CISA audit sparks debate about cybersecurity pay incentives

An audit that castigated the Cybersecurity and Infrastructure Security Agency’s cybersecurity pay incentives is worrying CISA staffers who say the report lacks context and could give the Trump administration an excuse to end a vital retention program.

The recent Department of Homeland Security inspector general report found that CISA had given the agency’s Cybersecurity Retention Incentive payments to hundreds of employees who didn’t qualify for them and that CISA wasn’t properly overseeing the incentives, which totaled $138 million from fiscal years 2020 to 2024. CISA paid $1.4 million in incentives to 348 people who didn’t deserve them, according to the report, which recommended that the agency consider “whether it is appropriate to seek repayment” from those workers.

Auditors said they had identified “240 employees who received the Cyber Incentive from various mission support offices whose role was not directly related to cybersecurity,” including on CISA’s strategy, external-affairs, and workforce-engagement teams.

Read more at Cybersecurity Dive