NOFO Building International Capacity to Counter the Proliferation and Misuse of Commercial Spyware v2.pdf

U.S. DEPARTMENT OF STATE

BUREAU OF CYBERSPACE AND DIGITAL POLICY (CDP)

Notice of Funding Opportunity (NOFO):

Building International Capacity to Counter the Proliferation and Misuse of Commercial Spyware

This is the announcement of funding opportunity number DFOP0016689

Federal Assistance Listing/Catalog of Federal Domestic Assistance Number: 19.665

Type of Solicitation: Open Competition

Deadline for Applications: 11:59 PM EST/EDT on 29 July 2024

Total Funding: $1,000,000.00 USD (FY2023)

Funding Type I: Economic Support Funds (ESF) FADR Data Element 2: Global/Economic Growth/EG8

Anticipated Number of Awards: 1

Type of Award: Cooperative Agreement

Period of Performance: 18 months

Anticipated Time to Award: October 2024

Deadline for Questions: 11:59 PM EST on 15 July 2024

Eligibility Category:

• U.S.- based non-profit/non-governmental organizations subject to sections 501 (c)(3) and 501

(c)(6) of the U.S. tax code

• Public International Organizations (PIOs) or Foreign

Public Entities (FPE)

• Foreign-based non-profit organizations/nongovernment organizations (NGO)

• Private, public, or state institutions of higher education

(universities and colleges)

• For-profit organizations or businesses.

Type of Applicant: Organizations only. Individuals not eligible to apply.

Number of Applications: One (1) per applicant organization.

This notice is subject to availability of funding.

Section A: Project Description

The U.S. Department of State, Bureau of Cyberspace and Digital Policy (CDP) announces an open competition for organizations with the capacity and interest to carry out the project outlined in this announcement.

Pending the availability of funds, CDP anticipates awarding one grant of up to $1,000,000.00

USD. CDP reserves the right to award more or less funding or make no award as is in the best interest of the US Government.

This project will increase the capacity of countries to develop effective regulations preventing the proliferation and misuse of commercial spyware in alignment with international best practices and advocate for commercial spyware regulatory approaches that are technically sound and rights-respecting.

The intended target audience of the project activities are partner govt agencies and other public institutions with regulatory or enforcement responsibility for commercial spyware.

This project will be global in nature with an initial focus on Asia, Europe and Central and South

America.

A1. Background

Recognizing the growing role of technology as a cross-cutting national security issue, the State

Department created the Bureau of Cyberspace and Digital Policy (CDP) in April 2022 to lead and coordinate U.S. diplomacy on cyber and digital policy. The bureau addresses the national security challenges and economic opportunities presented by cyberspace and digital technologies and promotes standards and norms that are fair, transparent, and support the rights-respecting use of technology. Through robust engagement in multilateral organizations, bilateral diplomacy with partners round the world, and encouragement of responsible state behavior in cyberspace, CDP empowers U.S. leadership in cyber, digital, and technology diplomacy.

CDP deploys foreign assistance to strengthen international cooperation, create new partnerships, promote economic growth and development, and assist in the defense of our foreign partners to uphold an open, interoperable, secure, and reliable Internet.

Calibrated cyber and digital policies help form the backbone of our deeply interconnected world, are vital to U.S. national and economic security, and are required to fully harness the transformative power of technology. As citizens around the world eagerly seek increased

Internet connectivity to access the tremendous opportunities afforded by digital transformation, the United States is working to ensure this connectivity is secure, meaningful, governed fairly, and serves the interests of its users. Foreign assistance programs aim to advance an affirmative vision of technology as a tool that supports collective security, prosperity, and democratic values.

More information on CDP is available at https://www.state.gov/bureaus-offices/deputy-secretary-of-state/bureau-of-cyberspace-and-digital-policy/.

The Digital Connectivity and Cybersecurity Partnership (DCCP) is a global, interagency initiative led by CDP and the U.S. Department of State to promote an open, interoperable, secure, and reliable internet. DCCP provides foreign assistance to partner nations to promote investments in secure, diverse, and resilient information and communication technologies (ICT) infrastructure; support the adoption of inclusive, rights-respecting, multi-stakeholder models of internet governance; grow global markets for trusted ICT goods and services; and enhance cybersecurity. CDP foreign assistance programming follows these core tenets of DCCP. More information on DCCP is available at https://www.state.gov/digital-connectivity-and-cybersecurity-partnership/.

A2. Strategic Program Goals and Objectives

This project should contribute to the following CDP strategic goals and objectives outlined in the Functional Bureau Strategy, and four DCCP Pillars.

CDP Strategic Goals and Objectives:

Bureau Goal 1: Advance cyber and digital policies that align with U.S. national interests and foreign policy objectives.

Objective 1.1: Deepen relationships with existing U.S. allies and partners, forge new partnerships, and engage with a range of countries to advance a common vision for the

Internet and digital technologies.

Objective 1.2: Leverage key multilateral fora to build relationships, advance U.S. policy priorities, and guard against positions that are counter to U.S. approaches to the Internet and digital technologies.

Objective 1.3: Identify, enhance, cultivate, and develop strategic engagements across the private sector and multistakeholder communities.

Objective 1.4: Increase secure and open digital connectivity and access to the Internet.

Objective 1.5: Implement public messaging and public diplomacy programs to expand key audiences’ understanding and support of U.S. cyber and digital policies.

DCCP Pillars:

Pillar 2: Advance an Open, Interoperable, Reliable, and Secure Internet by promoting inclusive, rights-respecting, multi-stakeholder models of internet governance and pro-competition, pro-innovation digital economy policies and regulations.

Pillar 4: Enhance Cybersecurity by increasing adoption and implementation of cybersecurity best practices.

A3. Project Goals, Objectives, Expected Outcomes, Activities, Indicators, and Sustainability

The United States has fundamental national security and foreign policy interests in ensuring that technology is developed, deployed, and governed in accordance with universal human rights; the rule of law; and appropriate legal authorization, safeguards, and oversight, such that it supports, and does not undermine, democracy, civil rights and civil liberties, and public safety. Furthermore, the United States is concerned about the impact of the misuse of digital https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.state.gov.mcas.ms%2Fbureaus-offices%2Fdeputy-secretary-of-state%2Fbureau-of-cyberspace-and-digital-policy%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11&McasTsid=20892 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.state.gov.mcas.ms%2Fbureaus-offices%2Fdeputy-secretary-of-state%2Fbureau-of-cyberspace-and-digital-policy%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11&McasTsid=20892 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.state.gov.mcas.ms%2Fdigital-connectivity-and-cybersecurity-partnership%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11&McasTsid=20892 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.state.gov.mcas.ms%2Fdigital-connectivity-and-cybersecurity-partnership%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11&McasTsid=20892 technologies on civic participation and human rights, including privacy, and freedoms of expression, association, and peaceful assembly. Therefore, the United States has prioritized countering the proliferation and misuse of commercial spyware. Governments have misused these tools to control access to information, arbitrarily and unlawfully surveil, and intimidate and silence journalists, human rights defenders, and perceived critics, disproportionately affecting women and girls and other members of marginalized populations. In egregious cases, these tactics have facilitated acts of transnational repression, physical aggression, arbitrary detentions and imprisonment, torture, and extrajudicial killings.

The proliferation and misuse of commercial spyware poses a risk to both national security and the exercise of human rights. Greater action is needed from governments to establish robust guardrails and procedures to ensure that any commercial spyware use is consistent with respect for universal human rights, the rule of law, and civil rights and civil liberties., which this funding will help drive.

In awarding funds for this project, CDP expects that the activities and milestones listed below will be accomplished within the project’s period of performance.

This project should be designed to achieve the following high-level goal: Increase the capacity of countries to develop effective regulations preventing the proliferation and misuse of commercial spyware in alignment with international best practices, advocate for commercial spyware regulatory approaches that are technically sound and rights-respecting.

Project Objective 1: Baseline Evaluation: Evaluate the current landscape of commercial spyware regulations, knowledge, and capacities in countries open to regulating commercial spyware and limiting its misuse.

Expected Outcomes

• Improved USG understanding of strategic opportunities and needs for developing maturity in commercial spyware regulation and policy development.

Activities and Deliverables

To achieve the expected project outcomes, the project must include the following:

• Baseline Analysis and Report: In order to identify the greatest opportunities and needs for developing maturity in regulation and policy development, the implementer will analyze existing capacities regarding counter commercial spyware regulation and policy levers and develop a baseline report for each geographical region. The list of countries for the analysis will be determined in conjunction with CDP once the implementer is chosen. However, priority regions will include, but not limited to:

o Asia o Central and South America o Europe

Project Objective 2: Curriculum Development: Design a training methodology and curriculum to increase the capacity of states to regulate commercial spyware and develop policy tools to counter the proliferation and misuse of commercial spyware.

Expected Outcomes

• Training methodology and curriculum to train foreign governments on the regulation of commercial spyware for foundational and advanced levels.

Activities and Deliverables

To achieve the expected project outcomes, the project must include the following:

• Develop an overall methodology, training curriculum, and plan of action on effectively and sustainably increasing the capacity of countries to effectively counter the proliferation and misuse of commercial spyware. This methodology should be based on

U.S. government action, including the Executive Order on the Prohibition of Use by the

United States Government of Commercial Spyware the Poses Risks to National Security, related export controls, economic sanctions, and visa restrictions, and programming to protect human rights defenders, including journalists as well as members of diaspora communities at risk of transnational repression. Consult with CDP to coordinate activities and target countries.

Project Objective 3: Broad-based Foundational Training: Using that baseline understanding and curriculum developed under Project Objectives 1 and 2, increase the capacity of a diverse set of government stakeholders to participate in the development of commercial spyware regulations and policies to counter the proliferation and misuse of commercial spyware.

Expected Outcomes

• Greater awareness and appreciation of the risks posed by the proliferation and misuse of commercial spyware.

• Greater understanding of the suite of regulatory and policy actions that states can leverage to counter the proliferation and misuse of commercial spyware.

• Increased capacity of target governments to limit the proliferation and misuse of commercial spyware and potential remedies to protect victims.

• Potentially expanding membership within the Joint Statement on Efforts to Counter the

Proliferation and Misuse of Commercial Spyware.

• Deepened international cooperation with allies and partners on counter commercial spyware policy.

• Participant countries adopt international best practices for domestic policies and regulations on limiting the proliferation and misuse of commercial spyware.

Activities and Deliverables

To achieve the expected project outcomes, the project must include the following:

• Collaborate with CDP and U.S. Embassies to identify global participants for the in-person conferences that includes diverse and relevant stakeholders who are currently involved in the development of commercial spyware regulations including technical experts from academia, policy makers in donor countries, the diplomatic community, private sector, and civil society organizations.

• Execute at least 3 in-person awareness raising workshops, with at least one for each of the regions mentioned in Project Objective 1. Workshops must include:

▪ foundational concepts related to the proliferation and misuse of commercial spyware;

▪ an overview of the threat landscape associated with commercial spyware;

▪ recommendations on regulatory, enforcement, and other opportunities to combat the proliferation and misuse of commercial spyware tailored to countries’ specific political and legal systems;

▪ creating spaces for collaboration, regional government presentations and discussions.

• Follow-on activities post workshops including (but not limited to):

▪ Collecting, analyzing, and sharing qualitative and quantitative data regarding the workshops and their impact.

▪ Building an Alumni network that provides a platform for continued collaboration, engagement, and sharing successes. Maintaining connections built at the conference through creating a list and distributing summaries of the event to all participants to enable continued collaboration regional governments.

Performance Indicators

In addition to project-specific indicators to monitor key milestones and progress to keep the project on track, implementers will report against relevant indicators within the performance management plan CDP established under the auspices of the Digital Connectivity and

Cybersecurity Program (DCCP). DCCP indicators for this project will include:

• Indicator DCCP 1.8 Number of USG supported fora held to convene key stakeholders for technical assistance or to discuss telecom/ICT or digital issues or best practices.

• Indicator DCCP 2.6 Number of people (and their country of origin) receiving USG assistance to participate in multilateral fora.

Upon final award, CDP and the selected partner will meet to discuss a final set of DCCP standard indicators as well as project-specific indicators.

Sustainability

As commercial spyware continues to proliferate it is important for countries around the world to implement policies that curb the proliferation and misuse of these tools. Increasing awareness, engagement, regulation, and policy development now will help positively shape the future of this industry. Such actions will help reduce the risk of rampant commercial spyware misuse. The United States, as a key technological partner, can help support the development of these regulations and policy options and expand the coalition of states committed to countering the proliferation and misuse of this technology.

https://gbc-word-edit.officeapps.live.com/mcasapi/McasPoliciesEndPoint/v2?policy=NativeApps&redir=0&McasSrc=bookmark%3A%2F%2FDCCP18&McasId=e52872cf-2d70-4447-b2ce-7f0edf85693c&McasHash=e6cbcd3f36c9a641b699ac0a227582450e920ce5ef3b20f3c842629d3e89f682

A4. Key Considerations The following list of program considerations is provided to help applicant(s) develop a responsive, robust proposal. Strong preference will be given to applicant(s) that:

• Demonstrate administrative and technical capacity and experience in administering successful and similar projects with a global participant base.

• Demonstrate thoughtful project design to address the key objectives and activities for the target audiences described in the NOFO.

• Demonstrate thoughtful monitoring and evaluation and report results.

• Prove existing, collaborative, and successful partnerships with U.S. and foreign partners on issues and engagements related to cybersecurity and digital policy.

• Demonstrate adherence to ethical best practices including “do no harm” and gender equity.

All applicants will also be required to address the entirety of Section A.3 within this NOFO in their completion of the Draft Scope of Work attached to this NOFO (see Section D.2.1, item #5).

Section B: Federal Award Information Organizations may submit one application per organization in response to this NOFO. If more than one application is submitted by an organization, only the first application received will be reviewed for eligibility and funding.

The U.S. government reserves the right to: (a) reject any or all applications, (b) accept other than the lowest cost application, (c) accept more than one application, and (d) waive irregularities in applications received.

The U.S. government may make award(s) based on initial applications received, without discussions or negotiations. Therefore, each initial application should contain the applicant's best terms from a cost and technical standpoint. The U.S. government reserves the right (though it is under no obligation to do so), to enter discussions with one or more applicants in order to obtain clarifications, additional detail, or to suggest refinements in the project description, budget, or other aspects of an application.

CDP anticipates awarding a Cooperative Agreement. The final determination on award mechanism will be made by the Grants Officer.

The authority for this funding opportunity is found in the Foreign Assistance Act of 1961 (FAA), as amended. Several funding restrictions apply, to include country restrictions. Project funding is provided via the Department of State, Foreign Operations and Related Programs

Appropriations Act, 2023 (Div. K. P.L. 117-328) (FY23 SOFAA).

To maximize the impact and sustainability of the award(s) that result(s) from this NOFO, CDP reserves the right to execute a non-competitive continuation amendment(s). The total duration of any award, including potential non-competitive continuation amendments, shall not exceed

54 months, or four and a half years. Any non-competitive continuation is contingent on availability of funds, and satisfactory performance of the program. A non-competitive continuation is not guaranteed, and the Department of State reserves the right to exercise or not exercise this option.

Section C: Eligibility Information

C1. Eligible Applicants CDP welcomes applications from public/State controlled institutions of higher education; U.S.-based non-profit organizations subject to section 501(c)(3) and 501(c)(6) status of the U.S. tax code; private institutions of higher educations; individuals; for-profit organizations; small businesses; non-U.S. entities; and other (specify).

Applications submitted by for-profit entities may be subject to additional review following the

Merit Review Panel selection process. Additionally, the Department of State prohibits profit to for-profit or commercial organizations under its assistance awards. Profit is defined as any amount in excess of allowable direct and indirect costs. The allowability of costs incurred by commercial organizations is determined in accordance with the provisions of the Federal

Acquisition Regulation (FAR) at 48 CFR 30, Cost Accounting Standards Administration, and 48

CFR 31 Contract Cost Principles and Procedures.

Please see 2 CFR 200.307 for regulations regarding program income.

C2. Cost Sharing or Matching Providing cost sharing, matching, or cost participation is not an eligibility factor or requirement for this NOFO and providing cost share will not result in a more favorable competitive ranking.

Per 2 CFR §200.306, items that are proposed for cost share must be allowable per 2 CFR §200, Subpart E—Costs Principles.

C3. Other To be eligible to receive an award, all organizations must have a unique entity identifier (UEI), as well as a valid registration on SAM.gov. Please see Section D3.2 for information on how to obtain these registrations.

Applicants must be organizations, and only one application will be considered for each applicant organization. If more than one application is submitted by the same organization, only the first received will be reviewed for eligibility and funding.

Applicants must have existing, or the capacity to develop, active partnerships local in-country partners, entities, and relevant stakeholders and have demonstrable experience in administering successful and preferably similar projects.

Please note, any applicant listed on the Excluded Parties List System in the System for Award

Management (SAM.gov) and/or has a current debt to the U.S. government is not eligible to apply for an assistance award in accordance with the OMB guidelines at 2 CFR 180 that implement Executive Orders 12549 (3 CFR,1986 Comp., p. 189) and 12689 (3 CFR,1989 Comp.,

p. 235), “Debarment and Suspension.” Additionally, no entity or person listed on the Excluded https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=http%3A%2F%2Fwww.SAM.gov.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fsam.gov.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fsam.gov.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11

Parties List System in SAM.gov can participate in any activities under an award. All applicants are strongly encouraged to review the Excluded Parties List System in SAM.gov to ensure that no ineligible entity or person is included in their application.

Section D: Application and Submission Information

D1. Address to Request Application Package Application forms, and other required materials are available at Grants.gov

(http://www.grants.gov) and SAMS Domestic (https://mygrants.servicenowservices.com) under the announcement title “Building International Capacity to Counter the Proliferation and

Misuse of Commercial Spyware,” and funding opportunity number “DFOP0016689”. Once the

NOFO deadline has passed, the Department of State may not discuss this competition with any applicant until the proposal review process has been completed. If requesting reasonable accommodations for persons with disabilities or for security reasons, please contact the CDP point of contact listed in Section G. Please note that reasonable accommodations do not include deadline extensions.

D2. Content and Form of Application Submission For all application documents, please ensure:

• The proposal clearly addresses the goals and objectives of this funding opportunity

• All documents are in English (original documents that are in another language must be accompanied by an English translation)

• All budgets are in U.S. dollars

• For documents subject to page limitations, all pages are numbered

• All documents are formatted to 8 ½ x 11 paper and,

• All Microsoft Word documents are single-spaced, 12-point Calibri font, with a minimum of 1-inch margins

• Captions and footnotes may be 10-point Calibri font

Any prospective applicant who has questions concerning the contents of this NOFO should submit them by email to the contacts listed in Section G. Any updates about this NOFO will also be posted on Grants.gov.

D2.1 Application Requirements Complete applications must include the following:

1. Completed and signed SF-424, SF-424A, as well as SF-424B, if applicable.

2. Organizations that engage in lobbying the U.S. government, including Congress, or pay for another entity to lobby on their behalf, are also required to complete the SF-LLL

“Disclosure of Lobbying Activities” form.

3. Cover Page and Executive Summary (not to exceed three [3] pages, preferably as a

Word Document). Includes the organization name, project title, target country or countries, and name and contact information for the application’s main point of contact https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=http%3A%2F%2Fwww.grants.gov.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fmygrants.servicenowservices.com.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=http%3A%2F%2Fwww.Grants.gov.mcas.ms.%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 and brief section that clearly outlines the (1) the problem statement addressed by the project (2) research-based evidence justifying the applicant’s approach, and (3) quantifiable project outcomes and impacts.

4. Proposal Narrative (not to exceed seven [7] pages, preferably as a Word Document).

The Proposal Narrative must include the following:

• Introduction to the Organization: Description of past and present operations, showing ability to carry out the project, including information on all relevant or similar type projects from previous grants from the Bureau and/or U.S.

government agencies.

• Problem Statement: Clear, concise, and well-supported statement that summarizes the problem and how the applicant’s unique project/approach will address it and support CDP’s Strategic Goals and Objectives.

• Project Goal: The goal describes the larger outcomes intended.

• Statement of Capabilities and Experience: Clear, concise, and well-supported statement that fully describes the applicant’s unique project/approach will address both objectives and support CDP’s Strategic Goals and Objectives.

Applicant should describe past experience with Federal contracting and logistics management, industry knowledge and contacts.

• Future Funding or Sustainability: Applicant’s plan for continuing the project beyond the grant period, or the availability of other resources, if applicable.

Include ways project activities will ensure sustainability.

• Risk Analysis: Internal and external risks associated with the proposed project, rate the likelihood of the risks, rate the potential impact of the risks on the project, and identify actions that could help mitigate the risks.

Please note the seven-page limit Proposal Narrative does not include the following:

• SF-forms listed above

• Cover Page and Executive Summary

• Scope of Work

• Project Design and Logic Model

• Project Performance Monitoring and Evaluation Plan

• Detailed Budget

• Budget Narrative – If the Budget includes subawards, please include a separate Budget Narrative for each organization.

• Timeline

• Key Personnel Summary, CVs or Resumes (per person)

• Contingency Plan

• Additional Required Attachments (Audit, NICRA, etc.)

• Optional Sections (if applicable, see page 15)

5. Scope of Work (SOW). Applicants should use the Tab 1 Building International Capacity to Counter the Proliferation and Misuse of Commercial Spyware Scope of Work

Template provided and attached to this NOFO. The SOW should provide a summary of the applicant’s unique approach to the following as indicated in Section 4) Proposal

Narrative:

• Project Goal

• Project Objectives

• Project Activities

• Project Indicators: Applicants should also identify key indicators and milestones to measure progress towards program goals and project objectives. Methods for collecting and monitoring project indicators should be described and those responsible for doing so identified.

• Sustainability

6. Project Logic Model (preferably as a Word Document). Building out a logic model with an accompanying theory of change can be helpful when planning and designing a program, project or activity. These tools can be used to visually depict or outline how and why a project will work—i.e., the rationale behind your project approach. Detailing how a project’s planned activities lead to certain outcomes can often help applicants understand the assumptions within the approach. Detailing factors outside your control, such as policy shifts, within a logic model can identify areas that should be included within your project’s risk analysis. It details planned activities, the immediate services or product of project activities (outputs), and the expected changes or benefits that occur after activities have been implemented (outcomes). Applicants should specify objectives, identify what resources (inputs) are needed, outline proposed activities

(outputs) and beneficiaries, and illustrate how activities lead to desired results in the theory of change. Applicants are encouraged to use the attached Tab 2 Building

International Capacity to Counter the Proliferation and Misuse of Commercial Spyware

Project Logic Model Template but are welcome to use their own templates so long as they provide the requisite information for thorough review of the proposed project.

7. Draft Project Performance Monitoring and Evaluation Plan (preferably as a Word

Document). This document details how a project’s performance monitoring and evaluation system will be carried out and by whom. It:

• Explains how the project’s performance toward its objectives will be tracked over time.

• Identifies which performance indicators the project will report against, the indicator type, baseline values, performance targets, and data sources or collection methods.

• Provides a clear description of the approach and data collection strategies and tools to be employed (e.g., pre- and post-test surveys, interviews, focus groups).

• Identifies what, if any, external evaluations will be conducted.

A sample Tab 3 Building International Capacity to Counter the Proliferation and Misuse of Commercial Spyware Project Performance Monitoring and Evaluation Plan Template is provided as an attachment to this NOFO. Applicants are encouraged to refer to the

Defining M&E Terms in the Project Logic Model template for concise explanations of

M&E terms and definitions used by the Department of State. The final will be due 45 days post-award

8. Detailed Budget (Excel workbook strongly preferred; please do not provide as a PDF).

Include three (3) columns containing the request to CDP, any cost sharing contribution, and the total budget. A Summary Budget should also be included using the OMB-approved budget categories (see SF-424A as a sample) in a separate tab. Costs must be in U.S. Dollars. Detailed line-item budgets for sub-grantees should be included as additional tabs within the Excel workbook (if available at the time of submission). Please see the attached Tab 4 Building International Capacity to Counter the Proliferation and

Misuse of Commercial Spyware Project Detailed Budget.

9. Budget Narrative (preferably as a Word Document). Justify each line-item in the budget and explain how the amounts were derived, consistency with the applicants’ documented policies, as well as the source and description of all proposed costs (and cost-share, if applicable). The narrative should complement the budget rather than repeat information provided in the budget. For example, the narrative should provide details on the purpose of costs, reasonability of costs, cost price analysis, explain allocations, explain any yearly variances, and tie expenses to project activities and/or objectives where appropriate. Sources of all cost-share offered in the application should be identified and explained in the budget narrative. Tab 4 Building International

Capacity to Counter the Proliferation and Misuse of Commercial Spyware Project

Budget Narrative Template.

10. Timeline (not to exceed one [1] page per year of proposed performance period, preferably as a Word Document or Excel Sheet). The timeline of the overall proposal should include activities, and monitoring and evaluation efforts outlined in either a monthly or quarterly format. It should also include sufficient time for project closeout to conduct and finalize internal/external evaluations and allow any sub-recipients time for final reporting.

11. Summary of Key Personnel and Subject Matter Experts (not to exceed two [2] pages, preferably as a Word Document). This can represent staff within your organization or outside of your organization (subgrantee, consultants, contractors), who are integral to the success of the project. Provides names, titles, roles, and bios that highlight relevant experience/qualifications of key personnel involved in the project.

12. Contingency Plan (not to exceed three (3) pages) for proposed activities should the originally planned activities not be able to be implemented. Applicants should demonstrate consideration of the risks identified in the submitted risk assessment and include specific alternative activities or locations as part of the Contingency Plan. Any proposed “plan” must comply with 2CFR200.433 – Contingency provisions. Plans must not include un-allocable or unallowable expenses and must not result in a larger Total

Award Value than the identified as the “competition ceiling.” CDP/SPC requires prior approval by the Grants Officer of the “plan” before any activities can take place, or costs can be incurred against the “plan.”

13. Additional Required Attachments:

• Audit An audit or an explanation for the lack of an audit is required. Please review the bulleted items below carefully.

• If your organization meets the threshold as defined in 2 CFR 200 Subpart F, then your organization must submit a pdf of its most recent single audit.

• If your organization does not currently meet the 2 CFR 200 requirement and has not had a single audit within its most recent three fiscal years, then your organization must submit its most recent (within the preceding three fiscal years) independent financial audit, preferably a pdf.

• If your organization has not been independently audited within its three most recent fiscal years, then it must explain the reason for the lack of an audit and provide an independent confirmation of the adequacy of its internal controls.

• NICRA If your organization has a Negotiated Indirect Cost Rate Agreement (NICRA) and includes NICRA charges in the budget, your latest NICRA letter should be included as a PDF file. This document will not be reviewed by the Merit Review Panel but will be used by project and grant team if the submission is recommended for funding. Organizations that have previously established indirect cost rates must submit timely indirect cost proposals to their cognizant agency as required by

Appendix III & IV of 2 CFR 200. If indirect cost proposals have not been submitted for re-negotiation, as required, out-of-date NICRAs may not be considered. If your proposal involves subawards to organizations charging indirect costs, please submit their NICRA, if applicable.

• Letters of support or official permission letters from project partners describing the roles and responsibilities of each partner, for any partner or partners identified in the proposal whose role is central to the project achieving its objectives. No letter of support is required for goods or services that are widely available commercially unless an identified provider is offering no-cost or uniquely favorable terms that will not be available commercially.

Applications that do not include the elements listed above will be deemed technically ineligible. To ensure that all applications receive a balanced evaluation, the review panel will review from the first page of each section up to the page limit and no further.

• Gender and Inclusion Analysis (not to exceed two (2) pages, preferably as a Word

Document) that provides a concise analysis of relevant gender norms, equity and equality for underserved communities and marginalized populations, power relations, and conflict dynamics in target countries. Potential domains of analysis include institutional practices and barriers, cultural norms, gender roles, access to and control over assets and resources, and patterns of decision-making. Applicants should briefly explain how they have integrated findings from their analysis into project design and/or other proposal documents, including a plan for regularly reviewing and updating the gender and inclusion analysis with local partners/beneficiaries, and making any necessary adjustments to project implementation.

D.2.2 Additional Information Requested for Those Receiving Conditional Notification

Letter Successful applicants must submit, after Conditional Notification Letter, but prior to issuance of a federal award:

• Written responses and revised application documents addressing conditions and recommendations from the review panel.

• A copy of the applicant’s latest NICRA as a PDF file, if the applicant has a NICRA and includes NICRA charges in the budget.

• A completed copy of the Department’s Financial Management Survey, if receiving

USG funding for the first time.

• Submission of required documents to register in the Payment Management System managed by the Department of Health and Human Services, if receiving CDP funding for the first time (unless an exemption is provided).

• Other requested information or documents included in the Conditional Notification

Letter or subsequent communications prior to issuance of a federal award.

• Applicants who submit their applications through Grants.gov will be required to create a SAMS Domestic account in order to accept the final award. Accounts must be logged into to every 60 days in order to maintain an active account.

D3. Unique Entity Identifier (UEI) and System for Award Management (SAM) All organizations, whether based in the United States or in another country, must have a

Unique Entity Identifier (UEI) and an active registration with SAM.gov. A UEI is one of the data elements mandated by Public Law 109-282, the Federal Funding Accountability and

Transparency Act (FFATA), for all federal awards.

The 2 CFR 200 requires that sub-grantees obtain a UEI number. Please note the UEI for sub-grantees is not required at the time of application but will be required before an award is processed and/or directed to a sub-grantee.

Note: The process of obtaining or renewing a SAM.gov registration may take anywhere from

4-8 weeks. Please begin your registration as early as possible and advise proposed sub-grantees to do so as well.

• Organizations based in the United States or that pay employees within the United

States will need an Employer Identification Number (EIN) from the Internal Revenue

Service (IRS) and a UEI number issued through SAM.gov. Once the UEI number is received continue with the remainder of the SAM.gov registration.

• Organizations based outside of the United States that do not pay employees within the United States do not need an EIN from the IRS but do need a UEI number – obtained by registering as an entity in SAM.gov.

Organizations based outside of the United States and that DO NOT plan to do business with the DoD should follow the below instructions:

Step 1: Proceed to SAM.gov to obtain a UEI and complete the SAM.gov registration process.

SAM.gov registration must be renewed annually.

All prime organizations must also continue to maintain active SAM.gov registration with current information at all times during which they have an active federal award or application under consideration by a federal award agency. SAM.gov requires all entities to renew their registration once a year in order to maintain an active registration status in SAM. It is the responsibility of the applicant to ensure it has an active registration in SAM.gov and to maintain that active registration. If an applicant has not fully complied with the requirements at the time of application, the applicant may be deemed technically ineligible to receive an award and use that determination as a basis for making an award to another applicant.

Note: SAM.gov is not the same as SAMS Domestic. It is free to register in both systems, but the registration processes are different.

Information is included on the SAM.gov website to help international registrations:

https://www.fsd.gov/gsafsd_sp?id=kb_article_view&sysparm_article=KB0016380&sys_kb_id=1

94695221bfe4d983565ed3ce54bcbbb&spa=1

Please note, guidance on SAM.gov and the guidance on GSA’s website about requirement for registering in SAM.gov is subject to change at any time. Applicants should review the website frequently for the most up-to-date guidance.

Organizations based outside of the United States and that DO plan to do business with the

DoD in addition to Department of State should follow the below instructions:

Step 1: Apply for an NCAGE code by following the instructions on the NSPA NATO website linked below:

NCAGE Homepage:

https://eportal.nspa.nato.int/AC135Public/sc/CageList.aspx

NCAGE Code Request Tool (NCRT):

https://eportal.nspa.nato.int/Codification/CageTool/home

D3.1 SAM.gov and UEI Exemptions An exemption from the UEI and sam.gov registration requirements may be permitted on a case-by-case basis if:

• An applicant’s identity must be protected due to potential endangerment of their mission, their organization’s status, their employees, or individuals being served by the applicant.

• For an applicant, if the federal awarding agency makes a determination that there are exigent circumstances that prohibit the applicant from receiving a unique entity identifier and completing SAM.gov registration prior to receiving a federal award. In these instances, federal awarding agencies must require the recipient to obtain a unique https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.fsd.gov.mcas.ms%2Fgsafsd_sp%3Fid%3Dkb_article_view%26sysparm_article%3DKB0016380%26sys_kb_id%3D194695221bfe4d983565ed3ce54bcbbb%26spa%3D1%26McasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.fsd.gov.mcas.ms%2Fgsafsd_sp%3Fid%3Dkb_article_view%26sysparm_article%3DKB0016380%26sys_kb_id%3D194695221bfe4d983565ed3ce54bcbbb%26spa%3D1%26McasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fusg02.safelinks.protection.office365.us.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Feportal.nspa.nato.int%252FAC135Public%252Fscage%252FCageList.aspx%26data%3D05%257C01%257Carichardson%2540guidehousefederal.com%257C78cee3cc704f48fee1b508db0f6cc096%257C8a628aaf2f064dc5a00733a134d5e988%257C1%257C0%257C638120733344255669%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3DRzF60kwplVm%252BMPTs3Bu8PTNOnfBZmHdcN063KiLE1y8%253D%26reserved%3D0%26McasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://eportal.nspa.nato.int/Codification/CageTool/home entity identifier and complete SAM.gov registration within 30 days of the federal award date.

Organizations requesting exemption from UEI or SAM.gov requirements must email the point of contact listed in Section G of the NOFO at least two weeks prior to the deadline in the NOFO providing a justification of their request. Approval for a SAM.gov exemption must come from the warranted Grants Officer before the application can be deemed eligible for review.

D3.2 Registering in SAMS Domestic and Grants.gov All application submissions must be made electronically via Grants.gov or SAMS Domestic

(https://mygrants.servicenowservices.com/ilms/). Both systems require registration by the applying organization. Please note that the Grants.gov registration process can take ten (10) business days or longer, even if all registration steps are completed in a timely manner.

Instructions for registering and submitting applications in each system are provided below.

SAMS Domestic:

Applicants using SAMS Domestic for the first time should complete their “New Organization

Registration.” To register with SAMS Domestic, go to:

https://mygrants.servicenowservices.com and click “create an account”.

Please note that establishing an account in SAMS Domestic may require the use of smartphone for multi-factor authentication (MFA). If an applicant does not have accessibility to a smartphone during the time of creating an account, please contact the helpdesk and request instructions on MFA for Windows PC.

Organizations must remember to save a screen shot of the checklist showing all documents submitted in case any document fails to upload successfully.

SAMS Domestic Help Desk:

For assistance with SAMS Domestic accounts and technical issues related to the system, please contact the ILMS help desk by phone at +1 (888) 313-4567 (toll charges apply for international callers) or through the Self Service online portal that can be accessed from https://afsitsm.service-now.com/ilms/home. Customer support is available 24/7.

Grants.gov:

Applicants who do not submit applications via SAMS Domestic may submit via Grants.gov.

Please be advised that completing all the necessary registration steps for obtaining a username and password from Grants.gov can take ten (10) business days or longer.

Please refer to the Grants.gov website for definitions of various “application statuses” and the difference between a submission receipt and a submission validation. Applicants will receive a validation e-mail from Grants.gov upon the successful submission of an application. Validation of an electronic submission via Grants.gov can take up to two business days. Additionally, organizations must remember to save a screenshot of the checklist showing all documents submitted in case any document fails to upload successfully.

https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fguidehouse.sharepoint.us.mcas.ms%2Fsites%2FEBDCCPSupport%2FShared%2520Documents%2FGeneral%2F06.%2520Guides%2520%26%2520Tools%2520for%2520EB%2520%26%2520Implementers%2FAward%2520Management%2520Toolkit%2FGrants%2520%26%2520Co-Ags%2F02%2520CDP%2520Grants%2520SOP%2FTools%2520and%2520Templates%2FPhase%25201%2520Pre-Award%2FGrants.gov%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fmygrants.servicenowservices.com.mcas.ms%2Films%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fmygrants.service-now.com.mcas.ms%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fafsitsm.service-now.com.mcas.ms%2Films%2Fhome%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11 https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.grants.gov.mcas.ms%2F%3FMcasTsid%3D20892&McasCSRF=9b5cb826be098bf166781c47404229b4de16d54d7f026fac64ae43e76a3c4c11

Grants.gov Helpdesk:

For assistance with Grants.gov, please call the Contact Center at +1 (800) 518-4726 or email support@grants.gov. The Contact Center is available 24 hours a day, seven days a week, except federal holidays. A full list of federal holidays can be found here.

D4. Submission Dates and Times Applications are due no later than 11:59 PM EST/EDT on 29 July 2024 on Grants.gov (https://www.grants.gov/), or SAMS Domestic (https://mygrants.servicenowservices.com), under the announcement title “Building International Capacity to Counter the Proliferation and Misuse of Commercial Spyware,” and funding opportunity number DFOP0016689.

Grants.gov and SAMS Domestic automatically log the date and time an application submission is made, and the Department of State will use this information to determine whether an application has been submitted on time. Late applications are neither reviewed nor considered. Known system errors caused by Grants.gov or SAMS Domestic

(https://mygrants.service-now.com) that are outside of the applicant’s control will be reviewed on a case-by-case basis. Applicants should not expect a notification upon CDP receiving their application.

D5. Funding Limitations, Restrictions, and other Considerations CDP will not consider applications that reflect any type of support for any member, affiliate, or representative of a designated terrorist organization. Please refer the link for Foreign Terrorist

Organizations: https://www.state.gov/foreign-terrorist-organizations/

Project activities whose direct beneficiaries are foreign militaries or paramilitary groups, or individuals will not be considered for CDP funding given purpose limitations on funding.

The Leahy Law prohibits Department foreign assistance funds from supporting foreign security force…