Tabitha Craig named Chief Information Security Officer at Congressional Budget Office (CBO)

Tabitha Craig has been named CISO of the Congressional Budget Office. She previously held leadership roles at the Department of Defense and the Department of Housing and Urban Development.

According to the Congressional Budget Office, Craig joined the agency in January 2025 as its Chief Information Security Officer. The agency says Craig reports to the Chief Information Officer and leads its cybersecurity program. In that program, CBO says, she oversees incident response, ensures compliance, manages vulnerabilities and risk, and develops and enforces policies and strategies to protect data and systems. CBO says Craig advises the CIO and the agency's senior leadership on security across all of its IT functions, programs and initiatives.

Before joining CBO, Craig was Director of Operations Security at the Department of Housing and Urban Development, the agency says. At HUD, CBO says, Craig advised the department on compliance, risk management and security strategy. According to the agency, she ensured compliance with federal security mandates while serving as Enterprise Vulnerability Program Manager. Before HUD, Craig served in the Army and retired from it in 2022, CBO says. At her final duty station in Washington, D.C., she supported training and readiness for noncommissioned and commissioned officers, according to the agency. According to CBO, Craig's M.S. from George Washington University is in information management technology. Her credentials include the Certified Information Security Manager designation from ISACA, Certified CompTIA Security +CE and a CIO certificate from GWU, according to CBO.

CBO says Craig's arrival was the one key staffing change among its managers in 2025 since the agency made its previous budget request. The agency says $5.4 million requested for cybersecurity in fiscal year 2027 would fund efforts intended to improve resilience and reduce operational risk. CBO says priority projects to reinforce its IT and cybersecurity systems include auditing its public key infrastructure and centralizing system logging.