Item 35 - FY 2022 Emergency Management Performance Grant

Home Browse Search

THSGP Appendix | 2023 Page B-13 Framework for Improving Critical Infrastructure Cybersecurity When requesting funds for cybersecurity, applicants are encouraged to propose projects that would aid in implementation of all or part of the Framework for Improving Critical Infrastructure Cybersecurity (the “Framework”) developed by the National Institute of Standards and Technology (NIST). The Framework gathers existing international standards and practices to help organizations understand, communicate, and manage their cyber risks. For organizations that do not know where to start with developing a cybersecurity program, the Framework provides initial guidance. For organizations with more advanced practices, the Framework offers a way to improve their programs, such as better communication with their leadership and suppliers about management of cyber risks. CISA’s Critical Infrastructure Cyber Community C³ Voluntary Program also provides resources to critical infrastructure owners and operators to assist in adoption of the Framework and managing cyber risks. Additional information on the Critical Infrastructure Cyber Community C³ Voluntary Program can be found at http://www.cisa.gov/ccubedvp. DHS’s Enhanced Cybersecurity Services (ECS) program is an example of a resource that assists in protecting U.S.-based public and private entities and combines key elements of capabilities under the “Detect” and “Protect” functions to deliver an impactful solution relative to the outcomes of the Cybersecurity Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and SLTT governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from sensitive and classified Government Furnished Information (GFI). DHS then shares those indicators with accredited Commercial Service Providers (CSPs). Those CSPs in turn use the indicators to block certain types of malicious traffic from entering a company’s networks. Groups interested in subscribing to ECS must contract directly with a CSP in order to receive services. Please visit Enhanced Cybersecurity Services (ECS) | CISA for a current list of ECS CSP points of contact. THSGP Investment Modifications – Changes in Scope or Objective Changes in scope or objective of the award—including those resulting from intended actions by the recipient or subrecipients—require FEMA’s prior written approval, in accordance with 2 C.F.R. §§ 200.308(c)(1), 200.407. THSGP is competitive, with applications recommended for funding based on threat, vulnerability, and consequence, and their mitigation of potential terrorist attacks. However, consistent with 2 C.F.R § 200.308(c)(1), Change in Scope Prior Approval, FEMA requires prior approval of any change in scope or objective of the grant-funded activity after the award is issued. See 2 C.F.R. § 200.308(b), (c). Scope or objective changes will be considered on a case-by-case basis, provided the change does not negatively impact the competitive process used to recommend THSGP awards. Requests to change the scope or objective of the grant-funded activity after the award is made must be submitted via ND Grants as a Scope Change Amendment. The amendment request must include the following: •A written request on the recipient’s letterhead, outlining the scope or objective change , including the approved projects from the IJ, the funds and relative scope or objective significance allocated to those projects, the proposed changes, and any resulting reallocations as a result of the change of scope or objective; •An explanation why the change of scope or objective is necessary; •How the proposed scope or objective changes to the project support the vulnerabilities and capability gaps identified in the approved IJ; and