There is also the political angle. If the government were to really enforce or mandate some levels of computer security starting in house, would lose almost all of its Gov business, and that would not be allowed to happen quietly.
$80 mil is plenty. All his department has to do is identify problems. Companies and government agencies that run computer networks will pay out of their own budgets to fix problems that he identifies. There is more to this story than we are being told in this article.