CISA cyber partnerships face ‘standstill’ amid cuts | Federal News Network
Staff reductions within the agency’s Stakeholder Engagement Division have slowed CISA’s ability to align with industry on high-priority cyber risks.
In a recent congressional hearing, witnesses stressed that CISA’s core role as the Sector Risk Management Agency depends on active collaboration with the private sector. The division has shed roughly half of its personnel since the start of last year, and the FY2027 budget plan anticipates further cuts, bringing staffing to about six dozen and eliminating several offices that coordinate council activities, stakeholder outreach, and international engagement.
Impact on outreach and modernization
Supporters say the outreach work is essential as the agency shifts its focus toward infrastructure security and operational efficiency. Critics warn that removing these capabilities threatens the information-sharing network industry relies on to address vulnerabilities in real time, especially as new sectors like space systems and data centers push for greater protection.
What the budget could change
The proposed FY2027 plan would cut the Stakeholder Engagement Division to roughly 62 positions, eliminating the division’s Council Management office, ongoing engagement programs, and the international relations external engagement office. Proponents argue this realignment prioritizes a narrower mission, but opponents say it narrows the channel through which industry can participate in risk assessments and incident response planning.
Arguments from the critique side
Analysts and advocates contend that without a dedicated engagement unit, formal information-sharing agreements with private firms may stall, leaving the sector vulnerable as threats grow more sophisticated and widespread. The removal of a key private-sector advisory council and reductions in federal support for multi-state information sharing and local cybersecurity initiatives have heightened concerns about the readiness of smaller utilities and municipalities to invest in protective measures.
Private-sector feedback
Industry observers note a rise in intelligence briefings to the private sector over the past two years, along with improvements in the public release of cyber advisories. Yet translating broad guidance into swift, concrete actions for thousands of regional providers remains a challenge, underscoring the need for efficient, localized communication channels.
Expansion discussions: space, data centers
Lawmakers have explored expanding the list of critical infrastructure sectors to include space systems. Advocates emphasize that space assets underpin national security and economic stability, arguing for explicit protection within a modern risk-management framework. Separately, experts say the rapidly growing role of data centers and cloud services warrants a dedicated national category to reflect their centrality to everyday services and security, beyond traditional communications infrastructure.
Policy discussions also highlight gaps in a unified approach to data-center security. Some stakeholders urge creating a distinct designation for data centers to better align standards, funding, and coordinated response across public and private networks.
Looking ahead
Overall, observers caution that without renewed investment in engagement capabilities and a clear framework for expanding infrastructure designations, coordination among government, industry, and local providers could weaken at a time when cyber threats are accelerating across diverse sectors.
