A cyber grant with a rising match is a sustainment test

The week

Most coverage of November 15, 2021 was about concrete and steel. That day, President Biden signed the Infrastructure Investment and Jobs Act, a law remembered for roads, bridges, water systems and broadband. Tucked inside it was something less visible but, for many town halls and county offices, just as consequential: dedicated federal money to defend their computer systems.

The signing closed a long legislative run. The Senate had passed the bill in August 2021 with support from both parties. The House passed it on November 5, after months of negotiation over a separate social spending package. The final law authorized roughly $1.2 trillion, most of it for physical infrastructure.

The law created the State and Local Cybersecurity Grant Program, funded at $1 billion over four fiscal years and administered by FEMA with CISA. FEMA, the Federal Emergency Management Agency, already runs many of the grants that flow from Washington to states for disasters and preparedness. CISA, the Cybersecurity and Infrastructure Security Agency, is the federal government’s civilian cyber defense agency and brought the technical expertise.

The authorized amounts were uneven by design: $200 million for fiscal 2022, $400 million for 2023, $300 million for 2024 and $100 million for 2025. The program peaked in its second year and then shrank.

What the statute required

The money came with conditions. To receive most funds, states had to form cybersecurity planning committees and submit cybersecurity plans for approval. Washington wanted each state to sit its key players around one table and write down what it intended to protect, and how, before the checks went out.

The law also pointed the money downward. States had to pass at least 80 percent of it through to local governments, with a quarter of the total reserved for rural areas. That matters because cities, counties, school districts and small towns run many of the services residents touch every day, from 911 dispatch to property records. Many do so with one or two IT staff and no security specialist at all.

Then came the detail that shaped everything else. The law required a non-federal cost share, the portion state and local governments had to pay themselves. It rose each year, from 10 percent in the first year to 40 percent in the fourth. A grant that starts generous and gets steadily less so is a message in itself.

The statute added guardrails that are easy to miss. Grant money could not be used to pay a ransom. It could not replace, or “supplant,” state and local money already being spent. It could not count toward the recipient’s own cost share, and no more than 5 percent could go to administration. A separate share was set aside for tribal governments, which DHS later ran as its own Tribal Cybersecurity Grant Program.

The formula was mechanical. Each state received a baseline of 1 percent, with smaller baselines for the territories. The remainder was divided half by population and half by rural population. That formula favored rural states relative to a pure population count.

The law separately created a Cyber Response and Recovery Fund for significant incidents, a pot meant for responding to serious attacks rather than building defenses ahead of time. It allowed the Secretary of Homeland Security to declare a significant incident and then provide voluntary assistance to affected non-federal entities. The same law also funded a separate Department of Energy program for cybersecurity at rural and municipal electric utilities.

The law also left a great deal to the states. It did not choose which local governments would benefit, which tools they would buy or how the state would divide its 80 percent. Those decisions fell to each state’s planning committee and grant office, within federal guidance. Two states with similar allocations could design very different programs. That latitude is why the design choices described below mattered as much as the federal rules.

Why localities had been waiting

The money arrived after several years of high-profile attacks on local government. Atlanta’s city systems were hit by ransomware in 2018, and Baltimore’s in 2019. School districts and county governments suffered a steady stream of smaller incidents, many never widely reported. Federal help had mostly come as advice, free scanning services and a share of broader homeland security grants.

The program did not move quickly. The first notice of funding opportunity, the formal announcement that tells eligible governments how to apply, came in September 2022, nearly a year after the signing. Still, the signing week is when the design was set, and the design is the part worth studying.

Federal cybersecurity money for state and local government had usually arrived in small, scattered pieces: a share of a homeland security grant, an election security allocation, a one-off appropriation. The program in the infrastructure law was the first dedicated, multi-year federal grant for state and local cybersecurity.

Its total was modest against the problem, spread across every state and territory and thousands of local governments. Its design said more than its size. Three features shaped how agencies should have used it: a rising cost share, a planning requirement, and a mandatory pass-through to localities. Each one was a question about what would happen in year five. The same question faces anyone, in government or out of it, who funds technology with money that will not last.

Two background sections come first: why security spending is hard to sustain, and how the money was meant to move. The three features then get a section each. The last sections turn the analysis into an allocation rule, show that the same cliff appears in banks and hospitals, and close with questions for leaders.

Why cybersecurity spending is hard to keep going

Start with what a government actually buys when it buys cybersecurity. Much of it is closer to a gym membership than a treadmill: something paid for every year, rather than equipment that sits on a shelf for twenty years.

Some costs are genuinely one-time. An assessment is an expert review of where an organization is weak. A tabletop exercise is a rehearsal in a conference room, where leaders walk through a pretend attack and discover who is supposed to decide what. Moving a town’s website and email to the .gov domain, the internet address ending reserved for verified US government bodies, is a project with a beginning and an end. It also makes it much harder for scammers to impersonate the town. Redesigning backups, the copies of data kept so systems can be restored after an attack, is largely a one-time engineering job.

Other costs recur every year, often forever. Security software is increasingly sold as a subscription: you pay annually, and if you stop paying, it stops working. Managed detection services are outside companies that watch an organization’s systems around the clock for signs of intrusion. They are valuable, and they bill monthly. New staff positions, of course, carry salaries and benefits for as long as they exist.

Then there are capabilities that cost little but must be kept up. Multifactor authentication, which requires a second proof of identity such as a code on a phone in addition to a password, is cheap to switch on and enormously effective. Someone still has to enroll new staff and handle lost phones. An asset inventory, the list of every device and system the organization owns, decays the moment people stop updating it.

Why the market made this worse

The vendor market moved in the same direction as the threat. Over the decade before 2021, much security software shifted from perpetual licenses, bought once and maintained cheaply, to subscriptions. Cloud email, endpoint protection and log storage are now commonly priced per user or per device per year.

That shift has real benefits: faster updates, less hardware to run, and protections that improve without a local upgrade project. It also converts what used to be a capital purchase into an operating cost. Public budgets treat those two very differently.

Many local governments fund equipment through capital plans or bonds, which can absorb a one-time purchase. Operating budgets are tighter, set annually and fought over line by line. A tool that moves from the capital side to the operating side becomes much harder to keep.

Counting the full cost of a tool

The license price is usually the smallest part of what a security tool costs to keep. Someone has to deploy it, tune its alerts, respond to what it finds and keep it integrated as other systems change. Renewal prices often rise after the first term. A tool that generates alerts nobody has time to read costs money and buys little protection.

For grant planning, that means every recurring purchase should carry an estimate of the staff time needed to run it. A county that buys monitoring software without anyone to answer its alerts has bought a subscription, not a capability. A managed service bundles that labor into the price, which is why it is often the better choice for small governments, and why its cost is harder to sustain.

Why budgets resist it

Public budgets are not built for this pattern. A council or legislature can often find money for a visible, one-time project. It is much harder to win a permanent new line for something whose success is measured by attacks that did not happen. The grant’s design pointed straight at that problem.

Small governments face an extra disadvantage. A county with one IT manager has no spare capacity to write grant applications, run procurements and file federal reports on top of daily support. The administrative effort of accepting federal money can be large relative to the award. That burden can lead eligible localities to pass up small awards altogether.

How the money was meant to move

Federal grants to states can look abstract from the outside, so the path deserves tracing step by step. Congress set the total and the rules. FEMA, working with CISA, turned those rules into a formal funding notice and handled awards. Each state received an allocation, but most of it could not be spent until the state had stood up its planning committee and had its cybersecurity plan approved. Within the state, a designated office managed the grant, tracked spending and reported back to Washington.

That designated office is the State Administrative Agency, usually the state’s homeland security or emergency management office. It was the only body allowed to apply. The arrangement made sense for grant administration, since those offices already run federal preparedness grants. It also meant that the office holding the money was often not the office holding the security expertise.

The statute addressed that gap by requiring consultation with the state’s chief information officer, chief information security officer or equivalent when allocating funds. CISA reviewed plans and projects for technical merit, and FEMA handled the money. Each pair of offices, federal and state, had to work together for anything to move.

The pass-through clock

From there, the 80 percent pass-through rule did the important work. The bulk of the money was meant to bypass the state’s own agencies and reach counties, cities, towns, school districts and other local bodies. A quarter of the total was set aside for rural areas. That rural reservation reflects a real gap. A small rural county may have one person handling every computer, phone and printer in the courthouse, and nobody whose job includes thinking about attackers.

The law gave states 45 days from receipt to pass funds through. If a state missed that deadline, a local government could petition to receive its share directly. The provision was a pressure valve against funds sitting idle in a state account.

The cost share was layered over all of this. For every dollar of federal money, a growing slice had to come from somewhere else. The match was designed to become less generous each year, which told recipients in advance that Washington expected them to take over.

Two different moments in an attack

Finally, the separate Cyber Response and Recovery Fund addressed a different moment in the life of an attack. The grant program was about preparation. The response fund was about what happens when a significant incident has already occurred. Leaders tend to underinvest in the first and scramble for the second, and the law tried to separate them.

The separation has a practical consequence. Response money depends on a federal declaration and on federal capacity at the time. A county cannot plan its own recovery around it. The preparation grant was the money a locality could actually plan with.

How it reached different kinds of government

The same rules landed very differently by type of recipient. A large city with a security team could write its own projects, match its own share and run its own procurement. For such a city, the grant was a modest supplement to an existing budget.

A rural township, a small water district or a library board was in a different position. Most had no security staff, no grant manager and no budget line to match from. For them, the useful forms of help were services delivered by the state or a regional body, not cash.

School districts and public health departments sat between those poles. Each had sector-specific obligations and funding streams, and each had suffered visible attacks. The statute’s requirement that planning committees include education and public health representatives was an attempt to bring them into the same plan.

The rising cost share

Recipients had to match federal funds with a non-federal share that grew each year: 10 percent, then 20, 30 and 40 percent. The signal was clear. Federal money was meant to start capabilities, not to pay for them indefinitely. Each year, state and local budgets would carry more of the cost, and after the program they would carry all of it.

That has direct consequences for what to buy. One-time investments fit the model well: assessments, planning, tabletop exercises, initial tool deployment, migration of email and websites to the .gov domain, and backup redesign. Recurring costs fit it poorly: software subscriptions, managed detection services and new positions.

An agency that funds a three-year subscription with grant money has written its own budget request for year four, and has done so in a year when the federal share is shrinking. That does not rule out recurring services. It means the sustainment source should be named before the contract is signed.

The match as a cash problem

The match also posed a cash problem. Many small jurisdictions had no cybersecurity line in their budget at all, so even a 10 percent share required a council vote or a reallocation. A state could cover the match for localities from its own funds, which kept small governments in the program but moved the sustainment question to the state budget. A locality could count in-kind contributions, such as staff time, where guidance allowed. Both approaches were legitimate. Each changed who would be asked to pay later, and neither removed the question.

The statute offered two narrower routes. The Secretary of Homeland Security could waive or modify the share for economic hardship, under published guidelines. And groups of eligible entities applying together as a multi-entity project received a more generous federal share in each year. That second route rewarded regional cooperation, which suits small governments with similar needs.

For a state budget office, the match is also a forecasting task. The non-federal share of each award is known years in advance, so a legislature can appropriate it in the normal budget cycle. Building the match into the regular cycle avoids a scramble for emergency transfers each time a new award arrives. It also puts the growing share in front of legislators every year, which prepares them for the full cost after the program.

How the anti-supplanting rule interacts with the match

The ban on supplanting is easy to read as a formality. It matters for sustainment. A county could not move its existing security spending onto the grant and redirect the freed money elsewhere. The grant had to fund additional work.

That rule protects the federal purpose, and it also means a grant-funded service is, by definition, something the local budget was not paying for before. When the grant ends, the service has no existing line to return to. The anti-supplanting rule and the rising match together guarantee a budget conversation at the end.

A county’s four years

Take a hypothetical county. In year one, a grant-funded award covers almost all of a new managed detection service, and the county pays a small share from a contingency line. By year three, the county’s share has tripled, and the service has become something its IT manager relies on daily. In the year after the program, the full bill lands in the general fund, competing with road repair and payroll. If nobody had warned the county board in year one, the board now faces a choice it never knowingly made: find the money, or switch off something that works.

Compare a second hypothetical county that spent the same award differently. It used year one for an assessment, multifactor rollout and a backup redesign. It used year two to move its domain to .gov and train staff. It bought a managed service in year three only after its board had added a line to the following year’s budget. The second county ends the program with fewer services but no cliff.

The case for buying recurring services anyway

There is a serious argument on the other side. The capability that most reduces ransomware damage at a small government is often continuous monitoring by people who know what they are looking at. A county cannot assess or plan its way to that. Refusing to fund it with grant money may simply mean the county never has it.

The argument has merit, and it supports a narrower conclusion. Recurring services were worth buying when a sustainment path was credible: a board commitment, a state program, or a shared regional contract with a clear funder. Without one, the grant bought a few years of protection and then a harder conversation.

The planning requirement

States could not receive most of the money without a cybersecurity planning committee and an approved plan. The committee had to include representatives of local government, public education and public health, among others, and at least half of its members had to have professional cybersecurity or IT experience. The plan had to cover a list of required elements, including asset inventory, vulnerability management, incident response, workforce, multifactor authentication and adoption of the .gov domain.

A few of those terms deserve a word. Vulnerability management is the routine of finding software flaws and fixing them before attackers use them. Incident response is the plan for what happens in the first hours and days after an attack: who is called, who decides, how systems are isolated and restored, and how the public is told. Workforce covers the unglamorous question of who will actually do all of this.

Who serves on the committee

The statute was specific about membership. Committees had to include representatives from counties, cities and towns, from public education and from public health institutions. They were expected to reflect rural, suburban and high-population jurisdictions. A state could use an existing multijurisdictional body if it met those tests.

The expertise rule, at least half of members with cybersecurity or IT experience, had a practical effect. It kept the committee from becoming a purely political allocation body. It also meant many small jurisdictions were represented by an association or a regional body rather than by their own staff, since they had no IT professional to send.

What the plan had to contain

The statute listed sixteen elements. Beyond the ones above, they included continuous network monitoring, resilience of communications, risks to critical infrastructure, modernization of older systems, information sharing and ensuring rural areas could reach the services offered. The plan also had to assess current capability on each element, set out resources and a timeline, and define metrics.

The funding notices added a short list of practices the program emphasized. They included multifactor authentication, enhanced logging, encryption of data, retiring unsupported software exposed to the internet, eliminating default passwords, the ability to restore systems from backup and migration to .gov. Most of these are one-time or low-cost to sustain, which fits the rising match well.

For some states, this formalized work already under way. For others, it was the first statewide plan that included counties, cities, school districts and public health departments at all. The requirement gave state chief information security officers a structured reason to convene those bodies and agree on shared priorities.

The committee as the durable output

That committee may have been the program’s most durable output. Grants end. Working relationships between a state security office and its local governments last, and they matter most during an incident. When a school district is hit by ransomware on a Sunday night, it makes a large difference if its superintendent already knows the name and phone number of the state’s security chief.

The statute contained a detail that shaped the committee’s role. The committee could not make decisions about the state’s own information systems. Its focus was the whole of the state, including governments the state does not run. That made it a convening body for local governments, rather than another layer of governance for state IT.

The case against front-loading planning

The planning requirement had critics. It delayed most project money by a year or more while localities facing active ransomware threats waited. Committees and plans consumed scarce staff time in states that already knew their priorities. Some argued the money should have flowed straight to proven controls.

The delay was real, and the cost of it fell on the smallest governments. Even so, money spent without a plan in a field this fragmented tends to buy overlapping tools and leave gaps. The plan was also the only document in which sustainment could be addressed before spending began. The requirement was slow, and its value depended on whether states used it for more than unlocking funds.

Planning for year five

The plan also offered a sustainment tool that few used fully. A plan that ranks capabilities by cost after the grant, and states who will pay for each, gives legislators and county boards an early view of the bill. A plan that lists only what the grant will buy leaves that conversation for later, when it is harder.

A sustainment-aware plan would add three columns to each project: annual cost after the grant, the proposed funder, and the date by which that funder must commit. Those columns cost nothing to add. They turn a spending plan into a budget forecast that a finance director can act on.

The metrics requirement could serve the same purpose. Metrics such as the share of local governments using multifactor authentication or the .gov domain show what the grant achieved. They also show legislators what would be lost if the supporting services ended, which is the evidence a sustainment budget request needs.

The local pass-through

Most funds had to reach local governments. Localities could receive cash, or, with their consent, receive services or equipment that the state bought on their behalf. That second option mattered. Many small municipalities lacked the staff to run a procurement, manage a federal grant or operate a security tool.

Consider a state that bought endpoint protection (security software on each laptop and server that blocks and reports malicious activity) at scale. Managed detection, vulnerability scanning and training work the same way. Delivered to localities, they could stretch the money further than hundreds of separate purchases. It also gave the state visibility across jurisdictions that had been invisible to it. One negotiation can bring better prices and consistent quality.

The trade-off is ownership

The trade-off was ownership. A service delivered by the state depends on the state continuing to fund it. Localities that accepted state-delivered tools needed to know what would happen when the federal share ended. Would the state absorb the cost, charge localities a fee, or stop the service? States needed to decide, and to say so in writing, before rollout. A county whose endpoints are protected by a state-licensed tool cannot easily replace it at short notice if the license lapses.

Data and visibility raise their own questions. A state-run monitoring service sees alerts from local systems, and sometimes the data behind them. Localities should know what the state can see, who at the state can see it, how long it is kept and whether it can be shared with law enforcement. A short data-sharing agreement answers those questions before they become an obstacle during an incident.

Exit terms matter as much as entry terms. If the state stops the service, the locality needs its data, its configuration and enough notice to buy a replacement. Those terms belong in the consent form the locality signs, not in a later memo.

Two ways to spend the same allocation

Suppose a state is weighing its options. Its security office could send each of its several hundred eligible local governments a small check and let each buy what it could. Many would struggle to spend the money at all, and those that did would buy different tools, at different prices, with nobody able to see the overall picture. Alternatively, the state could negotiate a single statewide contract for endpoint protection and vulnerability scanning, offer it to every willing locality, and run it centrally. The second approach almost certainly protects more machines per dollar. But it also means the state is now, in effect, the security provider for a small town that has never budgeted for one. When the federal share runs out, that town’s protection depends on a decision in the state capital.

Neither choice is wrong. What matters is that the state and the town both understand which one they made, and what it commits each of them to in the years after the grant.

Deciding what to centralize

A useful test is how much local context a service needs. Endpoint protection, email filtering, vulnerability scanning, awareness training and an incident response retainer work much the same in every town. They are good candidates for statewide delivery. Network redesign, backup architecture and decisions about which systems are critical depend on local knowledge, and usually need local or regional staff.

A second test is who can sustain it. A service the legislature is likely to fund after the grant belongs at the state. A service the locality will pay for belongs in the locality’s own contract, so it is not stranded when the state changes course.

Free federal services as a partial bridge

Some capabilities did not need grant money at all. CISA has long offered free services to state and local governments, including vulnerability scanning of internet-facing systems and assessments. The .gov domain itself is free for eligible government organizations, administered by CISA. A plan that used these free services for what they covered could reserve grant money for gaps.

Free services carry their own sustainment risk. They depend on federal budgets and priorities that can change. They are still a better base than a paid subscription with no funder, but a locality should know which of its protections rest on federal goodwill.

Three bins for the money

A sound allocation, read across all three features, separates spending into three bins.

• Foundation work, such as inventories, multifactor rollout, backups and .gov migration, can be funded freely. It pays off for years and does not leave a bill behind.
• Shared services delivered statewide can be funded if the state has a credible plan to sustain them.
• New recurring costs at individual agencies need a funding path in the agency’s own budget before the first dollar is spent.

Organizations should check grant guidance with their state administrative agency, the office that manages federal grants within each state, since allowable costs varied by year.

Applying the bins to people

Positions are the hardest case. The funding notices allowed money to be used for hiring, and a single skilled person can transform a small government’s security. Hiring on grant money without a permanent line, though, usually ends with that person leaving early for a stable job.

Two approaches reduce the risk. A shared position, such as a regional security officer serving several small governments, spreads the permanent cost. A fixed-term role with an explicit conversion commitment from the employing government gives the hire a reason to stay. Either is better than a position that disappears with the grant.

Evidence a reviewer will ask for

Federal grants come with audits and monitoring. A recipient should be able to show that spending matched approved projects, that the cost share was met and documented, that funds reached localities on time and that nothing supplanted existing budgets. For services delivered in place of cash, records of each locality’s written consent are part of that evidence.

The same files help with sustainment. Records of which localities use which services, at what cost, make the year-five budget request specific instead of abstract.

The failures follow a familiar shape.

• Buying the shiny recurring tool first. Subscriptions are easy to start with grant money and painful to stop.
• Treating the plan as paperwork. A plan written only to unlock funds says what will be bought, not what it will cost to keep.
• Letting the committee lapse once the money is allocated, losing the relationships that matter during an actual incident.
• Leaving localities guessing about the future of state-delivered services.
• Hiring on temporary money without a path to permanent funding, which tends to lose good people just as they become effective.

The same cliff in banks and hospitals

The rising match is a public-sector device, but the underlying problem is universal. Banks, hospitals and companies regularly fund technology from one-time sources: a special project budget, a post-incident allocation, a merger integration fund, a vendor’s introductory pricing. Each one can create a recurring cost that outlives the money that started it.

For a chief financial officer, the useful discipline is simple. Every time a one-time source pays for something, ask what it will cost in the year after that source ends, and whose budget will carry it. For a board, the useful habit is to ask the same question about security in particular, because security costs are easy to start and hard to cut without raising risk.

Take a community hospital that receives a one-time capital allocation after a scare. Its security leader uses it to buy a three-year subscription to a monitoring service and to hire two analysts on fixed-term contracts. Everything works well. Then the three years end, the allocation is long spent, and the operating budget has no line for any of it. The hospital now faces the same cliff as the county, with the same unattractive choices. The fix, in both cases, would have been the same conversation at the start: this is what it will cost to keep, and this is who will pay.

Where the private-sector version hides

In banks, the cliff often hides inside vendor contracts. An introductory discount on a security platform expires after the first term. A bundled license, included with a larger purchase, becomes a separate line at renewal. A credit union that joins a shared service through its core processor may find the price changes when the processor’s contract does.

In health systems, the cliff often follows mergers and grants. Integration budgets pay for tools across newly combined hospitals, then end. Federal and state health IT funding has followed the same pattern over the years, starting capabilities that operating budgets later had to absorb.

Federal agencies know a version of the same problem. Money from central modernization funds has often come with an expectation of repayment, which forces agencies to show where future savings or budget will come from. The mechanism differs from a rising match, but the question it forces is identical.

The discipline is the same in each case: a sustainment line on every business case, reviewed by finance, with a named owner and a renewal date on the calendar.

There is also a reputational angle. When a service residents or patients rely on is switched off for lack of funds and an attack follows, the explanation that the grant ran out will satisfy nobody.

Before the money runs out

• Which of our security capabilities are paid for by money that will run out, and when?
• For each recurring service we started with one-time funds, who pays in the first year after that funding ends?
• What would we switch off first if that money did not appear, and what risk would that create?
• If we receive services from a state, a parent company or a shared program, what happens when that arrangement ends? Is it in writing?
• Do we have standing relationships with the people we would call during a major incident, or would we be introducing ourselves in a crisis?

Most organizations can answer the first two from their contract register and budget in an afternoon. The harder work is the third: ranking capabilities by risk, so that if cuts come, they fall on what matters least.

A grant that shrinks every year is honest about the future, and it rewards the organizations that plan for it.

With hindsight

The program started slowly. DHS announced the first funding notice in September 2022, and the law required an approved plan before most project money could flow, so committees and planning came first. For many states, the first year was spent building the table before anyone could sit at it.

Less money than the headline

The money also tapered faster than the headline suggested. The infrastructure law authorized appropriations only through fiscal 2025, falling from $400 million in fiscal 2023 to $100 million in fiscal 2025. The final round, about $91.7 million for states and localities, was announced in August 2025. So while the local share of costs was rising, the overall federal pot was shrinking, and the two effects pushed in the same direction.

The amounts actually offered to states and localities were also below the authorized totals, because the tribal program and administration came out of the same pool. FEMA’s published figures show about $185 million in fiscal 2022, $374 million in 2023, $279 million in 2024 and $91.75 million in 2025. A separate $12.1 million in tribal awards accompanied the final state and local round.

The program’s priorities shifted over its life. By the fiscal 2024 round, CISA described the grants as a way to help recipients implement its Cross-Sector Cybersecurity Performance Goals. Those goals, first published in October 2022, are a short list of baseline practices such as multifactor authentication, logging and tested backups. That framing suited the rising match well, because most of the goals are inexpensive to sustain once in place.

Authority without new money

In February 2026, Congress extended the program’s statutory authority to September 30, 2026, but the infrastructure law’s own funding had already run its course. An extension of authority keeps the legal framework alive; it does not by itself put new money in anyone’s account. For a county finance director, the practical question was never whether the program technically existed, but whether a check would arrive.

CISA asked all recipients to resubmit their approved cybersecurity plans, revised as needed, by January 30, 2026. The plans and committees therefore outlasted the money’s main phase, which gave states a natural moment to add the sustainment columns many had skipped.

The statute also built in accountability that outlived the spending. DHS had to report to Congress at least annually on how the money was used, including the share that reached rural areas. The Government Accountability Office was required to review the program within three years of enactment.

Shared services faced the same test

The sustainment problem was not confined to the grant. In 2025, the Multi-State Information Sharing and Analysis Center, long supported with federal funds and used by thousands of state and local governments, moved to a member-funded model. Localities that had relied on its free services faced the same question the rising match posed: keep paying for something that works, or let it go.

What held up

The funding cliff the rising match had signaled arrived on schedule. That is worth saying plainly, because it was visible from the first page of the law. Nobody was surprised by the shape of the curve, only, in some places, by the fact that the bill had come due.

Less durable was the assumption, common in 2021, that dedicated federal money would become a permanent feature of state and local security budgets. The program proved the model of federal seed money with conditions. It did not establish a lasting federal funding stream.

The states in the best position are those that planned for sustainment from the start and kept their planning committees active. They knew which capabilities they intended to keep, had already argued for them in their own budgets, and still had a working network of local officials to call when something went wrong. Anyone funding anything with temporary money can take the same message: decide what you will keep before you start buying, and keep the people talking after the money ends.