FEMA has clarified that state and local governments are prohibited from using federal cyber grant funds to pay for membership fees that bundle cybersecurity or technical services, as the agency cannot determine the reasonableness of these bundled costs.