Item 35 - FY 2022 Emergency Management Performance Grant

Home Browse Search

IPR Appendix | 2023 Page F-8 Acquisition and Use of Technology to Mitigate UAS (Counter-UAS) In August 2020, FEMA was alerted you of an advisory guidance document issued by DHS, the Department of Justice, the Federal Aviation Administration, and the Federal Communications Commission: https://www.dhs.gov/publication/interagency-legal-advisory-uas-detection-and-mitigation- technologies. The purpose of the advisory guidance document is to help non-federal public and private entities better understand the federal laws and regulations that may apply to the use of capabilities to detect and mitigate threats posed by UAS operations (i.e., Counter-UAS or C-UAS). The Departments and Agencies issuing the advisory guidance document, and FEMA, do not have the authority to approve non-federal public or private use of UAS detection or mitigation capabilities, nor do they conduct legal reviews of commercially available product compliance with those laws. The advisory does not address state and local laws nor potential civil liability, which UAS detection and mitigation capabilities may also implicate. It is strongly recommended that, prior to the testing, acquisition, installation, or use of UAS detection and/or mitigation systems, entities seek the advice of counsel experienced with both federal and state criminal, surveillance, and communications laws. Entities should conduct their own legal and technical analysis of each UAS detection and/or mitigation system and should not rely solely on vendors’ representations of the systems’ legality or functionality. Please also see the DHS press release on this topic for further information: https://www.dhs.gov/news/2020/08/17/interagency-issues-advisory-use- technology-detect-and-mitigate-unmanned-aircraft. Cybersecurity Projects IPR funds may be used for projects that enhance the cybersecurity of: •Access controls, sensors; security cameras, badge/ID readers, ICS/SCADA systems, process monitors and controls (such as firewalls, network segmentation, predictive security cloud, etc.); and •Passenger/vehicle/cargo security screening equipment (cybersecurity assessments are allowable). When requesting funds for cybersecurity, applicants are encouraged to propose projects that would aid in implementation of all or part of the Framework for Improving Critical Infrastructure Cybersecurity (the “Framework”), developed by the National Institute of Standards and Technology (NIST). The Framework gathers existing international standards and practices to help organizations understand, communicate, and manage their cyber risks. For organizations that do not know where to start with developing a cybersecurity program, the Framework provides initial guidance. For organizations with more advanced practices, the Framework offers ways to improve their programs, such as through better communication with their leadership and suppliers about management of cyber risks. The Cybersecurity and Infrastructure Security Agency’s (CISA) Critical Infrastructure Cyber Community C³ Voluntary Program also provides resources to critical infrastructure owners and operators to assist in adoption of the Framework and managing cyber risks. Additional information on the Critical Infrastructure Cyber Community C³ Voluntary Program can be found at www.cisa.gov/ccubedvp. DHS’s Enhanced Cybersecurity Services (ECS) program is an example of a resource that assists in protecting U.S.-based public and private entities and combines key elements of capabilities under the “Detect” and “Protect” functions to deliver an impactful solution relative to the outcomes of the Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and SLTT governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from