The Department of Homeland Security Office of Inspector General has found significant weaknesses in the Cybersecurity and Infrastructure Security Agency’s Cybersecurity Retention Incentive program, which was designed to help the agency attract and retain high-demand cybersecurity professionals.
In an audit released Thursday, the OIG reported that CISA distributed more than $138 million between fiscal years 2020 and 2024 but failed to adequately target payments to mission-critical personnel. Instead, broad eligibility rules and weak oversight led to unauthorized back payments and retention incentives being awarded to employees who did not meet program requirements.
The Potomac Officers Club’s 2025 Homeland Security Summit will convene senior DHS and industry leaders to address urgent challenges in national security, including workforce retention, cyber resilience and the protection of critical infrastructure. The summit offers a timely forum to examine how oversight, innovation and collaboration can strengthen homeland security missions. Register now to secure your place at this exciting homeland security event.
CISA’s Incentive Payments to Ineligible Employees
The OIG identified $1.41 million in questioned costs tied to back pay provided to 348 employees ineligible under program criteria. Incentives generally ranged from $21,000 to $25,000 per recipient each year, yet the agency often lacked documentation that recipients possessed “unusually high or unique qualifications” or that they were at risk of leaving federal service without additional compensation.
The watchdog further found that CISA broadened eligibility beyond approved guidelines by lowering the threshold of time employees needed to spend on NICE Framework cybersecurity work from 51 percent to 30 percent. The temporary change expired, but continued in practice, the report noted.
Oversight and Tracking Gaps
According to the OIG, the Office of the Chief Human Capital Officer did not maintain accurate, centralized records of recipients and payments, making it difficult to verify compliance. Required certifications attesting to mission-critical duties and retention risk were often missing or incomplete.
These management failures, the report said, undermine the program’s effectiveness and risk wasting taxpayer dollars while also discouraging highly qualified cyber professionals if incentives are not directed appropriately.
The watchdog warned that the deficiencies increase the risk of fraud, waste and abuse and undermine CISA’s ability to ensure that incentive funds are used effectively to retain critical cybersecurity talent.
OIG Recommendations and CISA’s Response
The OIG issued eight recommendations, including developing a formal risk management plan, tightening eligibility rules, reinstating clear criteria for cybersecurity work percentages, consolidating program oversight under a single office, improving recordkeeping and tracking, and recovering unallowed payments.
CISA agreed with all recommendations. The DHS Office of the Chief Human Capital Officer has set target dates in 2026 to implement updated policies, new tracking mechanisms and recovery actions.
