Congress asks GAO to price CISA's missing third, before the next 900 cuts land

The loss the letter actually points at is ownership, not headcount. Several senior CISA figures have left over the past year, among them David Stern, described as the driving force behind a key ransomware notification initiative ^[7]. The signatories concede they cannot say much more than that: little is known about how the cuts hit the agency, or whether the departed knowledge has been replaced at all ^[6]. That is the request in a sentence. Congress is asking the Government Accountability Office to find out what it no longer knows about an agency it funds.

The arithmetic is worth doing because nobody in the letter does it. If nearly 1,000 departures amount to nearly a third of the workforce ^[2][c2b], the pre-cut headcount was somewhere around 3,000 ^[2], leaving roughly 2,000 in place. Acting director Nick Andersen's 300 planned hires ^[3] would replace about 30 percent of what walked out ^[4], still leaving the agency around 700 people short of where it started ^[1]. The fiscal 2027 request to eliminate nearly 900 more positions and more than $700 million ^[9] would then take close to 45 percent of the remainder ^[3].

Against that, The Record reports that DHS Secretary Markwayne Mullin has said the department built a plan to rebuild CISA over the coming year ^[10]. Both things cannot be planning assumptions for the same organisation, and the letter says as much, citing confusion about what the administration intends ^[9]. Anyone deciding whether to route an incident through CISA next quarter is choosing between a rebuild narrative and a budget line.

The chair has been effectively empty throughout. CISA has had no confirmed director since Jen Easterly left at the end of the Biden administration ^[15]. Andersen holds the job on an acting basis after Madhu Gottumukkala was removed in February following a series of scandals ^[16], and Recorded Future News reported in June that Palantir's Shyam Sankar was a lead contender for the permanent post ^[17].

Timing is the sharpest part. Federal agencies warned this week of an active threat against critical infrastructure using AI-generated exploit scripts, which they called an evolution in capability ^[13]. Those joint advisories are exactly the product private defenders consume for free. GAO, meanwhile, has confirmed only that it received the request and is working through its process for deciding whether and when to do the work ^[14]. The threat guidance arrives now. The account of whether anyone is left to follow it up arrives later.