What a second CISA lapse in five months asked state and local security teams to own

The week

On Thursday, February 12, 2026, the Senate tried and failed to move forward a full-year funding bill for the Department of Homeland Security. It fell short of the 60 votes needed to advance, after a dispute over immigration enforcement. Most of the federal government had already been funded through separate bills, so this time only one department was left without money. At 12:01 a.m. on Saturday, February 14, DHS alone went into a funding lapse.

That lapse reached an agency many state and local leaders rely on without always realizing it: the Cybersecurity and Infrastructure Security Agency, or CISA. CISA is the federal government’s civilian cyber defense agency. Among other things, it warns organizations about software flaws attackers are using, scans public networks for weaknesses, runs security assessments and exercises, and sends regional advisors to help counties, cities, school districts and utilities protect themselves, often at no charge.

CISA had only just found its feet again. It had returned from the 43-day government-wide shutdown just three months earlier.

In testimony before the lapse, CISA’s acting director told lawmakers the agency planned to keep 888 of its 2,341 employees working as excepted staff, the employees whose work is considered essential enough to continue without pay during a lapse. Most of the rest would be furloughed, sent home without work.

CISA said some functions would continue. Its 24/7 operations center would stay open. It would keep sharing urgent information about vulnerabilities and incidents, and it would respond to imminent threats. But much of its proactive work, the assessments, outreach and planning that help organizations get ahead of attacks rather than react to them, would pause.

For a small county IT team that had come to count on a free federal scan or a call with a regional advisor, that distinction mattered. Emergencies would still get an answer. The routine, preventive help that keeps emergencies from happening would not, and nobody could say for how long.

The October 2025 shutdown was the moment for organizations to write down what they borrowed from Washington. February tested what they did with that list.

A second interruption in five months, this time aimed at one department, changed the nature of the problem. One lapse is a contingency. Two in quick succession, on top of the end of federal funding for the Multi-State Information Sharing and Analysis Center in September 2025, is a pattern. And a pattern belongs in workforce and budget planning, not in an emergency binder.

For a state agency, county, city, school district or utility, every federal cyber service it uses now calls for one of three dispositions. Absorb it, by building the capability with its own staff. Buy it, from a state program, an information-sharing organization or a commercial provider. Or keep borrowing it from the federal government, with eyes open. The three are exclusive, and together they cover every service on the list. First, though, what these services are and why local governments came to depend on them.

Scans, advisories and a regional advisor’s phone call

Many local governments run their technology with very small teams. A county of modest size might have a handful of IT staff and a single person responsible for security, if that. Attackers, meanwhile, target public bodies because they hold sensitive data and run services people cannot do without: emergency dispatch, water treatment, tax collection, schools.

Over the years, a set of free or low-cost services grew up to close that gap. Five matter most.

• External vulnerability scanning. A scanner looks at an organization’s systems from the outside, the way an attacker would, and lists the doors and windows left unlocked: outdated software, exposed services, misconfigured devices. CISA has offered this scanning to public bodies at no cost.
• Advisories. When a serious software flaw is discovered, or attackers start using one, CISA and others publish alerts describing it and how to fix it. Someone locally still has to read each one, decide whether it applies, and get the right team to act.
• Assessments and penetration tests. A penetration test is an authorized, simulated attack, in which skilled testers try to break in so the organization can find and fix weaknesses before real attackers do.
• Tabletop exercises. These are structured rehearsals, around a table rather than at keyboards, in which leaders walk through a realistic scenario, such as ransomware freezing the payroll system, to test who decides what and how fast.
• Information sharing. The Multi-State Information Sharing and Analysis Center, known as MS-ISAC, is a membership network through which state and local bodies share threat warnings and get help. Its federal funding ended in September 2025, and it moved to a fee-based membership model.

Ransomware, the most common threat in these discussions, is malicious software that locks an organization’s files and systems until a payment is made, and increasingly also involves stealing data and threatening to publish it. For a city, it can mean days or weeks without online payments, permitting systems or even email. Most of the services above exist to make that outcome less likely or less damaging.

A dependency nobody budgeted for

The dependency was not careless. Federal services were free, good and convenient, and a local agency with a tight budget would have been foolish not to use them. Over time, though, they became part of the agency’s routine without ever appearing in its budget or its job descriptions. The scan report arrived; the analyst acted on it. The advisor called; the team adjusted its plans.

The trouble with a dependency that is invisible in the budget is that it is also invisible in planning. When a lapse arrives, the work it supported simply stops, and nobody has the authority or the money to replace it quickly. The first lapse might be forgiven as bad luck. By the second, it is a known risk that leaders are expected to manage.

Suppose a county has about a dozen IT staff and one security analyst. For three years, its analyst has relied on a weekly federal scan of the county’s internet-facing systems and a quarterly call with a CISA regional advisor. During the fall shutdown, both stopped. The analyst improvised, running some scans with a trial tool and skipping others. When the federal services returned, the county went back to its old routine. In February, both stopped again. This time the analyst’s manager asks the obvious question: why are we in the same position twice?

Absorb: work that should not depend on anyone else’s budget

Some work arrived through federal channels because it was free and convenient, though it never needed federal capability. External vulnerability scanning of an organization’s own internet-facing addresses is the clearest example. So is the routine triage of advisories, deciding which apply to local systems and opening tickets. When a federal service pauses, these tasks do not become less urgent; they stop happening.

Absorbing them is mostly a staffing decision. A mid-sized county that already runs an endpoint and vulnerability management tool, software that watches its computers and tracks their weaknesses, can usually add external scanning with modest effort. The harder part is deciding who interprets the results. Many smaller agencies have one security analyst, or none, and that person’s week was built around federal outputs. Absorbing the work means writing it into a job description, measuring it and covering it during leave. It also means training. A regional advisor who explained findings by phone was providing on-the-job coaching that a local team now has to replace.

Absorbing work also needs a measure, or it drifts. Two are usually enough: how long it takes from publication of a relevant advisory to a ticket in the right team’s queue, and how often the agency’s own external scan runs and is reviewed. Both can be reported monthly to the agency CIO. Both show quickly whether the work is happening when no federal partner is prompting it.

In the county described above, absorbing might look like this. The security analyst’s job description gains two explicit duties: weekly review of the county’s own external scan, and same-day triage of new advisories that touch county systems. A network administrator is trained as backup for both, so a vacation or sick day does not stop the work. The county configures the scanning feature already included in its existing vulnerability tool rather than buying something new. And the IT director adds two lines to the monthly report to the county administrator: average days from advisory to ticket, and the date of the last reviewed scan.

That costs little. What it requires is a decision that this work belongs to the county, and a small amount of management attention to keep it there.

Buy: capability that is cheaper to share than to build

Other services make little sense to build locally. Penetration tests, tabletop exercises facilitated by experienced outsiders, incident response surge capacity and threat intelligence tuned to public-sector targets all benefit from scale. A small agency running its own red team, an in-house group of ethical attackers, would spend far more for worse results.

These are candidates to buy. The sources are well known: state cyber programs, many funded in part through the State and Local Cybersecurity Grant Program; the information-sharing center, now on a fee-based membership model; and commercial providers under cooperative contracts, pre-negotiated agreements that many public bodies can buy from without running their own full procurement.

The procurement work is the obstacle. A county that has relied on free federal assessments may have no contract vehicle, no budget line and no evaluation criteria for buying one. Setting those up takes longer than a typical lapse. Agencies that start the paperwork when funding is calm can switch on a purchased service within days when it is not.

Buying also changes accountability. A contracted assessment comes with a statement of work, deliverables and a vendor who can be held to them. That is useful for audit and for grant reporting. It also means the agency must manage the vendor, which is a skill in its own right.

Keep borrowing: functions only the federal government provides

Some functions are federal by nature, and they largely continued through the lapse. National-level incident coordination, the Known Exploited Vulnerabilities catalog (CISA’s running list of software flaws that attackers are known to be using, and the most useful single list for deciding what to patch first), emergency directives for federal systems and classified threat briefings through federal partners have no local substitute. Continuing to rely on them is rational.

Borrowing with eyes open still means planning for thinner service. With most staff furloughed, response capacity was reduced, and nonurgent requests waited. Agencies that expected to call CISA during an incident needed other emergency contacts current: the FBI field office, the state fusion center (a state-run hub where law enforcement and other agencies share threat information), the information-sharing center where they are members, incident response retainers and cyber insurers.

Reporting obligations also need a check. Some state reporting requirements route through, or alongside, federal channels. Teams should confirm where a report goes and who receives it when federal staff are out.

A practical step is to keep a short incident contact sheet, printed as well as stored electronically, since an attack may take down the very systems that hold it. It should list, in order, who to call and for what: the incident response retainer for hands-on help, the cyber insurer for claims and approved vendors, the FBI field office for criminal matters, the state fusion center and the information-sharing center for coordination, and CISA for national-level support. Reviewing the sheet takes an hour a quarter. Discovering it is out of date during an attack can cost days.

Residents feel the gap first

An elected official or agency head may be tempted to see all of this as technical housekeeping. Five reasons say otherwise.

Residents and services. When a local government is hit by ransomware, the people who feel it are residents: the family that cannot pay a water bill online, the contractor whose permit is stuck, the caller whose emergency is logged on paper. Preventive work is what keeps those days rare. A pause in that work does not cause an attack, but it widens the window in which one can succeed.

Money. The cost of recovering from a serious incident, in overtime, outside experts, replacement equipment and lost revenue, typically dwarfs the cost of the preventive services that might have stopped it. Absorbing or buying a scan or an assessment is a small, predictable line. An incident is a large, unpredictable one.

Insurance and grants. Cyber insurers increasingly ask what security controls an organization has in place, and grant programs ask what the money will achieve. An agency that can show it runs its own scanning, buys assessments on a schedule and has tested its response plan is in a stronger position on both fronts than one that can only say a federal partner usually helps.

Accountability. After an incident, councils, auditors, journalists and sometimes courts ask what the organization knew and what it did. “The federal scan was paused” is an explanation. It is not a defense if the pause was the second in five months and nothing changed after the first.

Workforce. Security staff are hard to hire in the public sector, where salaries often trail private employers. A lone analyst who is left to improvise every time federal support stops is a flight risk. Clear roles, the right tools and a budget for outside help make the job sustainable.

Making the choice stick: owners, budgets and a one-page table

The disposition of each service should be reviewed at least once a year, ideally aligned with the agency’s own budget calendar rather than the federal one. The cost of absorbing or buying is visible and immediate. The cost of continued borrowing is invisible until a lapse, when it arrives as delayed assessments, stalled projects and analysts with nothing to act on.

A one-page table that lists each service, its disposition, its owner and its annual cost turns that hidden cost into a choice that a program director and a budget office can actually make. For the county described above, the table might show external scanning and advisory triage absorbed by the security analyst, with a backup named for leave; penetration testing and tabletop exercises bought through a state program; and the vulnerability catalog and national incident coordination still borrowed, with alternative emergency contacts listed beside them.

Who should see the table matters as much as what is in it. The security analyst can draft it, but the decisions it records are budget and staffing choices, so it belongs in front of the agency head, the budget office and, for a county or city, the elected body that approves spending. Presented once a year alongside the budget request, it explains why a line item for scanning tools or an assessment contract exists, and what the agency would lose if it were cut. It also creates a record that leaders considered the risk and made a choice, which is exactly what auditors and insurers want to see.

Grant timing is worth building in as well. State and Local Cybersecurity Grant Program funds and state cyber program offerings tend to follow their own application cycles. An agency that knows which services it intends to buy can line up those applications in advance, rather than discovering in the middle of a lapse that the next funding round is months away.

The goal is that table, kept current and seen by the people who control the budget. The failures are equally recognizable: treating each lapse as a one-off, improvising with trial tools and then reverting, leaving procurement until the service has already stopped, and assuming that because emergencies are still answered, prevention can wait.

What the next lapse would expose

• Which federal cyber services do we use today, including the free ones nobody budgets for, and have we decided to absorb, buy or keep borrowing each?
• Who reviews new advisories and makes sure the right team acts, and who covers when that person is on leave?
• Do we have a contract vehicle and budget line ready for assessments, exercises and incident response support?
• If we had a ransomware attack tomorrow and federal staff were out, who would we call first, second and third?
• When did we last review this list, and is that review tied to our budget calendar?

An agency that can answer all five has already turned most of its borrowing into decisions.

With hindsight

The lapse ran far longer than most partners planned for. It lasted about 75 days, the longest of its kind, and ended on April 30, 2026, when the President signed bipartisan legislation funding most of DHS, including CISA, for the rest of the fiscal year. Immigration enforcement agencies were left outside that bill.

In mid-April, with no appropriation yet enacted, DHS recalled its furloughed employees, CISA’s included, using available funds. So the deepest cut to proactive support lasted roughly two months rather than the whole lapse.

The damage outlasted the recall. In early May the Homeland Security Secretary said CISA had lost more than 1,000 employees during the shutdown. That is a loss of people, experience and relationships that a funding bill cannot restore overnight. Regional advisors who knew a county’s systems, analysts who understood a sector’s threats and staff who ran assessments all take time to replace.

For state and local partners, all of this followed the 43-day shutdown in the fall and arrived with the information-sharing center already charging fees. Three shocks in roughly eight months, each on its own understandable, together made the case that federal support could not be treated as a fixed utility.

The pattern reinforced the case for making dispositions deliberately. Services that had been absorbed or bought kept running regardless of Washington’s calendar. Those still borrowed by default depended on a thinner federal workforce even after funding returned.

Federal partners are not unreliable, and local agencies should not go it alone. Federal coordination, the vulnerability catalog and national incident response remain valuable and largely irreplaceable. Dependence on them should still be a decision, with an owner and a cost, rather than a habit. An agency that can show its board or council a one-page table of what it absorbs, buys and borrows is in a far stronger position the next time a funding deadline approaches.