The Cybersecurity and Infrastructure Security Agency is facing criticism from state and local officials who feel abandoned as federal support for critical cybersecurity programs diminishes. Many officials believe they will need to become more self-reliant, especially following recent cuts to the Multi-State Information Sharing and Analysis Center, which has provided vital cybersecurity intelligence for over two decades. A recent survey indicates that 22% of state and local governments allocate no funds for cybersecurity, while 42% operate with an annual budget of less than $100,000. With a growing reliance on state-driven initiatives, officials warn that the lack of federal support could lead to increased vulnerability to cyberattacks, as highlighted by Chris Gergen, North Dakota’s Chief Information Security Officer, who stated that the absence of federal backing leaves local governments to fend for themselves against advanced threats from nation-state actors.
The National Institute of Standards and Technology is developing new security guidance for artificial intelligence to address its associated risks, building on existing cybersecurity frameworks. This initiative aims to clarify how artificial intelligence interacts with cybersecurity, distinguishing three key areas: securing AI systems, the adversarial use of AI, and utilizing AI to enhance cybersecurity measures. Additionally, a bipartisan bill, the Validation and Evaluation for Trustworthy Artificial Intelligence Act, has been reintroduced in the Senate to establish guidelines for the development and testing of AI systems, emphasizing the need for responsible innovation in the rapidly evolving technology landscape.
House appropriators are proposing a significant funding increase for the National Institute of Standards and Technology, allocating $1.28 billion in the fiscal year 2026. This represents an 11% boost over current funding levels, rejecting the Trump administration’s request for a $325 million cut, which would have resulted in over 650 job losses. The proposed budget supports the Hollings Manufacturing Extension Partnership Program with $175 million, countering the administration’s aim to eliminate it. Additionally, $980 million is earmarked for NIST’s Scientific and Technical Research and Services program, reflecting a $237 million increase, despite potential reductions in critical areas like cybersecurity and health measurements.
The General Services Administration has announced that the Federal Risk Management and Authorization Program has already approved more than twice as many government cloud services in fiscal year 2025 compared to all of fiscal year 2024. As of July, FedRAMP reached 114 authorizations, alongside four new cloud services introduced through its revamped program aimed at simplifying the authorization process. The FedRAMP 20x program, launched in March, seeks to reduce the approval timeline from months to just weeks, eliminating the need for agency sponsorship, which has historically been a costly and time-consuming requirement. This shift reflects a broader trend toward a more efficient cloud authorization process, significantly decreasing wait times from over a year to approximately five weeks, according to GSA officials.
President Trump has announced the development of a new health care records system aimed at simplifying the sharing of personal health information among American consumers and healthcare providers. This initiative, launched in collaboration with major technology companies like Google, Amazon, and Apple, seeks to replace cumbersome paperwork with a more efficient electronic records system. During the announcement, Trump emphasized that the program will be entirely opt-in, addressing concerns about privacy and security. Medical data will not be stored in a centralized government database, which has been a common worry among citizens. However, experts have expressed skepticism regarding the program’s ability to protect patient privacy and comply with existing laws such as the Health Insurance Portability and Accountability Act. Critics note that much of the infrastructure for such a system is already in place, and voluntary participation may not yield the desired widespread adoption.
Why do we care?
Here’s the blunt version. Federal support is wobbling. MS-ISAC lost money, some grants can’t even pay for it, and a chunk of local governments have no cyber budget. If you serve cities, counties, or schools, you can’t wait for CISA—sell a fixed-price minimum viable cyber bundle that fits under $100k and document which grant dollars apply. And voice your concerns over CISA’s struggles – that’s a key resource we need.
On AI, NIST’s mapping is coming and the VET AI Act would force real third-party evaluations. Good—use that to standardize your AI hardening and keep a proof folder for audits.
Cloud? FedRAMP 20x is actually moving. Approvals are around five weeks and authorizations are up 2×. That’s your cue to push FedRAMP-authorized stacks for any gov-adjacent buyer and build a migration SKU. Also note that FedRAMP is becoming a thing in MSP world, and the race to certification is on for the platform vendors.
And the new health-records push? It’s opt-in and PR-heavy. Don’t chase shiny. Lock down consent, app vetting, and PHI logs before your clients connect more apps.
Theme of the day: operational discipline beats policy drama. Standardize your offers, prove the outcomes, and keep receipts.