Federal grants tagged to cybersecurity in Arkansas totaled $15 million in the past 90 days, up 851 percent from the same window a year ago. That number deserves immediate qualification, and also immediate attention.
The qualification: the largest piece of that figure, a $13.3 million HHS award to the Arkansas Department of Health, is primarily a health-data interoperability project. The SHARE health information exchange modernization grant names cybersecurity as a system component, not its core purpose. A separate $1.74 million HHS grant to the same department funds 988 behavioral health crisis-line capacity. Both match a cybersecurity keyword search; neither is a cybersecurity program. Strip them out and Arkansas's dedicated cyber portfolio looks different: $4.83 million from FEMA's State and Local Cybersecurity Grant Program (SLCGP) for FY2024, routed through the Arkansas Division of Emergency Management, plus a $5 million Department of Energy CESER grant to the University of Arkansas System for energy-cybersecurity research and workforce development.
The attention: even that narrower portfolio represents a genuine structural shift, because six months ago Arkansas had no institutional home to receive or deploy it.
Governor Sarah Huckabee Sanders signed Arkansas Act 489 on April 8, 2025, creating the state's first State Cybersecurity Office under a newly designated State Information Security Officer. Before that law, Arkansas was among the few states without a centralized cybersecurity authority, a gap that CISA and FEMA had flagged as a barrier to effective SLCGP sub-granting. The office is now tasked with directing cybersecurity functions across all state agencies, setting governance policy, and running a statewide incident response plan. It is also the entity positioned to pass SLCGP dollars down to county and municipal governments.
The timing matters because the federal money driving this moment is running out. Congress authorized $1 billion for SLCGP over four fiscal years under the Infrastructure Investment and Jobs Act; FY2025, which is now underway, is the final year of that authorization. The national pool has already contracted sharply: FEMA's FY2024 SLCGP allocation was $279.9 million nationally; the FY2025 allocation dropped to $91.7 million. Arkansas's FY2024 award of $4.83 million may represent the high-water mark for annual SLCGP flows to the state. Prior-year awards remain active through December 2028, but the pipeline filling them is narrowing.
The Arkansas Division of Emergency Management, acting as the state administrative agency under SLCGP rules, is already moving to push the money outward. Through a partnership with Mainstream Technologies, the state is offering free cybersecurity risk assessments to local governments as a first step toward sub-granting, an approach designed to build a demand-side picture of which jurisdictions need help most before dollars flow to them.
The DOE CESER grant runs a parallel track. The $5 million award to the University of Arkansas System, active through December 2026, funds research at the intersection of energy infrastructure and cyber risk alongside workforce pipelines into the field. It does not connect directly to the SLCGP local-government work, but it adds a research and talent dimension to what is otherwise an operational-security build. A separate $2 million NSF grant to Arkansas Tech University, starting this July, funds STEM scholarships that include a cybersecurity degree track, extending the workforce thread further.
The combined effect is that Arkansas, historically among the least-resourced Southern states for cybersecurity infrastructure, now has four distinct federal programs building toward the same gap in state capacity, even if none of them were designed in coordination with the others.
Among peer Southern states in the trailing 90-day window, Arkansas leads in cybersecurity-tagged federal grant dollars: $15 million versus Tennessee's $4.3 million, Louisiana's $3.9 million, and Oklahoma's $3.1 million. That ranking is significantly inflated by the HHS health-IT award. On dedicated cyber grants alone, the state's position is more modest. What distinguishes Arkansas from that peer group is less the dollar volume than the institutional change: creating a State Cybersecurity Office in April 2025 put Arkansas on the same structural footing as most other states for the first time, just as the federal program funding the transition enters its final year.
The next signal to watch is how the new State Cybersecurity Office allocates SLCGP sub-grants to local governments, a process that FEMA requires to begin in earnest now that the state has an administrative structure to manage it. Any delay in that sub-granting would leave prior-year SLCGP funds sitting idle while the program's remaining authorization expires. The FY2025 SLCGP award to Arkansas has not yet been announced; that figure, when it arrives, will show whether the contraction in the national pool hit the state proportionally or harder.
