Latest government funding bill makes modest cut to CISA

The Cybersecurity and Infrastructure Security Agency (CISA) would receive $2.8 billion in fiscal 2024 under a government funding package U.S. lawmakers unveiled on Thursday.

That amount, part of a total $1.2 trillion package, is $35 million less than CISA received in fiscal 2023. It is also $180 million under Biden’s administration’s budget request for fiscal 2024. 

The White House’s latest proposed cybersecurity budget would pour an additional $103 million to the agency’s coffers for next year, increasing its total allocation to $3 billion.

The overall fiscal 2024 package, which the House and Senate must pass before midnight on Friday in order to avoid a short-term lapse in government funding, provides CISA about $20 million less than it sought.

CISA most recently asked for $116 million, in fiscal 2025, just to oversee the implementation of a long-expected incident reporting rule. 

Once in effect, the rule will require critical infrastructure entities to report breaches to CISA within 72 hours. It will also require them to report ransomware payments within 24 hours.

CISA is required to publish a notice of proposed rulemaking for the incident reporting requirements by the end of this month. The agency then has another 18 months to finalize the rules before they go into effect.