Congressional appropriators move to extend information-sharing law, fund CISA

Congressional appropriators announced funding legislation this week that extends an expiring cyber threat information-sharing law and provides $2.6 billion for the Cybersecurity and Infrastructure Security Agency (CISA), including money for election security and directives on staffing levels.

The latest so-called “minibus” package of several spending bills to keep the government funded past a Jan. 30 deadline would extend the Cybersecurity and Information Sharing Act of 2015 through the end of the current fiscal year, Sept. 30. Industry and the Trump administration have been seeking a 10-year extension of a law that provides legal protections for sharing cyber threat data between companies and the government, but a deal on Capitol Hill has proven elusive.

The package, announced Tuesday, also would extend the expiring State and Local Cybersecurity Grants Program through the end of fiscal 2026. Both laws temporarily expired during the government shutdown before being included in broader government funding legislation that extended them through Jan. 30. The House Homeland Security Committee has approved legislation on a long-term extension of the grants program, but the Senate hasn’t taken any action on it.

Also notably, the “minibus” — with funding for Labor and Health and Human Services; Education and related agencies; Defense; Homeland Security; and Transportation, Housing and Urban Development and related agencies — includes an extension until Sept. 30 for the Technology Modernization Fund, a program focused on upgrading old and vulnerable federal tech that likewise has had difficulties getting an extension.

The legislation that funds the Department of Homeland Security (DHS) would provide $2.6 billion for CISA. The agency’s budget coming into the Trump administration stood at approximately $3 billion, and President Donald Trump sought nearly half a billion dollars less than that for fiscal 2026.

Under the bill, $39.6 million would go to continuing election security programs, namely election security advisers in each CISA region across the country and the continuation of the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC). Last spring, the organization that supports the EI-ISAC said it no longer was doing so after the Trump administration terminated funding, with DHS saying the EI-ISAC no longer aligns with its mission.

Despite going along with much of what Trump sought on the CISA budget total, the DHS funding bill gives the department a commandment on CISA staffing levels, which have been significantly reduced under the president.

“CISA shall maintain a workforce consistent with the personnel and FTE [full-time employee] funded by the pay and non-pay amounts provided in this Act,” according to a joint explanatory statement from appropriators. “CISA shall not reduce staffing in such a way that it lacks sufficient staff to effectively carry out its statutory missions, including cybersecurity and infrastructure security for the Federal Civilian Executive Branch agencies, SLTT [state, local, tribal and territorial] partners, Sector Risk Management Agencies, international partners, and other stakeholders.”

The House Appropriations Committee touted the DHS spending bill in a news release, saying that “from our borders and ports to aviation and cyber, we deliver the personnel, training, and technology to reinforce our security at every level.”

The fate of the minibus depends on a number of factors, among them the thin GOP House majority and rising Democratic opposition to funding for the Immigration and Customs Enforcement agency.