Although a methodologically rigorous total for these investments has not been calculated, an understanding of how the federal government applies resources to enhance its cybersecurity is necessary for Congress to provide constructive oversight and prevent waste. Rather than attempting to explore the "full range" of activities in the above US-CERT definition, this report will focus on a more limited range of activities: those involved in the protection of U.S. public and private sector data and networks from cyberattacks. How the Federal Government Invests in Cybersecurity

For this report, federal government spending on cybersecurity will be analyzed in three ways:
Agency spending to protect its own systems, networks, and data; Agency spending to protect other governmental systems, networks, and data; and Agency spending to protect non-federal IT systems, networks, and data. Specific Federal Agency Responsibilities for Internal Cybersecurity

Several cabinet-level departments and federal agencies have unique responsibilities in promoting internal cybersecurity within the federal government. The Office of Management and Budget (OMB), in exercising its management role, requires agencies to implement cybersecurity protocols. The Department of Justice (DOJ) investigates and prosecutes crimes involving federal information technology. As such, neither the President's nor the agency budget justifications, nor the FISMA report (both discussed below) can be considered complete and accurate representations of how much the federal government is spending on cybersecurity. Existing Assessments of Federal Cybersecurity Spending

Each February, the administration is expected to submit to Congress the following:
The President's Budget for the fiscal year; Agency budget justifications; and The Annual Report to Congress: Federal Information Security Management Act. Each of these submissions includes a manner of accounting for cybersecurity spending. Other agencies make distinct investments for managerial systems and mission-execution systems. Considerations for Congress

		Assessing Federal Government Cybersecurity Investments

For Congress to perform oversight of the federal government's investments in cybersecurity efforts as a whole, one could posit that four elements are necessary: an overarching federal cybersecurity strategy, a plan to execute that strategy, metrics that allow Congress to assess progress against the strategy's goals, and consistent reporting across agencies on how that strategy is being carried out. In these latter cases budget justification documents may not allow Congressional staff to identify specific levels of cybersecurity investment, and additional questioning of the department or agency may be necessary. An understanding of what risks an agency faces and what strategies the agency currently uses to combat those risks is a foundational element in examining an agency's internal cybersecurity. Understanding the risks organizations in the non-.gov domain face and their relationship with the federal government will inform the Congress and allow them to assess further levels of investment.
The federal government invests significant resources in cybersecurity across every agency through a variety of activities. Although a methodologically rigorous total for these investments has not been calculated and may not be possible, an understanding of how the federal government applies resources to protect U.S. public and private sector data and networks from cyberattacks is necessary for Congress to provide constructive oversight of those efforts.
This report considers federal cybersecurity investments in three broad categories:
Agency spending to protect its own systems, networks, and data; Agency spending to protect other governmental systems, networks, and data; and Agency spending to protect non-federal IT systems, networks, and data.
Each department and agency has some level of participation in cybersecurity activities. However, the Office of Management and Budget, the Department of Homeland Security, the Department of Commerce, the Department of Justice, and the Department of Defense have unique responsibilities established by statute—either for their role in assisting other departments and agencies, or, as in the case with the Department of Defense, for their unique responsibility for their own information technology.
Each February the administration releases three sets of documents which describe some facets of the government's investments in cybersecurity:
The President's Budget; Congressional Budget Justifications from each department or agency; and The Federal Information Security Management Act (FISMA) report to Congress.
These reports provide some valuable insights into how or why the government makes certain investments associated with promoting cybersecurity. However, on their own, none of these documents provides a complete and precise representation of how much the federal government is spending on cybersecurity. This is in part because of how they are developed; they are developed from agency submissions based on administration guidance that does not require methodologically consistent reporting on cybersecurity spending—or even provide a common definition for what cybersecurity is.
Even if such an authoritative top-line figure for federal cybersecurity investments were available, without detail and context it would not effectively inform the Congressional decision-making process. Understanding the risks an individual agency faces, and what strategies they have for confronting those risks given their size, complexity, and mission is vital to determining the appropriate level of future cybersecurity investments for that agency. Armed with an understanding of those factors, Congress may choose to assess cybersecurity investments of a federal agency independently. Congress may alternatively choose to assess internal cybersecurity investments by an agency relative to similar federal agencies, and external investments relative to, and supporting, the non-".gov" sector.