Department of the Treasury 

Cybersecurity Enhancement 

Account 

Congressional Budget 

Justification and Annual 

Performance Report and Plan 

FY 2023 
CEA - 2 

Table of Contents 

Section I – Budget Request ......................................................................................................... 3

A – Mission Statement .............................................................................................................. 3

B – Summary of the Request .................................................................................................... 3

1.1 – Appropriations Detail Table ............................................................................................ 4

1.2 – Budget Adjustments Table ............................................................................................... 4

C – Budget Increases and Decreases Description ..................................................................... 4

1.3 – Object Classification (Schedule O) .................................................................................. 9

D – Appropriations Language and Explanation of Changes .................................................. 10

E – Legislative Proposals ........................................................................................................ 10

Section II – Annual Performance Plan and Report ............................................................... 11

A – Strategic Alignment ......................................................................................................... 11

B – Budget and Performance by Budget Activity .................................................................. 11

2.1.1 Cybersecurity Enhancement Account Resources and Measures ................................... 11

Cybersecurity Enhancement Account (CEA) Budget and Performance ................................ 11

C – Changes in Performance Measures .................................................................................. 13

Section III – Additional Information ...................................................................................... 13

A – Summary of Capital Investments ..................................................................................... 13

B – National Institute of Standards and Technology (NIST) Crosswalk ................................ 13
CEA - 3 

Section I – Budget Request 

A – Mission Statement 

Bolster the Department’s cybersecurity posture. 

B – Summary of the Request 

To support the Department’s proactive and strategic approach to protecting and hardening the 

Treasury’s Information Technology (IT) infrastructure against cyber criminals and nation state 

actors, the FY 2023 budget request includes $215 million for the Cybersecurity Enhancement 

Account (CEA) to protect and defend sensitive agency systems and information and strengthen 

the role of the Treasury Chief Information Officer (CIO) in identifying, responding, and 

protecting against cyber threats. The request supports Treasury’s enterprise-wide investments, as 

well as $12 million for bureau specific investments that will extend and reinforce the security 

protections sought by CIO. 

Treasury’s mission in geopolitical, economic, foreign policy, and national security matters for 

the United States government, means its infrastructure and data are prime targets for cyber 

criminals and nation state actors. Protecting Treasury’s leadership role in this mission requires 

commensurate infrastructure investment. Treasury’s pivotal role in sanctions increases this risk. 

The FY 2023 Budget request provides critical cybersecurity resources to support Treasury’s 

efforts to comply with the Executive Order 14028 (EO), Improving the Nation’s Cybersecurity as 

well as Office of Management and Budget (OMB) Memorandums, specifically M-21-31

Improving the Federal Government’s Investigative and Remediation Capabilities (security 

logging) and M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity 

Principles. CEA’s funding request also supports compliance efforts associated with Department 

of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) guidance 

that sets new cybersecurity standards and objectives. These new directives also prioritize cloudbased security, security operations center (SOC) enhancements, universal encryption, and multifactor authentication (MFA). 

The CEA is positioned as a centralized account to support enterprise-wide cyber services and to 

further enhance cyber capabilities, providing a platform to enhance efficiency, communication, 

transparency, and accountability around the Treasury’s mission. The FY 2023 request elevates 

the importance of such initiatives and provides Treasury leadership, OMB, and Congress with a 

more holistic vantage point of cybersecurity activities across the Department. With the increase 

in cyber requirements and cascading deadlines, the Department is centralizing cybersecurity 

initiative leadership and oversight to gain operational efficiencies, ensure transparency and 

achieve enterprise-wide compliance for IT infrastructure. The enterprise-wide investment 

approach benefits the bureaus in their cybersecurity goals to create unified approach to cyber 

spending and stronger protections across the Department. 

The investments within the CEA continue to align with the National Institute of Standards and 

Technology (NIST) Cybersecurity core framework and reporting standards. This includes 

common cybersecurity activities and outcomes that are gaining use industry-wide: Identify, 

Protect, Detect, Respond, and Recover. 
CEA - 4 

1.1 – Appropriations Detail Table 

Dollars in Thousands 

 FY 2021 FY 2022 FY 2023 FY 2022 to FY 2023 

Appropriated Resources Operating Plan Annualized CR Request % Change 

New Appropriated 

Resources FTE AMOUNT FTE AMOUNT FTE AMOUNT FTE AMOUNT 

Cybersecurity Enhancement 

Account 4 18,000 10 18,000 21 215,000 110.0% 1094.4% 

Subtotal New 

Appropriated Resources 4 $18,000 10 $18,000 21 $215,000 110.0% 1094.4% 

Other Resources Recoveries from Prior Years 0 1,500 0 2,000 0 2,000 NA 0.0% 

Unobligated Balances from 

Prior Years 0 26,463 0 17,923 0 17,403 NA -2.9% 

Subtotal Other Resources 0 $27,963 0 $19,923 0 $19,403 NA -2.6% 

Total Budgetary Resources 4 $45,963 10 $37,923 21 $234,403 110.0% 518.1% 

*FTE = Full-time Equivalent employment 

1.2 – Budget Adjustments Table 

 FTE Amount 

FY 2022 Annualized CR 10 $18,000 

Changes to Base: 

 Non-Recurring Costs (10) (18,000) 

Subtotal Changes to Base (10) (18,000) 

FY 2023 Current Services 0 $0 

Program Changes: 

Program Increases: 21 215,000 

Zero Trust Architecture Implementation 9 86,452 

Security Logging Requirements 0 23,329 

Cloud Enterprise Investment1 0 22,500 

Universal Encryption 0 16,467 

Multi-Factor Authentication 0 10,978 

Other Cybersecurity Priorities 9 43,050 

Bureau Specific Investments 

Cloud Adoption - Bureau of the Fiscal Service (Fiscal Service) 0 9,674 

FISMA Assessment Readiness Team - Departmental Offices 

 Salaries and Expenses (DO SE) 3 1,850 

Logging Requirements - Treasury Inspector General for Tax 

 Administration (TIGTA) 0 700 

Subtotal Program Changes 21 $215,000 

FY 2023 President's Budget Request 21 $215,000 

1The $22.5 million program increase for the Cloud Enterprise Investment includes enhancing and 

upgrading cloud security capabilities across the Department, including related IRS cyber activities. 

C – Budget Increases and Decreases Description 

Non-Recurring Costs ............................................................. -$18,000,000 / -10 FTE 

This amount represents non-recurring initial investments. 

Program Increases ............................................................+$215,000,000 / +21 FTE 

Zero Trust Architecture Implementation +$86,452,000 / +9 FTE 

This investment supports work towards a compliant zero trust maturity model. This large-scale 

investment approach requires Treasury to enhance visibility and threat detection at the 

application level to improve its ability to support continuous threat analysis, detection, and 

response, and enable the analysis of encrypted traffic. Reinforcing implementation of continuous 

identity verification and access policies, aligned with Zero Trust, will improve the Department’s 

resistance to fraudulent tampering of privileged accounts. 

 
CEA - 5 

Zero Trust Architecture (ZTA) is an IT security approach to minimize implicit trust and 

reinvigorate least privilege. The ZTA approach is a paradigm shift from verifying once at the 

perimeter to continual verification of each user, device, application, and transaction. This 

approach will do the following: 

 Enable a new default security posture using the practice of “never trust, always verify” across 

the entire technology stack. 

 Alter the approach for access enforcement, leveraging granular policies to assess the user 

identity, user device, and the categorization of the data before making an access decision. 

 Shift from defending the “macro attack surface” to the “micro protect surface.” 

Implementation of Zero Trust will initially be driven by focusing on the near-term actions 

required by OMB M-22-09, such as changes to password policies, building a new data 

categorization model, and making one “internal” systems accessible over the Internet. Treasury 

will proceed with the transition to ZTA by planning projects on a pillar-by-pillar basis (Identity, 

Device, Network, Application, Data, as well as Monitoring/Visibility, Automation, and 

Governance). Priority projects will be based on the risk reduction that will result, as well as the 

anticipated gain in Zero Trust Maturity they will provide weighed against the 

cost. Implementation of ZTA will require personnel resources with skillsets for managing the 

service providers to develop, test, and deploy the applications that have integrated security 

controls. 

Security Logging Requirements +$23,329,000 / +0 FTE 

Supports Treasury’s compliance efforts related to the security logging requirements outlined in 

OMB Memorandum M-21-31. This guidance requires all logs of security information captured, 

to be accessible and visible for the highest-level security operations center (SOC) at the 

Department. This will require expansion of the Treasury Shared Services Secure Operations 

Center (TSSSOC) enterprise logging solution to be able to receive, store, analyze and process 

security event and system logs from all Treasury offices and bureaus as well as the 39 Treasury 

Shared Services. This will allow Treasury to: 

 Create and monitor traps for detecting data-stream disruption

 Implement a facility to share the logs with CISA, FBI and other authorities required 

 Provide storage and retention for log data consistent with M-21-31 requirements 

 Analyze logs in real time to detect attacks and other activities of interest 

 Develop automated hunt and incident response playbooks that take advantage of Security, 

Orchestration, Automation, and Response (SOAR) capabilities

 Create and implement a user behavioral analytics capability to allow for early detection of 

malicious behavior on all user and non-user accounts. This requires machine learning and 

artificial intelligence techniques to detect anomalous user actions and help combat advanced 

threats

 
CEA - 6 

The FY 2023 budget request for Security Logging Requirements will be used in the following 

ways: 

 Support appropriate acquisition of subject matter expertise for the development of an 

enterprise, centralized logging solution that leverages a single architecture and allows for 

segmentation of Bureau data, and presents efficiencies in collecting and distributing necessary 

information to external partners (e.g., CISA, FBI, etc.) 

 Stand-up the initial capabilities (resource support, development, migration, etc.) within the 

Treasury enterprise cloud program, Workplace Community Cloud (WC2) 

 Support initial storage requirements to centralize enterprise shared service program logs, with 

targeted expansion of architecture and migration of Bureaus logs to the centralized cloud-based 

storage solution 

 Expansion of enterprise license capacity to support centralized log management and the onramping of Bureaus from legacy licensing and log storage environments

There are many factors that will impact on the costs associated with implementation of the 

security logging requirements. These factors include but are not limited to legacy licensing; 

contract structures; resources for O&M; and holistic storage requirements. The complexity of a 

federated bureau environment also proposes a unique challenge to ensure compliance. 

Cloud Enterprise Investment +$22,500,000 / +0 FTE

This investment is for cloud enterprise cyber security enhancements and upgraded capabilities to 

meet ever growing security and compliance risks. The Treasury enterprise cloud program 

enhances security controls, monitors capabilities, and increases threat protections by providing a 

common cloud operating platform for Departmental workloads inclusive of all the of the security 

elements driven by EO 14028 and subsidiary guidance. This will allow the bureaus to integrate 

into Treasury’s holistic security umbrella with a single pane of glass view for operational 

security elements such as the TSSOC. 

Treasury continues to improve, entice, and further accelerate enterprise-wide cloud adoption 

through investment in cloud environments. The FY 2023 budget request will support 

improvements in the following areas: 

 Identity Pillars - Includes migrations of cloud users to Azure Active Directory (AD) and 

implementation of Azure Defender for endpoints and users. Azure AD will enable the 

enterprise shared service cloud program to centralize and streamline governance and 

management of WC2 privileged accounts, and includes advanced threat protections such as 

automated detection, remediation and reporting of unusual activity using latest threat detection 

and analytics. 

 Network and Environment Segregation - Includes an architecture ZTA maturity assessment 

and implementation plan for both Treasury shared services cloud environments against NIST 

Zero Trust reference Architectures. Implementation will focus on security control 

enhancements to achieve the near-term ZTA vision and alignment to NIST container-based 

control security requirements. 

 Cloud Monitoring Tenant - Includes increased cloud telemetry, implementation for Trusted 

Internet Connection (TIC) 3.0 requirements, and consolidation of logging environments to 

reduce ongoing O&M costs and adopt the latest advances in log analysis. Additional security 
CEA - 7 

operations and threat hunting support will operationalize the data creating security dashboards 

to show potential security issues which require investigation. 

Universal Encryption +$16,467,000 / +0 FTE 

Supports Treasury’s commitment to fully comply with the encryption protocols outlined in EO 

14028 and subsidiary supporting material from OMB, CISA, NIST and other cybersecurity 

oversight entities. Encryptions allows information and data to be converted into code to prevent 

unauthorized access. This funding level is necessary to develop a more aggressive approach to 

these cyber protections which contributes to the adoption of ZTA. 

To further protections of the internet and email traffic across its networks, Treasury uses 

encryption protocols to prevent adversaries from being able to intercept and capture traffic as it 

flows between endpoints. EO 14028 and M-22-09 prescribe a heightened level of encryption for 

Domain Name System (DNS) and Hypertext Transfer Protocol (HTTP) traffic that all agencies 

should use to increase the security of information transfer, particularly across public networks 

such as the Internet. It is anticipated that no changes will be made to the DNS infrastructure to 

enable encryption, and that the work will focus on transitioning applications to use HTTPS for 

secure communication with users. Treasury is also implementing Data at Rest (DAR) and Date 

in Transit (DIT) encryption across its entire IT portfolio. 

Multi-Factor Authentication +$10,978,000 / +0 FTE 

This investment is for Multi-Factor Authentication (MFA), which is a critical part of the Federal 

Government’s security baseline and integral component of Treasury’s solutions to prevent 

unauthorized access by adversaries including nation state actors. MFA is a layered approach to 

securing access to a network or application by verifying identity with a combination of two or 

more approved pieces of strong evidence (or factors) to an authentication mechanism. Typical 

MFA factors include knowledge (something only the user knows such as a PIN), possession 

(something only the user has such as a smart card), and inherence (form of biometric specific 

only to the user like a fingerprint). 

EO 14028 directed agencies to remove passwords and fully adopt MFA to the maximum extent 

by November 2021. While Treasury has made substantial progress with an increase in MFA 

compliance posture by 16% for internal systems and applications (moving from 58% to 74%);

there is significant work to be done including compliance with subsequent memos impacting 

MFA like M-22-09, which places significant emphasis on MFA. The FY 2023 funding levels 

support Treasury’s work to protect data at rest and in transit, which may include personal 

identification of financial assets; collaborate with industry partners, and to also align with the 

FISMA requirements driven by CISA. 

Other Cybersecurity Priorities +$43,050,000 / +9 FTE

In FY 2023, Treasury will continue to make progress on ongoing critical cybersecurity 

investments that are in various Development, Modernization and Enhancement (DME) and 

initial Operation and Maintenance (O&M) phases. Continued funding of these critical 

investments is necessary to sustain progress made on some investments and launch new projects 

not previously identified. Responding to the changing threat landscape in an interconnected 

environment has amplified the need for identifying and assessing the security posture of high 

value assets as well as vendors within our supply chain. Additionally, based on the complex 
CEA - 8 

nature of cybersecurity, ongoing maturation of these programs is necessary to enable much 

needed visibility into the myriad of threats, vulnerabilities, and cybersecurity risks facing 

Treasury. Priority investments include but are not limited to: 

 Supply Chain Risk Management Enhancements (SCRM) 

 Enterprise Cyber Risk Management (ECRM) 

 Governance, Risk and Compliance (GRC) 

 High Value Assets (HVA) 

 Enterprise Threat and Vulnerability Management (ETVM) 

 Vulnerability Disclosure Policy (VDP) Platform 

 Ongoing SolarWinds Infrastructure and Post Incident Investments: 

o Threat intelligence providing proactive posture with regards to emergent threat (Post 

Incident) 

o Enterprise Application Security Improvements (Post Incident) 

o Annual Threat Hunt (Post Incident) 

o Hardware Security Modules (HSM) for generation and storage of security certificates 

(Infrastructure) 

Additionally, the personnel resources requested are a part of Treasury’s reinforcement and 

maturation of its cybersecurity compliance practices. These resources will focus on HVAs, ECRM 

and SCRM to support the EO 1402 and FISMA assurance activities to ensure criteria to evaluate 

software security and utilization of tools demonstrate conformance to security practices. 

Bureau Specific Investment +$12,224,000 / +3 FTE 

Cloud Adoption- Bureau of the Fiscal Service (Fiscal Service) +$9,674,000 / +0 FTE 

This investment will accelerate Fiscal Service’s Cloud Adoption from aging, costly platforms to 

optimize cloud‐based architecture that will enhance the resiliency of Fiscal Service’s systems 

and remediate Fiscal Service audit deficiencies. This applies to Fiscal Service’s specific portfolio 

of applications and systems. Many of Fiscal Service’s HVAs that support the National Critical 

Financial Infrastructure (NCFI) are currently hosted on aging platforms based on antiquated 

code. For example, one of these platforms is the Fiscal Service Mainframe, which costs $45.9 

million annually substantial contractual costs that is anticipated to continue increasing over time. 

Consistent with the EO 14208, this funding will allow Fiscal Service to move over 60 FISMA 

systems to secure cloud services, including Software as a Service (SaaS), Infrastructure as a 

Service (IaaS), and Platform as a Service (PaaS). It will also enhance the business continuity and 

disaster recovery of these systems. 

FISMA Assessment Readiness Team- Departmental Offices Salaries and Expenses (DO SE) 

$1,850,000 / +3 FTE 

This investment will establish an Assessment Readiness Team (ART) which will be responsible 

for conducting independent assessments of security policies, programs, and operations 

throughout Treasury to identify gaps in a bureau’s security posture and close them before they 

can be exploited by cyber criminals and nation state actors. The ART will be responsible for 

conducting security control assessments ensuring incident detection controls are employed and 

identifying associated deficiencies to detect capabilities across Treasury systems. These 

assessments will be used to improve Treasury’s cybersecurity maturity model against technical, 

management and operational controls. 
CEA - 9 

Logging Requirements- Treasury Inspector General for Tax Administration (TIGTA) +$700,000 

/ +0 FTE 

This investment supports TIGTA’s plans to meet EO 14028 and subsequent OMB M-21-31. 

TIGTA will continue strengthening and operating its enterprise logging solution to meet current 

and future demands to: 

 Collect security event and system logs in real time for threat detection and compliance use 

cases 

 Analyze logs in real time to detect attacks and other activities of interest 

 Investigate incidents to determine their potential severity and impact on a business 

 Report on these activities 

 Store relevant events and logs 

This will also enable TIGTA to perform the data collection needed to meet the requirements and 

automate the identification of unauthorized disclosure or access (UNAX) while also vastly 

improving the cyber detection capabilities. At the same time, it will meet on-going demands for 

improved efficiencies around cyber incident detection and response. The request will fund 12 

months of operations. 

1.3 – Object Classification (Schedule O) 

Dollars in Thousands 

 FY 2021 FY 2022 FY 2023 

 Actual 

Obligations 

Estimated 

Obligations 

Estimated 

Object Classification Obligations 

11.1 - Full-time permanent 591 1,935 3,150 

11.5 - Other personnel compensation 10 0 0 

11.9 - Personnel Compensation (Total) 601 1,935 3,150 

12.0 - Personnel benefits 245 669 945 

Total Personnel and Compensation Benefits $846 $2,604 $4,095 

21.0 - Travel and transportation of persons 0 0 

23.3 - Communications, utilities, and miscellaneous charges 0 1,035 6,810 

25.1 - Advisory and assistance services 24,792 10,818 71,191 

25.2 - Other services from non-Federal sources 206 796 5,238 

25.3 - Other goods and services from Federal sources 0 569 3,742 

25.7 - Operation and maintenance of equipment 0 2,050 13,489 

26.0 - Supplies and materials 3 0 0 

31.0 - Equipment 2153 2,649 17,434 

32.0 - Land and structures 40 0 0 

Total Non-Personnel $27,194 $17,916 $117,905 

Total Obligations $28,040 $20,520 $122,000 

 

Full-time Equivalents (FTE) 4 10 21 

*Amounts reflect obligations of annual appropriated resources, carryover balance, reimbursables, and transfers. 
CEA - 10 

D – Appropriations Language and Explanation of Changes 

Appropriations Language Explanation of Changes 

DEPARTMENT OF THE TREASURY 

DEPARTMENTAL OFFICES 

CYBERSECURITY ENHANCEMENT ACCOUNT 

(INCLUDING TRANSFER OF FUNDS) 

For salaries and expenses for enhanced cybersecurity for systems 

operated by the Department of the Treasury, $215,000,000, to 

remain available until September 30, 2025: Provided, That such 

funds shall supplement and not supplant any other amounts made 

available to the Treasury offices and bureaus for cybersecurity: 

Provided further, That of the total amount made available under this 

heading $9,000,000 shall be available for administrative expenses 

for the Treasury Chief Information Officer to provide oversight of 

the investments made under this heading: Provided further, That 

such funds shall supplement and not supplant any other amounts 

made available to the Treasury Chief Information Officer. 

Note.—A full-year 2022 appropriation for this account was not 

enacted at the time the Budget was prepared; therefore, the Budget 

assumes this account is operating under the Continuing 

Appropriations Act, 2022 (Division A of Public Law 117–43, as 

amended). The amounts included for 2022 reflect the annualized 

level provided by the continuing resolution

E – Legislative Proposals 

The Cybersecurity Enhancement Account has no legislative proposals. 
CEA - 11 

Section II – Annual Performance Plan and Report 

A – Strategic Alignment 

Alignment with the Treasury Strategic Plan 

The CEA is focused on an enterprise approach to bolstering and security of Treasury’s critical IT 

systems and infrastructure to meet these Department’s strategic goals and objectives 

uninterrupted. The CEA aligns with the following Treasury strategic goal and objectives as 

presented in the FY 2022- 2026 strategic plan: 

Goal 2: Enhance National Security 

 Objective 2.1 – Cyber Resiliency of Financial Systems and Institutions - Harden assets and 

systems of Treasury and the broader financial system to promote financial system resiliency. 

Goal 3: Protect Financial Stability and Resiliency 

 Objective 3.1 – Financial System Vulnerabilities - Identify and address current and emerging 

vulnerabilities to the stability of the U.S. and global financial systems to support more 

sustainable and equitable growth. 

B – Budget and Performance by Budget Activity 

2.1.1 Cybersecurity Enhancement Account Resources and Measures 

Dollars in Thousands 

 

Resource Level

FY 2017 

Actuals 

FY 2018 

Actuals 

FY 2019 

Actuals 

FY 2020 

Actuals 

FY 2021 

Actuals 

FY 2022 

Annualized 

CR 

FY 2023 

Request 

Appropriated Resources 47,743 24,000 25,208 20,538 28,040 18,000 215,000 

Budget Activity Total $47,743 $24,000 $25,208 $20,538 $28,040 $18,000 $215,000 

Full-time Equivalents (FTE) 1 8 12 3 4 10 21 

*The FY 2017 – 2021 appropriated resources represent the approved operating plan. 

 FY 2017 FY 2018 FY 2019 FY 2020 FY 2021 FY 2021 FY 2022 FY 2023 

Performance Measure Actual Actual Actual Actual Actual Target Target Target 

Number of Major Incidents N/A 0 0 1 1 0 0 0 

Number of Reported Incidents N/A 225 152 206 246 150 150 150 

Percentage of Tier I High Value 

Assets (HVA) where Risk and 

Vulnerability Assessment (RVA) or 

Security Architecture Review (SAR) 

are Completed on Time (%) 

N/A 100 100 10 100 100 100 100 

Percentage of High and/or Critical 

Findings from RVAs or SARs on 

Tier I HVAs that are closed by the 

end of the FY 

N/A N/A 57% 80% 80% 75% 75% 80% 

Cybersecurity Enhancement Account (CEA) Budget and Performance 

($215,000,000 from direct appropriations): 

The purpose of CEA is to strategically mitigate cybersecurity risks through a centralized 

program with Department-wide impact. Investments support the core framework of the 

Department’s IT infrastructure. Due to the increasing volume and sophistication of cyberattacks, 

Treasury leadership continues to prioritize cybersecurity and will centralize department-wide 

cybersecurity initiatives through the CEA account. As a result, the FY 2023 CEA will begin to 

include bureau-level cybersecurity spending for specific investments related to cloud adoption 

and security logging requirements. 
CEA - 12 

Description of Performance 

Number of Major Incidents: 

The number of major incidents, as defined in OMB M-19-02, reported by Treasury to Congress 

in a given fiscal year. This is a measure of how effective Treasury’s collective defenses are at 

mitigating the most damaging security threats. On December 12, 2020, Treasury notified CISA 

of a major security incident because of the deployment of the SolarWinds Orion software 

product. Treasury has completed compromise assessments and all SolarWinds Orion products 

continue to remain offline across the Treasury Enterprise environment. The FY 2023 request 

includes additional funding to mitigate weaknesses identified and investments that support 

critical IT improvements. The FY 2022 and 2023 performance target of zero major incidents 

reported will be met through continued work to harden cybersecurity protocols, implementation 

of new cyber technology, interagency collaboration, increased training for cyber personnel, and 

customer feedback. 

Number of Reported Incidents: 

Each fiscal year, Treasury tracks the number of cybersecurity incidents reported to the United 

States Computer Emergency Readiness Team (US-CERT). This helps measure the effectiveness 

of Treasury’s defenses at mitigating security threats and is an indicator of how often Treasury is 

being targeted by malicious actors. If the number of reported incidents rises while the number of 

major incidents remains steady or declines, it indicates an effective cybersecurity program. The 

incidence of intrusion events at Treasury has not remained constant over time, and projections 

must be used as a baseline measure only. In FY 2021, Treasury witnessed a lower number of 

incidents being reported, this is indicative of enhanced detection and mitigation capabilities. The 

FY 2022 and FY 2023 targets will remain flat. 

Percentage of High and/or Critical Findings from Risk and Vulnerability Assessment (RVAs) or 

Security Architecture Review (SARs) on Tier I High Value Assets (HVAs) that are closed by the 

end of the Fiscal Year (FY):

This is a measure of how Treasury addresses the vulnerabilities and potentially exploitable 

weaknesses of its most important systems, based on its HVA assessment process. Treasury’s 

CEA performance targets are based upon the percentage of HVA system assessments that are 

conducted in accordance with the HVA assessment cycle and the closure rate of resulting 

findings and/or Plans of Action and Milestones (POAMs) within the fiscal year. Treasury has 

consistently recorded a 100 percent completion rate for system assessments and currently has a 

100 percent closure rate for associated findings and POAMs. This focus helps to ensure that the 

proper POAMs are in place for all assessed systems and that they are being acted upon in a 

timely manner. The investment will focus on remediation of vulnerabilities, as well as increased 

review and reporting on corrective actions to resolve all findings and recommendations discerned 

during the assessment process. It was decided that the FY 2022 and 2023 targets will remain flat 

from FY 2021 numbers due to the likelihood of findings from HVA assessments requiring longterm remediation efforts. 
CEA - 13 

C – Changes in Performance Measures 

This year, CEA is working to align budget activities and performance measures to the new 

objectives in the Treasury FY 2022 – 2026 Strategic Plan. This work will include benchmarking 

performance and may result in changes to performance measures in the FY 2024 budget. 

CEA has no changes to any performance measures from the previous year President’s Budget. 

Section III – Additional Information 

A – Summary of Capital Investments 

Capital investments that support CEA are included in the Departmental Offices plan. 

A summary of capital investment resources, including major information technology and nontechnology investments can be viewed and downloaded at: 

https://www.treasury.gov/about/budget-performance/Pages/summary-of-capitalinvestments.aspx. 

B – National Institute of Standards and Technology (NIST) Crosswalk 

NIST Crosswalk to FY 2023 President’s Budget Request: 

 

CEA Investments Identify Protect Detect Respond Recover Total FY 2023 Request

Zero Trust Architecture Implementation $                             ‐ $           ‐ 86,452,000 $                          ‐ $                              ‐ $                         $                  86,452,000

Security Logging Requirements $                             ‐ $           ‐ 23,329,000 $                          ‐ $                              ‐ $                         $                  23,329,000

Cloud Enterprise Investment $                             ‐ $           ‐ 22,500,000 $                          ‐ $                              ‐ $                         $                  22,500,000

Universal Encryption $                             ‐ $           ‐ 16,467,000 $                          ‐ $                              ‐ $                         $                  16,467,000

Multi‐Factor Authentication (MFA) $                             ‐ $            3,659,333 $           3,659,333 $                ‐ 3,659,333 $                         $                  10,978,000

Other Cybersecurity Priorities $             26,069,167 $          11,719,167 $           2,152,500 $               2,152,500 $             956,667 $                  43,050,000

Bureau Specific Investments 925,000 $                   $          10,374,000 $               ‐ 925,000 $                              ‐ $                         $                  12,224,000

BFS‐ Cloud Adoption $                             ‐ $             ‐ 9,674,000 $                          ‐ $                              ‐ $                         $                     9,674,000

DO SE‐FISMA ART 925,000 $                   ‐ $                         $               ‐ 925,000 $                              ‐ $                         $                     1,850,000

TIGTA‐Security Logging $                             ‐ $                ‐ 700,000 $                          ‐ $                              ‐ $                         $                        700,000

Grand Total 26,994,167 $              $       175,425,500 $           5,811,833 $               5,811,833 $             956,667 $                215,000,000

NIST Reporting Categories