Guaranteeing Universal Access to Cybersecurity Act
- Sponsor
- Sen. Warner, Mark R. [D-VA]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Jun 8, 2026
Bottom line
This bill aims to enhance the cybersecurity posture of state and local governments and critical infrastructure operators by ensuring universal, no-cost access to essential cyber threat intelligence and services through the MS-ISAC, reversing a prior shift to a fee-based model.
What it actually does
This bill amends the Homeland Security Act of 2002 to mandate a cooperative agreement between the Director of the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). The agreement requires MS-ISAC to provide no-cost cybersecurity services, threat intelligence, and technical assistance to all State, Local, Tribal, and Territorial (SLTT) entities that apply. It also mandates CISA and MS-ISAC to develop a plan for targeted outreach to re-enroll former members and engage new, under-resourced SLTT entities, appropriating $50 million annually for these purposes.
Proponents argue
Supporters argue that robust cybersecurity for SLTT entities is a national security imperative, as these entities are frequent targets of cyberattacks and often lack the resources to defend themselves. Restoring no-cost access to MS-ISAC services would close critical security gaps, protect essential public services, and strengthen the overall national cyber defense ecosystem by fostering better information sharing and capacity building.
Opponents contend
Potential opponents might argue about the cost of the appropriation, suggesting that $50 million annually could be allocated more efficiently or that SLTT entities should bear more responsibility for their own cybersecurity funding. Some might also raise concerns about the scope of federal involvement in state and local cybersecurity or the potential for dependency on federal funding.
The bill is concise and directly addresses its purpose, making it accessible for a quick read and evaluation.
Section 2, amending 6 U.S.C. 659 by adding subsection (t)(1)(A)
Mandated Federal Support for MS-ISAC
This provision requires the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to enter into a cooperative agreement with the operator of the Multi-State Information Sharing and Analysis Center (MS-ISAC). This agreement is designed to provide federal financial support for MS-ISAC's cybersecurity services, cyber threat intelligence collection and dissemination, and technical assistance specifically for State, Local, Tribal, and Territorial (SLTT) entities.
Supporters argue
Supporters argue this provision is crucial for stabilizing MS-ISAC's funding, ensuring its continued ability to provide vital cybersecurity services to SLTT entities, which often lack dedicated resources to defend against sophisticated cyber threats.
Critics contend
No specific opposition is typically raised against the concept of federal support for MS-ISAC, though general concerns about federal spending or the specific amount could be raised by fiscal conservatives.
Tradeoffs
This provision balances the need for federal support to enhance national cybersecurity resilience with potential concerns about the extent of federal involvement in state and local affairs and the allocation of federal resources.
Section 2, amending 6 U.S.C. 659 by adding subsection (t)(1)(B)
No-Cost Services and Targeted Outreach Mandates
This section outlines specific requirements for the MS-ISAC operator under the cooperative agreement. It mandates that MS-ISAC provide no-cost membership and access to core cybersecurity services, including cyber threat intelligence products, real-time indicator feeds, and incident response support, to all applying SLTT entities. It also requires MS-ISAC to prioritize outreach to and enrollment of SLTT entities lacking dedicated cybersecurity staff, operating on limited budgets, or identified as 'covered entities' under existing law.
Section 2, amending 6 U.S.C. 659 by adding subsection (t)(2)
Strategic Outreach and Capacity Building Plan
This provision requires CISA, in coordination with MS-ISAC, to develop and implement a comprehensive plan within 60 days of the bill's enactment. The plan must identify and conduct targeted outreach to re-enroll former fee-based members, retain current fee-based members, and enroll new SLTT entities and critical infrastructure owners/operators facing high cyber risk due to limited resources. It also mandates providing technical assistance and cybersecurity capacity-building support to these identified entities.
Section 2, amending 6 U.S.C. 659 by adding subsection (t)(3)
Annual Appropriations for MS-ISAC Support
This provision directly appropriates $50,000,000 for fiscal year 2027 and each fiscal year thereafter, to carry out the subsection related to the Multi-State Information Sharing and Analysis Center. These funds are designated to remain available until expended, providing consistent and long-term financial support for the federal cooperative agreement with MS-ISAC and its mandated services.
This provision mandates that the Multi-State Information Sharing and Analysis Center (MS-ISAC) prioritize outreach to and enrollment of State, Local, Tribal, and Territorial (SLTT) entities that have been identified as 'covered entities' as defined in section 2240 of the Homeland Security Act of 2002 (6 U.S.C. 681).
Section 2, amending 6 U.S.C. 659 by adding subsection (t)(1)(B)(ii)(III)
Why it matters:This is standard legislative practice to avoid redundancy and maintain consistency with existing statutory definitions across federal law. It is not intended to be evasive.
Case for: Proponents would argue that referencing existing definitions ensures consistency in federal cybersecurity policy and targets resources efficiently to entities already identified as critical or vulnerable under other established frameworks.
Case against: No specific case against this legislative drafting technique, though some might argue that requiring external lookup makes the bill less immediately comprehensible to a general audience without legal research tools.
Estimated impact: Ensures that a specific, pre-defined category of critical entities receives prioritized cybersecurity support from MS-ISAC, thereby focusing resources on those deemed most essential or at-risk by prior legislation.