Item 35 - FY 2022 Emergency Management Performance Grant

Home Browse Search

PSGP Program Appendix | 2023 Page G-9 public and private entities and combines key elements of capabilities under the “Detect” and “Protect” functions to deliver an impactful solution relative to the outcomes of the Cybersecurity Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and SLTT governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from sensitive and classified Government Furnished Information (GFI). DHS then shares those indicators with accredited Commercial Service Providers (CSPs). Those CSPs in turn use the indicators to block certain types of malicious traffic from entering a company’s networks. Groups interested in subscribing to ECS must contract directly with a CSP in order to receive services. Please visit http://www.cisa.gov/enhanced-cybersecurity-services-ecs for a current list of ECS CSP points of contact. “Hub and spoke” cybersecurity projects are allowable under PSGP for cybersecurity projects that span multiple port area facilities. Hub and spoke cybersecurity projects may affect a parent organization’s multiple eligible entities, and maritime security partners, in multiple port areas to provide a port-wide benefit. Such projects may be submitted within a primary Port Area for the project implementation. For example, an applicant in the Port of Houston may submit a hub and spoke project within the Houston/Galveston port area which includes system hardening throughout the organization’s facilities in Houston, Port Lavaca, and Corpus Christi. Proportionally, costs associated with entities or subcomponents that are not covered under an AMSP and are not instrumental to enhancing maritime security must not be included in the detailed budget worksheet or investment justification and thereby prorating the cost of the project only to those facilities that are covered by the AMSP. Following the example noted above, the applicant may not include costs associated with cybersecurity of their non-maritime facilities, such as a non-MTSA regulated facility located in San Antonio. Hub and spoke projects are limited only to the enhancement of maritime security as outlined in this section and may not include non-maritime systems or facilities. Please clearly identify hub and spoke projects as such within your IJ and consult your COTP to verify project applicability to enhancing maritime security. Cybersecurity projects should address risks to the marine transportation system and/or Transportation Security Incidents (TSIs) outlined in the applicable AMSP, or priorities prescribed under applicable FSP or VSP, as mandated under the MTSA or the PRMPs. At the port level, examples of cybersecurity projects include but are not limited to projects that enhance the cybersecurity of access control , sensors, security cameras, badge/ID readers, ICS/SCADA systems, process monitors and controls (such as those that monitor flow rates, valve positions, tank levels, etc.), security/safety of the ship-to-port-to-facility-to- intermodal interface, and systems that control vital cargo machinery at the ship/shore interface (such as cranes, manifolds, loading arms, etc.), and passenger/vehicle/cargo security screening equipment. Vulnerability assessments are generally not funded under PSGP. However, considering the evolving malicious cyber activity, the relative novelty of cybersecurity as a priority within the program, and the need to adopt best practices included in the voluntary Cybersecurity Framework, vulnerability assessments may be funded as contracted costs. Port-wide assessments are eligible and must demonstrate that the assessment includes port area partners and are necessary to be completed as a single project to ensure a comprehensive evaluation of port area cyber security vulnerabilities. Personnel costs (other than M&A) are not an allowable expense for conducting these assessments. CISA offers free resources to assist with initial assessments, please see https://www.cisa.gov/cyber- resource-hub for additional information. Applicants are encouraged to utilize free resources prior to requesting funds under this program. Copies of completed cybersecurity assessments funded under PSGP that impact the maritime transportation system, lead to a “transportation security incident” (as that term is defined under 46 U.S.C. § 70101(6)), or are otherwise related to systems, personnel, and procedures addressed by the