Homeland Security Cybersecurity Boots-on-the-Ground Act

Summary: (Sec. 1) Amends the Homeland Security Act of 2002 to add provisions entitled the Homeland Security Cybersecurity Boots-on-the-Ground Act, which require the Secretary of Homeland Security (DHS) to: (1) develop occupation categories for individuals performing activities in furtherance of DHS's cybersecurity mission, (2) ensure that such categories may be used throughout DHS and are made available to other federal agencies, and (3) conduct an annual assessment of the readiness and capacity of the DHS workforce to meet its cybersecurity mission.  Directs the Secretary to include in such readiness assessment information on which cybersecurity positions are performed by: (1) permanent full time departmental employees (together with demographic information about such employees' race, ethnicity, gender, disability status, and veterans status); (2) individuals employed by independent contractors; and (3) individuals employed by other federal agencies, including the National Security Agency (NSA). Requires the assessment to address vacancies within the supervisory workforce, job training, and recruiting costs.  Directs the Secretary to develop: (1) a workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the DHS cybersecurity workforce, including a multi-phased recruitment plan, a 5-year implementation plan, and a 10-year projection of DHS workforce needs; and (2) a process to verify that employees of independent contractors who serve in DHS cybersecurity positions receive initial and recurrent information security and role-based security training commensurate with assigned responsibilities.  Requires the Secretary to provide Congress with annual updates regarding such strategies, assessments, and training. Requires the Comptroller General (GAO) to study and report to the Secretary and Congress with respect to such assessments and strategies.  Directs the Secretary to report to Congress regarding the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for DHS for an agreed-upon period of time. (Sec. 2) Authorizes the Secretary to exercise personnel authorities (in the same manner as the Secretary of Defense [DOD] exercises authority with respect to civilian intelligence personnel and scholarship programs) to establish positions in the excepted service, appoint individuals, fix pay, and pay retention bonuses if needed to retain essential DHS employees who perform functions relating to the security of federal civilian information systems, critical infrastructure information systems, or related networks. Requires the Secretary to provide an explanation to Congress before announcing a bonus.  Requires the Secretary to provide an annual report to Congress for a specified period regarding the processes used in accepting applications, assessing candidates, ensuring adherence to veterans' preference, and selecting applicants for vacancies to be filled by a qualified employee.

SECTION 1. HOMELAND SECURITY CYBERSECURITY WORKFORCE.

    (a) In General.--Subtitle C of title II of the Homeland Security 
Act of 2002 (6 U.S.C. 141 et seq.) is amended by adding at the end the 
following new section:

``SEC. 226. CYBERSECURITY OCCUPATION CATEGORIES, WORKFORCE ASSESSMENT, 
              AND STRATEGY.

    ``(a) Short Title.--This section may be cited as the `Homeland 
Security Cybersecurity Boots-on-the-Ground Act'.
    ``(b) Cybersecurity Occupation Categories.--
            ``(1) In general.--Not later than 90 days after the date of 
        the enactment of this section, the Secretary shall develop and 
        issue comprehensive occupation categories for individuals 
        performing activities in furtherance of the cybersecurity 
        mission of the Department.
            ``(2) Applicability.--The Secretary shall ensure that the 
        comprehensive occupation categories issued under paragraph (1) 
        are used throughout the Department and are made available to 
        other Federal agencies.
    ``(c) Cybersecurity Workforce Assessment.--
            ``(1) In general.--Not later than 180 days after the date 
        of the enactment of this section and annually thereafter, the 
        Secretary shall assess the readiness and capacity of the 
        workforce of the Department to meet its cybersecurity mission.
            ``(2) Contents.--The assessment required under paragraph 
        (1) shall, at a minimum, include the following:
                    ``(A) Information where cybersecurity positions are 
                located within the Department, specified in accordance 
                with the cybersecurity occupation categories issued 
                under subsection (b).
                    ``(B) Information on which cybersecurity positions 
                are--
                            ``(i) performed by--
                                    ``(I) permanent full time 
                                departmental employees, together with 
                                demographic information about such 
                                employees' race, ethnicity, gender, 
                                disability status, and veterans status;
                                    ``(II) individuals employed by 
                                independent contractors; and
                                    ``(III) individuals employed by 
                                other Federal agencies, including the 
                                National Security Agency; and
                            ``(ii) vacant.
                    ``(C) The number of individuals hired by the 
                Department pursuant to the authority granted to the 
                Secretary in 2009 to permit the Secretary to fill 1,000 
                cybersecurity positions across the Department over a 
                three year period, and information on what challenges, 
                if any, were encountered with respect to the 
                implementation of such authority.
                    ``(D) Information on vacancies within the 
                Department's cybersecurity supervisory workforce, from 
                first line supervisory positions through senior 
                departmental cybersecurity positions.
                    ``(E) Information on the percentage of individuals 
                within each cybersecurity occupation category who 
                received essential training to perform their jobs, and 
                in cases in which such training is not received, 
                information on what challenges, if any, were 
                encountered with respect to the provision of such 
                training.
                    ``(F) Information on recruiting costs incurred with 
                respect to efforts to fill cybersecurity positions 
                across the Department in a manner that allows for 
                tracking of overall recruiting and identifying areas 
                for better coordination and leveraging of resources 
                within the Department.
    ``(d) Workforce Strategy.--
            ``(1) In general.--Not later than 180 days after the date 
        of the enactment of this section, the Secretary shall develop, 
        maintain, and, as necessary, update, a comprehensive workforce 
        strategy that enhances the readiness, capacity, training, 
        recruitment, and retention of the cybersecurity workforce of 
        the Department.
            ``(2) Contents.--The comprehensive workforce strategy 
        developed under paragraph (1) shall include--
                    ``(A) a multiphased recruitment plan, including 
                relating to experienced professionals, members of 
                disadvantaged or underserved communities, the 
                unemployed, and veterans;
                    ``(B) a 5-year implementation plan;
                    ``(C) a 10-year projection of the Department's 
                cybersecurity workforce needs; and
                    ``(D) obstacles impeding the hiring and development 
                of a cybersecurity workforce at the Department.
    ``(e) Information Security Training.--Not later than 270 days after 
the date of the enactment of this section, the Secretary shall 
establish and maintain a process to verify on an ongoing basis that 
individuals employed by independent contractors who serve in 
cybersecurity positions at the Department receive initial and recurrent 
information security training comprised of general security awareness 
training necessary to perform their job functions, and role-based 
security training that is commensurate with assigned responsibilities. 
The Secretary shall maintain documentation to ensure that training 
provided to an individual under this subsection meets or exceeds 
requirements for such individual's job function.
    ``(f) Updates.--The Secretary shall submit to the appropriate 
congressional committees annual updates regarding the cybersecurity 
workforce assessment required under subsection (c), information on the 
progress of carrying out the comprehensive workforce strategy developed 
under subsection (d), and information on the status of the 
implementation of the information security training required under 
subsection (e).
    ``(g) GAO Study.--The Secretary shall provide the Comptroller 
General of the United States with information on the cybersecurity 
workforce assessment required under subsection (c) and progress on 
carrying out the comprehensive workforce strategy developed under 
subsection (d). The Comptroller General shall submit to the Secretary 
and the appropriate congressional committees a study on such assessment 
and strategy.
    ``(h) Cybersecurity Fellowship Program.--Not later than 120 days 
after the date of the enactment of this section, the Secretary shall 
submit to the appropriate congressional committees a report on the 
feasibility of establishing a Cybersecurity Fellowship Program to offer 
a tuition payment plan for undergraduate and doctoral candidates who 
agree to work for the Department for an agreed-upon period of time.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by adding after the item relating to section 225 
the following new item:

``Sec. 226. Cybersecurity occupation categories, workforce assessment, 
                            and strategy.''.

SEC. 2. PERSONNEL AUTHORITIES.

    (a) In General.--Subtitle C of title II of the Homeland Security 
Act of 2002, as amended by section 1 of this Act, is further amended by 
adding at the end the following new section:

``SEC. 227. PERSONNEL AUTHORITIES.

    ``(a) In General.--
            ``(1) Personnel authorities.--The Secretary may exercise 
        with respect to qualified employees of the Department the same 
        authority that the Secretary of Defense has with respect to 
        civilian intelligence personnel and the scholarship program 
        under sections 1601, 1602, 1603, and 2200a of title 10, United 
        States Code, to establish as positions in the excepted service, 
        appoint individuals to such positions, fix pay, and pay a 
        retention bonus to any employee appointed under this section if 
        the Secretary determines that such is needed to retain 
        essential personnel. Before announcing the payment of a bonus 
        under this paragraph, the Secretary shall submit to the 
        Committee on Homeland Security of the House of Representatives 
        and the Committee on Homeland Security and Governmental Affairs 
        of the Senate a written explanation of such determination. Such 
        authority shall be exercised--
                    ``(A) to the same extent and subject to the same 
                conditions and limitations that the Secretary of 
                Defense may exercise such authority with respect to 
                civilian intelligence personnel of the Department of 
                Defense; and
                    ``(B) in a manner consistent with the merit system 
                principles set forth in section 2301 of title 5, United 
                States Code.
            ``(2) Civil service protections.--Sections 1221 and 2302, 
        and chapter 75 of title 5, United States Code, shall apply to 
        the positions established pursuant to the authorities provided 
        under paragraph (1).
            ``(3) Plan for execution of authorities.--Not later than 
        120 days after the date of the enactment of this section, the 
        Secretary shall submit to the Committee on Homeland Security of 
        the House of Representatives and the Committee on Homeland 
        Security and Governmental Affairs of the Senate a report that 
        contains a plan for the use of the authorities provided under 
        this subsection.
    ``(b) Annual Report.--Not later than one year after the date of the 
enactment of this section and annually thereafter for four years, the 
Secretary shall submit to the Committee on Homeland Security of the 
House of Representatives and the Committee on Homeland Security and 
Governmental Affairs of the Senate a detailed report (including 
appropriate metrics on actions occurring during the reporting period) 
that discusses the processes used by the Secretary in implementing this 
section and accepting applications, assessing candidates, ensuring 
adherence to veterans' preference, and selecting applicants for 
vacancies to be filled by a qualified employee.
    ``(c) Definition of Qualified Employee.--In this section, the term 
`qualified employee' means an employee who performs functions relating 
to the security of Federal civilian information systems, critical 
infrastructure information systems, or networks of either of such 
systems.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
such Act is amended by adding after the item relating to section 226 
(as added by section 1 of this Act) the following new item:

``Sec. 227. Personnel authorities.''.

SEC. 3. CLARIFICATION REGARDING AUTHORIZATION OF APPROPRIATIONS.

    No additional amounts are authorized to be appropriated by reason 
of this Act or the amendments made by this Act.

            Passed the House of Representatives July 28, 2014.

            Attest:

                                                 KAREN L. HAAS,

                                                                 Clerk.