Lawmakers are moving to extend key cybersecurity information authorities and grant programs, while also providing funds for the Cybersecurity and Infrastructure Security Agency to fill “critical” positions.

The “minibus” appropriations agreement released by House and Senate negotiators on Tuesday includes fiscal 2026 funding for the Department of Homeland Security. DHS funding could be a sticking point in moving the bill forward, as some Democrats want more restrictions around the Trump administration’s immigration enforcement operations.

The bill also extends the Cybersecurity Information Sharing Act of 2015 (CISA 2015) and the State and Local Cybersecurity Grant Program through the end of fiscal 2026. Both laws are set to expire at the end of this month.

The extension would give lawmakers more time to work out differences between competing versions of CISA 2015 reauthorizations in the House and Senate.

Ross Nodurft, executive director of the Alliance for Digital Innovation, also applauded the extension of the Technology Modernization Fund included in the minibus.

“Reauthorizing the Technology Modernization Fund and the State and Local Cyber Grant Program for the rest of the fiscal year allows the government to invest money in new technology modernization and cyber security projects at the federal and state level while we work on more permanent, longer term reauthorizations and funding,” Nodurft said. “I am encouraged to see Congress put forward these stop gap measures and will continue to work with members to reauthorize these critical programs beyond 2026.”

CISA funding

The bill would include a cut for the agency CISA, with fiscal 2026 funding level set at $2.6 billion, about $300 million less than its current annual budget.

But CISA has already seen steep workforce cuts and program reductions under the Trump administration. The Trump administration proposed cutting CISA’s budget by roughly $500 million.

The appropriations agreement would specifically provide $20 million for CISA to hire additional staff to “critical positions,” according to the joint explanatory statement on the DHS appropriations measure.

That funding would be evenly split across five CISA programs: Threat Hunting; Vulnerability Management; Continuous Diagnostics and Mitigation; Security Programs; and Security Advisors.

The bill would also require CISA to “not reduce staffing in such a way that it lacks sufficient staff to effectively carry out its statutory missions.” Both Democrats and Republicans have expressed concerns about CISA losing roughly one-third of its staff over the past year.

Secret Service burnout

Appropriators are also taking aim at burnout within the Secret Service’s ranks. The funding measure provides $3.3 billion for the Secret Service as it embarks on a major recruiting initiative over the next two years.

That total would allow the Secret Service to “maintain ‘zero-fail’ mission by funding aggressive recruitment and retention to eliminate officer burnout, while modernizing high-tech training facilities and armored fleets to stay ahead of evolving threats
to our nation’s leaders,” according to a DHS spending bill summary provided by Senate appropriators.

The bill includes an increase of $46 million for Secret Service hiring in fiscal 2026. It also provides the agency with advance funding to prepare for the 2028 Olympic and Paralympic Games in Los Angeles.

But appropriators also want updates on the Secret Service’s recruitment and retention efforts. The explanatory statement directs the agency to provide briefings on its employee resiliency program and hiring projections, respectively.

“The briefing shall also include ongoing efforts to decrease the time to hire and increase yield rates from applicants to hires, as well as the impact that these hiring efforts will have on overtime costs,” lawmakers wrote.

FEMA staffing

The spending agreement also includes a “rejection” of staffing cuts made at the Federal Emergency Management Agency in fiscal 2025, according to the joint explanatory statement. The bill would provide $32 billion for FEMA, including $26.4 billion for the Disaster Relief Fund.

FEMA lost more than 2,000 employees to workforce reduction programs last year. And the agency has undertaken further staff reductions by not renewing Cadre of On-Call Response/Recovery Employees (CORE) in recent weeks. FEMA headquarters officials have also contemplated cuts totaling up to 50% of its workforce as part of a planning exercise shared with agency leaders in December.

Now, appropriators want FEMA to provide monthly briefings on the agency’s staffing levels and workload requirements.

“Such briefings shall also include projected staffing levels for the remainder of the fiscal year in light of the agreement’s rejection of the position reductions implemented in fiscal year 2025,” the joint explanatory statement reads.

The bill also requires FEMA to maintain staff “necessary to fulfill the missions” required of the agency by six separate laws and various other authorities. That staffing requirement, lawmakers emphasize, also applies to FEMA reservists and CORE staff.

The Trump administration has moved to shift more emergency management responsibilities to state and local governments. FEMA staffing reductions and policy changes over the last year have sparked concerns that the administration is implementing that plan despite there being no changes in the agency’s lawful responsibilities.

The post DHS spending bill bolsters staffing at CISA, FEMA, Secret Service first appeared on Federal News Network.

The past year in federal cybersecurity policy was full of uncertainty, as a change in administration, expiring authorities and the emergence of artificial intelligence converged and led to plenty of questions about the future of the cybersecurity landscape.

Going into 2026, cyber policymakers and experts are expecting some clarity, especially around the interplay of AI and cyber. Here are five things to watch when it comes to federal cyber issues as the new year gets underway:

New national cyber strategy

The White House is expected to issue a new national cyber strategy early in the new year. During an appearance at the Aspen Institute’s Cyber Summit in November, National Cyber Director Sean Cairncross said the strategy won’t be a lengthy document.

“It’s going to be a short statement of intent and policy and then it will be paired very quickly with action items and deliverables under that,” Cairncross said. “As a topline matter, it’s going to be focused on shaping adversary behavior, introducing costs and consequences into the mix.”

Cairncross said the strategy will feature six pillars. And he said the Office of the National Cyber Director is also working on a “workforce initiative” to address cyber talent gaps.

“There’s over half a million cyber jobs just on the decks now that need filling and there will be a need for more,” Cairncross said. “We need to align industry incentives, academic incentives, vocational school incentives, [venture capital] and bring them together collaboratively to better the workforce for the country.”

Morgan Adamski, a former National Security Agency leader and executive at PWC, said the cyber strategy’s expected focus on influencing adversarial behavior and offensive cyber operations points toward a shift toward “active defense.”

“Active defense is essential because it shifts security from a passive, reactive posture to a proactive one that actively reduces risk,” Adamski told Federal News Network. “Instead of waiting for threats to materialize and cause damage, active defense emphasizes continuous monitoring, rapid detection, and timely response. This approach shortens the window between intrusion and containment, limits the attacker’s ability to escalate, and protects critical assets before harm spreads. In an environment where threats evolve quickly and adversaries adapt, relying solely on static controls is insufficient.”

AI and cyber

Industry will be closely reading the strategy for what it says about the multifaceted issue of AI. Cyber experts generally divide the issue into three broad categories: securing AI systems and data; defending against AI-enabled cyber attacks; and using AI for cyber defense.

Drew Bagley, Crowdstrike’s vice president for privacy and cyber policy, pointed to how federal agencies have embraced the “zero trust” concept in recent years, as well as technologies like endpoint detection and response, and log management.

“Now it’s going to be increasingly important to think about how those same concepts are applied to AI,” Bagley told Federal News Network. “If AI is going to continue to be embraced at this rapid speed without there being visibility into what’s going out the door with AI, then you have a problem. You have another attack surface.”

Bagley said he’s watching for the Cybersecurity and Infrastructure Security Agency to provide the federal government with leadership on AI security.

“CISA can provide guidance to those who are implementing AI in federal agencies as far as what the security standards need to be to make sure that that AI is secure and that AI is not introducing a security threat in and of itself,” he said.

Meanwhile, agency chief information security officers are also considering how they can use AI to improve cyber defenses. Adamski said CISOs will have to focus on both securing AI systems and harnessing AI for cybersecurity at the same time.

“AI is becoming a genuine force multiplier for defense, especially in security operations where teams are overwhelmed and attackers move fast,” she said. “It can improve detection, speed up investigation, enhance threat hunting, and help prioritize what matters most. In many environments, that kind of leverage is the difference between containing an incident quickly and getting buried by volume.”

CISA 2015 reauthorization

While Congress typically doesn’t move major pieces of legislation during an election year, the reauthorization of cybersecurity information sharing authorities remains a pressing priority when lawmakers return from their holiday recess.

The Cybersecurity Information Sharing Act of 2015 lapsed on Oct. 1. Congress gave it a temporary revival as part of the continuing resolution to reopen the government, but the CISA 2015 authorities are set to expire again on Jan. 30.

Reauthorizing the law has broad bipartisan support, including from the White House. But House Homeland Security Committee Chairman Andrew Garbarino (R-NY) has acknowledged the path to reauthorizing CISA 2015 remains murky at best.

In the House, lawmakers have advanced Garbarino’s bill, the Widespread Information Management for the Welfare of Infrastructure and Government Act (WIMWIG Act), through the committee. The bill would extend CISA 2015 for another decade and provide key definitional updates.

“Our colleagues in the Senate have different ideas. Some of them want to do a 10-year clean [reauthorization]. I don’t know if I can get that passed in the House, with concerns from the Freedom Caucus,” Garbarino said at an event hosted by Auburn University’s McCrary Institute in December.

Meanwhile, Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul (R-Ky.) also opposes a “clean” reauthorization due to his concerns about agencies working with social media companies on disinformation, which occurred under separate authorities from CISA 2015.

“I don’t know how it gets done on its own,” Garbarino said. “I feel like we have to attach it to another piece of legislation, whether that’s government funding. But we need it passed and unfortunately I don’t think we’re close enough with the discussions on the Senate to figure out which bill will pass and what will get done.”

The upshot, Garbarino continued, is another possible short-term extension of CISA 2015.

“Which is unfortunate because we worked very hard to get our bill out of committee,” he added. “It took a lot of requests or advice from the private sector on updates. So we love our piece of legislation that we got done. When you get the trial attorneys to not object to your bill giving liability protection, that’s a pretty good thing.”

CIRCIA rule

CISA the agency, meanwhile, is set to issue a landmark cyber incident reporting rule that will apply to vast swaths of the 16 U.S. critical infrastructure sectors.

Congress passed the Cyber Incident Reporting for Critical Infrastructure Act in 2022. The law generally requires critical infrastructure organizations – in sectors like energy, water and telecommunications – to report significant cyber incidents to CISA within 72 hours.

The law represents the most far-reaching federal cybersecurity regulation ever passed by Congress.

In 2024, CISA released a proposed rule to implement the law. At the time, the agency estimated the rule will apply to some 316,000 entities across the country.

Industry has criticized the proposed rule for being overly broad and is also encouraging CISA to “harmonize” the rule with many existing cyber incident reporting mandates.

The Trump administration has delayed the release of the final rule until May 2026, providing CISA with more time to respond to those concerns.

Cyber leader gaps

Meanwhile, CISA also heads into 2026 without a Senate-confirmed leader. Trump nominated Sean Plankey to serve as CISA director in March. But Plankey’s nomination has been held up in the Senate for various reasons.

Most recently, Sen. Jacky Rosen (D-Nev.) has placed a hold on Plankey’s nomination due to concerns about the Coast Guard’s implementation of a new hate speech policy. Plankey has been serving as a senior advisor in the Coast Guard.

Meanwhile, the National Security Agency and U.S. Cyber Command is also still under acting leadership at the start of the new year.

The dual-hat role of NSA director and CYBERCOM commander is a key cybersecurity post, especially with the Trump administration’s emphasis on offensive cyber operations. The role had been held by Air Force Gen. Timothy Haugh, but Trump ousted Haugh in April, reportedly at the behest of far-right influencer Laura Loomer.

According to multiple reports, Trump now intends to nominate Army Lt. Gen. Joshua Rudd to lead the NSA and CYBERCOM.

And in Congress, Senate Homeland Security and Governmental Affairs Committee Chairman Gary Peters (D-Mich.) announced that he will not seek re-election in 2026, meaning he will retire effective January 2027. Peters has been one of the most influential members of Congress on cyber policy over the last decade.

The post Five things to watch in cybersecurity for 2026 first appeared on Federal News Network.