1 

The Department of Homeland Security (DHS)

Notice of Funding Opportunity (NOFO)

Fiscal Year 2023 Homeland Security National Training Program

Continuing Training Grants (CTG)

National Cybersecurity Preparedness Consortium (NCPC)

All entities wishing to do business with the Federal government must have a unique entity 

identifier (UEI). The UEI number is issued by the SAM system. Requesting a UEI using 

SAM.gov can be found at: https://sam.gov/content/entity-registration.

Grants.gov registration information can be found at: 

https://www.grants.gov/web/grants/register.html. 

Planned UEI Updates in Grant Application Forms:

On April 4, 2022, the Data Universal Numbering System (DUNS) Number was replaced 

by a new, non-proprietary identifier requested in, and assigned by, the System for Award 

Management (SAM.gov). This new identifier is the Unique Entity Identifier (UEI).

Additional Information can be found on Grants.gov: 

https://www.grants.gov/web/grants/forms/planned-uei-updates.html

Table of Contents

Planned UEI Updates in Grant Application Forms:................................................................ 1

A. Program Description................................................................................................................ 5

1. Issued By.......................................................................................................................... 5

2. Assistance Listings Number ............................................................................................ 5

3. Assistance Listings Title .................................................................................................. 5

4. Funding Opportunity Title ............................................................................................... 5

5. Funding Opportunity Number.......................................................................................... 5

6. Authorizing Authority for Program ................................................................................. 5

7. Appropriation Authority for Program.............................................................................. 5

8. Announcement Type........................................................................................................ 5

9. Program Category ............................................................................................................ 5

10. Program Overview, Objectives, and Priorities ................................................................ 5

11. Performance Measures..................................................................................................... 8

B. Federal Award Information ..................................................................................................... 8

1. Available Funding for the NOFO: $8 million................................................................. 8

2. Projected Number of Awards 1..................................................................................... 8

3. Maximum Award Amount: $8 million .......................................................................... 8

4. Period of Performance: 36 months .............................................................................. 8

5. Projected Period of Performance Start Date(s): 09/01/2023........................................... 9

6. Projected Period of Performance End Date(s): 08/31/2026............................................ 9

7. Funding Instrument Type: Cooperative Agreement .................................................... 9

C. Eligibility Information............................................................................................................. 9
2

1. Eligible Applicants........................................................................................................... 9

2. Applicant Eligibility Criteria ........................................................................................... 9

a. National Incident Management System (NIMS) Implementation .............................. 9

3. Cost Share or Match....................................................................................................... 10

D. Application and Submission Information.............................................................................. 10

1. Key Dates and Times..................................................................................................... 10

a. Application Start Date: 5/26/2023 ........................................................................... 10

b. Application Submission Deadline: 6/27/2023 ......................................................... 10

c. Anticipated Funding Selection Date: No later than 9/1/2023 ............................. 11

d. Anticipated Award Date: No later than 9/30/2023.............................................. 11

e. Other Key Dates........................................................................................................ 11

2. Agreeing to Terms and Conditions of the Award.......................................................... 11

3. Address to Request Application Package ...................................................................... 11

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for

Award Management (SAM) .......................................................................................... 11

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award

Management (SAM), and Submit an Application ......................................................... 12

6. Electronic Delivery ........................................................................................................ 13

7. How to Register to Apply .............................................................................................. 13

a. General Instructions: ................................................................................................. 13

b. Obtain an UEI Number: ............................................................................................ 13

c. Obtain Employer Identification Number................................................................... 14

d. Create a login.gov account:....................................................................................... 14

e. Register with SAM:................................................................................................... 14

f. Register in FEMA GO, Add the Organization to the System, and Establish the AOR:

15

g. Add a Profile to a Grants.gov Account: .................................................................... 15

h. EBiz POC Authorized Profile Roles: ........................................................................ 15

i. Track Role Status: ..................................................................................................... 16

j. Electronic Signature: ................................................................................................. 16

8. Submitting the Final Application................................................................................... 16

9. Timely Receipt Requirements and Proof of Timely Submission .................................. 16

10. Content and Form of Application Submission............................................................... 17

a. Standard Required Application Forms and Information ........................................... 17

11. Intergovernmental Review............................................................................................. 17

12. Funding Restrictions and Allowable Costs.................................................................... 17

a. Prohibitions on Expending FEMA Award Funds for Covered Telecommunications

Equipment or Services................................................................................................... 18

b. Pre-Award Costs........................................................................................................ 19

c. Management and Administration (M&A) Costs....................................................... 19

d. Indirect Facilities & Administrative (F&A) Costs.................................................... 19

E. Application Review Information........................................................................................... 20

1. Application Evaluation Criteria ..................................................................................... 20

a. Programmatic Criteria ............................................................................................... 20

b. Financial Integrity Criteria ........................................................................................ 20

c. Supplemental Financial Integrity Criteria and Review ............................................. 20
3

2. Review and Selection Process ....................................................................................... 21

F. Federal Award Administration Information.......................................................................... 21

1. Notice of Award............................................................................................................. 21

2. Administrative and National Policy Requirements........................................................ 21

a. DHS Standard Terms and Conditions....................................................................... 21

b. Ensuring the Protection of Civil Rights .................................................................... 21

c. Environmental Planning and Historic Preservation (EHP) Compliance................... 22

d. National Incident Management System (NIMS) Implementation ............................ 23

3. Reporting........................................................................................................................ 23

a. Financial Reporting Requirements............................................................................ 24

b. Programmatic Performance Reporting Requirements............................................... 24

c. Closeout Reporting Requirements............................................................................. 25

d. Additional Reporting Requirements.......................................................................... 26

4. Monitoring and Oversight.............................................................................................. 27

G. DHS Awarding Agency Contact Information ....................................................................... 28

1. Contact and Resource Information ................................................................................ 28

a. Program Office Contact............................................................................................. 28

b. Centralized Scheduling and Information Desk (CSID)............................................. 28

c. Grant Programs Directorate (GPD) Award Administration Division ....................... 29

d. Equal Rights.............................................................................................................. 29

e. Environmental Planning and Historic Preservation .................................................. 29

f. Other Contact Information ........................................................................................ 29

2. Systems Information ...................................................................................................... 29

a. Grants.gov ................................................................................................................. 29

b. Payment and Reporting System (PARS)................................................................... 29

c. Payment Management System (PMS) (“Smartlink”)................................................ 30

d. FEMA GO ................................................................................................................. 30

e. FEMA Preparedness Toolkit..................................................................................... 30

H. Additional Information.......................................................................................................... 30

1. Termination Provisions.................................................................................................. 30

a. Noncompliance.......................................................................................................... 30

b. With the Consent of the Recipient ............................................................................ 30

c. Notification by the Recipient .................................................................................... 31

2. Program Evaluation......................................................................................................... 31

3. Period of Performance Extensions................................................................................. 31

4. Disability Integration....................................................................................................... 32

5. Conflicts of Interest in the Administration of Federal Awards or Subawards............... 33

6. Procurement Integrity .................................................................................................... 33

a. Important Changes to Procurement Standards in 2 C.F.R. Part 200 ......................... 34

b. Competition and Conflicts of Interest ....................................................................... 35

c. Supply Schedules and Purchasing Programs............................................................. 36

d. Procurement Documentation..................................................................................... 37

7. Record Retention ........................................................................................................... 38

a. Record Retention Period ........................................................................................... 38

b. Types of Records to Retain ....................................................................................... 39

8. Actions to Address Noncompliance............................................................................... 39
4 

9. Audits............................................................................................................................. 40

10. Payment Information ..................................................................................................... 41

11. Whole Community Preparedness................................................................................... 42

Appendix A: Program Guidelines and Application Content Requirements.......................... 43
5 

A. Program Description

1. Issued By

U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency 

(FEMA)/ Resilience/National Preparedness Directorate (NPD), National Training and 

Education Division (NTED)

2. Assistance Listings Number 

97.005

3. Assistance Listings Title

State and Local Homeland Security National Training Program

4. Funding Opportunity Title 

Homeland Security National Training Program (HSNTP) – Continuing Training Grants 

(CTG) - National Cybersecurity Preparedness Consortium (NCPC)

5. Funding Opportunity Number

DHS-23-NPD-005-00-97

6. Authorizing Authority for Program

National Cybersecurity Preparedness Consortium Act of 2021, (Pub. L. No. 117-122)

7. Appropriation Authority for Program

Division F, Title III, Consolidated Appropriations Act, 2023, (Pub. L. No. 117-328)

8. Announcement Type

Initial

9. Program Category 

Preparedness: Training

10. Program Overview, Objectives, and Priorities 

a. Overview

Over the last several years our nation has witnessed an exponential rise in threat vectors and 

cyber-attacks with disruptive and destructive physical consequences. Industrial control 

systems and other supporting information technology which power energy, water, 

communications, and other critical infrastructure sectors are becoming increasingly 

interdependent and attractive as targets. Training to address these threats is needed; FEMA 

learning solutions, developed and delivered through the NCPC, are appropriate to address

gaps and reduce risks.

The Department of Homeland Security Fiscal Year (FY) 2023 Homeland Security National 

Training Program (HSNTP), Continuing Training Grants (CTG), National Cybersecurity 

Preparedness Consortium (NCPC) provides funding to the eligible applicant to develop and 

deliver cybersecurity training solutions to address national preparedness gaps, map training 
6 

to the core capabilities, and ensure training is available and accessible to a nationwide 

audience. 

The NCPC plays an important role in the National Training and Education System (NTES), 

which is part of the larger National Preparedness System (the System). The System is 

designed to build, sustain, and deliver the core capabilities and achieve the desired outcomes 

identified in the National Preparedness Goal (the Goal). The Goal is “a secure and resilient 

nation with the capabilities required across the whole community to prevent, protect against, 

mitigate, respond to, and recover from the threats and hazards that pose the greatest risk.” 

The System provides a consistent and reliable approach to support decision making, resource 

allocation, and measure progress toward these outcomes.

The CTG/NCPC supports the 2022-2026 FEMA Strategic Plan, particularly Goal 3: Promote 

and sustain a ready FEMA and prepared nation and Objective 3.1 to Strengthen the 

emergency management workforce. Through developing and delivering cybersecurity 

training courses for state, local, tribal and territorial responder the NCPC award also supports 

The DHS Strategic Plan Fiscal Years 2020-2024, Goal 3: Secure Cyberspace and Critical 

Infrastructure, Objective 3.3: Assess and Counter Evolving Cybersecurity Risk.

b. Objectives

The NCPC identifies, develops, tests, and delivers training to state, local, tribal, and 

territorial (SLTT) emergency response providers, provides on-site mobile and web-based 

training at the awareness, performance, planning and management levels. Through 

collaboration, FEMA and the NCPC members address long-term cybersecurity trends that 

influence national preparedness—including emerging cybersecurity threats, new technologies 

and continuous individual, organizational, and community cybersecurity risk. Specifically, 

the NCPC program supports cybersecurity training that closes core capability area gaps 

identified in recent National Preparedness Reports.

FEMA is committed to reducing complexity, increasing efficiency, and improving outcomes. 

In simple terms, the training return on investment (ROI) is expressed as the benefit to cost 

ratio for individuals, teams, departments, jurisdictions, and regions across the nation to reach 

and maintain fully qualified/mission capable status. In practice, training ROI is difficult to 

measure. The cost of training varies significantly depending upon several variables including 

delivery format (e.g., online, indirect/train-the-trainer, mobile, resident/on-campus) and 

competency level (e.g., awareness, performance/operations, management). FEMA uses a 

systematic approach to optimize the national preparedness training portfolio, align resources 

to address capability gaps through the most effective and efficient means available, and 

ensure a sound ROI from the local to the national level. Collaboration with FEMA’s training 

partners is integral to that effort.

c. Priorities

This NOFO supports several strategic priorities that recipients are expected to support with 

funded products and activities to the greatest extent possible.
7 

FEMA Strategic Plan: The 2022-2026 FEMA Strategic Plan positions the agency to respond 

to a changing landscape in which the emergency management community must embrace its 

expanding role. To meet this challenge, the Strategic Plan outlines three bold and ambitious 

goals. The objectives under each goal outline how FEMA will support its workforce, better 

position communities, and leverage its programs and processes to advance the emergency 

management field.

• Goal 1 - Instill Equity as a Foundation of Emergency Management

• Goal 2 - Lead Whole of Community in Climate Resilience

• Goal 3 - Promote and Sustain a Ready FEMA and Prepared Nation

NCPC partners should address strategic goals and objectives in the 2022-2026 FEMA 

Strategic Plan within their submitted statement of work. NCPC partners should explain how 

activities performed under this award will support the Strategic Plan and ensure the goals and 

objectives outlined in the 2022-2026 FEMA Strategic Plan are incorporated where 

appropriate into new and existing training curriculum.

• Equity in emergency management requires proactively prioritizing actions that reinforce 

cultural competency, accessibility, and inclusion, as well as reflecting the historical 

context of specific groups of people. NCPC partners are strongly encouraged to explore 

how funded activities can address the needs of underserved, at-risk communities to help 

ensure consistent and systematic, fair, just, and impartial treatment of all individuals 

before, during, and after a disaster. 

• Special emphasis should be placed on the diverse needs and values of individual 

communities through training and education that aims at reversing the worsening social 

inequities and risk to our underserved communities. Substantial and ongoing 

prioritization of, and investment in, underserved communities is essential for the whole of 

community system of emergency management to be effective and efficient. For more 

information, refer to H. 13 Whole Community Preparedness.

• Where appropriate, NCPC partners should also incorporate: 1) the inseparable nature of 

climate and equity within the context of emergency management activities with learning 

objectives that address the significant compounding effects of climate change in 

underserved and marginalized communities; and 2) consequence management activities 

(e.g., planning, response, recovery) related to the threat of multiple, cascading critical 

infrastructure failures. 

THIRA/SPR: States and territories provide annual data on their proficiency across 32 core 

capabilities through the Threat and Hazard Identification and Risk Assessment (THIRA), 

Stakeholder Preparedness Reviews (SPR), exercise and real-world after-action reports, and other 

preparedness data. This data feeds into the National Preparedness Report (NPR), which 

summarizes progress made, and challenges that remain, in building and sustaining the 

capabilities needed to prevent, protect against, mitigate, respond to, and recover from the threats, 

hazards, and incidents that pose the greatest risk to the nation. This annual report offers all levels 

of government, tribes, the private and nonprofit sectors, and the public practical insights into 

preparedness that support decisions about program priorities, resource allocation, and actions 

that can create more resilient communities. The NCPC should address current and emerging 

capability gaps and risks identified in the 2022 National Preparedness Report, including, but not 
8 

limited to, THIRA/SPR results, and the 2022-2026 FEMA Strategic goals and objectives. Please 

visit fema.gov to access the 2022 National Preparedness Report and the Homeland Security 

Digital Library to access previous National Preparedness Reports.

11. Performance Measures

The New World Kirkpatrick Model is applied for analyzing and evaluating the results of training 

and educational programs. This model considers any style of training, both informal and formal, 

to assess learning. 

FEMA applies the New World Kirkpatrick Model for the FY 2023 NCPC program as follows:

Level 1: a student’s assessment of the training setting, material, and instruction; this is 

evaluated through surveys administered during or directly following curriculum delivery and 

uses numerical (e.g., Likert Scale) and narrative responses. Results are reported to the FEMA 

NTED Training Partners Program Branch and assessed to measure experiences compared 

with standards and expectations. 

Level 2: a comparison of pre-course knowledge and skills with post-course knowledge and 

skills; this is evaluated through testing administered during or directly following curriculum 

delivery. Results are reported to the FEMA NTED Training Partners Program Branch and 

assessed to measure knowledge transfer compared with an established standard of a twentysix-point increase.

Level 3: an assessment of learning applicability at the home organization or jurisdiction; this 

is evaluated through surveys administered following curriculum delivery, typically between 

90 and 180 days after training, and uses a numerical (e.g., Likert Scale) and narrative 

responses. Results are reported to the FEMA NTED Training Partners Program Branch and 

assessed to measure training impact on a student’s organization or jurisdiction.

FEMA’s First Responder Training System (FRTS) includes the Registration and Evaluation 

System (RES). The RES is used to collect New World Kirkpatrick Model evaluation data.

Sustainment: FEMA has the option to sustain any training course created under the HSNTP/CTG 

at the end of the award period of performance. Once FEMA determines to sustain a course, after 

consulting with the award recipient, FEMA may transfer any or all course material to another 

organization or entity to ensure program sustainability and to continue training delivery. FEMA 

will coordinate the orderly transition of courses between organizations.

B. Federal Award Information

1. Available Funding for the NOFO: $8 million

2. Projected Number of Awards 1

3. Maximum Award Amount: $8 million

4. Period of Performance: 36 months
9 

Extensions to the period of performance are allowed. For additional information on period of 

performance extensions, please refer to Section H of this NOFO.

FEMA awards under most programs, including this program, only include one budget period, 

so it will be same as the period of performance. See 2 C.F.R. § 200.1 for definitions of 

“budget period” and “period of performance.”

5. Projected Period of Performance Start Date(s): 09/01/2023

6. Projected Period of Performance End Date(s): 08/31/2026

7. Funding Instrument Type: Cooperative Agreement

The CTG NCPC program, prescribed by this NOFO, is awarded through a separate 

cooperative agreement, as defined by, and consistent with the Federal Grant and Cooperative 

Agreement Act of 1977 (Pub. L. No. 95-244, 31 U.S.C. §§ 6301-6308). FEMA maintains 

substantial involvement with the recipient as it carries out activities under the award to 

include financial monitoring and all training development and delivery activities, including 

the creation and approval of course content, arrangement of learning objectives, 

establishment of training delivery modes and methods, and use of the Kirkpatrick evaluation 

model. NTED Training Partners Program (TPP) managers serve as the authority to provide 

approval and disapproval for all activities over the life cycle of the award. As FEMA will 

work directly with the award recipient, training will be compliant with agency standards for 

curriculum design and development and students taking the training will benefit from 

standardized, high quality learning.

C. Eligibility Information

1. Eligible Applicants

University of Arkansas, Criminal Justice Institute (Executive Agent for the NCPC)

2. Applicant Eligibility Criteria

To receive funding under this program, recipients must be members of the NCPC. 

a. National Incident Management System (NIMS) Implementation

Prior to allocation of any Federal preparedness awards, recipients must ensure and maintain 

adoption and implementation of NIMS. The list of objectives used for progress and 

achievement reporting is on FEMA’s website at https://www.fema.gov/emergencymanagers/nims/implementation-training.

Emergency management and incident response activities require carefully managed resources 

(personnel, teams, facilities, equipment, and/or supplies) to meet incident needs. Utilization 

of the standardized resource management concepts such as typing, credentialing, and 

inventorying, promote a strong national mutual aid capability needed to support delivery of 

core capabilities. Additional information on resource management, NIMS resource typing 

definitions, job titles, and position qualifications is on FEMA’s website at 

https://www.fema.gov/emergency-managers/nims/components.
10

FEMA developed the National Incident Management System Guideline for the National 

Qualification System to describe national credentialing standards and to provide written 

guidance regarding the use of those standards. This guideline describes credentialing and 

typing processes and identifies tools that Federal Emergency Response Officials and 

emergency managers at all levels of government may use both routinely and to facilitate 

multijurisdictional coordinated responses. 

Although state (including territorial), local, tribal, and private sector partners (including 

nongovernmental organizations) are not required to credential their personnel in accordance 

with these guidelines, FEMA strongly encourages them to do so to leverage the Federal 

investment in the Federal Information Processing Standards 201 infrastructure and to 

facilitate interoperability for personnel deployed outside their home jurisdiction. 

Additional information about NIMS in general is available on FEMA’s website at 

https://www.fema.gov/emergency-managers/nims.

3. Cost Share or Match

There is no cost share or match requirement for this program.

D. Application and Submission Information

1. Key Dates and Times

a. Application Start Date: 5/26/2023 9:00AM ET

b. Application Submission Deadline: 6/27/2023 5:00PM ET

All applications must be received by the established deadline.

FEMA’s Grants Outcomes System (FEMA GO) automatically records proof of timely 

submission and the system generates an electronic date/time stamp when FEMA GO 

successfully receives the application. The individual with the Authorized Organization 

Representative role that submitted the application will also receive the official date/time 

stamp and a FEMA GO tracking number in an email serving as proof of their timely 

submission. For additional information on how an applicant will be notified of application 

receipt, see the subsection titled “Timely Receipt Requirements and Proof of Timely 

Submission” in Section D of this NOFO.

FEMA will not review applications that are received after the deadline or consider 

these late applications for funding. FEMA may, however, extend the application deadline 

on request for any applicant who can demonstrate that good cause exists to justify extending 

the deadline. Good cause for an extension may include technical problems outside of the 

applicant’s control that prevent submission of the application by the deadline, other exigent 

or emergency circumstances, or statutory requirements for FEMA to make an award. 

Applicants experiencing technical problems outside of their control must notify FEMA 

as soon as possible and before the application deadline. Failure to timely notify FEMA of 

the issue that prevented the timely filing of the application may preclude consideration of the 
11 

award. “Timely notification” of FEMA means the following: prior to the application deadline 

and within 48 hours after the applicant became aware of the issue.

A list of FEMA contacts can be found in Section G of this NOFO, “DHS Awarding Agency 

Contact Information.” For technical assistance with the FEMA GO system, please contact the 

FEMA GO Helpdesk at femago@fema.dhs.gov or (877) 611-4700, Monday through Friday, 

9:00 AM – 6:00 PM Eastern Time (ET). For programmatic or grants management questions, 

please contact your Program Analyst or Grants Management Specialist. If applicants do not 

know who to contact or if there are programmatic questions or concerns, please contact the 

Centralized Scheduling and Information Desk (CSID) by phone at (800) 368-6498 or by email at askcsid@fema.dhs.gov, Monday through Friday, 9:00 AM – 5:00 PM ET.

c. Anticipated Funding Selection Date: No later than 9/1/2023

d. Anticipated Award Date: No later than 9/30/2023

e. Other Key Dates 

2. Agreeing to Terms and Conditions of the Award

By submitting an application, applicants agree to comply with the requirements of this 

NOFO and the terms and conditions of the award, should they receive an award.

3. Address to Request Application Package

Applications are processed through the FEMA GO system. To access the system, go to 

https://go.fema.gov/. 

4. Requirements: Obtain a Unique Entity Identifier (UEI) and Register in the System for 

Award Management (SAM) 

Each applicant, unless they have a valid exception under 2 CFR 25.110, must:

1) Be registered in Sam.Gov before application submission. 

2) Provide a valid Unique Entity Identifier (UEI) in its application.

3) Continue to always maintain an active System for Award Management (SAM) registration 

with current information during the Federal Award process.

Event Suggested Deadline for Completion

Initial registration in SAM.gov 

includes UEI issuance

Four weeks before actual submission deadline 

Obtaining a valid Employer 

Identification Number (EIN) Four weeks before actual submission deadline 

Creating an account with login.gov Four weeks before actual submission deadline 

Registering in SAM or Updating 

SAM registration Four weeks before actual submission deadline 

Registering in FEMAGO Four weeks before actual submission deadline 

Starting application in FEMAGO One week before actual submission deadline 

Submitting the final application in

FEMA GO By the submission deadline
12 

5. Steps Required to Obtain a Unique Entity Identifier, Register in the System for Award 

Management (SAM), and Submit an Application

Applying for an award under this program is a multi-step process and requires time to 

complete. Applicants are encouraged to register early as the registration process can take four 

weeks or more to complete. Therefore, registration should be done in sufficient time to 

ensure it does not impact your ability to meet required submission deadlines. 

Please review the table above for estimated deadlines to complete each of the steps listed. 

Failure of an applicant to comply with any of the required steps before the deadline for 

submitting an application may disqualify that application from funding.

To apply for an award under this program, all applicants must:

a. Apply for, update, or verify their Unique Entity Identifier (UEI) number and Employer 

Identification Number (EIN) from the Internal Revenue Service; 

b. In the application, provide an UEI number;

c. Have an account with login.gov;

d. Register for, update, or verify their SAM account and ensure the account is active before 

submitting the application;

e. Register in FEMA GO, add the organization to the system, and establish the Authorized 

Organizational Representative (AOR). The organization’s electronic business point of 

contact (EBiz POC) from the SAM registration may need to be involved in this step. For 

step-by-step instructions, see https://www.fema.gov/medialibrary/assets/documents/181607;

f. Submit the complete application in FEMA GO; and

g. Continue to maintain an active SAM registration with current information at all times 

during which it has an active Federal award or an application or plan under consideration 

by a Federal awarding agency. As part of this, applicants must also provide information 

on an applicant’s immediate and highest-level owner and subsidiaries, as well as on all 

predecessors that have been awarded Federal contracts or Federal financial assistance 

within the last three years, if applicable.

Applicants are advised that FEMA may not make a Federal award until the applicant has 

complied with all applicable SAM requirements. Therefore, an applicant’s SAM registration 

must be active not only at the time of application, but also during the application review 

period and when FEMA is ready to make a Federal award. Further, as noted above, an 

applicant’s or recipient’s SAM registration must remain active for the duration of an active 

Federal award. If an applicant’s SAM registration is expired at the time of application, 

expires during application review, or expires any other time before award, FEMA may 

determine that the applicant is not qualified to receive a Federal award and use that 

determination as a basis for making a Federal award to another applicant. 

Per 2 C.F.R. § 25.110(c)(2)(iii), if an applicant is experiencing exigent circumstances that 

prevents it from obtaining an UEI number and completing SAM registration prior to 

receiving a Federal award, the applicant must notify FEMA as soon as possible by contacting 
13 

askcsid@fema.dhs.gov and providing the details of the circumstances that prevent 

completion of these requirements. If FEMA determines that there are exigent circumstances 

and FEMA has decided to make an award, the applicant will be required to obtain an UEI 

number, if applicable, and complete SAM registration within 30 days of the Federal award 

date. 

6. Electronic Delivery

DHS is participating in the Grants.gov initiative to provide the grant community with a single 

site to find and apply for grant funding opportunities. DHS encourages or requires applicants 

to submit their applications online through Grants.gov, depending on the funding 

opportunity. 

For this funding opportunity, FEMA requires applicants to submit applications through 

FEMA GO.

7. How to Register to Apply

a. General Instructions:

Registering and applying for an award under this program is a multi-step process and 

requires time to complete. Read the instructions below about registering to apply for FEMA 

funds. Applicants should read the registration instructions carefully and prepare the 

information requested before beginning the registration process. Reviewing and assembling 

the required information before beginning the registration process will alleviate last-minute 

searches for required information.

The registration process can take up to four weeks to complete. To ensure an application 

meets the deadline, applicants are advised to start the required steps well in advance of their 

submission.

Organizations must have an UEI number, an EIN, an active System for Award Management 

(SAM) registration and Grants.gov account to apply for grants. 

Organizations must also have a Grants.gov account to apply for an award under this program. 

Creating a Grants.gov account can be completed online in minutes, but UEI and SAM 

registrations may take several weeks. Therefore, an organization's registration should be done 

in sufficient time to ensure it does not impact the entity's ability to meet required application 

submission deadlines. Complete organization instructions can be found on Grants.gov here:

https://www.grants.gov/web/grants/applicants/organization-registration.html.

If individual applicants are eligible to apply for this grant funding opportunity, refer to 

https://www.grants.gov/web/grants/applicants/registration.html.

b. Obtain an UEI Number: 

All entities applying for funding, including renewal funding, prior to April 4, 2022, must 

have a UEI number. Applicants must enter the UEI number in the applicable data entry field 

on the SF-424 form.

For more detailed instructions for obtaining a UEI number, refer to: Sam.gov. 
14 

c. Obtain Employer Identification Number

All entities applying for funding must provide an Employer Identification Number (EIN). 

The EIN can be obtained from the IRS by visiting: https://www.irs.gov/businesses/smallbusinesses-self-employed/apply-for-an-employer-identification-number-ein-online. 

d. Create a login.gov account: 

Applicants must have a login.gov account in order to register with SAM or update their SAM 

registration. Applicants can create a login.gov account here: 

https://secure.login.gov/sign_up/enter_email?request_id=34f19fa8-14a2-438c-8323-

a62b99571fd3. 

Applicants only have to create a login.gov account once. For applicants that are existing 

SAM users, use the same email address for the login.gov account as with SAM.gov so that 

the two accounts can be linked.

For more information on the login.gov requirements for SAM registration, refer to: 

https://www.sam.gov/SAM/pages/public/loginFAQ.jsf. 

e. Register with SAM: 

All organizations applying online through Grants.gov must register with SAM. Failure to 

register with SAM will prevent your organization from applying through Grants.gov. SAM 

registration must be renewed annually. Organizations will be issued a UEI number with the 

completed SAM registration.

For more detailed instructions for registering with SAM, refer to:

https://www.grants.gov/web/grants/applicants/organization-registration/step-2-register-withsam.html.

Note: As a new requirement per 2 C.F.R. § 25.200, applicants must also provide the 

applicant’s immediate and highest-level owner, subsidiaries, and predecessors that have been 

awarded Federal contracts or Federal financial assistance within the last three years, if 

applicable.

I. ADDITIONAL SAM REMINDERS

Existing SAM.gov account holders should check their account to make sure it is “ACTIVE.” 

SAM registration should be completed at the very beginning of the application period and 

should be renewed annually to avoid being “INACTIVE.” Please allow plenty of time 

before the grant application submission deadline to obtain an UEI number and then to 

register in SAM. It may be four weeks or more after an applicant submits the SAM 

registration before the registration is active in SAM, and then it may be an additional 

24 hours before FEMA’s system recognizes the information.

It is imperative that the information applicants provide is correct and current. Please ensure 

that your organization’s name, address, and EIN are up to date in SAM and that the UEI 

number used in SAM is the same one used to apply for all other FEMA awards. Payment 

under any FEMA award is contingent on the recipient’s having a current SAM registration.
15 

II. HELP WITH SAM

The SAM quick start guide for new recipient registration and SAM video tutorial for new 

applicants are tools created by the General Services Administration (GSA) to assist those 

registering with SAM. If applicants have questions or concerns about a SAM registration, 

please contact the Federal Support Desk at https://www.fsd.gov/fsd-gov/home.do or call toll 

free (866) 606-8230.

f. Register in FEMA GO, Add the Organization to the System, and Establish the AOR: 

Applicants must register in FEMA GO and add their organization to the system. The 

organization’s electronic business point of contact (EBiz POC) from the SAM registration 

may need to be involved in this step. For step-by-step instructions, see 

https://www.fema.gov/media-library/assets/documents/181607.

Note: FEMA GO will support only the most recent major release of the following browsers:

• Google Chrome

• Internet Explorer

• Mozilla Firefox

• Apple Safari

• Microsoft Edge

Users who attempt to use tablet type devices or other browsers may encounter issues with 

using FEMA GO.

g. Add a Profile to a Grants.gov Account: 

A profile in Grants.gov corresponds to a single applicant organization the user represents 

(i.e., an applicant) or an individual applicant. If you work for or consult with multiple 

organizations and have a profile for each, you may log in to one Grants.gov account to access 

all of your grant applications. To add an organizational profile to your Grants.gov account, if 

applicable, enter the UEI number for the organization in the UEI field while adding a profile.

For more detailed instructions about creating a profile on Grants.gov, refer to: 

https://www.grants.gov/web/grants/applicants/registration/add-profile.html.

h. EBiz POC Authorized Profile Roles: 

After you register with Grants.gov and create an Organization Applicant Profile, the 

organization applicant's request for Grants.gov roles and access is sent to the EBiz POC. The 

EBiz POC will then log in to Grants.gov and authorize the appropriate roles, which may 

include the Authorized Organization Representative (AOR) role, thereby giving you 

permission to complete and submit applications on behalf of the organization. You will be 

able to submit your application online any time after you have been assigned the AOR role.

For more detailed instructions about creating a profile on Grants.gov, refer to: 

https://www.grants.gov/web/grants/applicants/registration/authorize-roles.html.
16 

i. Track Role Status: 

To track your role request, refer to:

https://www.grants.gov/web/grants/applicants/registration/track-role-status.html.

j. Electronic Signature: 

When applications are submitted through Grants.gov, the name of the organization applicant 

with the AOR role that submitted the application is inserted into the signature line of the 

application, serving as the electronic signature. The EBiz POC must authorize individuals 

who are able to make legally binding commitments on behalf of the organization as an AOR; 

this step is often missed, and it is crucial for valid and timely submissions.

8. Submitting the Final Application

Applicants will be prompted to submit the standard application information and any 

program-specific information required as described in Section D.10 of this NOFO, “Content 

and Form of Application Submission.” The Standard Forms (SF) may be accessed in the 

Forms tab under the SF-424 family on Grants.gov. Applicants should review these forms 

before applying to ensure they have all the information required.

After submitting the final application, FEMA GO will provide either an error message or a 

successfully received transmission in the form of an email sent to the AOR that submitted the 

application. Applicants using slow internet connections, such as dial-up connections, should 

be aware that transmission can take some time before FEMA GO receives your application.

For additional application submission requirements, including program-specific 

requirements, please refer to the subsection titled “Content and Form of Application 

Submission” under Section D of this NOFO.

9. Timely Receipt Requirements and Proof of Timely Submission

All applications must be completed in FEMA GO by the application deadline. FEMA GO 

automatically records proof of timely submission and the system generates an electronic 

date/time stamp when FEMA GO successfully receives the application. The individual with 

the Authorized Organization Representative (AOR) role that submitted the application will 

also receive the official date/time stamp and a FEMA GO tracking number in an email 

serving as proof of their timely submission on the date and time that FEMA GO received the 

application.

Applicants who experience system-related issues will be addressed until 3:00 PM ET on 

the date applications are due. No new system-related issues will be addressed after this 

deadline. Applications not received by the application submission deadline will not be 

accepted.
17 

10. Content and Form of Application Submission

a. Standard Required Application Forms and Information

The following forms or information are required to be submitted via FEMA GO. The 

Standard Forms (SF) are also available at https://www.grants.gov/web/grants/forms/sf-424-

family.html. 

• SF-424, Application for Federal Assistance

• Grants.gov Lobbying Form, Certification Regarding Lobbying

• SF-424A, Budget Information (Non-Construction)

• SF-424B, Standard Assurances (Non-Construction)

• SF-LLL, Disclosure of Lobbying Activities

• Indirect Cost Agreement or Proposal if the budget includes indirect costs and the 

applicant is required to have an indirect cost rate agreement or proposal. If the 

applicant does not have or is not required to have an indirect cost rate agreement or 

proposal, please see Section D.13 of this NOFO, “Funding Restrictions and 

Allowable Costs,” for further information regarding allowability of indirect costs 

and whether alternatives to an indirect cost rate agreement or proposal might be 

available or contact the relevant FEMA staff identified in Section G of this NOFO, 

“DHS Awarding Agency Contact Information” for further instructions.

11. Intergovernmental Review 

An intergovernmental review may be required. Applicants must contact their state’s Single 

Point of Contact (SPOC) to comply with the state’s process under Executive Order 12372. 

See Executive Orders | National Archives; Intergovernmental Review (SPOC List) 

(whitehouse.gov).

12. Funding Restrictions and Allowable Costs

All costs charged to awards covered by this NOFO must comply with the Uniform 

Administrative Requirements, Cost Principles, and Audit Requirements at 2 C.F.R. Part 200, 

unless otherwise indicated in the NOFO, or the terms and conditions of the award. This 

includes, among other requirements, that costs must be incurred, and products and services 

must be delivered, within the period of performance of the award. See 2 C.F.R. § 200.403(h) 

(referring to budget periods, which for FEMA awards is the same as the period of 

performance).

In general, the Cost Principles establish standards for the allowability of costs, provide 

detailed guidance on the cost accounting treatment of costs as direct or administrative costs, 

and set forth allowability principles for selected items of cost. More specifically, except as 

otherwise stated in this NOFO, the terms and condition of an award, or other program 

materials, costs charged to awards covered by this NOFO must be consistent with the Cost 

Principles for Federal Awards located at 2 C.F.R. Part 200, Subpart E. In order to be 

allowable, all costs charged to a FEMA award or applied to the cost share must be reasonable 

in nature and amount and allocable to the particular FEMA award.

Additionally, all costs charged to awards must comply with the grant program’s applicable 

statutes, policies, requirements in this NOFO as well as with the terms and conditions of the 
18 

award. If FEMA staff identify costs that are inconsistent with any of these requirements, 

these costs may be disallowed, and FEMA may recover funds as appropriate, consistent with 

applicable laws, regulations, and policies.

As part of those requirements, grant recipients and subrecipients may only use Federal funds 

or funds applied to a cost share for the purposes set forth in this NOFO and the terms and 

conditions of the award, and those costs must be consistent with the statutory authority for 

the award. 

Grant funds may not be used for matching funds for other Federal grants/cooperative 

agreements, lobbying, or intervention in Federal regulatory or adjudicatory proceedings. In 

addition, Federal funds may not be used to sue the Federal government or any other 

government entity.

a. Prohibitions on Expending FEMA Award Funds for Covered Telecommunications 

Equipment or Services 

Recipients and subrecipients of FEMA Federal financial assistance are subject to the 

prohibitions described in section 889 of the John S. McCain National Defense Authorization 

Act for Fiscal Year 2019 (FY 2019 NDAA), Pub. L. No. 115-232 (2018) and 2 C.F.R. §§ 

200.216, 200.327, 200.471, and Appendix II to 2 C.F.R. Part 200. Beginning August 13, 

2020, the statute – as it applies to FEMA recipients, subrecipients, and their contractors and 

subcontractors – prohibits obligating or expending Federal award funds on certain 

telecommunications and video surveillance products and contracting with certain entities for 

national security reasons. Guidance is available at FEMA Policy #405-143-1 - Prohibitions 

on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services

Additional guidance is available at Contract Provisions Guide: Navigating Appendix II to 

Part 200 - Contract Provisions for Non-Federal Entity Contracts Under Federal Awards 

(fema.gov).

Effective August 13, 2020, FEMA recipients and subrecipients may not use any FEMA 

funds under open or new awards to: 

• Procure or obtain any equipment, system, or service that uses covered 

telecommunications equipment or services as a substantial or essential component of 

any system, or as critical technology of any system.

• Enter into, extend, or renew a contract to procure or obtain any equipment, system, or 

service that uses covered telecommunications equipment or services as a substantial 

or essential component of any system, or as critical technology of any system; or

• Enter into, extend, or renew contracts with entities that use covered 

telecommunications equipment or services as a substantial or essential component of 

any system, or as critical technology as part of any system.

I. DEFINITIONS

Per section 889(f)(2)-(3) of the FY 2019 NDAA and 2 C.F.R. § 200.216, covered 

telecommunications equipment or services means:

i. Telecommunications equipment produced by Huawei Technologies Company or 

ZTE Corporation, (or any subsidiary or affiliate of such entities);
19 

ii. For the purpose of public safety, security of Government facilities, physical 

security surveillance of critical infrastructure, and other national security 

purposes, video surveillance and telecommunications equipment produced by 

Hytera Communications Corporation, Hangzhou Hikvision Digital Technology 

Company, or Dahua Technology Company (or any subsidiary or affiliate of such 

entities);

iii. Telecommunications or video surveillance services provided by such entities or 

using such equipment; or

iv. Telecommunications or video surveillance equipment or services produced or 

provided by an entity that the Secretary of Defense, in consultation with the 

Director of National Intelligence or the Director of the Federal Bureau of 

Investigation, reasonably believes to be an entity owned or controlled by, or 

otherwise connected to, the People’s Republic of China.

Examples of the types of products covered by this prohibition include phones, internet, video 

surveillance, and cloud servers when produced, provided, or used by the entities listed in the 

definition of “covered telecommunications equipment or services.” See 2 C.F.R. § 200.471.

b. Pre-Award Costs

Pre-award costs are allowable only with the prior written approval of DHS/FEMA and if they 

are included in the award agreement. To request pre-award costs a written request must be 

included with the application, signed by the Authorized Representative of the entity. The 

letter must outline what the pre-award costs are for, including a detailed budget breakout of 

pre-award costs from the post-award costs, and a justification for approval.

c. Management and Administration (M&A) Costs 

Management and Administration costs are activities directly related to managing and 

administering the award, such as financial management and monitoring. M&A costs are not 

operational costs. They are the necessary costs incurred in direct support of the grant or as a 

consequence of the grant and should be allocated across the entire lifecycle of the grant. 

Recipients may use up to five percent (5%) of the amount of the award for their M&A.

d. Indirect Facilities & Administrative (F&A) Costs 

Indirect costs are allowable under this program as described in 2 C.F.R. Part 200, including 2 

C.F.R. § 200.414. Applicants with a current negotiated indirect cost rate agreement that 

desire to charge indirect costs to an award must provide a copy of their negotiated indirect 

cost rate agreement at the time of application. Not all applicants are required to have a 

current negotiated indirect cost rate agreement. Applicants that are not required by 2 C.F.R. 

Part 200 to have a negotiated indirect cost rate agreement but are required by 2 C.F.R. Part 

200 to develop an indirect cost rate proposal must provide a copy of their proposal at the time 

of application. Applicants who do not have a current negotiated indirect cost rate agreement 

(including a provisional rate) and wish to charge the de minimis rate must reach out to the 

FEMA Program Manager for further instructions. Applicants who wish to use a cost 

allocation plan in lieu of an indirect cost rate must also reach out to the FEMA Program 

Manager for further instructions. 
20 

E. Application Review Information

1. Application Evaluation Criteria

a. Programmatic Criteria

Prior to making a Federal award, DHS/FEMA is required by 31 U.S.C. § 3321 note, 41 

U.S.C. § 2313 and 2 C.F.R. § 200.205 to review information available through any Office of 

Management and Budget (OMB) designated repositories of government wide eligibility 

qualification or financial integrity information. Therefore, application evaluation criteria may 

include the following risk-based considerations of the applicant: 1) Financial stability. 2) 

Quality of management systems and ability to meet management standards. 3) History of 

performance in managing Federal award. 4) Reports and findings from audits. 5) Ability to 

effectively implement statutory, regulatory, or other requirements.

b. Financial Integrity Criteria

Prior to making a Federal award, FEMA is required by 31 U.S.C. § 3354, as enacted by the 

Payment Integrity Information Act of 2019, Pub. L. No. 116-117 (2020); 41 U.S.C. § 2313; 

and 2 C.F.R. § 200.206 to review information available through any Office of Management 

and Budget (OMB)-designated repositories of governmentwide eligibility qualification or 

financial integrity information, including whether the applicant is suspended or debarred. 

FEMA may also pose additional questions to the applicant to aid in conducting the pre-award 

risk review. Therefore, application evaluation criteria may include the following risk-based 

considerations of the applicant: 

i. Financial stability. 

ii. Quality of management systems and ability to meet management 

standards.

iii. History of performance in managing Federal award. 

iv. Reports and findings from audits.

v. Ability to effectively implement statutory, regulatory, or other 

requirements.

c. Supplemental Financial Integrity Criteria and Review 

Prior to making a Federal award where the anticipated total Federal share will be greater than 

the simplified acquisition threshold, currently $250,000: 

i. FEMA is required to review and consider any information about the 

applicant, including information on the applicant’s immediate and highestlevel owner, subsidiaries, and predecessors, if applicable, that is in the 

designated integrity and performance system accessible through the 

System for Award Management (SAM), which is currently the Federal 

Awardee Performance and Integrity Information System (FAPIIS).

ii. An applicant, at its option, may review information in FAPIIS and 

comment on any information about itself that a Federal awarding agency 

previously entered.

iii. FEMA will consider any comments by the applicant, in addition to the 

other information in FAPIIS, in making a judgment about the applicant’s 

integrity, business ethics, and record of performance under Federal awards 

when completing the review of risk posed by applicants as described in 2 

C.F.R. § 200.206.
21 

2. Review and Selection Process

The Deputy Administrator of FEMA for Resilience, on behalf of the FEMA Administrator, 

will approve or disapprove the training projects funded through this program.

F. Federal Award Administration Information

1. Notice of Award

Before accepting the award, the AOR and recipient should carefully read the award package. 

The award package includes instructions on administering the grant award and the terms and 

conditions associated with responsibilities under Federal awards. Recipients must accept all 

conditions in this NOFO as well as any specific terms and conditions in the Notice of 

Award to receive an award under this program.

FEMA will provide the Federal award package to the applicant electronically via FEMA GO. 

Award packages include an Award Letter, Summary Award Memo, Agreement Articles, and 

Obligating Document. An email notification of the award package will be sent through 

FEMA’s grant application system to the Authorized Organization Representative (AOR) that 

submitted the application. 

Recipients must accept their awards no later than 30-days from the award date. The recipient 

shall notify FEMA of its intent to accept and proceed with work under the award through the 

FEMA GO system. 

Funds will remain on hold until the recipient accepts the award through the FEMA GO 

system and all other conditions of the award have been satisfied or until the award is 

otherwise rescinded. Failure to accept a grant award within the specified timeframe may 

result in a loss of funds.

2. Administrative and National Policy Requirements

In addition to the requirements of in this section and in this NOFO, FEMA may place 

specific terms and conditions on individual awards in accordance with 2 C.F.R. Part 200.

a. DHS Standard Terms and Conditions

All successful applicants for DHS grant and cooperative agreements are required to comply 

with DHS Standard Terms and Conditions, which are available online at: DHS Standard 

Terms and Conditions.

The applicable DHS Standard Terms and Conditions will be those in effect at the time the 

award was made unless the application is for a continuation award. In that event, the terms 

and conditions in effect at the time the original award was made will generally apply. What 

terms and conditions will apply for the award will be clearly stated in the award package at 

the time of award.

b. Ensuring the Protection of Civil Rights

As the Nation works towards achieving the National Preparedness Goal, it is important to 

continue to protect the civil rights of individuals. Recipients and subrecipients must carry out 

their programs and activities, including those related to the building, sustainment, and 
22 

delivery of core capabilities, in a manner that respects and ensures the protection of civil 

rights for protected populations. 

Federal civil rights statutes, such as Section 504 of the Rehabilitation Act of 1973 and Title 

VI of the Civil Rights Act of 1964, along with DHS and FEMA regulations, prohibit 

discrimination on the basis of race, color, national origin, sex, religion, age, disability, 

limited English proficiency, or economic status in connection with programs and activities 

receiving Federal financial assistance from FEMA. 

The DHS Standard Terms and Conditions include a fuller list of the civil rights provisions 

that apply to recipients. These terms and conditions can be found in the DHS Standard Terms 

and Conditions. Additional information on civil rights provisions is available at 

https://www.fema.gov/about/offices/equal-rights/civil-rights.

Monitoring and oversight requirements in connection with recipient compliance with Federal 

civil rights laws are also authorized pursuant to 44 C.F.R. Part 7.

In accordance with civil rights laws and regulations, recipients and subrecipients must ensure 

the consistent and systematic fair, just, and impartial treatment of all individuals, including 

individuals who belong to underserved communities that have been denied such treatment.

c. Environmental Planning and Historic Preservation (EHP) Compliance

As a Federal agency, FEMA is required to consider the effects of its actions on the 

environment and historic properties to ensure that all activities and programs funded by 

FEMA, including grant-funded projects, comply with Federal EHP laws, Executive Orders, 

regulations, and policies, as applicable. 

All non-critical new construction or substantial improvement of structures in a Special Flood 

Hazard Area must, at a minimum, apply the flood elevations of the Federal Flood Risk 

Management Standard’s Freeboard Value Approach unless doing so would cause the project 

to be unable to meet applicable program cost-effectiveness requirements. All other types of 

projects may choose to apply the flood elevations of the Federal Flood Risk Management 

Standard’s Freeboard Value Approach. See Executive Order (EO) 14030, Climate-Related 

Financial Risk and FEMA Policy #-206-21-0003, Partial Implementation of the Federal 

Flood Risk Management Standard for Hazard Mitigation Assistance Programs (Interim) 

(fema.gov). 

Recipients and subrecipients proposing projects that have the potential to impact the 

environment, including, but not limited to, the construction of communication towers, 

modification or renovation of existing buildings, structures, and facilities, or new 

construction including replacement of facilities, must participate in the FEMA EHP 

review process. The EHP review process involves the submission of a detailed project 

description along with any supporting documentation requested by FEMA in order to 

determine whether the proposed project has the potential to impact environmental resources 

or historic properties. 

In some cases, FEMA is also required to consult with other regulatory agencies and the 

public in order to complete the review process. Federal law requires EHP review to be 
23 

completed before Federal funds are released to carry out proposed projects. FEMA may not 

be able to fund projects that are not incompliance with applicable EHP laws, Executive 

Orders, regulations, and policies.

DHS and FEMA EHP policy is found in directives and instructions available on the 

FEMA.gov EHP page, the FEMA website page that includes documents regarding EHP 

responsibilities and program requirements, including implementation of the National 

Environmental Policy Act and other EHP regulations and Executive Orders. 

d. National Incident Management System (NIMS) Implementation 

In expending funds under this program, recipients that are state, local, tribal, or territorial 

governments must ensure and maintain adoption and implementation of NIMS. The state, 

local, tribal, or territorial government must show adoption of NIMS during any point of the 

period of performance. The list of objectives used for progress and achievement reporting is 

at https://www.fema.gov/emergency-managers/nims/implementation-training. 

Emergency management and incident response activities require carefully managed resources 

(personnel, teams, facilities, equipment, and/or supplies) to meet incident needs. Using 

standardized resource management concepts such as typing, credentialing, and inventorying, 

promote a strong national mutual aid capability needed to support delivery of core 

capabilities. Additional information on resource management, NIMS resource typing 

definitions, job titles, and position qualifications is on FEMA’s website at 

https://www.fema.gov/emergency-managers/nims/components.

FEMA developed the National Incident Management System Guideline for the National 

Qualification System to describe national credentialing standards and to provide written 

guidance regarding the use of those standards. This guideline describes credentialing and 

typing processes and identifies tools which Federal Emergency Response Officials and 

emergency managers at all levels of government may use both routinely and to facilitate 

multijurisdictional coordinated responses. 

Although state, local, tribal, and private sector partners (including nongovernmental 

organizations) are not required to credential their personnel in accordance with these 

guidelines, FEMA strongly encourages them to do so to leverage the Federal investment in 

the Federal Information Processing Standards 201 infrastructure and to facilitate 

interoperability for personnel deployed outside their home jurisdiction. 

Additional information about NIMS in general is available at 

https://www.fema.gov/emergency-managers/nims.

3. Reporting

Recipients are required to submit various financial and programmatic reports as a condition 

of award acceptance. Future awards and funds drawdown may be withheld if these reports 

are delinquent. 
24 

a. Financial Reporting Requirements 

I. FEDERAL FINANCIAL REPORT (FFR)

Recipients must report obligations and expenditures through the FFR form (SF-425) to 

FEMA. 

Recipients may review the Federal Financial Reporting Form (FFR) (SF-425) at 

https://www.grants.gov/web/grants/forms/post-award-reporting-forms.html#sortby=1

Recipients must file the FFR electronically using FEMA GO.

II. FFR REPORTING PERIODS AND DUE DATES

An FFR must be submitted quarterly throughout the POP, including partial calendar quarters, 

as well as in periods where no grant award activity occurs. The final FFR is due within 120 

calendar days after the end of the POP. Future awards and fund drawdowns may be withheld 

if these reports are delinquent, demonstrate lack of progress, or are insufficient in detail.

Except for the final FFR due at 120 days after the end of the POP for purposes of closeout, 

the following reporting periods and due dates apply for the FFR:

Reporting Period Report Due Date

October 1 – December 31 January 30

January 1 – March 31 April 30

April 1 – June 30 July 30

July 1 – September 30 October 30

b. Programmatic Performance Reporting Requirements 

I. PERFORMANCE PROGRESS REPORT (PPR)

Recipients are responsible for providing updated performance reports in Microsoft Word on a 

semi-annual basis. These is no prescribed government form for this report. The report is due 

within 30 days after the end of the reporting period. Recipients must submit it as an 

attachment to the FEMA GO system.

The semi-annual Performance Progress Report must follow the guidance provided by 

FEMA’s National Training and Education Division (NTED) in the NTED Monitoring Policy 

and Procedure Guide. FEMA/NTED will provide this guide to recipients of a FY 2023 

NCPC award as a post-award action.

Program Performance Reporting Periods and Due Dates

The following reporting periods and due dates apply for the PPR:
25 

Reporting Period Report Due Date

January 1 – June 30 July 30

July 1 – December 31 January 30

II. FINANCIAL AND COMPLIANCE AUDIT REPORT

For audits of fiscal years beginning on or after December 26, 2014, recipients that expend 

$750,000 or more from all Federal funding sources during their fiscal year are required to 

submit an organization-wide financial and compliance audit report. The audit must be 

performed in accordance with the requirements of Government and Accountability Office’s 

(GAO) Government Auditing Standards, located at 

https://www.gao.gov/yellowbook/overview, and the requirements of Subpart F of 2 C.F.R. 

Part 200, located at http://www.ecfr.gov/cgi-bin/text-idx?node=sp2.1.200.f.

c. Closeout Reporting Requirements 

I. CLOSEOUT REPORTING 

Within 120 calendar days after the end of the period of performance for the prime award or 

after an amendment has been issued to close out an award before the original POP ends, 

recipients must liquidate all financial obligations and must submit the following:

i. The final request for payment, if applicable.

ii. The final FFR (SF-425).

iii. The final progress report detailing all accomplishments, including a narrative 

summary of the impact of those accomplishments throughout the period of 

performance.

iv. Other documents required by this NOFO, terms and conditions of the award, or 

other FEMA guidance. 

In addition, pass-through entities are responsible for closing out their subawards as described 

in 2 C.F.R. § 200.344; subrecipients are still required to submit closeout materials within 90 

calendar days of the period of performance end date. When a subrecipient completes all 

closeout requirements, pass-through entities must promptly complete all closeout actions for 

subawards in time for the recipient to submit all necessary documentation and information to 

FEMA during the closeout of the prime award. 

After the prime award closeout reports have been reviewed and approved by FEMA, a 

closeout notice will be completed to close out the grant. The notice will indicate the period of 

performance as closed, list any remaining funds that will be deobligated, and address the 

requirement of maintaining the grant records for at least three years from the date of the final 

FFR. The record retention period may be longer, such as due to an audit or litigation, for 

equipment or real property used beyond the period of performance, or due to other 

circumstances outlined in 2 C.F.R. § 200.334.

The recipient is responsible for refunding to FEMA any balances of unobligated cash that 

FEMA paid that are not authorized to be retained per 2 C.F.R. § 200.344(d). 
26 

II. ADMINISTRATIVE CLOSEOUT

Administrative closeout is a mechanism for FEMA to unilaterally move forward with 

closeout of an award using available award information in lieu of final reports from the 

recipient per 2 C.F.R. § 200.344(h)-(i). It is a last resort available to FEMA, and if FEMA 

needs to administratively close an award, this may negatively impact a recipient’s ability to 

obtain future funding. This mechanism can also require FEMA to make cash or cost 

adjustments and ineligible cost determinations based on the information it has, which may 

result in identifying a debt owed to FEMA by the recipient.

When a recipient is not responsive to FEMA’s reasonable efforts to collect required reports 

needed to complete the standard closeout process, FEMA is required under 2 C.F.R. § 

200.344(h) to start the administrative closeout process within the regulatory timeframe. 

FEMA will make at least three written attempts to collect required reports before initiating 

administrative closeout. If the recipient does not submit all required reports in accordance 

with 2 C.F.R. § 200.344, this NOFO, and the terms and conditions of the award, FEMA must 

proceed to administratively close the award with the information available within one year of 

the period of performance end date. Additionally, if the recipient does not submit all required 

reports within one year of the period of performance end date, per 2 C.F.R. § 200.344(i), 

FEMA must report in FAPIIS the recipient’s material failure to comply with the terms and 

conditions of the award.

If FEMA administratively closes an award where no final FFR has been submitted, FEMA 

uses that administrative closeout date in lieu of the final FFR submission date as the start of 

the record retention period under 2 C.F.R. § 200.334. 

In addition, if an award is administratively closed, FEMA may decide to impose remedies for 

noncompliance per 2 C.F.R. § 200.339, consider this information in reviewing future award 

applications, or apply special conditions to existing or future awards.

d. Additional Reporting Requirements

I. DISCLOSING INFORMATION PER 2 C.F.R. § 180.335

This reporting requirement pertains to disclosing information related to government-wide 

suspension and debarment requirements. Before a recipient enters into a grant award with 

FEMA, the recipient must notify FEMA if it knows if it or any of the recipient’s principals 

under the award fall under one or more of the four criteria listed at 2 C.F.R. § 180.335:

i. Are presently excluded or disqualified;

ii. Have been convicted within the preceding three years of any of the offenses listed 

in 2 C.F.R. § 180.800(a) or had a civil judgment rendered against it or any of the 

recipient’s principals for one of those offenses within that time period; 

iii. Are presently indicted for or otherwise criminally or civilly charged by a 

governmental entity (Federal, state or local) with commission of any of the 

offenses listed in 2 C.F.R. § 180.800(a); or 

iv. Have had one or more public transactions (Federal, state, or local) terminated 

within the preceding three years for cause or default. 

At any time after accepting the award, if the recipient learns that it or any of its principals 
27 

falls under one or more of the criteria listed at 2 C.F.R. § 180.335, the recipient must 

provide immediate written notice to FEMA in accordance with 2 C.F.R. § 180.350.

II. REPORTING OF MATTERS RELATED TO RECIPIENT INTEGRITY AND PERFORMANCE 

Per 2 C.F.R. Part 200, Appendix I § F.3, the additional post-award reporting requirements in 

2 C.F.R. Part 200, Appendix XII may apply to applicants who, if upon becoming recipients, 

have a total value of currently active grants, cooperative agreements, and procurement 

contracts from all Federal awarding agencies that exceeds $10,000,000 for any period of time 

during the period of performance of an award under this funding opportunity. 

Recipients that meet these criteria must maintain current information reported in FAPIIS 

about civil, criminal, or administrative proceedings described in paragraph 2 of Appendix XII 

at the reporting frequency described in paragraph 4 of Appendix XII.

III. SINGLE AUDIT REPORT

For audits of fiscal years beginning on or after December 26, 2014, recipients that expend 

$750,000 or more from all Federal funding sources during their fiscal year are required to 

submit an organization-wide financial and compliance audit report, also known as the single 

audit report. 

The audit must be performed in accordance with the requirements of U.S. Government 

Accountability Office’s (GAO) Government Auditing Standards, located at 

https://www.gao.gov/yellowbook/overview, and the requirements of Subpart F of 2 C.F.R. 

Part 200, located at http://www.ecfr.gov/cgi-bin/text-idx?node=sp2.1.200.f.

4. Monitoring and Oversight

Per 2 C.F.R. § 200.337, FEMA, through its authorized representatives, has the right, at all 

reasonable times, to make site visits or conduct desk reviews to review project 

accomplishments and management control systems to review award progress and to provide 

any required technical assistance. During site visits or desk reviews, FEMA will review 

recipients’ files related to the award. As part of any monitoring and program evaluation 

activities, recipients must permit FEMA, upon reasonable notice, to review grant-related 

records and to interview the organization’s staff and contractors regarding the program. 

Recipients must respond in a timely and accurate manner to FEMA requests for information 

relating to the award.

Effective monitoring and oversight help FEMA ensure that recipients use grant funds for 

their intended purpose(s); verify that projects undertaken are consistent with approved plans; 

and ensure that recipients make adequate progress toward stated goals and objectives. 

Additionally, monitoring serves as the primary mechanism to ensure that recipients comply 

with applicable laws, rules, regulations, program guidance, and requirements. FEMA 

regularly monitors all grant programs both financially and programmatically in accordance 

with Federal laws, regulations (including 2 C.F.R. Part 200), program guidance, and the 

terms and conditions of the award. All monitoring efforts ultimately serve to evaluate 

progress towards grant goals and proactively target and address issues that may threaten 

grant success during the period of performance.
28 

FEMA staff will periodically monitor recipients to ensure that administrative processes, 

policies and procedures, budgets, and other related award criteria are meeting Federal 

Government-wide and FEMA regulations. Aside from reviewing quarterly financial and 

programmatic reports, FEMA may also conduct enhanced monitoring through either deskbased review, onsite monitoring visits, or both. Enhanced monitoring will involve the review 

and analysis of the financial compliance and administrative processes, policies, activities, and 

other attributes of each Federal assistance award, and it will identify areas where the 

recipient may need technical assistance, corrective actions, or other support.

Financial and programmatic monitoring are complementary processes within FEMA’s 

overarching monitoring strategy that function together to ensure effective grants 

management, accountability, and transparency; validate progress against grant and program 

goals; and safeguard Federal funds against fraud, waste, and abuse. Financial monitoring 

primarily focuses on statutory and regulatory compliance with administrative grant 

requirements, while programmatic monitoring seeks to validate and assist in grant progress, 

targeting issues that may be hindering achievement of project goals and ensuring compliance 

with the purpose of the grant and grant program. Both monitoring processes are similar in 

that they feature initial reviews of all open awards, and additional, in-depth monitoring of 

grants requiring additional attention.

Recipients and subrecipients who are pass-through entities are responsible for monitoring 

their subrecipients in a manner consistent with the terms of the Federal award at 2 C.F.R. 

Part 200, including 2 C.F.R. § 200.332. This includes the pass-through entity’s responsibility 

to monitor the activities of the subrecipient as necessary to ensure that the subaward is used 

for authorized purposes, in compliance with Federal statutes, regulations, and the terms and 

conditions of the subaward; and that subaward performance goals are achieved. 

In terms of overall award management, recipient and subrecipient responsibilities include, 

but are not limited to accounting of receipts and expenditures, cash management, maintaining 

adequate financial records, reporting and refunding expenditures disallowed by audits, 

monitoring if acting as a pass-through entity, or other assessments and reviews, and ensuring 

overall compliance with the terms and conditions of the award or subaward, as applicable, 

including the terms of 2 C.F.R. Part 200.

G. DHS Awarding Agency Contact Information

1. Contact and Resource Information

a. Program Office Contact

NTED maintains programmatic responsibility for the NCPC program and will maintain the 

program management function and responsibilities throughout the life cycle of the awarded 

grant. Contact our NTED point of contact Ms. Jessica Sterling at (202) 212-3042 or via email 

to jessica.sterling@fema.dhs.gov or Mr. Patrick Cowhey Patrick.cowhey@fema.dhs.gov for 

additional information.

b. Centralized Scheduling and Information Desk (CSID)

CSID is a non-emergency comprehensive management and information resource developed 

by FEMA for grants stakeholders. CSID provides general information on all FEMA grant 
29 

programs and maintains a comprehensive database containing key personnel contact 

information at the Federal, state, and local levels. When necessary, recipients will be directed 

to a Federal point of contact who can answer specific programmatic questions or concerns. 

CSID can be reached by phone at (800) 368-6498 or by e-mail at askcsid@fema.dhs.gov, 

Monday through Friday, 9:00 AM – 5:00 PM ET.

c. Grant Programs Directorate (GPD) Award Administration Division 

GPD’s Award Administration Division (AAD) provides support regarding financial matters 

and budgetary technical assistance. Additional guidance and information can be obtained by 

contacting the AAD’s Help Desk via e-mail at ASK-GMD@fema.dhs.gov.

d. Equal Rights

The FEMA Office of Equal Rights (OER) is responsible for compliance with and 

enforcement of Federal civil rights obligations in connection with programs and services 

conducted by FEMA and recipients of FEMA financial assistance. All inquiries and 

communications about Federal civil rights compliance for FEMA grants under this NOFO 

should be sent to FEMA-CivilRightsOffice@fema.dhs.gov.

e. Environmental Planning and Historic Preservation

The FEMA Office of Environmental Planning and Historic Preservation (OEHP) provides 

guidance and information about the EHP review process to FEMA programs and FEMA’s 

recipients and subrecipients. All inquiries and communications about EHP compliance for 

FEMA grant projects under this NOFO or the EHP review process should be sent to FEMAOEHP-NOFOQuestions@fema.dhs.gov.

f. Other Contact Information 

Telephone Device for the Deaf (TDD)

The Telephone Device for the Deaf (TDD) and/or Federal Information Relay Service (FIRS) 

number available for this announcement is (800) 462-7585 between 8 a.m. to 8 p.m. Eastern 

Time, Monday through Friday, except Federal holidays.

2. Systems Information 

a. Grants.gov 

For technical assistance with Grants.gov, call the customer support hotline 24 hours per day, 

7 days per week (except Federal holidays) at (800) 518-4726 or e-mail at 

support@grants.gov.

b. Payment and Reporting System (PARS)

FEMA uses the Payment and Reporting System (PARS) for financial reporting, invoicing, 

and tracking payments. FEMA uses the Direct Deposit/Electronic Funds Transfer (DD/EFT) 

method of payment to recipients. If you have questions about the online system, please call 

the Customer Service Center at (866) 927-5646 or email ask-GMD@fema.dhs.gov.
30 

c. Payment Management System (PMS) (“Smartlink”) 

The Payment Management System (PMS), commonly referred to as Smartlink, is a webbased application hosted by the Department of Health and Human Services. FEMA CSEPP 

may continue to use Smartlink for grants awarded in previous fiscal years using Smartlink. 

Additional information on PMS is available at https://pms.psc.gov.

d. FEMA GO 

For technical assistance with the FEMA GO system, please contact the FEMA GO Helpdesk 

at femago@fema.dhs.gov or (877) 611-4700, Monday through Friday, 9:00 AM – 6:00 PM 

ET.

e. FEMA Preparedness Toolkit

The FEMA Preparedness Toolkit (PrepToolkit) provides access to the tools and resources 

needed to implement the National Preparedness System and provide a collaborative 

community space for communities completing the Unified Reporting Tool (URT). Recipients 

complete and submit their Threat and Hazard Identification and Risk Assessment (THIRA) 

and Stakeholder Preparedness Review (SPR), and other required assessments using the tools 

on PrepToolkit. For assistance, contact support@preptoolkit.fema.dhs.gov.

H. Additional Information 

1. Termination Provisions

FEMA may terminate a Federal award in whole or in part for one of the following reasons. 

FEMA and the recipient must still comply with closeout requirements at 2 C.F.R. §§ 

200.344-200.345 even if an award is terminated in whole or in part. To the extent that 

subawards are permitted under this NOFO, pass-through entities should refer to 2 C.F.R. § 

200.340 for additional information on termination regarding subawards.

a. Noncompliance

If a recipient fails to comply with the terms and conditions of a Federal award, FEMA may 

terminate the award in whole or in part. If the noncompliance can be corrected, FEMA may 

first attempt to direct the recipient to correct the noncompliance. This may take the form of a 

Compliance Notification. If the noncompliance cannot be corrected or the recipient is nonresponsive, FEMA may proceed with a Remedy Notification, which could impose a remedy 

for noncompliance per 2 C.F.R. § 200.339, including termination. Any action to terminate 

based on noncompliance will follow the requirements of 2 C.F.R. §§ 200.341-200.342 as 

well as the requirement of 2 C.F.R. § 200.340(c) to report in FAPIIS the recipient’s material 

failure to comply with the award terms and conditions. See also the section on Actions to 

Address Noncompliance in this NOFO.

b. With the Consent of the Recipient

FEMA may also terminate an award in whole or in part with the consent of the recipient, in 

which case the parties must agree upon the termination conditions, including the effective 

date, and in the case of partial termination, the portion to be terminated. 
31 

c. Notification by the Recipient

The recipient may terminate the award, in whole or in part, by sending written notification to 

FEMA setting forth the reasons for such termination, the effective date, and in the case of 

partial termination, the portion to be terminated. In the case of partial termination, FEMA 

may determine that a partially terminated award will not accomplish the purpose of the 

Federal award, so FEMA may terminate the award in its entirety. If that occurs, FEMA will 

follow the requirements of 2 C.F.R. §§ 200.341-200.342 in deciding to fully terminate the 

award. 

2. Program Evaluation

Recipients and subrecipients are encouraged to incorporate program evaluation activities 

from the outset of their program design and implementation to meaningfully document and 

measure their progress towards meeting an agency priority goal(s). Title I of the Foundations

for Evidence-Based Policymaking Act of 2018 (Evidence Act), Pub. L. No. 115-435 (2019)

urges Federal awarding agencies and Federal assistance recipients and subrecipients to use 

program evaluation as a critical tool to learn, to improve equitable delivery, and to elevate 

program service and delivery across the program lifecycle. Evaluation means “an assessment 

using systematic data collection and analysis of one or more programs, policies, and 

organizations intended to assess their effectiveness and efficiency.” Evidence Act § 101 

(codified at 5 U.S.C. § 311). Evaluation costs are allowable costs (either as direct or indirect), 

unless prohibited by statute or regulation.

In addition, recipients are required to participate in a DHS-led evaluation if selected, which 

may be carried out by a third-party on behalf of the Program Office or DHS. By accepting 

grant funds, recipients agree to participate in the evaluation, which may include analysis of 

individuals who benefit from the grant, and provide access to program operating personnel 

and participants, as specified by the evaluator(s) during the award.

3. Period of Performance Extensions 

Extensions to the period of performance (POP) for this program are allowed. Extensions to 

the POP identified in the award will only be considered through formal, written requests to 

the recipient’s FEMA Program Manager and must contain specific and compelling 

justifications as to why an extension is required. Recipients are advised to coordinate with 

the FEMA Program Manager as needed when preparing an extension request. 

All extension requests must address the following:

a. The grant program, fiscal year, and award number;

b. Reason for the delay –including details of the legal, policy, or operational challenges 

that prevent the final outlay of awarded funds by the deadline;

c. Current status of the activity(ies);

d. Approved POP termination date and new project completion date;

e. Amount of funds drawn down to date;

f. Remaining available funds, both Federal and, if applicable, non-Federal;

g. Budget outlining how remaining Federal and, if applicable, non-Federal funds will be 

expended;
32 

h. Plan for completion, including milestones and timeframes for achieving each 

milestone and the position or person responsible for implementing the plan for 

completion; and

i. Certification that the activity(ies) will be completed within the extended POP without 

any modification to the original statement of work, as described in the application and 

as approved by FEMA.

Extension requests will be granted only due to compelling legal, policy, or operational 

challenges. Extension requests will only be considered for the following reasons:

• Contractual commitments by the recipient or subrecipient with vendors prevent 

completion of the project, including delivery of equipment or services, within the 

existing POP;

• The project must undergo a complex environmental review that cannot be completed 

within the existing POP;

• Projects are long-term by design, and therefore acceleration would compromise core 

programmatic goals; or

• Where other special or extenuating circumstances exist.

Recipients should submit all proposed extension requests to FEMA for review and approval 

at least 90 days prior to the end of the POP to allow sufficient processing time. 

4. Disability Integration

Pursuant to Section 504 of the Rehabilitation Act of 1973, recipients of FEMA financial 

assistance must ensure that their programs and activities do not discriminate against other 

qualified individuals with disabilities.

Grant recipients should engage with the whole community to advance individual and 

community preparedness and to work as a nation to build and sustain resilience. In doing so, 

recipients are encouraged to consider the needs of individuals with disabilities into the 

activities and projects funded by the grant. 

FEMA expects that the integration of the needs of people with disabilities will occur at all 

levels, including planning; alerting, notification, and public outreach; training; purchasing of 

equipment and supplies; protective action implementation; and exercises/drills.

The following are examples that demonstrate the integration of the needs of people with 

disabilities in carrying out FEMA awards:

• Include representatives of organizations that work with/for people with disabilities on 

planning committees, work groups and other bodies engaged in development and 

implementation of the grant programs and activities.

• Hold all activities related to the grant in locations that are accessible to persons with 

physical disabilities to the extent practicable. 

• Acquire language translation services, including American Sign Language, that

provide public information across the community and in shelters.

• If making alterations to an existing building to a primary function area utilizing 

Federal funds, complying with the most recent codes and standards and making path 

of travel to the primary function area accessible to the greatest extent possible.
33 

• Implement specific procedures used by public transportation agencies that include 

evacuation and passenger communication plans and measures for individuals with 

disabilities.

• Identify, create, and deliver training to address any training gaps specifically aimed 

toward whole-community preparedness. Include and interact with individuals with 

disabilities, aligning with the designated program capability.

• Establish best practices in inclusive planning and preparedness that consider physical 

access, language access, and information access. Examples of effective 

communication access include providing auxiliary aids and services such as sign 

language interpreters, Computer Aided Real-time Translation (CART), and materials 

in Braille or alternate formats.

FEMA grant recipients can fund projects towards the resiliency of the whole community, 

including people with disabilities, such as training, outreach and safety campaigns, provided 

that the project aligns with this NOFO and the terms and conditions of the award.

5. Conflicts of Interest in the Administration of Federal Awards or Subawards

For conflicts of interest under grant-funded procurements and contracts, refer to the section 

on Procurement Integrity in this NOFO and 2 C.F.R. §§ 200.317 – 200.327. 

To eliminate and reduce the impact of conflicts of interest in the subaward process, recipients 

and pass-through entities must follow their own policies and procedures regarding the 

elimination or reduction of conflicts of interest when making subawards. Recipients and 

pass-through entities are also required to follow any applicable Federal and state, local, tribal, 

or territorial (SLTT) statutes or regulations governing conflicts of interest in the making of 

subawards. 

The recipient or pass-through entity must disclose to the respective Program Analyst or 

Program Manager, in writing, any real or potential conflict of interest that may arise during 

the administration of the Federal award, as defined by the Federal or SLTT statutes or 

regulations or their own existing policies, within five days of learning of the conflict of 

interest. Similarly, subrecipients, whether acting as subrecipients or as pass-through entities, 

must disclose any real or potential conflict of interest to the recipient or next-level passthrough entity as required by the recipient or pass-through entity’s conflict of interest 

policies, or any applicable Federal or SLTT statutes or regulations.

Conflicts of interest may arise during the process of FEMA making a Federal award in 

situations where an employee, officer, or agent, any members of his or her immediate family, 

his or her partner has a close personal relationship, a business relationship, or a professional 

relationship, with an applicant, subapplicant, recipient, subrecipient, or FEMA employees.

6. Procurement Integrity

Through audits conducted by the DHS Office of Inspector General (OIG) and FEMA grant 

monitoring, findings have shown that some FEMA recipients have not fully adhered to the 

proper procurement requirements at 2 C.F.R. §§ 200.317 – 200.327 when spending grant 

funds. Anything less than full compliance with Federal procurement requirements 
34 

jeopardizes the integrity of the grant as well as the grant program. To assist with determining 

whether an action is a procurement or instead a subaward, please consult 2 C.F.R. § 200.331. 

For detailed guidance on the Federal procurement standards, recipients and subrecipients 

should refer to various materials issued by FEMA’s Procurement Disaster Assistance Team 

(PDAT), such as the PDAT Field Manual and Contract Provisions Guide. Additional 

resources, including an upcoming trainings schedule can be found on the PDAT Website: 

https://www.fema.gov/grants/procurement. 

The below highlights the Federal procurement requirements for FEMA recipients when 

procuring goods and services with Federal grant funds. FEMA will include a review of 

recipients’ procurement practices as part of the normal monitoring activities. All 

procurement activity must be conducted in accordance with Federal procurement 

standards at 2 C.F.R. §§ 200.317 – 200.327. Select requirements under these standards are 

listed below. The recipient and any of its subrecipients must comply with all requirements, 

even if they are not listed below.

Under 2 C.F.R. § 200.317, when procuring property and services under a Federal award, 

states (including territories) must follow the same policies and procedures they use for 

procurements from their non-Federal funds; additionally, states must now follow 2 C.F.R. § 

200.321 regarding socioeconomic steps, 200.323 regarding domestic preferences for 

procurements, 200.323 regarding procurement of recovered materials, and 2 C.F.R. § 

200.327 regarding required contract provisions.

All other non-Federal entities, such as tribes (collectively, non-state entities), must have 

and use their own documented procurement procedures that reflect applicable SLTT laws and 

regulations, provided that the procurements conform to applicable Federal law and the 

standards identified in 2 C.F.R. Part 200. These standards include, but are not limited to, 

providing for full and open competition consistent with the standards of 2 C.F.R. § 200.319 

and the required procurement methods at § 200.320.

a. Important Changes to Procurement Standards in 2 C.F.R. Part 200

OMB recently updated various parts of Title 2 of the Code of Federal Regulations, among 

them, the procurement standards. States are now required to follow the socioeconomic steps 

in soliciting small and minority businesses, women’s business enterprises, and labor surplus 

area firms per 2 C.F.R. § 200.321. All non-Federal entities should also, to the greatest extent 

practicable under a Federal award, provide a preference for the purchase, acquisition, or use 

of goods, products, or materials produced in the United States per 2 C.F.R. § 200.323. More 

information on OMB’s revisions to the Federal procurement standards can be found in 

Purchasing Under a FEMA Award: OMB Revisions Fact Sheet.

The recognized procurement methods in 2 C.F.R. § 200.320 have been reorganized into 

informal procurement methods, which include micro-purchases and small purchases; formal 

procurement methods, which include sealed bidding and competitive proposals; and 

noncompetitive procurements. The Federal micro-purchase threshold is currently $10,000, 

and non-state entities may use a lower threshold when using micro-purchase procedures 

under a FEMA award. If a non-state entity wants to use a micro-purchase threshold higher 

than the Federal threshold, it must follow the requirements of 2 C.F.R. § 200.320(a)(1)(iii)-
35 

(v). The Federal simplified acquisition threshold is currently $250,000, and a non-state entity 

may use a lower threshold but may not exceed the Federal threshold when using small 

purchase procedures under a FEMA award. See 2 C.F.R. § 200.1 (citing the definition of 

simplified acquisition threshold from 48 C.F.R. Part 2, Subpart 2.1). 

See 2 C.F.R. §§ 200.216, 200.471, and Appendix II as well as section D.13.a of the NOFO 

regarding prohibitions on covered telecommunications equipment or services.

b. Competition and Conflicts of Interest

Among the requirements of 2 C.F.R. § 200.319(b) applicable to all non-Federal entities other 

than states, in order to ensure objective contractor performance and eliminate unfair 

competitive advantage, contractors that develop or draft specifications, requirements, 

statements of work, or invitations for bids or requests for proposals must be excluded from 

competing for such procurements. FEMA considers these actions to be an organizational 

conflict of interest and interprets this restriction as applying to contractors that help a nonFederal entity develop its grant application, project plans, or project budget. This prohibition 

also applies to the use of former employees to manage the grant or carry out a contract when 

those former employees worked on such activities while they were employees of the nonFederal entity.

Under this prohibition, unless the non-Federal entity solicits for and awards a contract 

covering both development and execution of specifications (or similar elements as described 

above), and this contract was procured in compliance with 2 C.F.R. §§ 200.317 – 200.327, 

Federal funds cannot be used to pay a contractor to carry out the work if that contractor also 

worked on the development of those specifications. This rule applies to all contracts funded 

with Federal grant funds, including pre-award costs, such as grant writer fees, as well as postaward costs, such as grant management fees.

Additionally, some of the situations considered to be restrictive of competition include, but 

are not limited to:

• Placing unreasonable requirements on firms for them to qualify to do business.

• Requiring unnecessary experience and excessive bonding.

• Noncompetitive pricing practices between firms or between affiliated companies.

• Noncompetitive contracts to consultants that are on retainer contracts.

• Organizational conflicts of interest.

• Specifying only a “brand name” product instead of allowing “an equal” product to be 

offered and describing the performance or other relevant requirements of the 

procurement.

• Any arbitrary action in the procurement process.

Per 2 C.F.R. § 200.319(c), non-Federal entities other than states must conduct procurements 

in a manner that prohibits the use of statutorily or administratively imposed SLTT 

geographical preferences in the evaluation of bids or proposals, except in those cases where 

applicable Federal statutes expressly mandate or encourage geographic preference. Nothing 

in this section preempts state licensing laws. When contracting for architectural and 

engineering services, geographic location may be a selection criterion provided its 
36 

application leaves an appropriate number of qualified firms, given the nature and size of the 

project, to compete for the contract.

Under 2 C.F.R. § 200.318(c)(1), non-Federal entities other than states are required to 

maintain written standards of conduct covering conflicts of interest and governing the actions 

of their employees engaged in the selection, award, and administration of contracts. No 

employee, officer, or agent may participate in the selection, award, or administration of 

a contract supported by a Federal award if he or she has a real or apparent conflict of 

interest. Such conflicts of interest would arise when the employee, officer or agent, any 

member of his or her immediate family, his or her partner, or an organization that employs or 

is about to employ any of the parties indicated herein, has a financial or other interest in or a 

tangible personal benefit from a firm considered for a contract. The officers, employees, and 

agents of the non-Federal entity may neither solicit nor accept gratuities, favors, or anything 

of monetary value from contractors or parties to subcontracts. However, non-Federal entities 

may set standards for situations in which the financial interest is not substantial, or the gift is 

an unsolicited item of nominal value. The standards of conduct must provide for disciplinary 

actions to be applied for violations of such standards by officers, employees, or agents of the 

non-Federal entity. 

Under 2 C.F.R. 200.318(c)(2), if the recipient or subrecipient (other than states) has a parent, 

affiliate, or subsidiary organization that is not a state, local, tribal, or territorial government, 

the non-Federal entity must also maintain written standards of conduct covering 

organizational conflicts of interest. In this context, organizational conflict of interest means 

that because of a relationship with a parent company, affiliate, or subsidiary organization, the 

non-Federal entity is unable or appears to be unable to be impartial in conducting a 

procurement action involving a related organization. The non-Federal entity must disclose in 

writing any potential conflicts of interest to FEMA or the pass-through entity in accordance 

with applicable FEMA policy.

c. Supply Schedules and Purchasing Programs

Generally, a non-Federal entity may seek to procure goods or services from a Federal supply 

schedule, state supply schedule, or group purchasing agreement.

I. GENERAL SERVICES ADMINISTRATION SCHEDULES

States, tribes, and local governments, and any instrumentality thereof (such as local 

education agencies or institutions of higher education) may procure goods and services from 

a General Services Administration (GSA) schedule. GSA offers multiple efficient and 

effective procurement programs for state, tribal, and local governments, and instrumentalities 

thereof, to purchase products and services directly from pre-vetted contractors. The GSA 

Schedules (also referred to as the Multiple Award Schedules and the Federal Supply 

Schedules) are long-term government-wide contracts with commercial firms that provide 

access to millions of commercial products and services at volume discount pricing.
37 

Information about GSA programs for states, tribes, and local governments, and 

instrumentalities thereof, can be found at https://www.gsa.gov/resources-for/programs-forState-and-local-governments and https://www.gsa.gov/buying-selling/purchasingprograms/gsa-schedules/schedule-buyers/state-and-local-governments.

For tribes, local governments, and their instrumentalities that purchase off of a GSA 

schedule, this will satisfy the Federal requirements for full and open competition provided 

that the recipient follows the GSA ordering procedures; however, tribes, local governments, 

and their instrumentalities will still need to follow the other rules under 2 C.F.R. §§ 200.317 

– 200.327, such as solicitation of minority businesses, women’s business enterprises, small 

businesses, or labor surplus area firms (§ 200.321), domestic preferences (§ 200.323), 

contract cost and price (§ 200.324), and required contract provisions (§ 200.327 and 

Appendix II).

II. OTHER SUPPLY SCHEDULES AND PROGRAMS

For non-Federal entities other than states, such as tribes, local governments, and nonprofits, 

that want to procure goods or services from a state supply schedule, cooperative purchasing 

program, or other similar program, in order for such procurements to be permissible under 

Federal requirements, the following must be true:

• The procurement of the original contract or purchasing schedule and its use by the 

non-Federal entity complies with state and local law, regulations, and written 

procurement procedures.

• The state or other entity that originally procured the original contract or purchasing 

schedule entered into the contract or schedule with the express purpose of making it 

available to the non-Federal entity and other similar types of entities;

• The contract or purchasing schedule specifically allows for such use, and the work to 

be performed for the non-Federal entity falls within the scope of work under the 

contract as to type, amount, and geography;

• The procurement of the original contract or purchasing schedule complied with all the 

procurement standards applicable to a non-Federal entity other than states under at 2 

C.F.R. §§ 200.317 – 200.327; and

• With respect to the use of a purchasing schedule, the non-Federal entity must follow 

ordering procedures that adhere to applicable state, tribal, and local laws and 

regulations and the minimum requirements of full and open competition under 2 

C.F.R. Part 200.

If a non-Federal entity other than a state seeks to use a state supply schedule, cooperative 

purchasing program, or other similar type of arrangement, FEMA recommends the recipient 

discuss the procurement plans with its FEMA Program Manager.

d. Procurement Documentation

Per 2 C.F.R. § 200.318(i), non-Federal entities other than states and territories are required to 

maintain and retain records sufficient to detail the history of procurement covering at least 

the rationale for the procurement method, selection of contract type, contractor selection or 

rejection, and the basis for the contract price. States and territories are encouraged to 
38 

maintain and retain this information as well and are reminded that in order for any cost to be 

allowable, it must be adequately documented per 2 C.F.R. § 200.403(g). 

Examples of the types of documents that would cover this information include but are not 

limited to:

• Solicitation documentation, such as requests for quotes, invitations for bids, or 

requests for proposals.

• Responses to solicitations, such as quotes, bids, or proposals.

• Pre-solicitation independent cost estimates and post-solicitation cost/price analyses on 

file for review by Federal personnel, if applicable.

• Contract documents and amendments, including required contract provisions; and

• Other documents required by Federal regulations applicable at the time a grant is 

awarded to a recipient.

• Additional information on required procurement records can be found on pages 24-26 

of the PDAT Field Manual.

7. Record Retention

a. Record Retention Period

Financial records, supporting documents, statistical records, and all other non-Federal entity 

records pertinent to a Federal award generally must be maintained for at least three years 

from the date the final FFR is submitted. See 2 C.F.R. § 200.334. Further, if the recipient 

does not submit a final FFR and the award is administratively closed, FEMA uses the date of 

administrative closeout as the start of the general record retention period.

• The record retention period may be longer than three years or have a different start 

date in certain cases. These include: 

• Records for real property and equipment acquired with Federal funds must be 

retained for three years after final disposition of the property. See 2 C.F.R. § 

200.334(c). 

• If any litigation, claim, or audit is started before the expiration of the three-year 

period, the records must be retained until all litigation, claims, or audit findings 

involving the records have been resolved and final action taken. See 2 C.F.R. § 

200.334(a). 

• The record retention period will be extended if the non-Federal entity is notified in 

writing of the extension by FEMA, the cognizant or oversight agency for audit, or the 

cognizant agency for indirect costs, or pass-through entity. See 2 C.F.R. § 200.334(b). 

• Where FEMA requires recipients to report program income after the period of 

performance ends, the program income record retention period begins at the end of 

the recipient’s fiscal year in which program income is earned. See 2 C.F.R. § 

200.334(e). 

• For indirect cost rate computations and proposals, cost allocation plans, or any similar 

accounting computations of the rate at which a particular group of costs is chargeable 

(such as computer usage chargeback rates or composite fringe benefit rates), the start 

of the record retention period depends on whether the indirect cost rate documents 

were submitted for negotiation. If the indirect cost rate documents were submitted for 

negotiation, the record retention period begins from the date those documents were 

submitted for negotiation. If indirect cost rate documents were not submitted for 
39 

negotiation, the record retention period begins at the end of the recipient’s fiscal year 

or other accounting period covered by that indirect cost rate. See 2 C.F.R. § 

200.334(f).

b. Types of Records to Retain

FEMA requires that non-Federal entities maintain the following documentation for Federally 

funded purchases:

• Specifications

• Solicitations

• Competitive quotes or proposals

• Basis for selection decisions

• Purchase orders

• Contracts

• Invoices

• Cancelled checks

Non-Federal entities should keep detailed records of all transactions involving the grant. 

FEMA may at any time request copies of any relevant documentation and records, including 

purchasing documentation along with copies of cancelled checks for verification. See, e.g., 2 

C.F.R. §§ 200.318(i), 200.334, 200.337.

In order for any cost to be allowable, it must be adequately documented per 2 C.F.R. § 

200.403(g). Non-Federal entities who fail to fully document all purchases may find their 

expenditures questioned and subsequently disallowed.

8. Actions to Address Noncompliance 

Non-Federal entities receiving financial assistance funding from FEMA are required to 

comply with requirements in the terms and conditions of their awards or subawards, 

including the terms set forth in applicable Federal statutes, regulations, NOFOs, and policies. 

Throughout the award lifecycle or even after an award has been closed, FEMA or the passthrough entity may discover potential or actual noncompliance on the part of a recipient or 

subrecipient. This potential or actual noncompliance may be discovered through routine 

monitoring, audits, closeout, or reporting from various sources.

In the case of any potential or actual noncompliance, FEMA may place special conditions on 

an award per 2 C.F.R. §§ 200.208 and 200.339, FEMA may place a hold on funds until the 

matter is corrected, or additional information is provided per 2 C.F.R. § 200.339, or it may do 

both. Similar remedies for noncompliance with certain Federal civil rights laws are 

authorized pursuant to 44 C.F.R. Parts 7 and 19.

In the event the noncompliance is not able to be corrected by imposing additional conditions 

or the recipient or subrecipient refuses to correct the matter, FEMA might take other 

remedies allowed under 2 C.F.R. § 200.339. These remedies include actions to disallow 

costs, recover funds, wholly or partly suspend or terminate the award, initiate suspension and 

debarment proceedings, withhold further Federal awards, or take other remedies that may be 

legally available. For further information on termination due to noncompliance, see the 

section on Termination Provisions in the NOFO.
40 

FEMA may discover and take action on noncompliance even after an award has been closed. 

The closeout of an award does not affect FEMA’s right to disallow costs and recover funds 

as long the action to disallow costs takes place during the record retention period. See 2 

C.F.R. §§ 200.334, 200.345(a). Closeout also does not affect the obligation of the nonFederal entity to return any funds due as a result of later refunds, corrections, or other 

transactions. 2 C.F.R. § 200.345(a)(2).

The types of funds FEMA might attempt to recover include, but are not limited to, improper 

payments, cost share reimbursements, program income, interest earned on advance payments, 

or equipment disposition amounts.

FEMA may seek to recover disallowed costs through a Notice of Potential Debt Letter, a 

Remedy Notification, or other letter. The document will describe the potential amount owed, 

the reason why FEMA is recovering the funds, the recipient’s appeal rights, how the amount 

can be paid, and the consequences for not appealing or paying the amount by the deadline.

If the recipient neither appeals nor pays the amount by the deadline, the amount owed will 

become final. Potential consequences if the debt is not paid in full or otherwise resolved by 

the deadline include the assessment of interest, administrative fees, and penalty charges; 

administratively offsetting the debt against other payable Federal funds; and transferring the 

debt to the U.S. Department of the Treasury for collection.

FEMA notes the following common areas of noncompliance for FEMA’s grant programs:

• Insufficient documentation and lack of record retention.

• Failure to follow the procurement under grants requirements.

• Failure to submit closeout documents in a timely manner.

• Failure to follow EHP requirements.

• Failure to comply with the POP deadline

9. Audits 

FEMA grant recipients are subject to audit oversight from multiple entities including the 

DHS OIG, the GAO, the pass-through entity, or independent auditing firms for single audits, 

and may cover activities and costs incurred under the award. Auditing agencies such as the 

DHS OIG, the GAO, and the pass-through entity (if applicable), and FEMA in its oversight 

capacity, must have access to records pertaining to the FEMA award. Recipients and 

subrecipients must retain award documents for at least three years from the date the final 

FFR is submitted, and even longer in many cases subject to the requirements of 2 C.F.R. § 

200.334. In the case of administrative closeout, documents must be retained for at least three 

years from the date of closeout, or longer subject to the requirements of 2 C.F.R. § 200.334. 

If documents are retained longer than the required retention period, the DHS OIG, the GAO, 

and the pass-through entity, as well as FEMA in its oversight capacity, have the right to 

access these records as well. See 2 C.F.R. §§ 200.334, 200.337.

Additionally, non-Federal entities must comply with the single audit requirements at 2 C.F.R. 

Part 200, Subpart F. Specifically, non-Federal entities, other than for-profit subrecipients, 

that expend $750,000 or more in Federal awards during their fiscal year must have a single or 
41 

program-specific audit conducted for that year in accordance with Subpart F. 2 C.F.R. § 

200.501. A single audit covers all Federal funds expended during a fiscal year, not just 

FEMA funds. The cost of audit services may be allowable per 2 C.F.R. § 200.425, but nonFederal entities must select auditors in accordance with 2 C.F.R. § 200.509, including 

following the proper procurement procedures. For additional information on single audit 

reporting requirements, see section F of this NOFO under the header “Single Audit Report” 

within the subsection “Additional Reporting Requirements.”

The objectives of single audits are to:

• Determine if financial statements conform to generally accepted accounting 

principles (GAAP);

• Determine whether the schedule of expenditures of Federal awards is presented fairly;

• Understand, assess, and test the adequacy of internal controls for compliance with 

major programs; and

• Determine if the entity complied with applicable laws, regulations, and contracts or 

grants.

For single audits, the auditee is required to prepare financial statements reflecting its 

financial position, a schedule of Federal award expenditures, and a summary of the status of 

prior audit findings and questioned costs. The auditee also is required to follow up and take 

appropriate corrective actions on new and previously issued but not yet addressed audit 

findings. The auditee must prepare a corrective action plan to address the new audit findings. 

2 C.F.R. §§ 200.508, 200.510, 200.511.

Non-Federal entities must have an audit conducted, either single or program-specific, of their 

financial statements and Federal expenditures annually or biennially pursuant to 2 C.F.R. § 

200.504. Non-Federal entities must also follow the information submission requirements of 2 

C.F.R. § 200.512, including submitting the audit information to the Federal Audit 

Clearinghouse within the earlier of 30 calendar days after receipt of the auditor’s report(s) or 

nine months after the end of the audit period. The audit information to be submitted include 

the data collection form described at 2 C.F.R. § 200.512(c) and Appendix X to 2 C.F.R. Part 

200 as well as the reporting package described at 2 C.F.R. § 200.512(b).

The non-Federal entity must retain one copy of the data collection form and one copy of the 

reporting package for three years from the date of submission to the Federal Audit 

Clearinghouse. 2 C.F.R. § 200.512; see also 2 C.F.R. § 200.517 (setting requirements for 

retention of documents by the auditor and access to audit records in the auditor’s possession).

FEMA, the DHS OIG, the GAO, and the pass-through entity (if applicable), as part of 

monitoring or as part of an audit, may review a non-Federal entity’s compliance with the 

single audit requirements. In cases of continued inability or unwillingness to have an audit 

conducted in compliance with 2 C.F.R. Part 200, Subpart F, FEMA and the pass-through 

entity, if applicable, are required to take appropriate remedial action under 2 C.F.R. § 

200.339 for noncompliance, pursuant to 2 C.F.R. § 200.505.

10. Payment Information
42 

FEMA uses the Direct Deposit/Electronic Funds Transfer (DD/EFT) method of payment to 

recipients.

FEMA utilizes the Payment and Reporting System (PARS) for financial reporting, invoicing, 

and tracking payments. For additional information, refer to 

https://isource.fema.gov/sf269/execute/LogIn?sawContentMessage=true. 

11. Whole Community Preparedness

Preparedness is a shared responsibility that calls for the involvement of everyone—not just 

the government—in preparedness efforts. By working together, everyone can help keep the 

nation safe from harm and help keep it resilient when struck by hazards, such as natural 

disasters, acts of terrorism, and pandemics.

Whole Community includes:

• Individuals and families, including those with access and functional needs

• Businesses

• Faith-based and community organizations

• Nonprofit groups

• Schools and academia

• Media outlets

• All levels of government, including state, local, tribal, territorial, and Federal partners

The phrase “Whole Community” often appears in preparedness materials, as it is one of the 

guiding principles. It means two things:

1. Involving people in the development of national preparedness documents.

2. Ensuring their roles and responsibilities are reflected in the content of the 

materials.
43 

Appendix A: Program Guidelines and Application Content Requirements

Overview. Over the last several years our nation has witnessed an exponential rise in threat 

vectors and cyber-attacks with disruptive and destructive physical consequences. Industrial 

control systems and other supporting information technology which power energy, water, 

communications, and other critical infrastructure sectors are becoming increasingly 

interdependent and attractive as targets. 

Guidelines.

Support the 2022-2026 FEMA Strategic Plan. NCPC partners will support the strategic goals and 

objectives described in the 2022-2026 FEMA Strategic Plan to the greatest extent possible.

Training Must Address the Needs of Underserved Communities. In addition to serving a 

nationwide audience of various jurisdictions and communities, NCPC partners will plan and 

implement training to address the needs of underserved communities, as appropriate.

Needs Analysis. The NCPC’s training proposal/statement of work must identify and explain 

preparedness gaps that could be addressed through cybersecurity training development and 

delivery that are distinct from other national training programs and FEMA courses. NCPC 

partners will use NTED’s Unified Training Needs Assessment (UTNA) process to verify that 

training solutions to be developed, or to be sustained target the need, align with the FEMA 

mission, are not duplicative, and are cost effective in terms of content, modality, and delivery.

Target Audience. Cybersecurity training must empower technical and non-technical personnel in 

key roles including cybersecurity and information technology professionals, leadership and 

organizational decision makers, SLTT emergency responders and end users.

Standards. Proposed training must be consistent with the guidelines found in the following:

• Executive Order 14028: Improving the Nation’s Cybersecurity. Signed by President 

Biden May 12, 2021. https://www.whitehouse.gov/briefing-room/presidentialactions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

• Executive Order 13636: Improving Critical Infrastructure Cybersecurity. Signed by 

President Obama February 12, 2013. Additional information can be found at 

https://www.Federalregister.gov/documents/2013/02/19/2013-03915/improving-criticalinfrastructure-cybersecurity. 

• Executive Order 13691: Promoting Private Sector Cybersecurity Information Sharing. 

Signed by President Obama February 13, 2015. Additional information can be found at 

https://www.Federalregister.gov/documents/2015/02/20/2015-03714/promoting-privatesector-cybersecurity-information-sharing. 

• DHS’s Critical Infrastructure Cyber Community C3 Voluntary Program also provides 

resources to support critical infrastructure owners and operators in the adoption of the 

Framework to manage cyber risk more effectively. It was launched in February 2014 to 

support Executive Order 13636. Additional information on the C3 Program can be found 

at https://www.dhs.gov/ccubedvp;
44 

• Presidential Policy Directive 21: Critical Infrastructure Security and Resilience. More 

information is available at https://obamawhitehouse.archives.gov/the-pressoffice/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil/

• The National Institute of Standards and Technology (NIST) Framework for improving 

Critical Infrastructure Cybersecurity to better manage cybersecurity risk. This document 

was released February 12, 2014 and is available at 

http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf; 

• The National Cybersecurity Workforce Framework. This document is available at 

https://niccs.us-cert.gov/training/tc/framework; and 

• The Nationwide Cyber Security Review (NCSR) findings and recommendations. The 

NCSR identifies the level of maturity and risk awareness of state and local government 

information. This document is available at MS-ISAC (cisecurity.org)

• CISA National Cyber Incident Scoring System

The CISA National Cyber Incident Scoring System (NCISS) is a framework designed to 

provide a repeatable and consistent mechanism for estimating the impact of a cyber 

incident. https://www.cisa.gov/uscert/CISA-National-Cyber-Incident-Scoring-System

• Comprehensive National Cybersecurity Initiative

The CNCI consists of initiatives and goals designed to help secure the United States in 

cyberspace. https://obamawhitehouse.archives.gov/issues/foreignpolicy/cybersecurity/national-initiative

• E-Government Act of 2002 including Title III - The Federal Information Security 

Management (FISMA) Act

The purpose of this Act is to enhance the management and promotion of electronic 

government services and processes. Title III of this act is the Federal Information 

Security Management Act of 2002. The E-Government Act permanently supersedes the 

Homeland Security Act in those instances where both Acts prescribe different 

amendments to the same provisions of the United States Code. 

https://csrc.nist.gov/projects/risk-management/fisma-background.

• IT Sector Baseline Risk Assessment

The ITSRA identifies and prioritizes national-level risks to critical functions delivered 

and maintained by the IT Sector and relied on by all critical infrastructure sectors. 

https://www.hsdl.org/?abstract&did=4214

• National Infrastructure Protection Plan

NIPP 2013 outlines how government and private sector participants in the critical 

infrastructure community work together to manage risks and achieve security and 

resilience outcomes. https://www.cisa.gov/national-infrastructure-protection-plan

• Office of Management and Budget Memoranda M-22-09 

Guidance of moving the U.S. government towards zero trust cybersecurity principles. 

https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

• Office of Management and Budget Guidance on FISMA

M-22-05 provides current Administration information security priorities, FY 2021-2022 

Federal Information Security Management Act (FISMA) and Privacy Management 

reporting guidance and deadlines, and policy guidelines to improve Federal information 

security posture. https://www.whitehouse.gov/wp-content/uploads/2021/12/M-22-05-

FY22-FISMA-Guidance.pdf

• Office of Management and Budget Memoranda M-22-01 
45 

Guidance on improving detection of cybersecurity vulnerabilities and incidents on 

Federal government systems through endpoint detection and response. 

https://www.whitehouse.gov/wp-content/uploads/2021/10/M-22-01.pdf

Adult Learning Approach. NCPC training programs will use an adult learning approach across of 

variety of modalities and delivery methods including classroom instruction, virtual training, 

learning through workshops and seminars, interactive web-based and computer-based training. 

Adult learning theory includes the following key components outlining the general ways in 

which adults perceive learning and how they prefer to train: Self-Concept, Adult Learner 

Experience, Readiness to Learn, Orientation of Learning, and Motivation to Learn. 

Instructional Systems Design Expertise. NCPC partners must have staff members qualified in the 

field of Instructional Systems Design whose primary responsibilities are to design and develop 

instructional content for web-based and/or instructor-led courseware.

Non-Duplication of Existing Training Programs. NCPC-developed training must not duplicate 

training provided by Federal, state, local, tribal, or territorial departments and agencies, or other 

training providers. 

Course Mapping. NCPC partners will use NTED’s course mapping process to determine 

appropriate course complexity, learning levels, and alignment with Mission Areas and Core 

Capabilities. 

Application Content. The NCPC application must include the following:

Executive Summary. An executive summary that includes the following data and information, as 

appropriate:

• Statement(s) regarding the NCPC’s planned approach for identifying and reaching 

underserved communities 

• Statement(s) explaining the NCPC’s status for implementing Level 3 evaluations 

• Current funds balance from previous awards 

• An estimated number of backlogged training requests using evidence-based data such as 

student requests or registrations that have not received course allocations

• Number of active certified courses

• Number of proposed new courses

• Average cost per student per course

• Anticipated student throughput per course 

Program Narrative, Part 1. Provide detailed explanations for the following:

• Program alignment with the 2022-2026 FEMA Strategic Plan, National Preparedness 

Goal, National Preparedness System, National Incident Management System, National 

Planning Frameworks, Mission Areas, and Core Capabilities.

• Plan for addressing the needs of underserved communities that includes a listing of 

community and risk data sources, data analysis methodology, community engagement 

strategies, and decision processes for determining training delivery offerings.
46 

• Plan for implementing and advancing Level 3 evaluations to include details on how 

surveys will be delivered to students, examples of accompanying messages to encourage 

student participation and follow up reminder messages, data collection and assessment 

practices, and process for reporting data and information to NTED.

• Descriptions of program management structures to illustrate how the program is 

organized and managed within the NCPC. The NCPC must provide an organizational 

chart and describe how the organization will support the program.

• A detailed program schedule to reflect the program life cycle with phases, deliverables, 

and outcomes arranged and explained.

• A process for identifying lessons learned and best practices for inclusion in ongoing 

FEMA and DHS efforts.

Program Narrative, Part 2 (Training Objectives). The NCPC must describe their planned 

approach to design, develop, implement, and evaluate training aligned with the following 

objectives:

• Update Existing and Develop New Training for Emerging Cyber Threats and Incidents 

with Physical Consequences. Training should:

o Address the need to develop, assess, exercise, and update cyber plans and target the 

need to prepare for emerging cyber threats and incidents, especially those with the 

potential to result in physical consequences or otherwise impact the continuity of 

government at all levels.

o Educate participants on common terminology, best practices, resources, and planning 

considerations when developing cyber incident response, disaster recovery, and 

continuity plans.

o Address cyber incidents/attacks with physical consequences, in which the attacker(s) 

access a physical asset within a community’s critical infrastructure, such as a utilities 

provider, hospital, government organization, or 911 system.

o Relate risks to mitigation actions including the development and use of 

comprehensive cyber incident response planning tools and superior information 

system protection.

o Present key cyber preparedness program and plan components, including: identify 

cyber dependent information and information systems that support critical services 

and related dependencies; prioritize and plan for service and system disruptions; 

identify roles and responsibilities; provide integrated communication and public 

messaging; establish partnerships and information sharing procedures; and 

incorporate planning considerations for specific threat types, such as ransomware 

o Support the development of community-level cybersecurity preparedness, through 

development and delivery of a workshop that brings together community members 

from all sectors to establish a baseline awareness of cybersecurity threats and risks, 

provide knowledge of the challenges of preparing for, responding to, and recovering 

from a cyber incident, and prepare communities to integrate cybersecurity into 

planning.

• Support Development of Cybersecurity Certificate Programs. 

o The NCPC will collaborate with the Emergency Management Institute (EMI) to 

develop and support a cybersecurity certificate program for the emergency 

management community.
47 

o The NCPC will identify and develop a competency-based certificate program that 

will award individuals who successfully complete specific cybersecurity courses in 

one or more of the NCPC focus areas to include End User Awareness, 

Management/Leadership, and Information Technology. After completing all required 

courses under any specific category, the individual is awarded a certificate of 

completion. 

• Leadership and Cybersecurity. Training should:

o Provide SLTT executive leaders a comprehensive understanding of multi-sector 

dependencies and interdependencies, common operating environments across all 

levels of government, public and private partnerships, information sharing and 

collaboration methods/benefits, and interagency and intergovernmental resources and 

capabilities.

o Enhance the ability of SLTT executive leaders to address the challenges of planning 

for, protecting against, mitigating, responding to, and recovering from a cyber 

incident.

o Define roles and responsibilities for securing digital information, networks, critical 

infrastructure, and other assets for SLTT executive leaders within their jurisdictions, 

agencies, organizations, and communities.

o Address coordination activities with SLTT and Federal partners and emphasize 

compliance and consistency with applicable laws, regulatory requirements, NIST 

guidelines, and DHS policies and procedures.

• Threats Against Information Technology, Operational Technology, and Critical 

Infrastructure During Other Disasters and Incidents Resulting in Cascading Impacts. 

Training should:

o Highlight the likelihood of cyber-attacks coinciding with climate related disaster such 

as severe storms, wildfires, and hurricanes, and human caused disasters such as 

terrorist incidents that result in cascading impacts that could severely impact hamper 

response efforts and imperil survivors and provide approaches to reduce risks and 

mitigate impacts.

• Increase Delivery of Existing NCPC Training Programs and Implement New Courses. 

o The NCPC shall incrementally increase delivery of existing training by at least 50% 

compared with the average number of course completions between 2019 and 2022 by 

September 30, 2026.

Work Breakdown Structure. The NCPC will provide a work breakdown structure (WBS) as part 

of the application. A WBS is a task-oriented schematic of activities that organizes, defines, and 

graphically displays the total work to achieve the final objectives of a project.

The WBS applies a system for subdividing a project into manageable work packages, 

components, or elements to provide a common framework for scope/cost/schedule 

communications, allocation of responsibility, risk management, performance-based evaluations, 

and a quality control plan. The WBS establishes deliverables arranged on an anticipated timeline. 

Each descending level represents an increasingly detailed definition of the project objective. 

Components of the WBS include, but are not limited to, the following:
48 

• A risk management plan describing the approach for identifying and managing risks, and 

identifying known or postulated events or factors that could prevent a recipient from 

meeting program objectives (cost, schedule, scope, performance, or quality);

• A performance-based evaluation plan, including program performance measures that will 

assess the attainment of goals, objectives, outcomes, and which details a data collection 

plan including the analysis of data; and

• A quality control plan for the development and delivery of programs and courses.

Equipment Plan. The NCPC must provide an equipment-purchasing plan for proposed 

equipment purchases that are required to support the program. At a minimum, the plan must 

detail planned equipment purchases, why they are necessary, and the costs of the equipment.

Detailed Budget. The NCPC must provide a detailed budget by task and a summary budget 

aggregating task costs into the categories of personnel, fringe benefits, travel, equipment, 

supplies, consultants/contracts, other costs, indirect costs, and the total budget. Submit the 

detailed budget with the grant application as a file attachment within FEMA GO. The budget 

must be complete, reasonable, and cost-effective in relation to the proposed project. The budget 

should provide the basis of computation of all project-related costs, any appropriate narrative, 

and a detailed justification of M&A costs. Budget information must also address the following:

• Personnel. The NCPC must indicate the total projected salary and wages for all project 

personnel. Compensation paid for employees engaged in activities must be consistent 

with that paid for similar work within the NCPC organization.

• Travel. The NCPC must provide the total projected cost for travel. The NCPC should 

determine costs by the projected number of trips multiplied by the number of people 

traveling multiplied by an average cost for travel and per diem (airfare, lodging, meals). 

Separate travel for development of training and delivery of training in the detailed budget 

but include all travel costs as a single total in the summary budget. Detail travel 

performed at the request of NTED under travel for development of training.

• Equipment. The NCPC must provide the total projected cost for non-expendable items. 

Non-expendable equipment is tangible property having a useful life of more than one 

year and an acquisition cost of $5,000 or more per unit. The NCPC may use the 

organization’s own capitalization policy and threshold amount for classification of 

equipment. Expendable items should be included either in the “Supplies” category or in 

the “Other” category. The NCPC should analyze the cost benefits of purchasing versus 

leasing equipment, especially high-cost items, and those subject to rapid technical 

advances. List rented or leased equipment costs in the “Contracts” category. Identify and 

explain equipment purchases.

• Supplies. The NCPC must provide the total projected cost of supplies (e.g., office 

supplies, postage, training materials, copying paper, and other expendable items, such as 

books and hand-held tape-recording devices). The organization’s own capitalization 

policy and threshold amount for classification of supplies may be used. Generally, 

supplies include any materials that are expendable or consumed during the project.

• Consultants/Contracts. The NCPC must provide the total projected cost of consultants 

and contracts. Identify and justify the type of consultant/contract.
49 

• Other Costs. The NCPC must provide a total projected cost of miscellaneous items (e.g., 

rent, reproduction, telephone, janitorial or security services, and investigative or 

confidential funds).

• Indirect Costs. A copy of an active indirect cost rate agreement must be included in the 

detailed budget as required for all NCPC applicants. If the NCPC is not required to have 

an indirect cost rate agreement but will charge indirect costs and is required to have an 

indirect cost rate proposal, the NCPC must provide a copy of their indirect cost rate 

proposal with the application. FEMA will evaluate indirect costs as part of the application 

for Federal funds to determine if allowable and reasonable.