What Kristi Noem’s cyber cuts really mean for America’s security

Kristi Noem promised a whole of government push on cybersecurity. Nine months in, the record shows the opposite. The Department of Homeland Security says it has refocused the Cybersecurity and Infrastructure Security Agency on core missions. On the ground, staffing has been slashed, election security support has been stripped back, and state and local partners have been left with fewer lifelines. Words say one thing, actions say another.

The gap between the podium and the perimeter

CISA’s headcount has dropped to roughly 2,500, a loss of nearly 1,000 people. Only about 900 have been designated essential during the shutdown, the rest furloughed or shown the door. Teams that helped secure digital and physical aspects of U.S. elections have been hit. Stakeholder engagement staff who work directly with states, cities, and foreign partners have been laid off or reassigned. Funding for the Multi State Information Sharing and Analysis Center has been discontinued, undercutting the most widely used threat sharing service for state leaders.

DHS insists this is a reset after supposed excesses. It points to continued private sector engagement, new guardrails, and timely intelligence. The reality for many defenders is a larger workload with fewer people, less money, and rising expectations. That is not a refocus. That is a retreat.

Timing could not be worse

The threat landscape is not standing still. China linked operators have probed power and transport networks. Other state actors have used U.S. telecoms to spy on Americans. Recent intrusions abused widely used software to reach into federal agencies. The 2015 Cybersecurity Information Sharing Act has lapsed. CISA’s State and Local Cybersecurity Grant Program has lapsed as well, removing about one billion dollars in planned help for basic resilience. You cannot fight a faster opponent with fewer players and fewer tools.

Politics has crowded out protection

CISA was created during the Trump era, then fell out of favor after it pushed back on false election claims. The new line accuses the agency of drifting off mission and policing speech. That grievance has become budget policy. Immigration and law enforcement now dominate DHS attention. Cyber is treated as optional. State and local governments, along with critical industries, are told to pick up the slack. Many of them already operate on thin margins with legacy systems that were never designed for today’s threat tempo.

Cutting core capacity is a choice with consequences

When you hollow out the only federal agency chartered to defend civilian critical infrastructure, you handicap hospitals, water utilities, small banks, rural counties, school districts, and the vendors that connect them. You weaken the connective tissue that finds and shares indicators in real time. You slow incident response. You increase the odds that a single exploit cascades across regions and sectors. Our adversaries read the same budget sheets. They know when the referee has fewer whistles.

What should happen next

• Restore CISA staffing to pre cut levels, then grow selectively in field roles that support states and sectors.

• Reinstate funding for the Multi State Information Sharing and Analysis Center, and formalize support for other sector ISACs.

• Reauthorize and modernize the 2015 information sharing law, with clear liability protections and privacy guardrails.

• Restart the State and Local Cybersecurity Grant Program, tie awards to measurable outcomes, and prioritize small and under resourced jurisdictions.

• Nominate and confirm CISA leadership quickly, then give that leader stable authorities and public backing.

• Keep election security inside scope. Voters expect ballots to be counted, not contested by malware.

The measure that matters

Cyber policy is not judged by conference speeches. It is judged by whether hospitals can schedule surgeries after a ransomware hit, whether a small city can restore water pumps after a breach, whether a county clerk can run an election without hysteria and without malware. Right now, the administration is trading capacity for talking points. If that continues, the cost will be paid by the people doing the work and by the citizens they serve.

The promise was bigger, faster, and smarter. The practice has been smaller, slower, and riskier. That is not a course correction. That is an invitation.