Cybersecurity Grants 2026: Who Pays to Protect Nonprofits

Cybersecurity funding source review, Grantsights, November 6, 2026: Grantsights checked CISA's Cyber Hygiene services page (opens in a new tab), its no-cost services and tools list (opens in a new tab), its cyber guidance for small businesses (opens in a new tab), the program law at 6 U.S.C. 665g (opens in a new tab), FEMA's State and Local Cybersecurity Grant Program page (opens in a new tab) and FEMA's Nonprofit Security Grant Program page (opens in a new tab) against the 103 foundation grants. Where official sources stop: none of them says which local funder will pay for your multi-factor rollout, what a fair monthly price for managed security is in your region, or how to word the ask. For those, you need local quotes and a close read of each funder's earlier grants.

How Cybersecurity Grants Actually Work in 2026

Just 25 grants in the November 5, 2026 pull paid, in writing, for an organization to secure its own systems. That's a tiny share of what private foundations report each year, and it reflects how security work really gets funded: it rides inside a technology grant, a capacity grant or plain operating money, and the filing rarely says "cyber." Public money exists, but nearly all of it flows to governments, not to nonprofits.

Grantsights' view: stop hunting for a nonprofit "cybersecurity grant program," because there isn't a standing one. The realistic path is a security line inside a request to a funder that already backs your mission, plus the free help described below. The nonprofit technology guide covers computers, databases and IT in general. This page covers only the security piece.

Who Pays for a Nonprofit's Own Cybersecurity: What 990-PF Filings Show

The 25 own-security grants added up to $1,306,408 from 14 foundations, with a median of $4,000, according to the Grantsights pull of November 5, 2026. Every gift traces to a private foundation's annual return, which the IRS describes on its Form 990-PF page (opens in a new tab) as the form for reporting charitable distributions and activities alongside tax on investment income.

Two gifts distort the picture. According to the same November 5, 2026 pull, the Ahmanson and Champlin grants come to $946,660, or 72% of the own-security total, and both went to large institutions: a major orchestra and a statewide library consortium. 13 of the 25 grants were $4,000 or less. So a food pantry or a small arts group asking for its first security grant should think in thousands, not hundreds of thousands.

The grants were spread thin, too. 13 states had at least 1 own-security grant. Minnesota led with 9, all small gifts from one family foundation, and Texas had 4, three of them from one assessment round. No other state had more than 2. That's a small sample, and it says more about which funders write "cybersecurity" in a purpose line than about where the need is.

6 Kinds of Cybersecurity Work Foundations Paid For

Grantsights checked each of these 6 patterns against the recipient's work and the filed purpose. All the grants named come from the November 5, 2026 pull.

1. Security folded into a bigger technology upgrade. The Champlin Foundation's $386,660 to Ocean State Libraries in Rhode Island in 2024 paired cybersecurity upgrades with Wi-Fi and new screens. The Moody Foundation's $50,000 to the Alcohol Drug Abuse Women's Center in Texas in 2024 listed cybersecurity next to finance systems and building repairs. This is the most common shape, and it's the easiest one to copy.
2. A challenge grant. One organization in Connecticut, Waveny LifeCare Network, received $100,000 from the Jeniam Foundation in 2024 as a cybersecurity challenge grant. A challenge structure asks you to raise matching money, which suits a senior care group with a donor base.
3. An assessment round open to local nonprofits. The Abell-Hanger Foundation ran what its filings call a "physical and cyber security assessment grant opportunity" for Midland, Texas groups in 2024. For example, Midland Children's Rehabilitation Center and Bynum School each received $4,000, and Springboard Center received $2,000 for a cyber security assessment.
4. Many small gifts at once. The Patrick and Aimee Butler Family Foundation gave $500 for "cybersecurity efforts" to 9 Minnesota nonprofits in 2023, among them COMPAS, the Minnesota Center for Book Arts and the Schubert Club. The same funder gave Tech Impact $15,500 that year for nonprofit cybersecurity training.
5. Staff training and an outside consultant. The Cricket Island Foundation gave $5,000 in 2023, paid through the Public Health Institute of Chicago for an Illinois project, to hire an IT security consultant. The Keith Campbell Foundation gave the Conservation Foundation of Lancaster County $1,200 in 2023 for staff cybersecurity training, and the Burgum Foundation gave Harvey Public Schools in North Dakota $6,500 in 2024 for the same purpose.
6. A threat assessment for a group that's a target. Democracy Fund gave American Oversight $17,000 in 2024 for a cybersecurity threat assessment. Watchdog, advocacy and legal groups that handle sensitive records can make this case plainly.

Each of these purposes names what's being protected or who's doing the work. That habit makes the request legible to a funder who isn't technical.

Free and Low-Cost Security Help That Foundations Fund

11 grants worth $2,022,964, from 7 foundations, went to groups that give nonprofits free or discounted security help, according to the November 5, 2026 pull. For a small group, that help can beat cash, since the expertise comes with it.

• Gula Tech Foundation gave Cyber Ready Clinic in Maryland $1,000,000 in 2024 to bring cyber readiness to organizations with limited resources.
• The Bernard and Anne Spitzer Charitable Trust gave NGO-ISAC in Virginia $300,000 in 2024 for cyber security resilience among democracy nonprofits.
• Good Ventures Foundation filed $206,464 to Wavefront Security, a California LLC, in 2024 for subsidized cybersecurity services.
• The Ford Foundation gave The Engine Room $180,000 in 2024 to rehome a cybersecurity assessment tool, and gave Players Philanthropy Fund $100,000 in 2024 for Trestle's no-cost or low-cost cybersecurity services to grassroots nonprofits.
• The William & Flora Hewlett Foundation gave the Nonprofit Technology Enterprise Network (NTEN) $100,000 in 2024 to build a cybersecurity resource hub for nonprofits.
• The Grace & Franklin Bernsen Foundation gave 501 Technical in Oklahoma $15,000 a year in 2022, 2023 and 2024 for its cybersecurity program.

Grantsights didn't check what each of these groups offers today, so ask before you build a plan around one. The honest friction: free help usually covers an assessment and advice, not the licenses, hardware or staff time to act on it. Expect to fund the fixes yourself or through a follow-up grant.

Federal and Public Cybersecurity Programs: Status as of November 6, 2026

According to the Cyber Hygiene program, as CISA describes it on its service page (opens in a new tab), organizations that enroll typically cut their risk and exposure by 40% within the first 12 months. The service scans internet-facing systems and public web applications, with weekly vulnerability reports and monthly web application reports, and it's available at no cost. The page lists who can receive it: federal, state, local, tribal and territorial governments, plus public and private sector critical infrastructure organizations. It says services usually begin within 3 business days of sign-up. CISA's no-cost services and tools list (opens in a new tab) adds free tools from outside providers, filtered by readiness level, and suggests starting with your regional cybersecurity advisor, Cyber Hygiene enrollment and a Cybersecurity Performance Goals assessment.

The State and Local Cybersecurity Grant Program (SLCGP) is the big federal program, and it isn't open to nonprofits. The FY2025 notice on Grants.gov (opens in a new tab) named the governor-designated State Administrative Agency was the only eligible applicant, $91,750,000 was available, and the notice said FY 2025 was the final year of funding. The law itself, 6 U.S.C. 665g (opens in a new tab), requires a state to pass at least 80% of its grant to local governments, with at least 25% reaching rural areas, and the Code text authorizes money only through fiscal year 2025, with the section terminating September 30, 2025. According to FEMA, whose program page (opens in a new tab) was last updated July 30, 2026, the latest round is FY2025, and no FY2026 notice is posted. As of November 6, 2026, Grantsights found no official page announcing FY2026 money or a new authorization, so a town should ask its state's cybersecurity planning committee what's left of earlier awards.

Tribes have a parallel program. FEMA's Tribal Cybersecurity Grant Program page (opens in a new tab) lists $12.16 million for FY 2025, released August 1, 2025, for federally recognized tribal governments, and shows nothing for FY 2026 as of November 6, 2026. The tribal grants guide covers other programs open to tribes.

Schools and libraries had an FCC pilot, but it's closed to newcomers. According to the USAC Cybersecurity Pilot Program page (opens in a new tab), last updated October 2026, the three-year pilot provides up to $200 million to selected schools and libraries, the FCC announced participants on January 16, 2025, and the funding request window ran March 18 to September 15, 2025. Participants file annual reports starting in February 2027. Schools outside the pilot should read grants for school technology, and libraries can compare funders in grants for libraries.

The Nonprofit Security Grant Program (NSGP) is mainly a physical security program. FEMA's FY2026 notice on Grants.gov (opens in a new tab) totaled $300,000,000 and describes improving "physical/cybersecurity and facility/target hardening" for nonprofits at risk of a terrorist or other extremist attack. Its equipment list includes firewalls, anti-virus and malware software, intrusion detection, encryption and remote authentication systems. Eligible groups are 501(c)(3) organizations applying through their state, at up to $200,000 per site. Applications were due July 24, 2026, and FEMA's NSGP page (opens in a new tab) says awards were announced September 28, 2026. The NSGP guide explains how threat-based applications work.

What CISA and FEMA Don't Tell You About Paying for Cybersecurity

The official pages leave 5 gaps that matter when you're the one writing the budget.

1. A free scan finds problems; it doesn't pay to fix them. Cyber Hygiene reports list exposed systems and known flaws. Turn that report into your grant request: a funder can see a dated list of risks and a plan to close them.
2. "Critical infrastructure" isn't defined for your group. The Cyber Hygiene page doesn't say whether a small human services agency or arts group counts. Email CISA and ask before assuming you're out, and ask your local government whether it already enrolls partners.
3. State program money stops at local government. The 80% pass-through in 6 U.S.C. 665g goes to local governments, not nonprofits. A county IT office may share training or tools with nonprofit partners, but that's a favor, not an entitlement.
4. The match grew every year. The same law capped the federal share of a state's grant at 90% for FY2022, then 80%, 70% and 60% for FY2025. Towns that received earlier subawards often underestimate the local share they'll owe when federal money shrinks.
5. NSGP's cyber line is a red flag for ordinary IT asks. A food bank that wants backups and better passwords isn't the target. A house of worship with documented threats can include network protections, and church security grants covers that route.

Grantsights' honest take: the federal programs help governments far more than nonprofits. A nonprofit's realistic sources are its existing funders, free help and its own budget.

What Small-Organization Cybersecurity Costs and Which Parts Funders Pay For

According to the CISA small business guide, Cyber Guidance for Small Businesses (opens in a new tab), the most important step an organization can take is making sure all staff use multi-factor authentication (MFA) to sign in to important systems, especially email. The same page tells IT staff to patch, perform and test backups, remove administrator rights from user laptops and turn on disk encryption, and it asks leaders to approve a written incident response plan and run quarterly tabletop exercises. NIST's Small Business Cybersecurity Corner (opens in a new tab) has plain guides on ransomware, phishing, MFA and responding to an incident.

This table is illustrative, not data. Prices depend on your size, staff count and region, so collect at least 2 written quotes.

If you carry cyber insurance or plan to buy it, read the application questions closely. Insurers often ask about multi-factor sign-in, backups and training, and the answers you can't give yet are a ready-made list of grant-fundable fixes.

Why the Human Services List for Cybersecurity Grants

The 25 own-security recipients spanned arts, health, youth, conservation, education and advocacy, so no single cause owns this need. Grantsights points cybersecurity seekers to the human services list because those recipients reach across causes and because it's the list Grantsights offers for nonprofit technology as well. The free preview on the Grantsights human services funder list shows human services funders in your state broadly, not funders picked for cybersecurity.

Each row counts all human services giving in that state, from Grantsights analysis of 990-PF filings pulled October 29, 2026, so none of it is limited to security. The statewide medians, $5,000 to $7,325, sit close to the $4,000 median own-security grant, which is a fair sign of what a first ask should look like. A school or an arts group should use its own cause's list, since its security money will come from education or arts funders. For human services groups, the human services funder list covers every state, and you can get a refund within 30 days if it isn't a fit.

How to Write a Cybersecurity Grant Request a Funder Understands

22 of the 25 own-security purposes were 10 words or fewer, but the requests behind them had to persuade program officers who aren't technical. Write for that reader.

1. Start with whose data you hold. Client case files, children's records, donor cards, health information. Say how many people's records sit in your systems.
2. Describe the risk in mission terms. "A ransomware lockout would stop intake for 2 weeks" lands better than a list of vulnerabilities.
3. Show what you already found. Attach a Cyber Hygiene report, an assessment summary or the gaps on an insurance application.
4. Ask for a few specific fixes. MFA for every account, tested backups and staff training make a clear first phase.
5. Budget the second year. Licenses and monitoring keep costing money. Show where that comes from, and see grants for nonprofit operating costs for funders of ongoing costs.
6. Size the ask to the funder. Use how to read a 990-PF to see what a funder gave groups like yours. A funder whose usual gift is $5,000 won't cover a $40,000 managed security contract alone.

Common Mistakes in Cybersecurity Grant Requests

These 6 mistakes cost groups asks near the $4,000 median.

• Writing in jargon. A common mistake is a request full of acronyms and threat names. Name the people protected and the service you'd lose.
• Asking for a product, not an outcome. A request that names one vendor's tool before any assessment is a red flag for funders. Fund the assessment first, then the fixes it points to.
• Forgetting training. Groups underestimate how often a breach starts with one phishing email. Put training in the first budget, not the second.
• Mixing up your security with a cyber program for the public. Teaching teens or job seekers cybersecurity is a workforce program with different funders. 67 of the 103 grants in this pull went to that kind of work, not to protecting a grantee's own network.
• Treating NSGP as an IT fund. Its cyber items only fit a threat-based physical security plan.
• Calling it "capacity" with no detail. Capacity grants pay for security all the time, but say what you'll buy. The capacity building guide shows how funders frame these requests.

Related Guides for Cybersecurity Funding

The $1,306,408 in own-security grants is a sliver of foundation giving, so most groups will find this money through funders of their own cause. Groups rebuilding their public site at the same time should read grants for nonprofit websites, since a site rebuild is a natural moment to fix sign-in and hosting security. Libraries like Ocean State Libraries can compare funders in grants for libraries, and schools can start with grants for school technology.

Towns, counties and special districts should read federal grants for local governments and grants for municipalities for the wider set of public programs. To check open federal and state notices, search the Grantsights grant database.

FAQ: Common Questions

Are there cybersecurity grants for nonprofits? Yes, but only 25 of 103 cyber-named foundation grants in the November 5, 2026 pull paid for a group's own security.

How much do foundations give for a nonprofit's own cybersecurity? The median was $4,000, and 13 of the 25 grants were $4,000 or less.

Can a nonprofit apply for the State and Local Cybersecurity Grant Program? No. Only the State Administrative Agency applies, and the money passes to local governments.

Does the Nonprofit Security Grant Program pay for cybersecurity? Some cyber equipment, but only for 501(c)(3) groups at risk of terrorist or extremist attack.

Is there free cybersecurity help for small organizations? CISA's no-cost scanning serves governments and critical infrastructure groups, and 11 foundation grants funded free-help groups.

Are there cybersecurity grants for schools and libraries? The FCC pilot is closed to new applicants; foundations like The Champlin Foundation have paid directly.

Sources

These 12 sources, checked November 6, 2026, back the federal and filing claims above.

• CISA: Cyber Hygiene Services (opens in a new tab)
• CISA: No-Cost Cybersecurity Services and Tools (opens in a new tab)
• CISA: Cyber Guidance for Small Businesses (opens in a new tab)
• govinfo.gov: 6 U.S.C. 665g, State and Local Cybersecurity Grant Program (U.S. Code, 2024 edition) (opens in a new tab)
• FEMA: State and Local Cybersecurity Grant Program (last updated July 30, 2026) (opens in a new tab)
• Grants.gov: State and Local Cybersecurity Grant Program, fiscal year 2025 notice, DHS-25-GPD-137-00-99 (opens in a new tab)
• FEMA: Tribal Cybersecurity Grant Program (opens in a new tab)
• Grants.gov: FY2026 Nonprofit Security Grant Program (DHS-26-GPD-008-00-99) (opens in a new tab)
• FEMA: Nonprofit Security Grant Program (last updated September 28, 2026) (opens in a new tab)
• USAC: Schools and Libraries Cybersecurity Pilot Program (opens in a new tab)
• NIST: Small Business Cybersecurity Corner (opens in a new tab)
• IRS: About Form 990-PF (opens in a new tab)
• Grantsights 990-PF cybersecurity grant records pulled November 5, 2026, plus the statewide human services figures pulled October 29, 2026