Stories the budget tells

CISA's year-over-year change has two right answers, because there are two FY2026 figures. The Budget-in-Brief compares the request against the FY2026 annualized continuing resolution; the more meaningful comparison is against what was actually enacted in law. This monitor shows both and editorializes neither.

Both baselines, appropriation by appropriation, are on the overview.

The FY2027 topline falls, but the number understates what is happening underneath it. The request is a restructuring: whole missions move in and out of the agency at once.

A falling topline with a mission moving in and three moving out is the kind of change a single net number cannot carry — which is why the increases-and-decreases view is kept line by line.

The topline is authority; this is execution. In FY… CISA obligated … out of its own Treasury appropriation accounts.

The full feed and the largest awards are on the spending page.

CISA is not audited by itself — its accounts are consolidated into the Department of Homeland Security's financial statements. Those statements are clean.

DHS has posted a multi-year clean-opinion streak on the statements that include CISA. But CISA's missionis a different oversight story: protecting Federal information systems and cyber critical infrastructure has been on GAO's High-Risk List for over two decades. Clean books, and a burning platform — held apart, both cited.

The full record, and the internal-control caveat, are on the audit page.