Item 35 - FY 2022 Emergency Management Performance Grant

Home Browse Search

IBSGP Appendix | 2023 Page E-4 Cybersecurity Projects IBSGP funds may be used for projects that enhance the cybersecurity of: •Access controls; sensors; security cameras; badge/ID readers; ICS/SCADA systems; process monitors and controls (such as firewalls, network segmentation, predictive security cloud, etc.). CCTV Systems that are primarily archival, and do not clearly specify the ability for live monitoring in the IJ will not be funded; and •Passenger/vehicle/cargo security screening equipment (cybersecurity assessments are allowable). When requesting funds for cybersecurity, applicants are encouraged to propose projects that would aid in implementation of all or part of the Framework for Improving Critical Infrastructure Cybersecurity (“The Framework”) developed by the National Institute of Standards and Technology (NIST). The Framework gathers existing international standards and practices to help organizations understand, communicate, and manage their cyber risks. For organizations that do not know where to start with developing a cybersecurity program, the Framework provides initial guidance. For organizations with more advanced practices, the Framework offers a way to improve their programs, such as better communication with their leadership and suppliers about management of cyber risks. The Cybersecurity and Infrastructure Security Agency’s (CISA) Critical Infrastructure Cyber Community C³ Voluntary Program also provides resources to critical infrastructure owners and operators to assist in adoption of the Framework and managing cyber risks. Additional information on the Critical Infrastructure Cyber Community C³ Voluntary Program can be found at http://www.cisa.gov/ccubedvp. DHS’s Enhanced Cybersecurity Services (ECS) program is an example of a resource that assists in protecting U.S.-based public and private entities and combines key elements of capabilities under the “Detect” and “Protect” functions to deliver an impactful solution relative to the outcomes of the Cybersecurity Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and state, local, tribal, and territorial (SLTT) governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from sensitive and classified Government Furnished Information (GFI). DHS then shares those indicators with accredited Commercial Service Providers (CSPs). Those CSPs in turn use the indicators to block certain types of malicious traffic from entering a company’s networks . Groups interested in subscribing to ECS must contract directly with a CSP in order to receive services. Please visit Enhanced Cybersecurity Services (ECS) | CISA for a current list of ECS CSP points of contact. Capital (Construction) Projects Guidance Recipients must obtain written approval from FEMA prior to the use of any IBSGP funds for construction or renovation projects. When applying for construction funds, including communications towers, at the time of application, recipients must submit evidence of approved zoning ordinances, architectural plans, any other locally required planning permits. Additionally, recipients are required to submit a SF-424C and budget detail citing the project costs and an SF-424D Form for standard assurances for the construction project. All Capital (Construction) projects require Environmental Planning and Historic Preservation (EHP) review. Recipients are also encouraged to have completed as many steps as possible for a successful EHP review in support of their proposal for funding (e.g., coordination with their State Historic Preservation Office to identify potential historic preservation issues and to discuss the potential for project effects; compliance with all state and EHP laws and requirements).