DHS Shutdown Guts CISA: Agency at 38% Capacity, CIRCIA Cyber Reporting Town Halls Postponed

CISA is operating at 38% capacity following DHS-wide staff reductions, forcing postponement of CIRCIA town halls that were designed to gather industry input on mandatory cyber incident reporting rules. The final CIRCIA rules, which will require critical infrastructure operators to report incidents within 72 hours and ransomware payments within 24 hours, are delayed until at least May 2026. The capacity shortfall comes as Iran-linked cyber threats escalate and the Cybersecurity Information Sharing Act extension runs through September 2026.