Congress Proposes Steep Cuts to CISA

Congress is proposing spending cuts to the U.S. cyber defense agency, slashing hundreds of millions of dollars from programs tasked with federal threat hunting, analyzing hostile activity across federal networks and supporting frontline cyber operations.

In a bicameral funding bill published Tuesday, lawmakers also undid some of the cutbacks instituted over the first year of the Trump administration, including by earmarking $40 million for election security and requiring the Cybersecurity and Infrastructure Agency to participate with the Elections Infrastructure Information Sharing and Analysis Center.

Congress further admonished the executive branch that CISA must have a workforce capable of executing its duties. “CISA shall not reduce staffing in such a way that it lacks sufficient staff to effectively carry out its statutory missions,” legislators wrote in a statement accompanying the appropriations bill.

CISA entered fiscal 2026 weakened following months of hiring freezes, a mass exodus of senior leadership and internal restructuring that at times gutted entire teams responsible for stakeholder engagement (see: No Vote, No Leader: CISA Faces 2026 Without a Director.

The shakeups and cuts have come as officials warn Chinese, Russian, Iranian and criminal threat actors are intensifying probing of federal networks, election infrastructure and industrial control systems.

Under the bill, CISA’s topline will fall to roughly $2.6 billion, down nearly $268 million from the prior year’s enacted level. The bill cuts threat hunting by $17.5 million, vulnerability management by $22.2 million and extends cuts to funding for cyber analytics programs. It preserves staffing levels, regional field offices and election security operations.

The compromise funding bill reverses some of the gains CISA made during an expansion of federal cyber authorities and spending instituted by the Biden administration in reaction to gasoline supply disruptions in the Southeastern United States after a May 2021 ransomware attack on Colonial Pipeline.

Lawmakers eliminated procurement funding in the latest proposal for the National Cybersecurity Protection System, a platform for federal network monitoring.

Most reductions fall disproportionately on non-defense cyber funding. Many of the agency’s teams focused on vulnerability management, capacity building and operational planning face funding reductions, while defense-designated cyber funding rises modestly by about $62 million.

Congress had steadily expanded year-over-year cybersecurity funding since 2020 across federal agencies while embracing expanded authorities and workforce investments. Previously released funding packages for major civilian agencies also include reductions and flatlining cyber budgets, with lawmakers proposing “no less than the fiscal year 2024 enacted level” for most cybersecurity and digital risk-related programs across the Departments of Commerce, Justice and their science, technology and law enforcement components (see: Cyber Flatlines in FY 2026 Justice, Commerce Spending Bill).

Despite the sweeping cuts, the bill includes $20 million for targeted hiring across select mission areas, including continuous diagnostics and mitigation and security advisory roles. Election security funding is also preserved at roughly $40 million, which will allow the agency to continue regional election security support despite threats to the program throughout 2025.

CISA is also tasked under the bill with expanded reporting requirements on federal network security performance, workforce development efforts and post-quantum cryptography planning, adding oversight and coordination obligations at the same time several operational budgets are reduced.

Funding for the Department of Homeland Security – of which CISA is a component – could become a contentious fight, with House Republicans committing to a separate floor vote so it is not bundled with other appropriations bills. Tensions in Washington and across the country have risen in recent weeks following a series of high-profile incidents involving DHS’s Immigration and Customs Enforcement, including the fatal shooting of 37-year-old Renee Good by an ICE agent during a federal operation in Minneapolis (see: Breach Roundup: Website Publishes Identities of Thousands of ICE, Border Patrol Staff).