What criteria should municipalities follow when contracting for external cybersecurity management, monitoring, tracking, and auditing services?

Municipalities should refer to the State and Local Cybersecurity Grant Program (“SLCGP”) Notice of Funding Opportunity (“NOFO”) to guide them in contracting for external cybersecurity management, monitoring, tracking, and auditing services. Eligible incurred costs under the SLCGP must comply with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements outlined at 2 C.F.R. Part 200, including, among other requirements, the requirement that “costs must be incurred, and products and services must be delivered, within the period of performance of the award.”[1]  

Further, the procurement of any services must comport with procurement standards outlined at 2 C.F.R. §§ 200.317–200.327, including following recognized procurement methods and respecting socioeconomic considerations related to soliciting small and minority businesses, women’s business enterprises, and labor surplus area firms.[2]

Generally, costs associated with management and administration fall into one of the seven allowable expense categories enumerated in the SLCGP NOFO.[3] Accordingly, administrative costs related to management, monitoring, tracking, and auditing services could all be considered eligible costs, as long as the costs are reasonable and allocable to the grant, and provided the contracts for the services follow the procurement standards at 2 C.F.R. §§ 200.317–200.327.[4] Finally, the SLCGP Notice of Funding Opportunity specifies that the maximum amount of funding for management and administrative costs is five percent of the SLCGP award.[5]