Boosting National Defense: Critical Funding Needed for CISA’s Cybersecurity Mission

At a glance

• CISA’s Role: The Cybersecurity & Infrastructure Security Agency (CISA) leads federal efforts to protect U.S. critical infrastructure from cyberattacks.
• Funding Gaps: Advocates say tight budgets are limiting what CISA can do.
• Critical Infrastructure Protection: Energy, healthcare and transportation depend on the agency’s warnings and support.
• Innovative Approaches: New programs, such as incident reporting rules, need staff and money to work.
• Policy Recommendations: The Information Technology and Innovation Foundation (ITIF) is urging Congress to fund CISA rather than cut it.

The budget fight over CISA

The Cybersecurity & Infrastructure Security Agency (CISA) is the federal agency charged with protecting U.S. infrastructure from cyberattacks, and its supporters say it is being asked to do more with less while threats from criminal gangs and foreign governments keep growing. Congress is weighing its budget now. Critics want a smaller agency.

What CISA does

CISA’s mandate covers critical infrastructure sectors such as energy, healthcare and finance. It is the federal lead for civilian cybersecurity, warning organizations about threats and helping them recover from incidents. Much of its work depends on cooperation with state and local governments and private companies.

Where the money falls short

Supporters argue that CISA’s budget has not kept pace with its responsibilities. Without enough money, the agency faces limits on personnel, outdated technology and less capacity to develop new protective tools.

The case for more money

Advocates say current funding does not match the agency’s plans. Thin budgets slow risk assessments and delay new programs.

Infrastructure at risk

Attacks on essential services can disrupt whole communities, threaten public safety and erode trust in government. Transportation, energy and healthcare are especially exposed. Hospitals have had to divert ambulances, and pipelines have shut down.

CISA’s plans

CISA wants to use new technology to anticipate threats rather than react after the damage is done. That costs money.

What advocates want from Congress

More money would let CISA hire, update its systems and expand its services, and policymakers and industry groups are lobbying Congress to provide it.

ITIF’s recommendations

In an April 30, 2025 report, the Information Technology and Innovation Foundation (ITIF) argued that Congress should fund CISA instead of cutting it. Its priorities include staffing for incident reporting under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), the State and Local Cybersecurity Grant Program, and long-term support for the CVE Program. ITIF also stresses information sharing with the private sector.

What happens if the money doesn’t come

CISA’s backers say it cannot keep up without steady funding. Threats against infrastructure are not shrinking. Whether Congress agrees will show up in the next budget.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.