PKG00253758-instructions.pdf

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO)

State, Local, Tribal and Territorial

Security Operations Center | Information Sharing and Analysis Center

NOTE: If you are going to apply for this funding opportunity and have not obtained a Data Universal Numbering System (DUNS) number and/or are not currently registered in the System for Award Management (SAM), please take immediate action to obtain a DUNS Number, if applicable, and then to register immediately in SAM. It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information. Information on obtaining a DUNS number and registering in SAM is available from Grants.gov at:

http://www.grants.gov/web/grants/register.html. Detailed information regarding DUNS and SAM is also provided in Section D of this NOFO, subsection, Content and Form of Application Submission.

A. Program Description

Issued By U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), Cyber Security Division (CSD)

Assistance Listings Number (formerly Catalog of Federal Domestic Assistance Number) 97.123

Assistance Listings Title (formerly CFDA Title) State, Local, Tribal and Territorial Security Operations Center | Information Sharing and Analysis Center

Notice of Funding Opportunity Title State, Local, Tribal and Territorial (SLTT) Security Operations Center (SOC) | Information Sharing and Analysis Center (ISAC)

NOFO Number

DHS-19-CISA-123- ISAC000001

Authorizing Authority for Program Homeland Security Act of 2002, Title II, 6 U.S.C. 121(d)

Appropriation Authority for Program Department of Homeland Security (DHS) Appropriations Act, 2019, P.L. 116-6, Title III, Cybersecurity and Infrastructure Security Agency http://www.grants.gov/web/grants/register.html

Program Type New Competition

Program Overview, Objectives, and Priorities

Overview: Technological advances significantly outpace current cybersecurity efforts.

Pulling together critical infrastructure communities is essential to the protection of critical infrastructure and to furthering cybersecurity for the nation. This program addresses the DHS mission to Secure Cyberspace and Critical Infrastructure, as defined in the U.S.

Department of Homeland Security Strategic Plan – Fiscal Years 2020-2024 through efforts to stimulate the state, local, tribal and territorial (SLTT) government’s cyber ecosystem by building the capacity for bi-directional sharing of cyber threat information and response to cyber risk. This program leverages the strength of market technology forces to spur innovative strategies within a Security and Operations Center (SOC) to enable a cyber-relevant Information Sharing and Analysis Center (ISAC) operating model that is consistent with section 2209 of the Homeland Security Act, Executive Order 13636, Executive Order 13691, and Presidential Decision Directive-63 (PDD-63). Specifically, section 2209(d)(E) requires the composition of the national cybersecurity and communications center to include “an entity that collaborates with State and local governments on cybersecurity risks and incidents”. This program convenes effective SOC technology and their cyber analytic expertise with a coalition of SLTT cyber coordinators across all critical SLTT sub-sectors (i.e. elections, communications, energy etc.) to improve cybersecurity from mission control to community collaboration models that face current threats in the digital battlefront. The short-term impact of services will allow SLTT stakeholders to consume, and exchange awareness of threats via technologies that serve to derive a more accurate and timely picture of prioritized cyber defense actions. All the while, ensuring the awardee has access to sustained coordination with federal partners to defend forward and prevent or thwart malicious cyberspace actors and activities. Thus, through these efforts, the awardee will make improvements in SLTT cyber infrastructure and expertise; provide for a more efficient response and recovery time of systems during attack and develop resilience capabilities for our nation’s SLTT government sector.

Objectives: The purpose of this cooperative agreement is to foster relationships among critical infrastructure cyber owners and coordinators within the SLTT sector for the benefit of all. This trusted community of volunteers is primarily focused on sharing timely, actionable and relevant cyber information with each other including intelligence on threats, incidents and vulnerabilities that can include data such as indicators of compromise; tactics, techniques, and procedures (TTPs) of threat actors; advice and best practices; mitigation strategies; and other valuable materials. Sharing occurs by means of both people and machines. The awardee promotes advancement of this expansive capacity via a 24x7 Security Operations Center (SOC) | Information Sharing and Analysis Center (ISAC). The awardee is consistently engaged with external partners including federal government, law enforcement, vendor community, other ISACs and associations to facilitate cyber situational awareness and inform risk based decision-making across sectors. By technically integrating the SLTT cyber ecosystem, and empowering cyber expertise and situational awareness across the SLTT trusted circle, the community will collaboratively serve to protect and improve defenses for the nation’s SLTT and its critical infrastructure sub-sectors.

Priorities: Successful execution of this agreement will focus on expanding SLTT sector interrelationships using rapid rollout technology to support cyber threat intelligence exchange. New technologies in data analytic correlation, orchestration and collaborative threat intelligence platform capability have created opportunities for faster and actionable cyber threat intelligence and exchange. The priority is to provide a connective platform among the SLTT cyber coordinators for collaborative threat intelligence sharing. This enhanced technical model relies upon robust analytic-informed decisions to give cyber coordinators decision advantage, improve situational awareness and provide enhanced cyber defense. See Appendix A for a detailed approach in support of this collaborative enhancement.

Performance Metrics

Performance metrics will be implemented based on the detailed approach as defined in Appendix A, Task 10. The performance metrics program shall routinely measure, analyze, and report qualitative and quantitative measures and metrics on SLTT member partnerships, the impact of SLTT cyber security incidents, the degree and effectiveness of sensor coverage across the SLTT infrastructure, and the effectiveness of the recipient’s implementation of the threat intelligence awareness and sharing methodology.

To fulfill this requirement DHS will select an organization through an open and competitive process and enter into a cooperative agreement.

The grants officer will oversee the execution of the grant and the performance of grant execution based on input from the DHS CISA program office, discussion with the awardee, and Program Performance Reporting Requirements (found in section F).

B. Federal Award Information

Award Amounts, Important Dates, and Extensions Available Funding for the NOFO: $10,468,300.00

Projected number of Awards: 1 Award

Period of Performance: Up to 48 months (subject to the availability of funds)

Projected Period of Performance Start Date(s): 09/30/2019

Projected Period of Performance End Date(s): 09/29/2023

Funding Instrument – DHS will leverage this Cooperative Agreement award to stimulate evolution of the SLTT cyber ecosystem. To accomplish this goal, DHS will be responsible for substantial involvement to include the following:

1. DHS will provide promotional support of the SLTT ISAC program with the goal of increasing the cybersecurity posture of the SLTT community.

2. DHS will provide administrative assistance related to security clearances to fulfill the scope of work approved by DHS.

3. DHS will exchange bi-directional cyber threat indicators and information with the ISAC in furtherance of the objectives and priorities delineated in Appendix A in order to enable a collective defense model.

4. For purposes of maintaining cyber situational awareness of issues that affect reliability and resilience of the SLTT, DHS may exchange unattributed and attributed cyber threat landscape information with the ISAC.

5. DHS will make available office space at CISA for analysts to sit “side-by-side” with federal colleagues to provide the situational awareness assessment for the SLTT community that is used to prepare the national cyber assessment.

6. DHS provides a compartment on the HSIN platform for sharing information with the SLTT community and DHS staff populate the site with shared federal cyber awareness products.

7. DHS will hold equity calls with federal officials and the ISAC on victim notification.

8. DHS will assist in the establishment of partnerships, collaboration and cooperation with SLTT, or private entities that may be necessary for carrying out the program.

9. DHS will assist in the establishment of Federal interagency partnerships, collaboration and cooperation that may be necessary for carrying out the program.

10. DHS will provide subject matter experts (SMEs) and other varied technical and programmatic resources to support each component of the program as defined in Appendix A.

11. DHS representatives will attend and participate in appropriate meetings initiated by the Recipient.

12. DHS will provide technical assistance in the form of email, site visits, teleconferences, workshops, webinars, technical exchanges, cyber indicators, cyber vulnerabilities, cyber analytic and awareness products, training opportunities, table top exercises, and boots on the ground incident response as the program support deems necessary.

C. Eligibility Information

Eligible Applicants

• For-profit organizations other than small businesses

• Small businesses

• Nonprofits with 501(c)(3) IRS status, other than institution of higher education

• Nonprofits without 501(c)(3) IRS status, other than institution of higher education

Eligibility Criteria

1. Entity needs to be performing some of the functions of a Cyber Information Sharing and

Analysis Center.

2. Entity must possess the capacity to mature and expand a functioning 24x7 SOC to enable an ISAC.

3. Entity must be able to grow and unite stakeholder trust communities.

4. Entity must be able to retain cybersecurity analytic staff, including those with TS/SCI clearance.

5. Entity must be able to provide scalable access to cybersecurity information, tools and best practices.

6. Entity must be able to analyze huge amounts of information in real-time to identify trends and prioritize cyber information for actionable insights.

7. Entity must be able to sustain a communications model that allows critical cybersecurity information to quickly be disseminated across SLTT.

8. Entity must be capable of enabling reliable outcomes in managing cyber-relevant threat intelligence, with the benefit of improved customer resilience.

Entities that do not meet the eligibility criteria will be considered ineligible.

Other Eligibility Criteria DHS will not consider applications that do not adhere to one or more of the following requirements:

1. Deadlines. DHS will not accept late applications. Without exception, applications must be received by Grants.gov on or before the deadline in this announcement or they will not be considered.

2. Application relevance. Applications that do not address the purpose of this announcement will not be considered.

3. Compliance and completeness. Applications must substantially comply with the application submission instructions and requirements in this announcement or they will not be considered.

4. Proof of non-profit status. Non-profit applicants and any proposed sub-awardee of a non-profit must provide documentation of non-profit and/or public status. This requirement does not apply to for-profit applicants. Any of the following constitutes acceptable proof of non-profit status:

• A reference to the applicant organization’s listing in the Internal Revenue

Service’s (IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

• A copy of a currently valid IRS tax exemption certificate.

• A statement from a State taxing body, State attorney general, or other appropriate State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

• A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

• Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

• A signed statement on official letterhead by an official authorized to apply for grant funds on behalf of the public entity shall suffice.

5. In addition, DHS will not consider multiple applications from a single organization serving as the lead. If more than one application is submitted by a single organization as the lead, the later in time will be considered, unless the later application clearly indicates a unique role for that organization, other than as lead for this activity.

Maintenance of Effort (MOE)

N/A

Cost Share or Match

This cooperative agreement is a cost share program to provide cybersecurity resources and innovative solutions to under-resourced entities in the SLTT community. This cost shared service program leverages technology platform(s), shared situational awareness, and analytic tradecraft to enhance SLTT cybersecurity defensive posture.

All applicants will be required to commit to the cost share requirement at the time of the application. The required cost share is based on and calculated against the total program cost as reflected in the application budget. The maximum Federal share is 70 percent of the total program cost as reflected in the application budget. The recipient must provide a minimum non-federal entity contribution supporting 30 percent of the total program costs as reflected in the application budget. If the final approved federal award amount is lower than the total program costs reflected in the application budget, the calculation will be adjusted accordingly.

For example, if the federal award for a public sector recipient requires an 70 percent cost share and the total project cost is $100,000, then:

• Federal share is 70 percent of $100,000 = $70,000

• Recipient cost share is 30 percent of $100,000 = $30,000

Ultimately, the recipient is responsible for ensuring that it contributes the proper cost share to its actual program costs. If actual total program costs exceed projected total costs, the recipient will not receive any additional federal funding and will be responsible for contributing additional funds above the required cost match. If actual total project costs are less than the projected total project costs stated in the Federal Award, the recipient will be responsible for contributing the 30% of the actual project costs.

Eligible sources of local match include the following: funds from non-Government sources;

amounts received under a partner paid service agreement with SLTT; new capital; or in-kind contributions. The non-federal entity contribution should be specifically identified for each proposed project. The non-federal contribution, whether cash or third-party in-kind matches must consist of eligible costs (i.e., same allow-ability as the federal share) and must be identified as part of the submitted detailed budget worksheet.

This cooperative agreement is intended to offer the opportunity to introduce more innovative cybersecurity capabilities amongst the SLTT community that would not be possible under conventional methods of service delivery. A cost share model is to be implemented that increases coverage and accessibility for cybersecurity efforts. Increased involvement of SLTT government in this cooperative agreement can help to stimulate the private sector entity, buy down the cost share and contribute to increased employment, improved level of cybersecurity services and economic growth.

D. Application and Submission Information

Key Dates and Times

Date Posted to Grants.gov: 08/12/2019

Application Submission Deadline: 09/06/2019 at 11:59:00 PM [EDT]

Anticipated Funding Selection Date: 09/18/2019

Anticipated Award Date: 09/27/2019

Other Key Dates (If applicable).

Address to Request Application Package

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov , select “Applicants” then “Apply for Grants.” In order to obtain the application package select “Download a Grant Application Package.” Enter the Assistance Listings (formerly CFDA) and/or the funding opportunity number located on the

Event Suggested Deadline For Completion Obtaining DUNS Number Four weeks before actual submission deadline <date> Obtaining a valid EIN Four weeks before actual submission deadline <date> Updating SAM registration Four weeks before actual submission deadline <date> Starting application in Grants.gov One week before actual submission deadline <date> If applicable additional critical dates http://www.grants.gov/ cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

For a hardcopy of the full NOFO, please write or fax a request to:

Marsha Mathis Director, Grants and Financial Assistance Division marsha.mathis@hq.dhs.gov Phone: 202-447-5950

In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice is:

1-800-518-4726 (Grants.gov Help Desk)

Applications will be processed through the Grants.gov portal. If you experience difficulties accessing information or have any questions, please call Grants.gov customer support at:

1-800-518-4726.

Content and Form of Application Submission

Applicants must submit all required forms and required documents listed in this section. See the Grants.gov Applicant User Guide for instructions on how to attach forms and documents.

Applicant should ensure that the final submitted application package includes all required forms and documents. Applicants should avoid the use of special characters in attachment file names.

Submission of application to include:

1. A program narrative that incorporates both the technical and business vision statements on meeting the SOC|ISAC cybersecurity objective to build national SLTT resilience.

2. The application as a whole, must be signed by an official authorized to bind your organization and must stipulate that it is predicated upon the terms and conditions of this NOFO. To expedite the application evaluation, all submissions should be placed in the following order:

I. Technical Vision

It is recommended that the technical narrative provide a high level work plan indicating how each component of the NOFO is to be accomplished. Your technical approach should be in as much detail as you consider necessary to fully explain your proposed technical approach or method. The technical narrative should reflect a clear understanding of the nature of the work being undertaken. The technical narrative must include information on how the SOC|ISAC is to be organized, staffed, and managed.

II. Business Management Vision It is recommended that the business narrative provide sufficient information to allow the Government to perform a basic analysis of the work being performed and associated cost or price of the work. The applicant shall provide a high level mailto:marsha.mathis@hq.dhs.gov http://www.grants.gov/documents/19/18243/GrantsgovApplicantUserGuide.pdf summary of organizational capabilities to build trusted relationships amongst the SLTT community that enable sector-wide cybersecurity information sharing and defensive measures. The applicant shall indicate if it has the necessary financial capacity, working capital, and other resources to perform the services. If not, indicate the amount required and the anticipated source.

All optional tasks included in the NOFO shall be evaluated prior to award.

Separation of Technical and Business

The application must include two required documents: a “Technical Vision” and a “Business Management Vision”. Each of the parts shall be separate and complete in itself so that evaluation of one may be accomplished independently of, and concurrently with, evaluation of the other.

Unique Entity Identifier and System for Award Management (SAM)

All applicants for this award must:

1. Be registered in SAM before submitting its application;

2. Provide a valid DUNS number in its application; and

3. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a federal awarding agency.

DHS may not make a federal award to an applicant until the applicant has complied with all applicable DUNS and SAM requirements and, if an applicant has not fully complied with the requirements by the time DHS is ready to make a federal award. DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

Electronic Delivery

DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages applicants to submit their applications online through Grants.gov.

How to Register to Apply through Grants.gov

1. Instructions: Read the instructions below about registering to apply for DHS funds.

Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required application submission deadlines.

Organizations must have a Data Universal Numbering System (DUNS) Number, active System for Award Management (SAM) registration, and Grants.gov account to apply for grants.

If individual applicants are eligible to apply for this grant funding opportunity, refer to: https://www.grants.gov/web/grants/applicants/registration.html

Organization applicants can find complete instructions here:

https://www.grants.gov/web/grants/applicants/organization-registration.html

2. Obtain a DUNS Number: All entities applying for funding, including renewal funding, must have a Data Universal Numbering System (DUNS) number from Dun & Bradstreet (D&B). Applicants must enter the DUNS number in the data entry field labeled "Organizational DUNS" on the SF-424 form.

For more detailed instructions for obtaining a DUNS number, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html

3. Register with SAM: In addition to having a DUNS number, all organizations applying online through Grants.gov must register with the System for Award Management (SAM). Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html

4. Create a Grants.gov Account: The next step in the registration process is to create an account with Grants.gov. Applicants must know their organization's DUNS number to complete this process.

For more information, follow the on-screen instructions or refer to:

https://www.grants.gov/web/grants/applicants/registration.html

5. Add a Profile to a Grants.gov Account: A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, enter the DUNS Number for the organization in the DUNS field while adding a profile.

https://www.grants.gov/web/grants/applicants/registration.html https://www.grants.gov/web/grants/applicants/organization-registration.html https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html https://www.grants.gov/web/grants/applicants/registration.html

For more detailed instructions about creating a profile on Grants.gov, refer to:

https://www.grants.gov/web/grants/applicants/registration/add-profile.html

6. EBiz POC Authorized Profile Roles: After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the Authorized Organization Representative (AOR) role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to:https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html

7. Track Role Status: To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html

8. Electronic Signature: When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature.

The EBiz POC must authorize individuals who are able to make legally binding commitments on behalf of the organization as an AOR; this step is often missed and it is crucial for valid and timely submissions.

How to Submit an Application to DHS via Grants.gov

Grants.gov applicants can apply online using Workspace. Workspace is a shared, online environment where members of a grant team may simultaneously access and edit different Webforms within an application. For each Notice of Funding Opportunity, you can create individual instances of a workspace.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html

1. Create a Workspace: Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

2. Complete a Workspace: Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission.

3. Adobe Reader: If you decide not to apply by filling out Webforms you can download individual PDF forms in Workspace so that they will appear similar to other Standard or DHS forms. The individual PDF forms can be downloaded and saved to your local https://www.grants.gov/web/grants/applicants/registration/add-profile.html https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html https://www.grants.gov/web/grants/applicants/registration/track-role-status.html https://www.grants.gov/web/grants/applicants/workspace-overview.html device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at:

https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

4. Mandatory Fields in Forms: In the forms, you will note fields marked with an asterisk and a different background color. These fields are mandatory fields that must be completed to successfully submit your application.

5. Complete SF-424 Fields First: The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and DUNS number.

To trigger this feature, an applicant must complete the SF-424 information first.

Once it is completed, the information will transfer to the other forms.

6. Submit a Workspace: An application may be submitted through workspace by clicking the “Sign and Submit” button on the Manage Workspace page, under the Forms tab. Grants.gov recommends submitting your application package at least 24- 48 hours prior to the close date to provide you with time to correct any potential technical issues that may disrupt the application submission.

7. Track a Workspace: After successfully submitting a workspace package, a Grants.gov Tracking Number (GRANTXXXXXXXX) is automatically assigned to the application. The number will be listed on the Confirmation page that is generated after submission. Using the tracking number, access the Track My Application page under the Applicants tab or the Details tab in the submitted workspace.

For additional training resources, including video tutorials, refer to:

https://www.grants.gov/web/grants/applicants/applicant-training.html

Applicant Support: Grants.gov provides applicants 24/7 support via the toll-free number 1- 800-518-4726 and email at support@grants.gov. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist DHS with tracking your issue and understanding background information on the issue.

Timely Receipt Requirements and Proof of Timely Submission

Online Submissions. All applications must be received by MIDNIGHT Eastern Daylight Time on the due date established for each program. Proof of timely submission is automatically recorded by Grants.gov. An electronic date/time stamp is generated within the system when the application is successfully received by Grants.gov. The applicant with the https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html https://www.grants.gov/web/grants/applicants/applicant-training.html mailto:support@grants.gov

AOR role who submitted the application will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from Grants.gov with the successful transmission of their application. This applicant with the AOR role will also receive the official date/time stamp and Grants.gov Tracking number in an email serving as proof of their timely submission.

When DHS successfully retrieves the application from Grants.gov, and acknowledges the download of submissions, Grants.gov will provide an electronic acknowledgment of receipt of the application to the email address of the applicant with the AOR role who submitted the application. Again, proof of timely submission shall be the official date and time that Grants.gov receives your application. Applications received by Grants.gov after the established due date for the program will be considered late and will not be considered for funding by DHS.

Applicants using slow internet, such as dial-up connections, should be aware that transmission can take some time before Grants.gov receives your application. Again, Grants.gov will provide either an error or a successfully received transmission in the form of an email sent to the applicant with the AOR role. The Grants.gov Support Center reports that some applicants end the transmission because they think that nothing is occurring during the transmission process. Please be patient and give the system time to process the application.

Funding Restrictions

As well as any funding restrictions stated in the Budget Narrative section or any section within this document, the following are restrictions on use of award funds:

1. DHS cooperative agreement funds may only be used for the purpose set forth in the cooperative agreement, and must be consistent with the statutory authority for the award.

Cooperative agreement funds and non-monetary support may not be used for matching contributions for other federal grants or cooperative agreements, lobbying, or intervention in federal regulatory or adjudicatory proceedings. Federal employees are prohibited from serving in any capacity (paid or unpaid) on any proposal submitted under this program. Federal employees may not receive funds under this award. In addition, federal funds may not be used to sue the Federal Government or any other government entity.

DHS substantial programmatic involvement and performance/progress reviews may result in funding restrictions in conjunction with initial and annual continuation awards.

Management and Administration (M&A) Costs.

M&A is allowable by the primary recipient, if applicable.

Indirect Facilities & Administrative (F&A) Costs.

Indirect Costs are allowable for the grantee and any proposed sub-awardee (if applicable).

The applicant must attach a copy of the latest indirect cost rate agreement negotiated with a cognizant federal agency. If the applicant is in the process of initially developing or renegotiating a rate, upon notification that an award will be made, it should immediately develop a tentative indirect cost rate proposal based on its most recently completed fiscal year, in accordance with the cognizant agency's guidelines for establishing indirect cost rates, and submit it to the cognizant agency. Applicants awaiting approval of their indirect cost proposals may also request indirect costs. When an indirect cost rate is requested, those costs included in the indirect cost pool should not also be charged as direct costs to the award. If the applicant is requesting a rate which is less than what is allowed under the program, the authorized representative of the applicant organization must submit a signed acknowledgement that the applicant is accepting a lower rate than allowed.

Any non-Federal entity that has never received a negotiated indirect cost rate (except for those non-federal entities described in Appendix VII to Part 200 States and Local Government and Indian Tribe Indirect Cost Proposals, paragraph D.1.b) may elect to charge a de minimis rate of 10% of modified total direct costs (MTDC) which may be used indefinitely. As described in §200.403 Factors Affecting Allowability of Costs, costs must be consistently charged as either indirect or direct costs, but may not be double charged or inconsistently charged as both. If chosen, this methodology once elected must be used consistently for all federal awards until such time as a non-federal entity chooses to negotiate for a rate, which the non-federal entity may apply to do at any time. For more information, see 2 CFR Part 200.414.

Other Submission Requirements To access application forms and instructions for this funding opportunity, go to Grants.gov click on the “Search Grants” tab. Enter the FOA Number located on the cover of this announcement. Click on the highlighted Funding Opportunity # that appears and then click on the various tabs to: read the Synopsis; review the Version History; read the Full Announcement; and, complete the Application Package. Please read the entire FOA Application Package carefully before preparing and submitting an application. Application must be submitted in electronic format only.

If you experience difficulties accessing information or have any questions please call the grants.gov customer support hotline at (800) 518-4726.

E. Application Review Information

Application Evaluation Criteria

Prior to making a federal award, the <DHS FAO> is required by 31 U.S.C. § 3321 note, 41 U.S.C. § 2313, and 2 C.F.R. § 200.205 to review information available through any OMB-designated repositories of government wide eligibility qualification or financial integrity information. Therefore, application evaluation criteria may include the following risk based considerations of the applicant:

1. Financial stability.

2. Quality of management systems and ability to meet management standards.

3. History of performance in managing federal award.

4. Reports and findings from audits.

5. Ability to effectively implement statutory, regulatory, or other requirements.

DHS will evaluate applications deemed eligible against the criteria set forth below.

Factor 1: Technical (45 Points) Sub-factor 1.1 Indicator-to-action workflow planning, design and execution (20 Points) Sub-factor 1.2 Systems Engineering and Integration (15 Points) Sub-factor 1.3 Capacity for secure Automated Indicator Handling (10 Points) Factor 2: Business Management (35 Points)

Sub-factor 2.1 Overall business management approach in providing cybersecurity operational services that protect SLTT (15 Points)

Sub-factor 2.2 Personnel Management & Retention (10 Points) Sub-factor 2.3 SLTT (and Elections) Outreach and Communications (10 Points) Factor 3: Past Performance and Prior Experience (10 Points) Factor 4: Cost Effectiveness & Cooperative Agreement Cost Share Methodology (10 Points)

Relative Order of Importance Factor 1 (Technical) is more important than Factor 2 (Management). Factor 2 (Management) is more important than Factor 3 (Past Performance). Factor 3 (Past Performance) is more important than Factor 4 (Cost Effectiveness). Factors 1-3 (Technical, Management, Past Performance) are significantly more important than Factor 4 (Cost Effectiveness).

Factor 1- Technical

Capabilities Demonstration The applicant shall conduct a Capabilities Demonstration to evaluate how the applicant’s solution meets the workflow functionality as well as technical requirements of this award.

During the demonstrations, applicants will be evaluated on their maturity model to meet DHS CISA defined functional and technical capabilities. In addition, the demonstrations will provide input for assessing related criteria and validating the overall approach.

The extent to which the applicant demonstrates:

1.1 Indicator-to-action workflow planning, design and execution

• Applicant agility in implementing workflow processes that share prioritized cyber threat intelligence amongst community members to protect from and/or mitigate the threat at expedited speed.

1.2 Systems Engineering and Integration

• Approach and methodology for managing, expanding, enhancing, storing, integrating and sharing threat data and information. The approach shall include updating architecture hardware and software assets to support innovative technology and/or new capabilities insertion.

• Description for how applicant’s systems engineering approach and methodology supports maintaining the overall security posture and maintaining enterprise-wide configuration management, problem and release management.

• Approach, methodology, capabilities and capacity of proposed staffing

1.3 SOC operating capabilities

• Security Information and Event Management optimization for near real time event collection and analysis

• Big Data optimization to complement pattern and statistical analysis

• Threat Intelligence Security Tool Alerting optimization

• Ability to add time to SOC analyst through automation of repetitive activities

Factor 2: Business Management

The Government will evaluate the Applicant’s:

2.1 Overall Business Management approach in providing cybersecurity operational services

• Approach to meeting SLTT national cybersecurity resilience capability objectives –– such as information sharing, risk mitigation, incident response, engagement and workforce development.

2.2 Key Personnel Management & Retention

• Approach to provide a sound key personnel management strategy to include recruiting and hiring key personnel; and retaining capable, qualified and skilled key personnel.

2.3 SLTT (and Elections) Outreach and Communications Plan

• Outline of activities/communications that will be done to communicate strategy and move SLTT stakeholders to accomplish goals.

Factor 3: Past Performance and Prior Experience

3.1 Assesses the degree of confidence the Government has in an Applicant’s ability to deliver capabilities and services that meet the cybersecurity efforts at hand based on a demonstrated record of performance. The Government will evaluate the relevancy, recency, and overall performance confidence in the Applicant’s past performance.

Factor 4: Cost Effectiveness & Cooperative Agreement Cost Share Methodology

4.1 The extent to which the applicant’s proposed budget shows an effective use of grant funds.

4.2 Approach to managing program cost, schedule, and technical performance

4.3 Approach to managing SLTT partner paid delivery of service through crowdsourced pricing policies to support members who may lack resources for obtaining cybersecurity tools.

Review and Selection Process

DHS will conduct an initial review of applications to determine the responsiveness of the application. If an applicant is determined to be ineligible (see Section C. Eligibility Information) or an application is determined to be non-responsive, DHS will notify the applicant. All responsive and eligible applications will be reviewed as described below:

1. DHS will assemble a review panel which may include both federal employees and subject matter experts (non-federal reviewers) to review the eligible applications. Reviews of submitted applications will be conducted either on site or by remote review.

2. Technical reviewers will review each eligible application against the evaluation criteria. The reviewers will assign a score and provide summary comments based on the evaluation criteria identified above.

3. An application may be selected for a post-review quality control and possible rescoring if it received significantly diverging scores and comments from reviewers.

4. An internal review panel consisting of DHS staff will review the highest ranked applications and make final funding recommendations. The internal review panel may take applications out of rank order in consideration of strategic program priorities, which are identified below.

5. DHS may perform an additional review of the applicant organization and any and/or its key personnel. This may include reviewing audit reports, publicly available materials and/or government databases and may have a bearing on award outcome. DHS may request additional materials from the applicant as part of this review, including:

• The summary letter from the applicant’s most recent audit report; and

• Documentation of previous grant award completion that includes the name of the grantor, amount awarded, and whether the grant recipient sufficiently completed the requirements of the grant award (e.g., a final close-out report, certification of grant award completion, etc.)

6. After the technical review and before making final funding decisions, DHS may contact the highest ranking applicants to seek clarification and to discuss technical and programmatic aspects of the application. If an application includes a sub-awardee, DHS may request to speak with all parties included in the application to ensure sufficient planning and coordination has taken place prior to making an award.

7. Confidentiality and Conflict of Interest. Technical and cost proposals submitted under this funding opportunity will be protected from unauthorized disclosure in accordance with applicable laws and regulations. DHS may use one or more support contractors in the logistical processing of proposals.

However, funding recommendations and final award decisions are solely the responsibility of DHS personnel.

DHS screens all technical reviewers for potential conflicts of interest. To determine possible conflicts of interest, DHS requires potential reviewers to complete and sign conflicts of interest and nondisclosure forms. DHS will keep the names of submitting institutions and individuals as well as the substance of the applications confidential except to reviewers and DHS staff involved in the award process. DHS will destroy any unsuccessful applications after three years following the funding decision.

8. DHS strongly discourages, and will not consider, any materials submitted by or on behalf of the applicant (e.g., letters of support) other than those materials specifically requested in this notice of funding opportunity.

9. DHS will notify all applicants electronically of funding decisions. Unfunded applicants may send a written request to the Grants Officer, marsha.mathis@hq.dhs.gov to receive a written summary of comments related to the evaluation criteria, along with the points awarded to the application for each of the evaluation criteria. DHS will send the written summary to the applicant within 60 days of the request. Additional information beyond that described here will not be provided.

Supplemental Financial Integrity Review If the anticipated federal share of a federal award will be greater than the simplified acquisition threshold, currently $250,000 (see Section 805 of the National Defense Authorization Act for Fiscal year 2008, Pub. L. No. 115-91, OMB Memorandum M-18-18 at https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-18.pdf):

i. Prior to making a federal award with a total amount of federal share greater than the simplified acquisition threshold, DHS is required to review and consider any information about the applicant that is in the designated integrity and performance system accessible through SAM (currently FAPIIS).

ii. An applicant, at its option, may review information in the designated integrity and performance systems accessible through SAM and comment on any information about itself that a federal awarding agency previously entered and is currently in the designated integrity and performance system accessible through SAM.

https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-18.pdf

iii. DHS will consider any comments by the applicant, in addition to the other information in the designated integrity and performance system, in making a judgment about the applicant’s integrity, business ethics, and record of performance under federal awards when completing the review of risk posed by applicants as described in 2 C.F.R. § 200.205 federal awarding agency review of risk posed by applicants.

F. Federal Award Administration Information

Notice of Award

DHS issues formal award notification documents following fulfillment of DHS Congressional notifications. All DHS grants and cooperative agreements are subject to the standard DHS Award Terms and Conditions, which are attached to this package.

A grant award will be executed by a DHS Grants Officer authorized to obligate DHS funding. Unsuccessful applicants will be contacted as well and will be encouraged to apply for future grant award programs. Announcements for future programs will be listed at http://www.grants.gov.

Administrative and National Policy Requirements

All successful applicants for DHS grant and cooperative agreements are required to comply with DHS Standard Terms and Conditions, which are available online at:

DHS Standard Terms and Conditions

The applicable DHS Standard Terms and Conditions will be those in effect at the time the award was made, unless the application is for a continuation award. In that event, the terms and conditions in effect at the time the original award was made will generally apply. What terms and conditions will apply for the award will be clearly stated in the award package at the time of award.

Before accepting the award, the AOR should carefully read the award package for instructions on administering the grant award and the terms and conditions associated with responsibilities under federal awards. Recipients must accept all conditions in this NOFO as well as any special terms and conditions in the Notice of Award to receive an award under this program.

Reporting

Federal Financial Reporting Requirements.

The Federal Financial Reporting Form (FFR) is available online at:

http://www.grants.gov/ http://www.dhs.gov/publication/fy15-dhs-standard-terms-and-conditions

SF-425 OMB #4040-0014

Program Performance Reporting Requirements.

The recipient is required to submit the following performance reports:

1. Quarterly Performance Reports must be submitted to the DHS Grants Officer no later than 30 days after the end of each quarter. Reports are due October 30, January 31, April 30, and July 31. Reports shall be submitted via the GrantSolutions Grant Notes feature using the Grant Note submission guidance found here:

https://www.grantsolutions.gov/support/granteeUsers.html.

Performance reports must provide information on the overall progress. These reports shall also include:

i. Summary reports on the SLTT-ISAC’s strategic vision and activities;

management efforts; performance reports on each funded project, along with explanations of any changes from the initially approved work plan, discussion of progress for each milestone and explanations of why milestones were not reached, the performance metrics used; budget expenditures and changes;

unanticipated problems and plans for addressing them; and information on how project outcomes will advance or impact current technologies or capabilities.

ii. Budget information categorized by both object class and project.

iii. If applicable, include a certification that no patentable inventions were created…