
As a software engineer who uses CISA as one of my sources for evolving cybersecurity threats to keep the rest of my company updated, this is not ideal. CISA will be slower to respond to time-sensitive threats and support large enterprises (if needed - no clue how that works in practice, since large enterprises usually pull in a private incident response company if something serious happens)
The CVE program, which assigns identifiers so that people can communicate easily about vulnerabilities, is run by a contractor, so fortunately, that’s not going to be affected. But the Known Exploited Vulnerabilities (KEV) catalog is managed by CISA, and that may be slower to update. Because CISA almost let the funding lapse for the CVE program last year, more organizations have come together to make their own solutions that provide similar resources to CISA for the private sector…
…They still can’t replace an agency with the backing, resources, and authority of the federal government, but it does help make sure we’re not entirely in the dark during gov shutdowns. The EU has their own programs too now, because people realized the entire world was effectively reliant on one US gov-funded program