's 'Unique Talent' Incentive Reached Nearly Half Its Staff
Summary
A pay bonus built to retain 's rarest cyber talent reached nearly half the agency. A inspector general found $138.2 million paid since FY2020 — including $1.41 million in back pay to 348 people that no record explains.
A program that never shrank
's Cyber Incentive spending rose every year the auditor reviewed⧉ — from $21.5 million to 897 employees in FY2020 to $31.9 million to 1,493 in FY2024, a partial year that still set the recipient record. 's HR office never kept a single tally of who got paid; auditors had to rebuild the numbers from four inconsistent internal reports.
View data as table
| FY2020 | $21,473,977 (897 recipients) |
|---|---|
| FY2021 | $24,379,121 (984 recipients) |
| FY2022 | $28,236,173 (1,125 recipients) |
| FY2023 | $32,157,538 (1,312 recipients) |
| FY2024 (Q3) | $31,927,791 (1,493 recipients) |
| Total, FY2020-FY2024 Q3 | $138,174,600 |
'Mission-critical' stretched to a third of the agency
The rule requires a job to demand unusually high or unique cyber skills. tested 25 CISA position descriptions⧉ and found not one documented that way — not even inside 's own Cybersecurity Division. In July 2021 had quietly cut the required share of cyber work from 51 percent to 30 percent; that policy expired in July 2022, but OCHCO confirmed the agency kept paying at the looser bar through the end of the 2024 audit. A 2019 internal memo had warned against exactly this drift: 'Only positions that have been identified as mission critical are eligible.'
View data as table
| Cybersecurity Division | 72.5% |
|---|---|
| National Risk Management Center | 65.2% |
| Stakeholder Engagement Division | 44.3% |
| Mission Support Offices | 32.7% |
| Integrated Operations Division | 24.2% |
| Infrastructure Security Division | 22.0% |
| Emergency Communications | 9.6% |
| CISA-wide total | 43.5% (1,401 of 3,220) |
$1.41 million nobody can explain
The sharpest finding stands apart from the eligibility fight. paid $1.41 million in back pay⧉ to 348 recipients between FY2022 and FY2024 with no documentation of why — money out, no paper trail. flagged the full amount as questioned costs and told to determine whether to recover improper payments program-wide. agreed and set an August 31, 2026 date; the inspector general judged the response not fully responsive and left the recommendation open.
- A program built to be narrow reached nearly half the agency. 1,401 of 's 3,220 employees drew the Cyber Incentive in a single 2024 pay period, spanning every division — including offices found had no direct cybersecurity role.
- loosened its own rule, then kept running on the loosened version after it expired. The July 2021 cut from 51 percent to 30 percent expired in July 2022; OCHCO confirmed it never reverted, through the end of the 2024 audit.
- $1.41 million has no paper trail, and repayment is still an open question. found no documentation for that back pay and flagged it as questioned cost; the recommendation to determine whether to recover improper payments program-wide remains open, not closed by 's concurrence.
No or employee is named in this piece; the audit identifies findings by office and role ("a official," "a senior OCHCO official"), not by name, and this piece follows that convention. "Questioned costs" is a federal audit term for spending an agency could not document as justified -- it is not, on its own, a finding of fraud or theft. All figures are drawn directly from 's published report (-25-38, September 11, 2025); 's corrective-action completion dates (July 31 and August 31, 2026) are the agency's own self-set targets, not independently confirmed completions.
Sources(2) ▾
- U.S. Department of Homeland Security, Office of Inspector General, CISA Mismanaged Cybersecurity Retention Incentive Program and Wasted Funds, Risking Critical Talent Retention (OIG-25-38) (2025-09-11) — The primary document -- a 24-page performance audit of 's Cybersecurity Retention Incentive (Cyber Incentive) program. Read in full: the transmittal memorandum (8 recommendations, concurrence, Recommendation 7 left open/unresolved), the Highlights page, Background, all three Results-of-Audit findings, the Conclusion, all 8 Recommendations, Management Comments and Analysis for each recommendation, Appendix A (Objective, Scope, and Methodology), Appendix B ('s full comment letter), Table 1 (Cyber Incentive recipients by division, Pay Period 13 2024), and Table 2 (Cyber Incentive recipients and dollar amounts by fiscal year, FY2020-FY2024 Q3). Retrieved and hash-verified directly from the 's own domain. oig.dhs.gov · original document
- U.S. Department of Homeland Security, Office of Inspector General, Report Fraud, Waste, Abuse, or Mismanagement -- DHS OIG Hotline (2026-07-22) — The 's own public hotline page, fetched this iteration to source the call-to-action: phone number, mailing address, and online reporting portal -- the same office ( ) that produced -25-38, one organizational level above 's own OCHCO, which administers the audited program. oig.dhs.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
built the Cybersecurity Retention Incentive⧉ in 2015 for a rare few: cyber specialists too valuable to lose to private-sector pay. A September 2025 DHS inspector general audit⧉ found that in a single 2024 pay period, 43.5 percent of 's entire workforce was drawing it — including public-affairs and workforce-engagement staff with no cybersecurity role. Total paid since FY2020: $138.2 million.