The grant that pays for your cybersecurity

The most common objection we hear from a MUD board is not "we don't need this." It is "we can't afford this." That objection is usually wrong, and here is why.

What SLCGP is

The State and Local Cybersecurity Grant Program is federal money, administered through FEMA and CISA, that flows to Texas through the Office of the Governor. Local governments apply — and a municipal utility district is a local government. Texas has been allocated roughly $40 million across recent program years.

Money can be used for four kinds of work: governance and planning, assessment and evaluation, mitigation, and workforce development. A cybersecurity risk assessment of your SCADA system falls squarely inside the second category. Network segmentation and multi-factor authentication fall inside the third.

What your district actually pays

SLCGP requires a local match, generally 20–40% depending on the program year and the track. In practical terms: on a $40,000 assessment, your district's cash outlay is often under $10,000. Awards start at a $10,000 minimum with no stated cap.

The district applies. The federal government funds it. The district hires the vendor. We are never the grant applicant — you are.

There is a second, larger pool

The Drinking Water and Clean Water State Revolving Funds, administered in Texas by the Texas Water Development Board, are bigger than SLCGP — over $500 million and $460 million respectively in a recent state fiscal year. These are below-market loans, and for small or disadvantaged systems a portion of the principal can be forgiven, which makes them function like grants.

Cybersecurity is eligible. Better still, TWDB now awards priority points for having a cybersecurity assessment in hand — so an assessment does double duty: it tells you what's wrong, and it improves your ranking on the next infrastructure project you were going to apply for anyway.

Why timing is the real problem

A grant-funded project is not a fast process. From first conversation to a purchase order typically runs 9–15 months: six to nine months for the award decision, then another month or two for procurement.

Where things stand (November 2026): the most recent Texas SLCGP round closed on February 12, 2026, and the state has not yet posted the next one. TWDB's funding window is the next hard date. It opens in December and forms are due in early March. A finished cybersecurity assessment earns 2.50 priority points.

That means the work your district wants funded next year has to be scoped and registered this year. Districts that wait for the announcement have already missed it. Before you can apply you will also need a SAM.gov UEI number (7–10 business days), CISA Cyber Hygiene enrollment, and in most cases a board resolution committing the local match.

Where to start