CISA’s Acting Director Defends Cuts Amid Growing Turmoil

The top official at the U.S. Cybersecurity and Infrastructure Security Agency defended budget cuts and controversial remarks by Homeland Security Secretary Kristi Noem on Thursday, as lawmakers voiced concerns over how reductions could weaken national cyber defenses.

Bridget Bean, a senior official currently serving as acting director of CISA while President Donald Trump’s nominee awaits Senate confirmation, told the House Appropriations subcommittee the agency is “eliminating duplication and increasing efficiency.” Her testimony follows warnings from current and former staff that proposed budget cuts of up to $500 million and a potential one-third workforce reduction have thrown internal operations into turmoil (see: Planned CISA Cuts Face Political Delays and Growing Backlash).

Lawmakers pressed Bean on how the agency can counter threats from foreign adversaries like China – which she confirmed have infiltrated U.S. critical infrastructure systems – amid budget cuts to the nation’s cyber defense programs. Those concerns were bipartisan, including from Rep. Mark Amodei, R-Nev., chairman of the House Appropriations Homeland Security subcommittee. Amodei requested details on how the agency plans to strengthen cybersecurity with fewer resources and reduced staffing in its fiscal year 2026 request.

“More money is not automatically the answer, but I’m not talking about more money,” Amodei said. It’s “going to be a problem” for the committee to handle appropriations without more information from the agency on its restructuring plans, he said. “The question is: Why shouldn’t I be worried about where we’re sitting in terms of all the issues that you’ve talked about as a result of those cuts?”

Rep. Lauren Underwood, D-IL., ranking member of the subcommittee, questioned why CISA failed to deploy an emergency readiness team after the National Labor Relations Board reported suspicious data activity tied to a Russian IP address following access granted to Department of Government Efficiency staff. Bean responded that CISA was never contacted by the board and said she was “not aware” of any request for support or information from DOGE during its work across key agencies involving federal system access and sensitive data.

Bean also supported Homeland Security Secretary Kristi Noem following her April 30 keynote speech at the RSAC Conference in San Francisco, in which she derided CISA as the “Ministry of Truth” over its past efforts to combat misinformation. Noem also testified before the House Appropriations subcommittee on Wednesday, during which she teased a “grand cyber plan” and suggested CISA was unable to defend against Chinese cyberattacks under the previous administration (see: Trump’s ‘Grand Cyber Plan’ Coming Soon, Noem Tells Lawmakers).

Bean told lawmakers she felt the secretary was expressing her support to the agency and its staffers in her RSAC remarks.

“I think to the CISA family, [Noem] was saying, ‘I support you,'” Bean said. “That you are part of this national security and that you – that we play a critical role in that plan, and that she supports us.”

Before acting as the head of the agency, Bean was CISA’s chief integration officer and previously served as the Federal Management Agency’s acting deputy administrator for resilience.

Multiple CISA employees, speaking anonymously to Information Security Media Group in recent weeks, voiced increasing alarm about potential job losses and the potential weakening state of the country’s overall cybersecurity posture. The White House called for a $500 million cut to CISA in a Friday letter sent to the Senate Appropriations committee – a nearly 16% reduction in funding that the administration said will allow the agency to refocus “on its core mission” (see: White House Proposes $500 Million Cut to CISA).

Despite the restructuring and planned cuts, Bean said CISA has continued to deliver active shooter preparedness training, expand unmanned aircraft systems security guidance and enhance school safety efforts. The agency also supported major national events like the Boston Marathon and the 250th celebration of the Battles of Lexington and Concord by coordinating emergency response exercises, delivering threat mitigation training and conducting physical security assessments, Bean said.

CISA established new operational partnerships with 44 critical asset owners across seven sectors in the first quarter of fiscal year 2025 and added 73 known exploited vulnerabilities to the agency’s KEV catalog, she added. Bean also said the agency’s Protective Domain Name System service blocked over 700 million malicious connections across the federal civilian enterprise so far this year, as well as 60 million malicious connections across critical infrastructure.