When it comes to cybersecurity, the Biden administration is failing to put its money where its mouth is. Over the past month, the administration has released a flurry of well-constructed strategic documents outlining the importance of public-private collaboration to secure critical infrastructure. But the president’s budget, released a month earlier, fails to provide adequate funding to achieve this lofty goal.

In what may become the administration’s most important cybersecurity policy document, the administration issued National Security Memorandum 22 on April 30, updating a decade-old policy on how the federal government works with critical infrastructure owners and operators. While maintaining the designation of federal agencies as sector risk management agencies to work with the private sector, the update appropriately shifts the focus toward more robust risk management and cross-sector coordination.