White House Shifting Cyber Risk to State and Local Agencies

The White House is shifting cybersecurity risk management from the federal government to states and local agencies, marking a pivot in how Washington supports the protection of elections and other critical infrastructure.

On Wednesday, U.S. President Donald Trump signed an executive order launching a new National Resilience Strategy within 90 days, aimed at giving states power “to make smart infrastructure choices” that address risks from cyberattacks and other physical disasters. The order states it is the policy of the U.S. government that “state and local governments and individuals play a more active and significant role in national resilience and preparedness.”

The executive order comes on the heels of deep cuts to federal agencies – Trump and billionaire special adviser Elon Musk have worked in part to slash key cybersecurity teams and gut federally funded programs that states and local governments rely on to defend elections and other underfunded critical infrastructure from a rising wave of cyber threats (see: CISA Defunds Threat-Sharing Hubs for States and Elections).

Experts tell Information Security Media Group that losing federal cybersecurity services – ranging from urgent vulnerability bulletins and management of the Known Exploited Vulnerabilities catalog to support for the National Vulnerability Database and free risk and resilience assessments – will force states to scramble for replacements, creating a patchwork of haves and have-nots based on their ability to backfill critical defenses.

“State budgets are already in trouble with the reduction in federal support, and difficult choices are being made,” said Michael Hamilton, former chief information security officer of Seattle and field CISO of Lumifi Cyber. Hamilton said the reduction in real-time threat information sharing, particularly within environments insulated from regulatory oversight, would be a “huge loss.” States including Washington are already exploring ways to unite the public and private sectors to create state-run threat information centers.

“Without the federal government’s ecosystem of infrastructure protection – government coordinating councils, sector coordinating councils, ISACs – we’re essentially on our own,” he added.

The Cybersecurity and Infrastructure Security Agency has defended cutting funding for state and election security hubs, arguing it is being a “good steward of taxpayer dollars” and aiming to eliminate duplication of services the agency already provides. But even as it makes those cuts, CISA has reduced its workforce since Trump took office and recently forced probationary employees onto administrative leave after a judge ordered the reinstatement of those removed – along with thousands of federal workers across other agencies (see: CISA Rehires Fired Employees, Immediately Puts Them on Leave).

Many states lack their own national security and cyber threat intelligence fusion centers, leaving them heavily reliant on external organizations like the federal government or ISACs for guidance, said Travis Rosiek, public sector chief technology officer at Rubrik.

“States face a pressing need to strengthen their cyber maturity and resilience, but this task is particularly daunting for K-12 schools, municipalities and local governments,” Rosiek told ISMG, adding that the issue is exacerbated by a national cyber talent gap. “States must gain increased budgets to implement broad and robust election security and cybersecurity practices to make informed decisions under pressure.”

The White House did not respond to requests for comment. The rollback of federal cybersecurity services marks a stark shift from years of bipartisan practice – even during Trump’s first term, when his administration established CISA and expanded federal cyber support for state and local elections.

Experts warn that decentralizing cyber preparedness will weaken threat responses, causing fragmentation, delays and inefficiencies, while the order could introduce transitional risks as states take on more responsibility.

“States will be fighting an uphill battle of fragmentation and isolation at a greater magnitude than ever before,” said April Lenhard, a fellow at the Center for a New American Security and principal product manager at Qualys. “This executive order is an immediate call to action for states to take on more responsibility, or risk endangering national security by becoming the weakest link.”