CISA Force Structure Assessment Act
- Sponsor
- Rep. Walkinshaw, James R. [D-VA-11]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Sep 16, 2026
Bottom line
The bill requires a detailed, congressionally mandated review of CISA's capabilities and resources to ensure it is adequately equipped to address current and future cybersecurity threats to federal systems and critical infrastructure.
What it actually does
This bill mandates that the Director of the Cybersecurity and Infrastructure Security Agency (CISA) conduct a comprehensive force structure assessment. This assessment will evaluate CISA's ability to fulfill its mission, specifically focusing on the resources, personnel, training, and certifications needed across 12 critical areas, including federal information security, critical infrastructure resilience, and emerging technologies like AI and quantum computing. The Director must consult with stakeholders and submit a report with recommendations to Congress within one year.
Proponents argue
Supporters argue that a thorough, independent assessment is crucial for CISA to adapt to the rapidly evolving cyber threat landscape and emerging technologies. This proactive review ensures the agency has the necessary staffing, specialized training, and resources to effectively protect national security and critical infrastructure, identifying and addressing potential gaps before they lead to significant vulnerabilities.
Opponents contend
Critics might contend that such a broad assessment could be redundant with CISA's ongoing internal reviews and strategic planning efforts, potentially diverting valuable personnel and resources from active cybersecurity operations to administrative tasks. Some may also express concerns about the potential for bureaucratic bloat or the cost implications of recommended expansions without a clear, independently verified justification.
The bill is very short and clearly written, making it highly accessible for any reader to quickly understand its core requirements and implications.
Section 2(a)
CISA Force Structure Assessment Mandate
This section mandates that the Director of the Cybersecurity and Infrastructure Security Agency (CISA) must conduct a comprehensive assessment of the agency's capacity to carry out its mission. This assessment is intended to evaluate whether CISA has the necessary personnel, training, and resources to effectively address its responsibilities in securing the nation's cyber and physical infrastructure.
Supporters argue
Supporters argue this assessment is vital for CISA to remain agile and effective in a rapidly changing threat landscape. It provides a data-driven approach to identify and address resource gaps, ensuring CISA can adequately protect critical assets and respond to sophisticated cyber threats.
Critics contend
Some might argue that CISA already conducts internal reviews and that a congressionally mandated assessment could be duplicative or overly prescriptive, potentially diverting resources from operational cybersecurity work.
Tradeoffs
The tension lies between the need for comprehensive oversight and strategic planning versus the potential for administrative burden on an agency already stretched by ongoing cyber threats.
Section 2(b)
Specific Elements of the Assessment
This section details the specific areas CISA's force structure assessment must cover. These include the security of federal information systems, support for state and local governments, analysis of cyber incident reports, CISA's role as a Sector Risk Management Agency, addressing emerging technologies like AI and quantum computing, international cooperation, cyber defense operations, threat hunting, the Joint Cyber Defense Collaborative, operational technology security, cyber asset response, and the Alliance of National Councils for Homeland Operational Resilience - Critical Infrastructure. It also requires assessing personnel training and industry-recognized certifications.
Section 2(c) and 2(d)
Stakeholder Consultation and Reporting
This section requires CISA to consult with various stakeholders, including other federal agencies, Information Sharing and Analysis Organizations (ISAOs), sector coordinating councils, and State, local, Tribal, and territorial governments, while conducting the assessment. Furthermore, CISA must submit a detailed report of the assessment results, including recommendations for addressing any identified shortages or gaps, to the House and Senate Homeland Security Committees within one year of the bill's enactment.