Midterm Results Set to Reshape US Cybersecurity Policy

"Congressional Democrats are likely to take a more assertive posture on the role of the federal government in promoting cybersecurity," said Doc McConnell, Head of Policy and Compliance at Finite State.

Cybersecurity Information Sharing Act of 2015: a likely early win

McConnell identifies a concrete first move: a durable reauthorization of the Cybersecurity Information Sharing Act of 2015. He argues the law’s liability protections are central to voluntary private-sector sharing of threat and vulnerability information, and that the recent string of short-term extensions has eroded the confidence those protections provide. A multi-year reauthorization, he says, could arrive either in the lame-duck session or early in the new Congress and would restore the predictability that voluntary sharing depends on.

CISA’s capacity, budget pressures, and the summer water intrusions

McConnell frames a second priority as rebuilding federal capacity to defend critical infrastructure. He says CISA has "lost roughly a third of its workforce, has seen programs and partnerships contract, and has faced proposed budget cuts of hundreds of millions of dollars," while attacks on critical infrastructure have intensified. He points to this summer’s coordinated intrusions into water systems — "which began with more than thirty Minnesota utilities in late July and reached at least a dozen states" — as a stark reminder that coordinated intrusions demand coordinated defense.

On the policy front, McConnell expects attention to land first as reauthorization and funding for the State and Local Cybersecurity Grant Program, directing resources to smaller operators responsible for local water, power, and other critical services.

Supply chain transparency: piecemeal rules and an opportunity to harmonize

McConnell calls supply chain transparency the third likely shift. He describes current policy as "piecemeal," citing formal rules for connected vehicles, an executive order for the bulk power system, and FCC actions that "have created sudden and sharp disruptions for consumer technology companies." Because concern about foreign technology in U.S. systems is bipartisan, McConnell argues there is political room to continue current trends and to "streamline and harmonize these requirements across sectors," balancing security and transparency while giving manufacturers predictable rules for long-term investment decisions.

AI agents, NIST work, and the enterprise responsibility

Ryan McCurdy, Vice President of Marketing at Liquibase, frames the operational side: regardless of congressional priorities, enterprises face persistent challenges as AI agents take on more responsibility for developing and deploying software. "As AI agents take on more responsibility for developing and deploying software, organizations need to rethink how they control what those systems are allowed to do," he said. McCurdy warns that an agent with legitimate access does not need to exploit a vulnerability to cause damage: "An agent doesn’t need to exploit a vulnerability to drop a production table. It just needs the right permissions."

He notes growing attention to AI agent identity and authorization, including "work underway at NIST," but stresses access control is only part of the problem. Organizations must enforce policies about the changes agents make, validate changes before execution, and maintain evidence of what occurred. McCurdy’s bottom line: "Regardless of where federal policy goes, organizations remain accountable for what reaches production. The same standards should apply whether a change comes from a developer, an automated pipeline, or an AI agent."

How state and local operators, technologists, and enterprises are likely to respond

• State and local operators: They will watch for reauthorization and funding for the State and Local Cybersecurity Grant Program and prepare to absorb or request resources aimed at shoring up local defenses — especially in sectors like water utilities where coordinated intrusions occurred this summer.
• Technologists and security teams: Expect a sharper focus on identity, authorization, and auditability for automated systems and AI agents, aligning internal controls with any federal guidance that emerges and with the "work underway at NIST" McCurdy noted.
• Affected enterprises and procurement leaders: They will weigh how supply chain rules — from connected vehicles to the bulk power system and FCC actions affecting consumer technology — may be harmonized, and they will press for predictability to support long-term investment decisions.

The contours of change are specific: multi-year reauthorization for the Cybersecurity Information Sharing Act of 2015; efforts to rebuild CISA capacity and fund state and local grants after this summer’s water-system intrusions; and an attempt to convert a piecemeal set of supply-chain rules into a harmonized framework. Those moves, McConnell and McCurdy argue, would restore predictability for sharing, strengthen defenses at the local level, and force enterprises to reckon with how they control and audit increasingly autonomous development agents. Whether Congress acts in the lame-duck or waits until the new session, the measurable choices are clear: reauthorize, fund, and harmonize — or leave existing fractures in place while the operational risks McCurdy describes continue to multiply.

Source: What the Midterm Results Could Mean for US Cybersecurity Policy — Security Magazine