Last month Rep Roybal-Allard (D,CA) introduced HR 4431, the Department of Homeland Security Appropriations Act, 2022. As is typical with spending bills, the bill introduced is the version reported by the House Appropriations Committee, so the Committee Report is available. There is little in the bill dealing with cyber (beyond CISA funding, of course), but the Report contains important cybersecurity language.
CISA Spending
The table below shows the overview of CISA spending included in the bill, the data is taken from the Report.
The spending for cybersecurity would certainly be increased by this bill. I suspect that we may see further increases before an FY 2022 spending bill makes it to the President’s desk.
Cyber Provisions that Mimic Proposed Legislation
In the Report, the Appropriations Committee recognizes initiatives by the Administration that mimic a variety of bills that are wending their way through the legislative process. This is not an unusual process, as long as Congress is willing to provide the funds, the executive branch has a lot of leeway to standup various programs without specific legislative approval. If the programs are successful (for various meanings of that term) then Congress will, sooner or later, get around to authorizing the program.
The following are some of those programs addressed in the Report:
Civilian CyberCorps (pg 64) – The Committee addresses a planned DHS, NSF, DOD and OPM effort “to establish a plan to recruit, train, and educate personnel; shift military veterans into federal service upon discharge from active duty or engage reservists in civilian cyber workforce roles”. The report specifically requires DHS, within 120 days, to “brief the Committee on progress towards the development of this plan, to include anticipated resources needed to expand the ranks of federal civilian cyber professionals.”
Small Manufacturing Cybersecurity Support (pg 69) – The Committee wants CISA to partner with DOD, NIST and the Manufacturing Extension Partnership (MEP) Centers to “help small manufacturers enhance the protection of controlled unclassified information within the supply chain, respond quickly to crippling cyber-attacks and theft of intellectual property”. They also encourage CISA “to assist MEPs in establishing priorities for their cybersecurity risk management initiatives.”
Cyber Response and Recovery Fund (pg 74) – The Committee is providing $20 million to establish a Cyber Response and Recovery Fund (CRRF), as requested by the Administration for response to non-federal public and private critical infrastructure significant cyber incidents. The Committee would allow the funds to be used for:
Furnishing technical and advisory assistance, technology, or capabilities to entities affected by a cyber incident to protect their assets, mitigate vulnerabilities, and reduce the related impacts,
Identifying other entities that may be at risk from the significant cyber incident and assessing their risk from the same or similar vulnerabilities where necessary to respond to or recover from the significant cyber incident; assessing potential risks to the sector or region, including potential cascading effects, and developing courses of action to mitigate these risks where necessary to respond to or recover from the significant cyber incident,
Facilitating information sharing and operational coordination with threat response where necessary to respond to or recover from the significant cyber incident, and
Providing guidance on how best to utilize federal resources and capabilities in a timely, effective manner to speed recovery.
Cybersecurity Innovation
The report indicates the Committee’s support for cybersecurity innovation with support for potential new programs and expanding pilot programs. These include:
Capabilities to Nullify Cyber Attacks (pg 64) The Committee directs CISA to issue a Request for Information (RFI) “to identify existing software solutions for nullifying cybersecurity attacks before they infect systems and cause damage.”
CyberSentry (pg 67) The Committee increased funding for the CISA CyberSentry pilot program. The funds “will be used for additional personnel; the procurement and installation of sensors; system integration support; and contractor support for coordinating with participating organizations.”
Integrated Operations Division
Readers of my blog, Chemical Facility Security News, will recognize that the Integrated Operations Division is the regional organization that supports CISA operations in the field, including chemical security inspectors. The Committee increased funding for IOD by $17.1 million. The Report requires that:
“CISA shall report on the strategy and implementation plan for expanding regional capacity, to include a workload staffing model detailing the resourcing for Cyber Security Advisors , Physical Security Advisors, Chemical Inspectors, and other regional support staff. As part of the model, CISA shall consider whether the regional staffing requirements would benefit from introducing or increasing discipline-specific specialists.”
Moving Forward
Based upon recent history, this bill is unlikely to be considered by the House as a standalone measure. Significant portions will be included in the inevitable omnibus spending bill that will probably pass later this year. Because of their control of the purse, the mandates from the Report will continue in force.