II 

118TH CONGRESS 

1ST SESSION S. 885 

To establish a Civilian Cybersecurity Reserve in the Department of Homeland 

Security as a pilot project to address the cybersecurity needs of the 

United States with respect to national security, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 21, 2023 

Ms. ROSEN (for herself and Mrs. BLACKBURN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To establish a Civilian Cybersecurity Reserve in the Department of Homeland Security as a pilot project to address 

the cybersecurity needs of the United States with respect 

to national security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Home5 land Security Civilian Cybersecurity Reserve Act’’. 

6 SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 

7 PROJECT. 

8 (a) DEFINITIONS.—In this section: 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 885 IS

1 (1) AGENCY.—The term ‘‘Agency’’ means the 

2 Cybersecurity and Infrastructure Security Agency. 

3 (2) APPROPRIATE CONGRESSIONAL COMMIT4 TEES.—The term ‘‘appropriate congressional com5 mittees’’ means— 

6 (A) the Committee on Homeland Security 

7 and Governmental Affairs of the Senate; 

8 (B) the Committee on Appropriations of 

9 the Senate; 

10 (C) the Committee on Homeland Security 

11 of the House of Representatives; 

12 (D) the Committee on Oversight and Ac13 countability of the House of Representatives; 

14 and 

15 (E) the Committee on Appropriations of 

16 the House of Representatives. 

17 (3) COMPETITIVE SERVICE.—The term ‘‘com18 petitive service’’ has the meaning given the term in 

19 section 2102 of title 5, United States Code. 

20 (4) DIRECTOR.—The term ‘‘Director’’ means 

21 the Director of the Agency. 

22 (5) EXCEPTED SERVICE.—The term ‘‘excepted 

23 service’’ has the meaning given the term in section 

24 2103 of title 5, United States Code. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 885 IS

1 (6) SIGNIFICANT INCIDENT.—The term ‘‘sig2 nificant incident’’— 

3 (A) means an incident or a group of re4 lated incidents that results, or is likely to re5 sult, in demonstrable harm to— 

6 (i) the national security interests, for7 eign relations, or economy of the United 

8 States; or 

9 (ii) the public confidence, civil lib10 erties, or public health and safety of the 

11 people of the United States; and 

12 (B) does not include an incident or a por13 tion of a group of related incidents that occurs 

14 on— 

15 (i) a national security system, as de16 fined in section 3552 of title 44, United 

17 States Code; or 

18 (ii) an information system described 

19 in paragraph (2) or (3) of section 3553(e) 

20 of title 44, United States Code. 

21 (7) TEMPORARY POSITION.—The term ‘‘tem22 porary position’’ means a position in the competitive 

23 or excepted service for a period of 6 months or less. 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 885 IS

1 (8) UNIFORMED SERVICES.—The term ‘‘uni2 formed services’’ has the meaning given the term in 

3 section 2101 of title 5, United States Code. 

4 (b) PILOT PROJECT.— 

5 (1) IN GENERAL.—The Director may carry out 

6 a pilot project to establish a Civilian Cybersecurity 

7 Reserve at the Agency. 

8 (2) PURPOSE.—The purpose of a Civilian Cy9 bersecurity Reserve is to enable the Agency to effec10 tively respond to significant incidents. 

11 (3) ALTERNATIVE METHODS.—Consistent with 

12 section 4703 of title 5, United States Code, in car13 rying out a pilot project authorized under paragraph 

14 (1), the Director may, without further authorization 

15 from the Office of Personnel Management, provide 

16 for alternative methods of— 

17 (A) establishing qualifications require18 ments for, recruitment of, and appointment to 

19 positions; and 

20 (B) classifying positions. 

21 (4) APPOINTMENTS.—Under the pilot project 

22 authorized under paragraph (1), upon occurrence of 

23 a significant incident, the Director— 

24 (A) may activate members of the Civilian 

25 Cybersecurity Reserve by— 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 885 IS

1 (i) noncompetitively appointing mem2 bers of the Civilian Cybersecurity Reserve 

3 to temporary positions in the competitive 

4 service; or 

5 (ii) appointing members of the Civil6 ian Cybersecurity Reserve to temporary po7 sitions in the excepted service; 

8 (B) shall notify Congress whenever a mem9 ber is activated under subparagraph (A); and 

10 (C) may appoint not more than 30 mem11 bers to the Civilian Cybersecurity Reserve 

12 under subparagraph (A) at any time. 

13 (5) STATUS AS EMPLOYEES.—An individual ap14 pointed under subsection (b)(4) shall be considered 

15 a Federal civil service employee under section 2105 

16 of title 5, United States Code. 

17 (6) ADDITIONAL EMPLOYEES.—Individuals ap18 pointed under subsection (b)(4) shall be in addition 

19 to any employees of the Agency who provide cyberse20 curity services. 

21 (7) EMPLOYMENT PROTECTIONS.—The Sec22 retary of Labor shall prescribe such regulations as 

23 necessary to ensure the reemployment, continuation 

24 of benefits, and non-discrimination in reemployment 

25 of individuals appointed under subsection (b)(4), 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 885 IS

1 provided that such regulations shall include, at a 

2 minimum, those rights and obligations set forth 

3 under chapter 43 of title 38, United States Code. 

4 (8) STATUS IN RESERVE.—During the period 

5 beginning on the date on which an individual is re6 cruited by the Agency to serve in the Civilian Cyber7 security Reserve and ending on the date on which 

8 the individual is appointed under subsection (b)(4), 

9 and during any period in between any such appoint10 ments, the individual shall not be considered a Fed11 eral employee. 

12 (c) ELIGIBILITY; APPLICATION AND SELECTION.— 

13 (1) IN GENERAL.—Under the pilot project au14 thorized under subsection (b), the Director shall es15 tablish criteria for— 

16 (A) individuals to be eligible for the Civil17 ian Cybersecurity Reserve; and 

18 (B) the application and selection processes 

19 for the Civilian Cybersecurity Reserve. 

20 (2) REQUIREMENTS FOR INDIVIDUALS.—The 

21 criteria established under paragraph (1)(A) with re22 spect to an individual shall include— 

23 (A) previous employment— 

24 (i) by the executive branch; 

25 (ii) within the uniformed services; 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 885 IS

1 (iii) as a Federal contractor within 

2 the executive branch; or 

3 (iv) by a State, local, Tribal, or terri4 torial government; 

5 (B) if the individual has previously served 

6 as a member of the Civilian Cybersecurity Re7 serve of the Agency, that the previous appoint8 ment ended not less than 60 days before the in9 dividual may be appointed for a subsequent 

10 temporary position in the Civilian Cybersecurity 

11 Reserve of the Agency; and 

12 (C) cybersecurity expertise. 

13 (3) PRESCREENING.—The Agency shall— 

14 (A) conduct a prescreening of each indi15 vidual prior to appointment under subsection 

16 (b)(4) for any topic or product that would cre17 ate a conflict of interest; and 

18 (B) require each individual appointed 

19 under subsection (b)(4) to notify the Agency if 

20 a potential conflict of interest arises during the 

21 appointment. 

22 (4) AGREEMENT REQUIRED.—An individual 

23 may become a member of the Civilian Cybersecurity 

24 Reserve only if the individual enters into an agree25 ment with the Director to become such a member, 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 885 IS

1 which shall set forth the rights and obligations of 

2 the individual and the Agency. 

3 (5) EXCEPTION FOR CONTINUING MILITARY

4 SERVICE COMMITMENTS.—A member of the Selected 

5 Reserve under section 10143 of title 10, United 

6 States Code, may not be a member of the Civilian 

7 Cybersecurity Reserve. 

8 (6) PRIORITY.—In appointing individuals to the 

9 Civilian Cybersecurity Reserve, the Agency shall 

10 prioritize the appointment of individuals described in 

11 clause (i) or (ii) of paragraph (2)(A) before consid12 ering individuals described in clause (iii) or (iv) of 

13 paragraph (2)(A). 

14 (7) PROHIBITION.—Any individual who is an 

15 employee of the executive branch may not be re16 cruited or appointed to serve in the Civilian Cyberse17 curity Reserve. 

18 (d) SECURITY CLEARANCES.— 

19 (1) IN GENERAL.—The Director shall ensure 

20 that all members of the Civilian Cybersecurity Re21 serve undergo the appropriate personnel vetting and 

22 adjudication commensurate with the duties of the 

23 position, including a determination of eligibility for 

24 access to classified information where a security 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 885 IS

1 clearance is necessary, according to applicable policy 

2 and authorities. 

3 (2) COST OF SPONSORING CLEARANCES.—If a 

4 member of the Civilian Cybersecurity Reserve re5 quires a security clearance in order to carry out 

6 their duties, the Agency shall be responsible for the 

7 cost of sponsoring the security clearance of a mem8 ber of the Civilian Cybersecurity Reserve. 

9 (e) STUDY AND IMPLEMENTATION PLAN.— 

10 (1) STUDY.—Not later than 60 days after the 

11 date of enactment of this Act, the Agency shall 

12 begin a study on the design and implementation of 

13 the pilot project authorized under subsection (b)(1) 

14 at the Agency, including— 

15 (A) compensation and benefits for mem16 bers of the Civilian Cybersecurity Reserve; 

17 (B) activities that members may undertake 

18 as part of their duties; 

19 (C) methods for identifying and recruiting 

20 members, including alternatives to traditional 

21 qualifications requirements; 

22 (D) methods for preventing conflicts of in23 terest or other ethical concerns as a result of 

24 participation in the pilot project and details of 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 885 IS

1 mitigation efforts to address any conflict of in2 terest concerns; 

3 (E) resources, including additional fund4 ing, needed to carry out the pilot project; 

5 (F) possible penalties for individuals who 

6 do not respond to activation when called, in ac7 cordance with the rights and procedures set 

8 forth under title 5, Code of Federal Regula9 tions; and 

10 (G) processes and requirements for train11 ing and onboarding members. 

12 (2) IMPLEMENTATION PLAN.—Not later than 1 

13 year after beginning the study required under para14 graph (1), the Agency shall— 

15 (A) submit to the appropriate congres16 sional committees an implementation plan for 

17 the pilot project authorized under subsection 

18 (b)(1); and 

19 (B) provide to the appropriate congres20 sional committees a briefing on the implementa21 tion plan. 

22 (3) PROHIBITION.—The Agency may not take 

23 any action to begin implementation of the pilot 

24 project authorized under subsection (b)(1) until the 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 885 IS

1 Agency fulfills the requirements under paragraph 

2 (2). 

3 (f) PROJECT GUIDANCE.—Not later than 2 years 

4 after the date of enactment of this Act, the Director shall, 

5 in consultation with the Office of Personnel Management 

6 and the Office of Government Ethics, issue guidance es7 tablishing and implementing the pilot project authorized 

8 under subsection (b)(1) at the Agency. 

9 (g) BRIEFINGS AND REPORT.— 

10 (1) BRIEFINGS.—Not later than 1 year after 

11 the date on which the Director issues the guidance 

12 required under subsection (f), and every year there13 after, the Agency shall provide to the appropriate 

14 congressional committees a briefing on activities car15 ried out under the pilot project of the Agency, in16 cluding— 

17 (A) participation in the Civilian Cybersecu18 rity Reserve, including the number of partici19 pants, the diversity of participants, and any 

20 barriers to recruitment or retention of mem21 bers; 

22 (B) an evaluation of the ethical require23 ments of the pilot project; 

24 (C) whether the Civilian Cybersecurity Re25 serve has been effective in providing additional 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 885 IS

1 capacity to the Agency during significant inci2 dents; and 

3 (D) an evaluation of the eligibility require4 ments for the pilot project. 

5 (2) REPORT.—Not earlier than 6 months and 

6 not later than 3 months before the date on which 

7 the pilot project of the Agency terminates under 

8 subsection (i), the Agency shall submit to the appro9 priate congressional committees a report and provide 

10 a briefing on recommendations relating to the pilot 

11 project, including recommendations for— 

12 (A) whether the pilot project should be 

13 modified, extended in duration, or established 

14 as a permanent program, and if so, an appro15 priate scope for the program; 

16 (B) how to attract participants, ensure a 

17 diversity of participants, and address any bar18 riers to recruitment or retention of members of 

19 the Civilian Cybersecurity Reserve; 

20 (C) the ethical requirements of the pilot 

21 project and the effectiveness of mitigation ef22 forts to address any conflict of interest con23 cerns; and 

24 (D) an evaluation of the eligibility require25 ments for the pilot project. 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•S 885 IS

1 (h) EVALUATION.—Not later than 3 years after the 

2 pilot project authorized under subsection (b) is established 

3 in the Agency, the Comptroller General of the United 

4 States shall— 

5 (1) conduct a study evaluating the pilot project 

6 at the Agency; and 

7 (2) submit to Congress— 

8 (A) a report on the results of the study; 

9 and 

10 (B) a recommendation with respect to 

11 whether the pilot project should be modified, 

12 extended in duration, or established as a per13 manent program. 

14 (i) SUNSET.—The pilot project authorized under this 

15 section shall terminate on the date that is 4 years after 

16 the date on which the pilot project is established. 

17 (j) NO ADDITIONAL FUNDS.— 

18 (1) IN GENERAL.—No additional funds are au19 thorized to be appropriated for the purpose of car20 rying out this Act. 

21 (2) EXISTING AUTHORIZED AMOUNTS.—Funds 

22 to carry out this Act may, as provided in advance in 

23 appropriations Acts, only come from amounts au24 thorized to be appropriated to the Agency. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB