The Cybersecurity and Infrastructure Security Agency (CISA) is operating at about 35% staffing (889 retained) during the US government shutdown, according to a Washington Post analysis, and the 2015 information-sharing liability shield has expired, per a CyberScoop explainer.
For US enterprises, that combination means slower federal coordination and more legal caution when submitting IoCs this week. Essential missions continue, but reduced headcount limits outreach and elements of joint coordination that security teams have come to expect during active intrusions.
CISA staffing amid US government shutdown
With most personnel furloughed, CISA’s reduced capacity narrows outreach and some joint coordination, even as essential functions continue. That means less bandwidth for real-time collaboration on emerging threats, and longer timelines for responses that typically rely on federal coordination.
Reduced capacity doesn’t mean CISA vanishes; it means responses stretch and prioritization sharpens. Enterprises accustomed to same-day coordination on novel attack patterns should prepare for delays or silence.
Intel-sharing safe harbor after the shutdown
The same CyberScoop explainer notes the expired protections formed the legal backbone that enabled companies to share indicators without added liability; without them, many will default to private channels until Congress acts, weakening collective detection in the near term. Legal teams will re-weigh antitrust, privacy, and contractual constraints before external reporting.
Immediate steps for CISOs
Prioritize sector ISAC and ISAO channels and trusted vendors for indicator exchange while federal capacity is constrained. Run quick counsel reviews before external reporting given the safe-harbor lapse context: scope of artifacts, PII, contractual constraints.
Rotate MFA for privileged accounts; increase log retention and telemetry for stronger post-incident forensics. Add a “shutdown mode” branch to IR playbooks, alternate escalation paths, comms trees, what to withhold or delay.
Simulate a breach coordinated primarily with ISACs and vendors within 48 hours. Confirm counsel sign-offs and disclosure timelines. Tabletops surface procedural friction before a real incident demands rapid, compliant decisions under duress.
