CYBERSECURITY 

WORKFORCE 

Agencies Need to 

Improve Baseline 

Assessments and 

Procedures for 

Coding Positions 

Report to Congressional Committees

June 2018

GAO-18-466

United States Government Accountability Office
United States Government Accountability Office

 

Highlights of GAO-18-466, a report to 

congressional committees 

June 2018 

CYBERSECURITY WORKFORCE

Agencies Need to Improve Baseline Assessments 

and Procedures for Coding Positions

What GAO Found

As required by the Federal Cybersecurity Workforce Assessment Act of 2015

(act), the Office of Personnel Management (OPM) developed a cybersecurity 

coding structure under the National Initiative for Cybersecurity Education (NICE) 

as well as procedures for assigning codes to federal civilian cybersecurity 

positions. However, OPM issued the coding structure and procedures 5 and 4

months later than the act’s deadlines because OPM was working with the

National Institute of Standards and Technology (NIST) to align the structure and 

procedures with the draft NICE Cybersecurity Workforce Framework, which NIST 

issued later than planned. OPM also submitted a progress report to Congress on 

the implementation of the act 1 month after it was due. The delays in issuing the 

coding structure and procedures have extended the expected time frames for 

implementing subsequent provisions of the act.

Most of the 24 agencies covered by the Chief Financial Officers (CFO) Act

submitted baseline assessment reports to Congress but the results may not be 

reliable. As of March 2018, 21 of the 24 CFO Act agencies had conducted 

baseline assessments identifying the extent to which their cybersecurity 

employees held professional certifications and had submitted the assessment 

reports to Congress as required by the act. Three agencies had not conducted 

the assessments for various reasons, such as a lack of resources and tools to do 

so. Of the 21 agencies that did, 4 did not address all of the reportable 

information, such as the extent to which personnel without professional 

certifications were ready to obtain them or strategies for mitigating any gaps. 

Additionally, agencies were limited in their ability to obtain complete or consistent 

information about their cybersecurity employees and the certifications they held. 

This was because agencies had not yet fully identified all members of their 

cybersecurity workforces or did not have a consistent list of appropriate 

certifications for cybersecurity positions. As a result, the agencies had limited 

assurance that their assessment results accurately reflected all relevant 

employees or the extent to which those employees held appropriate 

certifications. This diminishes the usefulness of the assessments in determining 

the certification and training needs of these agencies’ cybersecurity employees. 

Most of the 24 CFO Act agencies established coding procedures, but 6 agencies 

only partially addressed certain activities required by OPM in their procedures.

Of the 24 agencies reviewed, 23 had established procedures to identify their 

civilian cybersecurity positions and assign the appropriate employment codes to 

the positions as called for by the act. However, 6 of the 23 agencies did not

address one or more of 7 activities required by OPM in their procedures, such as 

the activities to review all filled and vacant positions and annotate reviewed 

position descriptions with the appropriate employment code. These 6 agencies 

cited a variety of reasons for not addressing all of the required activities in their 

coding procedures. For example, these agencies stated that they addressed the 

activities in existing guidance or did not include activities that their components 

did not have the responsibility to perform. By not addressing all of the required 

activities in their coding procedures, the 6 agencies lack assurance that the

activities will be performed or performed consistently throughout their agency. 

View GAO-18-466. For more information, 

contact Gregory C. Wilshusen at 

(202) 512-6244 or wilshuseng@gao.gov. 

Why GAO Did This Study

A key component of mitigating and 

responding to cyber threats is having a 

qualified, well-trained cybersecurity 

workforce. The Federal Cybersecurity 

Workforce Assessment Act of 2015 

requires OPM and federal agencies to 

take several actions related to 

cybersecurity workforce planning. 

GAO is to monitor agencies’ progress

in implementing the act’s requirements.

For this report, GAO assessed

whether: (1) OPM developed a coding 

structure and procedures for assigning 

codes to cybersecurity positions and 

submitted a progress report to 

Congress; (2) CFO Act agencies

submitted complete, reliable baseline 

assessments of their cybersecurity 

workforces; and (3) CFO Act agencies 

established procedures to assign 

codes to cybersecurity positions. GAO 

examined OPM’s coding procedures 

and progress report on the act’s

implementation, and baseline 

assessments and coding procedures 

from the 24 CFO Act agencies. GAO 

also interviewed relevant OPM and 

agency officials about efforts to 

address the act’s requirements. 

What GAO Recommends

GAO is making 30 recommendations 

to 13 agencies to fully implement two 

of the act’s requirements on baseline 

assessments and coding procedures. 

Of the 12 agencies to which we made 

recommendations that provided 

comments on the report, 7 agreed with 

the recommendations made to them, 4 

did not state whether they agreed or 

disagreed, and 1 did not agree with 

one of two recommendations made to 

it. GAO continues to believe that the 

recommendation is valid as discussed 

in this report. 
Page i GAO-18-466 Cybersecurity Workforce 

Letter 1

Background 4

OPM Issued a Cybersecurity Position Coding Structure, 

Procedures, and Progress Report Later Than the Deadlines 

Established in the Act 10

Most CFO Act Agencies Submitted Baseline Assessments, but the 

Results May Not Be Reliable 16

Most CFO Act Agencies Established Coding Procedures, but Six 

Agencies’ Procedures Only Partially Addressed Activities 

Required by OPM 26

Conclusions 32

Recommendations for Executive Action 33

Agency Comments and Our Evaluation 36

Appendix I Objectives, Scope, and Methodology 43

Appendix II Comments from the Department of Commerce 46

Appendix III Comments from the Department of Education 48

Appendix IV Comments from the Department of Energy 49

Appendix V Comments from the Department of Homeland Security 51

Appendix VI Comments from the Department of the Interior 54

Appendix VII Comments from the Small Business Administration 55

Contents
Page ii GAO-18-466 Cybersecurity Workforce 

Appendix VIII Comments from National Aeronautics and Space Administration 56

Appendix IX Comments from the Nuclear Regulatory Commission 58

Appendix X Comments from the United States Agency for 

International Development 59

Appendix XI Comments from the Social Security Administration 62

Appendix XII GAO Contact and Staff Acknowledgments 63

Tables

Table 1: Office of Personnel Management Cybersecurity 

Employment Codes for “Securely Provision” Category 

(aligned with NICE Cybersecurity Workforce Framework, 

NIST SP 800-181) 11

Table 2: Submission Status of Reports on Cybersecurity 

Workforce Baseline Assessments by Agencies Covered 

by the Chief Financial Officers Act, as of March 2018 17

Table 3: Information Reported by 21 Chief Financial Officers 

(CFO) Act Agencies in Their Cybersecurity Workforce 

Baseline Assessments 20

Table 4: Extent That Chief Financial Officers Act Agencies with 

Procedures Have Addressed Activities Required by OPM 

in Their Procedures (Civilian Positions),a as of March 

2018 29

Figures

Figure 1: National Initiative for Cybersecurity Education 

Cybersecurity Workforce Framework (NIST SP 800-181), 

Categories and Specialty Areas 6
Page iii GAO-18-466 Cybersecurity Workforce 

Figure 2: Specialty Areas and Work Roles Defined in the 

“Securely Provision” Cybersecurity Workforce Framework 

Category 7

Figure 3: Timeline of Recent Efforts by OPM, NIST, and Other 

Agencies to Assess the Cybersecurity Workforce 9

Figure 4: Prior Delays Resulting in Later Implementation of the 

Provisions of the Federal Cybersecurity Workforce 

Assessment Act of 2015, as of March 2018 15

Abbreviations

CFO Chief Financial Officers

CIO chief information officer

CISO chief information security officer

DHS Department of Homeland Security

DOD Department of Defense

HR human resources

IT information technology

NASA National Aeronautics and Space Administration

NICE National Initiative for Cybersecurity Education

NIST National Institute of Standards and Technology

ODNI Office of the Director of National Intelligence

OMB Office of Management and Budget

OPM Office of Personnel Management

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-466 Cybersecurity Workforce 

441 G St. N.W.

Washington, DC 20548

June 14, 2018

Congressional Committees

The security of federal information systems and data is vital to public 

confidence and the nation’s safety, prosperity, and well-being. However, 

the federal government faces an ever-evolving array of cyber-based 

threats to its systems and information. Further, federal systems and 

networks are inherently at risk because of their complexity, technological 

diversity, and geographic dispersion, among other reasons.

A key component of the government’s ability to mitigate and respond to 

cyber threats is having a qualified, well-trained cybersecurity workforce. 

Cybersecurity professionals can help to prevent or mitigate the 

vulnerabilities that could allow malicious individuals and groups access to 

federal information technology (IT) systems. The ability to secure federal 

IT systems depends on the knowledge, skills, and abilities of the federal 

workforce that uses, implements, secures, and maintains these systems. 

This includes federal employees who use the systems in the course of 

their work, as well as the designers, developers, programmers, and 

administrators of the programs and systems.

We and other organizations previously have reported that agencies faced 

challenges in ensuring that they have an effective cybersecurity 

workforce. In 1997, we designated the security of federal information 

systems as a government-wide high-risk area and cited the shortage of 

information security personnel with technical expertise required to 

manage controls in these systems. In 2001, we added strategic human 

capital management to our high-risk list.1 In our 2017 update to the highrisk list, we reported that the federal government continues to be 

challenged in addressing mission critical skills gaps, including 

cybersecurity skills gaps.2

To address these and other challenges, the Federal Cybersecurity 

Workforce Assessment Act of 2015 requires the Office of Personnel 

 

1

GAO, High-Risk Series: Information Management and Technology, GAO/HR-97-9 

(Washington, D.C.: February 1997); and GAO, High-Risk Series: An Update, GAO-01-263 

(Washington, D.C.: January 2001).

2

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GAO-17-317 (Washington, D.C.: February 2017).

Letter
Page 2 GAO-18-466 Cybersecurity Workforce 

Management (OPM), the National Institute of Standards and Technology 

(NIST), and other federal agencies to take several actions related to 

cybersecurity workforce planning.3 Among other things, the act requires:

• OPM, in coordination with NIST, to develop an employment coding 

structure4 for cybersecurity positions.5

• OPM, in coordination with NIST, the Department of Homeland 

Security (DHS), and the Office of the Director of National Intelligence 

(ODNI), to establish procedures to implement the coding structure for 

civilian cybersecurity positions.

• OPM to submit a progress report on the implementation of the act to 

the appropriate congressional committees.

• Agencies to report on the baseline assessments of their existing 

cybersecurity workforces and establish procedures for identifying 

cybersecurity positions and assigning codes to such positions.

The Federal Cybersecurity Workforce Assessment Act of 2015 also 

includes a provision calling for us to analyze and monitor agencies’ 

implementation of the act’s requirements and report on this assessment 

to Congress no later than December 2018. Our objectives for this first 

report were to determine whether (1) OPM developed a coding structure 

and procedures for assigning codes to cybersecurity positions and 

submitted a progress report to Congress, (2) Chief Financial Officers 

 

3

The Federal Cybersecurity Workforce Assessment Act of 2015 was enacted as part of 

the Consolidated Appropriations Act, 2016, Pub. L. No. 114-113, Div. N, Title III, sec. 303 

(Dec. 18, 2015); 129 Stat. 2242, 2975-77. 

4

The act requires the development of an employment coding structure under the National 

Initiative for Cybersecurity Education (NICE). NIST, which heads NICE, issued the NICE 

Cybersecurity Workforce Framework to describe cybersecurity roles and positions. The 

employment coding structure identifies unique numeric codes for each of 52 work roles 

and 33 specialty areas defined in the NICE Framework. The codes are intended to allow 

OPM and agencies to identify and categorize all federal cybersecurity positions.

5

The act generally refers to the cybersecurity workforce as those positions requiring the 

performance of IT, cybersecurity, or other cyber-related job functions. Because the NICE 

Cybersecurity Workforce Framework focuses on cybersecurity work roles, for the 

purposes of this report, we refer to positions that require the performance of IT, 

cybersecurity, or other cyber-related functions as cybersecurity positions.
Page 3 GAO-18-466 Cybersecurity Workforce 

(CFO) Act agencies6 submitted complete and reliable baseline 

assessment reports of their cybersecurity workforces, and (3) CFO Act 

agencies established procedures to identify and assign codes to 

cybersecurity positions.

To address the first objective, we examined OPM guidance, 

memorandums, and reports to assess whether OPM had developed a 

coding structure and procedures for assigning codes to all federal civilian 

cybersecurity positions and submitted a progress report to Congress on 

the implementation of the act. We also interviewed OPM and NIST 

officials about their efforts to develop these documents and the reasons 

for any delays.

To address the second objective, we reviewed and compared the

contents of the 24 CFO Act agencies’ baseline assessment reports to the 

reporting requirements defined in the act. We also interviewed cognizant 

officials at the 24 agencies to (1) identify the process by which agencies 

collected and reported baseline assessment information on the 

certifications held by their cybersecurity personnel and (2) obtain their 

views on the reliability of the information reported in their agency’s 

baseline assessment.

To address the third objective, we assessed the completeness of the 24 

agencies’ procedures for identifying and assigning codes to cybersecurity 

positions by determining whether the procedures addressed the required 

coding activities defined in OPM guidance. We also compared the 

issuance date of the procedures to the deadline established in OPM’s 

coding guidance for agencies to issue the procedures, and interviewed 

agency officials about their efforts to complete the procedures by the 

required deadline and the reasons for any delays. A more complete 

description of our objectives, scope, and methodology is provided in 

appendix I.

 

6

The 24 agencies covered by the Chief Financial Officers Act are the Departments of 

Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, 

Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency; 

General Services Administration; National Aeronautics and Space Administration; National 

Science Foundation; Nuclear Regulatory Commission; Office of Personnel Management; 

Small Business Administration; Social Security Administration; and the U.S. Agency for 

International Development (31 U.S.C. § 901(b)).
Page 4 GAO-18-466 Cybersecurity Workforce 

We conducted this performance audit from October 2016 to June 2018 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Federal agencies and our nation’s critical infrastructures—such as 

energy, transportation systems, communications, and financial services— 

are dependent on computerized (cyber) information systems and 

electronic data to carry out operations and to process, maintain, and 

report essential information. The information systems and networks that 

support federal operations are highly complex and dynamic, 

technologically diverse, and often geographically dispersed. This 

complexity increases the difficulty in identifying, managing, and protecting 

the myriad of operating systems, applications, and devices comprising the 

systems and networks.

Cybersecurity professionals can help to prevent or mitigate the 

vulnerabilities that could allow malicious individuals and groups access to 

federal IT systems. The ability to secure federal systems depends on the 

knowledge, skills, and abilities of the federal and contractor workforce that 

uses, implements, secures, and maintains these systems.

Nevertheless, the Office of Management and Budget (OMB) has noted 

that the federal government and private industry face a persistent 

shortage of cybersecurity and IT talent to implement and oversee 

information security protections to combat cyber threats. In addition, the 

RAND Corporation7 and the Partnership for Public Service8 have reported 

that there is a nationwide shortage of cybersecurity experts, in particular, 

in the federal government. According to these reports, this shortage of 

cybersecurity professionals makes securing the nation’s networks more 

challenging and may leave federal IT systems vulnerable to malicious 

 

7

RAND Corporation, Hackers Wanted: An Examination of the Cybersecurity Labor Market 

(2014).

8

The Partnership for Public Service and Booz Allen Hamilton, Cyber-In-security: 

Strengthening the Federal Cybersecurity Workforce (July 2009) and Cyber In-Security II: 

Closing the Federal Talent Gap (April 2015).

Background
Page 5 GAO-18-466 Cybersecurity Workforce 

attacks. The persistent shortage of cyber-related talent has given rise to 

efforts to identify and assess the federal cybersecurity workforce.

NICE, led by NIST, is a partnership among government, academia, and 

the private sector focused on cybersecurity education, training, and 

workforce development. The mission of NICE is to energize and promote 

a robust network and an ecosystem of cybersecurity education, training, 

and workforce development. NICE fulfills this mission by coordinating with 

government, academic, and industry partners to build on existing 

successful programs, facilitate change and innovation, and bring 

leadership and vision to increase the number of skilled cybersecurity 

professionals that are helping to keep our nation secure. NICE issued an 

initial draft of the National Cybersecurity Workforce Framework (National 

Framework) for public comment in September 2011 and the final version 

1.0 in April 2013. The National Framework was intended to help identify, 

describe, and assess all cybersecurity roles within an organization. The 

National Framework organized cybersecurity job functions into 7 

categories and 31 specialty areas:

• Category: a high-level grouping of common cybersecurity functions. 

Categories group together work and workers that share common 

major functions, regardless of job titles or other occupational terms.

• Specialty area: an area of concentrated work, or function, within 

cybersecurity and related work. Related specialty areas are grouped 

together into categories. In version 1.0 of the National Framework, 

each specialty area was also associated with a distinct set of 

cybersecurity related tasks and knowledges, skills, and abilities.

In November 2016, NIST issued draft special publication 800-181 which 

revised and replaced earlier versions of the National Framework. The 

draft was co-authored by NIST, DOD, and DHS and was renamed the 

NICE Cybersecurity Workforce Framework (NICE Framework). In August 

2017, NIST published the final version of the special publication.9

The NICE Framework is intended to help the federal government better 

identify cybersecurity workforce needs by enabling agencies to examine 

 

9

National Institute of Standards and Technology, National Initiative for Cybersecurity 

Education (NICE) Cybersecurity Workforce Framework, SP 800-181 (Gaithersburg, Md.: 

August 2017).

The National Initiative for 

Cybersecurity Education 

(NICE) Created a 

Framework for Defining 

Cybersecurity Workforce 

Positions
Page 6 GAO-18-466 Cybersecurity Workforce 

specific cybersecurity work roles, and identify personnel skills gaps, 

rather than merely examine the number of vacancies by job series. The 

NICE Framework added 2 additional specialty areas within the 7 

categories. Figure 1 identifies the 7 categories and the 33 specialty areas 

in the NICE Framework.

Figure 1: National Initiative for Cybersecurity Education Cybersecurity Workforce Framework (NIST SP 800-181), Categories 

and Specialty Areas

The NICE Framework also introduced the concept of work roles as the 

third component of cybersecurity job functions. Work roles provide a more 

detailed description of the roles and responsibilities of cybersecurity job 

functions than do the category and specialty area components of the 
Page 7 GAO-18-466 Cybersecurity Workforce 

NICE Framework. The NICE Framework defines one or more work roles 

within each specialty area.10 For example, as depicted in figure 2, the 

NICE Framework defined 11 work roles within the 7 specialty areas in the 

“Securely Provision” category.11

Figure 2: Specialty Areas and Work Roles Defined in the “Securely Provision” Cybersecurity Workforce Framework Category

 

10The NICE Framework defines a total of 52 work roles across the 33 specialty areas. 

11The NICE Framework states that the specialty areas and work roles in the “Securely 

Provision” category conceptualize, design, procure, and/or build secure information 

technology systems, with responsibility for aspects of system and/or network 

development.
Page 8 GAO-18-466 Cybersecurity Workforce 

In October 2012, in coordination with a NICE interagency working group, 

OPM published a cybersecurity employment coding structure that aligned 

with the initial draft version of the National Cybersecurity Workforce 

Framework. The coding structure assigned a unique 2-digit cybersecurity 

employment code to each category and specialty area in the NICE 

Framework. According to OPM, the coding of federal positions with 

cybersecurity functions was intended to enhance agencies’ ability to 

identify critical cybersecurity workforce needs, recruit and hire employees 

with needed skills, and provide appropriate training and development 

opportunities to cybersecurity employees.

In July 2013, OPM initiated the Special Cybersecurity Workforce Project 

to support federal efforts to reduce the cybersecurity workforce skills gaps 

across agencies.12 Agencies were to use the definitions of cybersecurity 

work, as described in the National Cybersecurity Workforce Framework, 

along with OPM’s cybersecurity coding structure, to code positions 

performing cybersecurity work by the end of fiscal year 2014. The project 

was intended to enable agencies to identify and address their needs for 

cybersecurity skill sets to meet their missions.

In July 2016, OPM and the Office of Management and Budget (OMB) 

issued the Federal Cybersecurity Workforce Strategy.13 The strategy 

details government-wide actions to identify, expand, recruit, develop, 

retain, and sustain a capable and competent workforce in key functional 

areas to address complex and ever-evolving cyber threats. The strategy 

identifies a number of actions intended to address cybersecurity 

workforce challenges in: (1) identifying cybersecurity workforce needs, (2) 

expanding the cybersecurity workforce through education and training, (3) 

recruiting and hiring highly skilled talent, and (4) retaining and developing 

highly skilled talent.

The strategy states that OPM is to expand cybersecurity position coding 

and agencies are to conduct strategic workforce planning. These actions 

are related to the requirements of the Federal Cybersecurity Workforce 

Assessment Act of 2015, under which OPM is to establish an 

 

12Office of Personnel Management, Memorandum for Heads of Executive Departments 

and Agencies: Special Cybersecurity Workforce Project (Washington, D.C.: July 8, 2013).

13Office of Management and Budget and Office of Personnel Management, Federal 

Cybersecurity Workforce Strategy, M-16-15 (Washington, D.C.: July 12, 2016).

OPM Has Led Several 

Efforts to Assess the 

Federal Cybersecurity 

Workforce
Page 9 GAO-18-466 Cybersecurity Workforce 

employment coding structure and agencies are to identify and report on 

cybersecurity workforce critical needs.

Figure 3 depicts a timeline of recent efforts to assess the federal 

cybersecurity workforce.

Figure 3: Timeline of Recent Efforts by OPM, NIST, and Other Agencies to Assess the Cybersecurity Workforce
Page 10 GAO-18-466 Cybersecurity Workforce 

As required by the Federal Cybersecurity Workforce Assessment Act of 

2015, OPM developed a cybersecurity coding structure under NICE, 

issued guidance to implement the coding structure to identify all federal 

civilian cybersecurity positions, and provided a progress report to 

Congress on the implementation of the act. However, the coding structure 

and procedures were issued later than the act’s deadlines because OPM 

was working with the National Institute of Standards and Technology 

(NIST) to align the structure and procedures with the draft version of the 

NICE Cybersecurity Workforce Framework, which NIST issued later than 

planned. The delays in issuing the coding structure and procedures have 

extended the expected time frames for implementing subsequent

provisions of the act.

The Federal Cybersecurity Workforce Assessment Act of 2015 (the act) 

required OPM, in coordination with NIST, to develop a cybersecurity 

coding structure by June 15, 2016.

OPM addressed this requirement by developing a 3-digit cybersecurity 

employment coding structure that fully aligns with the NICE Cybersecurity 

Workforce Framework.

14 OPM issued version 1 of the coding structure on 

November 15, 2016, 5 months after the deadline established in the act.15

The coding structure assigns a unique 3-digit cybersecurity employment 

code to each work role outlined in the draft version of the NICE 

Cybersecurity Workforce Framework. Table 1 presents an example of the 

3-digit employment codes associated with one category—”Securely 

Provision”—and its component specialty areas and work roles.

 

14Office of Personnel Management, Memorandum for Human Resources Directors: 

Requirements of the Federal Cybersecurity Workforce Assessment Act (Washington, 

D.C.: August 1, 2016).

15Office of Personnel Management, Federal Cybersecurity Coding Structure Version 1.0

(November 15, 2016). Version 2 of the revised coding structure was issued on October 

18, 2017.

OPM Issued a 

Cybersecurity 

Position Coding 

Structure, 

Procedures, and 

Progress Report 

Later Than the 

Deadlines 

Established in the Act

OPM Developed a 3-digit 

Cybersecurity Coding 

Structure
Page 11 GAO-18-466 Cybersecurity Workforce 

Table 1: Office of Personnel Management Cybersecurity Employment Codes for “Securely Provision” Category (aligned with 

NICE Cybersecurity Workforce Framework, NIST SP 800-181)

Category Specialty Area Work Role Employment Code

Securely Provision Risk Management Authorizing Official/Designating Representative 611

Security Control Assessor 612

Software Development Software Developer 621

Secure Software Assessor 622

Systems Development Information Systems Security Developer 631

Systems Developer 632

Systems Requirements Planning Systems Requirements Planner 641

Systems Architecture Enterprise Architect 651

Security Architect 652

Technology Research and 

Development

Research & Development Specialist 661

Test and Evaluation System Testing and Evaluation Specialist 671

Source: GAO analysis of Office of Personnel Management, Federal Cybersecurity Coding Structure Version 1.0 (Washington, DC: November 15, 2016). | GAO-18-466

Although the act had called for the coding structure to be established by 

June 15, 2016, OPM officials explained that the coding structure was 

issued 5 months later than the established deadline because the structure 

was to be aligned with the NICE Cybersecurity Workforce Framework. 

However, the draft version of the NICE Framework was not issued until 

November 2, 2016.16

According to NIST officials, the issuance of the draft NICE Framework 

was delayed because some of the knowledge, skills, and abilities (KSA) 

and task statements17 that had been originally developed by the 

intelligence community were marked as sensitive. NIST delayed 

publication of the draft NICE Framework until officials in the intelligence 

community had removed any sensitivity designations on the KSAs and 

task statements. 

 

16National Institute of Standards and Technology, (Draft) NICE Cybersecurity Workforce 

Framework, Draft SP 800-181 (Gaithersburg, Md.: November 2, 2016).

17Knowledge, skills, and abilities—commonly known as KSAs—are the attributes required 

to perform work roles and are generally demonstrated through relevant experience, 

education, or training. A task is a specific define piece of work that, combined with other 

identified tasks, composes the work in a specific specialty area or work role. 
Page 12 GAO-18-466 Cybersecurity Workforce 

The act required OPM, in coordination with NIST, DHS, and ODNI to 

establish procedures to assist agencies in implementing the cybersecurity 

coding structure. OPM was to develop the procedures no later than 

September 18, 2016.

In accordance with this requirement, OPM coordinated with NIST, DHS, 

and ODNI to develop its Guidance for Assigning New Cybersecurity 

Codes to Positions with Information Technology, Cybersecurity, and 

Cyber-Related Functions.18 The guidance provides instructions on how 

agencies are to assign the 3-digit cybersecurity employment codes to 

filled and vacant positions, including required activities for identifying and 

assigning codes to cybersecurity positions. The guidance also referenced 

additional updates and guidance that were to be posted on OMB’s MAX 

website.19

OPM posted the guidance on the Chief Human Capital Officers Council 

website on January 4, 2017, 4 months after the deadline established in 

the act. OPM officials said they delayed issuance of the guidance so that 

it could be released in coordination with the cybersecurity coding 

structure, which was dependent on the release of the draft NICE 

Framework.

The act required OPM to report on the progress of agencies’ 

implementation of the act’s requirements, as well as OPM’s efforts to 

develop a coding structure and government-wide coding procedures. 

OPM was to submit the progress report to the appropriate congressional 

committees no later than June 15, 2016.20

 

18Office of Personnel Management, Memorandum for Heads of Executive Departments 

and Agencies: Guidance for Assigning New Cybersecurity Codes to Positions with 

Information Technology, Cybersecurity, and Cyber-Related Functions (Washington, D.C.: 

January 4, 2017).

19OMB uses the MAX Information System to collect, validate, analyze, model, collaborate 

with agencies on, and publish information relating to its government-wide management 

and budgeting activities. 

20The Federal Cybersecurity Workforce Assessment Act defined appropriate 

congressional committees to mean: the House committees on Armed Services, Homeland 

Security, Oversight and Government Reform, and Intelligence; and the Senate 

committees on Armed Services, Homeland Security and Governmental Affairs, 

Commerce, Science, and Transportation, and Intelligence.

OPM Developed 

Government-wide

Procedures for Assigning 

Codes to Civilian 

Cybersecurity Positions

OPM Submitted a 

Progress Report to 

Congress
Page 13 GAO-18-466 Cybersecurity Workforce 

OPM prepared and submitted its progress report to the congressional 

committees identified in the act on July 12, 2016, about 1 month after the 

act’s deadline. Among other things, the report stated the following:

• OPM was coordinating closely with NICE to revise the cybersecurity 

coding structure to align with the latest version of the NICE 

Framework, which was scheduled to be finalized in September 2016.

• OPM had begun an education campaign to inform the federal 

community of the act and its requirements and was collaborating with 

stakeholders and interagency partners on ideas for how to implement 

the requirements of the act.

An official in OPM’s Employee Services division stated that OPM was 

delayed in completing and submitting the report to congressional 

committees due to the agency’s internal review process.

Because the deadlines for agencies to implement certain provisions of the 

act are contingent on the completion of earlier activities, delays by OPM 

in issuing the revised cybersecurity coding structure and the governmentwide coding procedures have extended the due dates for agencies to 

implement other provisions of the act by about 4 months. Specifically:

• The act required agencies to establish procedures for identifying all IT 

or cybersecurity positions and for assigning the appropriate 

employment code to each position no later than 3 months after OPM 

issued the government-wide coding procedures. If OPM had issued 

the coding procedures by September 2016 as the act required, 

agencies would have been required to establish their coding 

procedures by December 2016. However, because OPM did not issue 

the government-wide procedures until January 2017, agencies did not 

have to develop their coding procedures until April 2017.

• Similarly, agencies were to assign employment codes to all of their 

cybersecurity positions no later than 1 year after establishing their 

coding procedures. Had agencies been required to establish their 

procedures by December 2016, they would have been required to 

assign the employment codes by December 2017. However, because 

they did not have to develop coding procedures until April 2017, they 

were therefore required to complete the assignment of employment 

codes by April 2018.

• Further, agencies are required to identify and report on cybersecurity 

work roles of critical need beginning 1 year after the employment 

codes are assigned. If agencies had been required to assign 

OPM’s Delays in 

Completing Required 

Activities Have Resulted in 

Later Implementation of 

Other Provisions of the Act
Page 14 GAO-18-466 Cybersecurity Workforce 

employment codes by December 2017, they would have to begin 

reporting on their critical needs by December 2018. However, 

because they did not have to complete the assignment of employment 

codes until April 2018, they are therefore required to identify and 

begin reporting on critical needs by April 2019.

Figure 4 depicts the delays in earlier activities which can result or have 

resulted in later implementation of subsequent provisions of the act.
Page 15 GAO-18-466 Cybersecurity Workforce 

Figure 4: Prior Delays Resulting in Later Implementation of the Provisions of the Federal Cybersecurity Workforce 

Assessment Act of 2015, as of March 2018

Note: NIST = National Institute of Standards and Technology; OPM = Office of Personnel 

Management; DHS = Department of Homeland Security; ODNI = Office of the Director of National 

Intelligence. 
Page 16 GAO-18-466 Cybersecurity Workforce 

Most of the 24 CFO Act agencies conducted baseline assessments 

identifying the extent to which their cybersecurity employees held 

certifications and submitted them to Congress as required by the act. 

However, 3 agencies did not complete the assessments for various 

reasons, such as a lack of resources and tools to do so. Further, of the 21 

agencies that did complete the assessments, 4 agencies did not address 

all of the reportable information, such as the extent to which personnel 

without certifications were ready to obtain them or strategies for mitigating 

any gaps. In addition, the assessments conducted by the 21 agencies did 

not contain complete, comprehensive, or consistent information on the 

certifications held by agencies’ cybersecurity employees due to limitations 

in the ability of the agencies to collect the needed information. As a result, 

the information collected and reported by most agencies about the 

certifications held by agency cybersecurity personnel may be of limited 

value for assessing the credentials and qualifications of their 

cybersecurity workforces.

The Federal Cybersecurity Workforce Assessment Act of 2015 required 

agencies to prepare baseline assessment reports identifying the extent to 

which their cybersecurity workforces held industry-recognized 

certifications as identified under NICE.21 OPM’s August 2016 

memorandum on the requirements and time frames of the act further 

stated that agencies were to report the results of the assessments to the 

appropriate congressional committees of jurisdiction by December 

2016.22

In the absence of a NICE-defined list of appropriate industry-recognized 

certifications, 21 of the 24 agencies covered by the CFO Act had 

conducted baseline assessments of the certifications held by their 

cybersecurity workforces and submitted the baseline assessment reports 

 

21Because NICE did not define a list of appropriate industry-recognized certifications, we 

evaluated only whether agencies identified personnel that held certifications.

22Office of Personnel Management, Memorandum for Human Resources Directors: 

Requirements of the Federal Cybersecurity Workforce Assessment Act (Washington, 

D.C.: August 1, 2016). 

Most CFO Act 

Agencies Submitted 

Baseline 

Assessments, but the 

Results May Not Be 

Reliable

Most CFO Agencies 

Conducted Baseline 

Assessments but Several 

Agencies Did Not Include 

All Reportable Information
Page 17 GAO-18-466 Cybersecurity Workforce 

to Congress as of March 2018.23 Table 2 shows the status of the 

agencies’ submissions of the baseline assessments as of March 2018.

Table 2: Submission Status of Reports on Cybersecurity Workforce Baseline 

Assessments by Agencies Covered by the Chief Financial Officers Act, as of 

March 2018

Agency Submitted report to Congress

Department of Agriculture 

Department of Commerce 

Department of Defense 

Department of Education 

Department of Energy 

Department of Health and Human Services 

Department of Homeland Security 

Department of Housing and Urban Development 

Department of the Interior 

Department of Justice 

Department of Labor 

Department of State 

Department of Transportation 

Department of the Treasury 

Department of Veterans Affairs 

Environmental Protection Agency 

General Services Administration 

National Aeronautics and Space Administration 

National Science Foundation 

Nuclear Regulatory Commission 

 

23The act required the baseline assessment to be submitted to the appropriate 

congressional committees of jurisdiction. Eight committees were identified as appropriate 

congressional committees, but the appropriate committees “of jurisdiction” were not 

specified. Fourteen agencies submitted the baseline assessment to the eight committees 

we previously mentioned. Two agencies submitted the assessment to their congressional 

committees of jurisdiction, but not to all of the committees listed in the act. Of the 21 

assessments that were submitted to Congress, 6 were submitted by December 2016, 7 

were submitted in January 2017, and 8 were submitted by January 2018.
Page 18 GAO-18-466 Cybersecurity Workforce 

Agency Submitted report to Congress

Office of Personnel Management 

Small Business Administration

Social Security Administration 

U.S. Agency for International Development 

Total 21

Legend:  = agency submitted assessment report to Congress 

Source: GAO analysis of the 24 Chief Financial Officers Act agencies’ reports. | GAO-18-466

Three agencies did not conduct baseline assessments:

• Instead of conducting a baseline assessment as called for by the act, 

DHS submitted its 2016 Comprehensive Cybersecurity Workforce 

Update24 to Congress in March 2017. However, this report did not 

include a baseline assessment of the department’s workforce as 

called for by the act. The report noted that DHS’s Office of the Chief 

Human Capital Officer lacked the ability to view or easily produce 

consolidated reports on employee certifications from all DHS 

components, and lacked consistent and detailed information about the 

readiness of additional employees to complete certification exams and 

specific certifications identified by components as being required for 

success in their positions. The report further noted that the 

department was working with cybersecurity subject matter experts 

from each component to revalidate the certifications most important to 

the work of their organizations and to organize the information 

according to the NICE Framework. 

• The Department of Housing and Urban Development (HUD) prepared 

an assessment of IT specialist skills, but did not conduct a baseline 

assessment that identified the extent to which its cybersecurity 

workforce held industry-recognized certifications. Officials in HUD’s 

Office of the Chief Information Officer (CIO) and Office of the Chief 

Human Capital Officer stated that the department intends to conduct a 

 

24DHS compiled this report in response to the Homeland Security Cybersecurity 

Workforce Assessment Act of 2014 (Pub. L. No. 113-277, sec. 4, Dec. 18, 2014); the 

Cybersecurity Workforce Assessment Act (Pub. L. No. 113-246, Dec. 18, 2014); and the 

Federal Cybersecurity Workforce Assessment Act of 2015. The report provided 

information on the Department’s cybersecurity workforce planning program to date, the 

Department’s efforts to code cybersecurity positions, an overview of the current 

cybersecurity workforce, and the readiness the cybersecurity workforce to meet mission 

requirements.
Page 19 GAO-18-466 Cybersecurity Workforce 

workforce assessment of its cybersecurity employees. The officials 

did not provide a time frame for when the assessment would be 

conducted.

• The CIO and Chief Human Capital Officer of the Small Business 

Administration (SBA) stated that the agency has been unable to 

complete a baseline assessment due to resource constraints. The 

officials added that the agency intends to conduct workforce planning 

efforts in the future. However, they did not provide a time frame for 

when the assessment would be conducted.

By not conducting baseline assessments, DHS, HUD, and SBA lack 

valuable information about the knowledge and skills of their cybersecurity 

employees. This lack of information limits the agencies’ ability to 

effectively gauge the competency of individuals who are charged with 

ensuring the confidentiality, integrity, and availability of federal information 

and information systems. Additionally, by not conducting or reporting on 

the assessment, the agencies have not provided Congress the 

information it required in the act regarding existing credentials and 

certifications of personnel with information technology, cybersecurity, or 

other cyber-related job functions.

The act required agencies’ baseline assessment reports to identify the 

following:

• the percentage of personnel with cybersecurity job functions who held 

the appropriate industry-recognized certifications as identified under 

NICE;25

• the level of preparedness of cybersecurity personnel without existing 

credentials to take certification exams; and

• a strategy for mitigating any gaps in (1) personnel holding industryrecognized certifications and (2) the preparedness of personnel 

without existing credentials to take certification exams.

In September 2016, OPM provided a template that agencies could use in 

reporting on their baseline assessments. Using the template, agencies 

could report on the number and percentage of surveyed staff with current 

 

25Certification is a voluntary process by which individuals are assessed (usually by 

application or exam) against pre-determined standards for knowledge, skills, and 

competency required to perform in a profession, occupation, or role, and granted a timelimited credential. It is typically awarded by a third-party, standard-setting organization.

Not All Agencies That 

Prepared Baseline 

Assessment Reports 

Addressed Reportable

Information
Page 20 GAO-18-466 Cybersecurity Workforce 

certifications and the number and percentage of staff without such 

certifications that were planning to obtain them within the next year. 

Human resource strategists and program management officials in OPM’s 

Employee Services division stated that the template was a guide to help 

agencies with the reporting process; however, agencies were not required 

to use the template or report their results in the format described in the 

template.

The 21 CFO agencies that prepared baseline assessment reports did not 

always address the reportable information in their baseline assessments. 

Specifically, of the 21 assessments that the CFO agencies had prepared, 

all of the assessments included information on the percentage of 

cybersecurity personnel holding certifications; 17 assessments discussed 

the level of preparedness for personnel without certifications to take 

certification exams; and 20 included strategies for mitigating certification 

gaps. Table 3 shows the extent to which the 21 agencies’ assessments 

reported this information.

Table 3: Information Reported by 21 Chief Financial Officers (CFO) Act Agencies in Their Cybersecurity Workforce Baseline 

Assessments 

Agency

Percentage of cybersecurity 

personnel holding 

certificationsa 

Level of preparedness of 

personnel without existing 

credentials to take 

certification exams

Strategies for 

mitigating any 

gaps identified 

Department of Agriculture   

Department of Commerce 

Department of Defense   

Department of Education   

Department of Energy  

Department of Health and Human 

Services 

  

Department of the Interior  

Department of Justice   

Department of Labor   

Department of State   

Department of Transportation   

Department of the Treasury   

Department of Veterans Affairs   

Environmental Protection Agency   
Page 21 GAO-18-466 Cybersecurity Workforce 

Agency

Percentage of cybersecurity 

personnel holding 

certificationsa 

Level of preparedness of 

personnel without existing 

credentials to take 

certification exams

Strategies for 

mitigating any 

gaps identified 

General Services Administration   

National Aeronautics and Space 

Administration

 

National Science Foundation   

Nuclear Regulatory Commission   

Office of Personnel Management   

Social Security Administration   

U.S. Agency for International 

Development

  

Total addressed 21 17 20

Total not addressed 0 4 1

Legend:  = reportable information addressed in assessment report 

Source: GAO analysis of the baseline assessment reports prepared by 21 Chief Financial Officers Act agencies. | GAO-18-466

a

Because NICE did not define a list of appropriate industry-recognized certifications, we evaluated 

only whether agencies identified personnel that held certifications. 

Note: This table does not include three CFO Act agencies—the Departments of Homeland Security 

and Housing and Urban Development and the Small Business Administration—because they had not 

conducted baseline assessments as of March 2018. 

Moreover, 4 of the 21 agencies did not address all reportable information

in their baseline assessments. Specifically:

• The Department of Commerce did not assess and did not report 

information on (1) the level of preparedness for personnel who did not 

hold certifications to take certification exams or (2) strategies for 

mitigating gaps. Officials in Commerce’s Office of Human Resources 

Management and Office of the CIO stated that information on the level 

of preparedness and gaps was not readily available because they 

have not fully identified and coded the department’s cybersecurity 

workforce, and there is no federal requirement for cybersecurity 

personnel to hold certifications. The officials stated that they did not 

have the time or resources to assess these reporting requirements.

• Officials in the Department of Energy’s Office of the Chief Human 

Capital Officer stated that they did not assess the level of 

preparedness for personnel without certifications to take certification 

exams because the department does not require its cybersecurity 

personnel to hold certifications. As a result, they did not have criteria 

for identifying personnel who are prepared to take certification exams.
Page 22 GAO-18-466 Cybersecurity Workforce 

• According to the Department of the Interior’s Principal Deputy 

Assistant Secretary for Policy, Management, and Budget, the 

department did not assess the level of preparedness for personnel 

without certifications to take certification exams because neither OPM

nor the department currently requires certifications for these 

cybersecurity positions. However, the department's Office of Human 

Resources and Office of the Chief Information Officer are exploring 

options to determine the level of preparedness across its IT 

workforce. 

• According to the National Aeronautics and Space Administration’s 

(NASA) baseline assessment report, the agency did not assess the 

level of preparedness for personnel without certifications to take 

certification exams because the agency does not require its 

cybersecurity personnel to maintain certifications. The agency did not 

know how many of its personnel were planning to seek certifications 

on their own.

Data regarding the number of cybersecurity employees that hold 

certifications and the level of preparedness of personnel without 

certifications can be a useful indicator of the skills and knowledge of an 

agency’s cybersecurity workforce. In addition, strategies for addressing 

gaps can help an agency increase the skills and knowledge of its 

cybersecurity workforce. By not including all reportable information in the 

assessments, these four agencies may lack valuable information that 

could help them identify and meet the certification and training needs of 

their cybersecurity employees who are charged with protecting federal 

information and information systems from cyberattacks. However, as 

discussed later in this report, the absence of NICE identified appropriate 

industry-recognized certifications may have also contributed to 

uncertainty for agencies in their efforts to comply with the requirements of 

the act.
Page 23 GAO-18-466 Cybersecurity Workforce 

Limitations in the 21 agencies’ baseline assessments raise concerns 

about the reliability of the assessments, thus constraining the conclusions 

that can be drawn from their results about the federal cybersecurity 

workforce’s certifications. The 21 agencies in our review that conducted 

assessments were not able to collect complete, comprehensive, or 

consistent information about the certifications held by their cybersecurity 

workforces for various reasons. As a result, these agencies had limited 

assurance that the certification information contained in their baseline 

assessment reports was reliable, thereby diminishing the usefulness of 

the assessments in determining the certification and training needs of 

their cybersecurity employees.

As previously noted, OPM’s August 2016 memorandum on the 

requirements of the act stated that, agencies were to report their baseline 

assessments to Congress by December 2016. However, according to 

OPM’s January 2017 coding guidance, agencies were not required to 

complete the assignment of the appropriate 3-digit employment codes to 

each position until April 2018. Consequently, agencies were required to 

submit their reports on the percentage of personnel performing 

cybersecurity functions who possessed certifications before the agencies 

had identified all members of their cybersecurity workforce and assigned 

the 3-digit cybersecurity employment codes to each position.

Because the agencies had not yet fully defined their cybersecurity 

workforces using the NICE Framework and the 3-digit coding structure, 

the 21 agencies in our review that prepared assessments did not use 

consistent criteria to define the population of personnel with cybersecurity 

job functions that were included in their baseline assessments. Examples 

of the criteria that these agencies used to define the target populations for 

their assessments included:

• cybersecurity employees who had been coded with the 2-digit 

cybersecurity employment codes during the 2013 Special 

Cybersecurity Workforce Project;

• employees within certain occupational series, such as the 2210 

Information Technology Management series;26

 

26An occupational series is used to identify a specific occupation and generally includes all 

jobs in that particular kind of work at all grade levels. Many agencies use the occupational 

series developed by the Office of Personnel Management.

Limitations in Agency 

Baseline Assessments 

Raise Concerns About the 

Reliability of Information 

about Certifications Held 

by Agencies’ 

Cybersecurity Employees

Agencies Were Required to 

Assess Cyber Employees’ 

Certifications before They Had 

Fully Defined Their 

Cybersecurity Workforces
Page 24 GAO-18-466 Cybersecurity Workforce 

• personnel within certain roles or organizations, such as the Office of 

Information Security or the Office of the CIO; or

• personnel who performed cybersecurity duties for a defined 

percentage of the time.27

As a result of not having fully defined their cybersecurity workforces prior 

to conducting their baseline assessments, the agencies have limited 

assurance that their baseline assessments reflected all relevant agency 

positions or personnel performing cybersecurity functions as defined by 

the NICE Framework.

Several agencies reported that they were not able to obtain information 

on certifications from all of the employees they surveyed when conducting 

their baseline assessments. Specifically, 6 of the 21 agencies that 

prepared assessments reported response rates of between 15 and 42 

percent to their surveys or data calls to employees for such information.28

Also, officials from two agencies told us that employees’ responses to 

their information requests were voluntary due to union and legal 

concerns. As a result, these agencies have limited assurance that their 

baseline assessment reports conveyed comprehensive information about 

all agency cybersecurity personnel and the certifications that they held 

because of the limited response from employees.

Although the act required agencies to report on the percentage of 

personnel who held appropriate industry-recognized certifications as 

identified under NICE, NICE had not defined such a list of certifications as 

of the agencies’ reporting deadline of December 2016. In August 2017, a 

NICE official told us that the organization did not believe it was 

appropriate for NICE, which is led by NIST, to identify industry 

appropriate certifications because doing so may be perceived as 

endorsing certain private certifications over other certifications. Currently, 

the NICE website describes an effort under a NICE working group—which 

includes representatives from government, academia, and the private 

sector—to map industry-recognized certifications to work roles based on 

the updated NICE Framework. However, this effort has not yet been 

 

27The percentage of time required for an individual to be counted as a cybersecurity 

employee varied among agencies and was typically between 20 percent and 30 percent.

28The response rate was not required to be included in the assessment report, but these 

six agencies chose to include this information. The other 15 agencies in our review that 

prepared baseline assessments did not report response rates.

Agencies Were Not Always 

Able to Obtain Certification 

Information from All Relevant 

Employees

NICE Had Not Defined 

Appropriate IndustryRecognized Certifications
Page 25 GAO-18-466 Cybersecurity Workforce 

completed. According to NICE officials, the mapping of certifications to 

the NICE Framework is expected to be completed by November 2018.

In the absence of a defined list of industry-recognized certifications, the 

agencies in our review developed their own approaches for determining 

the certifications on which they based their assessments. Examples of 

agencies’ approaches included:

• asking that cybersecurity staff provide input on any or all certifications 

that they held;

• using a list of certifications developed by the DHS National Initiative 

for Cybersecurity Careers and Studies, which was referenced in 

OPM’s reporting template;29

• using certifications identified in the Department of Defense’s (DOD) 

Information Assurance Workforce Improvement Program;30 or

• having the agency Office of the CIO or cybersecurity workforceplanning workgroup identify certifications to include in the 

assessment.

Because the baseline assessments were not based on a defined list of 

certifications, there is limited assurance that the assessments consistently 

or accurately conveyed the extent to which federal cybersecurity 

professionals held industry-recognized certifications that are appropriate 

for their job functions.

 

29DHS, in partnership with several other agencies, launched the National Initiative for 

Cybersecurity Careers and Studies (NICCS) in February 2013 as an online resource to 

connect government employees, students, educators, and industry with cybersecurity 

training providers across the nation. NICCS provides a catalog of cybersecurity-focused 

training courses that are delivered by accredited colleges and universities, National 

Security Agency/DHS National Centers of Academic Excellence, federal agencies, and 

other training providers. NICCS compiled a list of well-known industry cybersecurity 

certifications online at https://niccs.us-cert.gov/featured-stories/cybersecurity-certifications. 

30DOD Assistant Secretary of Defense for Networks and Information 

Integration/Department of Defense Chief Information Officer, DOD 8570.01-M Information 

Assurance Workforce Improvement Program Incorporating Change 4 11/10/2015. The 

Information Assurance Workforce Improvement Program requires individuals that are part 

of the DOD cybersecurity workforce to obtain the appropriate baseline certification within 

six months of entry on duty into certain designated cybersecurity positions. The list of 

approved industry-recognized certifications is maintained online at 

http://iase.disa.mil/iawip/Pages/iabaseline.aspx. 
Page 26 GAO-18-466 Cybersecurity Workforce 

In addition, no government-wide requirement exists for cybersecurity 

personnel to hold certifications, and most of the agencies in our review 

did not require certifications. Specifically:

• Although OPM guidance states that agencies may use certifications 

as a selective factor for some positions where specific qualifications 

are required, no government-wide requirement exists for positions 

performing cybersecurity related functions to hold certifications.

• Most agencies did not require IT or cybersecurity personnel to hold 

certifications. Only 6 of the 24 agencies31 reported that they had 

requirements for personnel to hold an industry-recognized 

certification, while only one agency—DOD—required certifications for 

all cybersecurity positions.

As a result, the information collected by most agencies about the 

certifications held by agency cybersecurity personnel may be of limited 

value for assessing the qualifications and skills of their cybersecurity 

workforces.

Almost all of the CFO Act agencies established procedures to identify all 

of their civilian positions and assign the appropriate cybersecurity 

employment codes to the positions as called for by the act. However, 6 

agencies’ procedures did not fully address 1 or more of 7 activities 

required by OPM, such as the activities to review all encumbered and 

vacant positions and annotate reviewed position descriptions with the 

appropriate employment code. Additionally, DOD did not establish 

procedures for coding noncivilian cybersecurity positions. By not 

developing coding procedures that address all of the required activities in 

their procedures, these agencies may not have reasonable assurance 

that they will fully realize the benefits of (1) comprehensively identifying 

the cybersecurity workforce, and (2) applying the employment codes to 

meet the intended goal of defining the workforce and helping to address 

critical mission needs.

 

31The Departments of Commerce, Defense, Energy, and the Interior; the General 

Services Administration; and the Small Business Administration.

Most Agencies Did Not 

Require Cybersecurity 

Personnel to Hold 

Certifications

Most CFO Act 

Agencies Established 

Coding Procedures, 

but Six Agencies’ 

Procedures Only 

Partially Addressed 

Activities Required by 

OPM
Page 27 GAO-18-466 Cybersecurity Workforce 

The act required agencies to establish procedures for identifying 

cybersecurity positions and assigning employment codes to each 

position. In January 2017, OPM issued a memorandum32 that required 

agencies to establish their coding procedures by April 2017. The 

memorandum also required agencies to perform a number of activities to 

identify and assign codes to cybersecurity positions.33 Among others, the 

memorandum stated that agencies were to:

• use the updated cybersecurity coding structure to find the appropriate 

cybersecurity employment code(s);

• identify encumbered and vacant positions with cybersecurity 

functions;

• have their CIO staff, managers, and human resources (HR) and 

classification staff work together to identify cybersecurity positions;

• annotate reviewed position descriptions with the appropriate 

employment code(s);

• account for the fact that cybersecurity positions will extend beyond the 

Information Technology Management 2210 (GS-2210) occupational 

series;

• assign code “000” to positions that do not perform cybersecurity 

functions; and

• assign up to three employment codes to each position, in the order of 

the level of criticality.

Most of the agencies in our review had established coding procedures. 

Specifically, of the 24 CFO Act agencies, 23 had established procedures. 

Fourteen of these 23 agencies established their procedures by April 2017

 

32Office of Personnel Management, Memorandum for Heads of Executive Departments 

and Agencies: Guidance for Assigning New Cybersecurity Codes to Positions with 

Information Technology, Cybersecurity, and Cyber-Related Functions (Washington, D.C.: 

January 4, 2017).

33While OPM’s coding guidance required agencies to implement the activities, agencies 

were not required to address each activity in their coding procedures. Nevertheless, the 

guidance stated that agencies should use the coding guidance as a resource in 

establishing agency coding procedures, and officials in OPM’s Employee Services division 

stated that including instructions for carrying out each of the required activities in agency 

coding procedures is a good practice.

Most Agencies 

Established Coding 

Procedures as Required 

by the Act
Page 28 GAO-18-466 Cybersecurity Workforce 

as OPM required, while the remaining 9 agencies34 established their 

procedures by March 2018.

Officials from the 9 agencies that did not complete their procedures by 

April 2017 gave several reasons for their late development or completion 

of the procedures. For example:

• General Services Administration officials said that the procedures 

were delayed due to their internal review processes.

• DOD officials said that the procedures were delayed because of the 

size and complexity of the processes required to identify and code the 

large number of civilian cybersecurity positions across the 

department, and because of the length and complexity of the 

department’s policy review processes.

• In October 2017, an official in DHS’s Office of the Chief Human 

Capital Officer stated that the department did not plan to develop 

procedures until the National Finance Center (NFC)35 payroll systems 

were updated to accept the 3-digit cybersecurity codes. The NFC 

systems were updated to accept the new codes in December 2017, 

and DHS issued its procedures in March 2018.

One agency—the Department of Energy—had not established coding 

procedures:

• An official in the Department of Energy’s Office of the Chief Human 

Capital Officer stated that, because responsibility for IT is not 

centralized under the department-level CIO organization (but rather, is 

distributed throughout the component agencies), the official had not 

determined who had the authority to issue coding procedures for the

entire department. By not establishing coding procedures, the 

Department of Energy faces increased risk that it will not fully identify 

its cybersecurity workforce or assign the appropriate employment 

codes to each position, limiting its ability to identify cybersecurity skills 

gaps or work roles of critical need.

 

34The Departments of Defense, Education, Homeland Security, Justice, and 

Transportation; the General Services Administration; the National Science Foundation; the 

Nuclear Regulatory Commission; and the U.S. Agency for International Development.

35The National Finance Center is one of the primary payroll service centers used by 

federal agencies to process employee pay. 
Page 29 GAO-18-466 Cybersecurity Workforce 

The agencies that developed coding procedures generally, but did not 

always, address the seven required activities that we reviewed in their 

procedures. Specifically, 17 of the 23 agencies that developed 

procedures addressed all 7 activities in their procedures, while the 

remaining 6 agencies partially addressed or did not address 1 or more of 

the 7 activities. Table 4 describes the extent to which agency procedures 

addressed the activities required by OPM.

Table 4: Extent That Chief Financial Officers Act Agencies with Procedures Have Addressed Activities Required by OPM in 

Their Procedures (Civilian Positions),a as of March 2018

Agency

Use the 

updated 

cybersecurity 

coding 

structure to 

find the 

appropriate 

code(s)

CIO staff, 

managers, 

and HR and 

classification 

staff work 

together to 

identify 

cyber 

positions

Review all 

encumbered 

and vacant 

positions 

with 

cybersecurity 

functions

Annotate 

reviewed 

position 

descriptions 

with the 

appropriate 

employment 

code(s)

Cybersecurity 

positions will 

extend 

beyond the 

GS-2210 IT 

occupational 

series

Assign code 

“000” to noncybersecurity 

positions

Assign up 

to three

employment 

codes to 

each 

position, in 

order of the 

level of 

criticality

Department of 

Agriculture ● ● ● ● ● ● ●

Department of 

Commerce ● ● ● ● ● ● ●

Department of Defense ● ● ● ● ● ● ●

Department of 

Education ● ● ● ● ● ○ ●

Department of Health 

and Human Services ● ● ● ● ● ● ●

Department of 

Homeland Security ● ● ● ● ● ● ●

Department of Housing 

and Urban 

Development 

● ● ● ● ● ● ●

Department of the 

Interior ● ● ● ● ● ● ●

Department of Justice ● ● ● ● ● ● ●

Department of Labor ● ● ● ○ ◐ ◐ ○

Department of State ● ● ● ● ● ● ●

Department of 

Transportation ● ● ● ● ● ● ●

Department of the 

Treasury ● ● ● ● ● ● ●

Agency Procedures Did 

Not Always Address 

Required Coding Activities
Page 30 GAO-18-466 Cybersecurity Workforce 

Agency

Use the 

updated 

cybersecurity 

coding 

structure to 

find the 

appropriate 

code(s)

CIO staff, 

managers, 

and HR and 

classification 

staff work 

together to 

identify 

cyber 

positions

Review all 

encumbered 

and vacant 

positions 

with 

cybersecurity 

functions

Annotate 

reviewed 

position 

descriptions 

with the 

appropriate 

employment 

code(s)

Cybersecurity 

positions will 

extend 

beyond the 

GS-2210 IT 

occupational 

series

Assign code 

“000” to noncybersecurity 

positions

Assign up 

to three

employment 

codes to 

each 

position, in 

order of the 

level of 

criticality

Department of 

Veterans Affairs ● ● ● ● ● ● ●

Environmental 

Protection Agency ● ● ● ● ● ● ●

General Services 

Administration ● ● ● ● ● ● ●

National Aeronautics 

and Space 

Administration 

● ● ● ● ● ○ ●

National Science 

Foundation ● ● ◐ ○ ○ ○ ○

Nuclear Regulatory 

Commissionb ● ● ● ● ○ ● ◐

Office of Personnel 

Management ● ● ● ● ● ● ●

Small Business 

Administration ● ● ● ● ● ● ●

Social Security 

Administration ● ● ● ● ● ● ●

U.S. Agency for 

International 

Development 

● ● ◐ ◐ ● ○ ○

Total addressed 23 23 21 20 20 18 19

Total partially 

addressed

0 0 2 1 1 1 1

Total not addressed 0 0 0 2 2 4 3

● = Fully addressed ◐ = Partially addressed ○ = Not addressed 

Source: GAO analysis of the 24 Chief Financial Officers Act agencies’ cybersecurity employment coding procedures. | GAO-18-466

a

The Department of Energy is not included in this table because it had not developed procedures as 

of March 2018. 

b

In its comments responding to a draft of this report, the Nuclear Regulatory Commission stated that it 

had updated its cybersecurity coding procedures to include language explaining that cybersecurity 

positions will extend beyond the GS-2210 occupational series, and that each position can be 

assigned up to three employment codes in order of criticality. The agency provided us a copy of the 

updated procedures along with its comments on May 10, 2018. Due to the date that we received the 

procedures, we did not include an assessment of the procedures in this report. 
Page 31 GAO-18-466 Cybersecurity Workforce 

The six agencies that did not address all activities required by OPM cited 

a variety of reasons for not including them in their coding procedures. For 

example:

• An official in the Department of Education’s Office of Human 

Resources explained that it was not necessary for the coding 

procedures that were provided to each component to address 

assigning code “000” to noncybersecurity positions because the Office 

of Human Resources would assign the “000” code to any position that 

did not have an assigned code.

• An official from the National Science Foundation’s Division of Human 

Resources Management stated that not addressing all activities may 

have been an oversight by the agency.

• Officials in NASA’s Office of Human Capital Management and its 

Office of the CIO said they felt that it was unnecessary to address 

assigning code “000” to noncybersecurity positions in the agency’s 

coding procedures because the agencies’ existing guidance for 

assigning the old 2-digit codes specified that such positions should be 

coded with “00.” 

By not addressing all of the activities required by OPM in their 

procedures, these 6 agencies lack assurance that the activities will be 

performed or performed consistently throughout their organizations.

In addition to developing procedures for civilian positions, the act required 

DOD to establish government-wide procedures for identifying and 

assigning employment codes to noncivilian (i.e., military) positions with 

cybersecurity job functions by June 2017. The act also required DOD to 

establish its internal departmental procedures for military positions by 

September 30, 2017.

According to officials in the department’s Office of the CIO and Office of 

the Chief Human Capital Officer, the only military personnel not currently 

within DOD are in the Coast Guard (which resides within DHS). 

Therefore, the department planned to fulfill its requirements to establish 

government-wide procedures and internal departmental procedures for 

identifying and coding military positions by establishing a single 

consolidated procedure. The officials added that the consolidated 

procedure is to include procedures for DHS to implement the coding 

structure for uniformed Coast Guard personnel along with the internal 

DOD procedures.

DOD Did Not Establish 

Coding Procedures for 

Noncivilian Cybersecurity 

Positions
Page 32 GAO-18-466 Cybersecurity Workforce 

However, as of February 2018, DOD had not finalized its consolidated 

coding procedures. An official in the department’s Office of the CIO in 

February 2018 stated that, because the military services use multiple 

Human Resources systems that all have to be updated to accommodate 

the cybersecurity employment codes, the office was working with each of 

the military services on guidance to meet the act’s deadlines while the 

services develop implementation plans for updating their human 

resources systems. Until DOD establishes both government-wide and 

DOD-specific procedures for identifying and coding noncivilian 

cybersecurity positions, increased risk exists that DOD and DHS will not 

be able to identify and code all positions in their noncivilian cybersecurity 

workforce, limiting the departments’ ability to identify cybersecurity skills 

gaps or work roles of critical need in their noncivilian cybersecurity 

workforce.

To implement the objectives of the Federal Cybersecurity Workforce 

Assessment Act of 2015, OPM and NIST, although delayed, have revised 

the coding structure and cybersecurity workforce framework, and 

developed coding procedures to support the identification and assignment 

of codes to federal cybersecurity positions. In addition, most CFO Act 

agencies have developed baseline assessments to identify cybersecurity 

personnel within their agencies that held certifications. Having information 

on the certifications held by cybersecurity employees can be a useful 

indicator of the skills and knowledge of an agency’s cybersecurity 

workforce. However, because agencies have not consistently defined the 

workforce and NICE had not developed a list of appropriate certifications, 

efforts such as conducting the baseline assessment to determine the 

percentage of cybersecurity personnel that hold appropriate certifications 

have yielded inconsistent and potentially unreliable results. By not 

conducting assessments or including all required information in the 

assessments, some of these agencies may lack valuable information that 

could help them identify the certification and training needs of their 

cybersecurity employees that are charged with protecting federal 

information and information systems from cyberattacks.

Lastly, while most CFO agencies have developed procedures for 

assigning cybersecurity codes to positions, several agencies did not 

address activities required by OPM. Unless those agencies address all of 

the activities, they may not have reasonable assurance that they are 

comprehensively identifying the cybersecurity workforce and applying the 

correct employment codes. As such, increased risk exists that the federal 

government will not meet its intended goal to define the cybersecurity 

Conclusions
Page 33 GAO-18-466 Cybersecurity Workforce 

workforce and address the critical mission needs for a qualified 

cybersecurity workforce.

We are making a total of 30 recommendations to 13 agencies in our 

review to develop and submit their baseline assessments and to fully 

address the required activities in OPM’s guidance in their procedures for 

assigning employment codes to cybersecurity positions. Specifically:

The Secretary of Commerce should evaluate the level of preparedness 

for cybersecurity personnel not currently holding certifications to take 

certification exams, identify strategies for mitigating any gaps identified, 

and report this information to Congress. (Recommendation 1)

The Secretary of Defense should develop, document, and implement 

government-wide procedures for identifying IT, cybersecurity, and cyberrelated noncivilian positions and assigning employment codes to those 

positions. (Recommendation 2)

The Secretary of Defense should develop, document, and implement 

internal departmental procedures for identifying IT, cybersecurity, and 

cyber-related noncivilian positions and assigning employment codes to 

those positions. (Recommendation 3)

The Secretary of Education should include requirements to assign code 

“000” to positions that do not perform IT, cybersecurity, and cyber-related 

functions in departmental procedures. (Recommendation 4)

The Secretary of Energy should evaluate the level of preparedness for 

cybersecurity personnel not currently holding certifications to take 

certification exams and report this information to Congress. 

(Recommendation 5)

The Secretary of Energy should develop, document, and implement 

departmental procedures for identifying IT, cybersecurity, and cyberrelated positions and assigning employment codes to those positions, 

taking into account the key elements described in OPM’s instructions for 

agencies’ procedures. (Recommendation 6)

The Secretary of Homeland Security should conduct a baseline 

assessment of the department’s cybersecurity workforce that includes (1) 

the percentage of personnel with IT, cybersecurity, or other cyber-related 

job functions who hold certifications; (2) the level of preparedness of other 

Recommendations for 

Executive Action
Page 34 GAO-18-466 Cybersecurity Workforce 

cyber personnel without existing credentials to take certification exams; 

and (3) a strategy for mitigating any gaps identified with appropriate 

training and certification for existing personnel. (Recommendation 7)

The Secretary of Homeland Security should submit a report of the 

department’s baseline assessment of its existing cybersecurity workforce 

to the appropriate congressional committees of jurisdiction. 

(Recommendation 8)

The Secretary of Housing and Urban Development should conduct a 

baseline assessment of the department’s cybersecurity workforce that 

includes (1) the percentage of personnel with IT, cybersecurity, or other 

cyber-related job functions who hold certifications; (2) the level of 

preparedness of other cyber personnel without existing credentials to take 

certification exams; and (3) a strategy for mitigating any gaps identified 

with appropriate training and certification for existing personnel. 

(Recommendation 9)

The Secretary of Housing and Urban Development should submit a report 

of the department’s baseline assessment of its existing cybersecurity 

workforce to the appropriate congressional committees of jurisdiction. 

(Recommendation 10)

The Secretary of the Interior should evaluate the level of preparedness for 

cybersecurity personnel not currently holding certifications to take 

certification exams and report this information to Congress. 

(Recommendation 11)

The Secretary of Labor should include requirements to annotate reviewed 

position descriptions with the appropriate cybersecurity data standard 

code(s) in departmental procedures. (Recommendation 12)

The Secretary of Labor should ensure that departmental procedures fully 

account for the fact that IT, cybersecurity, and cyber-related positions will 

extend beyond the Information Technology Management 2210 

occupational series. (Recommendation 13)

The Secretary of Labor should fully clarify requirements to assign code 

“000” to positions that do not perform IT, cybersecurity, and cyber-related 

functions in departmental procedures. (Recommendation 14)
Page 35 GAO-18-466 Cybersecurity Workforce 

The Secretary of Labor should include requirements to assign up to three 

employment codes per position in order of their criticality in departmental 

procedures. (Recommendation 15)

The Administrator of the National Aeronautics and Space Administration 

should evaluate the level of preparedness for cybersecurity personnel not 

currently holding certifications to take certification exams and report this 

information to Congress. (Recommendation 16)

The Administrator of the National Aeronautics and Space Administration 

should include requirements to assign code “000” to positions that do not 

perform IT, cybersecurity, and cyber-related functions in agency 

procedures. (Recommendation 17)

The Director of the National Science Foundation should fully clarify 

requirements to review all encumbered and vacant positions performing 

IT, cybersecurity, and cyber-related functions in agency procedures. 

(Recommendation 18)

The Director of the National Science Foundation should include 

requirements to annotate reviewed position descriptions with the 

appropriate cybersecurity data standard code(s) in agency procedures. 

(Recommendation 19)

The Director of the National Science Foundation should ensure that 

agency procedures account for the fact that IT, cybersecurity, and cyberrelated positions will extend beyond the Information Technology 

Management 2210 occupational series. (Recommendation 20)

The Director of the National Science Foundation should include 

requirements to assign code “000” to positions that do not perform IT, 

cybersecurity, and cyber-related functions in agency procedures. 

(Recommendation 21)

The Director of the National Science Foundation should include 

requirements to assign up to three employment codes per position in 

order of their criticality in agency procedures. (Recommendation 22)

The Chairman of the Nuclear Regulatory Commission should ensure that 

agency procedures account for the fact that IT, cybersecurity, and cyberrelated positions will extend beyond the Information Technology 

Management 2210 occupational series. (Recommendation 23)
Page 36 GAO-18-466 Cybersecurity Workforce 

The Chairman of the Nuclear Regulatory Commission should fully clarify 

requirements to assign up to three employment codes per position in 

order of their criticality in agency procedures. (Recommendation 24)

The Administrator of the Small Business Administration should conduct a 

baseline assessment of the department’s cybersecurity workforce that 

includes (1) the percentage of personnel with IT, cybersecurity, or other 

cyber-related job functions who hold certifications; (2) the level of 

preparedness of other cyber personnel without existing credentials to take 

certification exams; and (3) a strategy for mitigating any gaps identified 

with appropriate training and certification for existing personnel. 

(Recommendation 25)

The Administrator of the Small Business Administration should submit a 

report of its baseline assessment of its existing cybersecurity workforce to 

the appropriate congressional committees of jurisdiction. 

(Recommendation 26)

The Administrator of the U.S. Agency for International Development 

should fully clarify requirements to review all encumbered and vacant 

positions performing IT, cybersecurity, and cyber-related functions in 

agency procedures. (Recommendation 27)

The Administrator of the U.S. Agency for International Development 

should fully clarify requirements to annotate reviewed position 

descriptions with the appropriate cybersecurity data standard code(s) in 

agency procedures. (Recommendation 28)

The Administrator of the U.S. Agency for International Development 

should include requirements to assign code “000” to positions that do not 

perform IT, cybersecurity, and cyber-related functions in agency 

procedures. (Recommendation 29)

The Administrator of the U.S. Agency for International Development 

should include requirements to assign up to three employment codes per 

position in order of their criticality in agency procedures. 

(Recommendation 30)

We provided a draft of this report to the 24 CFO Act agencies for their 

review and comment. Of the 13 agencies to which we made 

recommendations, 7 agencies stated that they agreed with all of the 

recommendations directed to them; 1 agency agreed with one and did not 

Agency Comments 

and Our Evaluation
Page 37 GAO-18-466 Cybersecurity Workforce 

agree with one recommendation; 2 agencies provided comments but did 

not state whether they agreed or disagreed with the recommendations; 2 

agencies stated that they had no comments; and 1 agency—DOD—did 

not respond to our request for comments on the report. 

In addition, of the 11 agencies to which we did not make 

recommendations, 2 provided comments on the report and 9 responded 

that they had no comments on the report. We also received technical 

comments from 2 agencies, which we have incorporated into the report 

as appropriate.

The following seven agencies agreed with our recommendations:

• In its written comments (reprinted in appendix II), the Department of 

Commerce agreed with our recommendation. The department stated 

that it will evaluate the level of preparedness for cybersecurity 

personnel who do not hold certifications to take certification exams, 

identify strategies for mitigating any gaps identified, and report this 

information to Congress.

• In its written comments (reprinted in appendix III), the Department of 

Education agreed with our recommendation. The department stated 

that it had updated its coding guidance to require that positions that 

do not perform substantial work in information technology, 

cybersecurity, or cyber-related functions be assigned a code of “000.” 

• In its written comments (reprinted in appendix IV), the Department of 

Energy agreed with our recommendations and stated that it has

planned, or taken steps to address them. Specifically, with regard to 

our recommendation concerning cybersecurity certification, the 

department stated that it plans to conduct a department-wide 

evaluation of the level of preparedness for its cybersecurity personnel 

without existing credentials to take certification exams and will report 

the information to Congress. 

In addition, the department stated that it had developed and issued 

procedures for identifying and coding IT, cybersecurity, and cyberrelated positions, as we recommended, and that it had since 

completed its coding of applicable positions across the department.

The department also provided us its updated coding procedures, 

along with its written comments. 

• In its written comments (reprinted in appendix V), the Department of

Homeland Security agreed with our recommendations. Regarding the 

recommendation to conduct a baseline assessment of its 

cybersecurity workforce, the department stated that it is taking steps 
Page 38 GAO-18-466 Cybersecurity Workforce 

to collect data about certifications relevant to DHS cybersecurity work. 

The department also stated that it plans to identify the percentage of 

its cybersecurity workforce that holds certifications, the percentage 

prepared to take a relevant certification exam, and strategies for 

mitigating any gaps. The department added that it plans to provide 

this information to Congress, as we recommended. The department 

also provided technical comments, which we have incorporated into 

this report as appropriate. 

• In its written comments (reprinted in appendix VI), the Department of

the Interior stated that it agreed with our recommendation. The 

department also indicated that it is exploring options to determine the 

extent to which its cybersecurity employees who currently do not hold 

certifications are prepared to take certification exams. 

• In its written comments (reprinted in appendix VII), the Small Business 

Administration agreed with our recommendations. The agency also 

stated that it had recently completed an assessment of its IT 

workforce and reported on existing skills gaps, and that it plans to 

execute its IT workforce plan to address the requirements of the 

Federal Cybersecurity Workforce Assessment Act of 2015.

• In comments on a draft of this report provided via email on May 15, 

2018, a Program Analyst in the National Science Foundation’s Office 

of Integrative Activities stated that the agency concurred with our 

recommendations.

One agency did not agree with one of the two recommendations directed 

to it:

• In its written comments (reprinted in appendix VIII), the National 

Aeronautics and Space Administration did not agree with our first 

recommendation and agreed with the second. Specifically:

• NASA did not concur with our recommendation to evaluate the 

level of preparedness for cybersecurity personnel not currently 

holding certifications to take certification exams and report this 

information to Congress. The agency stated that there is no 

federal or NASA requirement for employees in cybersecurity 

positions to hold and/or maintain a certification, and therefore the 

agency has no plans to assess the readiness of its cybersecurity 

personnel to take certification exams. 

Nonetheless, we continue to believe our recommendation remains 

valid because the level of preparedness of personnel without 

certifications to take certification examinations can be a useful 
Page 39 GAO-18-466 Cybersecurity Workforce 

indicator of the skills and knowledge of an agency’s cybersecurity 

workforce. In addition, this information could help the agency 

identify and meet the certification and training needs of its 

cybersecurity employees who are charged with protecting NASA’s 

information and information systems from cyberattacks. Moreover, 

the act contains provisions that demonstrate congressional 

interest in assessing agency use of professional certifications. 

• NASA concurred with our recommendation to include in the 

agency’s coding procedures, requirements to assign code “000” to 

positions that do not perform IT, cybersecurity, and cyber-related 

functions. The agency stated that it planned to update its 

procedures to include this requirement, and indicated that 

supervisors and human resource specialists had been trained to 

assign cybersecurity codes to all positions, including code “000.”

The following two agencies provided comments, but did not state whether 

they agreed or disagreed with our recommendations:

• In its written comments (reprinted in appendix IX), the Nuclear 

Regulatory Commission stated that it was in general agreement with 

the overall content of the draft report. However, the agency asked that 

we revise the final report to reflect that the Nuclear Regulatory 

Commission had updated its cybersecurity coding procedures to 

include language explaining that IT, cybersecurity, and cyber-related 

positions will extend beyond the GS-2210 occupational series, and to 

outline the requirement that positions can be assigned up to three 

different employment codes in order of criticality. The agency provided 

its updated coding procedures along with its written comments. 

• In its written comments (reprinted in appendix X), the U.S. Agency for 

International Development stated that it had completed various 

actions related to coding its cybersecurity positions which addressed 

our four recommendations. For example, among other actions, the 

agency said it had updated its plan for coding cybersecurity positions 

to include procedures for assigning codes for multiple functional 

areas, with the predominant functional area being coded first. 

In addition, two agencies to which we made recommendations---the 

Departments of Housing and Urban Development and Labor—stated via 

email that they did not have comments on the report. The agencies did 

not state whether they agreed or disagreed with our recommendations.
Page 40 GAO-18-466 Cybersecurity Workforce 

Of the agencies to which we did not make recommendations, the Social 

Security Administration also provided a letter acknowledging its review of 

the report. The agency’s letter is reprinted in appendix XI. 

The remaining nine agencies to which we did not make 

recommendations—the Departments of Agriculture, Health and Human 

Services, Justice, State, Transportation, and Treasury; the Environmental 

Protection Agency; the General Services Administration; and the Office of 

Personnel Management—stated that they did not have any comments on 

our report. 

We are sending copies of this report to interested congressional 

committees, the Director of the Office of Management and Budget, the 

secretaries and agency heads of the departments and agencies 

addressed in this report, and other interested parties. In addition, this 

report will be available at no charge on the GAO website at 

http://www.gao.gov. 

If you have any questions regarding this report, please contact me at 

(202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. Key contributors to this report are listed in appendix XII. 

Gregory C. Wilshusen 

Director, Information Security Issues 
Page 41 GAO-18-466 Cybersecurity Workforce 

List of Committees

The Honorable John McCain

Chairman

The Honorable Jack Reed

Ranking Member

Committee on Armed Services

United States Senate

The Honorable Ron Johnson

Chairman

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Richard Burr

Chairman

The Honorable Mark Warner

Vice Chairman

Select Committee on Intelligence

United States Senate

The Honorable John Thune

Chairman

The Honorable Bill Nelson

Ranking Member

Committee on Commerce, Science, and Transportation

United States Senate

The Honorable Mac Thornberry

Chairman

The Honorable Adam Smith

Ranking Member

Committee on Armed Services

House of Representatives
Page 42 GAO-18-466 Cybersecurity Workforce 

The Honorable Michael McCaul

Chairman

The Honorable Bennie Thompson

Ranking Member

Committee on Homeland Security

House of Representatives

The Honorable Trey Gowdy

Chairman

The Honorable Elijah Cummings

Ranking Member

Committee on Oversight and Government Reform

House of Representatives

The Honorable Devin Nunes

Chairman

The Honorable Adam Schiff

Ranking Member

Permanent Select Committee on Intelligence

House of Representatives
Appendix I: Objectives, Scope, and 

Methodology

Page 43 GAO-18-466 Cybersecurity Workforce 

Our objectives were to determine whether (1) OPM developed a coding 

structure and procedures for assigning codes to cybersecurity positions 

and submitted a progress report to Congress, (2) Chief Financial Officers 

(CFO) Act agencies1 submitted complete and reliable baseline 

assessment reports of their cybersecurity workforces, and (3) CFO Act 

agencies established procedures to identify and assign codes to 

cybersecurity positions.

The scope of our review included the 24 departments and agencies 

(hereafter referred to as agencies) covered by the Chief Financial Officers 

Act of 1990. It also included OPM, DOD, DHS, and NIST in their roles 

related to the development of a cybersecurity coding structure and related 

guidance. Our work focused on the agencies’ cybersecurity positions and 

on workforce planning actions that the act required the agencies to 

complete by November 2017.

To address the first objective, we obtained and compared OPM’s federal 

cybersecurity employment coding structure, issued in November 2016, to 

the work roles described in the National Initiative for Cybersecurity 

Education (NICE) Cybersecurity Workforce Framework, issued in draft 

form by NIST in November 2016.2 We also examined OPM 

memorandums to identify if and when OPM had issued procedures to 

agencies for identifying cybersecurity positions and assigning 

employment codes.3 Additionally, we reviewed any progress reports 

submitted by OPM to Congress on the implementation of the act. We 

compared the issuance date of each of these documents to the deadlines 

by which OPM was to issue them, as established in the act. Also, we 

 

1

The 24 federal agencies covered by the Chief Financial Officers Act of 1990 are the 

Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human 

Services, Homeland Security, Housing and Urban Development, the Interior, Justice, 

Labor, State, Transportation, the Treasury, and Veterans Affairs; Environmental Protection 

Agency; General Services Administration; National Aeronautics and Space Administration; 

National Science Foundation; Nuclear Regulatory Commission; Office of Personnel 

Management; Small Business Administration; Social Security Administration; and U.S. 

Agency for International Development.

2

National Institute of Standards and Technology (NIST), National Initiative for 

Cybersecurity Education (NICE) Cybersecurity Workforce Framework, Draft NIST Special 

Publication 800-181 (Gaithersburg, Md.: November 2016).

3

Office of Personnel Management, Memorandum for Heads of Executive Departments 

and Agencies: Guidance for Assigning New Cybersecurity Codes to Positions with 

Information Technology, Cybersecurity, and Cyber-Related Functions (Washington, D.C.: 

January 4, 2017).

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 44 GAO-18-466 Cybersecurity Workforce 

interviewed OPM and NIST officials about their efforts to develop these 

documents and the reasons for any delays.

To address the second objective, we obtained available baseline 

assessments from each of the 24 CFO Act agencies and evaluated them 

against the act’s requirements to include information on (1) cybersecurity 

personnel holding certifications, (2) the level of preparedness of other 

personnel to take certification exams, and (3) strategies for mitigating any 

gaps identified. We also obtained agencies’ letters transmitting their 

assessments to the relevant congressional committees and evaluated 

them against the reporting deadline established in OPM guidance. In 

addition, we analyzed other relevant agency documentation and 

interviewed cognizant agency officials about their efforts to identify the 

appropriate certifications, identify relevant personnel, and collect 

information on employee certifications. We obtained the officials’ views on 

the reasons for any delays in agencies’ submissions of the assessments 

and the reliability of assessment results.

To address the third objective, we obtained and analyzed available 

cybersecurity coding procedures established by each of the 24 CFO Act 

agencies. We reviewed the required coding activities described in OPM’s 

Guidance for Assigning New Cybersecurity Codes to Positions with 

Information Technology, Cybersecurity, and Cyber-Related Functions. 

We judgementally selected seven of the activities that we determined to 

be particularly important for effectively identifying and coding all relevant 

encumbered and vacant cybersecurity positions. We then evaluated each 

agency’s procedures against these seven required coding activities. We 

also compared the issuance date of the procedures to the deadline 

established in OPM’s coding guidance for agencies to issue the 

procedures. In addition, we interviewed agency officials about their efforts 

to complete the procedures by the required deadline and the reasons for 

any delays.

Further, the Federal Cybersecurity Workforce Assessment Act of 2015 

established a separate requirement and deadline for DOD to develop 

government-wide procedures for implementing the coding structure for 

federal noncivilian cyber positions. As such, we reviewed relevant 

documentation and interviewed cognizant officials from the Department of 

Defense’s Office of the Chief Information Officer and Office of the Under 

Secretary for Personnel and Readiness about their efforts to establish 

coding procedures for both civilian and noncivilian positions by the 

deadlines set forth in the act.
Appendix I: Objectives, Scope, and 

Methodology

Page 45 GAO-18-466 Cybersecurity Workforce 

We conducted this performance audit from October 2016 to June 2018 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Appendix II: Comments from the Department 

of Commerce

Page 46 GAO-18-466 Cybersecurity Workforce 

Appendix II: Comments from the Department 

of Commerce 
Appendix II: Comments from the Department 

of Commerce

Page 47 GAO-18-466 Cybersecurity Workforce 
Appendix III: Comments from the Department 

of Education

Page 48 GAO-18-466 Cybersecurity Workforce 

Appendix III: Comments from the 

Department of Education
Appendix IV: Comments from the Department of Energy

Page 49 GAO-18-466 Cybersecurity Workforce 

Appendix IV: Comments from the 

Department of Energy
Appendix IV: Comments from the Department of Energy

Page 50 GAO-18-466 Cybersecurity Workforce 
Appendix V: Comments from the Department of Homeland 

Security 

Page 51 GAO-18-466 Cybersecurity Workforce 

Appendix V: Comments from the Department 

of Homeland Security 
Appendix V: Comments from the Department of Homeland 

Security 

Page 52 GAO-18-466 Cybersecurity Workforce 
Appendix V: Comments from the Department of Homeland 

Security 

Page 53 GAO-18-466 Cybersecurity Workforce 
Appendix VI: Comments from the Department of the Interior

Page 54 GAO-18-466 Cybersecurity Workforce 

Appendix VI: Comments from the 

Department of the Interior 
Appendix VII: Comments from the Small 

Business Administration

Page 55 GAO-18-466 Cybersecurity Workforce 

Appendix VII: Comments from the Small 

Business Administration 
Appendix VIII: Comments from National 

Aeronautics and Space Administration 

Page 56 GAO-18-466 Cybersecurity Workforce 

Appendix VIII: Comments from National 

Aeronautics and Space Administration 
Appendix VIII: Comments from National 

Aeronautics and Space Administration 

Page 57 GAO-18-466 Cybersecurity Workforce 
Appendix IX: Comments from the Nuclear 

Regulatory Commission

Page 58 GAO-18-466 Cybersecurity Workforce 

Appendix IX: Comments from the Nuclear 

Regulatory Commission 
Appendix X: Comments from the United States 

Agency for International Development

Page 59 GAO-18-466 Cybersecurity Workforce 

Appendix X: Comments from the United 

States Agency for International Development
Appendix X: Comments from the United States 

Agency for International Development

Page 60 GAO-18-466 Cybersecurity Workforce 
Appendix X: Comments from the United States 

Agency for International Development

Page 61 GAO-18-466 Cybersecurity Workforce 
Appendix XI: Comments from the Social 

Security Administration

Page 62 GAO-18-466 Cybersecurity Workforce 

Appendix XI: Comments from the Social 

Security Administration
Appendix XII: GAO Contact and Staff 

Acknowledgments

Page 63 GAO-18-466 Cybersecurity Workforce 

Gregory C. Wilshusen, (202) 512-6244 or wilshuseng@gao.gov

In addition to the individual named above, Nick Marinos (director), Tammi 

Kalugdan (assistant director), William Cook (analyst in charge), Chris 

Businsky, Virginia Chanley, Wayne Emilien, Lisa Maine, David Plocher, 

Priscilla Smith, Dwayne Staten, Daniel Wexler, and Merry Woo made 

significant contributions to this report.

Appendix XII: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(101198)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at https://www.gao.gov. 

Contact: 

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.