Shutdown plans counted people; agency systems depended on contracts and expiry dates

The week

Through the last week of September 2023, federal agencies prepared for a lapse in appropriations as the October 1 start of the fiscal year approached without a funding agreement. Agencies updated and published shutdown contingency plans identifying which employees would be excepted and keep working and which would be furloughed. On September 30, Congress passed a continuing resolution funding the government to November 17, and the President signed it that night, averting a shutdown. The agreement did not settle the underlying dispute. On October 3, the House voted to remove its Speaker, and further short-term funding deadlines followed into early 2024. For agency leaders, the week was a full rehearsal of a shutdown that did not happen.

Shutdown planning is written as a workforce exercise. The Office of Management and Budget asks agencies to say which activities are excepted, how many people perform them, and who goes home. That is the right legal frame, because the Antideficiency Act governs obligations and personnel. It leaves out most of what keeps agency technology running. Systems do not observe appropriations law, but the people, contracts and renewals behind them do. We look at an agency’s technology exposure in a lapse in four parts, which follow a shutdown from start to finish: who may work, what keeps getting paid, what expires during the lapse, and what has to restart afterward.

Who may work

During a lapse, agencies may continue activities needed to protect life and property and a few other categories. Security monitoring and incident response for systems that support excepted functions are generally treated as excepted, and so is the operation of those systems. Excepted staff work without pay until appropriations return, and they are usually a fraction of the normal team.

The gap is between the excepted list and the work those people actually depend on. A security operations center may be excepted while the identity team that disables a compromised account is not. A system administrator may be excepted while the change approver required by the agency’s own process is furloughed. Lapse plans should be tested against specific scenarios: a phishing campaign themed on the shutdown, a critical vulnerability disclosed on day three, a failed backup job. Each scenario needs a named excepted person with the authority to act and a documented, temporary change procedure that works without the usual approvers.

There is also a human cost to plan for. Excepted security staff work long hours without pay, often while colleagues are at home, and fatigue raises error rates. A rotation schedule for the excepted team, written before the deadline, and a clear statement of which routine tasks may be dropped, protects the work that cannot stop.

What keeps getting paid

Much federal IT is run by contractors, and their status in a lapse depends on how each contract is funded. Contracts funded with lapsed annual appropriations may receive stop-work orders. Contracts already fully funded, multi-year or paid from fees or other sources may continue, provided government staff are available to oversee them and grant facility or system access. The result is uneven: a help desk that keeps running while the network operations contract stops, or a managed detection service that keeps sending alerts to a furloughed team.

A funding map fixes most of this. For each IT and security service, it records the contract vehicle, the appropriation that funds it, the obligation status, the contracting officer’s representative and whether that person is excepted. Contracting officers can then issue clear instructions days before the deadline, so vendors can decide whether to keep staff on payroll. Where a service is critical to excepted work, agencies can work with counsel and budget offices on funding structures that keep it running within the law, such as timing obligations before the fiscal year ends.

What expires during the lapse

Some tasks are tied to the calendar, not to funding. During the 2018 to 2019 shutdown, security researchers reported that TLS certificates on dozens of federal websites had expired with nobody available to renew them, leaving pages that browsers flagged as unsafe. Domain registrations, software license keys, cloud subscriptions, service account passwords and code-signing certificates work the same way. So do scheduled jobs that fail and need a person to restart them.

The response is mechanical. Agencies can maintain an inventory of time-bound items with expiry dates and owners, and before each funding deadline renew everything that would expire within a plausible lapse window, say sixty days. Automated certificate management removes the largest category entirely. Cloud accounts need a separate check: a prepaid commitment or credit that runs out mid-lapse can suspend services, and nobody may be authorized to add funds. The inventory doubles as ordinary hygiene, because certificates expire during normal operations too.

What has to restart afterward

Reconstitution is the part lapse plans tend to leave to a final paragraph. When appropriations return, a backlog of patches, access requests, tickets and contract modifications meets staff who have been away for weeks. Accounts may have been disabled for inactivity. Vendors who reassigned staff during a stop-work order may need time to bring them back, and security clearances and badges for new contractor staff may have stalled.

A restart plan sets the order: confirm the integrity of systems that ran with thin oversight, apply critical patches released during the lapse, review privileged access changes made under temporary procedures, then clear the routine backlog. It names who signs off that each step is done. Because September 2023 ended without a lapse, many agencies filed their plans away. The next deadline was seven weeks off, and nothing about the conditions that made the September planning hard had changed.

With hindsight

Short-term funding deadlines continued until full-year appropriations passed in March 2024. The full test came later. Federal funding lapsed on October 1, 2025, and the shutdown that followed ran until November 12, the longest in U.S. history. Agencies worked with reduced staff for six weeks, and contractors faced stop-work orders. The Cybersecurity Information Sharing Act of 2015 protects organizations that share cyber threat information. It expired on the same day and was restored and temporarily extended by the law that ended the shutdown. The four exposures described here all appeared at a scale the 2023 rehearsal had not reached. How well individual agencies fared has not been comprehensively assessed in public, so we draw no ranking. A further lapse affecting the Department of Homeland Security in February 2026 kept the same planning questions current.