The Uptime report

Uptime Report Research · Budget Ledger

Cybersecurity Budget Data: Federal Civilian Cyber Spending Peaked in FY2024, and the FY2027 Request Is 13% Lower After Inflation

The federal cybersecurity budget for civilian agencies is $12.23B in the FY2027 request, according to OMB’s agency-by-agency tables. That is 5.8% below the $12.98B actually spent in FY2024 and 12.6% lower after inflation. CISA, the government’s cyber defense agency, was funded at $2.61B for FY2026, 17% below its FY2023 level in real terms.

$12.23BFY2027 request, civilian agency cybersecurity (excludes Defense)
$12.98BFY2024 actual, the high point of the series
-12.6%FY2027 request vs FY2024 actual, after inflation
$2.61BCISA enacted FY2026, -17% vs FY2023 in real terms
16.2%cyber share of the FY2027 civilian IT budget request

Most pages ranking for “cybersecurity budget” either quote a single White House topline or offer a rule of thumb with no source. This report does two things instead. First, it rebuilds the federal civilian cybersecurity budget from every OMB edition since the FY2022 budget, so each year uses the latest reported figure (actual spending where available), and adjusts it for inflation. Second, it pulls together the few organization-level benchmarks that come from primary sources, and labels which numbers we measured and which we are quoting.

The federal cybersecurity budget, FY2020 to FY2027

actual estimate request in FY2025 dollars

$0B$2B$4B$6B$8B$10B$12B$14BFY2020 actual: $7.83B nominal, $9.54B in FY2025 dollars7.8FY20act.FY2021 actual: $8.64B nominal, $10.19B in FY2025 dollars8.6FY21act.FY2022 actual: $10.01B nominal, $11.03B in FY2025 dollars10.0FY22act.FY2023 actual: $11.28B nominal, $11.87B in FY2025 dollars11.3FY23act.FY2024 actual: $12.98B nominal, $13.33B in FY2025 dollars13.0FY24act.FY2025 actual: $12.29B nominal, $12.29B in FY2025 dollars12.3FY25act.FY2026 estimate: $12.45B nominal, $12.10B in FY2025 dollars12.5FY26est.FY2027 request: $12.23B nominal, $11.64B in FY2025 dollars12.2FY27req.FY2020 in FY2025 dollars: $9.54BFY2021 in FY2025 dollars: $10.19BFY2022 in FY2025 dollars: $11.03BFY2023 in FY2025 dollars: $11.87BFY2024 in FY2025 dollars: $13.33BFY2025 in FY2025 dollars: $12.29BFY2026 in FY2025 dollars: $12.10BFY2027 in FY2025 dollars: $11.64B

Civilian federal cybersecurity funding, billions of dollars. Each fiscal year uses the most recent OMB edition that reports it: actual spending two budgets later, so FY2025 actual comes from the FY2027 budget. Real values use OMB’s GDP chained price index (Historical Table 10.1).

Civilian cyber spending rose from $7.83B in FY2020 to $12.98B in FY2024, then fell to $12.29B in FY2025, a 5.4% drop. Across FY2020 to FY2025 the nominal increase was 57%; after inflation it was 29%, so more than half of the headline growth was price growth. The FY2026 estimate of $12.45B and the FY2027 request of $12.23B keep spending roughly flat in nominal dollars, which is a cut in real terms.

Budget requests and outcomes do not always match. In FY2022 to FY2024 agencies ended up spending more than the President requested; in FY2025 they spent 5.5% less than the $13.00B requested. For FY2026, the current estimate of $12.45B is 6.0% above the $11.75B that was requested for FY2026.

Fiscal year Status Civilian cyber FY2025 dollars Change Requested that year Actual vs request Source edition
FY2020 Actual $7.83B $9.54B n/a FY2022 Budget
FY2021 Actual $8.64B $10.19B +10.4% n/a FY2023 Budget
FY2022 Actual $10.01B $11.03B +15.9% $9.85B +1.6% FY2024 Budget
FY2023 Actual $11.28B $11.87B +12.6% $10.89B +3.6% FY2025 Budget
FY2024 Actual $12.98B $13.33B +15.1% $12.72B +2.1% FY2026 crosscut
FY2025 Actual $12.29B $12.29B -5.4% $13.00B -5.5% FY2027 Budget
FY2026 Estimate $12.45B $12.10B +1.4% $11.75B FY2027 Budget
FY2027 Request $12.23B $11.64B -1.8% $12.23B FY2027 Budget

“Requested that year” is the budget-year column of the edition published for that fiscal year. FY2026 comes from OMB’s Technical Supplement crosscut tables, the only FY2026 edition with the cyber table. Editions before FY2022 used a different definition (the FY2021 edition put FY2020 civilian funding at $8.7B, the FY2022 edition at $7.8B), so the series starts in FY2020.

These figures cover civilian agencies only. The Defense Department reports its cyber budget separately: its FY2027 request includes $20.5 billion for cyberspace activities, of which $12.1 billion is cybersecurity and $7.7 billion cyberspace operations. Defense and civilian figures are built on different definitions, so adding them gives only a rough federal total. For federal IT contracting rather than budget authority, see our federal IT spending ledger built from USAspending.gov obligations.

Which agencies drive the FY2027 cybersecurity budget

From the FY2026 estimate to the FY2027 request, civilian cyber funding falls by $227 million. The biggest increases go to Justice (+312M), State (+174M), Transportation (+60M); the biggest cuts fall on Homeland Security (−222M), Veterans Affairs (−165M), NSF (−132M), Non-CFO agencies (−114M).

$11.9B$12.1B$12.3B$12.5B$12.7B$12.9B$13.1BFY2026 estimateFY2026 estimate $12.455B$12.45BJusticeJustice: +312.4M+312MStateState: +174.4M+174MTransportationTransportation: +60.3M+60MTreasuryTreasury: -80.1M−80MHHSHHS: -93.6M−94MNon-CFO agenciesNon-CFO agencies: -114.2M−114MNSFNSF: -131.7M−132MVeterans AffairsVeterans Affairs: -165.2M−165MHomeland SecurityHomeland Security: -222.3M−222MAll other agenciesAll other agencies: +33.0M+33MFY2027 requestFY2027 request $12.228B$12.23B

Change by agency, FY2026 estimate to FY2027 request, millions of dollars, both from the FY2027 Analytical Perspectives Table 5-5. Axis starts at $11.9B. “All other agencies” nets the remaining CFO Act agencies.

Homeland Security remains the largest civilian cyber budget at $3,053M, 25% of the civilian total. Over FY2020 to FY2025 it also added the most money, $1,552M. Justice’s +33% rise in the FY2027 request is the largest single increase. USAID no longer appears: its cyber line was $91M in FY2024 and is absent from the FY2027 table.

Agency FY2020 actual FY2024 actual FY2025 actual FY2026 est. FY2027 request FY26 to FY27 Share FY27
Homeland Security 1,613 3,386 3,165 3,275 3,053 -6.8% 25.0%
Justice 903 1,179 945 956 1,269 +32.7% 10.4%
Energy 590 1,028 974 1,067 1,078 +1.1% 8.8%
Veterans Affairs 426 785 991 1,242 1,077 -13.3% 8.8%
HHS 544 1,068 944 914 821 -10.2% 6.7%
State 284 770 712 635 809 +27.5% 6.6%
Treasury 556 1,349 1,025 814 734 -9.8% 6.0%
Transportation 267 418 511 557 617 +10.8% 5.0%
Commerce 701 442 423 390 428 +9.7% 3.5%
SSA 216 273 252 358 330 -7.8% 2.7%
Agriculture 223 267 270 242 242 -0.0% 2.0%
Education 123 227 210 211 215 +1.8% 1.8%
NASA 162 286 278 212 206 -2.9% 1.7%
HUD 73 119 145 172 189 +9.8% 1.5%
Interior 106 175 156 153 147 -4.1% 1.2%
NSF 241 15 281 266 134 -49.5% 1.1%
GSA 77 135 89 84 84 +0.2% 0.7%
Labor 101 76 73 86 82 -5.0% 0.7%
EPA 29 97 68 58 68 +15.7% 0.6%
OPM 47 118 58 46 47 +1.2% 0.4%
NRC 28 40 42 46 43 -5.7% 0.4%
SBA 16 34 36 37 38 +2.0% 0.3%
USAID 58 91 n/a n/a n/a
Non-CFO Act agencies 442 605 638 632 518 -18.1% 4.2%
Total civilian 7,826 12,983 12,287 12,455 12,228 -1.8% 100%

Millions of dollars. Each column comes from the latest OMB edition for that year (see methodology), so a row can mix editions. NSF reported $0 for FY2025 in the FY2026 crosscut but $281M actual in the FY2027 edition; we use the later figure.

CISA budget: FY2019 to the FY2027 request

enacted full-year continuing resolution request President’s request that year

$0.0B$0.5B$1.0B$1.5B$2.0B$2.5B$3.0BFY2019 Enacted: $1,682M1.68FY19FY2020 Enacted: $2,016M2.02FY20FY2021 Enacted: $2,025M2.02FY21FY2021 President’s request: $1,758MFY2022 Enacted: $2,594M2.59FY22FY2022 President’s request: $2,134MFY2023 Enacted: $2,907M2.91FY23FY2023 President’s request: $2,511MFY2024 Enacted: $2,873M2.87FY24FY2024 President’s request: $3,056MFY2025 Full-year CR: $2,873M2.87FY25FY2025 President’s request: $3,009MFY2026 Enacted (P.L. 119-86): $2,605M2.61FY26FY2026 President’s request: $2,378MFY2027 Request: $2,487M2.49FY27

CISA net discretionary budget authority, billions of dollars, from DHS Budget in Brief tables and, for FY2026, the enacted text of Public Law 119-86. Excludes supplemental and advance appropriations such as the $650.0M provided in the American Rescue Plan Act of 2021.

CISA’s appropriation grew 55% from FY2019 to FY2026 in nominal dollars, 22% after inflation. Almost all of that growth came by FY2023, when it peaked at $2,907M. FY2024 was enacted at $2,873M and FY2025 ran on a full-year continuing resolution at the same level. The FY2026 request asked for $2,378M, a 17% cut. Congress enacted $2,605M, which is 9.3% below FY2025 but $227M more than requested. The FY2027 request is $2,487M.

The FY2026 money arrived late. The fiscal year opened with a lapse in appropriations; Public Law 119-37 put DHS on a continuing resolution on November 12, 2025, and Public Law 119-75 extended it to February 13, 2026. DHS funding then lapsed from about February 14, and the full-year act was signed on April 30, 2026, seven months into the fiscal year.

Fiscal year Status CISA budget Change FY2025 dollars President’s request Budgeted FTE
FY2019 Enacted $1,682M $2,077M n/a 1,976
FY2020 Enacted $2,016M +19.9% $2,457M n/a 2,158
FY2021 Enacted $2,025M +0.5% $2,387M $1,758M 2,365
FY2022 Enacted $2,594M +28.1% $2,856M $2,134M 2,655
FY2023 Enacted $2,907M +12.1% $3,059M $2,511M 3,222
FY2024 Enacted $2,873M -1.2% $2,949M $3,056M 3,294
FY2025 Full-year CR $2,873M 0.0% $2,873M $3,009M 3,294
FY2026 Enacted (P.L. 119-86) $2,605M -9.3% $2,531M $2,378M not in enacted text
FY2027 Request $2,487M -4.5% $2,368M $2,487M 2,528

CISA staffing in 2025 and 2026, from budget documents

CISA’s congressional justifications give funded positions and full-time equivalents (FTE), not a headcount of people on board. In FY2024 and FY2025 CISA was funded for 3,732 positions and 3,294 FTE. The FY2026 request cut that to 2,649 positions and 2,324 FTE. The FY2027 request funds 2,865 positions and 2,528 FTE, 23% fewer FTE than FY2025. Both requests include a cut of 325 positions and 315 FTE ($64.9M) attributed to the DHS Workforce Transition Program, which covered deferred resignation, voluntary early retirement and separation incentive payments; the FY2027 justification says CISA “will only backfill mission-critical positions.” The enacted FY2026 law sets dollars, not FTE, so FY2026 staffing is not shown.

The FY2027 request’s largest reduction is $599.7 million and 953 FTE labeled “efficiencies and optimization.” It also proposes ending the election security program ($39.6M, 14 FTE), including the cooperative agreement for the Elections Infrastructure Information Sharing and Analysis Center, cutting Chemical Security Anti-Terrorism Standards staff ($35.1M, 194 FTE) and the National Risk Management Center’s planning work ($31.4M, 19 FTE). It keeps $1.4 billion and 954 FTE for cybersecurity.

Cybersecurity budget benchmarks for organizations

Searchers who type “cybersecurity budget” are often planning their own. The honest answer is that very few organizations publish what they spend on security, and most percentages in circulation come from vendor surveys. These are the figures that come from primary sources, split by how we got them.

Measured by us

  • 16.2%of the FY2027 civilian federal IT budget request is cybersecurity ($12.23B of $75.7B).OMB Analytical Perspectives Tables 5-4 and 5-5, our division
  • 16.2% to 17.3%cyber share of the civilian IT request in each budget from FY2022 to FY2027.Each edition’s cyber request over its own IT request
  • 7.8% to 29.0%range across civilian agencies in FY2027 (Army Corps to Justice); median 13.6%.22 agencies, Tables 5-4 and 5-5 (NSF excluded)
  • 0 of 22large U.S. companies’ latest 10-Ks put a dollar figure on their own cybersecurity spending, across 1,650 mentions of “cyber”.SEC EDGAR; method below

Quoted from the source

  • 4 states“four state CISOs report cybersecurity getting 1% or less of their states’ IT budget,” and nearly half could not readily attribute how much of the state IT budget goes to cyber.2024 Deloitte-NASCIO Cybersecurity Study
  • 22%of state CISOs reported a cyber budget increase of 6% or more, down from 40% in 2024; 16% reported cuts, against none in 2024. Eight states reported year-over-year reductions.2026 NASCIO-Deloitte Cybersecurity Study
  • 34,000Microsoft says its Secure Future Initiative dedicated “the equivalent of 34,000 full-time engineers,” but gives no dollar figure.Microsoft 2025 proxy statement (SEC)
  • $20.5BDefense Department FY2027 request for cyberspace activities, including $12.1B for cybersecurity.DoD FY2027 Budget Request Overview
0%5%10%15%20%25%30%35%all civilian 16.2%median agency 13.6%JusticeJustice: cyber $1,269M of $4,371M IT, 29.0%29.0%HUDHUD: cyber $189M of $700M IT, 27.0%27.0%Homeland SecurityHomeland Security: cyber $3,053M of $11,698M IT, 26.1%26.1%NRCNRC: cyber $43M of $180M IT, 24.1%24.1%OPMOPM: cyber $47M of $194M IT, 24.0%24.0%EPAEPA: cyber $68M of $301M IT, 22.4%22.4%StateState: cyber $809M of $3,761M IT, 21.5%21.5%EnergyEnergy: cyber $1,078M of $5,785M IT, 18.6%18.6%EducationEducation: cyber $215M of $1,271M IT, 16.9%16.9%NASANASA: cyber $206M of $1,381M IT, 14.9%14.9%CommerceCommerce: cyber $428M of $3,067M IT, 13.9%13.9%SSASSA: cyber $330M of $2,503M IT, 13.2%13.2%SBASBA: cyber $38M of $321M IT, 11.9%11.9%TreasuryTreasury: cyber $734M of $6,203M IT, 11.8%11.8%TransportationTransportation: cyber $617M of $5,694M IT, 10.8%10.8%LaborLabor: cyber $82M of $759M IT, 10.8%10.8%AgricultureAgriculture: cyber $242M of $2,641M IT, 9.2%9.2%Veterans AffairsVeterans Affairs: cyber $1,077M of $12,177M IT, 8.8%8.8%HHSHHS: cyber $821M of $9,489M IT, 8.6%8.6%GSAGSA: cyber $84M of $1,001M IT, 8.4%8.4%InteriorInterior: cyber $147M of $1,773M IT, 8.3%8.3%Army CorpsArmy Corps: cyber $17M of $221M IT, 7.8%7.8%

Cybersecurity as a share of each agency’s FY2027 IT request. Cyber from OMB Table 5-5, IT from Table 5-4 (same budget, same scope, Defense excluded). NSF is left out: its reported cyber funding ($134M) equals 66% of its whole IT budget ($202M), a ratio not comparable with the others.

The federal ratio is the only large, regularly published, line-item benchmark. It is a ratio of two budget estimates, not a target, and it varies widely by agency: Justice and Homeland Security put 29% and 26% of IT into cyber, while Veterans Affairs and HHS, two of the three largest civilian IT budgets, put 8.8% and 8.6%. The 2024 Deloitte-NASCIO report itself says federal agencies “generally allocate 10% to 12%” of IT budgets to cyber, citing an outside source; OMB’s own tables put the civilian ratio higher, between 16% and 17% in every budget since FY2022.

Corporate disclosure is thinner. Annual 10-K reports now carry a cybersecurity section (Item 1C) on how cyber risk is managed and overseen, but not on spending. In the latest 10-Ks of 22 large banks, payment networks, retailers, carriers, health insurers, a utility and Microsoft, every passage that pairs “cyber” with a dollar amount is about something else: an acquisition (Mastercard’s $2.7 billion purchase of Recorded Future) or incident costs (UnitedHealth’s Change Healthcare attack). JPMorgan’s 2025 shareholder letter calls cyber “one of our biggest risks” and says “We invest significantly,” without a number. Our cybersecurity statistics fact sheet collects other primary-source figures on threats and breaches.

How agencies divide the money is a more useful template than the topline. CFO Act agencies’ FY2027 cyber requests break down by NIST Cybersecurity Framework function as follows:

NIST CSF function FY2027 request Share
Protect $3,805M 32.5%
Detect $2,791M 23.8%
Respond $1,867M 15.9%
Govern $1,672M 14.3%
Identify $1,370M 11.7%
Recover $205M 1.7%
Agency IT request Cyber request Cyber share
Justice $4,371M $1,269M 29.0%
HUD $700M $189M 27.0%
Homeland Security $11,698M $3,053M 26.1%
NRC $180M $43M 24.1%
OPM $194M $47M 24.0%
EPA $301M $68M 22.4%
State $3,761M $809M 21.5%
Energy $5,785M $1,078M 18.6%
Education $1,271M $215M 16.9%
NASA $1,381M $206M 14.9%
Commerce $3,067M $428M 13.9%
SSA $2,503M $330M 13.2%
SBA $321M $38M 11.9%
Treasury $6,203M $734M 11.8%
Transportation $5,694M $617M 10.8%
Labor $759M $82M 10.8%
Agriculture $2,641M $242M 9.2%
Veterans Affairs $12,177M $1,077M 8.8%
HHS $9,489M $821M 8.6%
GSA $1,001M $84M 8.4%
Interior $1,773M $147M 8.3%
Army Corps $221M $17M 7.8%

What this means for MSPs

Size a client’s security budget from the bottom up, then sanity-check the ratio. A percentage of IT spend is an output, not an input. Price the controls the client actually needs (identity, endpoint, email, backup, logging, response retainer, training) and then compare the total with the federal range: civilian agencies put 14% to 16% of IT into cyber at the median and in total, and security-heavy departments such as Justice (29%) and Homeland Security (26%) put in more than a quarter. A client well below the lowest federal agency (8%) has a gap to explain; one above the security-heavy departments should be able to name the regulation or threat that justifies it. For context on how much IT itself costs by sector, see our analysis of IT spending by industry.

Use the federal split as an allocation check. OMB’s FY2027 numbers put 32% of agency cyber money into Protect, 24% into Detect, 16% into Respond and only 1.7% into Recover. Detection and response are the functions a managed service supplies most directly, so they are where an MSP proposal should be most specific. Showing a client a proposal mapped to the same five or six functions is easier to defend to a board or auditor than a vendor percentage.

Expect state and local clients to be short of federal money. The State and Local Cybersecurity Grant Program made $930 million available across its four IIJA rounds, falling to $91.75 million in FY2025, when the required non-federal match reached 40% for individual states. Its authorization ran to September 30, 2026, and the FY2027 continuing resolution did not extend it. The statute required states to pass at least 80% of grant funds (or services of that value) to local governments, so counties, cities and school districts are the clients most exposed. The 2026 NASCIO-Deloitte survey found nearly 40% of state CISOs already called the grants inadequate. Plan renewals for SLED clients on the assumption that the grant-funded tools they adopted in 2023 to 2025 now need a local budget line.

Expect less free help from CISA. The FY2027 request ends funding for the election security program and the EI-ISAC cooperative agreement, and a significant reduction to regional operations. Services that small public-sector clients relied on may shrink, while federal contractors face rising requirements: see our CMMC certification statistics and FedRAMP statistics for the compliance side.

State and Local Cybersecurity Grant Program, IIJA rounds

Round Total available Maximum federal share, single entity
FY2022 $185M 90% (10% match)
FY2023 $374M 80% (20% match)
FY2024 $279M 70% (30% match)
FY2025 $91.75M 60% (40% match)

Funding from FEMA’s program page; federal share from 6 U.S.C. 665g(m). Multi-entity groups had a federal share 10 points higher. The Tribal Cybersecurity Grant Program is separate.

Frequently asked questions

How much is the federal cybersecurity budget?

For civilian agencies, the FY2027 President’s budget requests $12.23B for cybersecurity, against an estimated $12.45B in FY2026 and $12.29B actually spent in FY2025, per OMB. The Defense Department reports separately: its FY2027 request includes $20.5 billion for cyberspace activities, of which $12.1 billion is cybersecurity.

What is CISA’s budget for 2026?

Congress enacted $2,605M for CISA in fiscal 2026 in Public Law 119-86, signed April 30, 2026: $2,218.6M for operations and support and $386.5M for procurement and construction. That is 9.3% below the $2,873.0M of FY2024 and FY2025. The FY2027 request is $2,487.2M.

What percentage of the IT budget should go to cybersecurity?

There is no official standard. The best public measured benchmark is the federal government’s own: civilian agencies requested 16.2% of their FY2027 IT budgets for cybersecurity, and the median agency 13.6%, ranging from 7.8% (Army Corps) to 29.0% (Justice). By contrast, the 2024 Deloitte-NASCIO study quotes four state CISOs saying cyber gets 1% or less of their state IT budget.

Did the federal cybersecurity budget go down?

Yes, after FY2024. Civilian cyber spending peaked at $12.98B in FY2024, fell to $12.29B in FY2025, and the FY2027 request of $12.23B is 5.8% below the peak in nominal dollars and 12.6% below it after inflation.

How many people work at CISA?

CISA’s budget documents show 3,732 funded positions and 3,294 full-time equivalents in FY2024 and FY2025. The FY2027 request funds 2,865 positions and 2,528 FTE, 23% fewer FTE, including 325 positions removed through the DHS Workforce Transition Program (deferred resignation, early retirement and separation incentives).

Is the State and Local Cybersecurity Grant Program still funded?

Its four years of Infrastructure Investment and Jobs Act money ended with the FY2025 round of $91.75 million. Public Law 119-75 extended the program’s authorization to September 30, 2026; the FY2027 continuing resolution (Public Law 119-103) extended other cyber laws to December 11, 2026 but did not extend the grant program.

Download the data. federal-cybersecurity-budget-fy2020-2027.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Federal civilian cyber funding. We downloaded the cybersecurity-by-agency table from every OMB budget edition that has one since the FY2022 budget: Analytical Perspectives chapters for FY2022 (Table 12-2), FY2023 (16-2), FY2024 (14-2) and FY2025 (15-2), the FY2026 Technical Supplement crosscut (Table 5-2), and the FY2027 Analytical Perspectives Table 5-5 (Excel). Each edition reports three years: prior-year actual, current-year estimate and budget-year request. We parsed all agency rows (CFO Act and non-CFO Act), checked that agency rows add up to OMB’s subtotals, and for each fiscal year used the most recent edition. All figures exclude the Defense Department, as OMB’s tables do. Editions for FY2021 and earlier used a different scope and are not comparable, so the series begins with FY2020 as reported in the FY2022 edition.

Inflation. Real values use the fiscal-year GDP chained price index from OMB Historical Table 10.1 (FY2027 budget), including OMB’s FY2026 and FY2027 projections.

Cyber share of IT. Each edition also has a civilian IT spending table by agency (for example Table 15-1 in FY2025 and Table 5-4 in FY2027); we divide each edition’s budget-year cyber total by its budget-year IT total. Agency shares divide Table 5-5 FY2027 cyber by Table 5-4 FY2027 IT for the agencies in Table 5-4, leaving out NSF, whose cyber figure equals two thirds of its IT budget.

CISA. Enacted and requested net discretionary budget authority from DHS Budget in Brief editions FY2021 to FY2027; FY2026 enacted is the sum of the operations and support ($2,218,634,000) and procurement, construction and improvements ($386,464,000) appropriations in Public Law 119-86, Division A. Positions and FTE come from the FY2026 and FY2027 CISA congressional justifications and Budget in Brief tables; they are funded levels, not people on board. Every CISA figure in this report is checked by our build script against the saved source text.

SEC check. We pulled the latest 10-K for 22 large U.S. companies (JPMorgan, Bank of America, Citigroup, Goldman Sachs, Morgan Stanley, U.S. Bancorp, PNC, Truist, Capital One, Schwab, American Express, Visa, Mastercard, Microsoft, Walmart, Home Depot, UPS, Union Pacific, Delta, CVS, UnitedHealth and TVA) from EDGAR, found every mention of “cyber” and checked for any dollar amount within 250 characters. Wells Fargo was excluded because its 10-K incorporates the annual report by reference. This is a targeted check of large filers, not a sample of all companies.

Quoted figures. NASCIO-Deloitte, Microsoft, JPMorgan and Defense Department figures are quoted as published and were not recomputed. We did not use vendor survey statistics.

Limitations. OMB’s cyber figures are agency-reported estimates of cybersecurity-related spending inside larger accounts, and agencies revise them between editions. Estimates and requests are not appropriations. Not advice.

Cite as:The Uptime Report. "Cybersecurity Budget Data: Federal Civilian Cyber Spending Peaked in FY2024, and the FY2027 Request Is 13% Lower After Inflation." October 2026. https://theuptimereport.com/cybersecurity-budget/

References

  1. OMB, Analytical Perspectives, Budget of the U.S. Government, Fiscal Year 2027, Chapter 5 and Tables 5-4 to 5-6. Accessed October 2026.
  2. OMB, Technical Supplement to the 2026 Budget: Crosscut Tables, Table 5-2. Accessed October 2026.
  3. OMB, Analytical Perspectives FY2025, Chapter 15, Information Technology and Cybersecurity Funding. Accessed October 2026.
  4. OMB, Analytical Perspectives FY2024, Chapter 14. Accessed October 2026.
  5. OMB, Analytical Perspectives FY2023, Chapter 16. Accessed October 2026.
  6. OMB, Analytical Perspectives FY2022, Chapter 12. Accessed October 2026.
  7. OMB, Analytical Perspectives FY2021, Chapter 19, Cybersecurity Funding (definition comparison). Accessed October 2026.
  8. OMB, Historical Tables, Table 10.1, GDP and deflators. Accessed October 2026.
  9. DHS, FY2027 Budget in Brief, and earlier editions FY2021 to FY2026 via DHS budget publications. Accessed October 2026.
  10. DHS, CISA Budget Overview, FY2027 Congressional Justification. Accessed October 2026.
  11. DHS, CISA FY2026 Congressional Budget Justification. Accessed October 2026.
  12. Public Law 119-86, Homeland Security and Further Additional Continuing Appropriations Act, 2026. Accessed October 2026.
  13. Public Law 119-37, Continuing Appropriations and Extensions Act, 2026. Accessed October 2026.
  14. Public Law 119-75, Consolidated Appropriations Act, 2026, Sec. 5009. Accessed October 2026.
  15. Public Law 119-103, Continuing Appropriations and Extensions Act, 2027. Accessed October 2026.
  16. 6 U.S.C. 665g, State and Local Cybersecurity Grant Program. Accessed October 2026.
  17. FEMA, State and Local Cybersecurity Grant Program. Accessed October 2026.
  18. Department of War (Defense), FY2027 Budget Request Overview, Cyberspace Activities. Accessed October 2026.
  19. NASCIO and Deloitte, 2026 NASCIO-Deloitte Cybersecurity Study. Accessed October 2026.
  20. Deloitte and NASCIO, 2024 Deloitte-NASCIO Cybersecurity Study. Accessed October 2026.
  21. Microsoft, 2025 Proxy Statement (SEC EDGAR). Accessed October 2026.
  22. JPMorgan Chase, 2025 Annual Report (SEC EDGAR). Accessed October 2026.
  23. SEC EDGAR, latest Form 10-K filings of the 22 companies listed in the methodology. Accessed October 2026.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts