South Carolina's local governments issued roughly 13 unique cybersecurity procurement notices in October and November 2026, more than four times the historical monthly baseline of one to three, with SLED's federally funded sub-grant pipeline as the primary engine. Then, on October 20, the City of Columbia discovered it had been hit by ransomware, and what was already the busiest cybersecurity procurement stretch in the state's recent history became something harder to ignore.
The two forces are related but distinct, and understanding both matters for anyone watching what comes next.
The first force is structural. SLED holds two active federal grants from CISA's State and Local Cybersecurity Grant Program totaling $7.3 million, a $5.5 million award from December 2024 running through 2028 and a $1.8 million award from September 2025 running through 2029. SLED is South Carolina's designated State Administrative Agency for the program, meaning every SLCGP dollar in the state flows through a single law enforcement agency before reaching a city hall or school district. That centralization compresses disbursement into visible, concentrated bursts. When SLED's FY2024 sub-grant application window opened March 20 and closed May 15 of this year, the approvals that followed released years of accumulated federal money into local procurement pipelines all at once. As NationGraph reported this summer, deduplicated cybersecurity RFPs in the state jumped from one to three per month historically to three to four per month starting in June. The October-November window is an extension of that same wave, now with new urgency layered on top.
Source: NationGraph.
South Carolina's 2026 Cybersecurity Plan, administered through SLED's SC Critical Infrastructure Cybersecurity program under Director and CIO Ryan Truskey, requires that at least 80 percent of SLCGP funds reach local governments, with 25 percent of that reserved for rural jurisdictions. That mandate explains why the procurement notices in this window span such a wide range of entities: Sumter School District seeking firewall and email security, Orangeburg County School District issuing a broad cybersecurity solution RFP, the small municipality of Reidville contracting for managed IT and cyber services, and Jasper County, one of the state's more rural jurisdictions, advertising 24/7 cybersecurity monitoring. These are not rich agencies buying premium tools. They are small governments spending grant dollars on baseline protections they could not previously afford.
The second force is the October attack on Columbia. According to reporting from WACH, cited by Shattered.io, SLED is leading the investigation with cybersecurity specialists assisting, and city services were affected. The timing is painfully ironic: SLED spent the first half of 2026 urging local governments to apply for sub-grants and buy protection, hired a Threat Intel Lead in May and a Cyber Coordinator in April, and broke ground on a 9,100-square-foot cyber remodel at its own headquarters. Then the state capital, which runs its own IT infrastructure independent of the SLCGP pipeline, became the year's most prominent cautionary tale.
For local governments still on the fence about applying for sub-grants or executing their approved procurements, Columbia is now the argument SLED doesn't have to make itself.
Running parallel to the SLCGP wave but funded differently is a compliance-driven procurement layer tied to NIST CSF 2.0 and CMMC requirements. Greenville-Spartanburg Airport issued an RFP for NIST CSF 2.0 maturity advancement, and the University of South Carolina sought CMMC Level 2 readiness certification earlier this year. Those procurements are almost certainly drawing on institutional or defense-contract budgets, not SLCGP grants. South Carolina's large defense footprint, anchored by Fort Jackson, Shaw Air Force Base, and Joint Base Charleston, is generating its own cybersecurity procurement pressure as contractors scramble to meet federal certification timelines. The two waves are happening simultaneously, but they are not the same program spending the same money toward the same ends.
Beyond procurement, the state is building the physical and human infrastructure to sustain this effort. Greenville Technical College is constructing a 90,000-square-foot Center for Cybersecurity and AI with a dedicated Security Operations Center on its Barton Campus. SLED is expanding its own cyber unit. The workforce pipeline and the enforcement capacity are being built at the same time the grant dollars are flowing.
What to watch now: SLED's investigation of the Columbia attack will eventually produce a public accounting of how the breach occurred and whether any SLCGP-eligible controls were absent. That report, whenever it arrives, will shape the next sub-grant application window and may push the state to revisit which entity types are eligible for direct SLED assistance. Local governments that have approved sub-grants but have not yet issued RFPs are also worth tracking. The grant money runs through 2028 and 2029, but political urgency has a shorter half-life, and Columbia's misfortune is currently doing the work of a thousand awareness campaigns.
