‘It’s not over’: Cyber info-sharing center begins ‘next chapters’ after losing federal funding

Since its shift to a paid model, a cybersecurity information-sharing center already has two dozen states with some form of membership and more than 3,000 individual organizations signed up, a key leader said last week.

The Multi-State Information Sharing and Analysis Center, whose federal funding run out last September after being cut by the Trump administration, now has 16 states and territories — Alaska, California, Connecticut, Kansas, Maine, Mississippi, New Jersey, New York, New Mexico, Oregon, Puerto Rico, Rhode Island, Tennessee, Texas, Vermont and Washington, D.C. — who are dues-paying members or in the final stages of completing that membership, while another eight states — Delaware, Hawaii, Minnesota, Missouri, North Carolina, Oklahoma, Pennsylvania and South Carolina — have paid for services for all state agencies only.

In addition, around 3,000 single government organizations have joined, said Carlos Kizzee, senior vice president for stakeholder engagement at the nonprofit Center for Internet Security, which houses the MS-ISAC. While 2025 was dogged by uncertainty amid the “drastic reduction” in funding, Kizzee said better days are ahead for the two-decade-old center.

“It is a long story, but it's not over,” Kizzee said during the Technology Innovation Forum at the National Association of Counties’ legislative conference in Washington, D.C. last week. “We suffered a drastic reduction in funding in 2025 and that brought about a tremendous amount of change that we have gone through…. We are still moving forward, and we have an interesting future ahead of us. And the next chapters, I think, are going to be great.”

The MS-ISAC has existed since the early 2000s and started receiving federal financial support in 2005 for its efforts to share threat information, respond to incidents and provide various services, including a security operations center at no cost to its members. But the future of those services was thrown into doubt last year after the Cybersecurity and Infrastructure Security Agency announced it had ended a $10 million partnership with CIS. The move prompted some soul-searching at MS-ISAC and an eventual decision to move to a paid membership model.

In addition to the paid model, Kizzee said governmental organizations with an annual operating budget of less than $25 million are eligible to receive membership for free for their first year under a hardship waiver. And he said the CIS executive committee introduced a program called MS-ISAC Connect that will allow any organization, regardless of their dues status, to connect with peers, attend events and access any data that the center generates, all for free.

“We have over 18,000 members who never had to pay anything before,” Kizzee said. “We cannot just let them go. There has to be a process to maintain relationships and collaboration, whether you're an MS-ISAC dues-paying member or not.”

With many states and organizations not dues-paying members, however, the MS-ISAC could face an uncertain future, even as states deal with the kind of crippling cyberattack that harmed Nevada last year. Previously, the MS-ISAC would provide all manner of services to members impacted by a cyberattack, and Kizzee said that would continue in this new dues-paying system.

For those not paying dues, he said the organization is “struggling with the passion and empathy” they feel about potentially removing those services from them. MS-ISAC Connect could help fill those gaps, Kizzee said, and he pledged that the organization would not abandon anyone. The details are still being worked out, he said.

“The desire is that we will provide an initial capability, initial connectivity for any organization, whether a member or not,” Kizzee said. “We're still now funding legacy services, but I would like to say that we would love there to be a mechanism where, when needed, we will be able to give additional insight and assistance.”

CIS will also continue to provide various services for free to state, local, tribal and territorial governments, Kizzee said, including on security best practices and when to implement various cybersecurity controls.

“Our citizens are important enough that it is ludicrous to stop programs that are working and supporting you with no notice to you and to expect that you will not become a target of threat actors who would choose to exploit the absence of protections and defense mechanisms that you depend on,” he said.

Kizzee promised that, regardless of what happens next, the MS-ISAC and CIS will still be there for local governments that have relied on their services for decades.

“I'm really proud to be a part of a company, an organization that cares enough that when the ground is shifting under your feet, you know we're still going to be here, and we're still going to be your strategic partner in your security,” he said.