The US Senate voted on Sunday to advance a short-term funding bill for the federal government, moving the country closer to ending its longest-ever shutdown. Part of the spending bill also restores critical cybersecurity programs that lapsed as the shutdown began.

Nestled in the 94-page bill, which will now advance to the Senate floor for further debate before a final vote later this week, are measures that would extend the expiration date of the Cybersecurity Information Sharing Act (CISA Act) of 2015 and the Federal Cybersecurity Enhancement Act (FCEA). Both measures expired just as the federal government shut down on October 1. The FCEA codified federal network security rules, while the CISA Act (separate from the CISA agency) gives private companies permission to share threat indicators with the federal government.

Many consider CISA to be a critical cybersecurity law, and its lapse has been seen as a massive cybersecurity failure that opened the door to hostile foreign governments compromising the security of the federal government and sensitive information at private companies.

As of now, the version of the continuing resolution that appears on the Congressional bill tracking website states that those and other measures will only be funded through November 21, giving Congress precious few days to pass the measure, send it to the House of Representatives, and get it to President Trump for his signature. According to Senator Kevin Cramer (R-ND), the version due for discussion in the Senate this week extends the funding deadline until the end of January 2026, before which Congress would need to arrive at a long-term spending bill. Or else this entire fiasco begins again.

Senator Tim Kaine (D-VA), one of eight Democrats who broke ranks to move the continuing resolution along for a full Senate vote, noted that the bill does more than just restart lapsed cybersecurity measures and other frozen programs. Per Kaine, the legislation also reinstates all federal government employees who were terminated during the shutdown, which includes a number of staff at the Cybersecurity and Infrastructure Security Agency, ensures all furloughed federal workers receive backpay, and puts a pause on any additional federal government reductions in force (aka layoffs). None of those changes is noted in the resolution as it is recorded on Congress’ website.

The move is also likely to please government contractors like ServiceNow, which last month expressed worry that the shutdown would cut into its bottom line as procurement processes ground to a halt. As one former federal government CISO told us at the beginning of October, every day a shutdown drags on compounds delays and further disrupts critical tech modernization projects.

“Contractors would face payment delays, modernization projects are frozen, and digital transformation momentum is stalling precisely when organizations need to be preparing for AI, quantum, and rapidly evolving cyber threats,” Timothy Amerson, now a federal government advisor at GuidePoint, told us.

With the current plan for the continuing resolution, at least we can be sure that those who were in charge of modernization efforts will be offered their jobs back, though whether they accept the offer to return amid so much continued uncertainty is another thing altogether.

A deal built on flimsy foundations

While the continuing resolution is now set for debate on the Senate floor before a vote to send it to the House of Representatives for approval (and then on to President Trump for his signature), its passage isn’t guaranteed, nor is there any way to know when it might become law and reopen the federal government.

As of today, the US federal government has been shut for 40 days, marking the longest shutdown in US history. Second place belongs to Trump’s first shutdown in 2018, which spilled over into 2019 and lasted 35 days, and this one is only going to get longer as discussions continue.

Even if the continuing resolution passes, it’s likely we could see the government shut down again at the end of January, as a key sticking point for Democrats that won the votes of the eight senators was resolved only through a handshake deal to vote again on it later. Democrats in Congress were holding fast against the bill because Republicans refused to include extensions for healthcare tax credit subsidies under the Affordable Care Act beyond the end of 2025. The party held the line for 39 days, voting down numerous attempts to pass resolutions that would reopen the government, sans ACA tax credit extensions that would keep health insurance costs low. Now the Republicans have promised to hold a separate vote on the measure before the end of December.

• Consumer Financial Protection Bureau’s security falls apart amid layoffs
• The US government has no idea how many cybersecurity pros it employs
• Senators try to save cyber threat sharing law, sans government funding
• Pentagon decrees warfighters don’t need ‘frequent’ cybersecurity training

“This deal guarantees a vote to extend Affordable Care Act premium tax credits, which Republicans weren’t willing to do,” Kaine said of the measure. Some members of the Democratic Party, such as California governor Gavin Newsom, have called the move from Kaine and other Democratic senators a betrayal.

If Republicans refuse to hold a vote on the extension, it’s entirely possible Democrats will withdraw their support for a long-term funding bill in January. It’s also not clear whether President Trump, who has long been trying to eliminate the ACA, would sign an extension into law.

In short, the federal government is a single senator away from the proposed continuing resolution’s failure, and the long-term funding of the government is dependent on Republicans not going back on their word to hold a vote to extend subsidies they’re all opposed to.

Don’t hold your breath for stability anytime soon. ®