Loading story…
Senior officials at NIST said significant workforce and budget reductions are forcing the agency to narrow and reprioritize work tied to national security and cybersecurity, including mandates related to AI, cybersecurity, and post-quantum encryption. NIST’s Information Technology Laboratory reported losing roughly 89 staff over the past year (within a headcount of 289), amid broader agency reductions of 700+ positions, and warned that additional congressional cuts (including a proposed $13M reduction to NIST’s labs program) could further constrain technical programs such as cryptographic testing and validation used for federal procurement and joint validation efforts with the Canadian Centre for Cybersecurity.
On Capitol Hill, House Homeland Security Committee Democrats pressed CISA Acting Director Madhu Gottumukkala on major workforce reductions—reported as about one-third of the agency’s employees departing over the past 12 months—and whether the agency can sustain its mission under current funding and staffing levels. Gottumukkala defended the reductions as part of a “mission-first” effort to eliminate duplication and align work to statutory authorities, while also signaling targeted hiring for key roles but declining to provide lawmakers a clear vacancy count or a definitive answer on whether recently appropriated DHS funding is sufficient for CISA to execute its responsibilities.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
NIST officials said the agency entered 2026 with reduced staffing and budget pressure, forcing it to narrow and reprioritize work across cybersecurity, AI, and post-quantum cryptography efforts.
At a House Homeland Security Committee hearing, Democrats questioned Acting Director Madhu Gottumukkala about major workforce reductions, DHS-directed reassignments, and CISA's ability to meet its mission amid reported staff losses.
NIST recently completed testing of its first post-quantum cryptographic module as part of the U.S. government's transition to quantum-resistant encryption.
By early 2026, NIST reported reducing its cryptographic validation backlog from nearly two years in 2020 to about six months, though officials said staffing losses were limiting further gains.
A staffing chart entered into the congressional record showed 65 involuntary reassignments at CISA, and lawmakers said some staff were placed on administrative leave amid an ongoing investigation tied to a failed polygraph incident.
Since President Trump took office, both CISA and NIST's Information Technology Laboratory have experienced significant personnel losses, with CISA later recording 998 departures during that period.
NIST officials said the agency's cryptographic testing and validation backlog reached nearly two years in 2020, reflecting the labor-intensive nature of its review process.
CISA's reported attempt to reassign CIO Bob Costello was later reversed, becoming one of several internal personnel incidents raised by lawmakers.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bipartisan lawmakers and private-sector cybersecurity leaders warned that the U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) has been significantly weakened after roughly a year of personnel cuts and layoffs under the second Trump administration, with reporting indicating the agency has lost about **one-third of its workforce** and shuttered or reduced entire divisions. Sources described diminished ability to execute core missions such as coordinating with industry and protecting federal civilian networks, with some organizations reportedly seeking alternatives (industry alliances, outside consultants, or direct government-to-government partnerships) rather than relying on CISA support. Reporting also tied the degradation to a prolonged **leadership vacuum**—with the administration’s nominee **Sean Plankey** not confirmed and Acting Director **Madhu Gottumukkala** criticized by some sources as struggling to lead—alongside political and operational pressures that deprioritized the agency. Specific capability impacts cited include reduced **counter-ransomware** efforts, work to promote **secure software development**, and losses affecting **election security** functions; additional strain was attributed to reassignment of staff to other DHS priorities and to a partial federal government shutdown that further reduced available staffing levels, raising concerns about CISA’s readiness to respond to a major cyber crisis.
Jun 29, 2026
The acting director of the Cybersecurity and Infrastructure Security Agency (**CISA**), **Madhu Gottumukkala**, faced escalating scrutiny over leadership and personnel decisions as the agency manages ongoing threats to federal networks and critical infrastructure. Reporting describes an attempted management-directed reassignment of CISA CIO **Robert Costello**—a process that can force an employee to transfer within DHS or resign—that triggered immediate objections from career staff and senior political appointees, leading DHS headquarters to pause and then halt the action the same day. Lawmakers on the House Homeland Security Committee pressed Gottumukkala on broader staffing reductions and whether CISA retains sufficient capacity to execute its mission, including questions about efforts to push out staff and a reported attempt to remove the CIO. A chart entered into the hearing record cited a drop in personnel from **3,387 to 2,389** (a reduction of **998**), figures that aligned closely with Gottumukkala’s testimony; he also cited a **7.5%** attrition rate last year and asserted the agency has “the required staff,” while members warned that cutbacks could weaken national cyber defenses and increase exposure of critical systems and infrastructure.
Jun 29, 2026
Senators and cybersecurity experts warned that **CISA** is operating under growing strain as the **Department of Homeland Security shutdown** and the absence of stable leadership compound earlier cuts to the agency’s workforce and budget. During his confirmation hearing, DHS secretary nominee **Markwayne Mullin** was pressed on whether he would restore staffing and funding after roughly one-third of CISA’s workforce was cut, but he declined to commit to rehiring personnel or reversing budget reductions, saying only that the agency would be staffed to remain mission capable. Security professionals said CISA can still perform its core statutory functions with excepted staff, but the loss of personnel, sidelining of employees during the shutdown, and lack of a permanent director are limiting the agency’s ability to sustain non-essential programs, build new capabilities, and advocate for long-term resources. Even as CISA continues to issue operational guidance, including recent warnings tied to **Microsoft Intune** hardening and patching of vulnerabilities in products such as **Synacor Zimbra Collaboration Suite** and **Microsoft Office**, the broader concern is that reduced staffing and weakened leadership are eroding national cyber defense capacity at a time of elevated threat pressure.
Jun 29, 2026