South Dakota Searchlight reported on August 23, 2026 that state-backed cybersecurity funding for local governments is scheduled to run out in 2028, even as counties, cities, utilities, and other public organizations continue dealing with cyberattacks and fraud attempts.
The details are specific to South Dakota, but the management problem is familiar well beyond one state. A security program can begin with grant money, emergency funding, a one-time vendor project, or a board-approved push after an incident. That first push matters. The harder question is what happens when the initial funding, contract, or executive attention expires.
The Budget Ends Before the Risk Does
Small organizations often buy cybersecurity in bursts. They approve a tool, complete an assessment, migrate email, add multifactor authentication, or bring in a consultant after a close call. Those moves can reduce risk, but they do not create durable protection unless someone owns the recurring work.
The South Dakota reporting describes local governments facing pressure from payment disruption, email compromise, attempted access to infrastructure systems, and long-running breach reports. Those are not problems that disappear after a project closes. They require operating habits: patching, endpoint monitoring, backup testing, access review, vendor oversight, employee training, incident response, and payment verification.
For a New Jersey business, school, nonprofit, healthcare practice, or municipal office, the lesson is not to copy another state's program. The lesson is to look at your own cybersecurity budget and ask whether it is built like a temporary campaign or a continuing responsibility.
The Owner Decision Is Funding Continuity
The practical decision is simple to state and easy to postpone: who pays for cybersecurity after the initial project ends?
If the answer is unclear, the organization may have a funding gap hiding inside an otherwise reasonable security plan. That gap can show up as expired endpoint licenses, stale backup testing, no one reviewing alerts, aging firewall rules, unsupported systems, or incident-response contacts that were never updated after staff or vendors changed.
This is especially important for organizations that rely on outside IT providers. A vendor may complete the project that was ordered, but the owner still needs to understand what is recurring, what is optional, what is monitored, and what will quietly lapse without a renewal or service agreement.
Questions to Ask Your IT Provider
- What security work is recurring? Separate one-time setup from monitoring, maintenance, reporting, and response.
- Which controls expire or renew? Review endpoint protection, backup services, email security, domain protection, firewall licensing, and identity tools.
- Who reviews alerts? Confirm whether alerts are actively investigated or simply generated by a tool.
- How often are backups tested? A paid backup service is not the same as proven recovery.
- What payment controls exist? Require out-of-band verification for vendor bank changes, urgent transfers, and unusual payment requests.
- What happens when funding changes? Ask for a reduced-scope plan before a budget cut turns into silent exposure.
A Better Way to Treat Cybersecurity Projects
Every cybersecurity project should end with an ownership handoff. That handoff should list the controls that were added, the people responsible for them, renewal dates, monthly or quarterly tasks, escalation contacts, and the minimum budget needed to keep the program alive.
Leaders do not need to become technical experts to manage this well. They need a plain-language inventory of what protects the organization, what it costs to keep those protections running, and what risk returns if the funding stops.
The calendar is the quiet part of cybersecurity. Put renewals, backup tests, tabletop exercises, access reviews, and vendor check-ins on it before the next funding deadline arrives. Attackers do not care whether the grant ended, the project closed, or the budget meeting moved to next quarter.
Sources and further reading
