CISA to furlough most of its workforce under impending DHS shutdown

"A likely partial government shutdown after Friday would impair the Cybersecurity and Infrastructure Security Agency's operations, leading to diminished capabilities in critical areas including cyber response, security assessments, stakeholder engagements, training exercises and special event planning, a top official said this week. CISA would furlough a majority of its workforce and just one-third would remain on the job under shutdown conditions, agency acting director Madhu Gottumukkala told House appropriators on Wednesday."

""I want to be clear - when the government shuts down, cyber threats do not," he said. The impending shutdown of the Department of Homeland Security - CISA's parent agency - comes after Congress granted the department a two-week funding extension following high-profile Immigration and Customs and Enforcement shootings in Minneapolis. Democrats have seized upon those incidents to advocate for funding overhauls for ICE and U.S. Customs and Border Protection, which have played central roles in the Trump administration's maximalist deportation efforts."

"The cyberdefense agency's work would be "strictly limited to those that are essential to protecting life and property" and available staff will "only look at anything that is an immediate need and an imminent threat," said Gottumukkala, adding that the agency will be unable to proactively scan for cyber vulnerabilities. The shutdown would also slow ongoing revamps of a major cyber incident reporting rule that was signed into law in 2022, he said. The Cyber Incident Reporting for Critical Infrastructure Act directed CISA to enact a final rule by October 2025, though that deadline has been extended to this May."

A partial government shutdown would significantly impair CISA operations, reducing capabilities across cyber response, security assessments, stakeholder engagement, training exercises, and special event planning. Most CISA employees would be furloughed, leaving roughly one-third on duty and limiting work to tasks essential for protecting life and property. Proactive vulnerability scanning would cease and the agency would focus only on immediate, imminent threats. The shutdown would delay finalizing the Cyber Incident Reporting for Critical Infrastructure Act rule, which has an extended deadline into May. CISA has already experienced substantial workforce reductions over the past year amid broader efficiency initiatives.

Read at Nextgov.com