Division F of HR 2471, the Consolidated Appropriations Act, 2022, is the Department of Homeland Security Appropriations Act, 2022. As with most annual spending bills, the language is very formulaic and changes little (other than the actual financial numbers) from year to year. The meat of the spending bill is found in the Joint Explanatory Statement (JES) provided by the negotiators (essentially a conference committee) of the final language of the bill. The JES for Division F can be found here. The JES also reaffirms the provisions of the House Appropriations Committee report on HR 4431, the DHS spending bill introduced earlier this year.
The table below shows the spending for CISA in FY 2022. The ‘FY 2021’ numbers are the final approved numbers for last year. The ‘HR 4431’ numbers were those proposed in the standalone House spending bill. And the ‘Division F’ are those included in the final HR 2471 spending bill.
In addition to providing more details about the spending allocations, the JES provides additional congressional reporting requirements over those found in the Committee Report on HR 4431 and one new program is outlined.
Increased Cybersecurity Spending
Division F increased the spending for CISA by over $301 million over that requested by President Biden. The new total for CISA is $2.43 billion which is about $410 million over the FY 2021 spending. Large portions of that spending increase go to various existing cybersecurity related programs including:
Joint Cyber Defense Collaborative (JCDC) - $16,153,000 above the request for the JCDC [pg 59],
Multi-State Information Sharing and Analysis Center (MS-ISAC) - $10,986,000 above the request [pg 60],
Threat Hunting - $24,000,000 above the request to increase cyber defensive operations in support of federal civilian agencies and non-federal networks, including SLTT governments and other critical infrastructure operators [pgs 60-1],
Vulnerability Management Infrastructure 10,022,000 above the request for the underlying infrastructure that enables better identification, analysis, and publication of known vulnerabilities and common attack patterns [pg 61],
JCDC Exercises - $2,244,000 above the request to support JCDC-organized cyber defense exercises [pg 61],
National Cyber Exercises - $3,367,000 above the request for the planning and execution of national cyber exercises [pg 61],
Cyber Safety Review Board (CSRB) - $2,893,000 above the request to establish the CSRB [pg 63], and
Cybersecurity Advisory Committee - $1,450,000 above the request to support the establishment of the Cybersecurity Advisory Committee [pg 63]
New Reporting Requirements
In addition to the reports required in the Committee Report on HR 4431, the JES for Division F also lists these new reporting requirements:
Cybersecurity Professionals – brief on the status of meeting the Department's cybersecurity hiring goals and plans for developing standardized metrics to ensure consistency in identifying personnel skills and talents across the Department [pg 12],
Cyber Fraud Task Forces – brief on the Secret Service efforts of its Cyber Fraud Task Forces [pg 50], Mitigating Malicious Bot Attacks – brief on the extent to which there have been distributed denial of service (DDoS) attacks, including those that may use bots [pgs 59-60], and
Ransomware – brief on the factors that left the United States vulnerable to any ransomware attack on critical infrastructure over the last two years and CISA's efforts to raise awareness of the threat of ransomware and activities to reduce the impact of ransomware attacks [pg 60]
New Programs
In addition to the new programs outlined in the Committee Report, the JES establishes funding for one additional new program, a new shared cyber threat intelligence service offering through CISA's Cybersecurity Shared Services Office (CSSO) to ensure efficient and effective use of cyber threat intelligence resources across the Federal Civilian Executive Branch (FCEB) [Pgs 56-7].