LIVE: House Panel Holds Oversight Hearing on Cybersecurity and Infrastructure Agency

Surprised anybody that we've got both scheduled in about an hour. So we are going to endeavor to be crisp. I'm not gonna waste a bunch of time telling you how we're gonna do that. Just to say that we are reducing the amount of time for questioning for members to four minutes. I was gonna do it for three, but Ms. Underwood basically bullied me into four. And so I got bullied and so it's four. If when we get to the hearing, I'm not gonna adjourn and come back after votes. We're going to adjourn. If members have questions that they wanted to ask of the cybersecurity folks that they didn't get asked and they don't feel good about submitting them in writing, then let us know and we'll talk about maybe trying to convene another hearing before marking up the cybersecurity part of things. And so with that, I got some nice stuff I could say here, but I'm not gonna because I got bullied into giving members four minutes instead of three. And so with that, I recognize the distinguished ranking member, Ms. Underwood for her opening comments. Well, thank you, Mr. Chairman, for holding this hearing to conduct oversight of the Cybersecurity and Infrastructure Security Agency. I'd also like to welcome Ms. Bridget Bean, the senior official performing the duties of director of CISA to her first hearing before us. This is not a large organization, but Congress fought over the years to properly fund the critical responsibilities of your agency, growing its funding by 75% from fiscal year 2019 to fiscal year 2024. Remarkably, these increases have consistently been with bipartisan support. I don't need to tell you how rare that is these days, and I believe it reflects the scale of the catastrophic cyber threats facing our country, as well as the quality of resources and support that CISA provides. But instead of investing in this popular, nimble and cost efficient agency that protects nearly every aspect of Americans' lives, you are proposing an almost 20% cut to CISA, $491 million in driving out the workforce through early retirement buyouts and questionable terminations. That's not cutting fat, that's a death blow. This reduction in force is not based on performance, but on things in CISA's congressionally mandated mission that the president is offended by, like securing America's elections from foreign adversaries like Russia. These are real threats. I represent Illinois, and during the 2016 elections, Russian hackers penetrated the State Board of Elections voter registration database, stealing the personal data of about 76,000 Illinois voters. CISA was created to protect the nation's critical infrastructure from physical and cyber threats, which includes election infrastructure. Therefore, you cannot claim to be refocusing on core missions like enhancing the security and resilience of critical infrastructure, while also eliminating election security support and staff. Unfortunately, CISA is not the only area suffering as this administration weakens our nation's cybersecurity vulnerabilities. Cabinet secretaries are putting American lives at risk by avoiding secure communications. The FBI's Foreign Influence Task Force has been disbanded. The head of U.S. Cyber Command has been fired with no replacement. This is all happening at a time when national security and cybersecurity experts have urged greater investments in cyber defense and offense, particularly as cyber crime proliferates and China and Russia have sought to interfere with our economy, our elections, our healthcare systems, and our security. Our adversaries are upping their game every day, growing significantly while this budget would take us backwards. These aren't hypothetical threats. China is ramping up attacks on our telecommunications and energy sectors. Schools and hospitals in my district have had to close after ransomware attacks. So my question is why? Why is this administration so determined to degrade the core cyber defenses that keep America safe? Is it to privatize CISA functions so that the tech CEOs who sat front row at President Trump's inauguration can profit off of them and lock small competitors out? Is it to let Putin and his cronies around the world who support the president interfere in our elections? Is it to make government services more difficult and frustrating to access so Americans will support your efforts to dismantle them? Is it being driven by some ass from anonymous investors in the president's crypto scheme? I don't know the answer. But what I do know is that this committee will continue to fulfill our Article I responsibilities under the Constitution, regardless of the chaos and corruption of this administration. We will have questions for you today on your plans to improve the core functions of CISA, fulfill the mission that Congress designated, and expand much-needed capabilities with the reduction in staff and resources you are requesting in this budget. Lastly, I'd like to thank the women and men of CISA working 24-7 to combat threats facing our nation's networks, critical infrastructure, elections, emergency communications, schools, hospitals, and public gatherings while a new administration creates job uncertainty and the fear of politically-motivated reprisal. Thank you again, Ms. Bean, for being here today, and I look forward to your testimony and answers to our questions. I yield back. Thank you, ma'am. So between the two of us, with your statement, our average is pretty good. We're ahead of schedule. I think we're doing great. Madam Director, the floor is yours. Good morning. Chairman Amadé, Ranking Member Underwood, and members of the subcommittee, thank you for the opportunity to discuss the cybersecurity and infrastructure security agency's priorities and our efforts to protect our nation. I'm honored to serve as a senior official performing the duties of the director and the executive director of CISA. My decades of civil service have well prepared me for this role, having previously served at the Small Business Administration and at the Federal Emergency Management Agency. I joined CISA in 2022 as our first chief integration officer, leading CISA's operations integrations across the nation to deliver mission-critical services more rapidly and in support of our critical infrastructure. This work made clear that cybersecurity and infrastructure security is national security. As the nation's cyber defense agency and the national coordinator for critical infrastructure and security and resilience, CISA leads the national effort to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on every day. CISA is committed to executing our core mission as authorized by Congress. Our agency has swiftly and responsibly implemented this administration's executive orders and supporting guidance. Aligned with administration priorities, we are laser-focused on our statutorily authorized cybersecurity, infrastructure security, and emergency communications missions. The threat facing our nation, they are not hypothetical. They are real, and our adversaries are directly targeting our critical infrastructure in unprecedented ways. We know this because the talented workforce at CISA has detected these adversaries. CISA's workforce, operating on the frontline of national security, is our greatest asset. I want to thank them personally, each and every one of them, for their unwavering dedication, professionalism, and service to our nation. Since January 2025, we have continued to drive vulnerability risk reduction in federal departments and critical infrastructure. We've increased visibility across networks and strengthened cybersecurity. We've released operational products with partners, including the FBI and NSA, warning infrastructure of pressing threats and urging specific mitigations. We've delivered 269 terrorism mitigation courses for more than 5,000 folks across the country, with 94% of those who participated responding that that training has enhanced their preparedness. We conducted 68 exercises, most recently the one in Philadelphia, convening hundreds of emergency managers in support of the World Cup 2026. We've completed 9,400 cyber and physical assessments and trainings for state and locals, as well as critical infrastructure owners and operators. We've conducted more than 4,000 notifications to warn entities of early-stage ransomware activity before malicious actors could take action. This results in uninterrupted service and billions of dollars in estimated savings because the ransomware could not be deployed. We've expanded CISA's known exploited vulnerability catalog to over 1,300 vulnerabilities. As a result of this, the private sector has remediated vulnerabilities identified by CISA an average of 15 months earlier. This is critical when we are defending against nation-state actors and persistent threat of ransomware. State, local, and tribal territorial governments and those who have signed up for CISA's vulnerability scanning services saw a 31% reduction in exploitable vulnerabilities. We've deployed endpoint detection and response technologies across federal agencies to more than 415,000 endpoints, enabling rapid detection and response. We've blocked 700 million malicious connections across the federal government and more than 60 million across critical infrastructure. This is just in the first quarter of 2025 alone. These examples illustrate that CISA is operating with a clear vision to defend and secure the federal civilian enterprise, to strengthen the physical and cybersecurity of the United States critical infrastructure, to incentivize the development and procurement of trustworthy technology, to lead the United States government's coordinated cyber defense operations and to unify our national response to significant cyber incidents by coordinating between government, industry, and our international partners. With the support of Congress, we have strengthened our ability to detect, analyze, and respond to cyber and physical threats faster and more effectively than ever before. There is no shortage of work ahead and we're committed to operating with transparency, accountability, and efficiency as we confront the threats of today and prepare for those of tomorrow. I look forward to working with all of you to strengthen CISA's capabilities to enhance the security and resilience of our nation's infrastructure. Thank you again for the opportunity to be here and I look forward to your questions. Thank you, Madam Director. The chair now recognizes the ranking member. The floor is yours for four minutes for your questions. Thank you, Mr. Chairman. Jumping right into it, my first one should be easy, a simple yes or no. Is Russia still a cybersecurity threat and priority for this administration in CISA? Yes. Excellent, I'm glad to hear that. And I wanna discuss with you CISA's response to a recent incident at the National Labor Relations Board which protects the legal rights of American workers. Public reporting indicates that in March, a whistleblower complaint was filed against a DOJ team at NLRB for removing massive amounts of sensitive data from the agency with no legitimate justification. The whistleblower reported a, quote, spike in data leaving the agency after DOJ was granted access to it. Among other things, it's possible this data included corporate secrets and private information on union members. At the same time, DOJ employees turned off monitoring tools, manually deleted records of what they accessed, and sought to ensure their activities weren't logged in the system. As soon as DOJ got there, the agency started detecting suspicious login attempts from an IP address in Russia. So NLRB's IT department launched a formal review of what it deemed a serious ongoing security breach or potentially illegal removal of personally identifiable information. Normally at this point, a CISA computer emergency readiness team would be created to respond. But public reporting indicates this never happened because of instructions, quote, had come down to drop the US CERT reporting and investigation. And the whistleblower who made the complaint found a threatening note taped to his door with sensitive personal info and a drone shot of him walking his dog. Who decided not to create a computer emergency readiness team in this instance? And was it someone at CISA or elsewhere in the administration? So what I can tell you is that CISA supports all of our federal civilian agencies through protection of sensitive data and sensitive systems, through targeting capabilities, products, hands-on technical assistance, and collaboration, providing resources. And we would be happy to work with the NLRB when asked, but we have not, you know, and we're happy to do that. So you did not receive a request? Not to my knowledge. Okay, so what's the standard procedure at CISA now for investigations involving the misuse of sensitive data and incursions by banned actors like Russia? So I think that there's, what I'd like to point out is that we are on the cybersecurity side of the house, right? So we are helping agencies to protect their systems and their sensitive information. So we, you know, we can, we're happy to help with some forensics with NLRB. The other thing is, you know, I think DOJ employees are federal employees, and, you know, they're held to the same rules of behavior and engagement, and I have every reason to believe that, that they're doing that. Can you commit to providing us regular and timely updates into the investigation, into what happened with NLRB, so as you do your forensics and the other investigations? Yes, ma'am, if we are asked to do so, we will provide updates. Okay, I yield back. Thank you. Thank you, ma'am. Three minutes, Mr. Chairman. Thank you very much. That's what they call a leader in my state. Good for you. If at any point in time during the questioning, the answer is appropriately, I'd love to talk to you guys in a skiff about it. Let us know, and we'll arrange that. Ms. Hinson, you are recognized for four minutes of questioning. Thank you, Mr. Chairman, and thank you to our ranking member for holding this hearing. Acting Director, thank you so much for being here today. As a member of the China Select Committee, I have seen firsthand, obviously, many of the threats that face our country, the work there, the adversaries, the tools that they are using to come after the United States and target our citizens. So agencies like yours are very, very important. The CCP is actively exploiting gaps in infrastructure to sow that chaos and instability embedding within our critical systems and positioning to strike when it suits them, as we know. We saw with the recent Bolt and Salt typhoon campaigns, obviously, operations that were carefully planned, well-resourced, and executed with precision. They make the strategic intent and long-term capabilities of CCP state-sponsored actors to carry out covert attacks on us. And this is a threat not only to our national security, but to every American's life. So I think it's a threat we cannot ignore. I know you're taking it very seriously. So I want to talk about a program that I think is absolutely essential in this, and it's the Attack Surface Management Program. Obviously, this is about not only identifying and going in forensically, like you said, auditing this and catching it, but patching the vulnerabilities before our adversaries can exploit them. So do you consider this program to be one of CISA's core cybersecurity capabilities? How are you leveraging this program to really help our partners defend against these sophisticated nation-state actors? Very important question. You're absolutely right. So this Attack Surface Management, it's one of our core capabilities. It is a pivotal, it is a critical pillar of our cyber defense program at CISA. And it's unique in as much as it's one of the most scalable programs we have, and it takes an attacker's approach. So it's looking from the outside in. Most CISOs and CIOs are looking at their environment from the inside. This is a way to scan across the horizon, across the network, across the internet, and see what are those vulnerabilities, where are they? And with that information, we actually are able to go to critical infrastructure and private sector and say, hey, you have this vulnerability. But the good news is you can patch it and you can protect yourself. So the Attack Surface Management, not only is it one of our most scalable, cost-effective tools we have, it's the most effective in identifying vulnerabilities and providing an entity to fix that, to mitigate that challenge. It reduces risks, it enables proactive measures. And as entities continue to build their attack surface, you add a device, you add a software, you have cloud, you've got mobile devices, all of that expands the attack surface that an adversary can capitalize on. This tool really allows the partnership between the government, CISA, and private entity to identify those vulnerabilities and to fix them. Certainly, I think the partnerships that you have at the state and local level, too, all the way down to the business community, it's critical. And I think the strike teams, as they were called, and getting out and actually communicating that is critically important. One follow-up, last question. Your predecessor was really outspoken about the national security risks associated with TikTok as well, regarding that access to personal devices, data harvesting that comes from that. Do you share that assessment? And how are you at CISA evaluating or responding to those risks? Absolutely. I think, as you know, TikTok's not authorized on any federal network. And what we're also trying to do is make sure that we're raising the awareness that cybersecurity is everyone's concern. And you mentioned it earlier, right? It's a team sport. It's the federal, state, local, but also individuals. And so making sure that our small businesses, our K-12, our students understand the risk and how it really plays into their everyday life, that's an important role we play to help educate the community on the threats and the risks. Thank you. I yield back, Mr. Chairman. Thank you, Ms. Henson. Mr. Cuellar, you have the floor for four minutes. Thank you, Mr. Chairman. First of all, Director Beene, I wanna wish you a happy Mother's Day. All of y'all also a happy Mother's Day. And guys, please don't forget, buy your cards, your flowers, and whatever you need to do for Sunday. So with that, I just say happy Mother's Day on Sunday. Let me talk a little bit about efficiency, effectiveness, and accountability. Look, I think we're all on the same page. We wanna get rid of inefficiencies and waste and all that. It's how we get there is where we've seen it. I know in Texas, working with then Comptroller John Sharp and the legislature in the 1990s, we did this doggie, I think is what they call it, but a doge without cutting people and without cutting services. But we found billions and billions of dollars of savings without cutting services and personnel. So there's a way of doing this. From there, years later, the Congress in a bipartisan way passed the law back in 2010, Government Performance and Results Modernization Act. And there's another law that's there. And it calls for annual operational reviews to make sure that we get the sufficiencies. It calls for regulatory modernization. That is anything that rules that are obsolete or costly, it calls for that. That's the law already. It calls for development and performance measures. The problem is you all develop the performance measures in a vacuum, and I'm talking about just the executive branch without sending anything over to us. They're put on a webpage, and I'm sure yours is in a webpage. And then the other thing tied up is calling for competitive contracting. That's a different law. Budgets, and I think every agency that has any contract has a problem with on budget and on time. And there are penalties that you can enforce under the law where if somebody doesn't do the contract after you get a competitive contract, if they're not on time or they're not on budget, there are penalties. But the federal government, I still haven't found one where we are on time and on budget. I'm sure there is an example somewhere out there, but we need to enforce that a lot more. And finally, just the quarterly oversight reporting, which is for us, Article 1. You do that, report to us under Article 1. And under the law that we passed in 2010, a lot of that is supposed to be done. The only thing that wasn't added was reporting back to Congress. It was the compromise, unfortunately, was to put it on a website. But we're hoping that committees and appropriations will start just at that little thing to the Government Modernization Act that I talked about. But I think we're all on the same page. We wanna find efficiencies, effectiveness, and we wanna work with you without cutting personnel and services. So we look forward to working with you. With that, I yield back the back of my time, Mr. Chairman. Don't forget Mother's Day, sir. Thank you, sir. Oh, I knew about that. Thank you for the reminder. That's kind of redundant, but that's good. We're good. Mr. Gonzalez, the floor is yours for four minutes. Thank you, Director, for your service to our country, and thank you for all the men and women at CISA for everything that y'all do. I wanna first start, we always talk about ecosystem and all these threats and how we grow this out. I wanna talk about universities, and I'm blessed to be in Texas. We have some amazing universities. I was just speaking with Heather Wilson, doing a great job, president of UTEP. Are you, or what can we do more to work with some of the universities? Is CISA doing anything in particular with UTEP-1, and then are you doing anything with any other universities? So, CISA is all about partnership, understanding that cybersecurity is a team sport. We can't do it by ourselves. And universities and institutions of higher learning play a critical role. And we do, we work with them at multiple levels. At the national level, we have engagement, but also at the local level. Our whole regional force is on the ground in those communities, working with universities to do three things, right? One is to make sure that we are highlighting the importance of cybersecurity in the curriculum and getting folks to go to school to learn that, to build the next generation of cyber defenders. Secondly, to make sure that we're learning from them. Some of the best and brightest ideas about how to defend our critical infrastructure is coming out of those institutions. So, our regional staff is working with them to make sure that we're getting that information, feeding it back up, really trying to be efficient and cost effective and leveraging that which is being done there. And lastly, the third one is just to make sure that we have academia, international partners, the federal government and state and local governments communicating so that we are leveraging resources and not duplicating. I tell you what, as we go through this budget process, that could be a sweet spot. All the members in here, we have in some form or fashion, colleges and universities, my good friend Juan Sescamani has University of Arizona there. There's all these opportunities. And if CISA is just partnering with all these places, it's going to be very hard for us to say, we want less of that. And it's going to be very easy for us to say more of that. I'm going to switch gears a little bit on international kind of discussion. A lot of us saw what happened in Spain and Portugal about a week ago. And that concerns me. Anytime the power goes out, I think we're still trying to figure that out. But I'm going to ask two questions. One, do you have any details on that situation? Absolutely. As soon as we became aware of it, we reached out to our partners to find out what was going on and could we render assistance. We were soon told that it was not a cyber nexus, cyber related, but we remain extremely committed to our international partner as the U.S. CERT, we have hundreds of international CERT partners and it's government to government, really. And our team works around the clock. I mean, just recently, someone was telling me that they were getting up at four o'clock in the morning to have an international call. So we are extremely committed to that continued sharing of information across what we call the CERTs. But your question is very timely and very important because regardless of whether or not it was a cyber event, it really demonstrates the importance of critical infrastructure. And critical infrastructure is the backbone of our national security and our economic security. So we wanna make sure at CISA that we are working with the critical infrastructure in our country, whether it's the electrical grid, whether it's clean drinking water, whether it's our healthcare, right? So it's our communication, making sure that they're both secure and resilient so that our American citizens can depend on having that operational infrastructure. Yeah, thank you for that answer. And thank you for working with our partners. You know, we've got military bases in Spain, they're a close ally. Today it's Spain, tomorrow it's somewhere else. But when I think of CISA, I always think is the expert in that area, not only for the United States, but for the world. So it's great that you're working on that. My last question is going to your critical infrastructure. Oil and gas industry is very important, not only to my district, not only to Texas, but the United States. The colonial pipeline is something very much on our mind. Can you briefly talk a little bit about what you're doing to harden and make sure that our energy industry is ready for that next attack that's coming? First, we're working with the Department of Energy, we're working with all of the sector risk management agencies, but we're working with the oil and gas companies specifically to make sure that they're understanding what is the threat to them, who is targeting them, and what can they do to help better secure themselves. What we're finding is that our nation state actors are not using any novel technique. They're exploiting known vulnerabilities, they are searching the internet, looking for misconfigurations, and they're getting in. And they're going undetected because these living off the land kind of techniques don't leave a footprint. And so what we're trying to work with the oil and gas companies as well as all the rest is to understand we need to make the adversary work harder to get in, and that there are things that they can do to significantly, and I mean drastically, reduce their risk. We're also providing intelligence briefings so that they better understand what exactly are we seeing so that if we're able to give them a bit more information, we're doing that. And again, our folks on the ground who are working with those companies to understand the interconnectivity. And lastly, making sure that those who rely on the oil and natural gas understand that if something should happen, what are their contingency plans? What are those cascading impacts? So we're trying to take a holistic approach to make sure that they are hardened and have a really good resiliency plan so that they can restart operations as soon as possible. Great, thank you, Director. I yield back, Chairman. Ms. Escobar, the floor is yours for four minutes, not an Arizona four minutes, or I mean a Texas four minutes, but at a high altitude. First Hawaii, Arizona. At a high altitude. Hawaii, Arizona. I'm gonna call your mother's name this year. Well, I'm a little rattled because when I hear the director talk about getting up at four in the morning for an international call and know that she's thinking about calling Nevada, it kind of has a negative impact on me. But I'm wasting the committee's time. Please proceed. Thank you, Mr. Chairman. Thank you, Ranking Member. Thank you so much, Ms. Bean, for your work and for being here. I have been so profoundly concerned about the reports of what DOGE, or Chairman Doggie, apologies, Chairman, has been doing. You're not gonna find anyone who disagrees with rooting out waste, fraud, and abuse. We all want that. But the unlawful ways that DOGE has been engaging with sensitive data has been alarming. And it's alarming to my constituents as well. I've gotten innumerable questions about it. And we've read reports about the staffers at DOGE sharing sensitive information via unsecured email accounts. There was just a Washington Post article yesterday about their desire to create a centralized account for all of Americans' sensitive data. So I'm, and obviously we are all concerned about the access to this data by adversaries. We don't want adversaries getting their hands on this data. So I'm wondering if CISA was consulted as DOGE staffers accessed this data. So I don't have any knowledge that CISA was consulted. What I can say is two things that I think are worth highlighting. One is CISA has worked through Congress' both direction and support to build tools that better protect the security on every federal agency network. And we continue to do that. And it's a top, top priority for us as directed by Congress and funded by Congress. Secondly, we are, as you mentioned, we're looking for efficiencies, but we're doing it as we do with every transition, right? You look at organizations, you look at spending. I've been in government a number of years, hardly worth quantifying, but I've seen this again and again. And we do, at every transition, you're looking at your staffing, you're looking at your budget, you're looking at your contracts, you're looking at your organizational structure. And that's what we're doing at CISA, to try and find efficiencies and make sure that we are still delivering on our core missions while eliminating duplication and increasing efficiency, which will really enhance the security of our citizens. All for efficiencies. But my concern is in the data that was accessed by these employees and potentially shared on unsecured networks. I've read that they've shared information via personal Gmail accounts. Have you all had a chance to go in and provide any oversight over what data was accessed, where it went, how it was shared? I don't have that here today, but I'm happy to go back and get some information and try and provide you a more fulsome answer. I am very, very interested in that. And I think there are other members of the committee who would be interested in that. And as the chairman mentioned, if we've got to do that in a SCIF, we are at the ready. Mr. Chairman, I yield back a little over three minutes. Thank you for being an all-star member of the committee. Mr. Siscomonte, the floor is yours for four minutes. I'll represent Arizona well and stick to the time, Mr. Chairman. Thank you, Ms. Bean, for being here with us today. I really appreciate your feedback. You know, we all know quite well that in our increasingly interconnected world where there's so much information lives on the cloud and communications are done electronically, the cyber threat environment is dynamic and changing on a daily basis. Adversarial nations and criminals take advantage of any weakness and perceived weakness and will continue to do so. That's how they operate. This happens not only at the federal level, but also at a state and the local level as well. Can you speak to the resources that you have available for state and local governments and how you anticipate the budget request changing if at all the availability of these resources for state and local governments? So, at CISO, we have what we call our regional delivery model. And that means having security advisors in every state and territory. And those are discipline-specific experts on security, cybersecurity, physical security, emergency solutions. And it's that team on the ground that's working with local government, local critical infrastructure in those communities. And they work and they live in those communities. So, this is the way we deliver many of our scalable products and services is down to our regional security advisors. And this administration is committed to making sure that we are as close to the American people delivering those services as possible. I can promise you that. Great, you know, on that same topic of closeness to the community, kind of like boots on the ground kind of thing, small businesses are a perfect representation of that. They depend a lot on the resources also that we can provide for their security, both cyber mainly, but also in other aspects. Can you speak a little bit to that, to the small business resources? Absolutely, you know, you're making my heart sing, having worked at the SBA for many, many years. We know that small business is the engine of our economy, and so making sure that they're doing everything they can in this highly competitive, highly connected environment is really important. And there's things that they can do immediately that will help better secure them. One is to get to know their CISA security advisor. Two is to sign up for our cyber hygiene program, which is a continuous monitoring of what's happening on there, what vulnerabilities they're exposed to. Thirdly is to patch those vulnerabilities, right? Another thing that they can do is make sure that their employees understand the threat that phishing attempts and those kinds of things, so internal education. The other thing that I really think bears special attention is small businesses are critical to the supply chain of our national security. And as such, whether they may not be prime contractors, they may be, they may be subcontractors, or they may be just supplying to those people. It is important that the products that they purchase are secure. And so they should be able to tell their employees that what they're buying is a product that is a product of a private company. It's a product of a private company. This should not be known to the public. This should, they shouldn't have to go and figure it out. How do I do this? Those products that they are buying and they're installing to drive their business with great jobs and economic revenue, they should be secure by design. They can have their voices heard talking through membership, through their congressional members, to have industry develop and deploy secure technology. So there's things they can do immediately, and then there's things that they can do that will have a longer term impact, but they are very powerful. Great, thank you so much. Thank you for that. Jim, I yield back. Sir, yes, George, you have one minute. Thank you, Mr. Chairman. And Director Bain, thank you for joining us this morning. I wanna talk a little bit about public-private partnerships. I know that CISA has done extremely well, particularly with the same stakeholders as ACDC. And we know that these public-private partnerships, they promote shared situational awareness, faster response, more unified, against cyber attacks. And so just with the agency going forward, talk a little bit about, one, the importance of these public-private partnerships, how we can grow and expand those, and maybe a little more particularly about some of the great work that ACDC is doing. Well, hotty toddy, I just love that question. CISA's built on public-private partnerships. I mean, we're not regulatory. Everything we do is through trusted, established relationships. And that is truly, the mandate that you've given us is to build public-private partnerships, and that's what we're doing. But it's critically important. We just talked about the Spain incident. Without those existing relationships and partnerships, we would not have been able to reach out immediately to get the information. Had it been a cyber incident, we would have been able to get indicators of compromise, all kinds of things that we could have then brought home and worked on our own networks. We are uniquely positioned, the authorities that you have given us uniquely position us between the private sector, the public sector, our international partners. And through that place where we sit, we are able to share and get information that's critically important that we can then share with all 16 critical infrastructures. The JCDC is, it is by nature, a partnership-building organization. And it is through that trusted relationship that people share information with us. Those who are competitors on the P&L sheet are collaborators in the CISA world because they know, and they're trusted, and they know that this information is gonna be used to secure our homeland. So they are sharing information that they would not share with competitors otherwise. And so we build it at the national level, at the international, but also at the local level. And so our field forces are in constant communication with JCDC. JCDC asks our regional folks to get with the people they know and trust on the ground. It is quintessential to our success to make sure that these public partnerships continue and that we grow them. And then let me ask you, you talked a little bit about cybercriminals, cyberattacks, reporting known vulnerabilities. So I think one of the ways that we can harden our systems is patching vulnerabilities within operations. We've had public service efforts. We always try to encourage people to get the newest and latest security update. And it seems like that so many of us don't. And I'm probably one of those that probably doesn't update my phone as often as I need to. So some of this may be talking to me. But without government heavy handedness and mandating these sorts of things, what can we do either through policies or incentives or standards to encourage more people to stay ahead of these cyberattacks by timely patching of operational systems within their business model? You know, the Patch Tuesdays just don't work anymore. And as we look across the whole ecosystem of cybersecurity, companies, businesses, small businesses, the burden shouldn't be on them. And again, I'm gonna go back and foot stomp Secure by Design. But these patches need to be done and forcing those installations. I'm really encouraged though, that as I look at my children, my grandchildren and the workforce we have, this digital interconnectivity is just a way of life. And so I think that they will be the driving force just to have it in our DNA. That's just gonna be a standard operating procedure. Also to raise the awareness that if you don't, you're not just opening yourself up to a cyberattack, but because you're so connected to everybody else, you are then the weakest link in the chain. And I think most Americans don't wanna be that. And so to the extent that we can help people understand how connected they are and that your family, your friends, your business partners, and the nation, our security depends on you doing this. But we also have to make it simple and easy. And I think that our technology companies need to do their fair share. One, that they don't exist when the product is released and then making sure that those patches are done timely and make it easy for folks to install them. Thank you, Mr. Chairman, I yield back. The grand master of questioning on the committee, Mr. Newhouse, the floor is yours for four minutes. 14. I wanna thank all the other committee members for saving time so that Mr. Newhouse can be himself. Thank you, Mr. Chairman, you're too generous. You really are. It was being thanked for being with us today. I was gonna bring this up anyway, but for sure, after Mr. Guest's point, his question, in your testimony, you talked about the number of trainings offered to support the private sector as well as local governments. And they truly are a critical function of what the agency does. I just wanted to say that last summer, this is a plug for you, I guess, that CISA provided some of my constituents with a briefing during an agricultural threats roundtable and also just in March, protecting food from farm to table with cybersecurity and protective emphasis workshop. And I just wanna say it was highly regarded, very well received. Chad Hudson, just to give him a call out, the regional affairs officer was very helpful. So I would encourage you to keep that up. It helps all of us be stronger. But I wanted to, real quickly, in the time I have left, just the threats from China are huge. I just came from a select committee on China. Now I won't be able to sleep tonight because of some of the things I learned there. But they're moving from economic and intelligence espionage to threatening our infrastructure, things that keep the lights on and all that kind of stuff. That's my understanding. So in your gut, do you feel that, do you believe that you've got the structure that's adequate for defending the U.S. against these kind of things? And if not, what can we do to help? You're right. I mean, China is the most prolific dominant threat we have. And they are doing it for three reasons, right? They are doing it for espionage, they're doing it to steal our intellectual property, and they are getting into our critical infrastructure and they are waiting. They are patient, they're persistent, they have decades of experience. And they are waiting to disrupt or destroy our critical infrastructure at the time and place of their choosing. And they want to do it to either discourage us, should there be a conflict with China over Taiwan. And two things, we are not making them work hard enough. Make it harder for them. We need to make it harder for them. And so the work that we're doing, and this is all part of the answer, our known vulnerabilities catalog and helping making sure that there's mitigating strategies, that's a huge way. The more we can make it hard for them to get into our critical infrastructure, the better it is. We have the tools to do what we need to do. We need to make sure that we are leveraging every partnership we have, that we're making sure that people understand the threat, that everybody is doing what they need to do. I don't know if you saw, but two weeks ago, Secretary Noem went out to the RSA Conference, which is one of the leading cybersecurity conferences out in San Francisco. And I think she went for two reasons. One, I think she wanted to let the world know that cybersecurity is part of our national security plan. We're gonna defend our homeland on land, air, border, sea, and cyber. So she was putting that call out there. And I think to the CISA family, she was saying, I support you, that you are part of this national security, and that you, that we play a critical role in that plan, and that she supports us. So we have the tools. What we need to be able to do is be more streamlined, more efficient, make sure that we are looking at the highest threats and the most vulnerable entities, and taking our precious resources and driving them to buy down that risk in that area that we know the adversaries are targeting. So it's working with the IC community to understand who are the targets, understanding the tools that will best address it, and then deploying it and working in partnership with those to make sure that they take those actions needed to drive down the risk. Thank you very much. Thank you, sir. Yield back to the best subcommittee chairman on the entire committee. Well, is there any more time you'd like, Mr. Newhouse? We can call you Mr. Rutherford and use his. Well, first of all, I wanna thank the committee for being true leaders in every stretch of the word in terms of trying to be efficient with our use of time today, with other schedules and stuff like that. Madam Director, thank you very much for appearing here today with your folks. I am gonna ask a couple of questions, but go ahead and start this for me too. I mean, I'm not a hypocrite most of the time. So a couple of things. First of all, some people have talked with you about outreach. So when we work up the bill, I think it's not news that outreach is phenomenally important to everybody on the committee. We think it's a very good thing that you do. And so we're gonna be looking specifically at, I mean, let's face it, the context that we will be marking up the bill for your budget is one that frankly has some challenges for us in terms of what may be asked for. Nobody leave the room saying that I'm challenging you on it, but please leave the room. And if you think there's a message there, here it is. You guys have been asked to transfer $139 million in a reprogramming request, and you've also been cut a half a billion dollars or whatever it is, round numbers. We would like to know, so before the markup, in a timely manner before the markup, it's like, so how does this affect things? You say, what the heck did he just ask? I'm not a guy that believes more money is the answer to everything, but I am very definitely, I don't speak for anybody but me, but I think there's a theme here, which is I wanna know where the 139 million's coming from in the reprogramming before we act on that. And the second thing is I wanna know how the 150, the half a billion basically comes out of that in the context of your mission. And I get that in the past that there was like, well, they were doing stuff they shouldn't have been doing. I'm not concerned with any of that right now. I'm concerned in what we're doing now in doggie and I'm concerned with what we're doing in fiscal year 26. And when I hear people like the subcommittee chairman from New York on the policy committee and the chairman of the policy committee talking about, China's eating our lunch, my word's not theirs, but in other words, and I know you can never say mission accomplished, but we wanna know specifically, it's like, so I know you're being reorganized and all that other sort of stuff, but at the end of the day, if there's a big meltdown and somebody's gonna go, well, how come you folks approved cutting a bunch of stuff? And it's like, I at least wanna be in the position, we asked the questions, we looked at the data, we thought we had done the right thing. I mean, perfection is the standard and we're all human, so that's not gonna be achieved. What I don't wanna be in the position at the end of this is, oh yeah, go ahead and all that. When it might be kind of obvious, it's like, well, you get what you pay for. More money is not automatically the answer, but I'm not talking about more money, I'm talking about approaching three quarters of a billion dollars between reprogramming and the cuts based on the skinny budget. And you say, well, what the heck's the question? The question is this, why shouldn't I be worried about where we're sitting in terms of all the issues that you've talked about as a result of those cuts? And if the only thing that's gonna come back is a general, well, we're reorganizing and refocusing, please pass up the chain, ma'am, that that dog won't hunt. And it ought to scare the heck out of everybody in this room to think that these people sitting around this table are gonna do your budget for you if we don't get something. So, I mean, I would be scared if I was doing my own budget even. So, we would like that feedback from you folks in a pretty timely manner. And we also look forward to hearing as it goes forward, what's going on in the reorganization. Because I'm guessing we're gonna have to do this budget before the reorganization's done. And so if that's a big unknown out there, that's gonna be a problem for these people being able to say that they had a pretty good snapshot of what the facts were and what we did. I'm being bullied up here about stuff that I guess I'm supposed to read. Not your fault, Madam Reichenbaum. So, I'm gonna start about, I already said that. I look forward to continuing the discussion on how we refocus CISA, but still maintain our core cyber defenses. I think I said that. Here's the part. We won't surprise you, don't you surprise us. For the get back questions the members had today, we ask that you respond within 15 days. There may be some additional questions members provide in writing. We ask you to respond to those in a timely manner. Thank you, ma'am. You and your agency, your professionalism, and whatever are noted. I wanna make that specifically part of the record today. We look forward to working with you. And, with that, the subcommittee stands adjourned. Thank you. Great job. Thank you so much. Have a wonderful weekend. Enjoy your weekend. Yes, you do the same. Thank you so much. Thank you so much, really appreciate it.