MS-ISAC: Defending America’s Critical Infrastructure
The Multi-State Information Sharing and Analysis Center (MS-ISAC) provides vital cybersecurity services to more than 18,000 state, local, tribal, and territorial (SLTT) government organizations supporting our nation’s critical infrastructure including public hospitals, public utilities, K-12 schools, and law enforcement. Without these services, they will be increasingly vulnerable to cyber attacks by foreign adversaries.
The MS-ISAC's Impact Across America
The MS-ISAC is the only initiative offering cyber threat intelligence, incident response support, and real-time information sharing programs not performed by the federal government.
Defense Against Costly Cyber Threats
As threats against state and local governments grow in volume and complexity, the average cost of a cyber attack for state and local governments can range from $2.83 million to $9.5 million, with some reports indicating even higher costs, depending on the type and severity of the breach.
In 2024, the MS-ISAC took the defensive measures below in an effort to protect SLTTs across the U.S.
Detected 40,000+ potential cyber attacks targeting SLTT networks
Impacted MS-ISAC members received alert notifications nearly twice as fast as commercially-available alternatives.
Detected and prevented 59,000+ malware and ransomware attacks
MS-ISAC members were supported with endpoint protection services that identify, detect, respond to, and remediate security incidents and alerts.
Blocked 25,000,000,000+ malicious domain connections for SLTTs
The MS-ISAC's protective DNS service blocked an average of 3.3M requests to known or suspected malicious domains per member organization.
How Members are Impacted
Learn how the MS-ISAC has supported the nations cybersecurity maturity across different sectors.
Impact of Funding Cuts to SLTTs
The federal government recently canceled funding for MS-ISAC operations, including cyber threat analysis and threat distribution. . To keep state and local governments secure, the Center for Internet Security (CIS) has been temporarily funding the continuation of cybersecurity services at a cost of more than $1 million per month. That funding will be phased out in the coming months. Without sustainable funding via either a fully-funded cooperative agreement with DHS/CISA or a paid membership model, the MS-ISAC will no longer be able to provide these essential cybersecurity services. Learn more about the impact of these cuts below.
The termination of these services would leave MS-ISAC members without critical, real-time threat information as well as cyber education and training support. These services are especially critical for thousands of small and rural communities, most with limited financial and technical resources, who would become more vulnerable to cyber threats. They would be unable to adequately respond to attacks that could impact local infrastructure, disrupt critical operations, and expose the private data of their citizens to cybercriminals.
Common Funding Questions
How was the MS-ISAC affected by recent funding cuts?
How was the MS-ISAC affected by recent funding cuts, what was cut, and what was the dollar amount of the cuts?
On March 6, the federal government cancelled funding to ten categories of work affecting MS-ISAC operations, including cyber threat analysis and threat distribution, incident response services, a wide range of member onboarding and account management support, and outreach activities including webinars, training, and virtual and in-person meetings.
These cuts were effective immediately. Without funding to sustain the efforts affected, the lapse in MS-ISAC services and support in these areas will hinder the MS-ISAC’s ability to provide state, local, tribal, and territorial organizations with cyber threat intelligence, incident response support, and real-time information sharing programs.
For the fiscal year 2025, the MS-ISAC has been operating with $27 million appropriated by Congress. As of March 6, $15.7 million remained in the MS-ISAC budget. The funding cuts, after negotiations with DHS/CISA, totaled approximately $8.3 million. Therefore, the cuts amounted to more than 50% of the MS-ISAC's remaining budget for the year.
Will funding cuts disrupt cybersecurity services for MS-ISAC members?
Will the funding cuts disrupt the cybersecurity services MS-ISAC members depend on in the near term?
The Center for Internet Security is committed to keeping state and local governments secure. For the next few months, we are funding critical services as we work with members of the MS-ISAC Executive Committee to implement an approach to fill the gap left by the partial discontinuation of federal support.
We are expecting to implement a membership model for core services and a fee-for-service model for non-core services. During this interim period there may be limited disruptions to various MS-ISAC offerings due to shifting priorities or funding constraints.
It’s important to note that some services MS-ISAC members rely on continue to be federally funded and have not been impacted by recent cuts, including:
- Albert Network Monitoring and Management sensors
- Malicious Domain Blocking and Reporting (MDBR)
- Endpoint Detection and Response (EDR)
- the Nationwide Cybersecurity Review (NCSR) and Foundational Assessment
- The 24x7x365 CIS Security Operations Center (SOC) support (to include issuance of Cyber Advisories and IP and Domain Monitoring activity)
MS-ISAC in the News
Resources for MS-ISAC Members
CIS Portal
Please log into the Portal to access resources designed to equip you with the information needed to advocate for our community.
Not a member?
The MS-ISAC is open to employees or representatives from all 50 states, the District of Columbia, U.S. Territories, local and tribal governments, public K-12 education entities, public institutions of higher education, authorities, and any other non-federal public entity in the United States of America.
