A cyber grant with a rising match is a sustainment test

The week

On November 15, 2021, President Biden signed the Infrastructure Investment and Jobs Act. Alongside roads, bridges, water and broadband, the law created the State and Local Cybersecurity Grant Program, funded at $1 billion over four fiscal years and administered by FEMA with CISA. To receive most funds, states had to form cybersecurity planning committees and submit cybersecurity plans for approval. The law required states to pass at least 80 percent of the money through to local governments, with a quarter of the total reserved for rural areas. It also required a non-federal cost share that rose each year, from 10 percent in the first year to 40 percent in the fourth. The law separately created a Cyber Response and Recovery Fund for significant incidents. The first notice of funding opportunity came in September 2022.

Federal cybersecurity money for state and local government had usually arrived in small, scattered pieces: a share of a homeland security grant, an election security allocation, a one-off appropriation. The program in the infrastructure law was the first dedicated, multi-year federal grant for state and local cybersecurity. Its total was modest against the problem, spread across every state and territory and thousands of local governments. Its design said more than its size. Three features shaped how agencies should have used it: a rising cost share, a planning requirement, and a mandatory pass-through to localities. Each one was a question about what would happen in year five.

The rising cost share

Recipients had to match federal funds with a non-federal share that grew each year: 10 percent, then 20, 30 and 40 percent. The signal was clear. Federal money was meant to start capabilities, not to pay for them indefinitely. Each year, state and local budgets would carry more of the cost, and after the program they would carry all of it.

That has direct consequences for what to buy. One-time investments fit the model well: assessments, planning, tabletop exercises, initial tool deployment, migration of email and websites to the .gov domain, and backup redesign. Recurring costs fit it poorly: software subscriptions, managed detection services and new positions. An agency that funds a three-year subscription with grant money has written its own budget request for year four, and has done so in a year when the federal share is shrinking. That does not rule out recurring services. It means the sustainment source should be named before the contract is signed.

The match also posed a cash problem. Many small jurisdictions had no cybersecurity line in their budget at all, so even a 10 percent share required a council vote or a reallocation. A state could cover the match for localities from its own funds, which kept small governments in the program but moved the sustainment question to the state budget. A locality could count in-kind contributions, such as staff time, where guidance allowed. Both approaches were legitimate. Each changed who would be asked to pay later, and neither removed the question.

The planning requirement

States could not receive most of the money without a cybersecurity planning committee and an approved plan. The committee had to include representatives of local government, public education and public health, among others, and at least half of its members had to have professional cybersecurity or IT experience. The plan had to cover a list of required elements, including asset inventory, vulnerability management, incident response, workforce, multifactor authentication and adoption of the .gov domain.

For some states, this formalized work already under way. For others, it was the first statewide plan that included counties, cities, school districts and public health departments at all. The requirement gave state chief information security officers a structured reason to convene those bodies and agree on shared priorities. That committee may have been the program’s most durable output. Grants end. Working relationships between a state security office and its local governments last, and they matter most during an incident.

The plan also offered a sustainment tool that few used fully. A plan that ranks capabilities by cost after the grant, and states who will pay for each, gives legislators and county boards an early view of the bill. A plan that lists only what the grant will buy leaves that conversation for later, when it is harder.

The local pass-through

Most funds had to reach local governments. Localities could receive cash, or, with their consent, receive services or equipment that the state bought on their behalf. That second option mattered. Many small municipalities lacked the staff to run a procurement, manage a federal grant or operate a security tool. A state that bought endpoint protection, managed detection, vulnerability scanning or training at scale and delivered it to localities could stretch the money further than hundreds of separate purchases. It also gave the state visibility across jurisdictions that had been invisible to it.

The trade-off was ownership. A service delivered by the state depends on the state continuing to fund it. Localities that accepted state-delivered tools needed to know what would happen when the federal share ended. Would the state absorb the cost, charge localities a fee, or stop the service? States needed to decide, and to say so in writing, before rollout. A county whose endpoints are protected by a state-licensed tool cannot easily replace it at short notice if the license lapses.

A sound allocation, read across all three features, separates spending into three bins. Foundation work, such as inventories, multifactor rollout, backups and .gov migration, can be funded freely. Shared services delivered statewide can be funded if the state has a credible plan to sustain them. New recurring costs at individual agencies need a funding path in the agency’s own budget before the first dollar is spent. Organizations should check grant guidance with their state administrative agency, since allowable costs varied by year.

With hindsight

The program started slowly. The first funding notice arrived in September 2022, and many states spent the first cycle forming committees and writing plans before funding projects. Over the following years, states commonly used the money for shared services delivered to localities, such as endpoint protection, training and vulnerability scanning, and for foundation work in small jurisdictions with no prior security budget. The program’s authorization ran through fiscal 2025. It lapsed at the end of September 2025 and was extended to January 30, 2026 in the November 2025 funding deal, without new grant money. The House passed a longer reauthorization that month, but the fiscal 2025 round was the last funded by the infrastructure law, and a durable successor remained unsettled well into 2026. The funding cliff the rising match had signaled became real. The states in the best position are those that planned for sustainment from the start and kept their planning committees active.