CISA Unveils Final $100M Cyber Grants as State Burdens Soar

The U.S. cyber defense agency is billing a $100 million cybersecurity grant rollout as a fresh investment in state and local protections, but experts say the grants are smaller than in past years and indicative of how the Trump administration is shifting cybersecurity responsibility to states without sufficient funding.

The Cybersecurity and Infrastructure Security Agency and the Federal Emergency Management Agency announced Friday more than $100 million in cybersecurity grant funding from two sources, the State and Local Cybersecurity Grant Program and the Tribal Cybersecurity Grant Program. The money is meant to support modernization efforts, lead to service improvements and buttress digital defenses.

CISA Acting Director Madhu Gottumukkala said the funding “ensures communities and our partners across the nation have the crucial resources needed to strengthen their cyber defense capabilities and mitigate risk.” The money is the final installment of funding authorized in 2021 and falls hundreds of millions short of previous years.

Congress initially appropriated $200 million in fiscal year 2022 for cybersecurity state grants and raised it to $400 million in 2023. The current level is “clearly insufficient” and includes stipulations that could create long-term financial burdens, said Mike Hamilton, former vice chair of the Department of Homeland Security’s state, local, tribal and territorial government coordinating council.

“There is simply not enough funding to compensate for the decrease in services offered by CISA, the Multi-State ISAC and the Center for Internet Security, all having lost significant funding themselves,” said Hamilton, who now serves as field CISO at Lumifi Cyber. The grant’s notice of funding opportunity requires grantees to maintain any capital purchases and services beyond the performance period, a condition that could lead to hesitation at accepting the grants, Hamilton said. “There is a reluctance to encumber the budget indefinitely to support them.”

The White House published an April executive order that effectively shifted the bulk of cybersecurity risk management from the federal government to state and local agencies, marking a significant change in how Washington supports the protection of critical infrastructure. The move came amid steep cuts to federal agencies, including CISA, which has lost a third of its workforce since January.

Deeper cybersecurity spending reductions proposed for the coming federal fiscal year could further strain states already struggling to defend against ransomware attacks, cyberespionage and breaches (see: Trump’s Cyber Rollbacks Expose States to Ransomware Attacks).

The threat landscape has changed dramatically since Congress first authorized the state and local grant programs: critical infrastructure is a prime target and geopolitical tensions have turned the cyber domain into contested terrain. One-time or time-limited funding, even when generous, may not be enough to build lasting cybersecurity maturity nationwide, said Ensar Seker, CISO of SOCRadar and a former security researcher at the NATO Cooperative Cyber Defense Center of Excellence.

“State and local governments are being asked to adopt sophisticated cybersecurity models, implement multi-layered controls, modernize legacy systems and collaborate with federal agencies on threat detection and response,” Seker told ISMG. “That’s a tall order even for large enterprises, let alone small counties or school districts operating with limited technical teams and budget constraints.”

State officials and lawmakers from both major political parties urged Congress earlier this year to reauthorize the cybersecurity grant programs, which are set to expire in September. Sean Plankey, President Donald Trump’s nominee to lead CISA, also voiced support for renewed federal investments in local cybersecurity efforts during his July confirmation hearing (see: Trump’s CISA Nominee Grilled Over 2020 Election Fraud Claims).

“A $100 million budget split more than 50 ways is insufficient to close the gap,” said Travis Rosiek, public sector chief technology officer at Rubrik and former red team director at the Defense Information Systems Agency.

“While $100 million may sound like a lot, it’s just a drop in the bucket – about as impactful as a Band-Aid in a pool,” he said.