Senate OKs creation of new DHS cyber agency

The long-sought promotion of the National Protection and Programs Directorate was approved by the Senate on Oct. 3.

Chris Krebs NPPD undersecretary (then acting) testifies FEBRUARY 7, 2018 HSGAC DHS reauthorization hearing

Christopher Krebs would head the Cybersecurity and Infrastructure Security Agency.


It’s cybersecurity awareness month, so Congress decided to give the Department of Homeland Security something nice to share.

On Oct. 3, the Senate (finally) passed its own version of legislation that would rename and elevate the National Protection and Programs Directorate. The House passed its version of the bill in December 2017.

The meat of the bill is actually quite thin, especially when compared to the more-ambitious vision laid out by officials two years ago. It changes NPPD’s name to the moderately less clunky Cybersecurity and Infrastructure Security Agency, and emphasizes that this is the go-to agency for IT security and civilian cyber issues.

“Thank you to Senator Ron Johnson and Claire McCaskill and the rest of the Senate for voting to create the first cybersecurity agency in the federal government,” Undersecretary and soon-to-be-Director Christopher Krebs said on Twitter. “This will go a long way in our ability to defend the nation against cyber threats.”

Some in DHS have said one of the most important changes would be the elevation from a headquarters component to a full operating agency, with a director and a higher degree of autonomy in the departmental hierarchy.

DHS surely wanted more than what’s contained in CISA, but the change is viewed as an important transition step for its branding power alone. DHS Secretary Kirstjen Nielsen said this week that CISA was needed to communicate clearly to stakeholders inside and outside government that “we are the national cybersecurity agency.”