HR 2787 Introduced – FY 2014 DOC Spending

As I noted last week Rep. Wolf (R,VA) introduced HR 2787, the Commerce, Justice, Science, and Related Agencies Appropriations Act, 2014. The House Appropriations Committee has favorably reported the bill so it may now be acted upon by the House.

The bill provides funding for a number of agencies that have significant cybersecurity missions, including the National Institute of Standards and Technology (NIST) and the National Science Foundation (NSF). There is no specific mention of cybersecurity in the bill itself. The closest mention is found in §515 that requires agency heads to consult with the FBI to ensure that information systems being acquired have been investigated for potential cyber espionage risks, particularly if the equipment comes from China. A distant second is §533 that prohibits funds from being used to establish or maintain a computer network that doesn’t proactively block porn sites.

There are some brief mentions of cybersecurity issues in the Committee Report.  A variety of reports to Congress are required, including an annual report on cyber-attacks executed against the Department of Commerce (pg 6). The Committee Report does note that the bill provides “funding to strengthen NIST’s core cybersecurity research and development programs” (pg 61).

All of the other cybersecurity mentions in the Report deal with Dept. of Commerce internal cybersecurity measures. This includes funding for an Enterprise Security Operations Center that would provide “Department-wide, 24×7 security status information on cyber security threats” (pg 31). Additional reporting is also required on responses to an IG FISMA report on “significant weaknesses exist in basic security practices” (pg 31) in the Dept. of Commerce.

S 1329 Introduced – FY 2014 DOC Spending

As I briefly noted last week Sen. Mikulski (D,MD) introduced S 1329, the Commerce, Justice, Science, and Related Agencies Appropriations Act, 2014. The Senate Appropriations Committee also favorably reported the bill for consideration by the Senate.

The bill itself does not contain any specific cybersecurity language; the programs are all funded at too low a level to show up as items in the bill. The Committee Report does provide some cybersecurity language for programs at both NIST and NSF. Interestingly there is no mention of the President’s cybersecurity executive order (EO 13636) in the Report even though NIST is one of the prime movers in executing the EO provisions.

NIST Cybersecurity

The Committee Report (pg 20) lists three cybersecurity programs supported by NIST spending:

$15,000,000 for the National Cybersecurity Center of Excellence;

$15,000,000 for the Comprehensive National Cybersecurity Initiative; and

$24,500,000 for the National Strategy for Trusted Identities in Cyberspace

There is nothing here that specifically targets control system security, though research funding could be used for that purpose.

NSF Cybersecurity

The Report notes (pg 122) full funding for NSF cybersecurity research ($159,250,000) which includes $57 million for the above mentioned Comprehensive National Cybersecurity Initiative.

A separately funded program, the CyberCorps scholarship for service program is being funded at $45,000,000, which is $20,000,000 above the requested level. The report notes that:

“More than 900 students have completed the program, which was initiated in fiscal year 2001; 92.6 percent of students have placed with more than 120 Federal agencies.”

It would be interesting to see how many of them have since transferred to private industry.

Moving Forward

As with all Senate spending bills the typical process will entail the language from this bill being substituted for the House language (in HR 2787 in this case which was introduced yesterday) and then goes to conference to work out the differences. Only in this case this is one of the lower priority spending bills so some version of the two bills will probably get folded into an omnibus spending bill or continuing resolution.