Democrats Move to Rebuild CISA Threat Sharing

Rebuilding CISA's public-private partnerships is a plan for the next Congress, with no restored channels yet in operation.

Updated on Nov. 6, 2026 in Cybersecurity

Democrats Move to Rebuild CISA Threat Sharing

Live Poll

Do you trust the federal government to protect critical infrastructure from cyberattacks?

House Homeland Security Committee Democrats plan to prioritize rebuilding the Cybersecurity and Infrastructure Security Agency (CISA), with Rep. Bennie Thompson naming it his top priority. The Administration forced out nearly one-third of CISA's staff, and this is a policy plan rather than an enacted change.

Why it matters

Eliminating key public-private partnerships last year reduced CISA's ability to coordinate with private operators of critical infrastructure. Democrats' House majority, won in the November 3, 2026 elections, gives them the gavel to pursue oversight and rebuilding in the next Congress.

The figures come from congressional statements and the agency's own staffing actions: nearly one-third of CISA staff were forced out, measured against the workforce before those departures. The $1 billion State and Local Cybersecurity Grant Program expires this year, and the source does not state whether it will be renewed.

The players

Rep. Bennie Thompson

Mississippi Democrat and likely incoming chair of the House Homeland Security Committee, who has made rebuilding CISA his top priority.

Sen. Maggie Hassan

New Hampshire Democrat who signaled interest in chairing the Senate Homeland Security and Governmental Affairs Committee.

Sen. Gary Peters

Michigan Democrat who is retiring and chairs the Senate Homeland Security and Governmental Affairs Committee.

Markwayne Mullin

Secretary of the Department of Homeland Security, the agency that oversees CISA, who received Thompson's records letter.

The details

CISA coordinates federal cybersecurity defense for critical infrastructure such as power, water and communications networks. Its public-private partnerships, including the Critical Infrastructure Partnership Advisory Council (CIPAC), let government and private operators share threat information. CISA recently unveiled ANCHOR-CI, a framework meant to restore that information sharing, but it is not yet operational.

Timeline

  1. July 1, 2026: CISA unveiled the ANCHOR-CI public-private framework.

  2. Last year (2025): Key partnerships, including CIPAC, were eliminated.

  3. November 3, 2026: Elections gave Democrats a House majority.

  4. November 11, 2026: Deadline for DHS written assurances that records have not been destroyed.

  5. January 2027: The new Congress convenes and committee chairs take office.

The Tech Race

The dispute is about whether the federal government can keep its cyber defense capacity for critical infrastructure while it reduces staff and program funding. Rebuilding CISA's partnerships under a new congressional majority would test whether a framework like ANCHOR-CI can replace the coordination lost when CIPAC was eliminated.

Operators of power, water and communications systems rely on CISA's threat-sharing partnerships, so any gap in those channels affects the services that households depend on. The $1 billion grant program that expires this year funds state and local cybersecurity work, and whether it is renewed is not yet known.

The takeaway

Watch whether DHS provides the written records assurances due November 11, 2026, and whether ANCHOR-CI becomes operational once the new Congress takes office in January 2027. Those two milestones will show whether the rebuilding plan moves from statement to practice.

What happens next

The DHS records assurances are due November 11, 2026, and the new Congress convenes in January 2027, when committee chairs take office.

Further reading

Explore more coverage in the Cybersecurity section for context on federal infrastructure defense.

Source note: This article includes information reported by Vitallaw.

Live Poll

Do you trust the federal government to protect critical infrastructure from cyberattacks?