CISA Restructures Amidst New Cybersecurity Challenges and Workforce Changes

Key facts

• The Cybersecurity and Infrastructure Security Agency (CISA) is shrinking as part of a wider federal workforce reduction.
• Reports in April 2025 put the planned cut at up to 1,300 people, about half of full-time staff plus many contractors.
• Voluntary resignation, early retirement and buyout offers came first, with layoff notices expected later.
• Critics warn the cuts could weaken threat hunting and support for critical infrastructure.

Why CISA is cutting staff

The changes at the Cybersecurity and Infrastructure Security Agency (CISA) are part of the Trump administration’s broader push to reduce the federal workforce. The White House has also been openly critical of CISA’s past work on election security and misinformation. CBS News first reported in early April 2025 that as many as 1,300 people could be pushed out or offered incentives to leave an agency that employed nearly 3,400.

Which CISA offices face cuts

According to Recorded Future News, the plan would cut about half of CISA’s full-time staff and 40 percent of its contractors. The National Risk Management Center, which analyzes risks to critical infrastructure, and the Stakeholder Engagement Division, which coordinates information sharing with companies and other agencies, were expected to take large cuts. The threat hunting team would be reduced but not eliminated.

By mid-April CISA had joined the Department of Homeland Security’s deferred resignation, early retirement and voluntary separation programs. An agency spokesperson did not say how many employees had signed up. At least 130 CISA jobs had already been cut in February as part of a DHS-wide reduction of probationary staff.

The threats CISA still has to cover

The cuts come while the agency’s workload keeps growing. Ransomware crews keep hitting hospitals and utilities, and state-backed groups such as China’s Volt Typhoon have been found inside U.S. critical infrastructure networks. CISA is responsible for helping defend more than a dozen infrastructure sectors.

What the agency is expected to keep doing

Its core functions remain on the books:

• Threat intelligence: Collecting and publishing warnings about active exploitation, including the Known Exploited Vulnerabilities catalog that federal agencies must patch against.
• Public-private partnerships: Working with infrastructure operators, many of them private companies, to share warnings and coordinate responses.
• Information sharing: Moving indicators and advisories quickly between government and industry. The Stakeholder Engagement Division that handles much of this is one of the units facing cuts.

What the cuts could mean

Former officials and lawmakers have questioned what the agency can keep doing with far fewer people. Rep. Eric Swalwell, ranking member of the House cybersecurity subcommittee, asked acting director Bridget Bean for a formal briefing on the cuts on April 10, 2025.

Mark Montgomery of the Foundation for Defense of Democracies told Nextgov the firings “are actually harming national security on a daily basis — this goes well beyond disruption and is actually destabilization.”

A plan still under review

At the end of April, Bean told staff the restructuring plan had been drafted but still needed review by DHS, the White House and the Office of Personnel Management. Its release would also wait for input from Sean Plankey, the nominee for CISA director.

What it means for CISA’s partners

For infrastructure operators and state and local governments that rely on CISA, the practical question is which services will continue at the same level. Organizations that depend on CISA assessments, regional advisors or threat hunting support should confirm their contacts and plan for slower responses.

For everyone else, CISA’s public advisories and the KEV catalog remain the agency’s most visible output. Watch whether those keep their pace as the cuts take effect.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.