CISA is operating at roughly 38% capacity, with 888 of its 2,341 staff remaining at their desks during the DHS shutdown that began on 14 February 2026. The agency will stay functional but with reduced capability, and those recalled would be limited to teams whose work is deemed necessary to protect human life, property, or national security.
Despite the furlough, the KEV Catalog will remain online through the shutdown, and a new vulnerability added to it would be considered for exception from the Antideficiency Act if it threatened life, property or national security. CISA’s work on two high-profile items, the CIRCIA rulemaking and related regulatory activities, is expected to slow or halt, while ongoing tasks such as updating KEV require validation, patch availability checks, and agency liaising.
Those remaining at work will prioritise what can be done, with older exploited vulnerabilities likely receiving lower priority and delayed handling. In a pointed remark from acting CISA leader Madhu Gottumukkala, “When the government shuts down, our adversaries do not.”