A township manager in Montgomery County opens the budget file and finds the same line every small office finds: nothing set aside for cybersecurity. No IT staff, no consultant on retainer, one person who happens to be good with computers. For years the answer was simple. Join the MS-ISAC, turn on the free monitoring, and lean on it. That answer changed in 2025.
If your township relied on free federal cybersecurity support, some of it is gone and some of it is still sitting there waiting for you to claim it. The office that sorts out which is which this month is in a much stronger position than the one that assumes the old setup still runs on its own.
What changed at MS-ISAC
The Multi-State Information Sharing and Analysis Center, run by the nonprofit Center for Internet Security, spent more than 20 years offering free membership to state and local governments. Federal funding through the Cybersecurity and Infrastructure Security Agency (CISA) paid for that. In 2025 that funding ended, and MS-ISAC moved to a paid membership model.
The practical effect for a township is direct. The free member services many offices signed up for years ago are no longer automatically free. Thousands of local governments across the country have already dropped off the rolls because the dues did not fit the budget.
Two things soften the blow, and both matter for a small Pennsylvania township:
First, MS-ISAC prices membership on an organization’s annual operating budget, and it added a hardship path. Governments with an annual operating budget under $25 million can qualify for free membership for their first year, with discounts, deferred billing, and financing offered beyond that. Nearly every township in Montgomery and Chester counties sits under that $25 million line, so the door is not closed. It just is not automatic anymore. Someone has to apply.
Second, CIS launched a free tier called MS-ISAC Connect that any organization can use regardless of whether it pays dues. It lets you connect with peers, attend events, and reach the threat data the center produces. It is not the full member service, but it is not nothing, and it costs zero.
What is still free and worth doing this month
The strongest move a part-time office can make is to claim the CISA services that never went behind a paywall. These are federal, they are built for local government, and they are still free.
Start with CISA Cyber Hygiene Services. This is automated vulnerability scanning of your internet-facing systems, the township website, the email server, anything with a public address. CISA scans continuously, sends a weekly report of what it finds, and fires off an alert when something urgent shows up. There is a web application scan for your public sites as well. Organizations that sign up typically cut their exposure by about 40% within the first year, with most of the improvement landing in the first 90 days.
Enrolling takes one email. Send a note to vulnerability@cisa.dhs.gov with the subject line “Requesting Cyber Hygiene Services.” Scanning usually begins within three business days, and the first report arrives within about two weeks. For an office with no security budget, that is the highest-value hour you will spend this quarter.
Next, look at your domain. If your township still runs its website and email on a .com, a .net, or a .org, you are paying for it and you are missing a free upgrade. A .gov domain is reserved for verified government bodies, and it is the clearest signal to a resident that an email or a website is really yours. CISA eliminated the registration fee in April 2021, so what used to cost $400 a year is now free for eligible governments, and townships qualify. Moving to .gov is a project, not a click, but it removes a whole category of impersonation risk, and the price is right.
Do not skip the moves that cost nothing but a little time. Turn on multi-factor authentication for township email, the accounting system, and any account that can move money or change payroll. Most attacks on small governments start with a stolen or guessed password, and a second login step stops the majority of them cold. Pair that with a short standing rule for staff: no wire changes, no vendor bank updates, and no gift-card requests act on an email alone, confirm by phone to a known number. That single habit blocks the business-email-compromise scam that has cost townships real money.
Round it out with the free training and reference material. CISA publishes the Known Exploited Vulnerabilities list and the StopRansomware guidance, and it staffs regional cybersecurity advisors who work with local governments at no charge. None of this requires a purchase order.
Where MS-ISAC and the paid options still fit
Free services cover the basics. They do not cover everything, and a township should be honest about the gap.
The paid MS-ISAC membership still brings the deeper member benefits: the security operations center, incident support, and the full threat feeds. If your township holds sensitive systems, runs its own network, or has been targeted before, the hardship-waiver first year is worth a serious look. Apply, use the free year, and decide with real experience whether the ongoing dues earn their place in next year’s budget.
On the insurance side, the PSATS Cyber Advantage program, run with the Gunn-Mowery agency, pairs prevention resources with cyber liability coverage built for townships. Free scanning tells you where you are exposed. Insurance decides who pays when an attack gets through anyway. The two are not substitutes. A township that has done the free hygiene work is also a better, cheaper risk to insure, so the order matters: shore up the basics first, then buy the coverage.
There is also grant money worth watching. Pennsylvania’s Department of Community and Economic Development has channeled federal State and Local Cybersecurity Grant Program dollars to municipalities, and PSATS posts the open windows and deadlines as they come. Grant timing shifts, so confirm the current round before you plan around it rather than trusting last year’s dates.
Where to go next
Three destinations cover most of what a township office needs:
- CISA Cyber Hygiene Services for the free vulnerability scanning: cisa.gov/cyber-hygiene-services. This is the first sign-up.
- The .gov domain program to check eligibility and start a move off .com or .org: get.gov.
- The PSATS Cyber Advantage for the insurance and prevention package that pairs with the free work: psats.org/psats-cyber-advantage.
For the broader set of tools MCATO keeps for township and borough officials, including the document library and the PSATS updates that track cyber grant deadlines, start at the MCATO Resources page.
Close
The free ride at MS-ISAC ended, but the free work did not. A township that sends one email to CISA this week, checks its domain, and files for the hardship year has spent nothing and closed most of the easy gaps an attacker looks for. The office that waits for the old system to protect it is protecting nothing.