Short answer: In March 2025, the Cybersecurity and Infrastructure Security Agency (CISA) ended approximately $10 million in annual funding associated with the nonprofit Center for Internet Security (CIS), which operated key information-sharing services for state, local, tribal, territorial, and election organizations. At the same time, CISA faced reported workforce reductions and contractor cancellations. The funding cut and the staffing losses were related developments, but they were not one single transaction.
The largest operational change came later: federal funding for MS-ISAC ended in September 2025, and the service moved to a fee-based membership model on October 1, 2025. MS-ISAC still exists, but access is no longer based on the former federally subsidized model.
As an Amazon Associate I earn from qualifying purchases.
The timeline at a glance
- March 2025: CISA announces an approximately $10 million annual reduction tied to its cooperative agreement with CIS.
- February through mid-2025: Reports describe probationary federal terminations, other staff departures, and canceled contractor agreements.
- September 2025: Federal funding for MS-ISAC services ends.
- October 1, 2025: MS-ISAC transitions to paid membership through CIS.
- 2026: Lawmakers continue questioning CISA staffing, budget capacity, and the future of election-security support.
The central consequence is not simply that CISA became smaller. A national public-sector cyber-coordination function moved from a federally subsidized arrangement toward a mix of paid membership, state support, commercial security services, and uncertain federal replacement programs.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the $10 million funded
CISA is the federal cybersecurity agency within the Department of Homeland Security. CIS is an independent nonprofit that operated several services under federal support, including:
#1 Best Overall
- MS-ISAC: the Multi-State Information Sharing and Analysis Center for state, local, tribal, and territorial governments.
- EI-ISAC: the Election Infrastructure Information Sharing and Analysis Center for election officials and election-related organizations.
CISA described the decision as ending approximately $10 million per year in funding under its cooperative agreement with CIS. That figure is not a $10 million cut to CISA’s entire budget. It refers to annual funding associated with CIS-operated information-sharing activities.
The administration’s stated rationale was to eliminate duplication, reduce federal spending, and focus CISA on what it considered mission-critical functions. CISA’s financial-assistance information, reporting by the Associated Press, and The Record provide the principal public descriptions of the decision.
What MS-ISAC and EI-ISAC did
These programs were more than mailing lists. Their practical functions included:
- Cyber-threat intelligence, alerts, and warnings.
- Incident-response coordination.
- Vulnerability and threat monitoring.
- Technical guidance for organizations with limited security staff.
- Coordination among jurisdictions facing similar attacks.
- Election-specific threat sharing and assistance.
That shared layer mattered because a small city, county, school system, or election office may not have a security operations center, dedicated threat-intelligence analyst, or incident-response team. Reproducing every service independently can require personnel, monitoring tools, procedures, and trusted relationships—not merely a software purchase.
The MS-ISAC charter describes the organization’s role and membership framework. The loss of federal support did not mean that every CIS service disappeared, nor did it prove that elections became insecure. It did create concerns about affordability, coverage, and coordination, particularly for smaller jurisdictions.
How many CISA employees were affected?
The numbers vary because reports combine different categories of workers. They should not be treated as interchangeable:
| Category | What was reported | How to interpret it |
|---|---|---|
| CISA workforce baseline | Approximately 3,200–3,300 employees in early 2025 | Sources may count employees, funded positions, or other workforce categories differently. |
| Probationary employees | At least 130 terminations were reported in February 2025 | Some employment actions later became subject to reinstatement litigation or administrative changes. |
| Broader early losses | Estimates of approximately 300–400 workers | This is a reported estimate, not a definitive final CISA headcount. |
| Contract personnel | Outside contracts were canceled, including agreements connected to some cyber work | Contractors should not automatically be counted as federal employees. |
Dark Reading reported estimates of roughly 300–400 affected workers. A House hearing document separately discussed probationary employees, contractors, and related workforce actions. Later political statements described substantially larger losses, but those figures require careful attention to the measurement date and the definition of “workforce.”
What happened to CISA’s red teams?
Reports about CISA’s red teams illustrate why the staffing story needs precision. A contractor and outside reporting described the elimination of a red-team contract and said more than 100 people were affected. CISA responded that it had terminated contracts where it identified efficiencies or duplication and that its federal red teams continued their work.
The accurate formulation is that contract cancellations and reported reductions affected red-team work, while CISA disputed the claim that its federal red teams had been laid off or eliminated. The distinction is between federal employees, contractor employees, and continuation of a mission after a contract changes. CISA’s official statement should be read alongside the independent reporting.
What changed after federal funding ended?
CIS announced a fee-based MS-ISAC membership model in June 2025. CIS says DHS officially ended federal funding for MS-ISAC services for the state, local, tribal, and territorial community on September 29, 2025, with the paid model beginning October 1.
Organizations that did not join faced a phased loss of access. The transition therefore changed both the funding source and the practical question of who could participate. MS-ISAC continued operating, but it no longer operated under the same universal federal subsidy.
Recommended Free Tools
According to the CIS membership FAQ, some federally funded endpoint-detection-and-response access was scheduled to remain available through September 30, 2026 for eligible organizations that purchase MS-ISAC membership. Eligibility and current terms should be confirmed directly with CIS because service scope can change.
CIS has also described a phased transition and the financial pressure created by the loss of federal support. That does not make MS-ISAC an ordinary commercial cybersecurity vendor: it remains a nonprofit-operated membership community focused on public-sector coordination. But membership now carries a recurring cost that many organizations previously did not pay directly.
EI-ISAC and election security
EI-ISAC requires separate treatment from MS-ISAC. Reporting described the prior federal funding and support arrangement as defunded in 2025. Later congressional correspondence said Congress provided $39.6 million for election-security efforts and demanded that DHS explain whether and how programs would be restored before the 2026 midterm elections.
An appropriation or authorization does not automatically recreate the former staffing, contracts, service levels, or operating relationships. The defensible conclusion is that election-security funding and program continuity remained subjects of political and administrative uncertainty. It would be irresponsible to claim that the cuts caused a particular election incident without incident-specific evidence.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
The concerns raised by lawmakers and cybersecurity experts are more limited and concrete: less federal coordination, fewer shared resources, loss of institutional knowledge, and unequal access to assistance among election offices.
What is confirmed and what remains disputed?
| Status | Position |
|---|---|
| Confirmed or documented | CISA ended approximately $10 million in annual funding associated with its CIS cooperative agreement; federal MS-ISAC funding ended in September 2025; MS-ISAC moved to paid membership on October 1, 2025. |
| Reported but requiring qualification | Approximately 300–400 workers were affected in early 2025. The estimate may include different combinations of federal employees, contractors, and other personnel. |
| Disputed | The claim that CISA eliminated or laid off its entire federal red team. CISA said its federal red teams continued after contract changes. |
| Not established by funding alone | That later congressional election-security funding restored the former EI-ISAC operating model. |
| Still dependent on current terms | Which organizations retain access to particular MS-ISAC services, including EDR, and what replacement support is available in each state or territory. |
What affected organizations should do
1. Inventory what was actually being used
Document whether the organization relied on MS-ISAC or EI-ISAC for alerts, incident response, monitoring, EDR, threat intelligence, exercises, or peer coordination. “We had MS-ISAC” is not specific enough for continuity planning.
2. Confirm membership and offboarding status
Contact CIS to verify eligibility, current membership terms, EDR availability, transition dates, data retention, alert recipients, and incident contacts. Do not assume that an old CISA or CIS webpage means a formerly free service remains available.
3. Compare four replacement paths
| Option | Best fit | Main limitation |
|---|---|---|
| Paid MS-ISAC membership | Organizations that value public-sector intelligence, peer coordination, and continuity with existing services. | Recurring cost and possible differences from the former federally funded scope. |
| State or regional security operations center | Smaller jurisdictions able to join a statewide or shared-services model. | Availability and service coverage vary by geography. |
| Commercial MDR or MSSP | Organizations needing 24/7 monitoring, detection, and response. | May not reproduce cross-jurisdiction public-sector intelligence or election-sector coordination. |
| Internal capability | Large organizations with budget, staff, and control requirements. | Requires recruitment, tooling, threat intelligence, procedures, and round-the-clock coverage. |
A commercial MDR or MSSP can monitor an organization’s telemetry and provide a contractual response service. It is not automatically a substitute for MS-ISAC’s community intelligence. Likewise, an EDR license alone is not equivalent to human monitoring and incident response.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Check grants and procurement channels
Organizations should examine state contracts, cooperative purchasing arrangements, statewide SOC services, and applicable federal or state grant rules. A grant appropriation may support a cybersecurity purpose without paying for every vendor, membership, or operating model.
Best Value
4. Protect continuity during the transition
- Assign named owners for receiving and acting on alerts.
- Export or preserve historical telemetry and incident records where permitted.
- Confirm who can authorize emergency response.
- Test escalation contacts and after-hours procedures.
- Require an exit plan from any commercial provider.
- Ensure that security tooling is connected to a response process and not merely installed.
How the alternatives differ financially and operationally
Paid MS-ISAC membership preserves access to a specialized government-sector community but adds a recurring expense. CIS’s public FAQ describes transition offers for qualifying organizations, but current pricing should be obtained directly rather than inferred from older promotional terms.
CIS SecureSuite provides access to resources such as CIS Controls and CIS Benchmarks. SecureSuite may help an organization improve configuration and governance, but it is not the same as managed detection or incident response.
CIS Hardened Images provide standardized secure baselines for certain cloud and virtual-machine workloads. They can reduce configuration risk, but they do not replace real-time monitoring or public-sector threat sharing. Details are available from the CIS Hardened Images page.
Commercial MDR and MSSP services may provide 24/7 monitoring and response, but pricing depends on endpoint volume, telemetry, retention, response scope, contract terms, and procurement channel. Examples of providers to evaluate include Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne Singularity, Arctic Wolf MDR, and Sophos MDR. No universal current price should be assumed from product pages.
A practical buying checklist
Before committing money to a replacement, ask:
- How many endpoints, identities, cloud systems, and users require coverage?
- Does the organization already operate an EDR, SIEM, or SOC?
- Is 24/7 human response required, or only alerts?
- Is government-sector or election-sector intelligence essential?
- Can a state contract or regional SOC lower the cost?
- Are grant funds available for the specific service?
- How are evidence, logs, and incident records retained?
- What happens if the provider relationship ends?
The bottom line
CISA’s 2025 decision ended approximately $10 million in annual funding tied to CIS-operated ISAC activities, while separate workforce reductions and contract cancellations reduced or disrupted parts of the agency’s capacity. The employee totals remain difficult to state precisely because reports mix federal employees, contractors, probationary personnel, and later staffing actions.
The clearest operational change came when federal MS-ISAC funding ended and the service shifted to paid membership. MS-ISAC did not simply disappear, but smaller public-sector organizations now face a more difficult decision: pay to preserve some shared capability, rely on state or regional support, buy commercial monitoring and response, or build more capacity internally. Those choices are not interchangeable, and an election-security appropriation alone does not prove that the former federal operating model has returned.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
