FY23 TCGP NOFO_OMB Approved_Final_508c_09-26-23.pdf

FY 2023 TCGP NOFO

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

Fiscal Year 2023 Tribal Cybersecurity Grant Program (TCGP)

All entities wishing to do business with the federal government must have a unique entity identifier (UEI). The UEI number is issued by the system. Instructions for requesting a UEI using Sam.gov can be found at: https://sam.gov/content/entity-registration.

Grants.gov registration information can be found at:

https://www.grants.gov/web/grants/register.html.

Planned UEI Updates in Grant Application Forms:

On April 4, 2022, the Data Universal Numbering System (DUNS) Number was replaced by a new, non-proprietary identifier requested in, and assigned by, the System for Award Management (SAM.gov). This new identifier is the Unique Entity Identifier (UEI).

Additional Information can be found on Grants.gov:

https://www.grants.gov/web/grants/forms/planned-uei-updates.html

Table of Contents The Department of Homeland Security (DHS) Planned UEI Updates in Grant Application Forms:

A. Program Description

1. Issued By

2. Assistance Listings Number

3. Assistance Listings Title

4. Funding Opportunity Title

5. Funding Opportunity Number

6. Authorizing Authority for Program

7. Appropriation Authority for Program

8. Announcement Type

9. Program Category

10. Program Overview, Objectives, and Priorities

a. Overview

b. Objectives

c. Priorities

11. Performance Measures B. Federal Award Information

1. Available Funding for the NOFO: $18,246,845

2. Period of Performance: 48 months

3. Projected Period of Performance Start Date(s): Mar. 1, 2024

4. Projected Period of Performance End Date(s): Feb. 29, 2028

5. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

2. Applicant Eligibility Criteria https://sam.gov/content/entity-registration https://www.grants.gov/web/grants/register.html https://www.grants.gov/web/grants/forms/planned-uei-updates.html

3. Other Eligibility Criteria/Restrictions

4. Cost Share or Match

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: Sept. 27, 2023, at 1:00 p.m. ET

b. Application Submission Deadline: Jan. 10, 2024, at 5:00 p.m. ET

c. Other Key Dates

2. Agreeing to Terms and Conditions of the Award

3. Address to Request Application Package

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM)

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application

6. Electronic Delivery

7. How to Register to Apply through Grants.gov

a. General Instructions:

b. Obtain an UEI Number:

c. Obtain Employer Identification Number

d. Create a login.gov account:

e. Register with SAM:

f. Create a Grants.gov Account:

g. Add a Profile to a Grants.gov Account:

h. EBiz POC Authorized Profile Roles:

i. Track Role Status:

j. Electronic Signature:

8. How to Submit an Initial Application to FEMA via Grants.gov

a. Create a Workspace:

b. Complete a Workspace:

c. Adobe Reader:

d. Mandatory Fields in Forms:

e. Complete SF-424 Fields First:

f. Submit a Workspace:

g. Track a Workspace:

h. Additional Training and Applicant Support:

9. Submitting the Final Application in ND Grants

10. Timely Receipt Requirements and Proof of Timely Submission

11. Content and Form of Application Submission

a. Standard Required Application Forms and Information

b. Program-Specific Required Forms and Information

12. Intergovernmental Review

13. Funding Restrictions and Allowable Costs

a. Prohibitions on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services

b. Pre-Award Costs

c. Management and Administration (M&A) Costs

d. Indirect Facilities & Administrative (F&A) Costs

e. Other Direct Costs E. Application Review Information

1. Application Evaluation Criteria

a. Discretionary-Based Allocation Method

b. Programmatic Criteria

b. Financial Integrity Criteria

c. Supplemental Financial Integrity Criteria and Review

2. Review and Selection Process F. Federal Award Administration Information

1. Notice of Award

2. Administrative and National Policy Requirements

a. DHS Standard Terms and Conditions

b. Ensuring the Protection of Civil Rights

c. Environmental Planning and Historic Preservation (EHP) Compliance

d. SAFECOM Guidance Compliance

e. Requirement for using CISA Services

3. Reporting

a. Financial Reporting Requirements

b. Programmatic Performance Reporting Requirements

c. Closeout Reporting Requirements

d. Additional Reporting Requirements

4. Program Evaluation

5. Monitoring and Oversight

a. Financial and Program Monitoring Overview and Approach G. DHS Awarding Agency Contact Information

1. Contact and Resource Information

a. FEMA TCGP Preparedness Officers

b. CISA Grant Program Office

c. Grant Programs Directorate (GPD) Award Administration Division (AAD)

d. FEMA Grants News

e. Equal Rights

f. Environmental Planning and Historic Preservation

2. Systems Information

a. Grants.gov

b. Non-Disaster (ND) Grants

c. Payment and Reporting System (PARS)

H. Additional Information

1. Termination Provisions

a. Noncompliance

b. With the Consent of the Recipient

c. Notification by the Recipient

2. Program Evaluation

3. Period of Performance Extensions

4. Disability Integration

5. Conflicts of Interest in the Administration of Federal Awards or Subawards

6. Procurement Integrity

a. Important Changes to Procurement Standards in 2 C.F.R. Part 200

b. Competition and Conflicts of Interest

c. Supply Schedules and Purchasing Programs

d. Procurement Documentation

7. Financial Assistance Programs for Infrastructure

a. Build America, Buy America Act

b. Waivers

c. Definitions

8. Record Retention

a. Record Retention Period

b. Types of Records to Retain

9. Actions to Address Noncompliance

10. Audits

11. Payment Information

12. Whole Community Preparedness

13. Continuity Capability

14. Appendices

Appendix A: Program Goals and Objectives Appendix B: Cybersecurity Planning Committee and Charter Appendix C: Cybersecurity Plan Appendix D: POETE Solution Areas for Investments Appendix E. TCGP Requirements Matrix Appendix F: Required, Encouraged, and Optional Services, Memberships, and Resources

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA)/Resilience/Grant Program Directorate (GPD)

2. Assistance Listings Number

97.137

3. Assistance Listings Title Tribal Cybersecurity Grant Program

4. Funding Opportunity Title Fiscal Year 2023 Tribal Cybersecurity Grant Program (TCGP)

5. Funding Opportunity Number

DHS-23-GPD-137-00-02

6. Authorizing Authority for Program Section 2220A of the Homeland Security Act of 2002, as amended (Pub. L. No. 107-296) (6 U.S.C. § 665g)

7. Appropriation Authority for Program

Infrastructure Investments and Jobs Act (Pub L. No. 117-58, Division J, Title V)

8. Announcement Type Initial

9. Program Category Preparedness: Infrastructure Security

10. Program Overview, Objectives, and Priorities

a. Overview

Tribal nations face unprecedented cybersecurity risks, including increasingly sophisticated adversaries, widespread vulnerabilities in commonly used hardware and software, and broad dependencies on networked technologies for the day-to-day operation of critical infrastructure. Cyber risk management is further complicated by the ability of malicious actors to operate remotely, linkages between cyber and physical systems, and the difficulty of reducing vulnerabilities.

Considering the risk and potential consequences of cyber incidents, strengthening the cybersecurity practices and resilience of tribal governments is an important homeland security mission and the primary focus of TCGP. Through funding from the Infrastructure Investment and Jobs Act referred to as the Bipartisan Infrastructure Law (BIL) throughout this document, the TCGP enables DHS to make targeted cybersecurity investments in tribal governments, thus improving the security of critical infrastructure and improving the resilience of the services tribal governments provide their communities.

The Fiscal Year (FY) 2023 TCGP aligns with the National Cybersecurity Strategy by addressing three of the five pillars: Pillar One – Defend Critical Infrastructure, Pillar Two – Disrupt and Dismantle Threat Actors, and Pillar Four – Invest in a Resilient Future. The FY 2023 TCGP also addresses the 2020-2024 DHS Strategic Plan by helping DHS achieve Goal 3: Secure Cyberspace and Critical Infrastructure, including Objective 3.3: Assess and Counter Evolving Cybersecurity Risks.

Lastly, the FY 2023 TCGP supports the 2022-2026 FEMA Strategic Plan, which outlines a bold vision with three ambitious goals and three supporting objectives for each goal, including Goal 3: Promote and Sustain a Ready FEMA and Prepared Nation and its Objective 3.2: Posture FEMA to meet current and emergent threats. The FY 2023 TCGP supports the Cybersecurity and Infrastructure Security Agency’s (CISA) 2023–2025 Strategic Plan, which includes Goal 1: Cyber Defense, Goal 2: Risk Reduction and Resilience, and Goal 3: Operational Collaboration.

b. Objectives The goal of TCGP is to assist tribal governments with managing and reducing systemic cyber risk. Accomplishment of this goal can be achieved by implementing or revising Cybersecurity Plans, priorities, projects and addressing TCGP objectives.

Tribal applicants must address how the following program objective will be met in their applications for FY 2023:

• Objective 1: Develop and establish appropriate governance structures, including by implementing or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations.

In addition to Objective 1, the following objectives are eligible, but not required, for FY 2023 applications:

• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.

• Objective 3: Implement security protections commensurate with risk.

• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

Applicants should refer to Appendix A, “Program Goals and Objectives” for more information on TCGP program goals, objectives, sub-objectives, and desired outcomes required in their FY 2023 TCGP application.

c. Priorities

i. CYBERSECURITY PLANS, COMMITTEES AND CHARTER

The Homeland Security Act of 2002, as amended by the BIL, requires TCGP grant recipients to develop a Cybersecurity Plan, establish a Cybersecurity Planning Committee to support development of the Cybersecurity Plan, and identify projects to implement using TCGP https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024 https://www.fema.gov/about/strategic-plan funding. To support these efforts, recipients must prioritize the following activities using FY 2023 TCGP funds, all of which are statutorily required as a condition of receiving a grant:

1. Establish a Cybersecurity Planning Committee*; and

2. Implement or revise a Cybersecurity Plan, unless the recipient already has a

Cybersecurity Plan and plans to revise it.

*Tribal Cybersecurity Planning Committee An existing Tribal Council/Governing Body that includes the participation of a designated Chief Information Officer (CIO), Chief Information Security Officer (CISO), or equivalent official to the CIO or CISO with expertise in information technology (IT) and systems. The CIO, CISO, or equivalent official to the CIO or CISO is one who fulfills the duties of the CIO, even if their job includes other duties and responsibilities. If the tribal government would prefer to establish a separate Cybersecurity Planning Committee, the required members of that committee must include the following: the grants administration office and a designated CIO, CISO, or equivalent official to the CIO or CISO with expertise in IT and systems. Additional members are encouraged but not required.

II. CYBERSECURITY ACTIVITIES, BEST PRACTICES, INVESTMENTS AND PROJECTS

Cybersecurity Activities The tribal government must consult with its CIO, CISO, or equivalent official to the CIO or CISO (who fulfills the duties of the CIO or CISO, even if their job includes other duties and responsibilities), in the plans for allocating TCGP funds. To support the FY 2023 TCGP requirements, Cybersecurity Plans must include the following activities:

a. An assessment of the capabilities of the tribal government relating to the 13 required cybersecurity plan elements; and

b. Adopting key cybersecurity best practices and consulting Cybersecurity Performance Goals (CPGs).

i. The CPGs are a prioritized subset of information technology and operational technology cybersecurity practices aimed at meaningfully reducing risks to both critical infrastructure operations.

ii. These goals are applicable across all critical infrastructure sectors and are informed by the most common and impactful threats and adversary tactics, techniques, and procedures (TTPs) observed by CISA and its government and industry partners, making them a common set of protections that all critical infrastructure entities – from large to small – should implement.

iii. The CPGs do not reflect an all-encompassing cybersecurity program – rather, they are a minimum set of practices that organizations should implement towards ensuring a strong cybersecurity posture.

iv. The Cross-Sector Cybersecurity Performance Goals are regularly updated, with a targeted revision cycle of at least every 6 to 12 months.

Key Cybersecurity Best Practices for Individual Projects To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, tribal governments must take decisive steps to modernize their approach to cybersecurity. As tribes increase their cybersecurity maturity, CISA recommends they move toward https://www.cisa.gov/cross-sector-cybersecurity-performance-goals implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing. To assist in the revision of tribal cyber planning efforts, the following Cybersecurity Best Practices are provided. As appropriate, the strategic elements listed in the table below should be included in FY 2023 individual projects:

Cybersecurity Best Practices for Individual Projects

Implement multi-factor authentication Implement enhanced logging Data encryption for data at rest and in transit End use of unsupported/end of life software and hardware that are accessible from the internet Prohibit use of known/fixed/default passwords and credentials Ensure the ability to reconstitute systems (backups) Actively engage in bidirectional sharing between CISA and tribal governments in cyber relevant time frames to drive down cyber risk Migration to the .gov internet domain

Cybersecurity Investments and Projects Given the Cybersecurity Plan is a strategic document, it should not identify specific vulnerabilities but instead capture the broad level of capability across the tribal government.

The Cybersecurity Plan must also show how the implementation of the individual projects and activities over time will help achieve the goals and objectives of the plan. A summary of projects using FY 2023 TCGP funds associated with each required and discretionary element provides a helpful snapshot of tribal capabilities and capacity that will be achieved as a result of this funding. Details for each project using TCGP funds must be included in the Investment Justifications (IJs).

Each IJ must provide a baseline understanding of the existing cybersecurity gaps, risks, and threats that the applicant entity faces, which have influenced the development of the IJ. The IJ must include a summary of the current capabilities within the applicant tribal government to address these threats and risks. The IJ should also include a description of how the proposed project addresses gaps and/or sustainment in the Cybersecurity Plan and how the project aligns to the cybersecurity elements in this funding notice. Finally, the IJ should include implementation planning data to assist in project management.

The Project Worksheet (PW) will be used to identify the budget details and the budget narrative portion of the application. Eligible applicants should submit only one PW as part of the overall application and must include information for each IJ submitted as part of the application for funding. More information on the IJ Template, PW and instructions can be found in Section D.11 in this funding notice.

III. MULTI-ENTITY PROJECTS

Eligible tribal governments can group together to address cybersecurity risks and threats to information systems within tribal jurisdictions. Each participating tribal jurisdiction in the group should include the multi-entity project in their individual IJ submissions with their application. There is no separate funding for multi-entity projects proposed by a group of eligible tribal governments. Instead, these investments would be considered as group projects: each tribal jurisdiction contributes an agreed-upon funding amount to the overall project. It is expected that IJs for multi-entity projects will be almost identical. Any differences should be due to alignment with each tribal jurisdiction’s respective Cybersecurity Plan. Each tribal jurisdiction’s financial contribution will be funded from their individual TCGP award.

The multi-entity project submissions must be approved by each tribal jurisdiction’s Cybersecurity Planning Committees, and each multi-entity project submission must be aligned with each tribal jurisdiction’s respective Cybersecurity Plan. The projects must improve or sustain capabilities identified in the respective Cybersecurity Plan for each tribal jurisdiction in the group. If two or more tribes apply for a multi-entity group project, the group will participate within the category of the highest populated tribe. For example, if a smaller tribe wants to join a larger tribe for a group project, then the application will be reviewed for funding within the larger tribe’s population category.

Multi-Entity Project Requirements and Process Overview The following must be included in each of the participating tribal governments’ Cybersecurity Plans, as well as the IJs and PWs for the multi-entity project:

• A detailed description of the overall project;

• The division of responsibilities among each participating tribal group member;

• The distribution of funding among the participating tribal group members; and

• An overview of how implementation of the multi-entity project will help achieve the goals and objectives in the Cybersecurity Plan of each participating tribal group member.

Multi-Entity Project Benefits A multi-entity project is funded from each participating tribal governments’ TCGP award in accordance with their agreed-upon contribution amounts. At the same time, all parties to a multi-entity project may realize cost savings due to volume purchases.

IV. IMMINENT CYBERSECURITY THREAT

TCGP is primarily a security preparedness program focused on reducing cyber risks by helping tribal governments address cybersecurity vulnerabilities and build cybersecurity capabilities. Over time, the program activities and investments reduce the potential impact of cybersecurity threats and incidents. Section 2220A(d)(4) of the Homeland Security Act of 2002 (6 U.S.C. § 665g(d)(4)) provides that “An eligible entity that receives a grant under this section and a local government that receives funds from a grant under this section, as appropriate, shall use the grant to…(4) assist with activities that address imminent cybersecurity threats, as confirmed by the Secretary, acting through the [CISA] Director, to the information systems owned or operated by, or on behalf of, the eligible entity or a local government within the jurisdiction of the eligible entity.”

The following provides a general overview of the processes for the FY 2023 grant cycle from a grant management perspective. Specific details on CISA’s criteria and process for confirming an imminent cybersecurity threat are not included here. The following also does not supersede or replace existing threat notification procedures or existing methods to collaborate on operational cybersecurity matters.

Process Overview

• Any eligible entity seeking to use TCGP funds to address an imminent cybersecurity threat, as confirmed by the Secretary, acting through the CISA Director, must have a Cybersecurity Plan approved by CISA.

• DHS, through CISA will determine whether an incident constitutes as an imminent cybersecurity threat.

• Upon confirmation, DHS will notify the tribal recipient who will, in turn, notify the Cybersecurity Planning Committee and CIO, CISO, or equivalent official to the CIO or

CISO.

• DHS will notify impacted tribal governments, as appropriate, of permissible imminent cybersecurity threat fund usage.

• FEMA will issue an Information Bulletin (IB) detailing the impacted governments and procedures for reprograming TCGP funds to support the specific imminent cybersecurity threat. The scope of the IB will be dependent on the nature of the imminent cybersecurity threat.

11. Performance Measures DHS will communicate with all TCGP recipients on the information collection process related to performance measures data. DHS will measure the recipient’s performance of the grant by comparing the number of activities and projects needed and requested in its IJs with the number of activities and projects acquired and delivered by the end of the period of performance (POP) using the following programmatic metrics:

Performance Measures Percentage of tribes with CISA approved tribal Cybersecurity Plans Percentage of tribes with Tribal Cybersecurity Planning Committees that meet the Homeland Security Act of 2002 and TCGP funding notice requirements Percentage of tribes conducting annual table-top and full-scope exercises to test Cybersecurity Plans Percent of the tribes’ TCGP budget allocated to exercises Average dollar amount expended on exercise planning for tribes Percentage of tribes conducting an annual cyber risk assessment to identify cyber risk management gaps and areas for improvement Percentage of tribes performing phishing training Percentage of tribes conducting awareness campaigns Percent of tribes providing role-based cybersecurity awareness training to employees Percentage of tribes adopting the Workforce Framework for Cybersecurity (NICE Framework) as evidenced by established workforce development and training plans Percentage of tribes with capabilities to analyze network traffic and activities related to potential threats Percentage of tribes implementing multi-factor authentication (MFA) for all remote access and privileged accounts

Percentage of tribes with programs to anticipate and discontinue use of end-of-life software and hardware

Percentage of tribes prohibiting the use of known/fixed/default passwords and credentials Percentage of tribes operating under the “.gov” internet domain Number of cybersecurity gaps or issues addressed annually by tribes

B. Federal Award Information

1. Available Funding for the NOFO: $18,246,845

The BIL appropriated $200 million in FY 2022 and $400 million in FY 2023 for the state, territorial, local, and tribal cybersecurity grant programs, to remain available until expended.

The amount apportioned for tribal governments is $6 million for FY 2022 (3% of the total appropriations of $200 million). For FY 2023, the amount apportioned for the tribal governments is $12,246,845 (3% of the total appropriations of $400 million for FY 2023) plus $8,228,169 remaining from FY 2022. FEMA and CISA combined FY 2022 and FY 2023 into a single funding notice for a total of $18,246,845.

TCGP uses an allocation methodology that establishes four funding categories and divides the $18,246,845 across them. The funding categories allow for applications to be evaluated from among applications from similarly populated tribes. The following table illustrates the four population levels, number of tribes, and the corresponding combined funding levels for FY 2022 and FY 2023:

Tribal Population Number of Tribes1

Maximum Allocation of Funding Per Category

100,000 or more 8 $8,109,709 10,000-99,999 33 $5,068,568 1,000-9,999 124 $3,041,141

1-999 392 $2,027,427

Additional information related to the discretionary allocation methodology is detailed in Section E. of this funding notice.

2. Period of Performance: 48 months

Extensions to the period of performance are allowed. For additional information on period of performance extensions, please refer to Section H of this funding notice.

3. Projected Period of Performance Start Date(s): Mar. 1, 2024

1 The number of tribes with a population greater than 1 total 557. The remaining 17 tribes have a represented population of less than 1 per the US Census.gov data collected in 2020.

4. Projected Period of Performance End Date(s): Feb. 29, 2028

5. Funding Instrument Type: Grant

C. Eligibility Information

1. Eligible Applicants

Tribal governments.

“Tribal government” is defined at Section 2220A(a)(7) of the Homeland Security Act (codified as amended at U.S.C. § 665g(a)(7)) as the recognized governing body of any Indian or Alaska Native Tribe, band, nation, pueblo, village, community, component band, or component reservation, that is individually identified (including parenthetically) in the most recent published list of Federally Recognized Tribes.

2. Applicant Eligibility Criteria Applicants must be a tribal government that is eligible for the program. Two or more tribal governments may apply together as a tribal consortium and submit one application for the consortium.

3. Other Eligibility Criteria/Restrictions Each eligible tribal government is required to meet the following criteria for FY 2023:

• Submit a Cybersecurity Plan, Cybersecurity Planning Committee List, and a Cybersecurity Charter that aligns with the criteria detailed in this funding notice.

• Cybersecurity projects funded by the Tribal Homeland Security Grant Program (THSGP) may be considered for TCGP funding if not duplicative of the THSGP project(s).

FEMA will not release funds to a recipient until CISA approves the entity’s Cybersecurity Plan. Details on the requirements for the Cybersecurity Plan, Committee Membership List, and Charter can be found in Appendices A - C in this funding notice.

4. Cost Share or Match Cost share or match is waived for the FY 2023 TCGP.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date:

b. Application Submission Deadline:

Sept. 27, 2023, at 1:00 p.m. ET

Jan. 10, 2024, at 5:00 p.m. ET

All applications must be received by the established deadline.

The Non-Disaster (ND) Grants System has a date stamp that indicates when an application is submitted. Applicants will receive an electronic message confirming receipt of their https://www.bia.gov/service/tribal-leaders-directory/federally-recognized-tribes submission. For additional information on how an applicant will be notified of application receipt, see the subsection titled “Timely Receipt Requirements and Proof of Timely Submission” in Section D of this funding notice.

FEMA will not review applications that are received after the deadline or consider these late applications for funding. FEMA may, however, extend the application deadline on request for any applicant who can demonstrate that good cause exists to justify extending the deadline. Good cause for an extension may include technical problems outside of the applicant’s control that prevent submission of the application by the deadline, other exigent or emergency circumstances, or statutory requirements for FEMA to make an award.

Applicants experiencing technical problems outside of their control must notify FEMA as soon as possible and before the application deadline. Failure to timely notify FEMA of the issue that prevented the timely filing of the application may preclude consideration of the award. “Timely notification” of FEMA means before the application deadline and within 48 hours after the applicant became aware of the issue.

A list of FEMA contacts can be found in Section G of this funding notice, “DHS Awarding Agency Contact Information.” For additional assistance using the ND Grants System, please contact the ND Grants Service Desk at (800) 865-4076 or NDGrants@fema.dhs.gov. The ND Grants Service Desk is available Monday through Friday, 9:00 a.m. – 6:00 p.m. ET. For programmatic or grants management questions, please contact your Program Analyst or Grants Specialist. If applicants do not know who to contact or if there are programmatic questions or concerns, please contact FEMA Grants News by phone at (800) 368-6498 or by e-mail at fema-grants-news@fema.dhs.gov, Monday through Friday, 9:00 a.m. – 5:00 p.m.

ET.

c. Other Key Dates

2. Agreeing to Terms and Conditions of the Award

By submitting an application, applicants agree to comply with the requirements of this funding notice and the terms and conditions of the award.

Event Suggested Deadline for Completion Initial registration in SAM.gov includes UEI issuance

Four weeks before actual submission deadline

Obtaining a valid Employer Identification Number (EIN) Four weeks before actual submission deadline

Creating an account with login.gov Four weeks before actual submission deadline Registering in SAM or Updating SAM registration Four weeks before actual submission deadline

Registering in Grants.gov Four weeks before actual submission deadline Registering in ND Grants Four weeks before actual submission deadline Starting application in Grants.gov One week before actual submission deadline Submitting the final application in ND Grants By the submission deadline mailto:NDGrants@fema.dhs.gov mailto:fema-grants-news@fema.dhs.gov

3. Address to Request Application Package

Initial applications are processed through the Grants.gov portal. Final applications are completed and submitted through FEMA’s ND Grants System. Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov.

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM) Each applicant, unless they have a valid exception under 2 C.F.R. 25.110, must:

1. Be registered in Sam.Gov before application submission.

2. Provide a valid Unique Entity Identifier (UEI) in its application.

3. Continue to always maintain an active System for Award Management (SAM) registration with current information during the Federal Award process.

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application Applying for an award under this program is a multi-step process and requires time to complete. Applicants are encouraged to register early as the registration process can take four weeks or more to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required submission deadlines.

Please review the table above for estimated deadlines to complete each of the steps listed.

Failure of an applicant to comply with any of the required steps before the deadline for submitting an application may disqualify that application from funding.

To apply for an award under this program, all applicants must:

a. Apply for, update, or verify their Unique Entity Identifier (UEI) number from SAM.gov and Employer Identification Number (EIN) from the Internal Revenue Service;

b. In the application, provide an UEI number;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before submitting the application;

e. Create a Grants.gov account;

f. Add a profile to a Grants.gov account;

g. Establish an Authorized Organizational Representative (AOR) in Grants.gov;

h. Register in ND Grants;

i. Submit an initial application in Grants.gov;

j. Submit the final application in ND Grants, including electronically signing applicable forms; and

k. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency. As part of this, applicants must also provide information on an applicant’s immediate and highest-level owner and https://www.grants.gov/ http://www.grants.gov/ https://www.login.gov/ subsidiaries, as well as on all predecessors that have been awarded federal contracts or federal financial assistance within the last three years, if applicable.

Specific instructions on how to apply for, update, or verify an UEI number or SAM registration or establish an AOR are included below in the steps for applying through Grants.gov.

Applicants are advised that FEMA may not make a federal award until the applicant has complied with all applicable SAM requirements. Therefore, an applicant’s SAM registration must be active not only at the time of application, but also during the application review period and when FEMA is ready to make a federal award. Further, as noted above, an applicant’s or recipient’s SAM registration must remain active for the duration of an active federal award. If an applicant’s SAM registration is expired at the time of application, expires during application review, or expires any other time before award, FEMA may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

Per 2 C.F.R. § 25.110(c)(2)(iii), if an applicant is experiencing exigent circumstances that prevents it from obtaining an UEI number and completing SAM registration prior to receiving a federal award, the applicant must notify FEMA as soon as possible by contacting fema-grants-news@fema.dhs.gov and providing the details of the circumstances that prevent completion of these requirements. If FEMA determines that there are exigent circumstances and FEMA has decided to make an award, the applicant will be required to obtain an UEI number, if applicable, and complete SAM registration within 30 days of the federal award date.

6. Electronic Delivery DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages or requires applicants to submit their applications online through Grants.gov, depending on the funding opportunity.

For this funding opportunity, FEMA requires applicants to submit initial applications through Grants.gov and a final application through ND Grants.

7. How to Register to Apply through Grants.gov

a. General Instructions:

Registering and applying for an award under this program is a multi-step process and requires time to complete. Read the instructions below about registering to apply for FEMA funds. Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. To ensure an application meets the deadline, applicants are advised to start the required steps well in advance of their submission.

mailto:fema-grants-news@fema.dhs.gov

Organizations must have an UEI number, an EIN, an active System for Award Management (SAM) registration and Grants.gov account to apply for grants.

Organizations must also have a Grants.gov account to apply for an award under this program.

Creating a Grants.gov account can be completed online in minutes, but UEI and SAM registrations may take several weeks. Therefore, an organization's registration should be done in sufficient time to ensure it does not impact the entity's ability to meet required application submission deadlines. Complete organization instructions can be found on Grants.gov here:

https://www.grants.gov/web/grants/applicants/organization-registration.html.

If individual applicants are eligible to apply for this grant funding opportunity, refer to https://www.grants.gov/web/grants/applicants/registration.html.

b. Obtain an UEI Number:

All entities applying for funding, including renewal funding, prior to April 4, 2022, must have a UEI number. Applicants must enter the UEI number in the applicable data entry field on the SF-424 form.

For more detailed instructions for obtaining a UEI number, refer to: Sam.gov.

c. Obtain Employer Identification Number All entities applying for funding must provide an Employer Identification Number (EIN).

The EIN can be obtained from the IRS by visiting https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online.

d. Create a login.gov account:

Applicants must have a login.gov account in order to register with SAM or update their SAM registration. Applicants can create a login.gov account here:

https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3.

Applicants only have to create a login.gov account once. For applicants that are existing SAM users, use the same email address for the login.gov account as with SAM.gov so that the two accounts can be linked.

For more information on the login.gov requirements for SAM registration, refer to:

https://www.sam.gov/SAM/pages/public/loginFAQ.jsf.

e. Register with SAM:

All organizations applying online through Grants.gov must register with SAM. Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually. Organizations will be issued a UEI number with the completed SAM registration.

https://www.grants.gov/web/grants/applicants/organization-registration.html https://www.grants.gov/web/grants/applicants/registration.html https://sam.gov/ https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online https://www.irs.gov/businesses/small-businesses-self-employed/apply-for-an-employer-identification-number-ein-online https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3 https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-a62b99571fd3 https://www.sam.gov/SAM/pages/public/loginFAQ.jsf

For more detailed instructions for registering with SAM, refer to https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html.

Note: As a new requirement per 2 C.F.R. § 25.200, applicants must also provide the applicant’s immediate and highest-level owner, subsidiaries, and predecessors that have been awarded federal contracts or federal financial assistance within the past three years, if applicable.

I. ADDITIONAL SAM REMINDERS

Existing SAM.gov account holders should check their account to make sure it is “ACTIVE.”

SAM registration should be completed at the very beginning of the application period and should be renewed annually to avoid being “INACTIVE.” Please allow plenty of time before the grant application submission deadline to obtain an UEI number and then to register in SAM. It may be four weeks or more after an applicant submits the SAM registration before the registration is active in SAM, and then it may be an additional 24 hours before FEMA’s system recognizes the information.

It is imperative that the information applicants provide is correct and current. Please ensure that your organization’s name, address, and EIN are up to date in SAM and that the UEI number used in SAM is the same one used to apply for all other FEMA awards. Payment under any FEMA award is contingent on the recipient’s having a current SAM registration.

II. HELP WITH SAM

The SAM quick start guide for new recipient registration and SAM video tutorial for new applicants are tools created by the General Services Administration (GSA) to assist those registering with SAM. If applicants have questions or concerns about a SAM registration, please contact the Federal Support Desk at https://www.fsd.gov/fsd-gov/home.do or call toll free (866) 606-8220.

f. Create a Grants.gov Account:

The next step in the registration process is to create an account with Grants.gov. If applicable, applicants must know their organization’s UEI number to complete this process.

For more information, follow the on-screen instructions or refer to https://www.grants.gov/web/grants/applicants/registration.html.

See also Section D.8 in this funding notice, “Submitting the Final Application in ND Grants,” for instructions on how to register early in ND Grants.

g. Add a Profile to a Grants.gov Account:

A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, if applicable, enter the UEI number for the organization in the UEI field while adding a profile.

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.fsd.gov/fsd-gov/home.do https://www.grants.gov/web/grants/applicants/registration.html

For more detailed instructions about creating a profile on Grants.gov, refer to https://www.grants.gov/web/grants/applicants/registration/add-profile.html.

h. EBiz POC Authorized Profile Roles:

After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the Authorized Organization Representative (AOR) role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html.

i. Track Role Status:

To track your role request, refer to https://www.grants.gov/web/grants/applicants/registration/track-role-status.html.

j. Electronic Signature:

When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature. The EBiz POC must authorize individuals who are able to make legally binding commitments on behalf of the organization as an AOR;

this step is often missed, and it is crucial for valid and timely submissions.

8. How to Submit an Initial Application to FEMA via Grants.gov Standard Form 424 (SF-424) is the initial application for this NOFO.

Grants.gov applicants can apply online using a workspace. A workspace is a shared, online environment where members of a grant team may simultaneously access and edit different web forms within an application. For each funding notice, you can create individual instances of a workspace. Applicants are encouraged to submit their initial applications in Grants.gov at least seven days before the application deadline.

In Grants.gov, applicants need to submit the following forms:

• SF-424, Application for Federal Assistance; and

• Grants.gov Lobbying Form, Certification Regarding Lobbying.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using workspace, refer to https://www.grants.gov/web/grants/applicants/workspace-overview.html

a. Create a Workspace:

Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

https://www.grants.gov/web/grants/applicants/registration/add-profile.html https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html https://www.grants.gov/web/grants/applicants/registration/track-role-status.html https://www.grants.gov/web/grants/applicants/workspace-overview.html

b. Complete a Workspace:

Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before

c. Adobe Reader:

If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace so that they will appear similar to other Standard or DHS forms. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html.

d. Mandatory Fields in Forms:

In the forms, you will note fields marked with an asterisk and a different background color.

These fields are mandatory fields that must be completed to successfully submit your application.

e. Complete SF-424 Fields First:

The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and UEI number. To trigger this feature, an applicant must complete the SF-424 information first. Once it is completed, the information will transfer to the other forms.

f. Submit a Workspace:

An application may be submitted through workspace by clicking the “Sign and Submit” button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24-48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application

g. Track a Workspace:

After successfully submitting a workspace package, a Grants.gov Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the confirmation page that is generated after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

h. Additional Training and Applicant Support:

For additional training resources, including video tutorials, refer to https://www.grants.gov/web/grants/applicants/applicant-training.html.

https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html https://www.grants.gov/web/grants/applicants/applicant-training.html

Grants.gov provides applicants 24/7 (except federal holidays) support via the toll-free number (800) 518-4726, email at support@grants.gov and the website at https://www.grants.gov/support.html. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist FEMA with tracking your issue and understanding background information on the issue.

9. Submitting the Final Application in ND Grants

After submitting the initial application in Grants.gov, eligible applicants will be notified by FEMA and asked to proceed with submitting their complete application package in ND Grants. Applicants can register early with ND Grants and are encouraged to begin their ND Grants registration at the time of this announcement or, at the latest, seven days before the application deadline. Early registration will allow applicants to have adequate time to start and complete their applications.

Applicants needing assistance registering for the ND Grants system should contact ndgrants@fema.dhs.gov or (800) 865-4076. For step-by-step directions on using the ND Grants system and other guides, please see https://www.fema.gov/grants/guidance-tools/non-disaster-grants-management-system.

In ND Grants, applicants will be prompted to submit the standard application information and any program-specific information required as described in Section D.10 of this notice, “Content and Form of Application Submission.” The Standard Forms (SF) are auto generated in ND Grants, but applicants may access these forms in advance through the Forms tab under the SF-424 family on Grants.gov. Applicants should review these forms before applying to ensure they have all the information required.

For additional application submission requirements, including program-specific requirements, please refer to the subsection titled “Content and Form of Application Submission” under Section D of this funding notice.

10. Timely Receipt Requirements and Proof of Timely Submission As application submission is a two-step process, the applicant with the AOR role who submitted the application in Grants.gov will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from Grants.gov with the successful transmission of its initial application. This notification does not serve as proof of timely submission, as the application is not complete until it is submitted in ND Grants. Applicants can also view the ND Grants Agency Tracking Number by accessing the Details tab in the submitted workspace section in Grants.gov, under the Agency Tracking Number column. Should the Agency Tracking Number not appear, the application has not yet migrated from Grants.gov into the ND Grants System. Please allow 24 hours for your ND Grants application tracking number to migrate.

mailto:support@grants.gov https://www.grants.gov/support.html mailto:ndgrants@fema.dhs.gov https://www.fema.gov/grants/guidance-tools/non-disaster-grants-management-system…