Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drive’s daily audio interviews on Apple Podcasts or PodcastOne.

The Cybersecurity and Infrastructure Security Agency is in line for another budget boost under the fiscal 2023 spending agreement, while lawmakers are also reauthorizing CISA’s marquee cyber defense program for another year.

The fiscal 2023 omnibus spending agreement includes $2.9 billion for CISA, a $313 million increase over its current budget. The funding includes $1.3 billion for the agency’s cybersecurity programs, about $230 million more than last year

That includes $331 million for the Continuous Diagnostics and Mitigation Program (CDM). Lawmakers are directing CISA to “continue evaluating the use of automation to replace manual software patch remediation methods” in CDM, according to the explanatory statement on the Homeland Security appropriations bill.

The legislation also reauthorizes CISA’s National Cybersecurity Protection System program through the end of fiscal 2023. The NCPS program employs a suite of tools known as “EINSTEIN” to detect and prevent cyber threats from infiltrating the networks of civilian executive branch agencies. The program’s seven-year authorization from the Federal Cybersecurity Enhancement Act of 2015 was due to expire this year.

The bill includes $91 million for the NCPS in fiscal 2023 “to enhance the protection of federal networks and expand CISA’s ability to coordinate and execute defenses against nation-state threats and mitigate critical vulnerabilities,” the explanatory statement says.

The EINSTEIN system came under fire from some observers for what they said was its failure to detect the SolarWinds cyber intrusion that affected at least nine federal agencies. Senate Homeland Security and Governmental Affairs Committee Ranking Member Rob Portman (R-Ohio) said the program needed reexamining in a March 2021 hearing.

“Clearly it was not effective in stopping the SolarWinds breach or even recognizing that it occurred,” Portman said at the time. “EINSTEIN’s authorization expires at the end of next year, so it’s a good time to consider its utility and how it can be improved.”

But CISA officials said the program is valuable and was not designed to detect “unknown threats” like the SolarWinds software supply chain exploit.

“I think we need to keep the pieces of EINSTEIN that continue to work and provide significant value and we need to transition those areas that don’t into different programs,” CISA Executive Director Brandon Wales said during the hearing.

Since then, CISA’s fiscal 2023 budget justification documents show the NCPS program has been undergoing “a restructuring effort.” That includes taking into account agencies’ increasing using of commercial cloud environments, which EINSTEIN was not designed to defend.

“NCPS will expand efforts to gain visibility into federal civilian cloud environments and making that data available to CISA cyber analysts to gain visibility into departments’ and agencies’ cloud infrastructures,” budget documents state.

Cyber investments across agencies

The omnibus spending agreement also provides $22 million for the White House Office of the National Cyber Director, the first time the new office has received funding through a regular appropriations bill. The office is expected to issue a new national cyber strategy in 2023, as well as a cybersecurity workforce, training and education plan.

It additionally provides $100 million for the Treasury Department’s Cybersecurity Enhancement Account, $20 million more than last year, although the Biden administration had requested $215 million for the account. The funds are targeted toward Treasury’s Bureau of Fiscal Service.

“The importance, complexity, and broad impacts of the Bureau of the Fiscal Service’s systems to its federal customers and American taxpayers is seen in everything from timely monthly payments to veterans and Social Security recipients to the collection of tax revenue and the sale of marketable securities that finance the government,” the explanatory statement reads. “Given this critical role, the department is expected to prioritize investments that strengthen cyber resiliency and support the implementation of Zero Trust Architecture and acceleration of cloud adoption within the Fiscal Service.”

The agreement also provides $200 million for the Department of Energy’s Cybersecurity, Energy Security, and Emergency Response (CESER) office, $14 million above CESER’s fiscal 2022 budget. CESER engages in next-generation cybersecurity research and development, including through its Cyber Testing for Resilient Industrial Control System (CyTRICS) program, which receives $20 million under the omnibus.

And the spending agreement includes legislation that would ban TikTok on government-issued devices. The measure was introduced by Sen. Josh Hawley (R-Mo.) and unanimously passed the Senate last week.

The Defense Department, the Department of Homeland Security, the State Department and other agencies have already banned TikTok on their devices due to security concerns about TikTok’s owner, ByteDance, and its relationship to the Chinese Communist Party.

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.