What’s Changed for MS-ISAC Members?

For nearly two decades, the MS-ISAC, managed by the Center for Internet Security (CIS), served as a trusted cybersecurity resource for state, local, tribal, and territorial (SLTT) governments. Funded by the Cybersecurity and Infrastructure Security Agency (CISA), it provided free access to threat intelligence, monitoring tools, and incident response support. That funding model has officially ended.

As of October 1, 2025, MS-ISAC operates under a membership-based, fee-supported structure. While this change ensures the program’s sustainability, it has created new financial and operational challenges for local governments that depended on federally subsidized services.

Smaller jurisdictions such as municipalities, K-12 districts, and utilities now face difficult decisions about how to replace or retain essential capabilities like network monitoring, vulnerability scanning, and incident response coordination.

Why Does This Matter for Local Government Leaders?

The MS-ISAC transition affects far more than budgets. It reshapes how local governments plan, prioritize, and justify their cybersecurity investments moving forward.

Leaders must now:

  • Identify which MS-ISAC services their teams previously relied on
  • Determine what coverage gaps have appeared post-funding
  • Reallocate resources to sustain mission-critical protections

Because the State and Local Cybersecurity Grant Program (SLCGP) still prohibits the use of grant dollars for MS-ISAC membership fees, agencies can no longer depend on those funds to fill the gap. Without a structured plan, organizations risk losing visibility at a time when ransomware, phishing, and supply-chain attacks are surging. Here are five steps to follow.

Step 1: Assess Your Current Capabilities

Start by conducting a full inventory of your cybersecurity ecosystem. Document which MS-ISAC services you previously used, what functions they provided, and where those functions now stand.

If your team depended on Albert sensors for network intrusion detection, for example, evaluate whether you can maintain that visibility through state-level cooperative programs, regional SOC initiatives, or managed detection and response (MDR) services.

This assessment provides a foundation for budget planning and risk-based decision-making.

Step 2: Develop a Risk-Based Cybersecurity Budget

With MS-ISAC services no longer funded, local governments need to transition from a cost-avoidance mindset to a risk-management framework. Spending should align directly with the systems and operations most essential to your mission.

Here are key strategies to guide that process:

  1. Connect every expense to a measurable reduction in risk: Focus on high-impact assets like elections systems, utilities, or public-safety networks.
  2. Plan in phases: Begin with achievable initiatives—such as MFA hardening, centralized logging, and vulnerability scanning—then scale toward advanced frameworks like zero trust.
  3. Include flexibility: Dedicate a portion of your cybersecurity budget to incident response readiness and emerging threats.
  4. Measure progress: Use key performance indicators such as mean time to detect (MTTD), patch compliance rates, and employee training participation to demonstrate ongoing improvement.

Step 3: Leverage Shared Services and Partnerships

With MS-ISAC’s funding model now subscription-based, collaboration is more important than ever. Shared services and public-private partnerships can help preserve visibility and response capabilities without overextending local budgets.

Consider options such as:

  • Regional or state SOC programs that offer pooled monitoring and analysis
  • Cooperative purchasing agreements that lower vendor costs
  • Managed Security Service Providers (MSSPs) that deliver 24/7 detection and response
  • Public-private partnerships that expand access to training, compliance guidance, and threat intelligence

When evaluating providers, select those familiar with public-sector procurement processes, regulatory frameworks, and the security needs of SLTT entities.

ArmorPoint’s Managed SOC services are designed for this exact environment, providing continuous visibility, incident response, and compliance support to local governments adapting beyond MS-ISAC coverage.

Step 4: Align and Diversify Funding Sources

Although MS-ISAC membership is no longer federally subsidized, several funding pathways remain available.

  • Use grant programs such as the SLCGP for eligible initiatives like risk assessments, endpoint protection, and staff training.
  • Dedicate local budget allocations to maintaining core detection and response capabilities.
  • Coordinate funding schedules across grants, renewals, and contracts to ensure year-round continuity.

A balanced mix of internal funding, external grants, and partnerships creates resilience against future policy shifts.

Step 5: Strengthen Governance and Accountability

As cybersecurity operations evolve, so should governance. Establish a framework that connects cybersecurity decisions directly to organizational strategy and financial oversight.

  • Conduct regular audits and cyber maturity assessments.
  • Share progress reports with governing boards and leadership teams.
  • Tie budget decisions to defined risk metrics and outcomes.

This transparency demonstrates that each investment directly improves security posture and helps secure long-term funding support.

Conclusion

The end of MS-ISAC’s federal funding marks a pivotal moment for public-sector cybersecurity. Rather than viewing it as a setback, local governments can use this shift to modernize governance, strengthen regional partnerships, and invest in sustainable security operations.

Agencies that act now by reassessing capabilities, optimizing budgets, and partnering strategically will be better positioned to safeguard their communities in the years ahead.

Ready to strengthen your post-MS-ISAC security plan?

Identify which security functions are mission-critical and explore options that extend coverage without exceeding your budget. ArmorPoint’s managed cybersecurity services help SLTT organizations maintain visibility and control long after the MS-ISAC transition. Contact ArmorPoint today to discuss your post-MS-ISAC cybersecurity strategy.