CISA Revises Cyber Pay Incentives Amid Staff Retention Concerns

• •CISA's CRI program continues but with stricter eligibility criteria.
• •Concerns arise over potential staff losses due to revised performance rating caps.
• •The program aims to address high vacancy rates in CISA's cybersecurity workforce.

The Cybersecurity and Infrastructure Security Agency (CISA) will continue its Cybersecurity Retention Incentive (CRI) program through fiscal 2027, but with revised eligibility criteria that may reduce the number of qualifying employees. The changes tie eligibility to job series and performance ratings, raising concerns about potential staff losses following widespread resignations last year. The Office of Personnel Management has capped higher performance ratings governmentwide, which could further impact retention. The program aims to address ongoing vacancy rates within CISA's cybersecurity workforce, allowing qualifying employees to receive pay increases of up to 25% of their base salary. Last December, CISA had announced plans to eliminate the incentive program due to mismanagement, but the new policy focuses on targeting cybersecurity functions. The revised criteria went into effect on October 1, 2026.