CISA Takes Over from CIS: Future of MS-ISAC Services Uncertain
Today marks the end of the cooperative agreement between the Cybersecurity and Infrastructure Security Agency (CISA) and the Center for Internet Security (CIS). This change raises questions about the future funding of vital cyber security services for state, local, tribal, and territorial (SLTT) governments.
CISA will now directly support SLTT governments, replacing MS-ISAC's services. However, the future of MS-ISAC's operations is uncertain, as federal funding for its cyber threat analysis, incident response, and outreach activities has been cut. CIS is temporarily funding MS-ISAC's services but plans to implement a fee-based membership model for sustainability.
The Cybersecurity Information Sharing Act of 2025, which facilitated these services, is expiring this month with no indication of reauthorization by the US Congress. Adding to the uncertainty, CISA has faced budget and workforce cuts, and a potential funding lapse due to a possible federal government shutdown. No clear alternative funding source has been identified for continuing these critical cyber security services beyond the current cooperative agreement.
As CISA takes over support for SLTT governments, the future of MS-ISAC's services and funding remains unclear. While CISA will offer grants, tools, and expertise, the expiration of the Cybersecurity Information Sharing Act and potential funding lapses pose challenges. Stakeholders await further clarification on how these essential cyber security services will be sustained in the long term.
