As cyber grant program hits the halfway mark, feds laud states’ progress
A 911 operations center at Suffolk County police headquarters in Yaphank, New York, on September 19, 2022. Suffolk County Police Commissioner Rodney Harrison and Chief of Operations Matthew Lewis, announced the additional step they are taking to battle the cyber-intrusion James Carbone/Newsday RM via Getty Images
Two years into the $1 billion program, state and local governments are better prepared for cyber attacks. But funding remains an obstacle as under-resourced cybersecurity budgets struggle to keep up with mounting threats.
When Congress passed the infrastructure law in 2021, it made a much-needed, first-of-its-kind investment in cybersecurity.
At the time, state and local governments were facing an increasing wave of ransomware and other cyberattacks. In 2020, a third of global attacks were on states and localities—a number that doubled in 2021, according to Sophos, a data protection and security company.
Now, two years into the $1 billion State and Local Cybersecurity Grant Program, hundreds of millions of dollars have already been appropriated, with millions more to follow starting later this year. States have used the grants to invest in long-term cybersecurity planning, coordinating with localities and implementing a whole-of-state approach.
The effort has certainly made governments more prepared, according to the agencies jointly in charge of the program’s administration—the Cybersecurity and Infrastructure Security Agency and the Federal Emergency Management Administration. Agency officials say it has been successful in making governments think about long-term planning and cyber resilience, although it has not been not without its challenges.
Bess Mitchell, CISA’s chief of grant operations, said during a panel discussion at the Billington State and Local Cybersecurity Summit in Washington, D.C., that every state, bar one, has provided a long-term cybersecurity strategic plan. And Lisa Nine, a senior program analyst at FEMA, said while that requirement created a “steep mountain to climb” for states, it helped them tackle often-neglected areas like cyber risk assessment.
Nine said it has made for a “very different grant program” from the norm because there are no set-asides where states are required to spend money and because of a requirement for states to stand up a cybersecurity planning committee. Mitchell said that has created a “governance baseline,” and in combination with the lack of set-asides, has allowed governments to think carefully about their own cyber needs and weaknesses without prescriptive federal spending constraints.
But the program could soon become a headache for state governments as cost-sharing requirements ramp up. Under the program, the federal government initially covered 90% of the cost. Going forward, the feds will reduce that by 10% each year, putting the onus more on states to pick up the tab.
Mitchell said the federal government wants the program to be “maintained and sustained after the life of the grant,” hence the increased cost-sharing burden on states. But both Mitchell and Nine acknowledged that could be a “huge lift” for state budgets, especially as tax revenues decline and federal pandemic aid ends.
While $1 billion “does sound like a big number … it is not,” said Nine. That money is spread across 50 states over multiple years. What’s more, cybersecurity has historically made up a small portion of overall IT budgets, and a survey of local governments executives this past fall found that hasn’t changed much. A majority reported inadequate budgets in the face of mounting cyber threats.
And an average ransom payment cost about $214,000 in 2021, according to Sophos. But the total cost of an attack is more as it often requires changes in security and data recovery.
Nine said FEMA offers other cybersecurity grants for state and local governments to tap into. As for the State and Local Cybersecurity Grant Program, it will sunset at the end of 2025. Mitchell said it is unlikely it will be reauthorized.
“I don’t foresee a blanket extension, but you never know,” she said, adding that the best way for states to argue for continued funding is to show the impact of the projects being funded. Grant applicants should not expect anything too dramatic in coming funding opportunities.
The planning process is over, which, Nine said, means states have cleared a “big hurdle” and can spend much more of their time focusing on funding cyber programs and providing services
Another Notice of Funding Opportunity is set to be released later this summer for year three of the state and local grant program. The requirements for a separate Tribal Cybersecurity Grant Program are also set to follow soon.
NEXT STORY: Is the US privacy policy good enough?