Cybersecurity Education and Training

Section 2220 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665f0) establishes the CETAP within CISA. The statutory purpose of CETAP is to support CISA's efforts in building and strengthening a national cybersecurity workforc

The nature of the cybersecurity threat to America is growing and our nation's cyber adversaries move with speed and stealth. In alignment with the Department of Homeland Security's Strategic Plan for Fiscal Years 2020-2024, it is imperative to not only secure cyberspace and critical infrastructure (Goal 3), but also strengthen the security and resilience of critical infrastructure (Objective 3.2). We must, therefore, support the educational development of cybersecurity talent needed to participate as members of the security community working to ensure a safe and secure nation. Section 2220 of the Homeland Security Act of 2002 (codified as amended at 6 U.S.C. § 665f) establishes a Cybersecurity Education and Training Assistance Program within CISA. The purpose of the CETAP is to support the Cybersecurity and Infrastructure Security Agency's (CISA) efforts in building and strengthening a national cybersecurity workforce pipeline capacity through enabling elementary and secondary cybersecurity education, including by providing foundational cybersecurity awareness and literacy, encouraging cybersecurity career exploration, and supporting the teaching of cybersecurity skills at the elementary and secondary education levels. To fund these cybersecurity and infrastructure security education and training programs and initiatives, Section 2220 authorizes CISA to award financial assistance in the form of cooperative agreements and grants to carry out the purposes of the CETAP and enhance CETAP to address the national shortfalls of cybersecurity professionals. To accomplish the stated goals in Section 2220, CISA provides financial assistance to non-federal entities to develop cybersecurity curriculum and professional development opportunities focused on K-12 students and their educators, administrators, and caregivers and engage in outreach efforts to increase cybersecurity awareness within that K-12 community.

Nonprofit organizations, other than institutions of higher education Nonprofit organizations are eligible applicants under the CETAP. A "nonprofit organization" means any organization that: (1) is operated primarily for scientific, educational, service, charitable, or similar purposes in the public interest; (2) is not organized primarily for profit; (3) uses net proceeds to maintain, improve, or expand the organization's operations; and (4) is not an institution of higher education as defined at 20 U.S.C. § 1001. A nonprofit organization may or may not have an effective ruling letter from the U.S. Internal Revenue Service granting tax exemption under Section 501(c)(3) of the Internal Revenue Code of 1986.

K-12 students, their caregivers, K-12 educators, K-12 administrators, school districts, public and non-profit elementary and secondary schools, and non-profit organizations The individuals and organizations that are intended to experience the benefits of the CETAP cooperative agreement awards include K-12 students, their caregivers, K-12 educators, K-12 administrators, school districts, and nonprofit organizations (such as an after-school program) that create, maintain, and/or support cybersecurity curriculum development and K-12 classroom implementation. There are some elements of the scope of work under a cooperative agreement award that will benefit these individuals and organizations in all states and territories (such as cybersecurity curriculum) and other elements that will benefit individuals and/or organizations in a specific geographical area (such as partnering with a specific school to assist with the inclusion of cybersecurity education in that school's curriculum)

Education; Elementary and Secondary The CETAP provides financial assistance for a non-profit organization to develop cybersecurity curriculum and professional development opportunities for K-12 students and their educators, administrators, and caregivers and engage in outreach to increase cybersecurity education awareness within that K-12 community. The eligible work under a cooperative agreement may include: drafting and implementing a written engagement and retention strategy specifying how the applicant will achieve all program objectives; creating and maintaining K-12 cybersecurity curriculum; developing marketing and outreach efforts to increase awareness of cybersecurity in the K-12 community; and creating professional development opportunities.

Please refer to opportunity.

A CETAP cooperative agreement award will have a 5-year period of performance comprised of five 1-year budget periods that CISA will fund individually. CISA will provide funding for only the first budget period at the time of initial award and may issue continuation funding for subsequent budget periods. Funding for subsequent budget periods is conditioned on the availability of funds, satisfactory performance by the recipient, program authority, compliance with the terms and conditions of the federal award, and a CISA determination that continued funding is in the best interests of the federal government. A recipient may only expend funding during the 1-year budget period for which CISA has issued funding unless CISA authorizes the recipient to carry forward unexpended funding into a subsequent budget period.

Intergovernmental review under Executive Order 12372, Intergovernmental Review of Federal Programs (1982) (as amended) may be required.

The Notice of Funding Opportunity will set forth the criteria that CISA will use in evaluating and scoring the budget and program narratives. As it relates to the program narrative, CISA will evaluate the applicant's capability to implement the CETAP objectives. This will include scoring information provided about the organization, communities served, past performance, proposed design, management strategy, and work plan. As it relates to the budget narrative, CISA will evaluate how well the applicant has allocated funds to each eligible activity and described the use of that funding. This will include scoring information provided about the planning, personal and contractual, delivery, and equipment purchase costs. CISA will also review information about an applicant through any OMB-designated repositories of governmentwide eligibility qualification or financial integrity information as required by 31 U.S.C. § 3354 (enacted by the Payment Integrity Information Act of 2019, Pub. L. No. 116-117, § 2 (2020)), 41 U.S.C. § 2313, and 2 C.F.R. § 200.206. Therefore, evaluation criteria will include risk-based considerations concerning an applicant's financial stability, quality of management systems and ability to meet management standards, history of performance in managing federal awards, reports and findings from audits, and ability to effectively implement statutory, regulatory, or other requirements. CISA, in cases where the project federal award exceeds the simplified acquisition threshold (currently $250,000), is also required by 41 U.S.C. § 2313 and 2 C.F.R. § 200.206 to review and consider any information about the applicant in the Federal Awardee Performance and Integrity Information System.

CISA/DHS communicates the Notices of Award to recipients for which CISA/DHS has made a cooperative agreement award. Payments to a recipient under the cooperative agreement award are made via an electronic system as detailed above in the Length and Time Phasing of Assistance section. A recipient may not contract out or subaward any work under the federal award unless described in the application and funded in the approved cooperative agreement award or approved by CISA after the cooperative agreement award. There is no negotiation of any terms and conditions or any other parts of the cooperative agreement award communicated to the recipient in the Notice of Award.

Deadlines The Notice of Funding Opportunity will detail the open application period and deadline for applying for a cooperative agreement under the CETAP. For planning purposes, the open application period for the CETAP is generally 61 days and extends from on or about May 1 to July 2. As it relates to requesting funding for additional budget periods, CISA will notify an incumbent recipient as to the availability of continuation funding for an additional budget period on or around May 1 and, if making such funding available, provide the recipient with 60 days to submit its continuation funding request

The range of time required for CISA to process applications for a federal award is approximately 30-60 days. CISA will communicate all Notices of Awards on or before September 30.

CISA may issue continuation funding for the second and subsequent budget periods falling within the period of performance of a cooperative agreement award. Upon the end of the period of performance for a cooperative agreement award, CISA does not make renewal awards.

There are no appeal rights for applicants that CISA does not select for a federal award. An unsuccessful applicant may request an informal debriefing and CISA may, in its sole discretion, elect to provide such a debriefing. As it relates to recipients of a federal award, the regulation at 2 C.F.R. § 200.342 requires CISA to provide a recipient an opportunity to appeal any remedy for non-compliance taken by CISA pursuant to 2 C.F.R. § 200.339. There are no other recipient appeal rights. For example, a recipient has no right to appeal the amount of a federal award, denial of a period of performance extension request, or denial of a budget change request.