CISA Lost 1,000 Staff. Democrats Promise to Rebuild and Regulate

CISA has lost more than 1,000 employees — roughly one-third of its workforce — since January 2025, and the incoming Democratic committee chairs want several hundred hired back. That is the number around which the next Congress's cybersecurity agenda now revolves. By Daniel Okafor.

Rep. Bennie Thompson (D-Miss.), expected to retake the House Homeland Security Committee gavel, called this a "pivotal time for CISA" in a statement. The agency is hiring several hundred staff to replace the departures. Whether Congress can actually expedite federal hiring at that pace remains untested. Federal recruitment cycles rarely move at the speed of a press release.

"First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks," Thompson said. He added that AI "will also accelerate the consequences of deferred investments in security" — a caveat that applies to utilities as much as to agencies.

What did the election change?

Democrats retook both the House and the Senate. The expected leaders of committees with cyber oversight have staked out priorities for January. Three themes dominate:

• Restaffing CISA after cuts under the Trump-Vance administration
• Extending expiring information-sharing authorities
• Countering AI-enabled attacks on critical infrastructure

Sen. Maggie Hassan (D-N.H.), expected chairwoman of the Senate Homeland Security and Governmental Affairs Committee, was blunt about the cause. "The Trump-Vance Administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA," she said in a statement. "We need to reverse these cuts, confront these challenges, and put public safety first." Reversing cuts requires appropriations, and no funding figure has been named.

Which authorities expire?

The Cybersecurity Information Sharing Act of 2015 — CISA 2015 — expires again in December after a short-term extension inside the continuing resolution. Nearly three dozen industry groups are calling for a long-term reauthorization. The law governs how the federal government shares cyber threat information with state and local governments and the private sector.

Sen. Mark Warner (D-Va.), expected incoming chairman of the Senate Select Committee on Intelligence, named two priorities: reauthorizing CISA 2015 and restoring funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC). The Department of Homeland Security allowed MS-ISAC funding to expire last year. No dollar amount for restoration has been stated.

Warner said U.S. critical infrastructure such as power and water "remains deeply vulnerable." He cited the Salt Typhoon, Colonial Pipeline and Change Healthcare hacks as proof — incidents that affected millions of Americans — and warned that AI tools will accelerate the speed and scale of attacks.

What new programs are on the table?

Thompson's list goes beyond staffing. He wants the State and Local Cybersecurity Grant Program extended to support under-resourced sectors, especially water utilities. He also committed to ensuring CISA's new cross-sector coordination authority, Anchor-CI, gets "up and running and meets the needs of stakeholders." Anchor-CI is new. Its budget, staffing and timeline were not disclosed in the statements.

Thompson's final pledge: "We will make sure CISA is well-positioned to support the secure development and deployment of AI." What that means in practice — guidance, regulation or funding — went unsaid.

What must companies prepare for?

Early next year, the Trump administration is expected to release final rules requiring critical infrastructure organizations to report cyber incidents to CISA within 72 hours. CISA sent the final CIRCIA rule — under the Cyber Incident Reporting for Critical Infrastructure Act — to the White House for review earlier this fall.

Tonya Ugoretz, a cybersecurity leader at PwC and former senior cyber official at the FBI, said companies should not wait. "Taking a hard look now internally at the controls and what they can improve now before that rule takes effect in the new year, presumably, to make sure that they're ready for what those demands are going to be," she told Federal News Network.

Ugoretz said cybersecurity is "demanding attention in a way that it hasn't previously because of the impacts of AI" — though she declined to credit the election alone. "I wouldn't chalk that up solely to the outcome of the election," she said. She expects scrutiny of resourcing across all sector-risk management agencies, not just CISA, as AI demands grow.

Does offense enter the picture?

One Trump administration signature policy has enlisted the private sector to conduct targeted offensive cyber operations against foreign criminal hacking groups. Warner wants a review. "We cannot simply be content to play defense when adversaries attack our nation's civilian infrastructure; we must also be able to punch back," he said.

He attached a condition worth watching: any offensive approach must be "measured and consistent with our country's principles and values." How Congress supervises private offensive operations — and under what legal authority — is the open question nobody has yet answered.