TELOS CORP

U.S. Budget

Congress has been unable to complete action on all appropriations bills for Fiscal Year ("FY") 2024, which began on October 1, 2023. Instead, Congress has resorted to approving a series of continuing resolutions (“CRs”), which have funded the government at FY2023 levels for over five months with no new program starts. Some appropriations bills were finally approved in early March 2024, but most federal spending remains under a CR.

This means the President’s proposed three percent increase in defense spending, which was also provided for by the spending caps contained in the debt ceiling legislation (the "Fiscal Responsibility Act”) signed into law last June 2023, have so far not been approved. The FY2024 National Defense Authorization Act enacted in December 2023 does not authorize that propose three percent hike in defense spending, but actual appropriated defense spending has remained at FY2023 levels under these CRs, and it will continue to be frozen until a full-year defense appropriations bill can be signed into law.

The President's FY2024 budget also proposed increased investments for cybersecurity within numerous federal civilian departments and agencies. In general, the President's budget reflected the prioritization of accelerated cloud adoption, IT modernization, further private sector collaboration for sector risk management responsibilities, ensuring adequate cyber threat information sharing, and supply chain risk management. These priorities align with the solutions Telos has been developing and bringing to market for the past several years. However, as with defense spending, these proposed increases have remained on hold until Congress can agree on full-year FY2024 appropriation legislation for all department and agencies.

Even if Congress finally reaches agreement on the remaining FY2024 appropriations bills in March 2024, that will leave less than seven months for federal agencies to execute any increased spending levels these measures provide.

Finally, submission to Congress of the Biden Administration's proposed FY2025 budget was delayed until March 11, 2024 – a month later than normal – in large part because lawmakers have been unable to complete work on FY2024 appropriations legislation. Such final bills would normally serve as a detailed baseline from which the White House would develop next year's proposed budget.

This failure to approve the FY2024 appropriations legislation in a timely manner and the resultant uncertainty about actual funding has impacted federal customers' ability to move forward on their planned expenditures in FY2024, and to adequately plan for FY2025.

Cybersecurity Landscape

In recent years, we have seen cybersecurity threats become more complex, with threat actors leveraging a wide variety of tactics to exploit their victims. With this growing threat, below are some trends to consider when looking at the cybersecurity landscape:

Rising Threats, Rising Liability: Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. One reason for the rise of ransomware attacks is that it is exceedingly profitable for cybercriminals, and ransomware victims generally settle the ransom rather than restoring the system from backups or dealing with the fallout from a data breach. Aside from the financial costs of paying the ransom and restoring the system, the consequences of a successful ransomware attack can include damage to the organization's reputation, stolen sensitive data being used for malicious purposes, and loss of business.

The Nation's Critical Systems Are Still at Risk: Critical infrastructure and industrial IoT are among the categories at greatest risk of cyberattacks.

The Challenging Complexity of Regulatory Compliance: Government mandates stronger security in highly regulated industries. These government initiatives and audit fatigue continue to burden highly regulated organizations, with automation solutions being recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires.

Additionally, the SEC has finalized and adopted new cybersecurity rules for publicly traded companies, which will require registrants to disclose additional cyber-related information in their regulatory filings. Specifically, they will have to: (1) regularly disclose their governance methods, risk analysis and management processes; (2) meet specific disclosure requirements and deadlines for reporting and describing material cyber incidents; and (3) describe the board's oversight of risks from cybersecurity threats, and management's expertise and role in assessing and managing material risks from cybersecurity threats. The required reporting of this information will lead many companies to proactively establish policies that will improve their cyber risk management posture and enable them to better withstand heightened public and regulatory scrutiny.

Identity Assurance and Privacy Protection are Essential for Today's Enterprises: Identity and access management continues to be a major cybersecurity concern for organizations and individuals that need to ensure their security and protect their privacy. Trusted identities are essential to confidence in IT and physical security strategies and to the success of Zero Trust security models and architectures.

Artificial Intelligence: Cybercriminals are using Artificial Intelligence ("AI") to launch more sophisticated attacks that can quickly adapt to changing environments, making detection harder. To protect against AI-powered cyberattacks, organizations must stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats timely before they can cause damage.