State leaders renew call for cyber grant program’s renewal

State leaders once again reiterated their calls for Congress to reauthorize and fund a popular cybersecurity grant program at a House hearing last week.

Officials said the State and Local Cybersecurity Grant Program, which has been reauthorized by the House but awaits action in the U.S. Senate before it expires in September, has been helpful for governments looking to build their cyber resilience against growing threats and must be allowed to continue.

“The scale, speed, and complexity of today’s threat environment require sustained funding, operational flexibility, and the ability to respond at the pace of emerging threats,” Tennessee Chief Information Officer Kristin Darby said in written testimony before the House Homeland Security Committee’s Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation last week. “The State and Local Cybersecurity Grant Program is one of the most effective tools available to strengthen our collective defense.”

The $1 billion cyber grant program was initially funded through a 2021 infrastructure law and received a temporary extension of its authority through September as part of a government funding deal last year. The House voted in November to approve the Protecting Information by Local Leaders for Agency Resilience — or PILLAR — Act, which would reauthorize the grant program for another 10 years. A companion bill is pending in the Senate, albeit with only a one-year extension.

Witnesses at this latest House hearing said the cyber grant program has been crucial in helping them strengthen their cybersecurity postures, although much more work lies ahead. Darby said the $21 million in grant funding that Tennessee has received has secured almost 90,000 endpoints across local governments and provided cybersecurity training to more than 21,000 local government employees.

That grant funding, the majority of which has been passed to local governments, has also supported programs like managed endpoint detection and response; cybersecurity awareness training; critical infrastructure improvements like firewalls and disaster recovery systems; and managed services for jurisdictions without IT staff, Darby said.

What happens next remains an open question, however, especially if more money is not appropriated to the program. Outside groups have previously called for a stable funding stream of $4.5 billion over two years. Darby said that, without continued funding, local governments would lose access to various programs and services that require subscription funding, they and would be unable to sustain various managed services or make further investments. She also warned of job cuts if the grant program dries up.

“Most importantly, we risk losing the momentum, relationships, and trust that have been built through our whole-of-state approach,” Darby said. “Cyber adversaries are not slowing down. If funding and support diminish, the gap between attackers and defenders will widen.”

Speakers had various suggestions for how the program could be improved. Darby and Colin Ahern, New York’s director of security and intelligence, urged the subcommittee to fund the program consistently over multiple years to allow states to carry out longer-term procurements and initiatives, while Ahern said eliminating cost-share match requirements could help reduce the burden of cost sharing on smaller jurisdictions.

Ahern also said that the program should be amended to allow states and localities to buy memberships and services from the Multi-State Information Sharing and Analysis Center, which recently moved to a membership model after seeing its federal funding cut. All speakers agreed that the federal government must be a strong partner in any cybersecurity efforts alongside states and localities.

“The federal government is an essential partner in this work,” said Florida CIO Warren Sponholtz in written testimony. “Federal intelligence collection and sharing brings national visibility that no individual state can replicate. Federal advisories, threat feeds, automated indicator sharing, vulnerability guidance, and incident coordination help states understand what is happening across the country and what may be heading toward our jurisdictions.”

There appears to be broad bipartisan support for helping state and local governments in their cybersecurity posture and a recognition that, while it may need tweaks, the cyber grant program has been a positive step forward.

“The premise was simple [behind the grant program],” Rep. Andy Ogles, a Tennessee Republican who chairs the subcommittee, said in his opening statement. “A small town faces the same threats as a large city, and a rural county is not exempt from Chinese or Russian cyber actors just because it has a limited IT budget. That program helped communities that could not otherwise help themselves. Unless Congress acts, that program expires this September. We should not let that happen, and we certainly should not let it happen at a moment when the threat is growing ever worse.”