCHEDULE

The implementation schedule table should be used as a planning tool for the key activities associated with each project identified in the Cybersecurity Plan. For each project and each year of the grant, the applicant should include the activities necessary to accomplish the goals of each project, as well as the estimated start and completion dates (by calendar quarter) for each activity.

The standard definition of a project is a temporary endeavor with a defined beginning and end (usually time-constrained, and often constrained by funding or a deliverable), undertaken to meet unique goals and objectives, typically to bring about beneficial change or added value. Applying this standard to projects using preparedness grant funds, a project is a related set of activities and purchases supporting the building or sustaining of core capabilities; and is associated with a single entity responsible for execution.

This approach will allow CISA/FEMA and applicants to categorize the grant-funded project as a discrete unit for post-award management, reporting, and monitoring purposes. The main steps and processes of the Project Management Lifecycle are Initiate, Execute, Control, Close Out.

a. Initiate: The authorization to begin work or resume work on any particular activity.

b. Execute: The period within the project life cycle during which the actual work of creating the project’s deliverables is carried out.

c. Control: A mechanism which reacts to the current project status to ensure accomplishment of project objectives. This involves planning, measuring, monitoring, and taking corrective action based on the results of the monitoring.

d. Close Out: The completion of all work on a project. Can also refer to completion of a phase of the project.

For additional information on the Project Management Lifecycle, please visit Project Management Institute's (PMI) A Guide to the Project Management Body of Knowledge (PMBOK Guide) at http://www.pmi.org/PMBOK-Guide-and-Standards.aspx. Specifically, applicants are encouraged to reference Chapter three of the PMBOK Guide, The Standard for Project Management of a Project.

Appendix A: Identify up to ten projects/activities, with start and end dates, which will be implemented during the period of performance