CISA budget bill would require agency to maintain ‘sufficient’ staffing levels

Lawmakers expect the Cybersecurity and Infrastructure Security Agency to use part of the funding provided in Tuesday’s minibus package to expand its workforce and sustain election security efforts, according to a congressional statement accompanying the bill.

The funding directive, laid out in a joint explanatory statement, appears to highlight contrasts between congressional priorities and the Trump administration’s approach to CISA, with lawmakers using appropriations language to reaffirm support for the agency’s staffing and election security mission even as the administration moved last year to scale back the size and scope of CISA’s workforce.

The funding package supports the Department of Homeland Security — which houses CISA — and a slew of other agencies through the end of the 2026 fiscal year in September.

“CISA shall maintain a workforce consistent with the personnel and FTE funded by the pay and non-pay amounts provided in this Act. CISA shall not reduce staffing in such a way that it lacks sufficient staff to effectively carry out its statutory missions, including cybersecurity and infrastructure security for the Federal Civilian Executive Branch agencies, [state, local, tribal and territorial] partners, Sector Risk Management Agencies, international partners, and other stakeholders,” the statement says.

Additionally, CISA must maintain at least 10 regional field offices around the country and employ no fewer than one expert “Cyber Security Advisor” per state or territory devoted exclusively to assisting such state or territory, it adds.

In total, the DHS funding bill would provide $2.6 billion for CISA, down from the approximately $3 billion the agency had when President Donald Trump retook the White House. 

Notably, the funding measure earmarks $39.6 million for continuing election security efforts, including funding for election security advisers in each CISA region and the Elections Infrastructure Information Sharing and Analysis Center. The Trump administration ended support for EI-ISAC last year, and many state and local election offices have since been thrown into disarray. 

Election matters fall under CISA’s statutory mission to protect critical infrastructure, which includes systems like election management software and vote tabulation machines, though the agency has faced sustained GOP scrutiny in recent years over its past work monitoring and flagging false information in coordination with social media companies.

Around a third of the cyberdefense agency’s workforce has been shed since early last year as various mechanisms to reduce federal staffing levels were implemented under broad White House efforts to remove wasteful spending in the government. Previous reporting has indicated the agency intends to undo some of those reductions.

The funding package also extends authorization for the lapsed Technology Modernization Fund and several cybersecurity statutes.