Shutdown plans counted people; agency systems depended on contracts and expiry dates

The week

Through the last week of September 2023, federal agencies prepared for something they hoped would not happen: a lapse in appropriations. Appropriations are the annual laws through which Congress gives agencies permission to spend money. The federal fiscal year begins on October 1, and that date was approaching without a funding agreement. Without one, most agencies would have to stop work that was not legally exempt, in what the public knows as a government shutdown.

The planning followed an established routine. OMB Circular A-11 requires each agency to keep a plan for operations in the absence of appropriations, and OMB publishes the plans. As a deadline nears, agencies review those plans and tell employees what their status would be. Employees who would be furloughed may generally work only a few hours on the first day of a lapse, to secure their work and hand over what must continue.

Preparing for a shutdown is a peculiar kind of planning. Agencies have to decide, in advance, which of their employees can keep working and which must stay home. Agencies updated and published shutdown contingency plans identifying which employees would be excepted and keep working and which would be furloughed. Excepted employees are those whose work is allowed to continue during a lapse, typically because it protects life or property. Furloughed employees are sent home and are not allowed to work, even voluntarily.

The plan format reinforced the focus on people. Agencies’ published plans are built around headcounts: how many employees are on board, how many would be retained because they are exempt or excepted, and the legal basis for each category of retained work. Technology appears where it supports an excepted activity, usually as a line in a staffing table rather than as a list of systems, contracts and dates.

Two background facts shaped the mood. Since 2019, federal law has guaranteed back pay to federal employees after a lapse, under the Government Employee Fair Treatment Act. Contractor employees have no such guarantee, which colors how vendors react to the threat of a stop-work order. And the most recent lapse, from December 2018 to January 2019, had lasted 35 days, then the longest on record. Many of the officials planning in September 2023 had managed that one.

All of that planning ran up against the clock. On September 30, Congress passed a continuing resolution funding the government to November 17, and the President signed it that night, averting a shutdown. A continuing resolution is a stopgap: rather than passing full-year budgets, Congress extends funding temporarily, usually at existing levels, to buy time.

The stopgap, the Continuing Appropriations Act, 2024, passed both chambers with large bipartisan majorities only hours before the deadline. Besides extending funding to November 17, it added disaster relief money for FEMA and extended several expiring authorities, including the Federal Aviation Administration’s. It left out additional aid for Ukraine, which had been one of the points of dispute. For agency planners, the outcome was a seven-week reprieve with the same plans still on the shelf. Congress then had until November 17 to agree on full-year bills or pass yet another stopgap.

The timing added strain of its own. The last weeks of September are the busiest of the year for federal contracting offices, as agencies obligate one-year money before it expires. The same staff who would have issued stop-work orders and lapse instructions were also closing out the fiscal year.

The relief was partial. The agreement did not settle the underlying dispute. On October 3, the House voted to remove its Speaker, and further short-term funding deadlines followed into early 2024. Agencies would face the same planning exercise again, more than once, before the fiscal year’s budget was settled.

The week amounted to a full rehearsal of a shutdown that did not happen. Plans were written, staff were told whether they were excepted, contractors waited for instructions, and then the deadline passed with a deal. A rehearsal has value only if someone notes what went wrong in it. And one thing the September planning revealed, for anyone looking, was that the plans described the workforce in detail while saying far less about the systems that workforce keeps running: the networks, websites, contracts, certificates and cloud services on which every excepted function depends.

Shutdown planning is written as a workforce exercise. The Office of Management and Budget asks agencies to say which activities are excepted, how many people perform them, and who goes home. That is the right legal frame, because the Antideficiency Act governs obligations and personnel. The Antideficiency Act is the law that forbids federal officials from spending money, or committing the government to spend money, that Congress has not provided; in a lapse, it is why most work must stop.

The workforce frame leaves out most of what keeps agency technology running. Systems do not observe appropriations law, but the people, contracts and renewals behind them do. A server keeps humming through a shutdown. The person who patches it may be at home. The contractor who monitors it may have been told to stop. The certificate that secures it may expire on day nine.

An agency’s technology exposure in a lapse has four parts, which follow a shutdown from start to finish: who may work, what keeps getting paid, what expires during the lapse, and what has to restart afterward. Technology behaves very differently from people in a shutdown, and that difference comes first.

The question matters well beyond Washington. State and local agencies run systems that exchange data with federal ones. Banks, hospitals and employers depend on federal services that can go dark in a lapse, and thousands of contractors carry the risk of unpaid stop-work orders. Each of them has a stake in how an agency plans for its technology, and each can apply the same four questions to its own dependence on federal systems.

Servers do not get furloughed

A shutdown plan is, at heart, a list of people and activities. It answers the question: who is allowed to keep working? That works well for functions carried out mainly by people, such as air traffic control or border inspection.

Technology is different in three ways. First, it runs continuously whether or not anyone is watching. Websites stay up, email flows, databases answer queries. Excepted functions depend on these systems, so that is useful, but it also means problems accumulate unseen. Second, much of it is operated by contractors rather than federal staff, so whether it is looked after depends on contract funding, not on an employee’s excepted status. Third, it is full of things with built-in expiry dates, from security certificates to software licenses, which keep counting down regardless of appropriations.

Some parts of the technology estate behave in less obvious ways. Cloud services keep running and keep billing. Software-as-a-service providers keep delivering under their contract terms, and their support desks keep answering, though nobody at the agency may be allowed to call them. Federal guidance generally restricts updates to agency websites during a lapse except for excepted information, so many sites carry a banner saying they are not being maintained. A site that is up but frozen can still mislead the public about deadlines and services that changed after the lapse began.

A family leaving home for six weeks at short notice faces the same problem. Deciding who goes and who stays is the obvious part; the less obvious part is everything that keeps running or comes due, from bills on automatic payment to a car registration that expires next month. Agency shutdown plans, built around people, often miss that second list.

Exempt, excepted and furloughed

The vocabulary matters because it decides what keeps running. Federal guidance distinguishes exempt employees, whose pay comes from sources other than the lapsed appropriation, from excepted employees, whose work may legally continue even though the money has lapsed. Exempt staff are paid on time from fees, multi-year funds or other sources. Excepted staff keep working but are paid only after appropriations return.

The same distinction applies to technology. A system funded from multi-year or no-year money, or from a fee account, may carry on with its contractors paid. A system funded from the lapsed annual appropriation depends on whatever excepted work the agency can justify. Shared service providers that run on working capital funds, charging customer agencies for services, may keep operating while their customers’ own funding has stopped. One office can therefore hold systems with three different statuses, and its shutdown plan may describe only its people.

Not every agency faces the same lapse

The exposure varies widely by type of organization. The Department of Defense keeps military personnel on duty and excepts many civilians who support them. Independent regulators funded by assessments and fees, such as the OCC, the FDIC and the NCUA, generally keep operating, so banks and credit unions continue to be examined. The federal judiciary has historically used fee balances to keep courts open for a period before facing its own limits.

Many civilian agencies, by contrast, rely almost entirely on annual appropriations. Their technology exposure is greatest, because both their staff and their contracts depend on the lapsed money.

State and local governments are not shut down, but they feel a federal lapse through shared systems and grant payments. E-Verify, the federal employment eligibility system that state agencies and private employers use, went offline in earlier lapses. Benefit programs that states administer with federal money, and the federal systems that support them, can be disrupted too. A county or state agency should map which of its own services depend on federal systems or funding that a lapse would interrupt.

Excepted, but unable to finish the job

During a lapse, agencies may continue activities needed to protect life and property and a few other categories. Security monitoring and incident response for systems that support excepted functions are generally treated as excepted, and so is the operation of those systems. Excepted staff work without pay until appropriations return, and they are usually a fraction of the normal team.

The gap is between the excepted list and the work those people actually depend on. A security operations center, the team that watches for cyberattacks, may be excepted while the identity team that disables a compromised account is not. A system administrator may be excepted while the change approver required by the agency’s own process is furloughed. The excepted person is at their desk, but cannot finish the job, because the colleague whose sign-off or action they need is at home.

Lapse plans should be tested against specific scenarios: a phishing campaign themed on the shutdown, a critical vulnerability disclosed on day three, a failed backup job. Phishing is the use of fraudulent emails to trick people into revealing passwords or clicking malicious links, and a shutdown, with its anxious staff and unusual instructions, makes a convincing theme. A critical vulnerability is a newly discovered flaw in widely used software that attackers can exploit, usually requiring an urgent fix.

Each scenario needs a named excepted person with the authority to act and a documented, temporary change procedure that works without the usual approvers. In normal times, changes to important systems go through a review process. In a lapse, that process may be impossible to follow, so the plan should say in advance what the reduced process is, who uses it, and how its use will be reviewed afterward.

There is also a human cost to plan for. Excepted security staff work long hours without pay, often while colleagues are at home, and fatigue raises error rates. A rotation schedule for the excepted team, written before the deadline, and a clear statement of which routine tasks may be dropped, protects the work that cannot stop.

Decision rights, written down before the deadline

The temporary procedure needs to exist on paper, signed by someone with authority, before a lapse begins. A one-page delegation memo can name the excepted officials who may approve emergency changes, the kinds of change they may approve, and the time limit on that authority. It can require two people for any change to a production system: one to make it and one to check it. Each emergency change should be logged with its reason, and the log reviewed within days of the restart.

Authorization to operate raises a related problem. Federal systems run under an authorization granted by a designated official after a security assessment. Significant changes may require that official’s review. If the authorizing official is furloughed, the plan should say who can accept the risk of an emergency change in the meantime, and how the decision will be ratified afterward.

External deadlines do not pause either. CISA’s directive on known exploited vulnerabilities, BOD 22-01, sets remediation due dates by calendar, not by funding status. Emergency directives can also arrive during a lapse. CISA issued its first emergency directive, on DNS infrastructure tampering, in January 2019, in the middle of the 35-day shutdown. Agencies had to act on it with reduced staff.

Monitoring that someone reads

Security monitoring is only as good as the response behind it. Agency dashboards, managed detection services and automated scans may all keep producing findings during a lapse. If the people who triage those findings are excepted but the teams that fix them are not, findings pile up in a queue that nobody can clear. The plan should state, for each monitoring feed, who reads it during a lapse, what they may fix themselves, and what must wait.

Shared services add a dependency outside the agency’s control. CISA operates under its own lapse plan, and the services it provides to agencies, states and critical infrastructure may run at reduced capacity. Agencies and states that rely on those services should know in advance which ones would continue and plan for gaps.

Which contracts keep running

Much federal IT is run by contractors, and their status in a lapse depends on how each contract is funded. Contracts funded with lapsed annual appropriations may receive stop-work orders, formal instructions from the government to halt performance. Contracts already fully funded, multi-year or paid from fees or other sources may continue, provided government staff are available to oversee them and grant facility or system access.

The result is uneven: a help desk that keeps running while the network operations contract stops, or a managed detection service that keeps sending alerts to a furloughed team. A managed detection service is an outside firm that watches an organization’s systems for signs of attack and raises alerts. If the people meant to receive and act on those alerts are furloughed, the alerts go unread.

A funding map fixes most of this. For each IT and security service, it records the contract vehicle, the appropriation that funds it, the obligation status, the contracting officer’s representative and whether that person is excepted. The contract vehicle is the legal arrangement under which the work is bought. Obligation status says whether the money has already been legally committed. The contracting officer’s representative is the government employee who oversees a contractor’s day-to-day work; if they are furloughed, even a fully funded contract may be hard to run.

The map needs an owner and a rhythm. The CIO’s office usually holds the technical inventory, the budget office knows the appropriations, and the acquisition office holds the contracts, so the map is a joint product. Much of the data already exists in the IT spending information agencies report to OMB and in contract-writing systems. Updating the map once a quarter, and again a month before each funding deadline, keeps it current without turning it into a project.

Contracting officers can then issue clear instructions days before the deadline, so vendors can decide whether to keep staff on payroll. That matters to the vendors, who otherwise face the choice of paying staff who may not be allowed to work or releasing staff they may need back next week. Where a service is critical to excepted work, agencies can work with counsel and budget offices on funding structures that keep it running within the law, such as timing obligations before the fiscal year ends.

How contract funding behaves in a lapse

Contract status turns on a few mechanisms that technology leaders rarely see. A fully funded, fixed-price contract has its money already obligated, so performance can generally continue if government oversight and access are available. An incrementally funded contract receives money in installments. When the obligated amount runs out, the Limitation of Funds clause means the contractor is not required to keep working, and a lapse prevents the agency from adding more.

Option periods are a frequent trap. Many contracts have performance periods aligned with the fiscal year, so an option year begins on October 1. Exercising an option is a new obligation, which a lapse prevents. A contract whose base year ends on September 30 can simply stop, even though nobody issued a stop-work order.

Where a stop-work order is issued, the standard clause, FAR 52.242-15, requires the contractor to halt the specified work and allows it to seek an equitable adjustment for the costs the stoppage caused. That mechanism compensates the company in time. It does not pay the contractor’s staff during the lapse, and some of them will take other jobs.

Severable services offer a lawful planning tool. Federal law allows agencies to fund a contract for severable services, such as operations support, with the earlier year’s money. The contract can begin in one fiscal year and run for up to twelve months into the next. Agencies that time such contracts with an eye to the funding calendar, with counsel and budget offices involved, can keep critical services covered over the October 1 boundary.

The vendor’s side of the same problem

For a contractor, a looming lapse is a staffing and cash flow decision. A sound vendor practice is to ask the contracting officer in writing, before the deadline, which work will continue and under what authority. Vendors should not perform work without written direction, since unauthorized work may not be paid. They should also track costs carefully from the first day of any stoppage, because those records support a later claim. Small businesses carry this risk hardest, since they have the least cash to keep idle staff on payroll.

Certificates and credits that run out on day nine

Some tasks are tied to the calendar, not to funding. During the 2018 to 2019 shutdown, security researchers reported that TLS certificates on dozens of federal websites had expired with nobody available to renew them, leaving pages that browsers flagged as unsafe. A TLS certificate is the digital credential that lets a browser confirm it is talking to the genuine website and encrypt the connection; it is what produces the padlock in the address bar. Certificates have fixed lifetimes. When one lapses, visitors see a warning that the site may not be safe, which for a government website undermines public trust at exactly the wrong time.

Domain registrations, software license keys, cloud subscriptions, service account passwords and code-signing certificates work the same way. A domain registration secures the agency’s web address. A service account is an account used by software rather than a person, and its password may be set to expire. A code-signing certificate lets an organization prove that software it distributes really came from it. So do scheduled jobs that fail and need a person to restart them, such as nightly data transfers between systems.

The response is mechanical. Agencies can maintain an inventory of time-bound items with expiry dates and owners, and before each funding deadline renew everything that would expire within a plausible lapse window, say sixty days. Automated certificate management, which renews certificates by software without anyone having to remember, removes the largest category entirely.

Why an expired certificate now does more damage

The effect of an expired certificate has grown more severe since the 2018 to 2019 lapse. CISA’s Binding Operational Directive 18-01 pushed federal websites to use HTTPS and HTTP Strict Transport Security, a setting that tells browsers to accept only secure connections to a site. On a site that uses that setting, browsers generally do not let visitors click past a certificate error. An expired certificate then makes the site unreachable for most visitors rather than merely alarming.

Automation reduces the risk but does not remove the need for a person. Automated renewal can fail because of a changed firewall rule, an expired account at the certificate authority or a configuration drift on a server. Someone excepted should receive the failure alerts and have authority to fix them.

Identities and secrets on a timer

The same calendar governs identity. Personal identity verification cards, the smart cards federal staff use to sign in, have expiry dates, and the badge offices that renew them may be closed. Interconnections with states, banks and other agencies often depend on API keys, tokens or certificates that rotate on a schedule. When one of those expires, a data exchange stops, and the partner on the other end may not learn why until someone answers the phone. A secrets vault that records every credential’s expiry date and owner turns that risk into a report that can be run before each deadline.

Cloud accounts need a separate check: a prepaid commitment or credit that runs out mid-lapse can suspend services, and nobody may be authorized to add funds. Agencies often buy cloud computing in advance, and if that balance runs out while no one is allowed to top it up, services can stop. The inventory doubles as ordinary hygiene, because certificates expire during normal operations too.

The order of the restart

Reconstitution, the formal term for bringing an organization back to normal operations, is the part lapse plans tend to leave to a final paragraph. When appropriations return, a backlog of patches, access requests, tickets and contract modifications meets staff who have been away for weeks. Accounts may have been disabled for inactivity. Vendors who reassigned staff during a stop-work order may need time to bring them back, and security clearances and badges for new contractor staff may have stalled.

A restart plan sets the order: confirm the integrity of systems that ran with thin oversight, apply critical patches released during the lapse, review privileged access changes made under temporary procedures, then clear the routine backlog. Integrity here means confirming nothing was altered without authorization while few people were watching. Privileged access is the high-level control over systems held by administrators; any changes made under emergency procedures deserve a second look. The plan names who signs off that each step is done.

Patch arithmetic shows why the order matters. Major software vendors release security updates on a monthly cycle, so a lapse of several weeks spans at least one full cycle and often two. Some of those fixes will address vulnerabilities added to CISA’s known exploited list during the lapse, with due dates already running. A restart plan should rank the accumulated patches by that list and by exposure to the internet, rather than applying them in the order they were released. Internet-facing systems that ran with thin monitoring should also be checked for signs of compromise before patching. A patch closes the door, but it does not remove an intruder who came in while it was open.

The order matters. An agency might clear its routine ticket queue first, satisfying the many staff who return wanting their access restored. If so, it may leave an unpatched system or an unreviewed emergency change in place for days longer than necessary.

Vendors need their own place in the sequence. A contractor that received a stop-work order has to be formally told to resume, and its staff may need their system access restored before they can do anything useful. If those steps wait until the contracting staff have worked through their own backlog, a critical service can sit idle for days after the money is back. A restart plan that lists, in advance, which contracts to restart first, who issues the instruction and who restores the vendor’s access turns that delay into a short checklist.

The same applies to communication. Returning staff, vendors and, for public-facing services, the public all need to know what is back, what is not, and when to expect the rest. A short, prewritten message for each group, ready to send on the first morning, saves time and calls.

The record the inspector general may ask for

A lapse leaves an audit trail, or should. Inspectors general and auditors reviewing an agency after a lapse may ask which emergency changes were made, who approved them, and whether they were reviewed afterward. Other likely questions cover which security controls were not performed during the lapse, such as scans or access reviews, and when they were caught up. Remediation items that slipped should be recorded in the agency’s plan of action and milestones, the tracking list for known security weaknesses, with new dates.

Inactivity rules deserve particular attention. Many agencies disable accounts after a set period without use, and a long lapse can push a large share of furloughed staff past that threshold. Re-enabling accounts in bulk is tempting and risky. A sounder approach is to re-enable accounts in batches tied to confirmed returns, verifying each user’s identity, and to review any account that was used during the lapse when its owner was furloughed.

A lapse at a mid-sized agency, day by day

Suppose a mid-sized federal agency enters a lapse with a plan that covers people well and technology less so.

On day one, its security operations center keeps running, staffed by excepted federal analysts and a fully funded monitoring contract. The network operations contract, funded from lapsed annual appropriations, receives a stop-work order. The contracting officer’s representative for the monitoring contract is furloughed.

On day three, a critical vulnerability is announced in software the agency uses on its public website. The excepted analysts see the alerts. The patch requires a change approval from an official who is furloughed, and the network team that would apply it is under a stop-work order. With no temporary change procedure written in advance, the analysts escalate, and a decision takes two days.

On day nine, the certificate on a public benefits information page expires. Visitors see a browser warning. Nobody excepted owns certificate renewal. Calls to the agency’s phone line increase.

On day twenty, a prepaid cloud commitment runs out, and a reporting service stops. No one is authorized to add funds.

When funding returns, staff come back to thousands of tickets. Several administrator accounts were disabled for inactivity. The network contractor has reassigned two engineers. Without an agreed order of work, teams clear the easy tickets first.

Every one of those problems was foreseeable, and each has a simple remedy: a scenario test with a named decision-maker, a funding map showing the representative’s status, a certificate inventory with automated renewal, a check on cloud balances, and a restart plan with an order and sign-offs.

Run the same lapse at an agency that did that work. On day three, an excepted official named in a signed delegation memo approves the emergency patch within hours, and the network contractor applies it, because its contract was funded through December with severable-services money. On day nine, nothing happens to the benefits page, because its certificate renews automatically and the renewal alert goes to an excepted engineer. The cloud balance was topped up before October 1. When funding returns, the restart plan puts the integrity checks and the review of emergency changes first, and the backlog follows in a known order.

What the agency puts at risk

Mission. Excepted functions protect life and property. They depend on systems that depend on people, contracts and renewals that the headcount plan may not cover.

Security. A lapse is a period of thin oversight, unusual procedures and anxious staff, which is attractive to attackers. Gaps in authority or monitoring are easier to exploit then.

Public trust. Expired certificates and unavailable services are visible to the public and the press, and they suggest an agency that cannot look after its own front door.

Workforce. Excepted staff working without pay carry a heavy load. Clear plans and rotations reduce the strain and the errors that come with it.

Recovery cost. A disorganized restart can take longer than the lapse itself to clear, and mistakes made in the rush can create new problems.

Partners. Agency services feed other institutions’ work. In the 2018 to 2019 lapse, the Small Business Administration stopped processing most new loans, which reached the banks that make them. A lapse that interrupts a federal data exchange or verification service moves the disruption into state agencies, lenders and employers who have no say in the funding dispute.

Contractor base. Vendors that go unpaid during a stop-work order may lose skilled staff, and small firms may not absorb the cash shortfall at all. An agency can return to find that the engineers who knew its systems have moved on, which turns a weeks-long lapse into a months-long capability gap.

A plan that covers systems as well as staff

A well-prepared agency has a lapse plan that names people and also covers systems. Its scenarios are specific and tested, each with an excepted decision-maker and a temporary change procedure. Its funding map shows, for every IT and security service, how it is funded and who oversees it. Its inventory of expiring items is current, and anything due within sixty days of a deadline is renewed in advance, with certificates renewed automatically. Its restart plan has an order and sign-offs.

The weaker plans treat the exercise as a headcount, when people are only part of what must keep working. They assume contractors will carry on, though each contractor’s status depends on how its contract is funded and whether its overseer is excepted. They forget the calendar: certificates, licenses and cloud credits do not pause for a lapse. They leave reconstitution to a paragraph, although the restart is where backlogs, disabled accounts and unreviewed changes collide. And they are filed away when a deadline passes, even though the next one is often weeks off.

Rehearsing without a lapse

An agency does not need a real shutdown to test its plan. A two-hour tabletop exercise each summer, before the fiscal year ends, can walk through the day-by-day scenario above with the people who would actually decide. That group includes the CIO and CISO, the budget officer, the head of contracting, general counsel and the officials who would be excepted.

The exercise produces a few measures worth tracking from year to year. One is the share of IT and security contracts on the funding map with a confirmed lapse status. Others are the number of certificates, credentials and subscriptions due to expire within sixty days of October 1, and the time the group took to approve an emergency change under the temporary procedure. If those numbers improve each year, the plan is getting better whether or not a lapse ever comes.

Objections, and where they hold

One objection is that shutdowns are rare and usually short, so planning for systems is wasted effort. The 2023 deadlines passed without a lapse, and many earlier ones did too. Most of the work described here is ordinary hygiene, though. An expiry inventory, a contract funding map and a restart sequence help in any disruption, from a cyber incident to a natural disaster. The added cost of using them for lapse planning is small.

A second objection is legal. The Antideficiency Act limits what agencies may do in advance, and the bona fide needs rule bars using one year’s money for another year’s needs. Prepaying services to avoid a lapse can cross those lines. The objection is right about the limits. It argues for involving counsel and budget officers early, and for using the tools the law provides, such as severable-services contracts, rather than for leaving the technology unplanned.

A third holds that agencies should simply except more technology staff. The excepted categories are narrow by law, and stretching “protection of property” to cover routine IT operations invites challenge. Agencies can make a defensible case for the staff whose work protects systems that support excepted functions. The plan should state that link explicitly for each excepted technology role.

A last objection is that moving to the cloud makes the problem disappear. Cloud services do remove much of the physical upkeep that once needed people on site. They also add a billing dependency, since services can be suspended when prepaid funds run out, and they keep certificates, credentials and subscriptions on their own timers. The cloud changes which items appear on the expiry list rather than shortening it.

Five checks before the next deadline

1. For each excepted function, which technology does it depend on, and is everyone needed to keep that technology running also excepted?
2. If a critical vulnerability were announced on day three of a lapse, who would decide to patch, and under what temporary procedure?
3. For every IT and security contract, how is it funded, would it continue, and is its contracting officer’s representative excepted?
4. What certificates, licenses, domains, passwords and cloud credits expire in the sixty days after the next funding deadline, and have we renewed them?
5. When funding returns, in what order do we restore systems, and who signs off each step?

Because September 2023 ended without a lapse, many agencies filed their plans away. The next deadline was seven weeks off, and nothing about the conditions that made the September planning hard had changed.

With hindsight

Short-term funding deadlines continued until full-year appropriations passed in March 2024. The pattern of stopgap after stopgap meant agencies spent months living with the possibility of a lapse, repeating the planning exercise each time.

The November 2023 stopgap used an unusual two-step structure, funding some agencies to January 19, 2024 and the rest to February 2. Both dates were pushed into March before the remaining full-year bills passed. Each new deadline brought another round of employee notices and contractor questions.

The full test came later. Federal funding lapsed on October 1, 2025, and the shutdown that followed ran until November 12, the longest in U.S. history. Agencies worked with reduced staff for six weeks, and contractors faced stop-work orders. Six weeks is long enough for almost every exposure described here to come due: certificates and credits reach their expiry dates, contracts funded from lapsed appropriations stop, excepted staff tire, and the backlog grows.

The strain on excepted staff became visible to the public. In November 2025, the Federal Aviation Administration ordered airlines to reduce flights at 40 major airports, citing strain on air traffic controllers who had worked for weeks without pay. Excepted status kept people at their posts, but it could not keep them there indefinitely at full strength.

The 2025 lapse also brought features the 2023 plans had not contemplated. OMB directed agencies to issue reduction-in-force notices during the shutdown; a federal court blocked them, and the law that ended the shutdown reversed them. E-Verify was unavailable, as it had been in earlier lapses. The November benefit cycle of the Supplemental Nutrition Assistance Program was disrupted and litigated, and states had to adjust benefit issuance on short notice. For state agencies, the federal lapse reached directly into their own systems and call centers.

There was also a less visible casualty. The Cybersecurity Information Sharing Act of 2015 protects organizations that share cyber threat information. It expired as the lapse began and was restored, through January 30, 2026, by the law that ended the shutdown. That law encourages companies and agencies to share warnings about attacks by giving them legal protections when they do. Its lapse showed that a funding gap can reach beyond what agencies themselves can do, to the legal footing on which others work with them.

The calendar also tightened. In April 2025, the CA/Browser Forum, the industry body that sets rules for publicly trusted certificates, approved a schedule that cuts the maximum lifetime of a TLS certificate in stages. It fell from 398 days to 200 days in March 2026 and is due to reach 47 days by 2029. At those lifetimes, a certificate renewed by hand before a funding deadline may still expire during a long lapse. Automated renewal has become the only workable approach.

Some of the planning parameters suggested here held up. The sixty-day renewal window would have covered the 2025 lapse, which ran 43 days from October 1, though without much room to spare. A longer lapse would have exceeded it.

The four exposures described here all appeared at a scale the 2023 rehearsal had not reached. Who may work, what keeps getting paid, what expires and what must restart all became live questions at once, across government, for weeks.

How well individual agencies fared has not been comprehensively assessed in public, so we draw no ranking; without public evidence, naming winners and losers would be guesswork.

A further lapse affecting the Department of Homeland Security in February 2026 kept the same planning questions current. Because it affected one department while most of the government stayed funded, it tested the dependencies between agencies as much as those within them. Funding deadlines will keep arriving, and a shutdown plan built only around people is incomplete. The questions about contracts, expiry dates and restart order are cheap to answer in a calm month. Every averted shutdown, like the one in September 2023, is a free rehearsal for one that is not averted.