What the SLCGP Was — and What Has Now Lapsed
Congress established the SLCGP and the companion Tribal Cybersecurity Grant Program (TCGP) in the Infrastructure Investment and Jobs Act (Pub. L. 117-58, enacted November 15, 2021), appropriating $1 billion to be distributed over four years: FY2022 through FY2025. FEMA administered the program in coordination with CISA, with the Governor-designated state administrative agency (SAA) — typically the state emergency management or homeland security agency — responsible for receiving the federal award and making subawards to local governments.
The final year allocation was $91.7 million for SLCGP, down from $279.9 million in FY2024. The Governor-designated state administrative agency was required to pass at least 80 percent of its award to local governments, including at least 25 percent of the total award to rural areas — meaning the program was structurally oriented toward building sub-state capacity, not simply reinforcing already-capable state agencies. By FY2025, the minimum state cost-share requirement had increased to 40 percent, shifting more of the funding burden back to states.
The statutory program requirements expired September 30, 2026. A vendor briefing from Faction Networks (status verified September 23, 2026) describes the mechanics, each of which is confirmed directly in the statute: Pub. L. 119-75, §5009 extended only §665g(s)(1) — the sunset provision — from September 30, 2025 to September 30, 2026. It did not extend the cost-share table (§665g(m)), which lists FY2022–FY2025 only, nor the authorization of appropriations (§665g(r)), which also ends at FY2025. No FY2026 appropriation appears in Pub. L. 119-86, the FY2026 Homeland Security funding law. Existing FY2022–FY2025 state awards remain active under their individual periods of performance — FY2025 federal grants run through August 31, 2029 — and states can continue distributing subawards to local governments through those dates. What the lapse means is that no new money is coming after these awards run out, absent new legislation.
Where Reauthorization Actually Stands
The House passed the Protecting Information by Local Leaders for Agency Resilience Act (H.R. 5078, the PILLAR Act) by voice vote on November 17, 2025. The bill would reauthorize the SLCGP through FY2033, expand eligible activities to include operational technology systems and emerging AI systems, permit spending on legacy OT that is no longer supported by its manufacturer, and give local governments a petition mechanism when a state SAA stalls on subawards. The House Homeland Security Committee Majority's September 10, 2026 twenty-fifth anniversary report on national security improvements explicitly endorsed PILLAR. Its language goes directly to the sustainment problem: the program "should be reauthorized and sufficiently funded so that jurisdictions can continue building capabilities that cannot be sustained through local resources alone." The report also notes that "Federal support should also encourage durable capabilities rather than one-time purchases that recipients cannot operate or maintain."
The only Senate bill addressing the program is S. 3251 (Hassan/Cornyn), introduced November 20, 2025. It is a one-year bill: it would authorize $300 million for FY2026 only and add a single FY2026 cost-share row. It is not a counterpart to PILLAR's eight-year extension. As of October 2026, no Senate bill matching PILLAR's scope has been introduced. S. 3251 has received no committee action beyond its initial referral.
On the appropriations side, the House Appropriations Committee reported H.R. 9310 on June 12, 2026, which includes a $50 million FY2027 SLCGP line. It has not been enacted; the FY2027 Homeland Security budget is not yet law. Even if enacted, $50 million nationally is a fraction of historical program levels, and a new funding notice, applications and awards would likely need to run first — probably not until mid-2027 on typical NOFO timelines.
A post-election lame-duck window could accelerate action, but lame-duck sessions are short and crowded with must-pass appropriations and defense legislation. State CISOs who count on reauthorization before a FY2027 budget submission have a single-point-of-failure in their plan.
The Spend Pattern That Determines Your Risk
How a state or locality used SLCGP funding over four years now determines what is at risk. Three distinct patterns appear in public program documents:
One-time deployment purchases. Many jurisdictions used grant funds to procure and deploy specific security products — endpoint detection and response agents, multi-factor authentication platforms, network monitoring tools — covering the initial licensing period. These investments produced real security improvement during the grant period. They sustain that improvement only if the state or local budget absorbs the recurring cost when the grant ends. Where there is no budget line, the subscription lapses, the agent goes unrenewed, or the platform relationship strains before the next renewal window. The security posture improvement disappears; the threat environment does not.
Shared services and aggregated contracts. The Cyber Florida October 2026 bulletin notes that for the final year of funding, Nebraska may shift from individual jurisdiction projects to multijurisdictional purchases such as aggregated endpoint detection and response licensing. Aggregated state contracts are structurally more defensible than per-jurisdiction standalone subscriptions: they survive the grant when the state absorbs the renewal cost rather than pushing it to local governments that cannot carry it. Whether a jurisdiction pursued this model, and whether the state has committed to the recurring cost, is exactly the question the sustainment audit surfaces.
One practical complication: CIS membership under MS-ISAC was listed as unallowable in the FY2025 funding notice. In October 2026, the Center for Internet Security announced that, under revised FEMA guidance (Information Bulletin 588), SLCGP funds can be applied to MS-ISAC membership and services. States with FY2025 award balances may therefore use those funds for MS-ISAC membership, but the recurring cost falls to the state when those balances run out.
Workforce and training programs. Montana's state Cybersecurity Planning Committee directed SLCGP funding toward five project focus areas: security awareness training for the general workforce, professional development for the technical workforce, endpoint detection and response, network traffic monitoring, and multi-factor authentication. Training investments are structurally different from product subscriptions. The training occurs once per cohort; the knowledge does not expire when the grant does. The institutional knowledge built through SLCGP-funded professional development stays in the workforce, even if the program that funded it does not.
The Sustained Capacity That Matters Most
The NASCIO 2026 State CIO Survey found that about half (49 percent) of state CIOs have funding to support local entities for critical infrastructure cyber protection. Those CIOs credited partnerships with MS-ISAC, fusion centers, and emergency management operations — alongside reliance on SLCGP — as critical to delivering these services, and a number of respondents identified SLCGP specifically as "vital to funding local entities." This is the most consequential exposure from program lapse — not a state agency's posture, but the whole-of-state model that extended state resources to counties, municipalities, school districts, and regional entities. The program's design — 80 percent of each award flowing to local governments — reflected that state agencies generally had more resources and capacity than the sub-state entities the grant was built to reach.
Those sub-state relationships do not automatically transfer to state general fund expenditures. Many were structured as grant-dependent services: state staff funded by the award who provided technical assistance, shared security monitoring contracts that local governments received as grant pass-throughs, and awareness training delivered to local workforces at no local cost. When the grant ends, the structure that delivered those services ends with it unless the state makes a deliberate budget decision to continue.
Critically, AI is now competing for exactly this state IT budget space. NASCIO's State CIO Top Ten priorities for 2026 marked the first year AI took the top spot, "overtaking cybersecurity, which held the top position for 12 straight years." That shift reflects real opportunity; it also means that requests for cybersecurity sustainment funding — which look defensive and maintenance-oriented — are competing against AI pilots and modernization investments that are more visible and more politically legible in executive budget processes.
The Sustainment Audit: A Practical Framework
Before state budget submission deadlines, state and local CISOs should complete a formal audit of every SLCGP-funded item. This is not a compliance exercise; it is a risk identification exercise.
For each funded capability:
- Classify the spend type. Is this a recurring product license, a one-time purchase (hardware or software deployment), a subscription service, or a training or workforce investment? Recurring licenses carry the highest lapse risk; one-time hardware purchases are lower risk since the asset persists. Training investments are the most durable.
- Identify the responsible budget line. Does the state or local budget currently carry this cost without the grant? If not, what is the conversion path — does it become a state general fund line, transfer to a local government's own budget, or simply end?
- Identify whole-of-state exposure. For every capability that serves local governments or smaller jurisdictions, identify which entities depend on it and whether they have independent budget to sustain it. A county that received SLCGP-funded EDR agents under a state aggregated contract may not know that contract depends on grant funding that has now lapsed.
- Define what lapses if no action is taken. This is the most important output: a list of specific capabilities, with their recurring costs and the security functions they provide, that will gap in the next 6-12 months unless converted to appropriated funding. This list is the budget case.
- Prioritize for conversion or acceptance. Not every SLCGP-funded item is worth the fight for a state budget line. A one-time phishing simulation for county IT staff is a sunk benefit; do not budget for it. A statewide SIEM platform that — hypothetically — forty local governments feed data into is shared infrastructure worth a budget request. Assess criticality, cost-effectiveness, and whether the alternative is an acceptable posture gap.
Two Factors That Change This Analysis
If PILLAR or an appropriations bill passes, even an enacted $50 million FY2027 line in H.R. 9310 does not mean money flows immediately. A new funding notice, applications and awards would likely need to run first — on typical NOFO-to-award timelines, probably not before mid-2027 at the earliest, and possibly longer for an eight-year reauthorization with expanded program requirements. A gap of six to twelve months or more between program end and first new award is a reasonable planning assumption, not a guaranteed minimum. The sustainment audit is still necessary.
If the threat environment escalates before reauthorization, the political pressure on the Senate changes. The Cyber Florida October 2026 bulletin identifies the November 2026 midterm elections as an early test of state cyber posture after SLCGP lapse — one of two federal supports that have ended, alongside CISA's weekly vulnerability bulletins. Election infrastructure, voter registration systems, and county election management systems are the highest-visibility local government targets in this window. A significant incident tied to a capability that lapsed with the grant would accelerate Senate action; it would also foreclose the argument that the program was unnecessary.
What Spartan X Brings to This Problem
State cybersecurity program sustainability is a program execution and budget strategy problem as much as a technical one. Spartan X's state cybersecurity advisory practice — risk assessments, security architecture and compliance roadmaps for state government — applies directly to this audit: identifying which capabilities the threat environment requires, what the state's governance can absorb, and how to frame the case for continued investment. The sustainment audit produces the list; getting it in front of the budget authority is the work that determines whether the capability survives.
Sources and further reading
- 6 U.S.C. §665g — SLCGP statutory authority (current through Oct. 15, 2026)
- Pub. L. 119-75, §5009 — one-year extension to September 30, 2026
- CISA SLCGP program page
- FEMA, Fiscal Year 2025 SLCGP Key Changes (Sept. 3, 2025)
- FY2025 SLCGP Notice of Funding Opportunity (DHS-25-GPD-137-00-99)
- CISA FY2025 SLCGP Key Changes
- SAM.gov SLCGP program listing with funding history
- H.R. 5078 (PILLAR Act), as passed the House November 2025
- S. 3251 (State and Local Cybersecurity Grant Program Reauthorization Act, FY2026 one-year bill)
- H.R. 9310 (DHS Appropriations Act, 2027) — includes $50M SLCGP line, not yet enacted
- House Homeland Security Committee Majority, 25th Anniversary National Security Report, September 10, 2026
- Faction Networks vendor briefing, SLCGP legislative status, September 23, 2026
- CIS press release on SLCGP/MS-ISAC eligibility under FEMA IB 588, October 15, 2026
- NASCIO 2026 State CIO Survey
- NASCIO State CIO Top Ten Policy and Technology Priorities for 2026
- Montana DES SLCGP Application Information
- Cyber Florida Critical Infrastructure Bulletin, October 5, 2026
