The FY 2021 Federal Budget Sustains Cybersecurity Funding, But Could Growth Be Slowing?

For the third fiscal year (FY) in a row the FY 2021 President’s Budget Request includes detailed government-wide data on the Administration’s intent to spend billions of dollars on cybersecurity across federal departments and agencies. Strengthening the cybersecurity posture of federal agencies remains a budget priority and a central component of the Trump Administration’s information technology (IT) modernization efforts.

In the Analytical Perspectives section of the FY 2021 proposed budget which was released last week, the Office of Management and Budget (OMB) includes a chapter specifically on Cybersecurity Funding. The inclusion of this funding detail is required under provisions included in the FY 2017 Consolidated Appropriations Act (omnibus). OMB’s analysis addresses that legislative requirement and covers cybersecurity activities and funding for all federal agencies, not just those carried out by the Department of Homeland Security (DHS) and Department of Defense (DOD).

Total Federal Cybersecurity Funding

The FY 2021 budget requests a total of more than $18.7B for FY 2021, down $12.8M from the estimated $18.8B in the current 2020 fiscal year. However, the FY 2021 level would be an increase of more than $1.8B over the FY 2019 actual level of just over $16.9B. If the FY 2021 budget is enacted as requested, the spending level would represent a 0.1% decrease from FY 2020 but an 11% increase over FY 2019. (See chart below.)

Is Federal Cyber- Budget Growth Slowing?

At first glance it seems surprising that OMB would actually request less funding for federal cybersecurity in the upcoming 2021 fiscal year compared to the current 2020 fiscal year, but a little historical reflection provides some additional context. Comparing this year’s FY 2021 budget request with last year’s FY 2020 budget request shows that the total enacted/estimated FY 2020 cyber- budget has been adjusted up an additional $1.3B (+8%) compared to what OMB requested and anticipated spending in FY 2020 when they submitted that budget request a year ago. OMB also restated up the final FY 2019 cyber- budget by nearly $300M or +2%. (See chart below.)

For DOD, the FY 2021 budget includes an enacted FY 2020 budget of $9.8B, which is a $432M increase compared to the requested amount of $9.6B in last year’s FY 2020 budget. For Civilian departments as a whole, the FY 2021 budget includes an enacted FY 2020 budget of $8.7B, which is a $925M increase compared to the requested amount of $7.8B in last year’s FY 2020 budget. Both the Defense and Civilian sectors saw their current fiscal year budgets grow compared to original budget requests, so the baselines for comparison with FY 2021 levels rose making the new year-over-year growth rates lower. Only time will tell if this front-loading of the spending timeline will indeed portend slower growth in future years. There is still much work to be done.

In addition, OMB notes that these amounts do not represent the entire cybersecurity budget “due to the sensitive nature of some activities.” Further, due to their sensitive and classified nature OMB says very little about DOD cyber activities beyond providing a top-line budget number of $9.8B.

Top Departments and Agencies

The bulk of federal cybersecurity funding in the FY 2021 budget is concentrated within the largest departments and among those with the largest cyber-related missions. These top ten departments account for over $16.8B – nearly 90% – of the total $18.8B FY 2021 cybersecurity budget released by OMB. That said, taken together these ten reflect a $41M decrease in cyber- budget from FY 2020 to 2021. That downward trend is predominantly due to a $229M drop at the DOD, which is somewhat offset by $100M (+17%) and $115M (+21%) increases at Treasury and Energy respectively. State is the only other department showing double-digit growth in FY 2021 at 20% while DHS is looking at a 3% increase in FY 2021. The VA, Commerce and Transportation are the only departments among the top ten beside DOD that are slated for budget declines in FY 2021, but each received significant increases in FY 2020. (See chart below.)

Departments where both percentage-change lines fall in the positive range above 0% are the strongest growing among these departments, showing growth from FY 2019 through FY 2021. Departments where the lighter blue line falls higher than the dark blue line are the departments seeing greater planned growth in FY 2021 than they saw in FY 2020. Naturally, departments where either line falls below 0% reflect a year-to-year decrease.

While we are seeing some variance and year-to-year budget trimming among some of the largest departments, the updated FY 2019 and 2020 figures from OMB noted above provide a picture of continued increased expenditures on cybersecurity government-wide and the priority it holds in the minds of agencies, OMB and appropriators in Congress, who ultimately decide how much funding agencies receive for information technology, cybersecurity, etc.

If the historical trend of upward restatements were to continue it is possible that the actual top-line FY 2021 cybersecurity budget could exceed $19B.