Biden's COVID-19 relief bill earmarks $9B to beef up the CISA and $200M to hire technology and cyber experts to support the federal CISO and US Digital Service
Emily Birnbaum / Protocol :
Context & Ripple Effects
This earmark extends a decade-long pattern of White House cybersecurity funding pushes: Obama's $19B Cybersecurity National Action Plan asked Congress for a 35% increase back in 2016, and the Information Sharing Act had already built the legal scaffolding. What changed with Biden's COVID-19 relief bill is that cybersecurity money arrived inside pandemic recovery legislation rather than as a standalone request.
The $9B for CISA and $200M for technology and cyber hires under the federal CISO and US Digital Service landed just before Congress voted on the American Rescue Plan itself, which separately sent $1B to the Technology Modernization Fund. Months later the Senate layered on another $2B for cybersecurity programs in its infrastructure bill, including federal assistance to state and local governments — making 2021 the year federal cyber spending moved from proposals to appropriations.
First-order effects
- CISA gains roughly $9B in new resources, tripling down on an agency whose budget was a fraction of that, while the federal CISO and US Digital Service get $200M specifically to recruit technology and cyber experts into government.
- Federal agencies become immediate customers: the hiring money targets the chronic shortage of in-house security talent that left agencies dependent on contractors — the same contractor model behind CISA's own GitHub credential-leak investigation.
Second-order effects
- State and local governments become a second wave of beneficiaries as the follow-on infrastructure bill directs $1B of its $2B toward federal cybersecurity assistance to them, extending CISA's reach beyond federal networks.
- The private-sector competition for security engineers intensifies, since a federally funded hiring push competes directly with industry for the same scarce cyber talent pool.
Third-order effects
- If the pattern holds, cybersecurity stops being a one-off presidential initiative (as with Obama's 2016 plan) and becomes a recurring line item across multiple bills — though the later fiscal 2026 proposal to slash $491M from CISA's ~$3B budget shows how quickly those gains can be contested by a change in administration.
- Sustained federal demand for cyber expertise points toward a structural shift in how government staffs security: less reliance on contractor-maintained systems like the leaky GitHub repos CISA investigated, more permanent in-house capability.
The trend: Federal cybersecurity funding is shifting from episodic presidential initiatives to embedded appropriations across major legislation — with each administration's budget now able to expand or claw back the agency's baseline.