FEMA Clarifies Cybersecurity Grant Rules for CIS Services and Drops NCSR Requirement
Summary
FEMA says SLCGP and TCGP funds can cover individually purchased CIS services under federal procurement standards, while bundled membership fees are ineligible. FEMA also removed the NCSR requirement for four grant programs.
Key points
- FEMA Information Bulletin No. 565 clarifies that SLCGP and TCGP funds may pay for CIS services purchased individually and in line with federal procurement standards.
- Eligible examples listed include network monitoring, managed detection and response, vulnerability scanning, penetration testing, malicious code analysis, and hardened system images.
- Bundled membership fees that include cybersecurity or technical services are not eligible under the bulletin; CIS says it will discuss options for separating those services.
- FEMA removed the Nationwide Cybersecurity Review requirement for SLCGP, TCGP, HSGP, and THSGP recipients; a replacement assessment may be introduced later.
- Grant-funded purchases still require compliance with federal procurement standards and transparent, itemized pricing.
Article Details
- Event Type
- Federal grant funding policy clarification
- Impact
- FEMA clarified that SLCGP and TCGP recipients may use grant funds to purchase CIS Services individually, subject to federal procurement standards and itemized, transparent pricing. Bundled membership fees that include cybersecurity or technical services are not eligible under the stated guidance. FEMA also removed the NCSR requirement for SLCGP, TCGP, HSGP, and THSGP recipients.