CISA's money came back. Its people didn't.

The Cybersecurity and Infrastructure Security Agency is the federal government's civilian defender of the systems everyone else's systems depend on — the networks federal agencies run on, and the power grids, water utilities, and election infrastructure the country runs on.▸ In 2025 its budget and its workforce became a political fight, and by 2026 the fight produced two contradictory facts that are both true at once: Congress refused to let CISA shrink, and CISA shrank anyway.

CISA's own FY2026 Congressional Budget Justification, submitted in June 2025, asked to shrink the agency from 3,732 positions funded in FY2025 to 2,649 in FY2026 — a cut of 1,083 positions, 970 full-time equivalents, and $494.67 million, net of pay and inflation adjustments elsewhere in the budget.▸ Program by program, the request's gross reductions came to $689.4 million, offset only by a single $3 million increase for 2026 World Cup and America 250 security work.

The single largest target was mission support — $132.4 million and 116 positions, which eliminates CISA's Office of Equity, Diversity, Inclusion and Accessibility under Executive Order 14151 and consolidates back-office functions.▸ The National Risk Management Center, which coordinates cyber and physical risk analysis for critical infrastructure operators, loses $70.4 million and 35 positions. A Workforce Transition Program — deferred resignations, early retirement, and separation incentives — accounts for $64.9 million and 325 more positions, on top of $63.8 million cut by simply eliminating 301 positions that were funded but already vacant. Smaller, but politically loud: the agency's own Election Security Program — the advisors in each of CISA's ten regions and the Elections Infrastructure Information Sharing and Analysis Center — was proposed for outright elimination, 14 positions and $39.6 million.

Congress didn't take the deal.▸ The Homeland Security Appropriations Act, 2026 (P.L. 119-86), enacted April 30, 2026, provides $2.6 billion for CISA — well above the request — and both the Senate committee's summary and the House committee's summary agree on the specifics: $20 million to fill critical vacancies the administration had proposed eliminating, and — per the Senate summary — an additional $40 million to continue election security activities funded back in fiscal year 2024. The enacted law also directs CISA to "maintain a workforce consistent with the personnel and FTE funded" by the act and bars the agency from reducing staff "in such a way that it lacks sufficient staff to effectively carry out its statutory missions."

That should have settled the fight. It didn't settle the headcount.

Money restored by an April law can't undo resignations processed the year before.▸ On February 11, 2026 — three days before a lapse in DHS appropriations actually began — CISA's Acting Director, Madhu Gottumukkala, testified to the House Appropriations Subcommittee on Homeland Security that CISA employed 2,341 people total, of whom 888 would be designated "excepted" and required to work without pay if funding lapsed. That headcount is not the administration's request (2,649). It is lower than the request — the deferred resignations, early retirements, and separation incentives the FY2026 budget proposed had, by the time Congress finished restoring the money, already run their course.

Congress's April law can staff back up going forward — the $20 million for critical vacancies is new hiring money, not a headcount that snaps back on its own — but hiring cyber-defense specialists takes months no appropriations bill can compress.▸ For as long as that hiring lags, the agency operates below both what it asked for and what Congress ordered.

Dollar and position figures for the FY2026 request are drawn from CISA's own Congressional Budget Justification and may not sum to the cent across tables due to independent rounding and separate pay/non-pay base adjustments, as noted in the data. The Feb. 2026 headcount is a single point-in-time figure from sworn testimony, not a monthly series; more recent counts may differ.