Nonprofit to provide gap funding for MS-ISAC cuts

After the Department of Homeland Security last month cut roughly $10 million in funding from the Multi-State Information Sharing and Analysis Center, the group will continue providing all cybersecurity services to its 18,000 members thanks to temporary gap funding provided by its parent organization.

The New York nonprofit Center for Internet Security that hosts the MS-ISAC in February lost funding for its Elections Infrastructure ISAC, leading to its closure. Last month it lost additional funding after the Cybersecurity and Infrastructure Security Agency claimed that many of the nonprofit’s services — such as the cybersecurity threat intelligence and cyber incident response it provided to state, local, territorial and tribal governments — overlapped with services already provided by the federal government.

Carlos Kizzee, the center’s senior vice president of MS-ISAC strategy and plan, told StateScoop that the nonprofit is covering the funding gap as a temporary measure while the MS-ISAC’s executive committee plots a course for the group’s future. Claims that its services are redundant, he said, are “not necessarily true.”

“This is a temporary measure, and it was kind of deemed essential to ensure that there be no gap in critical security services based on the reduction of those federal funds,” Kizzee said. “The federal funding does continue for the remainder of the cooperative agreement term, that is through this fiscal year.”

State and local government officials, including many officials responsible for overseeing the nation’s elections apparatus, told StateScoop they are concerned about what the funding cuts will mean to the ability of the nation’s smaller governments to defend themselves against the likes of China, Iran and North Korea.

The MS-ISAC is comprised of 18,301 members — state and local government agencies and departments that rely on the Center for Internet security’s services. These include network intrusion detection, a malicious domain blocking and reporting service, endpoint detection and response, a cybersecurity self-assessment program and a 24/7 security operations center. It provides threat intelligence sharing and has provided training and education to thousands of state and local agencies.

Dozens of state and local IT officials told StateScoop that they rely heavily on the center’s cybersecurity services.

Kizzee said a recent “town hall” meeting of its membership included a poll in which 97% said they considered the group “high value.” And 83% said they would not easily be able to find alternatives if the MS-ISAC’s services were to disappear. Beyond the limited funding available to many local governments, several state officials told StateScoop that the laws of their state additionally prohibited them from accepting cybersecurity information related to elections from any group without a cooperative agreement like that enjoyed by the Center for Internet Security.

Ninety-five percent of MS-ISAC members polled said elimination of the group’s services would have a negative effect on their cybersecurity.

“Without the support we provide, we think there are jurisdictions that would not be able to maintain the operational picture of threat activity against them or the awareness of security best practices that they can take advantage of, or even best practices of how to implement safeguards and security controls in the government environment they’re found in,” Kizzee said.

The funding cuts at the Center for Internet Security surprised many of the officials interviewed by StateScoop. Its MS-ISAC has operated for more than two decades and receives consistently high marks from a crowd that does not often abide waste or inefficiency in their resource-strapped organizations.

With the Center for Internet Security’s cooperative agreement for the MS-ISAC set to expire at the end of the current fiscal year, its future is unclear. Its funding source, CISA, is facing its own operational challenges after losing more than 100 staff members, and the agency of 3,400 could lose as many as 1,300 more as the administration of Donald Trump and Elon Musk’s Department of Government Efficiency unit search for ways to eliminate spending.

Kizzee said the invaluable services the MS-ISAC has provided governments will help it to survive.

“We don’t know yet what the governance and funding model will be,” he said. “[The executive committee’s] deliberation and coordination continue, but I will say that I am confident that the future of the MS-ISAC and the importance of its services will ensure that it’ll be around for decades more to follow.”

Full audio of StateScoop’s interview with Carlos Kizzee is available here.