NOFO - National Cyber Security Awareness Program Final_5-19-21.pdf

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

CISA Cyber Security Awareness Campaign

NOTE: If you are going to apply for this funding opportunity and have not obtained a Data Universal Numbering System (DUNS) number and/or are not currently registered in the System for Award Management (SAM), please take immediate action to obtain a DUNS Number, if applicable, and then to register immediately in SAM. It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information. Information on obtaining a DUNS number and registering in SAM is available from Grants.gov at:

http://www.grants.gov/web/grants/register.html. Detailed information regarding DUNS and SAM is also provided in Section D of this NOFO.

A. Program Description

1. Issued By U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA)

2. Assistance Listings (formerly Catalog of Federal Domestic Assistance (CFDA) Number) 97.128

3. Assistance Listings Title (formerly CFDA Title) National Cyber Security Awareness

4. Funding Opportunity Title CISA Cyber Security Awareness Campaign

5. Funding Opportunity Number

DHS-21-CISA-128-CSA001

6. Authorizing Authority for Program

Section 102(b)(2) of the Homeland Security Act of 2002, as amended (6 U.S.C. § 112(b)(2)).

7. Appropriation Authority for Program Department of Homeland Security Appropriation Act, 2021 (Public Law 116-260), Title III, Protection, Preparedness, Response, and Recovery, Cybersecurity and Infrastructure Security Agency, Operations and Support.

8. Announcement Type

Initial

9. Program Overview, Objectives, and Priorities

The Cybersecurity and Infrastructure Security Agency (CISA) serves as the Nation’s risk advisor to build the national capacity to defend against cyber-attacks, coordinate security and resilience efforts across the public and private sectors, and identify and address the most significant risks to the national critical functions provided by our Nation’s critical infrastructure.

In accordance with the 2020-2024 DHS Strategic Plan (found at https://www.dhs.gov/publication/department-homeland-securitys-strategic-plan-fiscal-years-2020-2024), CISA supports the following DHS guiding principles:

Championing “Relentless Resilience” for All Threats and Hazards: DHS will remain resolute against today’s threats and hazards by keeping pace with our adversaries and preparing for those of tomorrow by identifying and confronting systemic risk, ensuring the Nation’s citizens remain resilient, building redundancy and resilience into community lifelines, and raising the baseline of our security across the board—and across the world.

Promote Citizen Engagement and Strengthen and Expand Trusted Partnerships:

Homeland security is a whole-of-society endeavor, from every federal department and agency to every American across this Nation. We will work together and empower partners to leverage national capacity and capabilities, improve training exercises, and develop contingency plans that make America safe, secure, and resilient against all threats and all hazards.

This grant specifically supports the following DHS Strategic Plan Goals:

3.1: Secure federal civilian networks 3.2: Strengthen the security and resilience of critical infrastructure 3.3: Assess and counter evolving cybersecurity risks.

5.1: Build a National culture of preparedness 5.3: Support outcome-driven community recovery

Accordingly, coordination and collaboration with appropriate private sector and non-profit organizations, as well as federal, state, and local government entities, is necessary to facilitate a comprehensive cybersecurity awareness campaign program. This awareness campaign program intends to execute a research-driven strategy focused on implementing specific programs, activities, materials and outreach efforts, building on its cybersecurity awareness campaign to include activities and initiatives associated with Cybersecurity Awareness Month in October.

A comprehensive nationwide cybersecurity awareness campaign will:

Educate at-risk segments of the public about the dangers of cyber threats and key actions that can be taken to mitigate risks;

Identify effective approaches to increase cybersecurity awareness among the general public and specific target audiences;

Build relationships and coalitions across cybersecurity stakeholders to support a broad national effort;

Execute means of measuring impact of campaign strategies on increasing public cybersecurity awareness, and

Serve to further the Administration’s National Security Strategic priority to build a culture of preparedness, informing and empowering communities and individuals to obtain the skills and take the preparatory actions necessary to become more resilient against the threats and hazards that Americans face.

Cyber threats can be just as detrimental to communities, infrastructure, businesses, and individuals as a natural disaster. With this in mind, the public’s understanding of cyber threats as well as opportunities Americans leverage to strengthen their own cybersecurity posture should seek to be improved.

The recipient will research, plan, execute and measure project or individual initiative-based activities as part of a holistic strategy to drive cybersecurity actions in the targeted audiences. This is a national-level effort. Viable applicants must ensure they address capabilities and approach to driving behavior change among national, wide-ranging audiences.

As part of this work, the recipient will be required to organize, execute, and reach audiences with in-person events across the country, web-based outreach and use multiple media channels (from traditional media to social media).

The recipient must address how it will coordinate and collaborate with stakeholder groups in creative ways (e.g., current and potential Campaign partners), which span industry, educational institutions, non-profits and federal, state, local, tribal, and territorial governments as well as international partners. This includes how the recipient will amplify, promote, and bolster DHS’s existing cybersecurity awareness work, partnerships, and relationships and enhance these efforts.

Strategy Development

Assess current and future cybersecurity awareness needs for the general public as well as for targeted segments based on susceptibility to cyber threats and receptivity to adopting cybersecurity practices.

Perform market research to determine target audiences’ interests, needs and barriers to adopting cybersecurity best practices to inform design and execution of program activities to most effectively address cybersecurity risk.

Develop an annual cybersecurity communications campaign that meets identified needs, addresses the highest risk areas, and is understandable and implementable to the American public, augmented with targeted messaging related to the greatest and most prevalent risks by segmented priority audiences (e.g., home Internet users; small/medium-sized businesses; the academic community including K-12 and higher education educators, administrators, and students).

Measure, analyze and report on the effectiveness of awareness efforts and associated outcomes, to include:

• Developing a methodology for measuring successful cybersecurity awareness activity reach and outcomes based on specified performance metrics aligned to overall program objectives.

• Establishing baselines for awareness and actions associated with cybersecurity practices

• Conducting research to measure awareness of and outcomes and behavior changes due to Campaign exposure/saturation in order to determine program effectiveness. Such research may include:

Identification of changes influenced by campaign promotion and specific events or tactics executed Analysis of broad shifts in public attitudes or policies, measured through independent studies, government surveys, or polls

• Capturing the number of hits on websites and relevant social media platforms

Communications Materials Production

Create visually engaging, action oriented and outcome driven cybersecurity awareness collateral that can be leveraged by diverse stakeholder groups and serve as a repository for cybersecurity awareness-related activities and collateral.

Develop and execute creative website content and additional communication mediums for dissemination and promotion of cybersecurity messaging.

Stakeholder Engagement and Outreach

Establish formal and informal partnerships with key cybersecurity stakeholder groups to reach target audiences and communities.

Assist in the development of a coordinated messaging effort with partners in industry, educational institutions, non-profits and federal, state, local, tribal, and territorial governments as well as international partners.

Engage government stakeholders at the Federal, state, local, tribal and territorial levels in strong coordination with DHS/CISA to enhance the program and promote participation.

Conduct outreach efforts on cybersecurity awareness through identification of;

creation of; and/or engagement in meetings, conferences, events, and initiatives.

Cross-promotion of Cybersecurity Resources

Utilize and incorporate DHS/CISA cybersecurity programs/resources where applicable and relevant.

Align awareness/outreach efforts to the CISA strategic plan for long-term success, and regularly refresh and update outreach with new and innovative ideas, content, and strategies to the Campaign.

Develop and maintain efforts to advance cybersecurity workforce development through cybersecurity awareness communications channels, to include promotion of cybersecurity career opportunities and information across diverse stakeholder groups.

Execute National Cybersecurity Awareness Month Activities

Design a strategy to engage national participation across partners to raise the visibility of cybersecurity during October, to include tailored activities for small/medium businesses, academia, and the general public.

Facilitate partnership across cybersecurity stakeholders to execute a comprehensive campaign across a wide range of audiences and communications channels.

Secure and conduct media engagement to promote cybersecurity awareness and available resources to increase cybersecurity actions among the general public and target segments.

Create, produce and disseminate campaign materials to include partner toolkits, web content, public service announcements, social media content, graphics and print materials supporting identified themes.

Plan and produce targeted events to promote the month in geographically diverse locations with a variety of themes and audience targets, including a “kick-off” event.

Program Management

Provide CISA with timely reports that accurately reflect the recipient’s progress toward agreed-upon awareness program goals as determined by CISA and the recipient throughout the period of performance.

Determine contingency plans for unexpected program changes.

10. Performance Measures

The recipient will show the impact CISA Cyber Security Awareness Campaign Grantee’s activities have on the advancement of DHS goals, through cumulative quarterly datasheet reporting of the following performance metrics:

3.1: Secure federal civilian networks o Number and list of Cybersecurity Awareness Campaign key messages offered related to Federal Civilian Networks cybersecurity activities.

o Types of Cybersecurity Awareness Campaign outreach engagements/instances targeted toward the Federal stakeholder audience o Number of Federal Departments reached through Cybersecurity Awareness

Campaign messaging o Actual or estimated number of Federal stakeholders reached through each type of outreach engagement/instance

3.2: Strengthen the security and resilience of critical infrastructure o Number and list of Cybersecurity Awareness Campaign key messages offered related to cybersecurity activities specific to critical infrastructure information technology systems and/or infrastructure control systems security o Types of Cyber Security Awareness Campaign outreach engagements/instances targeted toward the critical infrastructure security stakeholder community o Actual or estimated number and demographic of critical infrastructure security community stakeholder groups reached through each type of outreach engagement/instance sorted by Critical Infrastructure Sector, CISA Region, State, Local, Tribal, Territorial, Private Sector, and International affiliation

3.3: Assess and counter evolving cybersecurity risks.

o Number and list of Cybersecurity Awareness Campaign key messages offered related to cybersecurity assessing and countering cybersecurity risks o Types of Cyber Security Awareness Campaign outreach engagements/instances targeted toward assessing and countering cybersecurity risks o Actual or estimated number and demographic of community stakeholder groups reached through each type of outreach engagement/instance sorted by CISA Region, Federal State, Local, Tribal, Territorial, Private Sector, and International affiliation

5.1: Build a National culture of preparedness o Number and list of Cybersecurity Awareness Campaign key messages related to general public computer user cybersecurity preparedness activities o Types of Cybersecurity Awareness Campaign outreach engagements/instances targeted toward the general public computer user audience o Actual or estimated number of general public computer users reached through each type of outreach engagement/instance o Number and types of Cybersecurity Awareness Campaign measurement tools used to collect short and long-term effects of national understanding of individual roles in cybersecurity and changes in behavior toward enhanced cybersecurity among campaign participants.

o Actual number and demographic of community stakeholder groups/participants assessed through Campaign implementation of behavior change measurement tools, sorted by CISA Region, Federal, State, Local, Tribal, Territorial, Private Sector, and International affiliation.

o Actual number of responses received (per each measured category) from each behavior change measurement tool implemented through the Cybersecurity Awareness Campaign.

o Percentage increase in the total number of Americans and International users receiving overall cybersecurity awareness campaign messaging from previous campaign years.

5.3: Support outcome-driven community recovery o Number of Cybersecurity Awareness Campaign key messages offered related to specific community recovery activities following a cybersecurity incident o Types of Cybersecurity Awareness Campaign outreach engagements/instances targeted toward the cybersecurity community recovery audience o Actual or estimated number and demographic of community recovery stakeholders reached through each type of outreach engagement/instance, sorted by CISA Region, Federal, State, Local, Tribal, Territorial, Private Sector, and International affiliation.

o Number of new DHS partnerships formed through Cybersecurity Awareness Campaign activities.

B. Federal Award Information

1. Available Funding for the NOFO: $549,996.00

2. Projected number of Awards (Optional): One (1)

3. Period of Performance: 12 Months

Any period over 12 months is an “extension.” Extensions to the period of performance are allowable. Please refer to Section H. Additional Information – Extension, for more information regarding what steps recipients must follow and what information must be included in the justification for such request to be considered.

4. Projected Period of Performance Start Date(s): 08/1/2021

5. Projected Period of Performance End Date(s): 7/30/2022

6. Funding Instrument Type: Cooperative Agreement

Due to substantial involvement, the best way to support the broad public purpose of enhanced cybersecurity awareness is through a cooperative agreement.

DHS Program Office Substantial Involvement

1. CISA will direct and facilitate the applicant’s collaboration with CISA and DHS’s key cybersecurity awareness partners, including such collaboration associated with the development of consistent cybersecurity awareness messaging and related concepts. All communication with any office within DHS must be coordinated through the designated Program Officer.

2. CISA will facilitate the participation of DHS officials and subject matter experts in workshops, conferences, or other project-related events, including but not limited to National Cybersecurity Awareness Month events, as requested by the applicant. CISA will coordinate with the applicant as necessary on such participation.

3. CISA must review and approve project materials prior to dissemination for purposes of ensuring suitability and appropriateness of message, including:

a. Publications, brochures, presentation materials, products, documents, websites (or portions thereof), social media presence and activities, or other cybersecurity awareness collateral produced under this award announcement that is to be shared with the public. Forty-five (45) days prior to the publishing or releasing such material, the recipient must submit a complete draft to the DHS Program Officer for review, comment and approval.

b. Agendas for meetings, seminars, workshops and conferences. Sixty (60) days prior to the event, the recipient must submit draft agendas and handouts to the DHS Program Office for review and approval.

c. If the recipient receives an invitation to present related information at a conference that is not listed in the approved project or budget narrative justification, and the activity will further the objectives of the campaign, the recipient shall seek the designated Program Officer’s review and approval of its participation. The recipient shall notify the Program Officer and Grants Officer in writing within three (3) business days of the receipt of any such invitation. The notification, which may be transmitted by email, will consist of, at minimum:

i. The invitation, and

ii. A written justification explaining how participation in the conference furthers the mission of the project funded by this Award.

C. Eligibility Information

1. Eligible Applicants

Nonprofits with 501(c)(3) IRS status, other than institutions of higher education

Financial assistance will be awarded through a competitive process. Eligible applicants will include public or private non-profit organizations, dedicated to promoting cybersecurity-related awareness and safe behavior online through creative website content and additional communication mediums nationwide. CISA will not review applications that fail to meet the eligibility criteria.

2. Applicant Eligibility Criteria

1. Deadlines. DHS will not accept late applications. Without exception, applications must be received by Grants.gov on or before the deadline in this announcement or they will not be considered.

2. Application relevance. Applications that do not address the purpose of this announcement will not be considered.

3. Compliance and completeness. Applications must substantially comply with the application submission instructions and requirements in this announcement or they will not be considered.

4. Funding limits. Applications exceeding the funding limits will not be considered.

5. Proof of non-profit status. Non-profit applicants and any proposed subrecipient of a non-profit must provide documentation of non-profit and/or public status. This requirement does not apply to for-profit applicants. Any of the following constitutes acceptable proof of non-profit status:

• A reference to the applicant organization’s listing in the Internal Revenue Service’s

(IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

• A copy of a currently valid IRS tax exemption certificate.

• A statement from a State taxing body, State attorney general, or other appropriate

State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

• A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

• Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

• A signed statement on official letterhead by an official authorized to apply for grant funds on behalf of the non-profit and/or public entity shall suffice.

• In addition, DHS will not consider multiple applications from a single organization serving as the lead. If more than one application is submitted by a single organization as the lead, the later in time will be considered, unless the later application clearly indicates a unique role for that organization, other than as lead for this activity.

3. Other Eligibility Criteria

Non-Responsive Applications: An application will be deemed non-responsive and not considered for review if:

1. The budget request for the budget period exceeds the maximum of $549,996 (direct and indirect costs).

2. The Project Narrative exceeds 15 pages (Note: The page limit does not include any of the attachments or forms).

3. The Project Narrative does not include each of the specified headings in the order identified in Section D.

4. The Application does not include one or more of the required forms or documents listed under Section D. The required forms and documents are:

• Form SF-424 – Application for Federal Assistance

• Form SF-424A – Budget

• Form SF-424B – Assurances – Non-Construction Programs

• Certification Regarding Lobbying

• Budget Narrative and Table

• Project Abstract

• Project Narrative

• Project Plan

• Documentation of non-profit status

Applications rejected by Grants.gov for unregistered AOR will be disqualified and will not be considered for competition.

4. Cost Share or Match No cost share is required

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: 05/19/2021

b. Application Submission Deadline: 06/18/2021 at 11:59:59 PM [Time Zone]

c. Anticipated Funding Selection Date (Optional): No later than 07/14/2021

d. Anticipated Award Date (Optional): No later than 08/01/2021

e. Other Key Dates (If applicable)

Event Suggested Deadline for Completion Obtaining DUNS Number Four weeks before actual submission deadline Obtaining a valid EIN Four weeks before actual submission deadline Updating SAM registration Four weeks before actual submission deadline Starting application in Grants.gov One week before actual submission deadline

2. Agreeing to Terms and Conditions of the Award

By submitting an application, applicants agree to comply with the requirements of this NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package

Applications must be submitted in electronic format only. Application forms and instructions are available at Grants.gov.

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov. Select “Applicants” then “Apply for Grants.” In order to obtain the application package select “Download a Grant Application Package.”

Enter the Assistance Listing (formerly CFDA) and/or the funding opportunity number located on the cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

For a hardcopy of the full NOFO, please email a request to:

Stephanie Dawkins Grants Officer Office of Procurement Operations 245 Murray Lane, SW, Mail Stop 0115 Washington, D.C. 20528-0115 Stephanie.Dawkins@hq.dhs.gov Phone: 202-447-0495

In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice is 1-800-518-4726 (Grants.gov Help Desk).

Applications will be processed through the Grants.gov portal. If you experience difficulties accessing information or have any questions, please call Grants.gov customer support at 1-800-518-4726.

4. Steps Required to Submit an Application, Unique Entity Identifier, and System for Award Management (SAM)

To apply for an award under this program, all applicants must:

a. Apply for, update, or verify their Data Universal Numbering System (DUNS)

Number from Dun & Bradstreet (D&B) and Employer ID Number (EIN)

b. In the application, provide a valid Data Universal Numbering System DUNS number, which is currently the unique entity identifier;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before submitting the application;

e. Create a Grants.gov account;

f. Add a profile to a Grants.gov account;

g. Establish an Authorized Organizational Representative (AOR) in Grants.gov;

h. Submit (if applicable, add: an initial) application in Grants.gov;

i. (If applicable) Submit the final application in the Grants.gov system; and

j. Continue to maintain an active SAM registration with current information, including information on a recipient’s immediate and highest level owner and subsidiaries, as well on all predecessors that have been awarded a Federal contract or grant within the last 3 years, if applicable, at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency.

Applicants are advised that DHS may not make a federal award until the applicant has complied with all applicable DUNS and SAM requirements. Therefore, an applicant’s SAM registration must be active not only at the time of application, but also during the application review period and when DHS is ready to make a federal award. Further, as noted above, an applicant’s or recipient’s SAM registration must remain active for the duration of an active federal award. If an applicant’s SAM registration is expired at the time of application, expires during application review, or expires any other time before award, DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

The Standard Language for Using Grants.gov to Apply is provided to aid in fulfilling these requirements (if applicable), based off of https://www.grants.gov/web/grants/grantors/grantor-standard-language.html:

5. Electronic Delivery

DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages or requires applicants to submit their applications online through Grants.gov, depending on the funding opportunity. For this funding opportunity, DHS/CISA requires applicants to submit applications through Grants.gov.

6. How to Register to Apply through Grants.gov

a. Instructions: Registering in Grants.gov is a multi-step process. Read the instructions below about registering to apply for DHS funds. Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. Therefore, registration should be done in enough time to ensure it does not impact your ability to meet required application submission deadlines.

Organizations must have a Data Universal Numbering System (DUNS) Number, active System for Award Management (SAM) registration, and Grants.gov account to apply for grants. If individual applicants are eligible to apply for this grant funding opportunity, then you may begin with step 3, Create a Grants.gov account, listed below.

Creating a Grants.gov account can be completed online in minutes, but DUNS and SAM registrations may take several weeks. Therefore, an organization's registration should be done in sufficient time to ensure it does not impact the entity's ability to meet required application submission deadlines. Complete organization instructions can be found on Grants.gov here:

https://www.grants.gov/web/grants/applicants/organization-registration.html

1) Obtain a DUNS Number: All entities applying for funding, including renewal funding, must have a DUNS number from Dun & Bradstreet (D&B). Applicants must enter the DUNS number in the data entry field labeled "Organizational DUNS" on the SF-424 form.

For more detailed instructions for obtaining a DUNS number, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html

2) Register with SAM: All organizations applying online through Grants.gov must register with the System for Award Management (SAM). Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html

3) Create a Grants.gov Account: The next step is to register an account with Grants.gov. Follow the on-screen instructions or refer to the detailed instructions here: https://www.grants.gov/web/grants/applicants/registration.html

4) Add a Profile to a Grants.gov Account: A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, enter the DUNS Number for the organization in the DUNS field while adding a profile.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/add-profile.html

5) EBiz POC Authorized Profile Roles: After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the AOR role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html

6) Track Role Status: To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html

7) Electronic Signature: When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature. The EBiz POC must authorize people who are able to make legally binding commitments on behalf of the organization as a user with the AOR role; this step is often missed, and it is crucial for valid and timely submissions.

7. How to Submit an Application to DHS via Grants.gov

Grants.gov applicants can apply online using Workspace. Workspace is a shared, online environment where members of a grant team may simultaneously access and edit different webforms within an application. For each NOFO, you can create individual instances of a workspace.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html

a. Create a Workspace: Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

b. Complete a Workspace: Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission. The Workspace progress bar will display the state of your application process as you apply. As you apply using Workspace, you may click the blue question mark icon near the upper-right corner of each page to access context-sensitive help.

c. Adobe Reader: If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at:

https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

d. Mandatory Fields in Forms: In the forms, you will note fields marked with an asterisk and a different background color. These fields are mandatory fields that must be completed to successfully submit your application.

e. Complete SF-424 Fields First: The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and DUNS number.

To trigger this feature, an applicant must complete the SF-424 information first.

Once it is completed, the information will transfer to the other forms.

f. Submit a Workspace: An application may be submitted through workspace by clicking the Sign and Submit button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24- 48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application submission.

g. Track a Workspace Submission: After successfully submitting a workspace application, a Grants.gov Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the Confirmation page that is generated after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

For additional training resources, including video tutorials, refer to:

https://www.grants.gov/web/grants/applicants/applicant-training.html

Applicant Support: Grants.gov provides applicants 24/7 support via the toll-free number 1-800-518-4726 and email at support@grants.gov. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist DHS with tracking your issue and understanding background information on the issue.

8. Timely Receipt Requirements and Proof of Timely Submission

a. Online Submission. All applications must be received by [INSERT TIME] Eastern time on the due date established for each program. Proof of timely submission is automatically recorded by Grants.gov. An electronic date/time stamp is generated within the system when the application is successfully received by Grants.gov. The applicant with the AOR role who submitted the application will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from

Grants.gov with the successful transmission of their application. This applicant with the AOR role will also receive the official date/time stamp and Grants.gov Tracking number in an email serving as proof of their timely submission.

When DHS successfully retrieves the application from Grants.gov, and acknowledges the download of submissions, Grants.gov will provide an electronic acknowledgment of receipt of the application to the email address of the applicant with the AOR role who submitted the application. Again, proof of timely submission shall be the official date and time that Grants.gov receives your application. Applications received by Grants.gov after the established due date for the program will be considered late and will not be considered for funding by DHS.

Applicants using slow internet, such as dial-up connections, should be aware that transmission can take some time before Grants.gov receives your application. Again, Grants.gov will provide either an error or a successfully received transmission in the form of an email sent to the applicant with the AOR role attempting to submit the application. The Grants.gov Support Center reports that some applicants end the transmission because they think that nothing is occurring during the transmission process. Please be patient and give the system time to process the application.

9. Content and Form of Application Submission

Required Forms

Complete the required forms in accordance with the application instructions on Grants.gov. If submitting any information that is deemed proprietary, privileged, confidential, or financial, please denote the beginning and ending of such information with asterisks (*).

1. Form SF-424 – Application for Federal Assistance: Complete the SF-424 application form. This form may be completed on the Grants.gov website or it can be completed offline in its entirety. NOTE: Applications submitted through Grants.gov must use the SF-424 provided by Grants.gov. The SF-424 application form can only be viewed and downloaded once Adobe Reader has been installed.

The SF-424 application form on Grants.gov is formatted so applicants are only required to complete fields which are indicated with an asterisk (*) and color coded. Once the application is complete, close the document (you will then be prompted to save changes or not).

2. Form SF-424A – Budget: Complete the budget in its entirety. Provide budget amounts by object class (salaries, fringe, travel, indirect, etc.). Funds may be requested if the item and amount are necessary to perform the proposed work and are not precluded by the cost principles or program funding restrictions.

3. Certifications/Assurances: Applicants must submit:

a. Form SF-424B – Assurances – Non-Construction Programs; and

b. Certification Regarding Lobbying. If paragraph two of the certification applies, then complete and submit the SF-LLL Disclosure of Lobbying which is provided as an optional form in the application package.

By signing and submitting an application under this announcement, the applicant is providing: Certification Regarding Drug-Free Workplace Requirements (see Attachment B); Certification Regarding Debarment, Suspension, and Other Responsibility Matters – Primary Covered Transactions (see Attachment C); and Certification that the applicant is not delinquent on any federal debt.

Required Documents

4. Budget Table and Narrative: See also Restrictions on Use of Award Funds.

If a subrecipient is proposed under the project, applicants must provide a separate subrecipient budget narrative and table following the same format and with the same level of detail as that of the applicant (i.e., by Object Class Category/Cost Classification). Each subrecipient budget and supporting detail should be separate from the applicant’s budget narrative.

If any fees are proposed that will result in program income, please show in the budget how this income will be used.

Budget Table Provide your budget request in a table format. This must be provided either in the same document as the budget narrative or uploaded as a separate document under the “Other Attachments” form found under the “Optional Documents” section of the application package.” Include all budget categories, as listed in the budget narrative section. Under each category, list the line items requested. See a sample table below.

Note: This sample table shows the Personnel category only. Applicants must provide information on all budget categories.

Budget Table

Year 1 Total Category and Item

In- Kind

DHS Total

In-kind DHS Total 1. Personnel-

1 FTE

$X $X $X

$X $X $X TOTAL

Personnel

$X $X $X

$X $X $X

Include costs for the performance year. Show a total of all requested federal grant funds. This total should match the total listed on the project abstract. Budget categories below should add up to this total. This total should not include any in-kind costs. The in-kind contribution (if applicable) total should be listed separately.

Provide budget information in the order listed below. Budget detail is required for:

a. In-Kind Costs: The dollar value of non-cash donations to the project.

These donations may be in the form of space, supplies, salaries, etc. The costs should be calculated at the verifiable fair-market value.

b. Personnel: Costs of employee salaries and wages. For each staff person, provide the name (if known), title, time commitment to the project as a percentage of a full-time equivalent (FTE), annual salary, and grant funded salary. Do not include the costs of consultants. Consultants are to be included under “Contractual.”

c. Fringe Benefits: Costs of employee fringe benefits unless treated as part of an approved indirect cost rate. Provide the method used to calculate the proposed rate amount. If a fringe benefit has been negotiated with, or approved by, a cognizant federal agency, provide a copy of the agreement.

If no rate agreement exists, provide a breakdown of the amounts and percentages that comprise fringe benefit costs such as health insurance, FICA, retirement insurance, taxes, etc. Identify the base for allocating these fringe benefit expenses.

d. Travel: Costs of project-related travel by employees of the applicant organization (do not include costs of sub-contractor or consultant travel).

For each proposed trip, provide the purpose, number of travelers, travel origin and destination, number of days, and a breakdown of costs for airfare, lodging, meals, car rental, and incidentals. The basis for the airfare, lodging, meals, car rental, and incidentals must be provided, such as past trips, current quotations, Federal Travel Regulations, etc. Foreign travel is not permitted.

e. Equipment: Equipment costs are not anticipated under this NOFO.

f. Supplies: Costs of all tangible personal property. Specify general categories of supplies and their costs. Show computations and provide other information which supports the amount requested.

g. Contractual: Costs of all contracts for services and goods except for those that belong under other categories such as equipment, supplies, construction, etc. Include third party evaluation contracts (if applicable) and contracts with secondary recipient organizations. Demonstrate that all procurement transactions will be conducted in a manner to provide, to the maximum extent practical, open and free competition. Identify proposed sub- contractor work and the cost of each sub-contractor. Provide a detailed budget for each sub-contractor that is expected to perform work estimated to be $25,000 or more, or 50% of the total work effort, whichever is less.

• Identify each planned subcontractor and its total proposed budget.

Each subcontractor's budget and supporting detail should be included as part of the applicant's budget narrative.

• Provide the following information for each planned subcontract: a brief description of the work to be subcontracted; the number of quotes solicited and received, if applicable; the cost or price analysis performed by the applicant; names and addresses of the subcontractors tentatively selected and the basis for their selection;

e.g., unique capabilities (for sole source subcontracts), low bidder, delivery schedule, technical competence; type of contract and estimated cost and fee or profit; and, affiliation with the applicant, if any.

• Recipient may be required to make pre-award review and procurement documents available to DHS, including request for proposals or invitations for bids, independent cost estimates, etc.

This may include procurements expected to exceed the simplified acquisition threshold fixed at 41 USC 403(11) (currently set at $250,000) and expected to be awarded without competition or only one bid or offer is received in response to a solicitation.

A. All required flow down provisions in the award must be included in any subcontract.

h. Other Direct Costs: Any other items proposed as direct costs. Provide an itemized list with costs and state the basis for each proposed item.

i. Indirect Costs: Provide a copy of the latest rate agreement negotiated with a cognizant federal agency. If the applicant is in the process of initially developing or renegotiating a rate, upon notification that an award will be made, it should immediately develop a tentative indirect cost rate proposal based on its most recently completed fiscal year, in accordance with the cognizant agency's guidelines for establishing indirect cost rates, and submit it to the cognizant agency. Applicants awaiting approval of their indirect cost proposals may also request indirect costs. When an indirect cost rate is requested, those costs included in the indirect cost pool should not also be charged as direct costs to the award. If the applicant is requesting a rate which is less than what is allowed under the program, the authorized representative of the applicant organization must submit a signed acknowledgement that the applicant is accepting a lower rate than allowed.

NOTE: If no indirect cost rate agreement is included, no indirect costs should be listed in the proposed budget.

5. Project Abstract (3 single-spaced page maximum) Provide the information below in a separate document, suitable for public dissemination. The project abstract must not include any proprietary/confidential information. Attach the Project Abstract to the “Project Abstract” form within the application package.

General Information

1. Organization Legal Name

2. Organization Legal Address (Number and street, city, state, zip code)

3. Head of the Organization (Name, title, address, phone number, email

4. Authorized Official, the person at the organization authorized to sign to receive

5. Grant Project Manager, the person who will manage the operations of the grant project and will serve as CISA’s primary point of contact (Name, title, address, phone number, email address)

6. Type of Organization (e.g., community/faith-based organization, etc.)

7. Project Description (200 words or less) Provide a one-paragraph summary of the following:

� The organization’s experience providing cybersecurity awareness services and number of years providing services;

� A description of the constituency, that the organization will serve; and � Proposed grant project activities and outcomes.

8. Total Federal Funding Requested (Not to exceed $549,996)

9. Total Federal Funding Allocated for Cybersecurity Awareness

Campaign Program Activities and Materials

10. Total Federal Funding Allocated for Cybersecurity Awareness Month

Activities and Materials

11. Applicant’s Total In-Kind Contributions (if applicable)

12. Geographic Area/Community where services will be provided

13. Congressional District (based on the legal address of the applicant organization)

14. Targeted Communities (if applicable)

15. Number of Full-Time Equivalents (FTEs) Indicate the number of intended grant-funded FTEs. Include part-time work as percentages of FTEs. Include any grant-funded subrecipient FTEs.

16. Proposed Subrecipient Organization (if applicable) (Organization name, point of contact name and title, address, phone number, email address)

17. Services Proposed by Subrecipient Organization

18. Are all program sites in compliance with the Americans With

Disabilities Act?

19. Has your organization previously received a CISA grant? If so, provide year(s) Program Outcomes (for grant-funded services over the one -year period)

20. Increased cybersecurity awareness across stakeholder groups.

21. Enhanced and newly developed materials for cybersecurity awareness.

22. Successful events that promote cybersecurity across all media platforms.

6. Project Narrative (15-page maximum)

Use this section to provide a comprehensive description of the proposed program, addressing all required elements in response to the evaluation criteria. Items 6.a. – 6.c. below are the mandatory elements that must be included in the Project Narrative. You must follow the order specified below, using the title headings provided below to identify each element.

Required Headings:

a. Problem Statement Describing the Need and Current State of Public

Cybersecurity Awareness

b. Program Design and Rationale

c. Organizational Qualifications and Experience

An application that does not include each required element listed in the order provided in this section and/or is in excess of 15 double-spaced pages will be deemed non-responsive and will not be considered.

Format Requirements

Include the title “Project Narrative” at the top of the first page.

Ensure that the application can be printed on 8 ½” x 11” single-sided paper.

Use double-spacing.

Do not include any marks from the “Track Changes” tool in your word processing program.

Font size must be at least 12 point, preferably Times New Roman font.

Margins must be at least one (1) inch at the top, bottom, left and right of the paper.

Project narrative pages must be numbered “1” of “XX.”

Pages should be numbered consecutively and are limited to a total of 15 pages.

Attach the completed Project Narrative to the “Project Narrative

Attachment” form.

Required Project Narrative Sections

a. Problem Statement Describing the Need and Current State of Public Cybersecurity Awareness: Use this section to demonstrate the current state and recommended focus areas of cybersecurity awareness among the general public; small/medium businesses; the academic community, including K-12 and higher education educators, administrators, and students; and/or other key stakeholders. Narratives should incorporate sound research and data to support the problem statement.

b. Program Design and Rationale: Provide a brief overview of your cyber security awareness program design that covers the following: 1) a description of the cyber security…