FEMA Grant Funds Now Cover Cybersecurity Membership Fees

The policy update allows states to use grant money for MS-ISAC membership costs, easing budget pressures for local agencies.

Updated on Oct. 20, 2026 in Cybersecurity

Bold flat-color editorial illustration of a secure lock mechanism, representing the policy change for cybersecurity funding access. — FEMA has reversed a policy restriction, allowing state and local agencies to use federal grant funds for essential cybersecurity membership fees. AI Illustration. Upload story photo >

Live Poll

Do you believe publicly funded cybersecurity memberships are a worthwhile use of government grant money?

FEMA has updated its guidance to allow states and local governments to use grant funds for Multi-State Information Sharing and Analysis Center (MS-ISAC) membership fees. This policy change, issued via Information Bulletin 588, reverses a previous fiscal year 2025 prohibition on using federal awards for these cybersecurity service costs.

Why it matters

The change enables public-sector organizations to maintain access to essential threat information and expert support as they navigate shifting federal funding models. By allowing grant funds to cover these costs, FEMA aims to help local entities maximize limited cybersecurity budgets after federal cooperative agreements previously funding the center concluded.

MS-ISAC has onboarded 5,992 public-sector organizations since moving to a paid model, transitioning away from a legacy system that supported 18,000 jurisdictions. Recipients utilizing grant funds must now provide itemized cost breakdowns and documented comparative pricing to justify the expenditure.

The players

FEMA

The federal agency responsible for emergency management and administration of the State and Local Cybersecurity Grant Program.

MS-ISAC

A provider of cybersecurity threat information and technical support services for state, local, tribal, and territorial governments.

Center for Internet Security

The organization that operates the MS-ISAC and manages its transition to a subscription-based membership model.

The details

Grant recipients must now satisfy rigorous documentation requirements to utilize the State and Local Cybersecurity Grant Program for membership fees. This process includes providing a detailed breakdown of services bundled with the MS-ISAC membership and performing market research to demonstrate that the fees are reasonable. Organizations must explicitly show how the purchased services, which include threat intelligence and technical expert support, directly align with their cybersecurity program objectives.

October 9, 2026: FEMA issued Information Bulletin 588.
October 15, 2026: Center for Internet Security announced the policy change.

The Tech Race

This policy adjustment reflects the broader effort to stabilize cybersecurity infrastructure as federal support shifts from direct cooperative agreements to grant-based models. It moves the sector away from the legacy access patterns of the Nationwide Cybersecurity Review, forcing local agencies to justify service costs through a new fiscal lens.

Public-sector IT administrators and grant managers can now immediately apply for funding to cover MS-ISAC membership costs. Organizations must first establish a documented market research process to prove cost reasonableness before drawing on their existing grant allocations.

The takeaway

Agencies should prioritize updating their grant budget requests to include itemized service breakdowns for subscription fees. Future adjustments to the grant landscape may include the introduction of new mandatory assessment tools to replace the decommissioned Nationwide Cybersecurity Review.