FY22 SLCGP NOFO_9_13_2022.pdf

FY 2022 SLCGP NOFO Back to the Top

The Department of Homeland Security

Notice of Funding Opportunity Fiscal Year 2022 State and Local Cybersecurity Grant Program

Effective April 4, 2022, the Federal Government transitioned from using the Data Universal Numbering System or DUNS number, to a new, non-proprietary identifier known as a Unique Entity Identifier or UEI. For entities that had an active registration in the System for Award Management (SAM.gov) prior to this the UEI has automatically been assigned and no action is necessary. For all entities filing a new registration in SAM.gov on or after April 4, 2022, the UEI will be assigned to that entity as part of the SAM.gov registration process.

UEI registration information is available on GSA.gov at: Unique Entity Identifier Update | GSA.

Grants.gov registration information can be found at:

https://www.grants.gov/web/grants/register.html. Detailed information regarding UEI and SAM is also provided in Section D of this notice.

Table of Contents A. Program Description

1. Issued By

2. Assistance Listings Number

3. Assistance Listings Title

4. Funding Opportunity Title

5. Funding Opportunity Number

6. Authorizing Authority for Program

7. Appropriation Authority for Program

8. Announcement Type

9. Program Category

10. Program Overview, Objectives, and Priorities

11. Performance Measures

B. Federal Award Information

1. Available Funding for the NOFO: $185 million

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

4. Projected Period of Performance Start Date(s): Sept. 1, 2022

5. Projected Period of Performance End Date(s): Aug. 31, 2026

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

2. Applicant Eligibility Criteria

3. Other Eligibility Criteria

4. Cost Share or Match

D. Application and Submission Information

1. Key Dates and Times

2. Agreeing to Terms and Conditions of the Award https://www.gsa.gov/about-us/organization/federal-acquisition-service/office-of-systems-management/integrated-award-environment-iae/iae-systems-information-kit/unique-entity-identifier-update https://www.grants.gov/web/grants/register.html

3. Address to Request Application Package

4. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application

5. Electronic Delivery

6. How to Register to Apply through Grants.gov

7. How to Submit an Initial Application to DHS via Grants.gov

8. Submitting the Final Application in ND Grants

9. Timely Receipt Requirements and Proof of Timely Submission

10. Content and Form of Application Submission

11. Intergovernmental Review

12. Funding Restrictions and Allowable Costs

E. Application Review Information

1. Application Evaluation Criteria

2. Review and Selection Process

F. Federal Award Administration Information

1. Notice of Award

2. Pass-Through Requirements

3. Administrative and National Policy Requirements

4. Reporting

5. Program Evaluation

6. Monitoring and Oversight

G. DHS Awarding Agency Contact Information

1. Contact and Resource Information

2. Systems Information

H. Additional Information

1. Termination Provisions

2. Period of Performance Extensions

3. Disability Integration

4. Conflicts of Interest in the Administration of Federal Awards or Subawards

5. Procurement Integrity

6. Record Retention

7. Actions to Address Noncompliance

8. Audits

9. Payment Information

10. Whole Community Preparedness

11. Continuity Capability

12. Appendices Appendix A: Goals and Objectives Appendix B: Planning Committee Appendix C: Cybersecurity Plan Appendix D: Multi-Entity Grants Appendix E: Imminent Cybersecurity Threat Appendix F: Investment Justification Form and Instructions Appendix G: Required, Encouraged, and Optional Services, Memberships, and Resources 90 Appendix H: Economic Hardship Cost Share Waiver

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA)/Resilience/Grant Program Directorate (GPD)

2. Assistance Listings Number

97.137

3. Assistance Listings Title State and Local Cybersecurity Grant Program (SLCGP)

4. Funding Opportunity Title Fiscal Year 2022 State and Local Cybersecurity Grant Program (SLCGP)

5. Funding Opportunity Number

DHS-22-137-000-01

6. Authorizing Authority for Program Section 2220A of the Homeland Security Act of 2002, as amended (Pub. L. No. 107-296) (6 U.S.C. § 665g)

7. Appropriation Authority for Program Infrastructure Investments and Jobs Appropriations Act (Pub. L. No. 117-58)

8. Announcement Type

Initial

9. Program Category Preparedness: Community Security

10. Program Overview, Objectives, and Priorities

a. Overview

Our nation faces unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure. Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities.

The potential consequences of cyber incidents threaten national security. Strengthening cybersecurity practices and resilience of state, local, and territorial (SLT) governments is an important homeland security mission and the primary focus of the State and Local Cybersecurity Grant Program (SLCGP). Through funding from Infrastructure Investment and Jobs Act (IIJA), also known as the Bipartisan Infrastructure Law (BIL), the SLCGP enables DHS to make targeted cybersecurity investments in SLT government agencies, thus improving the security of critical infrastructure and improving the resilience of the services

SLT governments provide their community.

The FY 2022 SLCGP aligns with the 2020-2024 DHS Strategic Plan by helping DHS achieve Goal 3: Secure Cyberspace and Critical Infrastructure, Objective 3.3. Assess and Counter Evolving Cybersecurity Risks. The FY 2022 SLCGP also supports the 2022-2026 FEMA Strategic Plan which outlines a bold vision and three ambitious goals, including Goal 3: Promote and Sustain a Ready FEMA and Prepared Nation, Objective 3.2: Posture FEMA to meet current and emergent threats.

b. Objectives

The goal of SLCGP is to assist SLT governments with managing and reducing systemic cyber risk. For Fiscal Year (FY) 2022, applicants are required to address how the following program objectives will be met in their applications:

• Objective 1: Develop and establish appropriate governance structures, including developing, implementing, or revising cybersecurity plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

For more information on the program goals, objectives, sub-objectives, and desired outcomes, please refer to Appendix A.

c. Priorities The Homeland Security Act of 2002, as amended by the Bipartisan Infrastructure Law requires grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the Plan, and identify projects to implement utilizing SLCGP funding. To support these efforts, recipients are highly encouraged to prioritize the following activities using FY 2022 SLCGP funds, all of which are statutorily required as a condition of receiving a grant:

• Establish a Cybersecurity Planning Committee;

• Develop a state-wide Cybersecurity Plan, unless the recipient already has a state-wide

Cybersecurity Plan and uses the funds to implement or revise a state-wide Cybersecurity Plan;

• Conduct assessment and evaluations as the basis for individual projects throughout the life of the program; and

• Adopt key cybersecurity best practices.

Cybersecurity Planning Committee The Planning Committee is responsible for developing, implementing, and revising Cybersecurity Plans (including individual projects); formally approving the Cybersecurity Plan (along with the chief information officer, chief information security officer or an https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 https://www.fema.gov/about/strategic-plan https://www.fema.gov/about/strategic-plan equivalent official); and assisting with determination of effective funding priorities (i.e., work with entities within the eligible entity’s jurisdiction to identify and prioritize individual projects). To support these responsibilities, the Planning Committee must include the following entities:

• The eligible entity (i.e., state or territory);

• County, city, and town representation (if the eligible entity is a state);

• Institutions of public education within the eligible entity’s jurisdiction;

• Institutions of public health within the eligible entity’s jurisdiction; and

• As appropriate, representatives from rural, suburban, and high-population jurisdictions.

For more information on the Cybersecurity Planning Committee responsibilities and composition, please refer to Appendix B.

Cybersecurity Plan To assist in developing the required Plan, a Cybersecurity Plan Checklist containing information on what must be included in the Plan has been developed for use by SLCGP recipients. Recipients are encouraged to incorporate, where applicable, any existing plans to protect against cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of, SLT governments. For more information on the Cybersecurity Plan and Cybersecurity Plan Checklist, please refer to Appendix C.

Key Cybersecurity Best Practices To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, SLT governments must take decisive steps to modernize their approach to cybersecurity, adopting security best practices and advancing toward Zero Trust Architecture. The following strategic elements, therefore, are required to be included in Cybersecurity Plans and in individual projects:

• Implement multi-factor authentication;

• Implement enhanced logging;

• Data encryption for data at rest and in transit;

• End use of unsupported/end of life software and hardware that are accessible from the

Internet;

• Prohibit use of known/fixed/default passwords and credentials;

• Ensure the ability to reconstitute systems (backups); and

• Migration to the .gov internet domain.

As individual government entities increase their cybersecurity maturity, implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing, will be recommended.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf

11. Performance Measures Each grant recipient is required to collect data to allow DHS to measure performance of the awarded grant in support of the SLCGP metrics, which will be described in each Cybersecurity Plan.

The statute requires that “not later than one year after the date on which an eligible entity receives a grant…for the purpose of implementing [its] Cybersecurity Plan…, including an eligible entity that comprises a multi-entity group that receives a grant for that purpose, and annually thereafter until one year after the date on which funds from the grant are expended or returned, the eligible entity shall submit to the Secretary a report that, using the metrics described in the Cybersecurity Plan of the eligible entity, describes the progress of the eligible entity in:

• Implementing the Cybersecurity Plan;

• Reducing cybersecurity risks to, and identifying, responding to, and recovering from cybersecurity threats to, information systems owned or operated by, or on behalf of, the eligible entity or, if the eligible entity is a state, local governments within the jurisdiction of the eligible entity.”

If an eligible entity does not have a Cybersecurity Plan in place and receives an award, then the statute requires that not later than one year after the date on which the eligible entity receives a grant, and annually thereafter until one year after the date on which funds from the grant are expended or returned, the eligible entity shall submit to the Secretary a report describing how the eligible entity obligated and expended grant funds to:

• Develop or revise a Cybersecurity Plan; or

• Assist with activities that address imminent cybersecurity threats, as confirmed by the

Secretary, acting through the CISA Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.

In order to measure performance, DHS may request information throughout the period of performance. In its final performance report submitted at closeout, the recipient must submit sufficient information to demonstrate it has met the performance goals as stated in its award.

DHS will measure the recipient’s performance of the grant by comparing the number of activities and projects needed and requested in its investment justification with the number of activities and projects acquired and delivered by the end of the period of performance using the following programmatic metrics:

• Percentage of entities with CISA approved state-wide Cybersecurity Plans

• Percentage of entities with statewide cybersecurity planning committees that meet the Homeland Security Act of 2002 and this SLCGP Notice of Funding Opportunity (NOFO) requirements

• Percentage of entities conducting annual table-top and full-scope exercises to test cybersecurity plans; Percent of the entities' SLCGP budget allocated to exercises;

or Average dollar amount expended on exercise planning for entities

• Percentage of entities conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement

• Percentage of entities performing phishing training; Percent of entities conducting awareness campaigns; Percent of entities providing role-based cybersecurity awareness training to employees

• Percentage of entities adopting the Workforce Framework for Cybersecurity (NICE Framework) as evidenced by established workforce development and training plans

• Percentage of entities with capabilities to analyze network traffic and activities related to potential threats

• Percentage of entities implementing multi-factor authentication (MFA) for all remote access and privileged accounts

• Percentage of entities with programs to anticipate and discontinue use of end of life software and hardware

• Percentage of entities prohibiting the use of known/fixed/default passwords and credentials

• Percentage of entities operating under the “.gov” internet domain

• Number of cybersecurity gaps or issues addressed annually by entities

B. Federal Award Information

1. Available Funding for the NOFO: $185 million

For FY 2022, DHS will award state and territorial funds based on baseline minimums and population as required by the Homeland Security Act of 2002, and described below.

Each state and territory will receive a baseline allocation using thresholds established in the Homeland Security Act of 2002. All 50 States, the District of Columbia, and the Commonwealth of Puerto Rico will receive a minimum of $2,000,000 each, equaling 1% of total funds appropriated to DHS in FY 2022. Each of the four territories (American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands) will receive a minimum of $500,000, equaling 0.25% of the total funds appropriated to DHS in FY 2022.

$90,500,000, 50% of the remaining amount will be apportioned based on the ratio that the population of each state or territory bears to the population of all states and territories. The remaining $90,500,000, equaling the other 50% of the remaining amount, will be apportioned based on the ratio that the population of each state that resides in rural areas bears to the population of all states that resides in rural areas.

FY 2022 SLCGP Allocations

State/Territory FY 2022 SLCGP Allocation

Alabama $3,848,596 Alaska $2,245,130 Arizona $3,336,349 Arkansas $3,162,746 California $7,981,997

Colorado $3,234,143 Connecticut $2,681,116 Delaware $2,224,803 District of Columbia $2,081,394 Florida $5,889,464 Georgia $4,877,389 Hawaii $2,243,739 Idaho $2,550,109 Illinois $4,404,622 Indiana $3,949,173 Iowa $3,073,518 Kansas $2,820,015 Kentucky $3,659,521 Louisiana $3,327,540 Maine $2,666,932 Maryland $3,214,008 Massachusetts $3,173,589 Michigan $4,777,219 Minnesota $3,606,482 Mississippi $3,274,355 Missouri $3,841,132 Montana $2,428,110 Nebraska $2,555,930 Nevada $2,488,375 New Hampshire $2,499,170 New Jersey $3,380,963 New Mexico $2,540,767 New York $5,813,554 North Carolina $5,362,452 North Dakota $2,287,118 Ohio $4,980,243 Oklahoma $3,294,613 Oregon $2,988,975 Pennsylvania $5,207,249 Rhode Island $2,190,484 South Carolina $3,661,568 South Dakota $2,341,978 Tennessee $4,244,182 Texas $8,469,945 Utah $2,619,397 Vermont $2,310,302 Virginia $4,292,938 Washington $3,667,735

West Virginia $2,764,988 Wisconsin $3,795,634 Wyoming $2,200,558 Puerto Rico $2,492,381 U.S. Virgin Islands $500,000 American Samoa $500,000 Guam $500,000 Northern Mariana Islands $500,000 Total $185,024,690

2. Projected Number of Awards: 56

3. Period of Performance: 48 months

Extensions to the period of performance are allowed. For additional information on period of performance extensions, please refer to Section H of this NOFO.

FEMA awards under most programs, including this program, only include one budget period, so it will be same as the period of performance. See 2 C.F.R. § 200.1 for definitions of “budget period” and “period of performance.”

4. Projected Period of Performance Start Date(s): Sept. 1, 2022

5. Projected Period of Performance End Date(s): Aug. 31, 2026

6. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

All 56 states and territories, including any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands, are eligible to apply for SLCGP funds. Accordingly, the Governor designated State Administrative Agency (SAA) is the only entity eligible to submit SLCGP applications to DHS/FEMA.

Although Tribes are not eligible to apply directly for SLCGP funding, they may be eligible subrecipients, and can receive SLCGP funding as a local government. Each individual SAA may determine whether and how much SLCGP funding to pass through to Tribal entities;

DHS does not have the authority to mandate that a certain percentage of SLCGP funds are directed to Tribal governments. Additionally, $6 million in funding will be directly available to Tribal entities under the forthcoming Tribal Cybersecurity Grant Program, which DHS expects to publish the NOFO in the fall of 2022.

“State” is defined in 6 U.S.C. § 101(17) to include the 50 states, District of Columbia, Commonwealth of Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, and Commonwealth of the Northern Mariana Islands;

“Local government” is defined in 6 U.S.C. § 101(13) as

A) A county, municipality, city, town, township, local public authority, school district, special district, intrastate district, council of governments, regional or interstate government entity, or agency or instrumentality of a local government;

B) An Indian tribe or authorized tribal organization, or in Alaska a Native village or Alaska Regional Native Corporation; and

C) A rural community, unincorporated town or village, or other public entity.

“Tribal government” for purposes of being an eligible entity for the Tribal Cybersecurity Grant Program is defined in 6 U.S.C. § 665g(1)(12) as the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent published list of Federally Recognized Tribes.

In addition to applying as a single entity, an eligible entity under SLCGP (i.e., the SAA) may partner with one or more other eligible entities to form a multi-entity group. Members of multi-entity groups work together to address cybersecurity risks and cybersecurity threats to information systems within their jurisdictions. There is no limit to the number of participating entities in a multi-entity group. Local entities can be included in the project, but their respective eligible entity must also participate at some level (see Appendix D). There is no separate funding for multi-entity awards. Instead, they should be considered as group projects within their existing state or territory allocations. These projects should be included as individual Investment Justifications from each participating eligible entity, each approved by the respective Planning Committee and aligned with each respective eligible entity’s Cybersecurity Plan.

2. Applicant Eligibility Criteria Applicants must be an eligible entity, meaning one of the 56 states and territories that are eligible for the program. One or more eligible entities may form a multi-entity group.

3. Other Eligibility Criteria Cybersecurity Plan To be eligible for FY 2022 SLCGP funding, each eligible entity is required to submit a Cybersecurity Plan that aligns with the criteria detailed in Appendix C.

The only exception is if an eligible entity certifies to the Secretary that:

A. The activities that will be supported by a grant are:

1. Integral to the development of the Cybersecurity Plan of the eligible entity; or

2. Necessary to assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the CISA Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity; and B. The eligible entity will submit to the Secretary a Cybersecurity Plan for review by

September 30, 2023.

Note that for multi-entity groups, in order to be eligible for an award, all eligible entities within the multi-entity group must already have a Cybersecurity Plan in place; multi-entity groups are not eligible for awards to develop a Cybersecurity Plan. See 6 U.S.C. § 665g(f), (i)(3).

Cybersecurity Planning Committee To be eligible for FY 2022 SLCGP funding, each eligible entity is required to establish a Cybersecurity Planning Committee comprised of the members summarized in Appendix B.

4. Cost Share or Match Eligible entities, if applying as a single applicant, must meet a 10% cost share requirement for the FY 2022 SLCGP. The recipient contribution can be cash (hard match) or third-party in-kind (soft match). Eligible applicants shall agree to make available non-federal funds to carry out an SLCGP award in an amount not less than 10% of activities under the award. For FY 2022, in accordance with 48 U.S.C. § 1469a, cost share requirements are waived for the insular areas of the U.S. territories of American Samoa, Guam, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana Islands.

DHS/FEMA administers cost-matching requirements in accordance with 2 C.F.R. § 200.306.

To meet matching requirements, the recipient contributions must be verifiable, reasonable, allocable and necessary, and otherwise allowable under the grant program, and in compliance with all applicable federal requirements and regulations. Unless otherwise authorized by law, the non-federal cost share requirement cannot be matched with other federal funds.

For example, if the federal award were at a 90% cost share and the total approved budget cost was $100,000, then:

• Federal share is 90% of $100,000 = $90,000

• Recipient share is 10% of $100,000 = $10,000

However, with this example, if the total cost ended up being $120,000, the federal share would remain at $90,000 due to the statutory formula even if it means the federal share ends up being lower than 90%. Any cost overruns will not be matched by this grant program and will be incurred by the recipient. With this example, if the total cost ended up being $80,000, then the 90% federal share would decrease to $72,000, and the recipient cost share would be $8,000.

Additionally, by statute, the cost share applies to each individual activity funded by the grant award rather than just to the cumulative total. Recipients must ensure that each activity’s cost share is met. DHS interprets “activity” to mean all items approved as part of a submitted “Project Worksheet.”

For a multi-entity group project, a cost share or cost match is not required for the FY 2022 SLCGP. For more information about multi-entity group projects, please refer to Appendix D.

The Secretary of Homeland Security may waive or modify the non-federal share for an individual entity if the entity demonstrates economic hardship. Additional information about the eligibility criteria for a cost share waiver, as well as how to submit a request for a cost share waiver from DHS is included in Appendix H.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date:

b. Application Submission Deadline:

09/16/2022

11/15/2022 at 5 p.m. ET

All applications must be received by the established deadline.

The Non-Disaster (ND) Grants System has a date stamp that indicates when an application is submitted. Applicants will receive an electronic message confirming receipt of their submission. For additional information on how an applicant will be notified of application receipt, see the subsection titled “Timely Receipt Requirements and Proof of Timely Submission” in Section D of this NOFO.

DHS will not review applications that are received after the deadline or consider these late applications for funding. DHS may, however, extend the application deadline on request for any applicant who can demonstrate that good cause exists to justify extending the deadline. Good cause for an extension may include technical problems outside of the applicant’s control that prevent submission of the application by the deadline, other exigent or emergency circumstances, or statutory requirements for DHS to make an award.

Applicants experiencing technical problems outside of their control must notify DHS as soon as possible and before the application deadline. Failure to timely notify DHS of the issue that prevented the timely filing of the application may preclude consideration of the award. “Timely notification” of DHS means prior to the application deadline and within 48 hours after the applicant became aware of the issue.

A list of FEMA contacts can be found in Section G of this NOFO, “DHS Awarding Agency Contact Information.” For additional assistance using the ND Grants System, please contact the ND Grants Service Desk at (800) 865-4076 or NDGrants@fema.dhs.gov. The ND Grants Service Desk is available Monday through Friday, 9 a.m. – 6 p.m. ET. If applicants have programmatic or grants management questions or concerns, please contact the Centralized Scheduling and Information Desk (CSID) by phone at (800) 368-6498 or by e-mail at askcsid@fema.dhs.gov, Monday through Friday, 9 a.m. – 5 p.m. ET.

c. Anticipated Funding Selection Date: No later than 11/30/2022 mailto:NDGrants@fema.dhs.gov mailto:askcsid@fema.dhs.gov

d. Anticipated Award Date: No later than 12/31/2022

e. Other Key Dates:

2. Agreeing to Terms and Conditions of the Award By submitting an application, applicants agree to comply with the requirements of this NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package Initial applications are processed through the Grants.gov portal. Final applications are completed and submitted through FEMA’s Non-Disaster Grants (ND Grants) System.

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov, select “Applicants” then “Apply for Grants”. In order to obtain the application package, select “Download a Grant Application Package”. Enter the Assistance Listing (formerly CFDA) and/or the funding opportunity number located on the cover of the program’s NOFO, select “Download Package,” and then follow the prompts to download the application package. In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice and all relevant NOFO is (800) 462-7585.

4. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award Management (SAM), and Submit an Application Applying for an award under this program is a multi-step process and requires time to complete. Applicants are encouraged to register early as the registration process can take four weeks or more to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadlines.

Please review the table above for estimated deadlines to complete each of the steps listed.

Failure of an applicant to comply with any of the required steps before the deadline for submitting an application may disqualify that application from funding.

To apply for an award under this program, all applicants must:

Event Suggested Deadline for Completion Obtaining Unique Entity Identifier (UEI) Number

Four weeks before actual submission deadline

Obtaining a valid Employer Identification Number (EIN) Four weeks before actual submission deadline

Creating an account with login.gov Four weeks before actual submission deadline Registering in SAM or updating SAM registration Four weeks before actual submission deadline

Registering in Grants.gov Four weeks before actual submission deadline Registering in ND Grants Four weeks before actual submission deadline Starting application in Grants.gov One week before actual submission deadline Submitting the final application in ND Grants By the submission deadline https://www.grants.gov/ http://www.grants.gov/

a. Apply for, update, or verify their Unique Entity Identifier (UEI) number from SAM.gov and Employer Identification Number (EIN) from the Internal Revenue Service;

b. In the application, provide an UEI number;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before submitting the application;

e. Create a Grants.gov account;

f. Add a profile to a Grants.gov account;

g. Establish an Authorized Organizational Representative (AOR) in Grants.gov;

h. Register in ND Grants

i. Submit an initial application in Grants.gov;

j. Submit the final application in ND Grants, including electronically signing applicable forms; and

k. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency. As part of this, applicants must also provide information on an applicant’s immediate and highest-level owner and subsidiaries, as well as on all predecessors that have been awarded federal contracts or federal financial assistance within the last three years, if applicable.

Specific instructions on how to apply for, update, or verify a UEI number or SAM registration or establish an AOR are included below in the steps for applying through Grants.gov.

Applicants are advised that DHS may not make a federal award until the applicant has complied with all applicable SAM requirements. Therefore, an applicant’s SAM registration must be active not only at the time of application, but also during the application review period and when DHS is ready to make a federal award. Further, as noted above, an applicant’s or recipient’s SAM registration must remain active for the duration of an active federal award. If an applicant’s SAM registration is expired at the time of application, expires during application review, or expires any other time before award, DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

Per 2 C.F.R. § 25.110(c)(2)(iii), if an applicant is experiencing exigent circumstances that prevents it from receiving a UEI number, if applicable, and completing SAM registration prior to receiving a federal award, the applicant must notify FEMA as soon as possible by contacting askcsid@fema.dhs.gov and providing the details of the circumstances that prevent completion of these requirements. If FEMA determines that there are exigent circumstances and FEMA has decided to make an award, the applicant will be required to obtain a UEI number, if applicable, and complete SAM registration within 30 days of the federal award date.

5. Electronic Delivery DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages or requires applicants https://www.login.gov/ mailto:askcsid@fema.dhs.gov to submit their applications online through Grants.gov, depending on the funding opportunity.

For this funding opportunity, FEMA requires applicants to submit initial applications through Grants.gov and a final application through ND Grants.

6. How to Register to Apply through Grants.gov

a. General Instructions:

Registering and applying for an award under this program is a multi-step process and requires time to complete. Read the instructions below about registering to apply for FEMA funds. Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. To ensure an application meets the deadline, applicants are advised to start the required steps well in advance of their submission.

Organizations must have an UEI number, an EIN, an active SAM registration and Grants.gov account to apply for grants.

Organizations must also have a Grants.gov account to apply for an award under this program.

Creating a Grants.gov account can be completed online in minutes, but DUNS and SAM registrations may take several weeks. Therefore, an organization's registration should be done in sufficient time to ensure it does not impact the entity's ability to meet required application submission deadlines. Complete organization instructions can be found on Grants.gov here:

https://www.grants.gov/web/grants/applicants/organization-registration.html.

If individual applicants are eligible to apply for this grant funding opportunity, refer to:

b. Obtain an UEI Number:

All entities applying for funding, including renewal funding, prior to April 4, 2022, must have a UEI number. Applicants must enter the UEI number in the applicable data entry field on the SF-424 form.

For more detailed instructions for obtaining a UEI number, refer to: Sam.gov.

c. Obtain Employer Identification Number All entities applying for funding must provide an Employer Identification Number (EIN).

The EIN can be obtained from the IRS by visiting: https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online.

d. Create a login.gov account:

Applicants must have a login.gov account in order to register with SAM or update their SAM registration. Applicants can create a login.gov account here:

https://www.grants.gov/web/grants/applicants/organization-registration.html https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3.

Applicants only have to create a login.gov account once. For applicants that are existing SAM users, use the same email address for the login.gov account as with SAM.gov so that the two accounts can be linked.

For more information on the login.gov requirements for SAM registration, refer to:

https://www.sam.gov/SAM/pages/public/loginFAQ.jsf.

e. Register with SAM:

All organizations applying online through Grants.gov must register with SAM. Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html.

Note: As a new requirement per 2 C.F.R. § 25.200, applicants must also provide the applicant’s immediate and highest-level owner, subsidiaries, and predecessors that have been awarded federal contracts or federal financial assistance within the last three years, if applicable.

I. ADDITIONAL SAM REMINDERS

Existing SAM.gov account holders should check their account to make sure it is “ACTIVE.”

SAM registration should be completed at the very beginning of the application period and should be renewed annually to avoid being “INACTIVE.” Please allow plenty of time before the grant application submission deadline to obtain an UEI number, if applicable, and then to register in SAM. It may be four weeks or more after an applicant submits the SAM registration before the registration is active in SAM, and then it may be an additional 24 hours before FEMA’s system recognizes the information.

It is imperative that the information applicants provide is correct and current. Please ensure that your organization’s name, address, and EIN are up to date in SAM and the UEI number used in SAM is the same one used to apply for all other FEMA awards. Payment under any FEMA award is contingent on the recipient’s having a current SAM registration.

II. HELP WITH SAM

The SAM quick start guide for new recipient registration and SAM video tutorial for new applicants are tools created by the General Services Administration (GSA) to assist those registering with SAM. If applicants have questions or concerns about a SAM registration, please contact the Federal Support Desk at https://www.fsd.gov/fsd-gov/home.do or call toll free (866) 606-8220.

https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3 https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3 https://www.sam.gov/SAM/pages/public/loginFAQ.jsf https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.fsd.gov/fsd-gov/home.do

f. Create a Grants.gov Account:

The next step in the registration process is to create an account with Grants.gov. If applicable, applicants must know their organization’s DUNS number to complete this process.

For more information, follow the on-screen instructions or refer to:

https://www.grants.gov/web/grants/applicants/registration.html.

See also Section D.8 in this NOFO, “Submitting the Final Application in ND Grants,” for instructions on how to register early in ND Grants.

g. Add a Profile to a Grants.gov Account:

A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, if applicable, enter the DUNS number for the organization in the UEI field while adding a profile.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/add-profile.html.

h. EBiz POC Authorized Profile Roles:

After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access are sent to the EBiz POC.

The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the Authorized Organization Representative (AOR) role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html.

i. Track Role Status:

To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html.

j. Electronic Signature:

When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature. The EBiz POC must authorize individuals who are able to make legally binding commitments on behalf of the organization as an AOR;

this step is often missed, and it is crucial for valid and timely submissions.

7. How to Submit an Initial Application to DHS via Grants.gov Standard Form 424 (SF-424) is the initial application for this NOFO.

https://www.grants.gov/web/grants/applicants/registration.html https://www.grants.gov/web/grants/applicants/registration/add-profile.html https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html https://www.grants.gov/web/grants/applicants/registration/track-role-status.html

Grants.gov applicants can apply online using a workspace. A workspace is a shared, online environment where members of a grant team may simultaneously access and edit different web forms within an application. For each Notice of Funding Opportunity, you can create individual instances of a workspace. Applicants are encouraged to submit their initial applications in Grants.gov at least seven days before the application deadline.

In Grants.gov, applicants need to submit the following forms:

• SF-424, Application for Federal Assistance; and

• Grants.gov Lobbying Form, Certification Regarding Lobbying.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html

a. Create a Workspace:

Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

b. Complete a Workspace:

Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission.

c. Adobe Reader:

If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace so that they will appear similar to other Standard or DHS forms. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at: https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

d. Mandatory Fields in Forms:

In the forms, you will note fields marked with an asterisk and a different background color.

These fields are mandatory fields that must be completed to successfully submit your application.

e. Complete SF-424 Fields First:

The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and UEI number. To trigger this feature, an applicant must complete the SF-424 information first. Once it is completed, the information will transfer to the other forms.

https://www.grants.gov/web/grants/applicants/workspace-overview.html https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

f. Submit a Workspace:

An application may be submitted through workspace by clicking the “Sign and Submit” button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24-48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application submission.

g. Track a Workspace:

After successfully submitting a workspace package, a Grants.gov Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the confirmation page that is generated after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

h. Additional Training and Applicant Support:

For additional training resources, including video tutorials, refer to:

https://www.grants.gov/web/grants/applicants/applicant-training.html Grants.gov provides applicants 24/7 (except federal holidays) support via the toll-free number (800) 518-4726, email at support@grants.gov and the website at https://www.grants.gov/support.html. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist FEMA with tracking your issue and understanding background information on the issue.

8. Submitting the Final Application in ND Grants

After submitting the initial application in Grants.gov, eligible applicants will be notified by FEMA and asked to proceed with submitting their complete application package in ND Grants. Applicants can register early with ND Grants and are encouraged to begin their ND Grants registration at the time of this announcement or, at the latest, seven days before the application deadline. Early registration will allow applicants to have adequate time to start and complete their applications.

Applicants needing assistance registering for the ND Grants system should contact ndgrants@fema.dhs.gov or (800) 865-4076. For step-by-step directions on using the ND Grants system and other guides, please see https://www.fema.gov/grants/guidance-tools/non-disaster-grants-management-system.

In ND Grants, applicants will be prompted to submit the standard application information and any program-specific information required as described in Section D.10 of this NOFO, “Content and Form of Application Submission.” The Standard Forms (SF) are auto generated in ND Grants, but applicants may access these forms in advance through the Forms tab under the SF-424 family on Grants.gov. Applicants should review these forms before applying to ensure they have all the information required.

https://www.grants.gov/web/grants/applicants/applicant-training.html mailto:support@grants.gov https://www.grants.gov/support.html mailto:ndgrants@fema.dhs.gov https://www.fema.gov/grants/guidance-tools/non-disaster-grants-management-system https://www.fema.gov/grants/guidance-tools/non-disaster-grants-management-system https://www.grants.gov/forms/sf-424-family.html

For additional application submission requirements, including program-specific requirements, please refer to the subsection titled “Content and Form of Application Submission” under Section D of this NOFO.

9. Timely Receipt Requirements and Proof of Timely Submission As application submission is a two-step process, the applicant with the AOR role who submitted the application in Grants.gov will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from Grants.gov with the successful transmission of its initial application. This notification does not serve as proof of timely submission, as the application is not complete until it is submitted in ND Grants. Applicants can also view the ND Grants Agency Tracking Number by accessing the Details tab in the submitted workspace section in Grants.gov, under the Agency Tracking Number column. Should the Agency Tracking Number not appear, the application has not yet migrated from Grants.gov into the ND Grants System. Please allow 24 hours for your ND Grants application tracking number to migrate.

All applications must be received in ND Grants by 5 p.m. ET on the application deadline.

Proof of timely submission is automatically recorded by ND Grants. An electronic date/time stamp is generated within the system when the application is successfully received by ND Grants. Additionally, the applicant(s) listed as contacts on the application will receive a system-generated email to confirm receipt.

10. Content and Form of Application Submission

a. Standard Required Application Forms and Information

The following forms or information are required to be submitted in either Grants.gov or ND Grants. The Standard Forms (SF) are submitted either through Grants.gov, through forms generated in ND Grants, or as an attachment in ND Grants. Applicants may also access the SFs at https://www.grants.gov/web/grants/forms/sf-424-family.html.

I. GRANTS.GOV

• SF-424, Application for Federal Assistance, initial application submitted through

Grants.gov; and

• Grants.gov Lobbying Form, Certification Regarding Lobbying, submitted through

Grants.gov.

II. ND GRANTS

• SF-424A, Budget Information (Non-Construction), submitted via the forms generated by ND Grants;

• SF-424B, Standard Assurances (Non-Construction), submitted via the forms generated by ND Grants;

• SF-LLL, Disclosure of Lobbying Activities, submitted via the forms generated by ND Grants; and

• Indirect Cost Agreement or Proposal, submitted as an attachment in ND Grants if the budget…