Cybersecurity Policy Report, Congress Should Protect CISA From Funding Shutdowns, ITIF’s Castro Says, (Oct 3, 2025)
Congress should establish a way to shield the Cybersecurity and Infrastructure Security Agency from future government shutdowns, according to Daniel Castro, vice president of the Information Technology and Innovation Foundation.
“The Cybersecurity and Infrastructure Security Agency (CISA) furloughed two-thirds of its staff this week after Congress failed to pass a spending bill to keep the government open, leaving the agency with just shy of 900 workers,” Mr. Castro noted today in a blog post.
“Hitting pause on U.S. cybersecurity efforts creates a serious vulnerability,” he warned. “Attackers will almost certainly seize this opening to attempt new exploits—ones that may not be discovered for months or more.”
Ideally, Congress would fund CISA operations while the “overall funding fight continues,” he said. “But the reality is that lawmakers are unlikely to give any preferential treatment to CISA over other federal budget concerns, especially if Congress remains out of session.”
“But these budget fights are becoming more common, so Congress should prepare for the next one. To keep CISA fully operational, Congress should create a dedicated funding stream so that the agency does not have to rely so heavily on appropriations,” Mr. Castro recommended.
“One option is for Congress to establish a working capital fund and then allow CISA to create a fee-for-service model for various cybersecurity services that it provides to states, such as vulnerability monitoring and phishing assessments. CISA provides these services at no cost today, but Congress could instead provide states grants to pay for these services from CISA,” he said.
“Another option would be for Congress to establish a permanent self-sustaining fund for CISA operations, such as one paid for with a small fee for domain name registrations and renewals,” he said.
“Maintaining strong cybersecurity is crucial to national security, and Congress should not allow it to get caught in the crossfire of funding fights,” Mr. Castro added. “Unless Congress shutdown-proofs CISA, the next lapse in funding will not just stall government—it could open the door to dangerous cyberattacks by America’s adversaries.”
News: FederalLegislation DataSecurity