US cybersecurity is weakened by congressional delays

The White House has restarted a stalled urgent priority by renominating Sean Plankeyas director of CISA. Experts say the step offers some relief but is not enough to resolve the broader congressional inertia that continues to strain the nation’s cyber defenses.

See also: China bans cybersecurity software from US and Israel

Some have accused the White House of a lack of engagement with cybersecurity issues and pushing them through Congress, while others say Congressional dysfunction is the bigger problem. Referring to the Trump administration’s broader approach to cyber policy, Jim Lewis, SVP and director of the technology and public policy program at the Center for Strategic and International Studies (CSIS), tells CSO, “Cybersecurity is not a priority for these people.” But Ari Schwartz, director of cybersecurity services at Venable, sees Congress as the biggest culprit.

“It’s very difficult to get bills through Congress, and it’s proving to be very difficult for some of these candidates to get through, even when they have bipartisan support. That signals that we can’t get things done, and that’s extremely problematic,” he tells CSO. The problems that result from inaction in these areas could start to show as early as next month and worsen thereafter if further action isn’t taken.

Some experts hope that Congress or the administration will step in to address the shortcomings, though they warn that solutions will not come quickly. The end of the year for Congress on Dec. 31 has allowed Plankey’s nomination to expire, requiring a new nomination process. Experts say the longer Plankey waits for confirmation, the longer CISA and U.S. cyber policy will remain dormant.

See also: Cybersecurity will accelerate this year, partly due to AI

Amid budget cuts brought about by Elon Musk’s Department of Government Efficiency, which has drastically reduced CISA’s staffing and institutional capacity, the continued lack of leadership at CISA has accelerated the loss of invaluable experience and created a triple cybersecurity failure — internal, domestic, and international — for the U.S., according to Megan Stifel, director of strategy at the Institute for Security and Technology.

A major cybersecurity bill called the Cybersecurity Information Sharing Act of 2015 (CISA 2015), which expired on September 30, was temporarily revived on November 13 and given a two-month life extension until January 30, 2026. The law provides critical legal liability protections that allow for the sharing of cyber threat information between agencies and the federal government.

The short-term extension appeared to secure a long-term renewal of the legislation, as lawmakers, the administration, and industry broadly agree that the failure to extend legal liability protection under CISA 2015 is unacceptable.

A murky landscape is emerging for another piece of unfinished business in Congress: a state and local cybersecurity grant program (SLCGP) administered by CISA. Most of the remaining funds in the $1 billion program were exhausted through Elon Musk’s Department of Government Efficiency in early 2025.

See also: AI: Emerging models enhance and threaten cybersecurity

Some experts say the bipartisan nature of cybersecurity gives them hope. “Cybersecurity, and particularly the protection of critical infrastructure and the defense of U.S. networks, remains a bipartisan issue,” Schwartz says. “That makes me feel better about the possibility of getting to a point where we’re moving forward again.”