The Homeland Security Department is in charge of overseeing federal civilian agency cybersecurity operations and incident response, according to a July 6 memo from the Office of Management and Budget.

The memo, signed by Peter Orszag, OMB director, and Howard Schmidt, the White House cyber czar, states that DHS has the power to:

• Oversee the governmentwide and agency-specific implementation of and reporting on cybersecurity policies and guidance;
• oversee and assist governmentwide and agency-specific efforts to provide adequate, risk-based and cost-effective cybersecurity;
• oversee the agencies' compliance with FISMA and developing analyses for OMB to assist in the development of the FISMA annual report;
• oversee the agencies' cybersecurity operations and incident response and providing appropriate assistance; and
• annually review the agencies' cybersecurity programs.

DHS's power applies to all federal agencies, except the Defense Department and the Central Intelligence Agency, according to the memo.

DHS's lack of direct cybersecurity power over other federal agencies was a subject during a June 16 hearing of the House Homeland Security Committee. During the hearing, panel witness Stewart Baker, a partner in the law firm Steptoe and Johnson and a former DHS assistant secretary for policy, questioned whether DHS can force other agencies to enact cybersecurity provisions as it sees fit.

"The difficulty with telling agencies what to do is that you're telling them to spend money that they were going to spend on something else," he said. "There needs to be support from OMB to either say, 'We can find the money,' or 'I'm sorry, take the cut,'" he added.

The memo states that OMB will responsible for "the development and approval of the cybersecurity portions" of the annual budget request.

For more:
- download the OMB memo, M-10-15 (.pdf)

Related Articles:
DHS IG wants US CERT enforcement power, doesn't say how
OMB gives DHS new powers under revised FISMA guidance
GAO: TIC, Einstein success is dependent on OMB, DHS guidance