Michigan Has $2.35 Million for Local Cybersecurity. Here’s the Fine Print

Michigan has $2,346,859 in federal fiscal-year 2025 funding for state and local cybersecurity. Eligible local and tribal governments can compete for projects ranging from multifactor authentication and backups to managed detection and protection for operational technology.

The number at the top of the announcement is real. So is the complication underneath it: this is not a $2.35 million shopping budget. It is a federal contribution to locally owned projects, each carrying a match, cash-flow requirements, procurement rules, implementation work, and costs that may continue after the grant ends.

That changes the useful question. It is not merely, “What can the grant buy?” It is, “What improvement can a local government afford to own after the grant has helped pay for it?”

The 40% match changes the size of the project

The federal FY 2025 notice requires a nonfederal contribution equal to at least 40% of the total cost of each ordinary project. The federal share is 60%.

For a project with a total cost of $100,000, the basic model is simple:

• Federal share: $60,000
• Nonfederal share: $40,000

That is different from receiving a $100,000 award and adding a 40% match. A project seeking $100,000 in federal money would have a total cost of about $166,667, with about $66,667 supplied from nonfederal sources.

The match is calculated project by project, not merely across Michigan’s whole award. Federal rules allow qualifying cash or documented in-kind contributions, but the source and treatment of a local match should be confirmed with the state before the project is sized. The same contribution cannot simply be counted twice or supplied from another federal award unless the law governing that other funding permits it.

The first hidden cost, then, appears before a product is selected: the municipality must identify real local value to put beside the federal share.

Reimbursement turns a grant into a cash-flow decision

Michigan describes this as a reimbursable pass-through program. A local government may have to pay an eligible bill, document it correctly, and wait for reimbursement under the grant agreement. It also needs the required state vendor registration to receive payment.

The timing boundary is explicit. Michigan says costs incurred before the State of Michigan subaward date are not eligible for reimbursement. An application is not an award, and an expected award is not permission to begin grant-funded work. Applicants should not enter grant-dependent contracts or obligations until awards are announced and the required agreement and documents have been received, signed, and returned.

That can make cash flow more consequential than the product list. A technically excellent project can still strain a local budget if finance has not planned for the match, the initial payment, the reimbursement interval, and any portion later ruled ineligible.

Procurement may decide what the grant can buy

A grant-funded purchase must follow the applicable federal procurement standards along with the local government’s documented procedures. Competition, conflicts of interest, procurement method, selection, price support, contract terms, and the history of the purchase all need a defensible record.

One rule deserves attention before a likely vendor helps write the application. A contractor that develops specifications, requirements, a statement of work, a project plan, a project budget, or parts of the grant application may have to be excluded from competing for the resulting work. FEMA treats that as an organizational conflict of interest. A properly procured combined design-and-execution engagement can be different, but that structure has to comply with the rules from the beginning.

This is not a ban on technical help. It is a reason to decide who may shape the requirement before a would-be bidder quietly becomes the author of the contest.

Procurement can therefore matter more than brand preference. The grant may make money available for a category of work while the procurement record determines which specific purchase remains eligible.

Four purchases, four continuing obligations

The approved categories are broad. The economics become clearer when four familiar examples are followed beyond the invoice.

Multifactor authentication and identity

Michigan allows authentication devices, MFA software, identity and access management systems, and related support. The purchase can strengthen access quickly. It also creates continuing work: enrollment, recovery, administrator protection, employee changes, lost devices, emergency access, licensing, and support. The control is not finished when the login prompt first appears.

Backup and recovery

Eligible backup projects can include software, cloud services, servers, storage, and services that support recovery. Buying capacity is the visible part. Retention decisions, monitoring, restore tests, protected administration, storage growth, and a person responsible for recovery are the system that makes the capacity useful. A backup that nobody can restore on the needed timetable is an archive of optimism.

Endpoint or managed detection

Michigan permits EDR, MDR, and XDR subscriptions selected through the entity’s procurement process, but subscriptions funded under this round cannot extend beyond November 2027. The date exposes the underlying economics. Detection products generate alerts; someone must review them, decide what matters, contain incidents, document action, and renew or replace the service when the funded term ends.

A temporary grant can create a permanent subscription.

Operational technology and water systems

Michigan also permits cybersecurity hardening for systems such as industrial controls, programmable controllers, operational technology, and related IT infrastructure. Here the continuing obligation may be larger than a license. Assessments can reveal aging equipment, unsupported software, remote-access dependencies, physical-access issues, segmentation needs, specialist labor, and recovery procedures tied to an essential public service.

The grant can help fund a defined improvement. It cannot become the system owner, train a future employee, carry a maintenance contract forever, or make an incident-response decision at 2 a.m.

The project lives in the gaps between invoices

Grant categories naturally make a project look like a collection of things that can be purchased. The lasting capability usually lives between those things.

An identity project may require directory cleanup before enrollment, decisions about which accounts receive stronger controls, a tested recovery path, and a process for people who join, leave, or change jobs. A backup project may require owners to agree on what must be recoverable, how quickly, and in what order. Detection may depend on an asset inventory, escalation authority, contact information, maintenance windows, and evidence that a suspicious device was actually isolated.

Those are not decorative project-management tasks. They determine whether the purchased control changes an operating outcome. They also do not all fit neatly on a product quote.

It helps to see four layers in the total project:

• The purchased layer includes eligible software, hardware, subscriptions, assessments, and contracted services.
• The implementation layer includes configuration, migration, testing, integration, documentation, and employee time needed to put the control into use.
• The operating layer includes monitoring, administration, response, recovery drills, support, renewals, and replacement.
• The evidence layer includes procurement records, invoices, match documentation, reports, approvals, test results, and the records needed to show what the project accomplished.

The grant agreement determines which costs are eligible, and the municipality remains responsible for the rest. A proposal can therefore be fully compliant on paper and still be underfunded as an operating system if it budgets for the purchased layer while assuming the other three will somehow appear.

Partial funding can change the system, not just the price

The Michigan application asks whether a project can proceed with partial funding. That question is more difficult than applying a percentage to every line.

Some projects shrink cleanly. A municipality might enroll fewer lower-risk users in a first phase while preserving strong controls for administrators and critical accounts. Other projects contain dependencies that cannot be divided without changing the result. Backup storage without a workable restoration path, detection licenses without response coverage, or an operational-technology assessment without a plan for the highest-priority findings may produce information but not the intended resilience.

A useful partial-funding plan identifies a smallest coherent capability: the reduced scope that can still be implemented, operated, tested, and sustained. It also names what will remain exposed or deferred. That is more honest than promising the original outcome with fewer of the components that made the outcome plausible.

This is another reason the apparent award amount can be misleading. The value of a project is not proportional to the percentage of its shopping list that gets funded. It depends on whether the funded pieces still form a working system.

Free scanning creates work

Successful subrecipients must participate in a limited set of free CISA services after award. Michigan identifies web-application scanning for publicly accessible applications and continuous vulnerability scanning of public, static IP addresses. The latter produces weekly reports and ad hoc alerts.

Free scanning is useful because it can reveal exposed services, known vulnerabilities, and weak configurations. It also illustrates the ownership problem neatly. A finding is not remediation. Someone must receive the report, identify the affected system, judge urgency, coordinate a change, verify the fix, document an exception when necessary, and keep watching the queue.

Funding can create work, not merely protection. An application that proposes better detection should name who owns the next action when detection succeeds.

The second-year invoice is part of the first-year project

Michigan asks applicants how a project will be sustained after grant funds are exhausted. That is not ceremonial grant language. It is where the project becomes an operating commitment.

For identity, the answer may involve annual licenses and account administration. For backup, it may involve storage, monitoring, and restore testing. For managed detection, it includes the renewal and the people who respond. For operational technology, it may include maintenance, specialist support, replacement planning, and exercises that involve both technology and public-service staff.

A credible project identifies the recurring annual cost, budget owner, renewal date, response duty, internal labor, data or configuration portability, contract exit terms, and the smaller fallback plan if the full service cannot continue. A modest project with a funded future may be more valuable than a larger project whose second year arrives as a surprise.

Before you apply

• Name the operational problem. Use an assessment, failed restore, audit finding, incident, unsupported system, exposed access path, or other evidence employees can already explain.
• Build the whole cost. Include the nonfederal share, reimbursement timing, implementation labor, procurement work, remediation, and recurring expense.
• Protect competition. Decide who may help write requirements before a likely bidder shapes the application.
• Name the owner. Identify who will administer the control, review alerts, approve changes, test recovery, and report results.
• Plan the renewal or exit. Know what happens when the funded term ends.
• Confirm the current rules. Applications are due at 11:59 p.m. on October 11, 2026, but applicants should use the current state guidance and grant agreement for final decisions.

A strong application is a financing plan and an operating plan

The technical narrative explains what will change. The budget reveals whether the organization understands what must happen around that change. Finance needs the cash-flow and match assumptions. Procurement needs a competition path that does not disqualify the intended work. Technology staff need a deployable scope. Department leaders need to know what interruption, training, or policy change the project will require. Whoever handles an alert or failed restore needs enough authority to act.

These responsibilities do not have to become a large bureaucracy. They do have to be visible. When they remain implicit, the grant can move a purchase forward while leaving every difficult decision for the first outage, alert, renewal, audit, or reimbursement question. When they are named early, the same funding can leave behind not only equipment or licenses but a repeatable way to operate them.

What the $2.35 million actually buys

The grant can buy a meaningful reduction in risk. It can help a local government install stronger authentication, build recoverable backups, add detection capacity, or harden systems behind water, facilities, and other public services.

What it cannot buy is ownership.

The municipality still owns the match, the cash flow, the procurement, the implementation, the findings, the response, the renewal, and the second-year invoice. Once those obligations are included, the best project is not necessarily the one that captures the most federal money. It is the one that leaves behind a capability the organization can continue to operate.

Official references

• Michigan FY 2025 SLCGP application guidance, issued August 24, 2026
• Michigan State and Local Cybersecurity Grant Program page
• FEMA FY 2025 State and Local Cybersecurity Grant Program notice
• FEMA procurement guidance