Congressional Funding Package Targets CISA Staffing, Election Security, and Federal Cyber Modernization
A DHS “minibus” appropriations package would direct the Cybersecurity and Infrastructure Security Agency (CISA) to maintain “sufficient” staffing to execute its statutory missions, including support to federal civilian agencies and state/local/tribal/territorial partners. The accompanying congressional language also calls for maintaining at least 10 regional field offices and having at least one Cyber Security Advisor per state or territory, while continuing to fund election security activities (including regional election security advisers and the Elections Infrastructure ISAC). The bill would provide $2.6B for CISA, down from roughly $3B previously cited in the reporting.
The same funding package would extend authorization for the Technology Modernization Fund (TMF)—which had lapsed—through Sept. 30 (end of FY2026), enabling continued federal IT modernization investments that are often tied to cyber risk reduction. It would also extend several cybersecurity-related statutory authorities, including the Cybersecurity Information Sharing Act of 2015, preserving a legal framework for private-sector sharing of cyber threat intelligence with U.S. government entities under specified liability protections. Separately, CISA leadership turmoil was reported as internal pushback halted an attempted management-directed reassignment of CISA CIO Robert Costello, adding to concerns about decision-making and stability amid ongoing pressure from persistent threats to federal networks and critical infrastructure.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Lawmakers direct CISA to sustain staffing and election security work
The joint explanatory statement for the January 2026 appropriations package instructed CISA to maintain sufficient staffing, preserve regional and state cyber advisor coverage, and continue election security efforts. The bill would provide CISA $2.6 billion through the end of fiscal year 2026, including $39.6 million for election security and support for EI-ISAC.
Appropriators release funding package extending cyber programs
On January 20, 2026, House and Senate appropriators released a minibus funding package that would extend the Technology Modernization Fund, the Cybersecurity Information Sharing Act, the State and Local Cybersecurity Grant Program, and the National Cybersecurity Protection System through Sept. 30, 2026.
TMF authorization lapses, halting new investments
The Technology Modernization Fund's authorization expired more than a month before the January 2026 appropriations package, preventing the fund from making new investments while Congress considered reauthorization.
CISA workforce shrinks by about one-third
Beginning in early 2025, federal staffing reduction efforts led CISA to lose roughly one-third of its workforce, raising concerns about its ability to carry out statutory missions.
Trump administration ends support for EI-ISAC
The Trump administration terminated support for the Elections Infrastructure Information Sharing and Analysis Center, a move the article says contributed to disarray among state and local election offices.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US Lawmakers Seek Short-Term Extension of Key CISA Cybersecurity Authorities Amid Agency Leadership Turmoil
Congressional leaders introduced a compromise federal funding package that would **temporarily extend two major U.S. cybersecurity authorities**—the 2015 *Cybersecurity and Infrastructure Security Act* (which provides liability protections intended to encourage private-sector cyber threat information sharing with the federal government) and the **State and Local Cybersecurity Grant Program**—through **September 30**. The proposal follows prior stopgap extensions after the statutes lapsed, and comes as lawmakers debate longer-term reauthorization options, including competing House and Senate proposals and a draft approach from Sen. Rand Paul that would remove the original law’s liability protections. Separately, reporting highlighted **internal leadership instability at CISA**: acting director **Madhu Gottumukkala** reportedly attempted to remove or reassign CISA CIO **Robert Costello** via a management-directed reassignment, but was blocked after objections from other political appointees within DHS. The episode adds to concerns about decision-making and turnover at the agency at a time when CISA is responsible for coordinating federal cyber defense, incident response support, and collaboration with state, local, and private-sector partners—functions that could be affected by sustained leadership disruption.
Mar 21, 2026
Acting CISA Director Warns DHS Shutdown Would Curtail Cyber Defense Operations
Acting CISA Director **Madhu Gottumukkala** told House appropriators that a potential Department of Homeland Security funding lapse would materially reduce CISA’s ability to support public- and private-sector partners, warning that “when the government shuts down, cyber threats do not.” He said a shutdown would degrade timely, actionable guidance; curtail core missions such as digital response; and limit work to activities deemed essential to protecting life and property—shifting the agency from proactive efforts (including vulnerability scanning) to a more reactive posture. He also said a shutdown would force more than a third of CISA’s frontline security experts and threat hunters to work without pay and would impede progress on CISA’s long-awaited cyber incident reporting rule. In the same congressional context, Gottumukkala also acknowledged that **about 70 CISA staff** were reassigned to other DHS offices over the last year (including a “handful” to **ICE**), while “30 plus” personnel were transferred into CISA; a December 2025 staffing chart cited in reporting reflected **27 inbound** and **65 outbound** reassignments. Separately, Congress reauthorized the **Cybersecurity Information Sharing Act of 2015 (CISA 2015)**—which provides liability protections, FOIA exemptions, and other safeguards for sharing cyber threat indicators and defensive measures—extending it from its planned January 2026 sunset to **September 30, 2026**. Reporting on the Senate Intelligence Committee advancing a nominee to lead **U.S. Cyber Command/NSA** is related to federal cyber leadership but is not part of the shutdown/CISA operational-impact story.
Mar 21, 2026
CISA Capacity Degraded by Personnel Cuts, Program Closures, and Leadership Vacancies
Bipartisan lawmakers and private-sector cybersecurity leaders warned that the U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) has been significantly weakened after roughly a year of personnel cuts and layoffs under the second Trump administration, with reporting indicating the agency has lost about **one-third of its workforce** and shuttered or reduced entire divisions. Sources described diminished ability to execute core missions such as coordinating with industry and protecting federal civilian networks, with some organizations reportedly seeking alternatives (industry alliances, outside consultants, or direct government-to-government partnerships) rather than relying on CISA support. Reporting also tied the degradation to a prolonged **leadership vacuum**—with the administration’s nominee **Sean Plankey** not confirmed and Acting Director **Madhu Gottumukkala** criticized by some sources as struggling to lead—alongside political and operational pressures that deprioritized the agency. Specific capability impacts cited include reduced **counter-ransomware** efforts, work to promote **secure software development**, and losses affecting **election security** functions; additional strain was attributed to reassignment of staff to other DHS priorities and to a partial federal government shutdown that further reduced available staffing levels, raising concerns about CISA’s readiness to respond to a major cyber crisis.
Mar 21, 2026