"Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats," Maggie Hassan said in a statement to CyberScoop. Her words frame what Democratic control of both chambers of Congress will mean for a dozen interlocking cyber policy debates — from funding and staffing at the Cybersecurity and Infrastructure Security Agency (CISA) to AI safety, surveillance authorities and the shape of next year’s defense policy bill.
Leadership plans ahead on Homeland Security and CISA
With Democrats set to control the House and Senate, Maggie Hassan, D-N.H., is slated to take the gavel on the Senate Homeland Security and Governmental Affairs Committee after Sen. Gary Peters, Mich., retires. Hassan told CyberScoop that the committee must confront “emerging threats like artificial intelligence security risks and strengthening our cybersecurity,” and that the administration she named had “divert[ed] resources away from combatting fentanyl trafficking and gutting CISA.”
On the House side, Rep. Bennie Thompson, D-Miss., is expected to return as chair of the House Homeland Security Committee. Thompson described Democrats taking over at a “pivotal time for CISA,” noting the agency is “looking to add staff after cutting back by nearly one-third.” He said Democrats will “aim to work with CISA to expedite its critical re-staffing effort” and ensure the agency can help “critical infrastructure owners and operators rapidly improve their cybersecurity posture.”
Lame-duck deadlines and potential vehicles: Dec. 11 looms
A cluster of deadlines concentrates leverage in the lame-duck session. The long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is set to expire on Dec. 11. The Department of Homeland Security — and CISA by extension — is operating on a continuing resolution that also expires Dec. 11. Sources told CyberScoop that those synchronized expirations open options: a short-term extension through another continuing resolution, inclusion in an omnibus funding bill, or hitching reauthorization to the annual National Defense Authorization Act (NDAA), which Republicans have discussed finishing in the lame duck.
Former government cyber official Michael Garcia, now vice president at Monument Advocacy, said Sen. Rand Paul, R-Ky., has been the biggest obstacle to reauthorization in the Senate but could be “rolled” by GOP leadership onto an extension. If CISA 2015 cannot be finalized in the lame duck, CyberScoop reporting makes clear it will remain a top priority for 2027.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleLeadership shuffle and committee dynamics that will shape bills
The post-election shuffle matters beyond committee chairs. Sen. Rand Paul, while losing his gavel, remains capable of blocking legislation from the minority; what he does next could affect cyber bills in the next Congress. If Paul departs HSGAC, Nebraska Sen. James Lankford would be the likely top Republican there and is viewed by an industry source as a supporter of CISA 2015.
On the Intelligence Committee, leadership moves to Sen. Mark Warner, D-Va., a lawmaker who has “placed a big emphasis on cybersecurity” in his congressional career, according to CyberScoop. Incoming House Intelligence Chairman Jim Himes, D-Conn., is named later in the piece as a lawmaker who has fought for renewal of surveillance authority Section 702 in the past.
House Homeland Security subcommittee leadership is also shifting: Rep. Delia Ramirez, D-Ill., is poised to chair the panel’s cybersecurity subcommittee, with Rep. Vince Fong, R-Calif., set to be the top Republican. CyberScoop notes both have histories of bipartisanship, and that Rep. Andrew Garbarino, R-N.Y., while moving to the minority, has been willing to collaborate on cybersecurity issues.
Appropriations, oversight and the agency’s staffing and coordination
Democrats have signaled scrutiny of cuts to CISA and wider department changes. Thompson said Democrats will ensure funding “gets straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water.” The State and Local Cybersecurity Grants Program has expired and, even if reauthorized, will require appropriators to invest in it.
Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, noted an area of oversight focus could be the Department of Government Efficiency (DOGE) and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.” CyberScoop also observed that if the White House names a permanent nominee for CISA director, Democrats would be positioned to vet that person, and they would have influence over who leads the Office of the National Cyber Director should the incumbent, Sean Cairncross, depart.
What this means for CISA, state and local governments, and the Defense Department
- CISA: Expect committee-led pressure to re-staff the agency after cuts of “nearly one-third,” re-establish cross-sector coordination (including restarting Anchor-CI) and broaden operational support to owners and operators defending against AI-enabled attacks, per Thompson and Hassan.
- State and local governments: Reauthorization and new appropriations for the State and Local Cybersecurity Grant Program are priorities; Thompson said getting resources “straight into the hands for defenders” will be emphasized, particularly in under-resourced sectors such as water.
- Defense Department and AI vendors: Leiserson flagged an NDAA Senate provision that would require every artificial intelligence product sold to the Defense Department to include an AI bill of materials, and that the Senate bill contains a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations.
The immediate calendar and the committee map matter: Dec. 11 remains the pivot for reauthorization and funding, and Democratic committee leads have signaled a rapid appetite to rebuild CISA’s capacity while pressing on AI, grants, and oversight of prior agency changes. Whether CISA 2015 is extended in the lame duck or pushed into 2027, and how Democrats translate committee control into concrete staffing, appropriations and AI rules, are the specific next moves to watch.
Source: CyberScoop — What Democratic control of Congress means for cybersecurity
