$1 Billion Over Four Years: The Federal Cybersecurity Money Small Towns Rely On Is Running Out

Congress set aside $1 billion in 2021 to help states, cities and towns defend their computer networks. The money was meant to last four years. It came from the 2021 infrastructure law. That law created the State and Local Cybersecurity Grant Program. The first year was 2022.

Four years is up, and local officials are being told so. Paul King runs technology for the town of Friday Harbor, Washington. In June he told his council that "the federal government is currently in its final year with the grant program." Friday Harbor is asking for $275,000 of it to protect its water and sewer systems.

The awards are small. Owosso, Michigan is getting $22,960. It owes nothing in return and has until September 30, 2028 to spend it. Norwalk, Connecticut is getting $24,000 and must put in $6,000 of its own. Portsmouth, Rhode Island was awarded almost $144,000 to pay for a second login step for four years. The biggest is Corpus Christi, Texas, which is chasing $406,345.24 and would have to match it with $101,586.31 in cash. Owosso's award came with no local share at all.

It is running out while attacks keep landing. Suisun City, California called its council in at 8 a.m. one morning this month. The city needed direction on a demand from the people behind what it calls the August 2026 Cyber Incident. Winona County, Minnesota has declared emergencies over two separate attacks, and the National Guard came. Foster City, California declared an emergency over ransomware this spring. Passaic County, New Jersey turned to emergency contracting after its own. When the grant money stops, the general fund is what is left.

At a Glance

• Program: The State and Local Cybersecurity Grant Program. It was created by the Infrastructure Investment and Jobs Act of 2021.
• Size: $1 billion over four years, starting in 2022. The federal cyber agency, the Cybersecurity and Infrastructure Security Agency, or CISA, reports $200 million in year one and $400 million in year two, counting this program together with a separate tribal cybersecurity grant program.
• Status: In its final year, Friday Harbor, Washington's technology chief told his council in June. Money set aside in earlier years is still going out.
• How it reaches towns: CISA sets the rules. The Federal Emergency Management Agency writes the checks. State agencies pass the money down. The law makes states send at least 80 percent to local governments. At least 25 percent of a state's allocation has to go to rural areas.
• Award range in 2026: $22,960 in Owosso, Michigan, up to the $406,345.24 Corpus Christi, Texas is seeking.
• Local share: None in Owosso. $6,000 against a $24,000 award in Norwalk, Connecticut, on a $30,000 project. 30 percent of project cost in Contra Costa County, California.
• Emergencies declared in 2026: Winona County, Minnesota, twice. Foster City, California.

Why Every Town Buys the Same Things

The shopping list barely changes from state to state. CISA tells applicants what good practice looks like. Turn on a second login step. Keep better logs. Encrypt data. Stop using internet-facing software and hardware the maker no longer supports. Limit default and shared passwords. Be able to rebuild systems from backups. Share threat information. Move to a .gov address.

Towns bought that list. Utility staff in Coldwater, Michigan asked their board to award a backup contract to SHI for $143,963.79. Contra Costa County, California went after as much as $175,000 to swap old door badges for encrypted cards. The federal share would be 70 percent. Portsmouth's money goes to one thing only, a second login step. Owosso's buys backup systems. Slaughter Beach, Delaware, a town of about 300 people, has finished its grant and is moving town email to a .gov address. It has also written a security plan.

School districts buy at a different level, and they rent rather than own. The DeKalb County School District in Georgia moved to keep paying Cyderes up to $678,960 to watch its network, plus up to $331,200 to Dean Dorton for advice. That is more than a million dollars for one district. Federal awards elsewhere run to tens of thousands.

A big district can carry a million-dollar service on its own books. A town of a few thousand cannot.

Money Is Still Going Out the Door

Friday Harbor's warning came weeks before the next round of money went out. On August 4, 2026, the California Governor's Office of Emergency Services wrote to Superintendent Juan Cruz of the Heber Elementary School District. The letter told him his district would get funds from the 2024 federal budget year. Smyrna, Tennessee is taking a 2024 award of its own through the state finance department.

Both things are true at once. Money set aside in earlier years is still reaching towns. The power to hand out new money is running down. The two are easy to mix up. Owosso can spend its grant until September 30, 2028, long after new money stops.

Suisun City Called an Emergency Meeting Over a Demand

Suisun City is a Solano County city of about 28,000 people. In mid-August it called its council together at 8 a.m. under California Government Code section 54956.5. That law lets a city meet faster than the state's open meeting rules normally allow. The reason the city gave was "a crippling activity that severely impairs public safety."

"...and that prompt action is necessary due to the disruption or threatened disruption of public facilities and the need for prompt Council direction regarding a demand received from the person or persons responsible for the August 2026 Cyber Incident..."

The city described the trouble as still happening, not over. And the attackers had made contact and asked for something. The council was set to go behind closed doors on two questions. One was a threat to the controls that run critical systems. The other was a lawsuit the city thinks may be coming. No outcome has been made public.

Suisun City had already been spending on the problem. Weeks earlier the council weighed more work from Apex Technology Management, LLC. The job covered a backup device, cloud backups, and moving staff remote access to a system called Timus. Whether any of it was finished in time is not known.

Winona County Is Seven Months In

Winona County, Minnesota declared a local emergency in January. It said it was "experiencing a cyber-attack affecting county information systems" and critical services. The county used Minnesota Statutes chapter 12 to start its emergency plan and ask for outside help. On January 27 the board met privately with its administrator, assistant county attorney, technology director and human resources director.

Months later, commissioners Chris Meyer and Greg Olson gave a regional workforce board an update. Police were still investigating. The National Guard came. And the county had declared emergencies "on both episodes," meaning two attacks, not one.

They also said two things that do not fit together. The declarations mean the county "should be some reimbursement for our staff time and work that is done." But the county has "not been able to get reimbursements from the state or grants because of the attack." The paperwork that would prove the loss appears to be part of the loss.

The damage went well past the technology department. The county's economic development arm found the attack had stopped loan payments from going through. Borrowers were marked late who were not late. The loan book carried a balance of $599,626.30, with another $200,000 promised.

The Insurance Response

Cyber coverage is moving faster than the grants. The number of United States local governments handling cyber insurance climbed from single digits a month in late 2025 to 40 in May 2026. June and July were 46 each. The counts come from Obedio data, by month. What they are buying is not comparable. Murrysville, Pennsylvania is renewing a cyber policy with Travelers Insurance for $5,618, running August 2026 to July 2027. Glendale, California moved to renew property, excess liability, workers' compensation and cyber coverage in one bundle, capped at $9,887,600.89. Mono County, California takes cyber liability coverage through a shared pool of public agencies, run by Public Risk Innovation, Solutions, and Management.

Passaic County shows the order of events. Ransomware hit the county in March. It hired the response firm MoxFive LLC under emergency rules instead of taking bids. It went back later for a bigger contract. Its cyber policy from Lexington Insurance Company reached the board in June as an after-the-fact approval. The policy was already in force.

What Defense Looks Like Without a Grant

Some of it costs nothing but staff time. Mason County, Michigan adopted Resolution 2026-116 in July. Chair Andersen moved it and Krieger seconded. It approves a written plan for handling a cyber attack, drawn up by the county's Computer Network Advisory Board. The plan protects county data. It puts one group in charge during an attack. It keeps county systems from being used to attack others, and limits the fallout. Stafford, Texas moved to adopt a similar plan.

Water and sewer systems have another option. The Environmental Protection Agency points utilities to three other funds. Two are the Clean Water and Drinking Water State Revolving Funds. The third is a resilience program for midsize and large drinking water systems. The agency says all three can pay for cybersecurity work.

Owatonna, Minnesota put numbers on the daily grind. Jackson Enz, who runs security operations, told the council the city takes about 7,471 emails a day, roughly 2.7 million a year. It blocks about 200 of them daily. Staff found more than 1,200 security incidents over the year, and about 280 needed a person to step in. Phishing aimed at local government, Enz said, is up 360 percent in a year. He cited an IBM study. It puts the average data breach at $4.8 million and the average ransomware bill at $1.8 million, before fines and lawsuits. Enz also pointed to a recent coordinated attack on Minnesota water systems. AE2S, the company that runs Owatonna's water controls, confirmed the way in was shut on the city's systems.

Timeline

Why It Matters for Vendors, Insurers and Municipal Buyers

• Grant money and general funds are two different sales. A $22,960 award with no local share and a 2028 deadline buys one backup system. A $406,345 application with a $101,586 match buys a platform. As the program winds down, buyers move from the first column to the second, or drop out.
• Grant deadlines outlast the grants. Owosso can spend until September 2028. Renewal talks for grant-funded tools will land on budgets that never planned for them.
• Emergency rules skip the bidding. Passaic County hired MoxFive under emergency rules, then went back four months later for a bigger contract.
• Water and sewer utilities can apply elsewhere. Friday Harbor aimed its request at utilities. The Environmental Protection Agency lists state revolving funds as another way to pay for the same work.

The Risks and Obstacles

• Old money still flowing is not new money. California was still sending out 2024 funds in August 2026. That does not mean Congress has added more.
• The local share is a barrier for the smallest towns. Corpus Christi has to find $101,586.31 in cash. Norwalk has to find $6,000. Owosso and Slaughter Beach owed nothing. Which column a town lands in decides whether the money is reachable.
• Winona County may not get paid back. The county says its emergency declarations should support reimbursement for staff time. In the same breath it says it cannot get money from the state or from grants because of the attack.
• A vendor's breach becomes the town's problem. Godfrey, Illinois had to work through its county emergency office after ransomware hit CodeRED, the alert system it uses but does not run.

What to Watch

• Whether Congress puts more money into the program, and what states do with what is left.
• Fiscal 2027 budgets, where general-fund money to replace expiring grants will either show up or not.
• Whether Suisun City says what came out of its emergency meeting, and whether a lawsuit or an insurance claim follows.
• Cyber policy renewals this fall, and whether more towns join pools instead of buying on their own.

Contact Obedio

Obedio tracks cybersecurity spending, grant awards and insurance placements across local governments nationwide. Contact Obedio for municipal cybersecurity best practices, what comparable towns are paying for cyber liability coverage, and which carriers, brokers and risk pools are writing that business.

This article is factual background and is not legal, financial, or investment advice.