PKG00253798-instructions.docx

The Department of Homeland Security (DHS) Notice of Funding Opportunity (NOFO) State, Local, Tribal and Territorial Indicators of Compromise Automation Pilot

NOTE: If you are going to apply for this funding opportunity and have not obtained a Data Universal Numbering System (DUNS) number and/or are not currently registered in the System for Award Management (SAM), please take immediate action to obtain a DUNS Number, if applicable, and then to register immediately in SAM. It may take 4 weeks or more after you submit your SAM registration before your registration is active in SAM, then an additional 24 hours for Grants.gov to recognize your information. Information on obtaining a DUNS number and registering in SAM is available from Grants.gov at: http://www.grants.gov/web/grants/register.html Detailed information regarding DUNS and SAM is also provided in Section D of this NOFO, subsection, Content and Form of Application Submission.

A. Program Description

Issued By U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Cybersecurity Division (CSD)

Assistance Listings Number (formerly Catalog of Federal Domestic Assistance Number) 97.128

Assistance Listing Title (formerly CFDA Title) State, Local, Tribal and Territorial (SLTT) Indicators of Compromise Automation

Notice of Funding Opportunity Title State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot

NOFO Number

DHS–19-CISA-128-SLT001

Authorizing Authority for Program Homeland Security Act of 2002, as amended by the Cybersecurity and Infrastructure Security Agency Act of 2018, National Cybersecurity Protection Act of 2014, Executive Order (EO) 13636, Executive Order 13691, Presidential Policy Directive (PPD) 21

Appropriation Authority for Program Department of Homeland Security (DHS) Appropriations Act, 2019, P.L. 116-6, Title III, Cybersecurity and Infrastructure Security Agency

Program Type New Cooperative Agreement

Program Overview, Objectives, and Priorities The Cybersecurity and Infrastructure Security Agency, Cybersecurity Division, Stakeholder Engagement and Cyber Infrastructure Resilience (SECIR) seeks to award a new cooperative agreement for a pilot titled “State, Local, Tribal and Territorial (SLTT) Indicators of Compromise – Automation Pilot in fiscal year 2019. This agreement supports implementation of the Homeland Security Act of 2002, as amended by the Cybersecurity and Infrastructure Security Agency Act of 2018, Subtitle A, SEC. 2209, specifically with respect to facilitating information sharing related to cybersecurity risks, incidents, analysis, and warnings, and providing technical assistance.

Justification: the nature of the cybersecurity threat to America is growing, and our nation’s cyber adversaries move with speed and stealth. To keep pace, all types of organizations, including those beyond traditional critical infrastructure sectors, need to be able to share information and respond to cyber risk in as close to real-time as possible. Organizations engaged in information sharing and responding to indicators of compromise in “real-time” play an invaluable role in the collective cybersecurity of the United States.

The purpose of this cooperative agreement is to apply the usage of automation to enhance and speed the evaluation of threat Indicators of Compromise (IOC) at the state and local government levels. In addition, the pilot will identify key areas for potential reduction of manual tasks by humans and actionable information sharing across enterprises and SLTT. The pilot will also identify orchestration services needed to integrate the activities of sensing, understanding, decision-making, and acting. The grant recipient may select up to five states and/or localities to participate in the pilot project. The pilot project will focus on developing model processes, methods, and accompanying policies and procedures that can be applied by SLTT to accomplish the following:

· Action upon IOCs within minutes of receipt.

· Reduce time spent on repetitive tasks.

· Provide generation, enrichment and scoring of IOCs.

· Receipt, remediation and response to IOCs.

· Demonstrate the use of Security Orchestration, Automation, and Response (SOAR) operational procedures and capabilities combined with information sharing to make data more actionable and enable consistent execution at and across SLTT levels.

· Development of repeatable processes for orchestration and automation services that bridge existing SLTT policies with SOAR capabilities.

To fulfill this requirement DHS will select an organization through an open and competitive process and enter into a cooperative agreement.

The grants officer will oversee the execution of the grant and the performance of grant execution based on input from the DHS, CISA, CSD Program Office, discussion with the awardee, and Program Performance Reporting Requirements (found in Section F and Appendix A).

Security Automation an Orchestration (SA&O) Operational Performance measures and metrics

Quarterly Performance Metrics must be submitted to the DHS Grants Officer no later than 30 days after the end of each quarter. Reports are due October 30, January 31, April 30 and July 31. Reports shall be submitted via the GrantSolutions Grant Note feature using the Grant Note submission guidance found here: https://www.grantsolutions.gov/support/granteeUsers.html.

SA&O metrics and measures assist organizations in recognizing and refining how SA&O capabilities and techniques introduce benefits, value and effects. This document identifies metrics and measures that organizations may find beneficial to collect, assess, and compare over time.

Metrics and Measures Groupings

1. Operational Performance - evaluate & recognize SA&O value, benefits, issues and effects as it relates to security operations and performance.

2. System Performance - evaluate & recognize value, issues and effects as it relates to your Cyber security infrastructure, practices and SA&O support.

3. Process Performance – evaluate & recognize value, issues, and effects as it relates to organizational, practice and process dependencies that directly impact SA&O value.

4. Workflow Execution - assist organizations to design, develop, monitor, tune, troubleshoot and maintain SA&O capabilities.

* The groupings are general to highlight types of metrics and measures and are not comprehensive

As organizations apply SA&O capabilities, there is value in collecting information to help assess utility, applicability, (in) efficiency, and reliability of the implementations. It is also useful to collect information that identifies dependencies, opportunities for improvements, or changes in performance. Lastly, it may be important to collect audit information to support deployment testing or compliance verification.

Metrics and Measures may be tailored for performance indicators as:

· Quantitative – measure of value (number, time, $, ratio)

· Qualitative – measure of acceptability or health

· Thresholds – when an index reaches set targets or falls into set ranges

· Milestones – when a specific condition is reached

· Trends – results analyzed over time and volume

Metrics and Measures The following tables provide insight into metrics and measures that can be captured or produced by SA&O systems. Each entry includes a description and rationale/utility examples.

SA&O Operational Performance measures and metrics Assist organizations to evaluate and recognize SA&O value, benefits, issues and effects. They offer insights for how SA&O has been applied, efficiencies gained, cyber security operations effectiveness and overall Return on Investment (ROI) context. Because they are directly related to reasons that organizations invest in SA&O, most of these metrics and measures are already “provided” by orchestration providers and described in industry resources.

Identifies or Informs

Operational Performance

· Example: Time lapse notifying SOC tier 1 support

· Summarize operational value

· Ability to handle higher volumes of investigations, alerts and data

· Example: Time lapse between notification and when an automated workflow or analyst begins investigating

· If organization achieving quicker detection and response

· Example: Average time to resolve a number of major vs. minor incidents

· Track progression for each type of remediation

· Summarize operational value

· Example: Summarize the types of incidents aided by workflows for remediation

· How SA&O aids investigations compared to the volume of alert data

· Resource savings

· Examples: speed of decision/resolution, resource utilization improvement (e.g., devices run faster due to less malware, increased network bandwidth due to blocking malware related traffic)

System Performance measures and metrics Assist organizations to evaluate & recognize value, issues and effects as it relates to your cyber security infrastructure, practices and SA&O support. They offer insights for how SA&O has been implemented, orchestration management, and cyber security product/service value as related to automation in operations.

System Performance and Utilization

· Operational value for incident and alert triage

· Operational practices and dependencies

· Example: Identify if workflows are or could address common incidents/alerts in part or whole.

· Heavily vs. underutilized sensor(s)

· Which sensors aid investigation and/or remediation actions

· Example: Which workflows rely on real- time packet capture analysis? Impact if it were to become unavailable?

an investigation or remediation

· Potential impact of compromised or unavailable sensor(s)

· High valued vs. underutilized sensor(s)

· Sensor tuning effectiveness

· Which sensors aid investigation and/or remediation actions

· Example: Types of logs or threat feeds and indicators proven effective

· Identify system bottlenecks

· Throughput

· System failures

· Examples: Understanding if the system is capable of supporting operational demand

· Examples: Comparing workflow executions with Incident triage in peak time periods

· Common, duplicative vs.

purposely separated system interfaces

· Example: Common dependency on a logging interface and impact if it were to become compromised or unavailable.

· Example: boundary protection devices run slower due to increasingly large blacklists or decreased network bandwidth due to queries to support internal enrichment of IOCs

· Examples: unauthorized software/devices identified in investigations, percentage of devices with current patches, detected non- compliance with business conduct policies, and number of reported vs. detected security incidents

Process Performance measures and metrics Assist organizations to evaluate & recognize value, issues, and effects as it relates to organizational, practice and process dependencies that directly impact SA&O value. They offer insights for how SA&O efficiency and effectiveness may be impacted by dependencies on external, manual, poorly-defined, and/or cross-organizational processes.

Process Performance

Examples: Third party service or cloud providers, inter-organizational relationships NOC/SOC/IT

· Workflows that can execute without human interaction

· Classifying how different types of workflows may benefit by manual or automated validation, verification and/or audit.

· Example: Identify frequently executed workflows with a history of high confidence execution still requiring human interaction.

· Opportunities to enhance workflows and reduce manual processing required

· Additional sensors, sources and/or analysis techniques relevant to the task

· Example: Percentage or number of investigations and workflows which required unanticipated analyst investigation support.

Track within and across connected workflows

· Organizational dependencies

· Opportunities to streamline operations across organizations

· Inform service level agreements between organizations

· Examples: SOC, NOC, IT, Helpdesk, and Legal

Workflow Execution measures and metrics Assist organizations in verifying that SA&O performance is achieving intended effects. As part of that, these metrics and measures assist organizations in the design, development, monitoring/auditing, tuning, troubleshooting, and maintenance of SA&O capabilities.

Workflow Execution

· Complexity of workflows

· Controlled administration, configuration & tuning

· Audit authorized & verified changes

· Automated tests to verify and validate results and intent.

· Example: Stable workflows suddenly revised or unapproved changes to operational practices.

· Frequency of initiating condition or alerts

· Example: Identify how often the workflow executes during business hours

· Frequency of changes made to certain operational assets

· Example: Identify how often the workflow executes different actions in response to same trigger

· Operational practices and dependencies

· Example: Identify if and how analysts and/or automated responses are applying workflows.

· Return on Investment (ROI)

25. Workflow confidence level

· Potential workflows to enhance with automation

· Example: Workflow confidence score increases given the frequency analysts concur with recommendations.

· Throughput/efficiency constraints

· Sources of bottlenecks

· Example: SOC workflow commonly requires network operations center (NOC) concurrence which is taking 24- 48hrs. Opportunity to accelerate between departments?

· Failures common across workflows

· Example: Workflow A is highly reliable while workflow B commonly requires unplanned manual intervention and should be considered for revision.

· Example: provide evidence that a critical server is not taken offline and reset unless another service is verified as online first.

· Change in system or capabilities

· Example: A workflow typically requires 1 minute to complete and is noted taking 2+ mins. Intended or unintended change?

· If workflows can be verified, audited and validated

· Examples: verification that initiating feeds are working, timing information on how long certain paths or steps take, responses from sensors or actuators tasked

B. Federal Award Information

Award Amounts, Important Dates, and Extensions Available Funding for the NOFO: $2,000,000.00.

Projected number of Awards (Optional): 1 (one) award.

Period of Performance: 12 months.

Extensions to the Performance Period may be awarded but are not guaranteed. Extension approvals will be based on the availability of funds within the award and acceptable performance.

Projected Period of Performance Start Date(s): 10/1/2019

Projected Period of Performance End Date(s): 09/30/2020 Funding Instrument: Discretionary – Competitive – Cooperative Agreement

DHS will exercise substantial programmatic involvement through this cooperative agreement. This includes conducting site visits and quarterly monitoring of project progress; providing technical assistance; overseeing agency review and approval required at the completion of one stage of the work prior to moving on to subsequent phases; reviewing and approving of sub-grants that exceed standard regulatory approvals; work plans or modifications thereto; holding kickoff meetings; conducting bi-annual programmatic reviews; coordinating standards development and self-certification activities.

The grants officer will oversee the execution of the grant and the overall performance of the awardee from an administrative and financial perspective.

C. Eligibility Information

Eligible Applicants

· For-profit organizations other than small businesses

· Nonprofits with 501(c) (3) IRS status, other than institution of higher education

· Nonprofits without 501(c) (3) IRS status, other than institution of higher education

· Federally Funded Research and Development Centers (FFRDCs)

· University Affiliated Research Centers (UARCs)

· Private institutions of higher education

· Public and State controlled institutions of higher education

· Small businesses

Eligibility Criteria To be eligible for this program, must meet the below requirements.

1. Applicants must not be a Government organization. Pursuant to EO 13691, “Promoting Private Sector Cybersecurity Information Sharing” of February 13, 2015, the organization selected must be non-governmental to be eligible. DHS has interpreted this restriction to exclude federal, state, local, territorial, tribal, and foreign governmental entities from making a proposal for this announcement.

2. At the time of application, applicants must have at least three years of experience developing cybersecurity best practices for SLTT Governments.

3. Applicants must have qualified and experienced to gather, analyze, and disseminate government and critical infrastructure information that can be shared at machine speed across SLTT. Recent and extensive experience providing cybersecurity-related information sharing, interoperability and automation best practices development.

4. Applicants must have at least three years of experience coordinating engagements with SLTT, private companies, Federal agencies, and subject matter experts engaged in addressing advances in orchestration and automation services for improved interoperability, information sharing and automation of network defenses.

5. Applicants must have three years of experience conducting research and analysis on the most effective methods for advancing cybersecurity, IOC automation, and demonstrating the usage and effectiveness of SOAR capabilities.

6. Applicants must have deep knowledge of the National Infrastructure Protection Plan, Executive Order 13636, Executive Order 13691, and PPD-21.

7. Federal agencies may not apply. Federal employees are not eligible to serve in a principal leadership role on a grant or cooperative agreement, and may not receive salaries or in other ways augment their agency's appropriations through awards made by this program.

a. Nonetheless, federal employees may interact substantively with awardees in the form of cooperation.

b. Cooperation involves consulting on the planning, management, and coordination of standards organization and/or information sharing and analysis organization activities, sharing or comparing information, indicators, samples, equipment, facilities, data, models, or other support during the conduct of the standards development and related activities in which the interaction is substantial and requires the award of a cooperative agreement, rather than a grant.

c. Substantial involvement occurs when the collaboration or cooperation of a federal employee or facility is necessary to achieving the overall goals of the activities supported by this cooperative agreement.

Other Eligibility Criteria DHS will not consider applications that do not adhere to one or more of the following requirements:

1. Deadlines. DHS will not accept late applications. Without exception, applications must be received by Grants.gov on or before the deadline in this announcement or they will not be considered.

2. Application relevance. Applications that do not address the purpose of this announcement will not be considered.

3. Compliance and completeness. Applications must substantially comply with the application submission instructions and requirements in this announcement or they will not be considered.

4. Funding limits. Applications exceeding the funding limits will not be considered.

5. Proof of non-profit status. Non-profit applicants and any proposed sub-awardee of a non-profit must provide documentation of non-profit and/or public status. This requirement does not apply to for-profit applicants. Any of the following constitutes acceptable proof of non-profit status:

· A reference to the applicant organization’s listing in the Internal Revenue Service’s (IRS) most recent list of tax-exempt organizations described in section 501(c)(3) of the IRS Code.

· A copy of a currently valid IRS tax exemption certificate.

· A statement from a State taxing body, State attorney general, or other appropriate State official certifying that the applicant organization has a non-profit status and that none of the net earnings accrue to any private shareholders or individuals.

· A certified copy of the organization’s certificate of incorporation or similar document that clearly establishes non-profit status.

· Any of the items in the subparagraphs immediately above for a State or national parent organization and a statement signed by the parent organization that the applicant organization is a local non-profit affiliate.

· A signed statement on official letterhead by an official authorized to apply for grant funds on behalf of the public entity shall suffice.

In addition, DHS will not consider multiple applications from a single organization serving as the lead. If more than one application is submitted by a single organization as the lead, the later in time will be considered, unless the later application clearly indicates a unique role for that organization, other than as lead for this activity.

Maintenance of Effort (MOE) There is no maintenance of effort requirement for this program. Requests for funds under this announcement shall not be used to take the place of activities described in the application that are currently supported with other funding. Also, grant funds shall not be used to support activities that are a normal part of the organization’s operations.

Cost Share or Match There is no cost share or match requirement for this program.

D. Application and Submission Information

Key Dates and Times

Date Posted to Grants.gov: 08/12/2019

Application Submission Deadline: 08/28/2019 at 11:59:59 /PM [EDT]

Anticipated Funding Selection Date: 09/10/2019

Anticipated Award Date: 09/25/2019

Address to Request Application Package

Application forms and instructions are available at Grants.gov. To access these materials, go to http://www.grants.gov , select “Applicants” then “Apply for Grants.” In order to obtain the application package select “Download a Grant Application Package.” Enter the CFDA and/or the funding opportunity number located on the cover of this NOFO, select “Download Package,” and then follow the prompts to download the application package.

For a hardcopy of the full NOFO, please write or fax a request to:

Stephanie Dawkins Grants Officer stephanie.dawkins@hq.dhs.gov Phone: 202-447-0495

In addition, the following Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) number available for this Notice is: 1-800-518-4726 (Grants.gov Help Desk).

Applications will be processed through the Grants.gov portal. If you experience difficulties accessing information or have any questions, please call Grants.gov customer support at 1-800-518-4726.

Hard copy applications will not be accepted.

Content and Form of Application Submission Applicants must submit all required forms and required documents listed in this section. See the Grants.gov Applicant User Guide for instructions on how to attach forms and documents. Applicant should ensure that the final submitted application package includes all required forms and documents. Applicants should avoid the use of special characters in attachment file names.

Unique Entity Identifier and System for Award Management (SAM) All applicants for this award must:

1. Be registered in SAM before submitting its application;

2. Provide a valid DUNS number in its application; and

3. Continue to maintain an active SAM registration with current information at all times during which it has an active federal award or an application or plan under consideration by a DHS FAO.

DHS may not make a federal award to an applicant until the applicant has complied with all applicable DUNS and SAM requirements and, if an applicant has not fully complied with the requirements by the time DHS is ready to make a federal award. DHS may determine that the applicant is not qualified to receive a federal award and use that determination as a basis for making a federal award to another applicant.

The Standard Language for Using Grants.gov Apply is provided to aid in fulfilling these requirements:

Electronic Delivery DHS is participating in the Grants.gov initiative to provide the grant community with a single site to find and apply for grant funding opportunities. DHS encourages applicants to submit their applications online through Grants.gov.

How to Register to Apply through Grants.gov

1. Instructions: Read the instructions below about registering to apply for DHS funds. Applicants should read the registration instructions carefully and prepare the information requested before beginning the registration process. Reviewing and assembling the required information before beginning the registration process will alleviate last-minute searches for required information.

The registration process can take up to four weeks to complete. Therefore, registration should be done in sufficient time to ensure it does not impact your ability to meet required application submission deadlines.

Organizations must have a Data Universal Numbering System (DUNS) Number, active System for Award Management (SAM) registration, and Grants.gov account to apply for grants.

If individual applicants are eligible to apply for this grant funding opportunity, refer to: https://www.grants.gov/web/grants/applicants/registration.html Organization applicants can find complete instructions here:

https://www.grants.gov/web/grants/applicants/organization-registration.html

2. Obtain a DUNS Number: All entities applying for funding, including renewal funding, must have a Data Universal Numbering System (DUNS) number from Dun & Bradstreet (D&B). Applicants must enter the DUNS number in the data entry field labeled "Organizational DUNS" on the SF-424 Form.

For more detailed instructions for obtaining a DUNS number, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-1-obtain-duns-number.html

3. Register with SAM: In addition to having a DUNS number, all organizations applying online through Grants.gov must register with the System for Award Management (SAM). Failure to register with SAM will prevent your organization from applying through Grants.gov. SAM registration must be renewed annually.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-with-sam.html

4. Create a Grants.gov Account: The next step in the registration process is to create an account with Grants.gov. Applicants must know their organization's DUNS number to complete this process.

For more information, follow the on-screen instructions or refer to: https://www.grants.gov/web/grants/applicants/registration.html

5. Add a Profile to a Grants.gov Account: A profile in Grants.gov corresponds to a single applicant organization the user represents (i.e., an applicant) or an individual applicant. If you work for or consult with multiple organizations and have a profile for each, you may log in to one Grants.gov account to access all of your grant applications. To add an organizational profile to your Grants.gov account, enter the DUNS Number for the organization in the DUNS field while adding a profile.

For more detailed instructions about creating a profile on Grants.gov, refer to: https://www.grants.gov/web/grants/applicants/registration/add-profile.html

6. EBiz POC Authorized Profile Roles: After you register with Grants.gov and create an Organization Applicant Profile, the organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may include the AOR role, thereby giving you permission to complete and submit applications on behalf of the organization. You will be able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to: https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html

7. Track Role Status: To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html

8. Electronic Signature: When applications are submitted through Grants.gov, the name of the organization applicant with the AOR role that submitted the application is inserted into the signature line of the application, serving as the electronic signature. The EBiz POC must authorize individuals who are able to make legally binding commitments on behalf of the organization as an AOR; this step is often missed and it is crucial for valid and timely submissions.

How to Submit an Application to DHS via Grants.gov Grants.gov applicants can apply online using Workspace. Workspace is a shared, online environment where members of a grant team may simultaneously access and edit different webforms within an application. For each funding opportunity announcement (FOA), you can create individual instances of a workspace.

Below is an overview of applying on Grants.gov. For access to complete instructions on how to apply for opportunities using Workspace, refer to:

https://www.grants.gov/web/grants/applicants/workspace-overview.html

1. Create a Workspace: Creating a workspace allows you to complete it online and route it through your organization for review before submitting.

2. Complete a Workspace: Add participants to the workspace to work on the application together, complete all the required forms online or by downloading PDF versions, and check for errors before submission.

3. Adobe Reader: If you decide not to apply by filling out webforms you can download individual PDF forms in Workspace so that they will appear similar to other Standard or DHS forms. The individual PDF forms can be downloaded and saved to your local device storage, network drive(s), or external drives, then accessed through Adobe Reader.

NOTE: Visit the Adobe Software Compatibility page on Grants.gov to download the appropriate version of the software at: https://www.grants.gov/web/grants/applicants/adobe-software-compatibility.html

4. Mandatory Fields in Forms: In the forms, you will note fields marked with an asterisk and a different background color. These fields are mandatory fields that must be completed to successfully submit your application.

5. Complete SF-424 Fields First: The forms are designed to fill in common required fields across other forms, such as the applicant name, address, and DUNS number. To trigger this feature, an applicant must complete the SF-424 information first. Once it is completed, the information will transfer to the other forms.

For additional training resources, including video tutorials, refer to: https://www.grants.gov/web/grants/applicants/applicant-training.html Applicant Support: Grants.gov provides applicants 24/7 support via the toll-free number 1-800-518-4726 and email at support@grants.gov. For questions related to the specific grant opportunity, contact the number listed in the application package of the grant you are applying for.

If you are experiencing difficulties with your submission, it is best to call the Grants.gov Support Center and get a ticket number. The Support Center ticket number will assist the DHS with tracking your issue and understanding background information on the issue.

Timely Receipt Requirements and Proof of Timely Submission Online Submissions. All applications must be received by Midnight Eastern Daylight Time the due date established for each program. Proof of timely submission is automatically recorded by Grants.gov. An electronic date/time stamp is generated within the system when the application is successfully received by Grants.gov. The applicant with the AOR role who submitted the application will receive an acknowledgement of receipt and a tracking number (GRANTXXXXXXXX) from Grants.gov with the successful transmission of their application. This applicant with the AOR role will also receive the official date/time stamp and Grants.gov Tracking number in an email serving as proof of their timely submission.

When DHS successfully retrieves the application from Grants.gov, and acknowledges the download of submissions, Grants.gov will provide an electronic acknowledgment of receipt of the application to the email address of the applicant with the AOR role who submitted the application. Again, proof of timely submission shall be the official date and time that Grants.gov receives your application. Applications received by Grants.gov after the established due date for the program will be considered late and will not be considered for funding by DHS.

Applicants using slow internet, such as dial-up connections, should be aware that transmission can take some time before Grants.gov receives your application. Again, Grants.gov will provide either an error or a successfully received transmission in the form of an email sent to the applicant with the AOR role. The Grants.gov Support Center reports that some applicants end the transmission because they think that nothing is occurring during the transmission process. Please be patient and give the system time to process the application.

Intergovernmental Review

An intergovernmental review may be required. Applicants must contact their State’s Single Point of Contact (SPOC) to comply with the State’s process under Executive Order 12372 (see http://www.fws.gov/policy/library/rgeo12372.pdf). Name and addresses of the SPOCs are maintained at the Office of Management and Budget’s home page at http://www.whitehouse.gov/omb/grants_spoc to ensure currency.

Funding Restrictions Restrictions on Use of Award Funds As well as any funding restrictions stated in the Budget Narrative section or any section within this document, the following are restrictions on use of award funds:

1. DHS cooperative agreement funds may only be used for the purpose set forth in the cooperative agreement, and must be consistent with the statutory authority for the award. Cooperative agreement funds and non-monetary support may not be used for matching contributions for other federal grants or cooperative agreements, lobbying, or intervention in federal regulatory or adjudicatory proceedings. Federal employees are prohibited from serving in any capacity (paid or unpaid) on any proposal submitted under this program. Federal employees may not receive funds under this award. In addition, federal funds may not be used to sue the Federal Government or any other government entity.

DHS substantial programmatic involvement and performance/progress reviews may result in funding restrictions in conjunction with initial and annual continuation awards.

Management and Administration (M&A) Costs.

M&A is allowable by the primary recipient, if applicable.

Indirect Facilities & Administrative (F&A) Costs.

Indirect Costs are allowable for the grantee and any proposed sub-awardee (if applicable). The applicant must attach a copy of the latest indirect cost rate agreement negotiated with a cognizant federal agency. If the applicant is in the process of initially developing or renegotiating a rate, upon notification that an award will be made, it should immediately develop a tentative indirect cost rate proposal based on its most recently completed fiscal year, in accordance with the cognizant agency's guidelines for establishing indirect cost rates, and submit it to the cognizant agency. Applicants awaiting approval of their indirect cost proposals may also request indirect costs. When an indirect cost rate is requested, those costs included in the indirect cost pool should not also be charged as direct costs to the award. If the applicant is requesting a rate which is less than what is allowed under the program, the authorized representative of the applicant organization must submit a signed acknowledgement that the applicant is accepting a lower rate than allowed.

Any non-Federal entity that has never received a negotiated indirect cost rate (except for those non-federal entities described in Appendix VII to Part 200 States and Local Government and Indian Tribe Indirect Cost Proposals, paragraph D.1.b) may elect to charge a de minimis rate of 10% of modified total direct costs (MTDC) which may be used indefinitely. As described in §200.403 Factors Affecting Allowability of Costs, costs must be consistently charged as either indirect or direct costs, but may not be double charged or inconsistently charged as both. If chosen, this methodology once elected must be used consistently for all federal awards until such time as a non-federal entity chooses to negotiate for a rate, which the non-federal entity may apply to do at any time. For more information, see 2 CFR Part 200.414.

Other Submission Requirements

To access application forms and instructions for this funding opportunity, go to Grants.gov click on the “Search Grants” tab. Enter the FOA Number located on the cover of this announcement. Click on the highlighted Funding Opportunity # that appears and then click on the various tabs to: read the Synopsis; review the Version History; read the Full Announcement; and, complete the Application Package. Please read the entire FOA Application Package carefully before preparing and submitting an application. Application must be submitted in electronic format only.

If you experience difficulties accessing information or have any questions please call the grants.gov customer support hotline at (800) 518-4726.

E. Application Review Information Application Evaluation Criteria Prior to making a federal award, the <DHS FAO> is required by 31 U.S.C. § 3321 note, 41 U.S.C. § 2313, and 2 C.F.R. § 200.205 to review information available through any OMB-designated repositories of government wide eligibility qualification or financial integrity information. Therefore, application evaluation criteria may include the following risk based considerations of the applicant:

1. Financial stability.

2. Quality of management systems and ability to meet management standards.

3. History of performance in managing federal award.

4. Reports and findings from audits.

5. Ability to effectively implement statutory, regulatory, or other requirements.

DHS will use the following criteria to evaluate applications deemed eligible and responsive. Applicants can receive up to 100 points.

1. Capacity to provide leadership in the automation of Indicators of Compromise and to make the data relevant and actionable for network defense. (30 Points) The extent to which the applicant demonstrates:

a. Knowledge of the most effective methods to automate the evaluation of Indicators of Compromise. (10 points).

b. Background with cybersecurity-related information sharing and the automating the evaluation of Indicators of Compromise, conducted pilots demonstrating that it is possible to define a process that optimizes time to mitigation by utilizing Security Automation and Orchestration technologies. (10 points).

c. Qualified and experienced to gather, analyze, and disseminate government and critical infrastructure cybersecurity information to SLTT. Recent and extensive experience providing cybersecurity-related information sharing and best practice development generally. (10 points).

2. Develop documentation including design, policies and procedures, CONOPS, and operations manual(s); (20 Points) The extent to which the applicant demonstrates:

a. Develop policy and procedures from Information Sharing and Analysis Centers or Threat Intelligence Platforms to make data actionable, useable and consumable to SLTT. (20 points).

3. Capacity to Provide Wide Outreach to SLTT (40 Points) The extent to which the applicant demonstrates:

a. Ability to deliver coordination engagements with SLTT and subject matter experts engaged in addressing cybersecurity automation use cases. (20 points)

b. Ability to coordinate and engage with SLTT agencies that own and operate critical infrastructure, to include but not limited to Election Infrastructure, to develop policies and procedures regarding IOC automation (20 Points)

4. Cost Effectiveness and Balance (10 Points) The extent to which the applicant’s proposed budget shows an effective use of grant funds. (10 points)

Review and Selection Process

DHS will conduct an initial review of applications to determine the responsiveness of the application. If an applicant is determined to be ineligible (see Section C. Eligibility Information) or an application is determined to be non-responsive, DHS will notify the applicant. All responsive and eligible applications will be reviewed as described below:

1. DHS will assemble reviewers which may include both federal and non-federal reviewers to review the eligible applications. Reviews of submitted applications will be conducted either on site or by remote review.

2. Technical reviewers will review each eligible application against the evaluation criteria. The reviewers will assign a score and provide summary comments based on the evaluation criteria identified above.

3. An application may be selected for a post-review quality control and possible rescoring if it received significantly diverging scores and comments from reviewers.

4. An internal review panel consisting of DHS staff will review the highest ranked applications and make final funding recommendations. The internal review panel may take applications out of rank order in consideration of strategic program priorities, which are identified below.

5. DHS may perform an additional review of the applicant organization and any and/or its key personnel. This may include reviewing audit reports, publicly available materials and/or government databases and may have a bearing on award outcome. DHS may request additional materials from the applicant as part of this review, including:

· The summary letter from the applicant’s most recent audit report; and

· Documentation of previous grant award completion that includes the name of the grantor, amount awarded, and whether the grant recipient sufficiently completed the requirements of the grant award (e.g., a final close-out report, certification of grant award completion, etc.)

6. After the technical review and before making final funding decisions, DHS may contact the highest ranking applicants to seek clarification and to negotiate technical and programmatic aspects of the application. If an application includes a sub-awardee, DHS may request to speak with all parties included in the application to ensure sufficient planning and coordination has taken place prior to making an award.

7. Confidentiality and Conflict of Interest. Technical and cost proposals submitted under this funding opportunity will be protected from unauthorized disclosure in accordance with applicable laws and regulations. DHS may use one or more support contractors in the logistical processing of proposals. However, funding recommendations and final award decisions are solely the responsibility of DHS personnel.

DHS screens all technical reviewers for potential conflicts of interest. To determine possible conflicts of interest, DHS requires potential reviewers to complete and sign conflicts of interest and nondisclosure forms. DHS will keep the names of submitting institutions and individuals as well as the substance of the applications confidential except to reviewers and DHS staff involved in the award process. DHS will destroy any unsuccessful applications after three years following the funding decision.

8 DHS strongly discourages, and will not consider, any materials submitted by or on behalf of the applicant (e.g., letters of support) other than those materials specifically requested in this notice of funding opportunity.

9 DHS will notify all applicants electronically of funding decisions. Unfunded applicants may send a written request to the Grants Officer, stephanie.dawkins@hq.dhs.gov to receive a written summary of comments related to the evaluation criteria, along with the points awarded to the application for each of the evaluation criteria. DHS will send the written summary to the applicant within 60 days of the request. Additional information beyond that described here will not be provided.

Applications will be evaluated relative to the requirements of the funding opportunity announcement. Therefore, interested parties should be aware that evaluators will distinguish between what is required information and rationalizations, “brochuremanship,” or extraneous information.