NOFO - Fina 6.28.24-Final.pdf

U.S. Small Business Administration Office of Entrepreneurial Development

Funding Opportunity No.OED-2024-001

Page | 1

CYBERSECURITY FOR SMALL BUSINESS

PILOT PROGRAM

FUNDING OPPORTUNITY

FY 2024

FUNDING OPPORTUNITY NO.

OED-2024-001

The purpose of this Funding Opportunity is to invite proposals for funding from state government entities

(within US). For-profit businesses are not eligible for this award. The following states are ineligible to apply for this award: Ohio, Colorado, Hawaii, Indiana, Virginia, and Wyoming.

Opening Date for Proposals: July 2, 2024

Closing Date for Proposals: August 2, 2024

Proposals responding to this program Funding Opportunity notice must be posted to www.grants.gov by 11:59 PM Eastern Time (ET) on August 2, 2024. No other methods of submission will be permitted.

Proposals submitted after the stipulated deadline will be rejected without being evaluated. GrantSolutions is the official grant system used for this award.

http://www.granssolution.gov/

Page | 2

TABLE OF CONTENTS

Section I. Funding Opportunity Description 3

Program Overview

Background

Purpose

SBA Involvement and Oversight

Changes or Cancellation

Section II. Award Information 6

Expected Number of Awards

Period of Performance/Budget Period

Funding Information

Funding Instrument

Match Requirement

Section III. Eligibility 7

General

Eligible Applicants

Ineligible Applicants

Section IV. Application and Submission Information 8

Application Instructions

Submission Instructions

Required Proposal Submission Date

Section V. Application Review Information 16

General

Evaluation Criteria

Review and Selection Process

Section VI. Award Administration Information 19

Award Notification

Administrative and National Policy Requirements

Reporting

Record Keeping Requirements

Section VII. Agency Contacts 20

Program Point of Contact

Financial/Grants Management Point of Contact

Section VIII. Other Information 21

Definitions, Guidelines, and Checklist

Page | 3

Section I – Funding Opportunity Description

1.0 Program Overview

1.1.1. Federal Agency Name U. S. Small Business Administration, Office of Entrepreneurial Development

1.1.2. Funding Opportunity

Title

Cybersecurity for Small Business Pilot Program

1.1.3. Announcement Type Initial

1.1.4. Funding Opportunity

Number:

Funding Opportunity No. OED-2024-001

1.1.5. CFDA Number 59.079

1.1.6. Closing Date for

Submissions:

August 2, 2024,11:59 P.M. Eastern Time

1.1.7. Authority: 15 USC 648 and Pub. L. No. 118-47

1.1.8. Duration of Authority: Permanent

Page | 4

1.1.9. Funding Instrument: Grant

1.1.10. Funding: Funding is for a twenty-four-month period.

1.1.11. Award

Amount/Funding Range:

The amount of Cybersecurity for Small Business Pilot Program funding in FY2024 is $3,136,265 subject to the availability of funds.

Applicants can apply for awards ranging from $1,000,000 (minimum) to $1,045,421 (maximum) for the period of performance.

1.1.12. Project Duration: Awards will be made for a period of 24 months.

1.1.13. Project Starting Date: Within 30 calendar days of the start date of the Project Period.

1.1.14. Proposal Evaluation: An initial screening for eligibility (in accordance with Section 3) will be conducted by the program office. Proposals will be reviewed for sufficiency and quality as detailed in Sections 4 and 5. SBA may ask Applicant for clarification of technical proposal and cost aspects of proposals.

1.1.15. Agency Programmatic

Point of Contact:

Philip T. Gibson, U.S. Small Business Administration Headquarters

Interested parties may submit questions to the Office of Entrepreneurship Education (OEE) email inbox (oee@SBA.gov) during the Q&A open period (July 2, 2024, through July 15, 2024). SBA will post answers to the questions on Grants.gov by July 17, 2024.

No additional questions will be collected after July 15, 2024.

Page | 5

Introduction

In 2023, FBI’s Internet Crime Complaint Center (IC3) received a record number of complaints from the American public: 880,418 complaints were registered, with potential losses exceeding $12.5 billion. This is a nearly 10% increase in complaints received, and it represents a 22% increase in losses suffered, compared to 2022. Small businesses are attractive targets because they have information that cybercriminals want, and they typically lack the security infrastructure of larger businesses.

Surveys have shown that many small business owners feel their businesses are vulnerable to a cyberattack. Yet many businesses cannot afford professional IT solutions, have limited time to devote to cybersecurity, or do not know where to begin.

The Consolidated Appropriations Acts, 2022, 2023 and 2024, authorized the U.S. Small Business Administration to make grants to States, and the equivalent thereof, to carry out projects that help new small business concerns with tools to combat cybersecurity threats during their formative and most vulnerable years.

Background

Since its inception in 1953, SBA has served to aid, counsel, assist and protect the interests of small businesses. While

SBA is best known for its financial support of small businesses through its many lending programs, the Agency also plays a critical role in providing funding to organizations that deliver technical assistance in the form of mentoring and training to small business concerns and nascent entrepreneurs to promote growth, expansion, innovation, increased productivity, and management improvement. The mission of SBA’s Office of Entrepreneurial

Development, which bears responsibility for administering and overseeing the Cybersecurity for Small Business Pilot

Program, is to provide assistance to the small business community by linking the resources of Federal, state, and local governments with the resources of the educational community and the private sector.

Purpose

Eligible applicants are comprised of state governments that seek to provide training, counseling, remediation, and other tailored cybersecurity services for emerging small firms in multiple industries. Grantees will be awarded up to

$1,045,421 million to assist small businesses.

Leveraging of Resources

Applicants selected for awards under this Funding Opportunity announcement are encouraged to maximize their efforts to leverage SBA funding by working in conjunction with SBA District Offices and other Federal, state, local and tribal government small business development programs and activities; SBA resource partners such as Small

Business Development Centers (SBDCs), SCORE, Women’s Business Centers (WBCs), Veterans Business Outreach

Centers (VBOCs), 7(j) Technical Assistance providers, Small Business Investment Companies (SBICs), U.S. Export

Assistance Centers (USEACs), Certified Development Companies (CDCs) and SBA lenders; universities, colleges, and other institutions of higher education; and private organizations such as chambers of commerce and trade and industry groups and associations.

Page | 6

SBA Involvement and Oversight

The Cybersecurity for Small Business Pilot Program is managed by the Office of Entrepreneurial Development

(OED) at SBA Headquarters. The SBA will administer, monitor, and oversee the grant. OED shall assign a Grants

Management Officer (GMO) to review the budget and all fiscal documentation for compliance with applicable

Federal and program requirements and issue the Notice of Award. A Program Manager within OED will serve as the

Grants Officer Technical Representative (GOTR) responsible for overall monitoring and oversight of the Recipient’s award, including compliance with the terms and conditions of the Grant and program service delivery and performance.

Changes or Cancellation

SBA reserves the right to amend or cancel this Funding Opportunity, in whole or in part, at the Agency’s discretion.

Should SBA make material changes to this Funding Opportunity, the Agency will extend the closing date as necessary to afford Applicants sufficient opportunity to address such changes.

Section II – Award Information

Estimated Funding

SBA expects to issue one or more awards based on the funds appropriated. The Federal budget for the Cybersecurity for Small Business Program for program 2024-2025 is $3,136,265.

Subject to the availability of funds and compliance with the terms and conditions of the Grant, SBA has the discretion to increase the award to an amount consistent with the authorized funding level under federal appropriations law.

Expected Number of Awards

SBA expects to award up to three awards with no single award exceeding $1,045,421. Individual award amounts are anticipated in the range of $ $1,000,000 to $1,045,421.

Period of Performance/Budget Periods

The period of performance for this award is two years (24-months).

Project Start Dates

The projected start date is September 30, 2024, or 30 days after notification of award for states responding to Funding Opportunity No. OED 2024-001.

Funding Information

Funds provided under the Cybersecurity for Small Business Pilot Program must be used solely for the purposes stipulated in this Funding Opportunity and the Notice of Award and may not be commingled with any other monies. All costs proposed in an Applicant’s budget must be allowable, allocable, and reasonable as set forth in the applicable Office of Management and Budget (OMB) cost principles. Indirect costs will be based on the Applicant’s cognizant Agency indirect cost rate agreement or the 10% de minimis rate.

Page | 7

Funding Instrument

The funding instrument is a grant.

Matching Requirement

Awards made under this Announcement will require no contribution of non-Federal matching funds.

No program income is approved for this award.

Section III – Eligibility Information

Eligible Applicants

To be eligible for this Funding Opportunity an Applicant must be a “State,”. For the purpose of this announcement a “state” includes, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, the

Commonwealth of Northern Mariana Islands, and American Samoa. Therefore, only States that meet this definition are eligible to apply for and administer an award under this Notice of Funding Opportunity. For purposes of this

Notice of Funding Opportunity, the term “eligible non-Federal entity” means a State agency designated by the State

Governor, or equivalent thereof (e.g., Mayor of the District of Columbia), as the sole Applicant and lead entity for conducting the State’s cybersecurity education and/or resolution services. The following states are ineligible to apply for this award: Ohio, Colorado, Hawaii, Indiana, Virginia, and Wyoming.

i. Only those proposals accompanied by the written designation of the State Governor, or his/her designee, may apply for evaluation and funding consideration.

ii. Should the Governor, or equivalent thereof, assign to a designee the signatory responsibility for the designation letter, the designation letter must include an acknowledgement that the Governor, or his/her equivalent, has authorized the designee to sign the letter on his/her behalf.

iii. For insular areas, the equivalent of a State Governor is the appropriate signatory.

Ineligible Applicants

The following will automatically be considered ineligible, and their applications will be rejected without being evaluated.

i. Applicants that are not a state would be considered ineligible to apply for this grant.

ii.Any State agency that has not been officially designated by a State Governor as the sole Applicant and lead entity for conducting the State’s cybersecurity education and/or remediation services (See Section - Eligible non-Federal entity, above.);

iii.Any State agency that owes an outstanding and unresolved financial obligation to the Federal government;

iv. Any State agency that is currently suspended, debarred, or otherwise prohibited from receiving awards of contracts, grants, or cooperative agreements from the Federal government;

v. Any State agency with an outstanding and unresolved material deficiency reported under the requirements of 2

CFR Part 200, Subpart F within the past three years;

Page | 8 vi.Any State agency that has had a grant or cooperative agreement involuntarily terminated or non-renewed by SBA for cause within the past one year;

vii. Any State agency that proposes to serve as a pass-through and permits another organization to manage the day-to-day operations of the project; and/or;

viii. Any State agency that was convicted or had an officer or agent acting on its behalf convicted, of a felony criminal violation under any Federal law within the past two years.

Section IV – Application and Submission Information

Application Instructions

General

i. A State may submit only one proposal in response to this Notice of Funding Opportunity.

ii. Any additional applications from a State will automatically be rejected without being evaluated. (Only the latest application successfully submitted by an eligible non-Federal entity to www.grants.gov will be screened for potential evaluation for an award.)

iii. States must round all monetary values to the nearest whole dollar in all budgetary and financial application document submissions.

iv. Multiple states/territories are allowed to apply jointly if each is eligible under the requirements of the Notice of

Funding Opportunity.

Under such circumstances, the application should identify each eligible entity within the submitted application, including designation by each applicable Governor, the roles and budget applicable to each eligible entity covered by the application, the lead Applicant which is submitting the application, and detailed agreement on overall project management including performance reporting.

All applications successfully submitted to SBA via www.grants.gov will undergo a screening process, consisting of a review for Applicant eligibility and application completeness. Applications will be rejected without further evaluation if they are submitted by ineligible entities, or they are non-responsive to the requirements of this Notice of Funding

Opportunity.

The following documents must be completed as part of the electronic application form in www.grants.gov:

1) SF-424, Application Federal Assistance,

2) SF-424A, Budget Information, All documents must be submitted as separate attachments in GrantSolutions. Documents cannot be bundled together.

Instructions for file naming conventions:

Please include the following attachments separately using the exact name and standard order outlined below. The

Application elements as described below should be named with the Attachment number [#], Applicant’s State abbreviation (do not spell out state name), and name of document (identified in the left-hand side of chart below).

Do not add the word “attachment” in the file name.

http://www.grants.gov/ http://www.grants.gov/

Page | 9

For example: [1] [State abbreviation] Cover Letter. Applications must upload the following elements as attachments in GrantSolutions.

REQUIRED APPLICATION ELEMENTS

The following Financial Assistance General Certifications and Representations are located within the System for

Award Management (SAM.gov) and do not need to be submitted with this application:

• Lobbying Disclosure Act of 1995, 2 U.S.C. 1601 et seq.

• Financial Management Certification – 2 CFR 200.302 & 2 CFR 200.303

• Debarment and Suspension – 2 CFR Part 180

• Drug-Free Workplace – 41 U.S.C. 8103

• Tax Compliance – Section 543 of PL 112-55

• Conflict of Interest – 2 CFR 200.112

Cover Letter (Maximum 1 page)

[1] Cover Letter - (Signed) PDF format.

The first element of the application must be a cover letter containing a summary of each non-Federal entity’s key proposed cybersecurity activities. Submit the Cover Letter electronically in .PDF format. The cover letter is not counted in the 12-page requirement and must be one page and include the following information:

i. Non-Federal entity’s name and address (which must match the Governor’s Letter of designation);

ii. Non-Federal entity’s website address;

iii. Non-Federal entity’s cybersecurity webpage if one already exists;

iv. Name, telephone number, fax number, and email address of the non-Federal entity’s designated point of contact (the Authorized Organizational Representative);

v. Dollar amount of Federal assistance being requested;

vi. A one paragraph summary (110-125 words) of the proposed cybersecurity activities supporting the proposed milestone goals. Use the following language to start this requirement:

“The (fill in State name) will use Cybersecurity for Small Business Pilot Program award funds to support cybersecurity for eligible small business concerns to include (insert the proposed activities)”.

Technical Proposal (Maximum 12 pages)

[2] [State abbreviation] Technical Proposal-Word format

To expedite the proposal review process, Applicants must submit their Technical Proposal referenced in application instructions Appendix. The proposal elements must be in the same order as the evaluation criteria in Section 5.2 of the Notice of Funding Opportunity. The proposal may not exceed 12 pages (excluding title page and cover page) and must be double-spaced on 8 ½ x 11- inch paper (electronic document format). Times New Roman in 12-point font is required. Only the first 12 pages will be reviewed and evaluated. An Applicant will not be notified and consulted if

Page | 10 additional pages are eliminated and not reviewed.

States are strongly encouraged to prepare focused proposals including, performance measures and metrics that support activities that can realistically be achieved within the 24-months performance period.

i. Introduction: Start the Technical Proposal with an ‘Introduction’ section on page one (not on the title page) that summarizes in no more than one (1) paragraph, your organization’s requested Federal and Non-Federal award amount, targeted number of eligible small business concerns, brief description of proposed statutory activities that will be achieved with Cybersecurity for Small Business Pilot Program funds in the 24-months performance period, the total expected cybersecurity clients served/trained, and anticipated number of cyber threats/attacks addressed or averted.

ii. Cybersecurity Experience: In an estimated one (1) page, provide the organizational capability to achieve success in the past and/or present to educate, prepare and serve small business concerns on critical cybersecurity matters.

iii. Project Design: Within about 10 pages, labeled with the main heading ‘Project Design’, this section should demonstrate how the State can credibly and significantly leverage partnerships to identify, reach, and serve new small business concerns on critical cybersecurity matters. Please include the expected or proposed organizational structure such as an organizational chart to convey internal structure for the grant project.

Describe the data collection methods your organization uses to track outputs and outcomes associated with existing Cybersecurity programs. This section must address all components as described in Section 5:

a. Performance Measures, Metrics & Outcomes;

b. Direct Benefit to Small Business Communities and Clients; and

c. Collaboration.

iv. Data Collection & Measurement of Outcomes - In an estimated 2 pages, labeled ‘Data Collection and

Measurement of Outcomes’, this section must address the required data collection elements (include metrics) identified in Section 5; and the quality of Applicant’s ability to quantitatively measure progress on proposed outcomes. Cybersecurity for Small Business Pilot Program outcomes may include, but are not limited to, number of small business clients served, number of cybersecurity cases resolved, client satisfaction measurements, and potential or realized cost-savings of cybersecurity resolution/avoidance/mitigation to small business client(s).

Proposed Plan: Performance Outputs & Outcomes

[3] [State abbreviation] Proposed Plan - Excel format

Non-Federal entities States will be responsible for preparing a Proposed Plan including, Performance Outputs and

Outcomes in an MS Excel spreadsheet.

The Proposed Plan serves as the data blueprint to measure the extent to which the Cybersecurity for Small Business

Pilot Program grant recipient achieves program activities and the results (outcomes) of those measures. If awarded a grant, the grant recipient will be assigned a Cybersecurity for Small Business Pilot Program manager who is responsible for reviewing and approving your plan. Grant recipients will be required to report performance measures achieved, activities completed, and measurable results on a quarterly basis for the full two-year award period. SBA will collect, analyze, and utilize this data to evaluate the program’s overall success. Client data will be confidential and used by SBA only if permission is given by a representative of the eligible small business concern.

Page | 11

Budget

Each Applicant must provide budget information according to the specific instructions for each item. Submit budget information documents separately, in the following order, with the file name labeled as follows:

Standard Form (SF) 424, Application for Federal Assistance

[4] [State abbreviation] SF 424 - Online and PDF format SF 424

Application for Federal Assistance. This standardized form requires basic information about your organization. The

Cybersecurity for Small Business Pilot Program Project Director must be listed in block 8f on the SF 424, not a grant writer or any other contact person, since this is where SBA obtains the contact information to generate the Notice of

Award for acceptance of the grant. Pertinent information regarding this announcement and all programmatic matters will also need to be provided to the Cybersecurity for Small Business Pilot Program Project Director listed in block

8f.

SF-424A, Budget Information (Non-Construction Programs)

[5] [State abbreviation] SF 424A - Online and PDF format

This form requires an estimate of the Applicant's total cost of executing Cybersecurity for Small Business Pilot

Program activities described in the technical proposal.

a. For Section A, fill in columns (a) with ‘Cybersecurity for Small Business Pilot Program’, (b) with 59.079, and appropriate total amounts in (e), (f), and (g);

Attachments A-9 through A-12 (Budget Detail Worksheets)

[6] [State abbreviation] A9 - A12- PDF format

a. A State Cybersecurity for Small Business Pilot Program Project Director must devote at least 50% of his/her time, to the Cybersecurity for Small Business Pilot Program project.

b. On the A-9, identify all personnel who will be funded by Federal amount or who will support the Cybersecurity for Small Business Pilot Program project without project funding (follow the sample shown on the A-9

‘Supplementary Instructions’ for personnel calculations; do not include the A-9 instruction page in the application package);

c. All subtotals and totals on the A-9 through A-12 must match all dollar amounts reflected on SF-424A; and, Budget Narrative

[7] [State abbreviation] Budget Narrative - PDF format

a. Provide a detailed explanation of the components of each budget cost category listed on the SF-424A; Section B.

b. Explain how each cost component directly benefits cybersecurity awareness/education and small business client success.

c. Indicate which cost category (item and dollar amount) comprises the proposed Non-activity related Federal

Expense that was entered in the yellow highlighted section at the bottom row (P 21) in the Proposed Plan.

Page | 12

Commitment letter(s)

[8] [State abbreviation] Commitment Letter - PDF format

CERTIFICATION FORMS AND ASSURANCES

Submit certification and assurances forms separately in the following order, with the file name labeled as follows

(Note: Where applicable, if the Applicant has submitted these certifications and assurances via www.SAM.gov over the past 12 months, the Applicant can rely on those forms instead of submitting new versions. Applicable forms are marked below.):

Cost Policy Statement

[9] [State abbreviation] Cost Policy Statement - (Signed) PDF format.

The Cost Policy Statement must describe State’s general accounting policies and a description of their cost allocation methodology (how each type of proposed cost is allocated: direct and indirect. This policy must be signed by the

Chief Financial Officer (or equivalent thereof, holding analogous responsibilities, and having analogous expertise).

Designation Letter

[10] [State abbreviation] Governor Designation Letter - (Signed) PDF format.

Governor’s letter, or equivalent thereof (e.g., Mayor of the District of Columbia), designating the Applicant as the

State’s sole Applicant and lead entity for conducting the State’s cybersecurity activities.

Letter to be send electronically to:

Mr. Philip T. Gibson, Office of Entrepreneurship Education

Email: oee@sba.gov

For insular areas, the Governor, or equivalent must state that the Applicant is an agency or instrumentality of the area to receive potential funding award. See Section 3.1.

ORGANIZATIONAL MANAGEMENT

Each Applicant must provide budget information according to the specific instructions for each item. Submit organizational management documents separately in the following order, with the file name labeled as follows:

Key Personnel Résumés and Position Descriptions

[11] [State abbreviation] Key Personnel Resumes and Position Descriptions - PDF format

Résumés and position descriptions for ALL key personnel (including vacant positions) supporting the

Cybersecurity for Small Business Pilot Program project.

a. Résumé of Cybersecurity for Small Business Pilot Program Project Director should reflect knowledge and experience with both administering a Federal award and executing the proposed cybersecurity activities.

b. Other résumés must reflect experience and education relevant to the proposed Cybersecurity for Small Business http://www.grants.gov/applicants/get_registered.jsp mailto:oee@sba.gov

Page | 13

Pilot Program project.

Résumés may not be more than two pages in length. Each resume will be reviewed and evaluated. An Applicant will not be notified and consulted if additional pages are eliminated and not reviewed.

All applicants must submit a proposed Organizational Chart for the program.

Lists of Contractual and Consulting Agreements

[12] [State abbreviation] List of Contractual and Consulting- PDF format

Provide two separate lists of Contracts and Agreements as follows:

1. List of Contractual and Consulting Agreements - List of all extant or anticipated contractual and consulting agreements that directly support the Applicant’s proposed cybersecurity activities which must include:

a. Contract provider name or TBD if contractor is anticipated;

b. Manner in which the provider was or will be selected (i.e., competitively, or sole source);

c. Summary of support provided;

d. Actual or estimated contract cost to support the proposed Cybersecurity for Small Business Pilot Program activities;

e. Identity of the employee or official of the Applicant organization who will be responsible for overseeing the agreements; and

f. Description of oversight process.

States may follow their own procurement policies and procedures when contracting with Project Funds but must comply with the requirements of 2 C.F.R. §§ 200.317-200.326.: Additionally, when using Project Funds to procure supplies and/or equipment, Applicant is encouraged to purchase American-manufactured goods to the maximum extent practicable. American-manufactured goods are those products for which the cost of component parts that were mined, produced, or manufactured in the United States exceeds 50 percent of the total cost of all components.

For further guidance regarding what constitutes an American-manufactured good (also known as a domestic end product), see 48 C.F.R. Part 25.

The following additional rules apply to contracts involving $20,000 or less:

a. You do not need to submit copies of the proposed contracts to the Grants Officer Technical Representative (GOTR) for approval before executing them.

b. The contracts are not required to be awarded via competition if your organization considers prices to be reasonable.

The following additional rules apply to contracts involving between $20,001 and $249,999 in Project Funds:

a. You must obtain price quotes (either orally or in writing) from at least three qualified sources and inform SBA of these quotes in the corresponding payment requests/financial reports.

Page | 14

b. You must obtain prior approval from the SBA prior to executing contract greater than $20,000.

c. If you do not choose to go with the lowest price quote, you must explain why.

The following additional rules apply to contracts involving more than $250,000 in Project Funds:

a. You must submit copies of the proposed contracts to the GOTR for approval before executing the contract.

The contracts must be awarded via competition. Non-competitive contracting at this level is only allowed if you can demonstrate to SBA’s satisfaction either: (i) there is only one possible source for a particular good or service or (ii) there is an emergency involving the risk of imminent damage to property or injury to people.

2. List of contracts that the State proposes to charge against the project as a direct cost that will be outside the indirect cost rate agreement (e.g., a facilities lease).

a. Contract provider/lessor name.

b. Summary of support provided.

c. Actual or estimated contract cost.

If a State does not propose any contract support for this award, include this attachment marked “N/A.”

FINANCIAL MANAGEMENT

Each Applicant must provide financial management information according to the specific instructions for each item. Submit financial management documents separately in the following order, with the file name labeled as follows:

Single Audit Report

[13] [State abbreviation] Audit Report - PDF format

Attach the most recent Single Audit Report. If the State is not subject to the requirements of the Single Audit Act, it must instead submit a copy of its most recently audited financial statement and the CPA opinion of this audit (e.g., unqualified, qualified, adverse, etc.)

Note: if the State’s Single Audit or most recent financial statement audit is large, provide a blank page with website link and instruction on where to locate the audit.

Indirect Cost Rate Agreement (ICRA) or Extension Letter (if applicable)

[14] [State abbreviation] ICRA - PDF format

For States that include indirect costs, provide a current, executed Indirect Cost Rate Agreement from the cognizant

Federal agency or a letter from the State’s cognizant Federal agency approving an extension of a previous indirect cost rate for a period that covers the period of performance for this award. If the State does not propose such charges for this award, include this attachment marked “N/A.”

SUBMISSION INSTRUCTIONS

This section provides the application submission and receipt instructions for applications submitted for this

Announcement. Please read the following instructions carefully and completely.

Page | 15

1. Electronic Delivery

SBA is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. Applicants must submit their applications online through Grants.gov.

2. How to Register to Apply through Grants.gov

All technical proposals, including attachments, must be submitted electronically via the government-wide financial assistance portal www.grants.gov. NO OTHER FORMS OF SUBMISSION WILL BE ACCEPTED. All required forms are provided in the Grants.gov application package for this funding opportunity. Specific instructions for obtaining, completing, and applying via Grants.gov, including animated tutorials, may be found at http://www.grants.gov/web/grants/applicants.html.

To apply via Grants.gov, your organization must first:

• Have a UEI number (Unique Entity Identifier);

• Be registered with the System for Award Management (SAM) at SAM.gov | Home; and

• Have a Grants.gov username and password.

The process for meeting these three pre-submission requirements may take several weeks to complete. Additionally, Applicants may have to download or upgrade software to utilize Grants.gov.

Therefore, Applicants without these required identification items should begin the process immediately.

Applicants that experience unexpected delays or are otherwise unable to obtain these items risk having their applications automatically rejected. Rejected applications do not reach SBA and cannot be considered.

Information about the Grants.gov registration process can be found at http://www.grants.gov/applicants/get_registered.jsp. Applicants must register as organizations, not as individuals.

Organizations already registered with Grants.gov do not need to re-register. However, all registered organizations must keep their SAM registration up to date.

As part of the Grants.gov registration process, an Applicant must designate one or more Authorized Organizational

Representatives (AORs). AORs are the only individuals who may submit applications to Grants.gov on behalf of an organization. If an application is submitted by anyone other than a designated AOR, it will be rejected by Grants.gov and cannot be considered for funding.

Once an application is submitted, it undergoes a validation process through which it will either be accepted or rejected by the Grants.gov system. The validation process may take up to 48 hours or more to complete. Applicants should save and print written proof of an electronic submission made at Grants.gov.

Applicants can expect to receive multiple emails regarding the status of their submission.

The first email will confirm receipt of the application. The second email will indicate whether the application has been successfully validated by the system and assigned an SBA tracking number or has been rejected due to errors.

An Applicant will receive a third email once SBA has downloaded its application from Grants.gov for review.

If Grants.gov notifies an Applicant that its application contains an error, the Applicant must correct the noted error(s) before the system will accept and validate the application. Applicants that submit on or close to the closing date may not receive email notification of an error with their applications until after the submission deadline, and http://www.sam.gov/ http://www.grants.gov/web/grants/applicants.html https://sam.gov/content/home

Page | 16 thus will not have an opportunity to correct and resubmit their applications. APPLICATIONS THAT ARE

REJECTED BY GRANTS.GOV WILL NOT BE FORWARDED TO SBA AND CANNOT BE

CONSIDERED FOR FUNDING. It is the Applicant’s responsibility to verify that its submission was received and validated successfully at Grants.gov. To check on the status of your application and see the date and time it was received, log on to Grants.gov and click on the “Track My Application” link from the left-hand menu.

If you experience a technical difficulty with Grants.gov (i.e., system problems or glitches with the operation of the

Grants.gov website itself) that you believe threatens your ability to submit your application, please (i) print any error message received; and (ii) call the Grants.gov Contact Center at 1- 800-518-4726 for immediate assistance. Ensure that you obtain a case number regarding your communications with Grants.gov. NOTE: Problems with an

Applicant’s own computer system or equipment are not considered technical difficulties with Grants.gov. Similarly, an Applicant’s failure to: (i) obtain a Unique Entity Identifier (UEI) number or complete the SAM or Grants.gov registration process; (ii) ensure that an AOR submits the application; or (iii) take note of and act upon an email from

Grants.gov rejecting its application due to errors, are not considered technical difficulties. A Grants.gov technical difficulty is an issue occurring in connection with the operations of Grants.gov itself, such as the temporary loss of service by Grants.gov due to an unexpected volume of traffic or failure of information technology systems, both of which are rare occurrences.

Applicants should use the following link to obtain assistance in navigating Grants.gov and accessing a list of useful resources How to Apply for Grants | Grants.gov If you have a question that is not addressed under the “Applicant

FAQs” or “Applicant User Guide,” contact Grants.gov via email at support@grants.gov or telephone at 1-800-518-

4726. The Grants.gov Contact Center is open 24 hours a day, seven days a week.

3. Required Proposal Submission Date

Each Applicant is required to submit its proposal electronically via www.grants.gov no later than 11:59

P.M. Eastern Time on August 2, 2024. Because of the conditions for submitting applications via Grants.gov and the potential for encountering technical difficulties in using that site, Applicants are strongly encouraged to log on to the Grants.gov and review the submission instructions early. DO NOT WAIT UNTIL THE CLOSING DATE

TO BEGIN THE SUBMISSION PROCESS. Applicants bear sole responsibility for ensuring their proposals are submitted and received before the closing date.

SBA will consider the date and time stamp on the validation generated by Grants.gov as the official submission time.

A proposal that is not received by Grants.gov before the closing date of this Announcement will be rejected without being evaluated, unless the Applicant can clearly demonstrate through documentation obtained from Grants.gov that it attempted to submit its proposal in a timely manner but was unable to do so solely because of grants.gov systems issues. Additionally, SBA will not accept any changes, additions, revisions, or deletions to applications made after the closing date.

Applicants should save and print written proof of an electronic submission made at Grants.gov. If problems occur while using Grants.gov, the Applicant is advised to (i) print any error message received; and (ii) contact Grants.gov for immediate assistance. Applicants may obtain advice and assistance with Grants.gov submission process by visiting

Support | Grants.govl or calling 1-800-518-4726.

Section V. Application Review Information

General

The entire application package, comprised of the Technical Proposal (using required template format), and all https://www.grants.gov/applicants/grant-applications/how-to-apply-for-grants http://www.cdfifund.gov/pages/opportunity-mailto:OEE@sba.gov https://www.grants.gov/support https://www.grants.gov/support

Page | 17 additional attachments, will be evaluated on its comprehensiveness, completeness, and overall quality.

All applications successfully submitted to SBA via grants.gov will undergo a screening process, consisting of a review for eligibility and application completeness. Applications will be rejected without further evaluation if they are submitted by ineligible entities, or they are non-responsive to the requirements of this Notice of Funding

Opportunity.

In addition, an Applicant must disclose in its application if it currently holds any other financial assistance awards from SBA or has any other applications for SBA financial assistance awards still pending. If it does, the Applicant must identify how it will avoid duplication of efforts, commingling of funds, and overlapping or double claiming of costs among those projects. Applicants must treat each SBA project as separate and discrete with individual outcomes and deliverables and provide each application and award with its own reporting, accounting, and audit trails.

Failure to sufficiently distinguish between multiple applications from the same organization, or between an application and one or more current SBA awards, may result in rejection of an application on the ground that it is duplicative of proposed or existing efforts.

Review and Selection Process

Applications that are not rejected by grants.gov or SBA’s screening process will be evaluated by teams of reviewers and scored based on how well they meet the criteria outlined above. These reviewers may be SBA employees or employees of other Federal agencies. Prior to evaluating applications received in response to this Notice of Funding

Opportunity, SBA will establish a minimum acceptable score. Only those applications that meet or exceed that threshold will be eligible for funding. Therefore, Applicants are encouraged to design proposals that address each of the scoring criteria listed above as thoroughly as possible.

At SBA’s discretion, it may select qualified Applicants not funded under this Notice of Funding Opportunity for awards in the future using subsequent fiscal year resources, subject to continuing program authority, and the availability of funds.

Evaluation (100 points total)

Technical Proposal - States will be evaluated based on their Technical Proposal and accompanying Proposed Plan

(Excel spreadsheet). The project design should be very clear, concise, and focused (based on a careful assessment of top priorities, key cybersecurity industries and markets) on the State. It must address credible and impactful outcomes pertaining to the program’s objectives which are: to increase the number of small businesses educated/trained on cybersecurity threats, protections, resources/tools, and prevention strategies; services to small businesses facing cybersecurity vulnerabilities; and resolution of cybersecurity incidences.

i. Cybersecurity Experience (up to 25 points)– States will be evaluated according to their organizational capability to achieve success with client education, awareness, satisfaction, and direct services.

ii. Performance Measures & Outcomes (up to 25 points) –States will be evaluated on their capability and experience with developing credible and impactful performance measures and outcomes that are commensurate with statutory requirements.

iii. Direct Benefit to Small Businesses (up to 25 points) – The proposal must demonstrate the

State’s capacity to recruit, prepare and assist new small business concerns. The proposal must include a plan to increase the number of Small Business from Small Business Communities assisted (e.g., recruiting, preparing, and

Page | 18 assisting Small Businesses and Small Business Communities to participate in cybersecurity activities).

iv. Collaboration (up to 25 points) - States are expected to establish and leverage collaborative partnerships with relevant organizations to accomplish the proposed performance measures and supporting cybersecurity activities.

Based on information contained in the Technical Proposal, States will be evaluated on how well they will collaborate on proposed cybersecurity activities with each of their identified partners, drawn from the following entities:

a. SBA’s District Offices and resource partners such as Small Business Development Centers (SBDC), SCORE, Women’s Business Centers, Veterans Business Outreach Centers, Small Business Investment Companies, Certified

Development Companies, SBA lenders, and other SBA award recipients;

b. Institutions of higher education (colleges & universities), trade and vocational schools; and

c. Private organizations, such as Chambers of Commerce, trade and industry groups, and associations.

v. Financial Assistance Plan-State Financial Assistance Plans should address criteria and policies for the following elements. This Plan must conform to the Cybersecurity for Small Business Pilot Program parameters as described below. States may not build in discretion to use Cybersecurity for Small Business Pilot Program funds for other purposes not approved by SBA.

a. Application Process: State application process for eligible small business concerns seeking Cybersecurity for Small

Business Pilot Program assistance including the following:

b. Criteria and selection process to become a Cybersecurity for Small Business Pilot Program client.

vi. Internal Controls: The State financial management structure and systems – a clearly defined and documented internal control process that will ensure compliance related to the timely and reasonable expenditure of Federal funds.

a. A specific response time (such as, 30-45 days) for issuing financial assistance awards to Cybersecurity for Small

Business Pilot Program clients, processing payments, and submitting reimbursement request to expend and report

Cybersecurity for Small Business Pilot Program funds in a timely manner must be outlined.

b. The State’s process for ensuring that Cybersecurity for Small Business Pilot Program funding is spread out to allow a multiplicity of small business participation and encouraging support to new Cybersecurity for Small Business Pilot

Program clients.

States are strongly encouraged to develop requirements for ‘building the pipeline’ so that companies can complete any formalized programs or client service periods within a reasonable duration.

vii. Data Collection and Measurement of Outcomes-Based on information contained in the Technical Proposal and their client Data Collection Instrument (DCI), States will be evaluated on whether their Data Collection

Methodology is credible and includes the following critical elements necessary to obtain the sufficient cybersecurity sales data from small businesses. DCI elements:

a. Cybersecurity for Small Business Pilot Program Client’s level of cybersecurity experience (“market expansion” or

“new-to-cybersecurity”);

b. Number and profiles of small business clients served;

c. Cyber threats and incidences trained on, blocked/avoided, serviced, and/or resolved; and

d. Client satisfaction with services offered client/host interactions, applicability, and quality of training/services.

Page | 19

Section VI. Award Administration Information

6.1. Award Notification

All States selected for an award and States not selected for an award will receive written notification. There will be no debriefing process for unsuccessful States. If you are selected for an award, you will be given instructions on how to register with GrantSolutions to access and sign the award.

6.2 Administrative and National Policy Requirements

All successful States will be required to comply with the requirements set forth in 2 C.F.R. Part 200 and Single Audit

(as applicable); and the terms and conditions set forth in their Notices of Award.

The State must permit personnel from SBA’s Office of Inspector General (OIG), other SBA personnel involved in the examination and oversight of Cybersecurity for Small Business Pilot Program recipients, and/or their designated agents, unrestricted access to review and make copies of all products, materials, and data, including those prepared or stored electronically.

In addition, SBA may from time to time advise States of awards made under this announcement of new legal requirements and/or policy initiatives with which they must agree to comply.

6.3 Cybersecurity for Small Business Pilot Program Financial Requirements

Non-Federal entity proposals are not permitted to include costs associated with any of the following items or activities:

i. Transactions with suspended or debarred entities, as discussed in Part VIII (9.3) below;

ii. Construction or renovation of facilities or acquisition of real estate;

iii. Litigation, whether civil, criminal, or administrative;

iv. Providing matching contributions to any other Federal awards;

v. Meals, lodging, per diem, or other subsistence expenses associated with local travel (however, Project Funds may be used to pay transportation expenses for local travel). Local travel is any travel conducted entirely within a 50-mile radius of Your organization’s address of record;

vi.Travel by elected officials;

vii. Costs associated with printing materials; and

viii. National and regional association dues or travel to association events.

The underlying premise of the Cybersecurity for Small Business Pilot Program is to supplement the State with funds for cybersecurity activities, not to substitute Federal funds for costs States would normally or otherwise cover.

Per 2 C.F.R. Section 200.408, use of Federal funds for the Cybersecurity for Small Business Pilot Program is limited to the Cybersecurity for Small Business Pilot Program statutory uses of funds.

Page | 20

6.4 Reporting Requirements

All States are required to submit the reports identified below. SBA may withhold payment if reports are not received or are deemed inadequate. Failure to report in a timely manner will also be weighed against future applications for award funding from the same organization and the exercise of the option period. The reports, or portions thereof, provided by the State may be made public. In addition, SBA reserves the right to require States to post these reports on their web sites.

Financial Reports

States will be required to submit quarterly financial reports to SBA using the form SF- 425, Federal Financial Report

(FFR) and SF-270 within 30 days of the completion of each of the first three quarters and within 120 days of the completion of the fourth and final quarter of the period of performance. Non- Federal entities are encouraged to submit final quarter reports prior to the end of the allowed 120 days.

Progress Reports

States will be required to submit quarterly progress reports to SBA using the Grant Progress Report within 30 days of the completion of each of the first three quarters and within 120 days of the completion of the fourth (final) quarter of the performance period.

Summary of Participation Measurements: The State should submit along with its progress reports a summary of activities that highlights program accomplishments including total number of small businesses supported, services provided, customer satisfaction metrics, best practices, and how the Cybersecurity for Small Business Pilot Program funds assisted small businesses address cybersecurity threats. SBA will provide guidance and revise reporting requirements for the performance period, as needed, to better track progress and actual results.

Report Submission

Reports must be submitted electronically through GrantSolutions to the assigned GOTR and/or uploaded to the grant management system designated by SBA.

Section VII. Agency Contacts

7.1 Cybersecurity for Small Business Pilot Program Point of Contact

Questions concerning general information contained in this Notice of Funding Opportunity should be directed to oee@sba.gov.