The Cybersecurity Divide, and Who Gets Left on the Wrong Side of It

The cybersecurity divide is not mainly a technology gap. It is an access gap: some sectors now have organized, sponsored help arriving at their door, and other organizations carry identical expectations with nobody organizing anything on their behalf. The last seven days made that visible. Rural water systems, a sector that has been loudly under resourced for years, got two pieces of structured help at once. Meanwhile a nonprofit running client data on a handful of laptops, or a machine shop with a defense prime asking hard questions, woke up to the same Monday they had last week.

What does the cybersecurity divide actually look like in practice?

It looks like two organizations with roughly the same exposure and very different odds. One is inside a sector that regulators, state governments and volunteer communities have decided to organize around: it gets a program, a point of contact, something concrete delivered. The other has the same laptops, the same email, the same vendor access, and no program at all, expected to figure it out from public documentation alone.

Here is the part people miss: the second organization is not less regulated. A small supplier in the defense industrial base is subject to real contract requirements regardless of headcount. A nonprofit holding client health or immigration information sits under state breach notification law and often grantor security expectations. The obligation showed up. The support did not.

Why did rural water utilities get organized help this month?

Two things happened, worth understanding as a model rather than news. First, the DEF CON Franklin project announced it will arrange for cybersecurity firms to deliver monitoring and detection to small rural water utilities, free to the utility, an in-kind model. Second, New York State announced cybersecurity grants for local water system projects, a state deciding a class of small operators is critical enough to fund directly.

The reason water got both is not mystery: it is a documented weak point in critical infrastructure, politically legible, with an identifiable list of operators. When a sector is countable and the risk is obvious, organizing help becomes possible. When a sector is scattered across every zip code with no shared roster, it stays invisible. That is the real mechanic behind the divide: visibility, not merit.

Is the help going where the requirements are?

Not evenly. GSA runs Highly Adaptive Cybersecurity Services under the Multiple Award Schedule, a purchasing path agencies use for risk assessment, penetration testing, incident response, cyber hunt; GSA also states interest in small business utilization on that vehicle. But that is a channel for agencies to buy services and for small firms to sell them, not a channel that delivers an assessment to a nine-person nonprofit or a family-owned fabricator.

Requirements flow all the way down the supply chain to the smallest supplier. Structured assistance mostly stops several layers above them. Nobody designed that outcome; it is what happens when obligations follow contract language and assistance follows programs.

What do you do when nobody has built a program for your sector?

Build the smallest honest version of one yourself, in an order that survives scrutiny. Start by writing down what you actually have: not a tool inventory, but a list of the information you hold that would hurt someone if it leaked, where it lives, who can reach it, and which outside parties have access into your systems. NIST SP 800-171, which governs protection of controlled unclassified information for defense suppliers, begins by asking what is in scope and where it flows.

Then find out what is already free: CISA publishes a catalog of free cybersecurity services and tools; Multi State Information Sharing and Analysis Center membership is available to state, local, tribal and territorial entities. Then be honest about the gap that remains, usually a piece that needs an experienced outside set of eyes: a gap assessment against the framework your contracts or grantors actually reference. That is the piece small organizations skip, and it decides whether everything else is aimed at the right target.

How do you tell real in-kind help from a sales funnel?

Ask four questions before accepting anything: What exactly do I receive, in writing, and is it a deliverable I would still own if we never worked together again? Who is providing it, and what is their interest in providing it? Is the assessment tied to the framework my contracts or grantors actually name, or to a generic checklist? Is there a hard commitment attached to accepting it?

Our own model is in-kind and we say that plainly: we contribute the assessment work itself, meaning the labor and expertise, and you get a gap report that is yours. That distinction is not a technicality. A second warning sign worth naming: some sector programs are real and open, if a genuine sponsored program exists for your sector, take it; we would rather you get help from someone else than get no help at all.

What should a small defense supplier take from all of this?

That the timeline is not waiting for the support to catch up. The CMMC program is phasing into defense contracts, with requirements flowing through contract clauses to suppliers of many sizes; the exact phase and clause language depend on your contract, and any solicitation you are looking at is the authority, not a blog post. What is not in dispute is the direction: expectations that were once informal are becoming conditions of eligibility.

If you are a small supplier wondering when your turn comes for organized help, the practical answer is not to plan around it arriving, plan around knowing your gaps before someone else finds them for you.

Frequently Asked Questions

What is the cybersecurity divide?

The cybersecurity divide is the gap between organizations that receive structured, sponsored cybersecurity help and those that face the same threats and requirements with no organized support. It is driven less by risk severity than by whether a sector is visible, countable and politically legible. Water utilities, hospitals and schools tend to be organized around. Small nonprofits, small businesses and small defense suppliers often are not.

Are cybersecurity grants always money?

No. Some are direct funding from a state or federal program. Others are in-kind, meaning an organization contributes services, labor or expertise rather than funds. Both are legitimate, but you should know which one you are being offered, because the two produce very different deliverables and obligations.

Does the GSA Highly Adaptive Cybersecurity Services program help small businesses directly?

Not in the way most small organizations hope. HACS is a purchasing path on the GSA Multiple Award Schedule that federal agencies use to acquire services such as risk assessment, penetration testing and incident response. It supports small business participation as sellers on the vehicle, but it is not a mechanism that delivers assessments to a small nonprofit or a small supplier as a recipient.

What can a small nonprofit do first with no security staff?

Start with a written inventory of the sensitive information you hold, where it lives, who can reach it and which vendors have access into your systems. Then check the CISA free cybersecurity services and tools catalog for offerings you already qualify for. Only after that does it make sense to buy or accept anything, because otherwise you cannot tell what you are actually filling.

Do small defense suppliers really have to meet the same requirements as large ones?

Contract requirements generally follow the information you handle, not your headcount. If you receive controlled unclassified information, protection expectations under NIST SP 800-171 apply to you, and CMMC requirements phase in through contract clauses. The specific level and timing depend on your solicitation, so read the actual contract language rather than assuming your size exempts you.

How do I know if a security offer is real or a sales pitch?

Ask what tangible deliverable you receive, whether you keep it unconditionally, which named framework it is measured against, and what commitment is attached to accepting it. A real in-kind offer will answer all four in writing without hesitation. If the answers are vague or the deliverable only exists inside a subscription, you are looking at a funnel.

Sources: GSA Highly Adaptive Cybersecurity Services; CISA Free Cybersecurity Services and Tools; NIST SP 800-171; DoD CIO, Cybersecurity Maturity Model Certification; Facilities Dive, water cybersecurity monitoring via DEF CON Franklin.