TCGP Cyber Plan Template_508c_09-21-23.docx

Tribal Cybersecurity Grant Program (TCGP) Cybersecurity Plan Template Paperwork Burden Disclosure Notice:

Public reporting burden for this data collection is estimated to average 100 hours per response. The burden estimate includes the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and submitting this form. This collection of information is required to obtain or retain benefits. You are not required to respond to this collection of information unless a valid OMB control number is displayed on this form. Send comments regarding the accuracy of the burden estimate and any suggestions for reducing the burden to: Information Collections Management, Department of Homeland Security, Federal Emergency Management Agency, 500 C Street, SW., Washington, DC 20472-3100, Paperwork Reduction Project (1660-0125) NOTE: Do not send your completed form to this address.

Privacy Notice:

GENERAL: This information is being collected for the primary purpose of facilitating correspondence between the grant applicant and the Department of Homeland Security (DHS) and for determining eligibility and administration of the Tribal Cybersecurity Grant Program (TCGP).

AUTHORITY: The Homeland Security Act of 2002, Section 2220A (Pub. L. No. 107-296, as amended by the Infrastructure Investment and Jobs Act (Pub. L. No. 117-58)) (6 U.S.C. § 665g)).

USES AND SHARING: The information on this form may be disclosed as generally permitted under 5 U.S.C. § 552a(b) of the Privacy Act of 1974, as amended. This includes using this information as necessary and authorized by the routine uses published in DHS/FEMA-004 Non-Disaster Grant Management Information Files System of Records, 87 FR 41141 (July 11, 2022), and upon written request, by agreement, or as required by law. Further information regarding FEMA’s use and sharing of information can be found with the DHS/FEMA/PIA – 013 Grants Management Programs Privacy Impact Assessment. The Department’s list of Privacy Impact Assessments can be found on the Department's website at https://www.dhs.gov/privacy-impact-assessments.

EFFECTS OF NONDISCLOSURE: The disclosure of information on this form is voluntary; however, failure to provide the information requested may delay or prevent the organization from receiving grant funding.

Security Warning: When opening the TCGP Cybersecurity Plan Template, some users may see a note that says, "Security Warning: some active content has been disabled." Click on the [Options …] button next to the message, select "Enable this content," then click on the [OK] button. If this is not done, the text boxes may not function properly.

Helpful Hints:

Moving Through the Cybersecurity Plan Template: While entering information into this Template, applicants should try to minimize the use of the Tab and Enter keys to move between data entry fields. As the Template consists of a combination of text boxes and cells, using these keys may cause the cursor to move to an undesired location.

Copying & Pasting in the Cybersecurity Plan Template: Some applicants may find it helpful to begin drafting their content in a word processor and then pasting this into the Template. However, please be aware that, when copying and pasting information from a word processor into the text boxes in the Template, any formatting may not carry over.

Character Count: The data entry fields included in the Template allow for a maximum number of characters. Once that limit has been reached, users will not be able to insert any additional text in the field, but responses may be continued on a separate page attached to this form if needed.

Spell Check:

It is suggested that applicants use a word processor’s spell check software to ensure that the entered information is spelled correctly. The Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA) recognize that tribal-specific words may not be recognized by a word processor’s spell check software. Please feel free to use the tribal government language in describing names or programs that are within the tribe’s jurisdiction.

TCGP Cybersecurity Plan Template Instructions:

FEMA and CISA respect the sovereignty and self-determination of tribal governments and recognize the intent of Congress to provide flexibility to tribal governments to meet cybersecurity needs across Indian Country through the TCGP. The TCGP program elements were a result of nation-to-nation consultation with tribal representatives across the country and are intended to support tribal cybersecurity resiliency.

Section 2220A of the Homeland Security Act of 2002 requires a tribal government to have a Cybersecurity Plan meeting 13 required statutory elements, as determined by the CISA Director, to receive a grant under the TCGP. This Template is provided as an optional tool for eligible tribal governments to use to develop and submit their Cybersecurity Plans with their grant applications to help ensure their plans meet the 13 required statutory elements. Ultimately, tribal governments are encouraged to develop a plan that reflects their unique situation while meeting program requirements. This includes using existing plans and documents to the extent that any plans of the tribal government protect against cybersecurity risks and cybersecurity threats to information systems owned or operated by or on behalf of the tribal government.

Cybersecurity Plans are intended to be strategic in nature and do not represent a firm commitment to complete all associated activities in alignment with respective objectives within a given period of performance. Additionally, Cybersecurity Plans are intended to be living documents and a tribal government, following submission of its final plan in its grant application, may later update that plan. FEMA and CISA are available to provide technical assistance to tribal governments on Cybersecurity Plan development. Tribal governments can connect with their FEMA Preparedness Officer at FEMA-TCGP@fema.dhs.gov, if they need assistance with their grant application, and connect with their respective CISA Regional Cybersecurity Advisor or State Coordinator at iodregionaloperations@cisa.dhs.gov, if they need assistance with their cybersecurity plans and projects.

While a living document, the Template must have sufficient information for FEMA/CISA to conduct a meaningful discretionary review as part of the TCGP. Only one application will be submitted by the tribal government. The tribal government must include at least one Investment Justification, one Project Worksheet and its Cybersecurity Plan. The tribe’s Cybersecurity Plan can be either this completed Template form or can be a separate document as part of the overall application submission through the ND Grants system, located at https://portal.fema.gov/famsVuWeb/home, no later than MONTH, DAY, TIME, TIMEZONE.

DEPARTMENT OF HOMELAND SECURITY

Federal Emergency Management Agency

This draft Cybersecurity Plan Template should be used until the final form is approved by OMB

OMB Control Number: TBD Expiration date: TBD

By signing below, signatories confirm approval of the Cybersecurity Plan. Please ensure the signatory’s name matches the tribal Point of Contact (POC) information in the corresponding Investment Justification and Project Worksheet, as well. Either a physical or digital signature will suffice.

Required signatories:

1. Chief Information Officer (CIO), Chief Information Security Officer (CISO), or equivalent official to the CIO or CISO; and

2. Chair of the Cybersecurity Committee (or equivalent organization)

Print signatory name (CIO, CISO, or equivalent official to the CIO or CISO): ______________________________

Please sign here: X ________________________________

Print signatory name (Chair of Cybersecurity Committee or equivalent organization): ______________________________

Please sign here: X_________________________________

TCGP OBJECTIVES

Please select all TCGP Objectives that will be addressed and briefly describe how the tribal government will meet the Objective. For more information on the TCGP Objectives, please refer to NOFO section A(10).

☐ Objective 1 (REQUIRED) Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents and ensure continuity of operations:

☐ Objective 2 (OPTIONAL) Understand current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments:

☐ Objective 3 (OPTIONAL) Implement security protections commensurate with risk:

☐ Objective 4 (OPTIONAL) Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility:

13 CYBERSECURITY PLAN ELEMENTS

Please briefly describe, to the extent practicable, how the tribal government will meet the following required elements. Responses may be continued on a separate page attached to this form if needed.

1. Manage, monitor, and track information systems, applications, and user accounts owned or operated by the tribal government, and the information technology deployed on those information systems, including legacy information systems and information technology that are no longer supported by the manufacturer of the systems or technology:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Basic ☐ Intermediate ☐ Advanced

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

2. Monitor, audit, and track network traffic and activity transiting or traveling to or from information systems, applications, and user accounts owned or operated by, or on behalf of, the tribal government:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

3. Enhance the preparation, response, and resilience of information systems, applications, and user accounts owned or operated by, or on behalf of, the tribal government, against cybersecurity risks and cybersecurity threats

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

4. Implement a process of continuous cybersecurity vulnerability assessments and threat mitigation practices prioritized by degree of risk to address cybersecurity risks and cybersecurity threats on information systems, applications, and user accounts owned or operated by, or on behalf of, the tribal government

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

5. Ensure that tribal government adopts and uses best practices and methodologies to enhance cybersecurity

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

6. Promote the delivery of safe, recognizable, and trustworthy online services by the tribal government, including through the use of the .gov internet domain

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

7. Ensure continuity of operations of the tribal government, in the event of a cybersecurity incident, including by conducting exercises to practice responding to a cybersecurity incident

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

8. Use the National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity developed by National Institute of Science and Technology (NIST) to identify and mitigate any gaps in the cybersecurity workforce of the tribal government, enhance recruitment and retention efforts for that workforce, and bolster the knowledge, skills, and abilities of personnel of the tribal government, to address cybersecurity risks and cybersecurity threats, such as through cybersecurity hygiene training:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

9. Assess and mitigate, to the greatest degree possible, cybersecurity risks and cybersecurity threats relating to critical infrastructure and key resources, the degradation of which may impact the performance of information systems within the jurisdiction of the tribal government:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

10. Enhance capabilities to share cyber threat indicators and related information between the tribal government and CISA:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

11. Leverage cybersecurity services offered by the Department. See NOFO Appendix F for additional information on CISA resources and required services and membership:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

12. Implement an information technology and operational technology modernization cybersecurity review process that ensures alignment between information technology and operational technology cybersecurity objectives:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

13. Develop and coordinate strategies to address cybersecurity risks and cybersecurity threats:

Please check one of the below options to indicate the tribal government’s assessment of its current capabilities regarding the Cybersecurity Plan element.

☐ Intermediate

What metric(s) will the tribal government use to measure progress toward implementing this planning element?

Cybersecurity Planning Committee

☐ Please check this box to confirm that the tribal government has either established a new Cybersecurity Planning Committee or is adapting an existing tribal body to serve as its Cybersecurity Planning Committee. If the latter, please provide the name of that body here: _______________________________

Previously, FEMA and CISA hosted tribal consultations during which tribal governments noted the complications caused by the Cybersecurity Planning Committee requirement, to include a structure that does not account for the diversity of organizations within the Federally Recognized tribes. Therefore, the Tribal Cybersecurity Planning Committee requirement can be met by an existing Tribal Council/Governing Body that includes the participation of a designated Chief Information Officer (CIO or CIO-equivalent/person with expertise in information technology (IT) and systems. The CIO or CIO-equivalent/person is one who fulfills the duties of the CIO, even if their job includes other duties and responsibilities. If the tribal government would prefer to establish a separate Cybersecurity Planning Committee, the required members of that committee should include the following: the grants administration office and a designated CIO or CIO-equivalent/person with expertise in IT and systems. Additional members are encouraged but not required.

If the Cybersecurity Planning Committee is not be adapted from one that already exists within the applicant tribal organization, please describe how the applicant is meeting the Cybersecurity Planning Committee Requirement below.

Please provide a brief outline, to the extent practicable, of the required resources and implementation timeline for the Cybersecurity Plan.

☐ Required Resources: _______________________________

☐ Brief Implementation Timeline: ______________________________