II 

Calendar No. 204 

118TH CONGRESS 

1ST SESSION S. 885 

[Report No. 118–96] 

To establish a Civilian Cybersecurity Reserve in the Department of Homeland 

Security as a pilot project to address the cybersecurity needs of the 

United States with respect to national security, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 21, 2023 

Ms. ROSEN (for herself and Mrs. BLACKBURN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

SEPTEMBER 11, 2023 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To establish a Civilian Cybersecurity Reserve in the Department of Homeland Security as a pilot project to address 

the cybersecurity needs of the United States with respect 

to national security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 885 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Department of Home3 land Security Civilian Cybersecurity Reserve Act’’. 

4 SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 

5 PROJECT. 

6 (a) DEFINITIONS.—In this section: 

7 (1) AGENCY.—The term ‘‘Agency’’ means the 

8 Cybersecurity and Infrastructure Security Agency. 

9 (2) APPROPRIATE CONGRESSIONAL COMMIT10 TEES.—The term ‘‘appropriate congressional com11 mittees’’ means— 

12 (A) the Committee on Homeland Security 

13 and Governmental Affairs of the Senate; 

14 (B) the Committee on Appropriations of 

15 the Senate; 

16 (C) the Committee on Homeland Security 

17 of the House of Representatives; 

18 (D) the Committee on Oversight and Ac19 countability of the House of Representatives; 

20 and 

21 (E) the Committee on Appropriations of 

22 the House of Representatives. 

23 (3) COMPETITIVE SERVICE.—The term ‘‘com24 petitive service’’ has the meaning given the term in 

25 section 2102 of title 5, United States Code. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 885 RS

1 (4) DIRECTOR.—The term ‘‘Director’’ means 

2 the Director of the Agency. 

3 (5) EXCEPTED SERVICE.—The term ‘‘excepted 

4 service’’ has the meaning given the term in section 

5 2103 of title 5, United States Code. 

6 (6) SIGNIFICANT INCIDENT.—The term ‘‘sig7 nificant incident’’— 

8 (A) means an incident or a group of re9 lated incidents that results, or is likely to re10 sult, in demonstrable harm to— 

11 (i) the national security interests, for12 eign relations, or economy of the United 

13 States; or 

14 (ii) the public confidence, civil lib15 erties, or public health and safety of the 

16 people of the United States; and 

17 (B) does not include an incident or a por18 tion of a group of related incidents that occurs 

19 on— 

20 (i) a national security system, as de21 fined in section 3552 of title 44, United 

22 States Code; or 

23 (ii) an information system described 

24 in paragraph (2) or (3) of section 3553(e) 

25 of title 44, United States Code. 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 885 RS

1 (7) TEMPORARY POSITION.—The term ‘‘tem2 porary position’’ means a position in the competitive 

3 or excepted service for a period of 6 months or less. 

4 (8) UNIFORMED SERVICES.—The term ‘‘uni5 formed services’’ has the meaning given the term in 

6 section 2101 of title 5, United States Code. 

7 (b) PILOT PROJECT.— 

8 (1) IN GENERAL.—The Director may carry out 

9 a pilot project to establish a Civilian Cybersecurity 

10 Reserve at the Agency. 

11 (2) PURPOSE.—The purpose of a Civilian Cy12 bersecurity Reserve is to enable the Agency to effec13 tively respond to significant incidents. 

14 (3) ALTERNATIVE METHODS.—Consistent with 

15 section 4703 of title 5, United States Code, in car16 rying out a pilot project authorized under paragraph 

17 (1), the Director may, without further authorization 

18 from the Office of Personnel Management, provide 

19 for alternative methods of— 

20 (A) establishing qualifications require21 ments for, recruitment of, and appointment to 

22 positions; and 

23 (B) classifying positions. 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 885 RS

1 (4) APPOINTMENTS.—Under the pilot project 

2 authorized under paragraph (1), upon occurrence of 

3 a significant incident, the Director— 

4 (A) may activate members of the Civilian 

5 Cybersecurity Reserve by— 

6 (i) noncompetitively appointing mem7 bers of the Civilian Cybersecurity Reserve 

8 to temporary positions in the competitive 

9 service; or 

10 (ii) appointing members of the Civil11 ian Cybersecurity Reserve to temporary po12 sitions in the excepted service; 

13 (B) shall notify Congress whenever a mem14 ber is activated under subparagraph (A); and 

15 (C) may appoint not more than 30 mem16 bers to the Civilian Cybersecurity Reserve 

17 under subparagraph (A) at any time. 

18 (5) STATUS AS EMPLOYEES.—An individual ap19 pointed under subsection (b)(4) shall be considered 

20 a Federal civil service employee under section 2105 

21 of title 5, United States Code. 

22 (6) ADDITIONAL EMPLOYEES.—Individuals ap23 pointed under subsection (b)(4) shall be in addition 

24 to any employees of the Agency who provide cyberse25 curity services. 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 885 RS

1 (7) EMPLOYMENT PROTECTIONS.—The Sec2 retary of Labor shall prescribe such regulations as 

3 necessary to ensure the reemployment, continuation 

4 of benefits, and non-discrimination in reemployment 

5 of individuals appointed under subsection (b)(4), 

6 provided that such regulations shall include, at a 

7 minimum, those rights and obligations set forth 

8 under chapter 43 of title 38, United States Code. 

9 (8) STATUS IN RESERVE.—During the period 

10 beginning on the date on which an individual is re11 cruited by the Agency to serve in the Civilian Cyber12 security Reserve and ending on the date on which 

13 the individual is appointed under subsection (b)(4), 

14 and during any period in between any such appoint15 ments, the individual shall not be considered a Fed16 eral employee. 

17 (c) ELIGIBILITY; APPLICATION AND SELECTION.— 

18 (1) IN GENERAL.—Under the pilot project au19 thorized under subsection (b), the Director shall es20 tablish criteria for— 

21 (A) individuals to be eligible for the Civil22 ian Cybersecurity Reserve; and 

23 (B) the application and selection processes 

24 for the Civilian Cybersecurity Reserve. 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 885 RS

1 (2) REQUIREMENTS FOR INDIVIDUALS.—The 

2 criteria established under paragraph (1)(A) with re3 spect to an individual shall include— 

4 (A) previous employment— 

5 (i) by the executive branch; 

6 (ii) within the uniformed services; 

7 (iii) as a Federal contractor within 

8 the executive branch; or 

9 (iv) by a State, local, Tribal, or terri10 torial government; 

11 (B) if the individual has previously served 

12 as a member of the Civilian Cybersecurity Re13 serve of the Agency, that the previous appoint14 ment ended not less than 60 days before the in15 dividual may be appointed for a subsequent 

16 temporary position in the Civilian Cybersecurity 

17 Reserve of the Agency; and 

18 (C) cybersecurity expertise. 

19 (3) PRESCREENING.—The Agency shall— 

20 (A) conduct a prescreening of each indi21 vidual prior to appointment under subsection 

22 (b)(4) for any topic or product that would cre23 ate a conflict of interest; and 

24 (B) require each individual appointed 

25 under subsection (b)(4) to notify the Agency if 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 885 RS

1 a potential conflict of interest arises during the 

2 appointment. 

3 (4) AGREEMENT REQUIRED.—An individual 

4 may become a member of the Civilian Cybersecurity 

5 Reserve only if the individual enters into an agree6 ment with the Director to become such a member, 

7 which shall set forth the rights and obligations of 

8 the individual and the Agency. 

9 (5) EXCEPTION FOR CONTINUING MILITARY

10 SERVICE COMMITMENTS.—A member of the Selected 

11 Reserve under section 10143 of title 10, United 

12 States Code, may not be a member of the Civilian 

13 Cybersecurity Reserve. 

14 (6) PRIORITY.—In appointing individuals to the 

15 Civilian Cybersecurity Reserve, the Agency shall 

16 prioritize the appointment of individuals described in 

17 clause (i) or (ii) of paragraph (2)(A) before consid18 ering individuals described in clause (iii) or (iv) of 

19 paragraph (2)(A). 

20 (7) PROHIBITION.—Any individual who is an 

21 employee of the executive branch may not be re22 cruited or appointed to serve in the Civilian Cyberse23 curity Reserve. 

24 (d) SECURITY CLEARANCES.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 885 RS

1 (1) IN GENERAL.—The Director shall ensure 

2 that all members of the Civilian Cybersecurity Re3 serve undergo the appropriate personnel vetting and 

4 adjudication commensurate with the duties of the 

5 position, including a determination of eligibility for 

6 access to classified information where a security 

7 clearance is necessary, according to applicable policy 

8 and authorities. 

9 (2) COST OF SPONSORING CLEARANCES.—If a 

10 member of the Civilian Cybersecurity Reserve re11 quires a security clearance in order to carry out 

12 their duties, the Agency shall be responsible for the 

13 cost of sponsoring the security clearance of a mem14 ber of the Civilian Cybersecurity Reserve. 

15 (e) STUDY AND IMPLEMENTATION PLAN.— 

16 (1) STUDY.—Not later than 60 days after the 

17 date of enactment of this Act, the Agency shall 

18 begin a study on the design and implementation of 

19 the pilot project authorized under subsection (b)(1) 

20 at the Agency, including— 

21 (A) compensation and benefits for mem22 bers of the Civilian Cybersecurity Reserve; 

23 (B) activities that members may undertake 

24 as part of their duties; 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 885 RS

1 (C) methods for identifying and recruiting 

2 members, including alternatives to traditional 

3 qualifications requirements; 

4 (D) methods for preventing conflicts of in5 terest or other ethical concerns as a result of 

6 participation in the pilot project and details of 

7 mitigation efforts to address any conflict of in8 terest concerns; 

9 (E) resources, including additional fund10 ing, needed to carry out the pilot project; 

11 (F) possible penalties for individuals who 

12 do not respond to activation when called, in ac13 cordance with the rights and procedures set 

14 forth under title 5, Code of Federal Regula15 tions; and 

16 (G) processes and requirements for train17 ing and onboarding members. 

18 (2) IMPLEMENTATION PLAN.—Not later than 1 

19 year after beginning the study required under para20 graph (1), the Agency shall— 

21 (A) submit to the appropriate congres22 sional committees an implementation plan for 

23 the pilot project authorized under subsection 

24 (b)(1); and 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 885 RS

1 (B) provide to the appropriate congres2 sional committees a briefing on the implementa3 tion plan. 

4 (3) PROHIBITION.—The Agency may not take 

5 any action to begin implementation of the pilot 

6 project authorized under subsection (b)(1) until the 

7 Agency fulfills the requirements under paragraph 

8 (2). 

9 (f) PROJECT GUIDANCE.—Not later than 2 years 

10 after the date of enactment of this Act, the Director shall, 

11 in consultation with the Office of Personnel Management 

12 and the Office of Government Ethics, issue guidance es13 tablishing and implementing the pilot project authorized 

14 under subsection (b)(1) at the Agency. 

15 (g) BRIEFINGS AND REPORT.— 

16 (1) BRIEFINGS.—Not later than 1 year after 

17 the date on which the Director issues the guidance 

18 required under subsection (f), and every year there19 after, the Agency shall provide to the appropriate 

20 congressional committees a briefing on activities car21 ried out under the pilot project of the Agency, in22 cluding— 

23 (A) participation in the Civilian Cybersecu24 rity Reserve, including the number of partici25 pants, the diversity of participants, and any 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 885 RS

1 barriers to recruitment or retention of mem2 bers; 

3 (B) an evaluation of the ethical require4 ments of the pilot project; 

5 (C) whether the Civilian Cybersecurity Re6 serve has been effective in providing additional 

7 capacity to the Agency during significant inci8 dents; and 

9 (D) an evaluation of the eligibility require10 ments for the pilot project. 

11 (2) REPORT.—Not earlier than 6 months and 

12 not later than 3 months before the date on which 

13 the pilot project of the Agency terminates under 

14 subsection (i), the Agency shall submit to the appro15 priate congressional committees a report and provide 

16 a briefing on recommendations relating to the pilot 

17 project, including recommendations for— 

18 (A) whether the pilot project should be 

19 modified, extended in duration, or established 

20 as a permanent program, and if so, an appro21 priate scope for the program; 

22 (B) how to attract participants, ensure a 

23 diversity of participants, and address any bar24 riers to recruitment or retention of members of 

25 the Civilian Cybersecurity Reserve; 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•S 885 RS

1 (C) the ethical requirements of the pilot 

2 project and the effectiveness of mitigation ef3 forts to address any conflict of interest con4 cerns; and 

5 (D) an evaluation of the eligibility require6 ments for the pilot project. 

7 (h) EVALUATION.—Not later than 3 years after the 

8 pilot project authorized under subsection (b) is established 

9 in the Agency, the Comptroller General of the United 

10 States shall— 

11 (1) conduct a study evaluating the pilot project 

12 at the Agency; and 

13 (2) submit to Congress— 

14 (A) a report on the results of the study; 

15 and 

16 (B) a recommendation with respect to 

17 whether the pilot project should be modified, 

18 extended in duration, or established as a per19 manent program. 

20 (i) SUNSET.—The pilot project authorized under this 

21 section shall terminate on the date that is 4 years after 

22 the date on which the pilot project is established. 

23 (j) NO ADDITIONAL FUNDS.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
14 

•S 885 RS

1 (1) IN GENERAL.—No additional funds are au2 thorized to be appropriated for the purpose of car3 rying out this Act. 

4 (2) EXISTING AUTHORIZED AMOUNTS.—Funds 

5 to carry out this Act may, as provided in advance in 

6 appropriations Acts, only come from amounts au7 thorized to be appropriated to the Agency. 

8 SECTION 1. SHORT TITLE. 

9 This Act may be cited as the ‘‘Department of Home10 land Security Civilian Cybersecurity Reserve Act’’. 

11 SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 

12 PROJECT. 

13 (a) DEFINITIONS.—In this section: 

14 (1) AGENCY.—The term ‘‘Agency’’ means the Cy15 bersecurity and Infrastructure Security Agency. 

16 (2) APPROPRIATE CONGRESSIONAL COMMIT17 TEES.—The term ‘‘appropriate congressional commit18 tees’’ means— 

19 (A) the Committee on Homeland Security 

20 and Governmental Affairs of the Senate; 

21 (B) the Committee on Appropriations of the 

22 Senate; 

23 (C) the Committee on Homeland Security of 

24 the House of Representatives; 


pbinns on DSKJLVW7X2PROD with $$_JOB
15 

•S 885 RS

1 (D) the Committee on Oversight and Ac2 countability of the House of Representatives; and 

3 (E) the Committee on Appropriations of the 

4 House of Representatives. 

5 (3) COMPETITIVE SERVICE.—The term ‘‘competi6 tive service’’ has the meaning given the term in sec7 tion 2102 of title 5, United States Code. 

8 (4) DIRECTOR.—The term ‘‘Director’’ means the 

9 Director of the Agency. 

10 (5) EXCEPTED SERVICE.—The term ‘‘excepted 

11 service’’ has the meaning given the term in section 

12 2103 of title 5, United States Code. 

13 (6) SIGNIFICANT INCIDENT.—The term ‘‘signifi14 cant incident’’— 

15 (A) means an incident or a group of related 

16 incidents that results, or is likely to result, in de17 monstrable harm to— 

18 (i) the national security interests, for19 eign relations, or economy of the United 

20 States; or 

21 (ii) the public confidence, civil lib22 erties, or public health and safety of the 

23 people of the United States; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
16 

•S 885 RS

1 (B) does not include an incident or a por2 tion of a group of related incidents that occurs 

3 on— 

4 (i) a national security system, as de5 fined in section 3552 of title 44, United 

6 States Code; or 

7 (ii) an information system described in 

8 paragraph (2) or (3) of section 3553(e) of 

9 title 44, United States Code. 

10 (7) TEMPORARY POSITION.—The term ‘‘tem11 porary position’’ means a position in the competitive 

12 or excepted service for a period of 6 months or less. 

13 (8) UNIFORMED SERVICES.—The term ‘‘uni14 formed services’’ has the meaning given the term in 

15 section 2101 of title 5, United States Code. 

16 (b) PILOT PROJECT.— 

17 (1) IN GENERAL.—The Director may carry out 

18 a pilot project to establish a Civilian Cybersecurity 

19 Reserve at the Agency. 

20 (2) PURPOSE.—The purpose of a Civilian Cyber21 security Reserve is to enable the Agency to effectively 

22 respond to significant incidents. 

23 (3) ALTERNATIVE METHODS.—Consistent with 

24 section 4703 of title 5, United States Code, in car25 rying out a pilot project authorized under paragraph 


pbinns on DSKJLVW7X2PROD with $$_JOB
17 

•S 885 RS

1 (1), the Director may, without further authorization 

2 from the Office of Personnel Management, provide for 

3 alternative methods of— 

4 (A) establishing qualifications requirements 

5 for, recruitment of, and appointment to posi6 tions; and 

7 (B) classifying positions. 

8 (4) APPOINTMENTS.—Under the pilot project au9 thorized under paragraph (1), upon occurrence of a 

10 significant incident, the Director— 

11 (A) may activate members of the Civilian 

12 Cybersecurity Reserve by— 

13 (i) noncompetitively appointing mem14 bers of the Civilian Cybersecurity Reserve to 

15 temporary positions in the competitive serv16 ice; or 

17 (ii) appointing members of the Civil18 ian Cybersecurity Reserve to temporary po19 sitions in the excepted service; 

20 (B) shall notify Congress whenever a mem21 ber is activated under subparagraph (A); and 

22 (C) may appoint not more than 30 mem23 bers to temporary positions. 

24 (5) STATUS AS EMPLOYEES.—An individual ap25 pointed under paragraph (4) shall be considered a 


pbinns on DSKJLVW7X2PROD with $$_JOB
18 

•S 885 RS

1 Federal civil service employee under section 2105 of 

2 title 5, United States Code. 

3 (6) ADDITIONAL EMPLOYEES.—Individuals ap4 pointed under paragraph (4) shall be in addition to 

5 any employees of the Agency who provide cybersecu6 rity services. 

7 (7) EMPLOYMENT PROTECTIONS.—The Secretary 

8 of Labor shall prescribe such regulations as necessary 

9 to ensure the reemployment, continuation of benefits, 

10 and non-discrimination in reemployment of individ11 uals appointed under paragraph (4), provided that 

12 such regulations shall include, at a minimum, those 

13 rights and obligations set forth under chapter 43 of 

14 title 38, United States Code. 

15 (8) STATUS IN RESERVE.—During the period be16 ginning on the date on which an individual is re17 cruited by the Agency to serve in the Civilian Cyber18 security Reserve and ending on the date on which the 

19 individual is appointed under paragraph (4), and 

20 during any period in between any such appoint21 ments, the individual shall not be considered a Fed22 eral employee. 

23 (c) ELIGIBILITY; APPLICATION AND SELECTION.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
19 

•S 885 RS

1 (1) IN GENERAL.—Under the pilot project au2 thorized under subsection (b)(1), the Director shall es3 tablish criteria for— 

4 (A) individuals to be eligible for the Civil5 ian Cybersecurity Reserve; and 

6 (B) the application and selection processes 

7 for the Civilian Cybersecurity Reserve. 

8 (2) REQUIREMENTS FOR INDIVIDUALS.—The cri9 teria established under paragraph (1)(A) with respect 

10 to an individual shall include— 

11 (A) previous employment— 

12 (i) by the executive branch; 

13 (ii) within the uniformed services; 

14 (iii) as a Federal contractor within the 

15 executive branch; or 

16 (iv) by a State, local, Tribal, or terri17 torial government; 

18 (B) if the individual has previously served 

19 as a member of the Civilian Cybersecurity Re20 serve of the Agency, that the previous appoint21 ment ended not less than 60 days before the indi22 vidual may be appointed for a subsequent tem23 porary position in the Civilian Cybersecurity 

24 Reserve of the Agency; and 

25 (C) cybersecurity expertise. 


pbinns on DSKJLVW7X2PROD with $$_JOB
20 

•S 885 RS

1 (3) PRESCREENING.—The Agency shall— 

2 (A) conduct a prescreening of each indi3 vidual prior to appointment under subsection 

4 (b)(4) for any topic or product that would create 

5 a conflict of interest; and 

6 (B) require each individual appointed 

7 under subsection (b)(4) to notify the Agency if a 

8 potential conflict of interest arises during the ap9 pointment. 

10 (4) AGREEMENT REQUIRED.—An individual 

11 may become a member of the Civilian Cybersecurity 

12 Reserve only if the individual enters into an agree13 ment with the Director to become such a member, 

14 which shall set forth the rights and obligations of the 

15 individual and the Agency. 

16 (5) EXCEPTION FOR CONTINUING MILITARY SERV17 ICE COMMITMENTS.—A member of the Selected Re18 serve under section 10143 of title 10, United States 

19 Code, may not be a member of the Civilian Cyberse20 curity Reserve. 

21 (6) PRIORITY.—In appointing individuals to the 

22 Civilian Cybersecurity Reserve, the Agency shall 

23 prioritize the appointment of individuals described in 

24 clause (i) or (ii) of paragraph (2)(A) before considVerDate Sep 11 2014 23:42 Sep 11, 2023 Jkt 039200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6203 E:\BILLS\S885.RS S885

pbinns on DSKJLVW7X2PROD with $$_JOB
21 

•S 885 RS

1 ering individuals described in clause (iii) or (iv) of 

2 paragraph (2)(A). 

3 (7) PROHIBITION.—Any individual who is an 

4 employee (as defined in section 2105 of title 5, United 

5 States Code) of the executive branch may not be re6 cruited or appointed to serve in the Civilian Cyberse7 curity Reserve. 

8 (d) SECURITY CLEARANCES.— 

9 (1) IN GENERAL.—The Director shall ensure that 

10 all members of the Civilian Cybersecurity Reserve un11 dergo the appropriate personnel vetting and adjudica12 tion commensurate with the duties of the position, in13 cluding a determination of eligibility for access to 

14 classified information where a security clearance is 

15 necessary, according to applicable policy and authori16 ties. 

17 (2) COST OF SPONSORING CLEARANCES.—If a 

18 member of the Civilian Cybersecurity Reserve requires 

19 a security clearance in order to carry out their duties, 

20 the Agency shall be responsible for the cost of spon21 soring the security clearance of that member. 

22 (e) STUDY AND IMPLEMENTATION PLAN.— 

23 (1) STUDY.—Not later than 60 days after the 

24 date of enactment of this Act, the Agency shall begin 

25 a study on the design and implementation of the pilot 


pbinns on DSKJLVW7X2PROD with $$_JOB
22 

•S 885 RS

1 project authorized under subsection (b)(1) at the 

2 Agency, including— 

3 (A) compensation and benefits for members 

4 of the Civilian Cybersecurity Reserve; 

5 (B) activities that members may undertake 

6 as part of their duties; 

7 (C) methods for identifying and recruiting 

8 members, including alternatives to traditional 

9 qualifications requirements; 

10 (D) methods for preventing conflicts of in11 terest or other ethical concerns as a result of par12 ticipation in the pilot project and details of 

13 mitigation efforts to address any conflict of in14 terest concerns; 

15 (E) resources, including additional funding, 

16 needed to carry out the pilot project; 

17 (F) possible penalties for individuals who 

18 do not respond to activation when called, in ac19 cordance with the rights and procedures set forth 

20 under title 5, Code of Federal Regulations; and 

21 (G) processes and requirements for training 

22 and onboarding members. 

23 (2) IMPLEMENTATION PLAN.—Not later than 1 

24 year after beginning the study required under para25 graph (1), the Agency shall— 


pbinns on DSKJLVW7X2PROD with $$_JOB
23 

•S 885 RS

1 (A) submit to the appropriate congressional 

2 committees an implementation plan for the pilot 

3 project authorized under subsection (b)(1); and 

4 (B) provide to the appropriate congressional 

5 committees a briefing on the implementation 

6 plan. 

7 (3) PROHIBITION.—The Agency may not take 

8 any action to begin implementation of the pilot 

9 project authorized under subsection (b)(1) until the 

10 Agency fulfills the requirements under paragraph (2). 

11 (f) PROJECT GUIDANCE.—Not later than 2 years after 

12 the date of enactment of this Act, the Director shall, in con13 sultation with the Office of Government Ethics, issue guid14 ance establishing and implementing the pilot project au15 thorized under subsection (b)(1) at the Agency. 

16 (g) BRIEFINGS AND REPORT.— 

17 (1) BRIEFINGS.—Not later than 1 year after the 

18 date on which the Director issues the guidance re19 quired under subsection (f), and every year thereafter, 

20 the Agency shall provide to the appropriate congres21 sional committees a briefing on activities carried out 

22 under the pilot project authorized under subsection 

23 (b)(1), including— 

24 (A) participation in the Civilian Cybersecu25 rity Reserve, including the number of particiVerDate Sep 11 2014 23:42 Sep 11, 2023 Jkt 039200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6203 E:\BILLS\S885.RS S885

pbinns on DSKJLVW7X2PROD with $$_JOB
24 

•S 885 RS

1 pants, the diversity of participants, and any 

2 barriers to recruitment or retention of members; 

3 (B) an evaluation of the ethical require4 ments of the pilot project; 

5 (C) whether the Civilian Cybersecurity Re6 serve has been effective in providing additional 

7 capacity to the Agency during significant inci8 dents; and 

9 (D) an evaluation of the eligibility require10 ments for the pilot project. 

11 (2) REPORT.—Not earlier than 6 months and 

12 not later than 3 months before the date on which the 

13 pilot project of the Agency terminates under sub14 section (i), the Agency shall submit to the appropriate 

15 congressional committees a report on, and provide a 

16 briefing on recommendations relating to, the pilot 

17 project, including recommendations for— 

18 (A) whether the pilot project should be 

19 modified, extended in duration, or established as 

20 a permanent program, and if so, an appropriate 

21 scope for the program; 

22 (B) how to attract participants, ensure a 

23 diversity of participants, and address any bar24 riers to recruitment or retention of members of 

25 the Civilian Cybersecurity Reserve; 


pbinns on DSKJLVW7X2PROD with $$_JOB
25 

•S 885 RS

1 (C) the ethical requirements of the pilot 

2 project and the effectiveness of mitigation efforts 

3 to address any conflict of interest concerns; and 

4 (D) an evaluation of the eligibility require5 ments for the pilot project. 

6 (h) EVALUATION.—Not later than 3 years after the 

7 pilot project authorized under subsection (b)(1) is estab8 lished in the Agency, the Comptroller General of the United 

9 States shall— 

10 (1) conduct a study evaluating the pilot project 

11 at the Agency; and 

12 (2) submit to Congress— 

13 (A) a report on the results of the study; and 

14 (B) a recommendation with respect to 

15 whether the pilot project should be modified, ex16 tended in duration, or established as a perma17 nent program. 

18 (i) SUNSET.—The pilot project authorized under sub19 section (b)(1) shall terminate on the date that is 4 years 

20 after the date on which the pilot project is established, ex21 cept that an activated member of the Civilian Cybersecurity 

22 Reserve who was appointed to and is serving in a tem23 porary position under this section as of the day before that 

24 termination date may continue to serve until the end of 

25 the appointment. 


pbinns on DSKJLVW7X2PROD with $$_JOB
26 

•S 885 RS

1 (j) NO ADDITIONAL FUNDS.—No additional funds are 

2 authorized to be appropriated for the purpose of carrying 

3 out this Act. 


pbinns on DSKJLVW7X2PROD with $$_JOB

pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 204 

118TH CONGRESS 

1ST SESSION S. 885 

[Report No. 118–96] 

A BILL 

To establish a Civilian Cybersecurity Reserve in the 

and for other purposes. United States with respect to national security, project to address the cybersecurity needs of the Department of Homeland Security as a pilot 

SEPTEMBER 11, 2023 

Reported with an amendment 


pbinns on DSKJLVW7X2PROD with $$_JOB