Item 36 - Resolution, Agreement, and Appropriation Adjustment Accepting the FY 2023 Emergency Management Performance Grant

Home Browse Search

Framework for Improving Critical Infrastructure Cybersecurity When requesting funds for cybersecurity, applicants are encouraged to propose projects that would aid in implementation of all or part of the Framework for Improving Critical Infrastructure Cybersecurity (the " F r a me wo r k " ) d e v e l o p e d b y t h e Na t i o n a l I n s t i t u t e gathers existing international standards and practices to help organizations understand, communicate, and manage their cyber risks. For organizations that do not know where to start with developing a cybersecurity program, the Framework provides initial guidance. For organizations with more advanced practices, the Framework offers a way to improve their programs, such as better communication with their leadership and suppliers about management of cyber risks. CISA's Critical Infrastructure C y b e r Community C3 infrastructure owners and operators to assist in adoption of the Framework and managing cyber risks. Additional information on the Critical Infrastructure Cyber Community C3 Voluntary Program can be found at http://www.cisa.gov/ccubedvp. D H S' s E n h a n c e d C y b e r s e cur i t y e cff&resour�edhat assists iE C S) protecting U.S.-based public and private entities and combines key elements of capabilities under the " De t e c t" a n d " P r o t e c t" f u n c t i o n s t o d e l i v e r Cybersecurity Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and SLTT governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from sensitive and classified Government Furnished Information (GFI). DHS then shares those indicators with accredited Commercial Service Providers (CSPs). Those CSPs in turn use the indicators to block certain types of malicious t r a f f i c f r o m e n t e r i n g a c o m p a n subscribing to ECS must contract directly with a CSP in order to receive services. Please visit Enhanced Cybersecurity Services (ECS) CISA for a current list of ECS CSP points of contact. THSGP Investment Modifications — Changes in Scope or Objective Changes in scope or objective of the award —including those resulting from intended actions by the recipient or subrecipientsr e q u i r e F E MA' s p r i o r w r i t t e n a p p 200.308(c)(1), 200.407. THSGP is competitive, with applications recommended for funding based on threat, vulnerability, and consequence, and their mitigation of potential terrorist attacks. However, consistent with 2 C.F.R § 200.308(c)(1), Change in Scope Prior Approval, FEMA requires prior approval of any change in scope or objective of the grant -funded activity after the award is issued. See 2 C.F.R. § 200.308(b), (c). Scope or objective changes will be considered on a case -by -case basis, provided the change does not negatively impact the competitive process used to recommend THSGP awards. Requests to change the scope or objective of the grant -funded activity after the award is made must be submitted via ND Grants as a Scope Change Amendment. The amendment request must include the following: A w r i t t e n r e q u e s t o n t h e r e c i p i e n t', including t the approved projects from the IJ, the funds and relative scope or objective significance allocated to those projects, the proposed changes, and any resulting reallocations as a result of the change of scope or objective; An explanation why the change of scope or objective is necessary; How the proposed scope or objective changes to the project support the vulnerabilities and capability gaps identified in the approved IJ; and p r o g a n y' s n o v a 1 t e r h e ��Nos��. e �� FEMA THSGP Appendix 12023 Page B-13