DHS Funding Lapse Would Sideline Federal Cyber Staff

More than half of the Cybersecurity and Infrastructure Security Agency’s workforce would be furloughed and key cyber defense programs paused if the U.S. Congress does not extend funding for the Department of Homeland Security beyond the Friday funding deadline, according to testimony the agency’s acting chief delivered Wednesday to lawmakers.

See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach eBook

Acting CISA Director Madhu Gottumukkala told the House Appropriations subcommittee on Homeland Security Wednesday the agency has contingency plans for a shutdown that would significantly reduce operations. Work would largely be restricted to threat response and protection of critical systems.

CISA currently plans to designate 888 of its 2,341 employees as “excepted” personnel who would still continue working during a funding lapse. The majority of staff would be furloughed while the smaller group carries out mission-critical cybersecurity operations, without pay.

A funding lapse at CISA parent agency Department of Homeland Security would “delay deploying cybersecurity services and capabilities to federal agencies, leaving significant gaps in security programs,” Gottumukkala told lawmakers. “CISA’s capacity to provide timely and actionable guidance to help partners defend their networks would be degraded.”

CISA would maintain its 24/7 operations center, share urgent vulnerability and incident information, respond to imminent threats and operate certain cybersecurity shared services, Gottumukkala told lawmakers. Most proactive cybersecurity work would halt, including strategic planning, development of new technical capabilities, stakeholder training and security assessments for government and critical infrastructure partners.

Work on a cyber incident reporting rulemaking required under the Cyber Incident Reporting for Critical Infrastructure Act would also pause, according to the acting director, delaying efforts to finalize regulations intended to standardize how organizations report major cyber incidents to the federal government. He said a funding lapse would strain frontline threat hunters and analysts, delay deployment of cybersecurity services to federal agencies and weaken the government’s ability to provide timely guidance to infrastructure operators.

Congressional Democrats say they won’t support a funding extension for DHS without changes to immigration detention operations conducted by other departmental bureaus. Among their demands is an end to immigration agent face coverings, assurances that government officials will not enter private property without a judicial warrant and “a reasonable use of force policy.”

The White House and Senate Republicans have pushed back against the demands. One key senator called the Democratic asks “a ridiculous Christmas list of demands for the press.”

The likelihood of a protracted shutdown comes at a turbulent moment for CISA, which has spent the past year attempting to refocus on core infrastructure security missions following budget reductions, political scrutiny and internal uncertainty (see: No Vote, No Leader: CISA Faces 2026 Without a Director).

Workforce reductions during government-wide shutdown in 2025 – the longest in American history – disproportionately hit CISA during a period of instability that included leadership turnover and political pressure tied to broader debates about the agency’s role in countering online influence operations and coordinating with state election officials.

Lawmakers and former officials have previously warned that funding lapses can disproportionately affect cybersecurity preparedness because prevention activities often do not qualify as “excepted” functions during government shutdowns (see: CISA Is ‘Trying to Get Back on Its Mission’ After Trump Cuts ).

In past shutdown planning scenarios, CISA officials have said that delaying vulnerability assessments, training exercises and infrastructure coordination efforts can create downstream security risks that persist long after funding resumes. The acting chief noted the timing of the latest partial shutdown could be particularly sensitive as the agency is spearheading work to strengthen federal cyber defenses through binding operational directives, expanded endpoint detection capabilities and coordination with state, local, tribal and territorial governments.

Gottumukkala also told lawmakers that disruptions to workforce pay and morale may exacerbate operational challenges if a shutdown persists for an extended period – particularly as cyberthreat actors continue targeting U.S. infrastructure and government networks.

“The adverse effects of a shutdown are not just felt by our agency alone but also extend to the communities we serve, as delays or disruptions may impact our collective ability to protect and support national infrastructure security,” he said.