Item 18 - Adopt Resolution for FY 2021 Emergency Management Performance Grant

Home Browse Search

PSGP Appendix | February 2021 Page G-8 gathers existing international standards and practices to help organizations understand, communicate, and manage their cyber risks. For organizations that do not know where to start with developing a cybersecurity program, the Framework provides initial guidance. For organizations with more advanced practices, the Framework offers a way to improve their programs, such as better communication with their leadership and suppliers about management of cyber risks. The Cybersecurity and Infrastructure Security Agency’s (CISA) Critical Infrastructure Cyber Community C³ Voluntary Program also provides resources to critical infrastructure owners and operators to assist in adoption of the Framework and managing cyber risks. Additional information on the Critical Infrastructure Cyber Community C³ Voluntary Program can be found at www.cisa.gov/ccubedvp. DHS’s Enhanced Cybersecurity Services (ECS) program is an example of a resource that assists in protecting U.S.-based public and private entities and combines key elements of capabilities under the “Detect” and “Protect” functions to deliver an impactful solution relative to the outcomes of the Cybersecurity Framework. Specifically, ECS offers intrusion prevention and analysis services that help U.S.-based companies and SLTT governments defend their computer systems against unauthorized access, exploitation, and data exfiltration. ECS works by sourcing timely, actionable cyber threat indicators from sensitive and classified Government Furnished Information (GFI). DHS then shares those indicators with accredited Commercial Service Providers (CSPs). Those CSPs in turn use the indicators to block certain types of malicious traffic from entering a company’s networks. Groups interested in subscribing to ECS must contract directly with a CSP in order to receive services. Please visit http://www.cisa.gov/enhanced- cybersecurity-services for a current list of ECS CSP points of contact. “Hub and spoke” cybersecurity projects are allowable under PSGP for cybersecurity projects that span multiple port area facilities. Hub and spoke cybersecurity projects may affect a parent organization’s multiple eligible entities in multiple port areas. Such projects may be submitted within a primary Port Area for the project implementation. For example, an applicant in the Port of Houston may submit a hub and spoke project within the Houston/Galveston port area which includes system hardening throughout the organization’s facilities in Houston, Port Lavaca and Corpus Christi. Proportionally, costs associated with entities or subcomponents that are not covered under an AMSP and are not instrumental to enhancing maritime security must not be included in the detailed budget worksheet or investment justification and thereby prorating the cost of the project only to those facilities that are covered by the AMSP. Following the example noted above, the applicant may not include costs associated with cybersecurity of their non-maritime facilities, such as a non-MTSA regulated facility located in San Antonio. Hub and spoke projects are limited only to the enhancement of maritime security as outlined in this section and may not include non-maritime systems or facilities. Please clearly identify hub and spoke projects as such within your IJ and consult your COTP to verify project applicability to enhancing maritime security. Cybersecurity projects should address risks to the marine transportation system and/or Transportation Security Incidents (TSIs) outlined in the applicable AMSP or priorities prescribed under applicable FSP or VSP, as mandated under the MTSA or the PRMPs. At the port level, examples of cybersecurity projects include but are not limited to projects that enhance the cybersecurity of access control, sensors, security cameras, badge/ID readers, ICS/SCADA systems, process monitors and controls (such as those that monitor flow rates, valve positions, tank levels, etc.), security/safety of the ship-to-port-to- facility-to-intermodal interface, and systems that control vital cargo machinery at the ship/shore interface (such as cranes, manifolds, loading arms, etc.), and passenger/vehicle/cargo security screening equipment. Vulnerability assessments are generally not funded under PSGP. However, considering the evolving malicious cyber activity, the relative novelty of cybersecurity as a priority within the program, and the need to adopt best practices included in the voluntary Cybersecurity Framework, vulnerability