What a second CISA lapse in five months asked state and local security teams to own
The DHS funding lapse that began on February 14 was the second interruption to CISA’s proactive services in five months. For state and local agencies, the question moved from listing federal dependencies to deciding which work to absorb, buy or keep borrowing.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 12, 2026, the Senate failed to advance a full-year funding bill for the Department of Homeland Security, falling short of the 60 votes needed after a dispute over immigration enforcement. Most of the government was already funded separately, so DHS alone lapsed at 12:01 a.m. on Saturday, February 14. The lapse reached the Cybersecurity and Infrastructure Security Agency, which had returned from the 43-day government-wide shutdown only three months earlier. In testimony before the lapse, CISA’s acting director said the agency planned to keep 888 of its 2,341 employees working as excepted staff, with most of the rest furloughed. CISA said its 24/7 operations center, urgent vulnerability and incident sharing and response to imminent threats would continue. Much of its proactive work, including assessments, outreach and planning, would pause.
Earlier in this series, we looked at the October 2025 shutdown as the moment organizations should write down what they borrowed from Washington. February tested what they did with that list. A second interruption in five months, this time aimed at one department, changed the nature of the problem. One lapse is a contingency. Two in quick succession, on top of the end of federal funding for the Multi-State Information Sharing and Analysis Center in September 2025, is a pattern that belongs in workforce and budget planning.
For a state agency, county, city, school district or utility, every federal cyber service it uses now calls for one of three dispositions. Absorb it, by building the capability with its own staff. Buy it, from a state program, an information-sharing organization or a commercial provider. Or keep borrowing it from the federal government, with eyes open. The three are exclusive, and together they cover every service on the list.
Absorb: work that should not depend on anyone else’s budget
Some work arrived through federal channels only because it was free and convenient, not because it needed federal capability. External vulnerability scanning of an organization’s own internet-facing addresses is the clearest example. So is the routine triage of advisories, deciding which apply to local systems and opening tickets. When a federal service pauses, these tasks do not become less urgent. They simply stop happening.
Absorbing them is mostly a staffing decision. A mid-sized county that already runs an endpoint and vulnerability management tool can usually add external scanning with modest effort. The harder question is who interprets the results. Many smaller agencies have one security analyst, or none, and that person’s week was built around federal outputs. Absorbing the work means writing it into a job description, measuring it and covering it during leave. It also means training. A regional advisor who explained findings by phone was providing on-the-job coaching that a local team now has to replace.
Absorbing work also needs a measure, or it drifts. Two are usually enough: how long it takes from publication of a relevant advisory to a ticket in the right team’s queue, and how often the agency’s own external scan runs and is reviewed. Both can be reported monthly to the agency CIO. Both show quickly whether the work is happening when no federal partner is prompting it.
Buy: capability that is cheaper to share than to build
Other services make little sense to build locally. Penetration tests, tabletop exercises facilitated by experienced outsiders, incident response surge capacity and threat intelligence tuned to public-sector targets all benefit from scale. A small agency running its own red team would spend far more for worse results.
These are candidates to buy. The sources are well known: state cyber programs, many funded in part through the State and Local Cybersecurity Grant Program; the information-sharing center, now on a fee-based membership model; and commercial providers under cooperative contracts. The procurement work is the obstacle. A county that has relied on free federal assessments may have no contract vehicle, no budget line and no evaluation criteria for buying one. Setting those up takes longer than a typical lapse. Agencies that start the paperwork when funding is calm can switch on a purchased service within days when it is not.
Buying also changes accountability. A contracted assessment comes with a statement of work, deliverables and a vendor who can be held to them. That is useful for audit and for grant reporting. It also means the agency must manage the vendor, which is a skill in its own right.
Keep borrowing: functions only the federal government provides
Some functions are federal by nature, and they largely continued through the lapse. National-level incident coordination, the Known Exploited Vulnerabilities catalog, emergency directives for federal systems and classified threat briefings through federal partners have no local substitute. Continuing to rely on them is rational.
Borrowing with eyes open still means planning for thinner service. With most staff furloughed, response capacity was reduced, and nonurgent requests waited. Agencies that expected to call CISA during an incident needed other emergency contacts current: the FBI field office, the state fusion center, the information-sharing center where they are members, incident response retainers and cyber insurers. Reporting obligations also need a check. Some state reporting requirements route through, or alongside, federal channels. Teams should confirm where a report goes and who receives it when federal staff are out.
The disposition of each service should be reviewed at least once a year, ideally aligned with the agency’s own budget calendar rather than the federal one. The cost of absorbing or buying is visible and immediate. The cost of continued borrowing is invisible until a lapse, when it arrives as delayed assessments, stalled projects and analysts with nothing to act on. A one-page table that lists each service, its disposition, its owner and its annual cost turns that hidden cost into a choice that a program director and a budget office can actually make.
With hindsight
The lapse ran far longer than most partners planned for. It lasted about 75 days, the longest of its kind, and ended on April 30, 2026, when the President signed bipartisan legislation funding most of DHS, including CISA, through September 30. Immigration enforcement agencies were left outside that bill. For CISA’s state and local partners, that meant most of a quarter with reduced proactive support, following the 43-day shutdown in the fall, and with the information-sharing center already charging fees. Reporting after the lapse described a slow recovery for CISA itself, as furloughed staff returned to stalled projects and outreach. The pattern reinforced the case for making dispositions deliberately. Services that had been absorbed or bought kept running through spring. Those still borrowed by default waited for Congress.