CISA Cyber Security Awareness Campaign

CISA's mission is to lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. In carrying out this mission, Section 2202 of the Homeland Security Act of 2002 assigns CISA with the responsibilities to c

In carrying out its mission and pursuant to its authorities, CISA provides financial assistance under the CAC Program to non-federal entities to perform cybersecurity awareness activities to reduce cybersecurity risks through messaging, tools, and resources to encourage individuals and organizations to reduce their exposure to malicious cyber activity. Through strategies implemented year-round with a focal point of Cybersecurity Awareness Month in October, a recipient under a federal cooperative agreement award will engage in efforts to improve the public's understanding of cyber threats, amplify opportunities that individuals and non-federal entities can leverage to strengthen their own cybersecurity posture, and encourage discussion, engagement, and actions that can be taken to reduce cyber risk.

Nonprofit organizations, other than institutions of higher education, with an effective ruling letter from the U.S. Internal Revenue Service granting tax exemption under Section 501(c)(3) of the Internal Revenue Code of 1986 A recipient under the Cybersecurity Awareness Campaign Program must be a nonprofit organization with an effective ruling letter from the U.S. Internal Revenue Service granting tax exemption under Section 501(c)(3) of the Internal Revenue Code of 1986. A "nonprofit organization" means any organization that: (1) is operated primarily for scientific, educational, service, charitable, or similar purposes in the public interest; (2) is not organized primarily for profit; (3) uses net proceeds to maintain, improve, or expand the organization's operations; and (4) is not an institution of higher education as defined at 20 U.S.C. § 1001.

Individuals, businesses, states, local governments, Indian tribes, institutions of higher education, and nonprofit organizations The beneficiaries of a Cybersecurity Awareness Campaign cooperative agreement award are the individuals and non-federal entities that will experience the benefits of the information provided by a recipient through its cybersecurity awareness activities. As these activities are intended to reach all individuals and non-federal entities in the United States, the beneficiaries include individuals, businesses, states, local governments, Indian tribes, institutions of higher education, and nonprofit organizations

The CAC Program provides financial assistance for a nonprofit organization to carry out public awareness activities concerning cybersecurity risks and messaging, tools, and resources to encourage individuals and non-federal entities to reduce their exposure to malicious cyber activity.

The period of performance for a cooperative agreement award under the Cybersecurity Awareness Campaign Program is typically two to three years and comprised of separate budget periods that CISA will fund individually. CISA will provide funding for only the initial budget period at the time of initial award and may issue continuation funding for subsequent budget periods. Funding for subsequent budget periods is conditioned on the availability of funds, satisfactory performance by the recipient, program authority, compliance with the terms and conditions of the federal award, and a CISA determination that continued funding is in the best interests of the federal government. A recipient may only expend funding during the budget period for which CISA has issued funding unless CISA authorizes the recipient to carry forward unexpended funding into a subsequent budget period. CISA makes payments for federal awards in accordance with 2 C.F.R. § 200.305(b). Under this payment process, CISA makes the federal funds available to a recipient in the U.S. Department of Health and Human Services Payment Management System ("PMS") at the time of the federal award (or time of continuation funding) and the recipient draws down funds on the advance payment, reimbursement, or working capital advance method.

Intergovernmental review under Executive Order 12372, Intergovernmental Review of Federal Programs (1982) (as amended) may be required.

The Notice of Funding Opportunity will set forth the criteria that CISA will use in evaluating and scoring applications. These criteria include program design and rationale; project management and organizational capability; demonstrated experience and past performance; and project plan and budget. CISA will also review information about an applicant through any OMB-designated repositories of governmentwide eligibility qualification or financial integrity information as required by 31 U.S.C. § 3354 (enacted by the Payment Integrity Information Act of 2019, Pub. L. No. 116-117, § 2 (2020)), 41 U.S.C. § 2313, and 2 C.F.R. § 200.206. Therefore, evaluation criteria will include risk-based considerations concerning an applicant's financial stability, quality of management systems and ability to meet management standards, history of performance in managing federal awards, reports and findings from audits, and ability to effectively implement statutory, regulatory, or other requirements. CISA, in cases where the project federal award exceeds the simplified acquisition threshold (currently $250,000), is also required by 41 U.S.C. § 2313 and 2 C.F.R. § 200.206 to review and consider any information about the applicant in the Federal Awardee Performance and Integrity Information System.

CISA/DHS communicates the Notices of Award to recipients for which CISA/DHS has made a cooperative agreement award. Payments to a recipient under the cooperative agreement award are made via an electronic system as detailed above in the Length and Time Phasing of Assistance section. A recipient may not contract out or subaward any work under the federal award unless described in the application and funded in the approved cooperative agreement award or approved by CISA after the cooperative agreement award. There is no negotiation of any terms and conditions or any other parts of the cooperative agreement award communicated to the recipient in the Notice of Award.

The Notice of Funding Opportunity will identify the open application period and deadline for applying for a Cybersecurity Awareness Campaign Program cooperative agreement. The application period is generally at least 61 days and extends from on or about May 1 to July 1. As it relates to the deadline for a recipient under an existing cooperative agreement to request funding for an additional budget period, CISA will notify the recipient as to the availability of continuation funding for an additional budget period on or about July 1 and, if making such funds available, will provide the recipient with 60 days to submit its continuation funding request.

The range of time required for CISA to process applications for a federal award is approximately 30-60 days. CISA will communicate all Notices of Awards on or before September 30.

CISA may issue continuation funding for the second and subsequent budget periods falling within the period of performance of a cooperative agreement award. Upon the end of the period of performance for a cooperative agreement award, CISA does not make renewal awards.

There are no appeal rights for applicants that CISA does not select for a federal award. An unsuccessful applicant may request an informal debriefing and CISA may, in its sole discretion, elect to provide such a debriefing. As it relates to recipients of a federal award, the regulation at 2 C.F.R. § 200.342 requires CISA to provide a recipient an opportunity to appeal any remedy for non-compliance taken by CISA pursuant to 2 C.F.R. § 200.339. There are no other recipient appeal rights. For example, a recipient has no right to appeal the amount of a federal award, denial of a period of performance extension request, or denial of a budget change request.