Start with the actual funding calendar
SLCGP, administered through CISA and FEMA, supports state, local and territorial cybersecurity planning and investment. Its value is particularly clear where smaller jurisdictions need expertise and tools they cannot readily sustain alone. It should not be described as the origin of all whole-of-state cybersecurity: states and local partners had cooperative programs before this grant.
CISA's 2026 evaluation notice describes the original $1 billion, four-year funding program and schedules its active funding phase to conclude in fiscal 2026, with the final performance period in fiscal 2029. That is the notice's program-level timeline. As of this October 1, 2026 review, fiscal 2026 has ended; that does not establish that every individual award has expired or that the notice describes every subsequent funding action. A recipient must still consult its own award, amendments and applicable guidance for its actual expenditure and closeout dates; it should not assume it has three more years merely because the evaluation discusses 2029.
The notice proposes evaluating implementation and outcomes. It is not a completed finding that the program succeeded or that a particular sustainment model will receive a favorable score.
Decide what the state is buying together
A shared security operations center, consolidated tooling or joint technical assistance can spread scarce expertise across jurisdictions. A county may gain access to monitoring and response capabilities that would be difficult to staff independently. Common reporting can also help participants understand threats that cross organizational boundaries.
Those benefits depend on execution. Shared infrastructure can concentrate risk, and a central team can become a bottleneck if enrollment grows faster than staffing. Not every local need fits one service. A regional arrangement, a state-provided baseline with local supplements or a commercial service may each be appropriate.
The decision therefore needs evidence: which entities actually send usable telemetry, what hours are covered, who can take response action and how quickly an incident reaches the right local official. A list of enrolled jurisdictions is not the same as verified protection.
Turn a funded project into a supported service
Licenses, monitoring, maintenance and analysts generate recurring costs. An assessment can remain useful after a grant ends, but its recommendations need owners and implementation resources. A tool purchase without an operating plan can leave a jurisdiction responsible for a capability it cannot maintain.
Service agreements should settle practical questions:
- Participation: which entities and systems are covered, and what local prerequisites apply?
- Responsibility: who monitors, investigates, contains and restores, within each entity's authority?
- Funding: which appropriation, local contribution or approved cost-recovery arrangement pays recurring costs?
- Information: who can access shared data, for what purpose, and under what retention terms?
- Exit: how a participant leaves without losing essential records, coverage or support unexpectedly.
Workforce planning belongs here too. A standing operations function needs qualified backups, development paths and training time. Temporary staffing can help launch a program, but the plan should state who carries the work when a term or contract ends.
Use the evaluation to ask better questions
The federal notice identifies questions about planning, technical assistance, training and preparedness. Legislators and program leaders can use the same general discipline locally: establish a baseline, compare results and identify what the program cannot yet demonstrate.
Useful operating measures include verified endpoint coverage, response and restoration performance, unresolved high-impact gaps and the cost of serving an additional jurisdiction. Interpret changes carefully. More detected incidents may reflect better visibility rather than worsening security; fewer alerts may reflect a broken feed rather than improvement.
The budget case becomes stronger when it can explain both what the shared service provides and what would be lost if it ended. Avoid treating every purchased seat as value or every unspent dollar as failure without examining the service delivered.
Build the sustainment case around one service
Take a hypothetical grant-supported monitoring service used by several counties. The award paid for initial onboarding and a period of subscription coverage. The next budget request needs to distinguish costs that will not recur from those required to keep protection operating: analyst coverage, data collection, platform renewal, engineering, local support and incident coordination.
Start with the actual service boundary. Which enrolled systems provide working telemetry? Who investigates alerts overnight? Who can authorize containment locally? A county that holds a license but has not completed onboarding should not be counted as receiving the same service as one with tested coverage and response procedures.
Then connect each continuing expense to a funding source and decision date. The date a contract renews may arrive before an award closes or a legislature considers an appropriation. Give decision-makers enough time to select an option without forcing an emergency renewal merely because the procurement process started late. The grants office should confirm allowable uses and award-specific restrictions; a generally useful cybersecurity service is not automatically eligible under every award.
Present choices with the lost capability made explicit
A useful decision paper compares more than full continuation with abrupt cancellation. Depending on the service and legal arrangements, options may include a narrower baseline, a regional partnership, local cost sharing or transition to another provider. Describe the operating effect of each, including onboarding work and changes in response coverage.
If contributions are proposed, test the affordability and participation assumptions. Losing several participants may raise the cost per remaining jurisdiction or leave important gaps. A cost-recovery model that balances only at full enrollment needs a contingency plan. Conversely, a state-funded baseline may preserve coverage but require explicit choices about which additional services local participants fund themselves.
If a service must end, plan the transition. Identify the last day of monitoring, the receiving provider or local owner, access to necessary incident records and the handling of retained data under applicable terms. Verify the replacement before assuming the gap is closed. A canceled renewal and a signed replacement contract do not, by themselves, prove uninterrupted operation.
This approach gives legislators and local officials a concrete decision: what protection is being purchased, what it costs to sustain and what changes under the alternatives. It also creates accountability after funding is approved. Review actual participation, coverage and support demand against the assumptions rather than allowing the grant's original project description to stand in for the current service.
Prepare the next funding decision
- Inventory recurring commitments. List staff, contracts, renewals, data storage and local support costs by service and award.
- Verify each deadline. Reconcile award terms and amendments with the grants office; keep program-level forecasts separate.
- Test participation and performance. Confirm live coverage and exercise escalation with a sample of participating jurisdictions.
- Present funded options. Compare sustaining, narrowing, combining or retiring services, with costs and impacts stated plainly.
- Align contracts with the chosen model. Require transparent per-jurisdiction costs, access to evidence and transition support.
Vendors serving these programs should expect buyers to ask about multi-entity operations and outcomes, not just product counts. That is a procurement opportunity, but it does not establish that thousands of local buyers will inevitably consolidate into a few state contracts.
Sources and further reading
- CISA SLCGP evaluation notice — proposed evaluation, program context and stated funding/performance timetable. The sustainment options above are management recommendations, not award terms.
Spartan X's cybersecurity and program-execution work addresses both sides of this decision: the controls a shared service needs and the staffing, agreements and budget required to keep those controls operating.
