There is a great deal of interest in the cybersecurity activities of the federal government. Cyberattacks against the U.S. government and the nation have been reported with increasing frequency since 2006. Recent high profile breaches of federal government systems, including those of the White House, State Department, and Office of Personnel Management, have called into question the ability of the federal government to secure its data and networks adequately in today's threat environment. Funding for cybersecurity activities has also risen over the years. Although a methodologically rigorous total for these investments has not been calculated, an understanding of how the federal government applies resources to enhance its cybersecurity is necessary for Congress to provide constructive oversight and prevent waste. This report provides an overview of how the federal government has applied resources to promote cybersecurity in the past, and options for how it could choose to do so in the future. One of the challenges in discussing federal cybersecurity is that a common definition for the term "cybersecurity" does not exist. The United States Computer Emergency Readiness Team (US-CERT) provides the following definition: The activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation. Extended Definition: Strategy, policy, and standards regarding the security of and operations in cyberspace, and encompass[ing] the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure. This definition presents cybersecurity as an integrated function. Any federal agency that employs information technology engages in cybersecurity activities in some way. Rather than attempting to explore the "full range" of activities in the above US-CERT definition, this report will focus on a more limited range of activities: those involved in the protection of U.S. public and private sector data and networks from cyberattacks. Issues of deterrence, international engagement, diplomacy, military, and intelligence missions will largely be left for discussion in other reports. For this report, federal government spending on cybersecurity will be analyzed in three ways: Agency spending to protect its own systems, networks, and data; Agency spending to protect other governmental systems, networks, and data; and Agency spending to protect non-federal IT systems, networks, and data. The first two types of spending can be termed "internal" spending, as they relate to the government dealing with its own cybersecurity responsibilities within the federal .gov domain. Each of these includes spending on information technology infrastructure (i.e., hardware and software) and services (including the costs of personnel). The third type can be termed "external" spending, as it relates to the government promoting cybersecurity to elements beyond its direct control. This type can also be divided into two categories: direct funding—usually in the form of grants or other direct financing—and services—which could include training, technical assistance, regulatory efforts, information sharing efforts, or other programs where the government helps facilitate cybersecurity functions of outside organizations. After reviewing these various cybersecurity responsibilities and potential ways to assess federal spending to meet them, this report will analyze three sources often cited as totals of cybersecurity spending, and discuss what would be necessary to provide an authoritative total that could support oversight efforts. As noted above, all federal agencies that use information technology make investments in cybersecurity in their own systems and personnel. A handful of other agencies have specific cybersecurity responsibilities in protecting the whole federal government enterprise from cyberattacks. Federal agency investments in their own cybersecurity include acquisitions of security hardware and software, the hiring of specialized personnel, and the training of staff. Generally, an agency is responsible for the security of its own systems, networks, and data. This includes agency generated data (like financial information) and collected data (like that submitted by the citizen population). This is governed by the requirements in the Federal Information Security Management Act as amended (hereinafter referred to as FISMA). Several cabinet-level departments and federal agencies have unique responsibilities in promoting internal cybersecurity within the federal government. The Office of Management and Budget (OMB), in exercising its management role, requires agencies to implement cybersecurity protocols. The Department of Homeland Security (DHS) implements government-wide programs to protect the federal .gov domain from adversaries and oversees agency adoption of cybersecurity. The Department of Commerce (DOC), acting through the National Institutes for Standards and Technology (NIST), develops the standards for federal information technology systems. The Department of Justice (DOJ) investigates and prosecutes crimes involving federal information technology. The Department of Defense (DOD) participates in the requirements for unclassified systems under FISMA, and chairs the Committee on National Security System (CNSS) which performs a similar function as DHS for national security systems. The DOD has unique authorities for ensuring the cybersecurity of the .mil domain. A list of CRS experts capable of addressing Congressional inquiries regarding the cybersecurity functions of these departments is provided at the end of this report. The federal government plays a role in enhancing cybersecurity in the non-federal sector as well. The non-federal sector includes state, local, and tribal governments; the private sector; academia; and non-governmental organizations. Federal investment in the nation's cybersecurity is based on the increased reliance American companies and individuals have on the Internet. About 85% of the U.S. population uses the Internet—for communication, commerce, entertainment, financial transactions, and even the monitoring, control, and enabling of industrial activities. When agencies invest federal resources in cybersecurity outside the .gov domain, they are generally fulfilling one of three responsibilities: 1. The first responsibility is to broadly improve national cybersecurity (e.g., information sharing programs or law enforcement activities). An example of this is the National Cybersecurity and Communications Integration Center (NCCIC) at DHS, or the National Cyber Investigative Joint Task Force (NCIJTF) hosted by the Federal Bureau of Investigation (FBI). Both of these organizations share information on cyber threats and how those threats can be mitigated. 2. Another is to encourage improved cybersecurity activities within a specific sector (e.g., sector-specific agency activities for critical infrastructure). An example of this is the grant programs the Department of Energy (DOE) provides to industry to research ways to bolster the cybersecurity of the electric grid. 3. Finally, agencies wield regulatory authority over certain sectors of the economy that encompasses their cybersecurity practices. Examples of this include the Department of the Treasury's establishment of regulations for record-keeping and the retention of records, and the Federal Trade Commission enforcing regulations by fining individual companies for violating consumer protections. There are several different reasons for interest in various calculations of federal spending on cybersecurity. One might ask how much the government spends on cybersecurity in an attempt to gauge a level of commitment to confronting the issue. At the agency level, there may be an interest in looking at spending on cybersecurity as part of an effort to compare the level of activity across the government. An authoritative top-line number for federal government spending on cybersecurity cannot be calculated, however, without an explicit definition of what such a total encompasses and consistent reporting of data from all federal agencies. As such, neither the President's nor the agency budget justifications, nor the FISMA report (both discussed below) can be considered complete and accurate representations of how much the federal government is spending on cybersecurity. Each February, the administration is expected to submit to Congress the following: The President's Budget for the fiscal year; Agency budget justifications; and The Annual Report to Congress: Federal Information Security Management Act. Each of these submissions includes a manner of accounting for cybersecurity spending. Federal law requires the President to submit the budget of the U.S. government for the coming fiscal year " On or after the first Monday in January but not later than the first Monday in February." Although sometimes the release of the budget and its supporting documents is delayed beyond the statutory window, usually they are released by the Office of Management and Budget (OMB) on the first Monday in February . Each year, the budget includes documents outlining government's activities and the administration's policy priorities in the coming fiscal year. The Obama Administration's FY2017 budget request included a three-page fact sheet on cybersecurity spending. This fact sheet stated that the Administration requested $19 billion "to support a broad-based cybersecurity strategy." It went on to highlight roughly $5.8 billion in funding requested for seven agencies in a brief discussion of priority cybersecurity programs. The FY2016 budget request included a similar four-page fact sheet on cybersecurity spending, which stated that the Administration requested $14 billion "to support the Administration's cybersecurity strategy." It went on to highlight roughly $12.4 billion in priority programs. While the methodology used in OMB's analysis in developing these totals is unknown, closer examination of the funding for each of the agencies highlighted showed inconsistencies in methodologies among the agencies' accounting (discussed further below) and significant lack of detail. At roughly the same time as the release of the budget request by OMB, agencies release justifications outlining their own proposed budgets in much greater detail than is included in the President's budget request documents. CRS appropriations experts reviewed agency budget justifications as part of an effort to assess the inclusiveness of the Administration's total number cited in the budget request, to determine if it was a total calculation of federal cybersecurity investments. Those reviews revealed a lack of consistency in agency reporting on cybersecurity spending across the government in their budget justifications. This inconsistency makes agency-to-agency comparisons in cybersecurity investments difficult. Some agencies, such as DOE, included cybersecurity as a crosscut analysis of their budget.