Cyber Civil Defense Summit East: Key Learnings from New Jersey

On August 20th, UC Berkeley Center for Long-Term Cybersecurity (CLTC) and New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) convened over 100 representatives from state and local governments, nonprofits, and industry at Kean University in Union, New Jersey for Cyber Civil Defense Summit East. This one-day gathering — the second of three regional summits planned across the country in 2026 — focused on strengthening the cybersecurity of local governments and critical infrastructure through regional coordination.

The Summit brought together cybersecurity practitioners and leaders from 15 states and the District of Columbia, spanning the entire East Coast from Maine to Florida. It provided a rare opportunity for state and local government cybersecurity practitioners and leaders to share their expertise, build relationships, and coordinate future cross-state collaboration.

The regional Cyber Civil Defense Summits come at an important time, as states are shouldering increasing cybersecurity responsibilities in the face of reduced federal leadership and funding. Throughout the day’s events, attendees spoke candidly about the challenges they face, lessons learned, and the approaches they are taking to strengthen cyber resilience at the state, local, and community levels.

Key Challenges

The event underscored that many of the organizations responsible for cybersecurity in the Eastern U.S. are wrestling with some major shared challenges, as detailed below.

Key Challenge #1: The expiration of federal grant funding undermines state and local governments’ long-term cybersecurity capacity.

A pressing concern for attendees was the question of how state and local governments will contend with the potential loss of the State and Local Cybersecurity Grant Program (SLGCP), a federal grant program started in 2022 that provided $1 billion dollars over four years to help state, local, and tribal governments address cybersecurity threats. The program expired in September 2025 and has yet to be renewed by Congress, despite broad support for the program by state and local cybersecurity officials.

Local government cybersecurity leaders at the Summit expressed frustration with the unpredictability of federal and state grant funding, describing how the uncertainty has complicated their efforts to build up cybersecurity programs. Several speakers described spending years establishing programs, onboarding new platforms, and building internal understanding and leadership buy-in, only to face the prospect of having to backfill funding or scale back efforts when grants end. 

Attendees shared that they view grant programs like SLCGP as transformative for local governments, as they provide necessary resources to establish new capabilities, deploy new tech, and hire talent. However, state cybersecurity leaders stressed that short-term grants can create long-term challenges when there is no sustainable funding to maintain capabilities over time. Without predictable funding, state and local governments risk falling into a cycle of building, dismantling, and eventually rebuilding cybersecurity capacity.

Key Challenge #2: Local governments and critical infrastructure are going toe-to-toe with capable threat actors.

Local governments and critical infrastructure entities are increasingly defending against well-resourced nation-state actors and sophisticated commercial ransomware groups, often with limited cybersecurity resources.

At the Summit, representatives from state legislatures in Maine, Maryland, New Hampshire, and New Jersey shared examples of how small and under-resourced organizations in their communities are under attack from capable threat actors. They highlighted the impacts these attacks have on essential services.

• State-sponsored Iranian hackers have targeted dozens of municipal water systems across at least 12 different states. In one case, about 300,000 residents near Atlanta, Georgia were warned to boil their water to ensure it was safe to drink.
  
• Sophisticated commercial ransomware gangs extorted and disrupted K-12 school districts in Maryland, leading to closures affecting tens of thousands of students.
  
• Cyberattacks on hospital systems in Maine and New Hampshire disrupted patient care, as downed phone and internet service limited patients’ access to medications and prescriptions, delayed cancer treatments, and shut down fetal monitoring systems and CT scanners. 

State cybersecurity leaders emphasized that adversaries do not discriminate based on the size or importance of their targets. Instead, they often seek out the most accessible or vulnerable entry points. Often, the “lowest-hanging fruit,” or the weakest links, are small, local community organizations like municipal and county governments, K-12 schools, and water systems, which tend to have limited cybersecurity staff, funding, and technical capacity.

The leaders described how this “target-rich, cyber-poor” dynamic creates challenges for states pursuing whole-of-state cybersecurity strategies. A state’s cybersecurity posture is only as strong as its weakest link, and many community organizations are attached to state networks. Strengthening statewide cybersecurity therefore requires states to understand where local vulnerabilities exist, and to provide support to jurisdictions and critical infrastructure entities with the fewest resources, which requires a great deal of coordination and trust.

Key Challenge #3: State agencies struggle to engage local entities in shared cyber efforts, in part due to managed service providers (MSPs) and other intermediaries. 

Local governments and critical infrastructure operators are essential partners in advancing states’ whole-of-state cybersecurity goals. However, states often lack the authority to require local governments to adopt state cybersecurity guidance or use state-provided cybersecurity services and resources. As a result, state IT and cybersecurity agencies must rely on outreach and relationship-building to influence or encourage local governments to participate.

At the Summit, state officials described persistent challenges in reaching small municipalities and critical infrastructure entities. Many smaller organizations lack cybersecurity awareness and dedicated cybersecurity staff, often relying instead on managed service providers (MSPs) to make cybersecurity decisions on their behalf.

Speakers noted how MSPs can sometimes be blockers to state-local collaboration because they influence or control decisions on behalf of their clients. MSPs may even discourage clients from using shared services provided by the state. Some MSPs view state involvement as a threat to their business and are reluctant to engage with state government. One speaker noted that the most common reason local officials in her state decline state cybersecurity resources is because their MSP advises them to do so.

Emerging Solutions

In addition to sharing challenges they face, attendees at the CCDS East Summit explored a variety of solutions to help improve local and state cybersecurity.

Solution #1: State and local governments should plan for grant funding cliffs and establish sustainable grant programs.

Speakers at the Summit shared varying strategies that local governments have used to manage budgetary uncertainty around cybersecurity investments. For example, some jurisdictions have chosen to maintain backfill funding in their annual budgets by setting aside multi-year matching reserves for all SLCGP funds received. This practice helps ensure program continuity for several additional years once federal funding ends. Others have chosen not to apply for SLCGP grant funding altogether because of concerns about their organizations’ ability to sustain the associated costs once the grant period ends. 

Rob Beach, Information Technology Director for the City of Palm Bay, Florida, shared an interesting model that may offer a potential path toward more sustainable state cybersecurity funding. In 2023, Florida was one of two states that declined to apply for SLCGP funding, as state leaders instead established their own grant program to help local governments improve their cybersecurity capabilities. The Florida Local Government State Grant Program (FLGSGP) initially provided $30 million in funding, although that amount has been reduced in subsequent years. In response, the Florida Local Government Information Systems Association (FLCGISA) — a technology organization for local governments supported by the Florida League of Cities — worked with a lobbying firm to engage state lawmakers and advocate for making the FLGSGP a permanent, consistent funding source. In 2025, FLCGISA partnered with a lawmaker to successfully advance House Bill 1085, which enshrined the program in state law and created a more predictable source for annual funding.

Solution #2: States should engage with trusted intermediaries like MSPs to advance whole-of-state cybersecurity. 

Managed service providers can have significant influence over small local governments and critical infrastructure entity clients, as these organizations often rely on MSPs to manage their IT and cybersecurity risks. Because MSPs have such sway, states should leverage these relationships to expand awareness and adoption of state-provided cybersecurity services.

At CCDS East, Meghan Cook, Chief Cyber Officer of New York State, highlighted how New York has successfully utilized this strategy. The state’s Division of Homeland Security & Emergency Services Incident Response launched an initiative to formally engage MSPs serving local governments to clarify available state services, address confusion about how these services work, and explain how they can complement rather than replace MSPs’ offerings. For example, the agency arranged meet-and-greets with MSPs and developed lasting relationships, eventually leveraging MSPs to influence local governments and increase uptake of state cybersecurity services.

Solution #3: Local governments should strengthen peer networks of cyber civil defenders.

At the event, local government cybersecurity personnel repeatedly identified peer networks as one of the most valuable assets in their work. These networks take many forms, ranging from informal email chains and mailing lists among local IT directors to formal quarterly meetings and membership in local government information services associations.

Speakers described these peer networks as trusted spaces where practitioners can share information about emerging threats in their communities, exchange stories and lessons learned, and compare strategies among peers who often face similar challenges with limited resources. They also provide an important source of real-time support, as cyber practitioners turn to their peers for advice on cybersecurity products, “gut checks” on unusual or suspicious signals, and hands-on incident response assistance during ransomware events. These peer communities help break down information silos and promote camaraderie, trust, and a culture of mutual aid among local governments.

Solution #4: Utilize cyber volunteers and students to provide assistance.

Cyber volunteering programs emerged as one of the most promising models for supporting organizations below the “cyber poverty line,” including under-resourced local governments, K-12 schools, and water systems. Cyber volunteers can help fill capacity and resource gaps by providing no-cost services such as cybersecurity risk assessments, consulting, training and exercises, and incident response.

These programs are gaining momentum across Eastern states, with states and universities experimenting with a variety of approaches, including university-based cyber clinics, state cyber corps programs, and regional security operations centers (RSOCs). Panelists at the Summit highlighted efforts such as the Maryland Defense Force 256th Cyber Defense Unit (a state cyber corps program), the Rochester Institute of Technology’s cybersecurity clinic, the Virginia Cyber Navigators internship program, and Protect.ngo’s Builders program.

Cyber volunteering programs can also serve as pipelines for workforce development. Escalating experience requirements for “entry-level” cybersecurity positions are making it increasingly difficult for recent graduates to break into the cybersecurity industry. Cyber volunteering opportunities create opportunities for students, early- to mid-career professionals, and career changers to acquire hands-on work experience in key skills such as conducting threat assessments, responding to cyber incidents, and briefing clients on cybersecurity threats. Such programs may also provide state and federal government agencies with a pipeline for recruiting individuals into public-sector cybersecurity careers.

Looking Ahead

At a time when states are being asked to contribute and lead more than ever on cyber defense, Cyber Civil Defense Summit East emphasized that states are more resilient when they work together. The challenge of protecting the infrastructure that underpins our local communities from cyberattacks is uniquely complex and wide-reaching. Strong bonds between states, local governments, tribal nations, nonprofits, schools, industry, and academia will be essential to defending community infrastructure in the years ahead.

We are hopeful that the conversations begun in New Jersey will continue as the Cyber Civil Defense Summit heads to its last 2026 stop: Baton Rouge, Louisiana, for Cyber Civil Defense Summit Central.