II 

118TH CONGRESS 

1ST SESSION S. 903 

To require the Secretary of the Army to carry out a pilot project to establish 

a Civilian Cybersecurity Reserve, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 21, 2023 

Ms. ROSEN (for herself and Mrs. BLACKBURN) introduced the following bill; 

which was read twice and referred to the Committee on Armed Services 

A BILL 

To require the Secretary of the Army to carry out a pilot 

project to establish a Civilian Cybersecurity Reserve, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Defense 

5 Civilian Cybersecurity Reserve Act’’. 

6 SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 

7 PROJECT. 

8 (a) DEFINITIONS.—In this Act: 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 903 IS

1 (1) APPROPRIATE CONGRESSIONAL COMMIT2 TEES.—The term ‘‘appropriate congressional com3 mittees’’ means— 

4 (A) the Committee on Homeland Security 

5 and Governmental Affairs of the Senate; 

6 (B) the Committee on Armed Services of 

7 the Senate; 

8 (C) the Committee on Homeland Security 

9 of the House of Representatives; and 

10 (D) the Committee on Armed Services of 

11 the House of Representatives. 

12 (2) COMPETITIVE SERVICE.—The term ‘‘com13 petitive service’’ has the meaning given the term in 

14 section 2102 of title 5, United States Code. 

15 (3) EXCEPTED SERVICE.—The term ‘‘excepted 

16 service’’ has the meaning given the term in section 

17 2103 of title 5, United States Code. 

18 (4) TEMPORARY POSITION.—The term ‘‘tem19 porary position’’ means a position in the competitive 

20 or excepted service for a period of 180 days or less. 

21 (b) PILOT PROJECT.— 

22 (1) IN GENERAL.—The Secretary of the Army 

23 shall carry out a pilot project to establish a Civilian 

24 Cybersecurity Reserve. 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 903 IS

1 (2) PURPOSE.—The purpose of the Civilian Cy2 bersecurity Reserve is to enable the Army to provide 

3 manpower to the United States Cyber Command to 

4 effectively— 

5 (A) preempt, defeat, deter, or respond to 

6 malicious cyber activity; 

7 (B) conduct cyberspace operations; 

8 (C) secure information and systems of the 

9 Department of Defense against malicious cyber 

10 activity; and 

11 (D) assist in solving cyber workforce-re12 lated challenges. 

13 (3) ALTERNATIVE METHODS.—Consistent with 

14 section 4703 of title 5, United States Code, in car15 rying out the pilot project required under paragraph 

16 (1), the Secretary may, without further authoriza17 tion from the Office of Personnel Management, pro18 vide for alternative methods of— 

19 (A) establishing qualifications require20 ments for, recruitment of, and appointment to 

21 positions; and 

22 (B) classifying positions. 

23 (4) APPOINTMENTS.—Under the pilot project 

24 required under paragraph (1), in order to fulfill the 

25 purpose under paragraph (2), the Secretary— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 903 IS

1 (A) may activate members of the Civilian 

2 Cybersecurity Reserve by— 

3 (i) noncompetitively appointing mem4 bers of the Civilian Cybersecurity Reserve 

5 to temporary positions in the competitive 

6 service; or 

7 (ii) appointing members of the Civil8 ian Cybersecurity Reserve to temporary po9 sitions in the excepted service; 

10 (B) shall notify Congress whenever a mem11 ber is activated under subparagraph (A); and 

12 (C) may appoint not more than 50 mem13 bers to the Civilian Cybersecurity Reserve 

14 under subparagraph (A) at any time. 

15 (5) STATUS AS EMPLOYEES.—An individual ap16 pointed under paragraph (4) shall be considered a 

17 Federal civil service employee under section 2105 of 

18 title 5, United States Code. 

19 (6) ADDITIONAL EMPLOYEES.—Individuals ap20 pointed under paragraph (4) shall be in addition to 

21 any employees of the United States Cyber Command 

22 who provide cybersecurity services. 

23 (7) EMPLOYMENT PROTECTIONS.—The Sec24 retary of Labor shall prescribe such regulations as 

25 necessary to ensure the reemployment, continuation 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 903 IS

1 of benefits, and non-discrimination in reemployment 

2 of individuals appointed under paragraph (4), pro3 vided that such regulations shall include, at a min4 imum, those rights and obligations set forth under 

5 chapter 43 of title 38, United States Code. 

6 (8) STATUS IN RESERVE.—During the period 

7 beginning on the date on which an individual is re8 cruited to serve in the Civilian Cybersecurity Reserve 

9 and ending on the date on which the individual is 

10 appointed under paragraph (4), and during any pe11 riod in between any such appointments, the indi12 vidual shall not be considered a Federal employee. 

13 (c) ELIGIBILITY; APPLICATION AND SELECTION.— 

14 (1) IN GENERAL.—Under the pilot project re15 quired under subsection (b)(1), the Secretary of the 

16 Army shall establish criteria for— 

17 (A) individuals to be eligible for the Civil18 ian Cybersecurity Reserve; and 

19 (B) the application and selection processes 

20 for the Civilian Cybersecurity Reserve. 

21 (2) REQUIREMENTS FOR INDIVIDUALS.—The 

22 criteria established under paragraph (1)(A) with re23 spect to an individual shall include— 

24 (A) if the individual has previously served 

25 as a member of the Civilian Cybersecurity ReVerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903

kjohnson on DSK79L0C42PROD with BILLS
6 

•S 903 IS

1 serve, that the previous appointment ended not 

2 less than 60 days before the individual may be 

3 appointed for a subsequent temporary position 

4 in the Civilian Cybersecurity Reserve; and 

5 (B) cybersecurity expertise. 

6 (3) PRESCREENING.—The Secretary shall— 

7 (A) conduct a prescreening of each indi8 vidual prior to appointment under subsection 

9 (b)(4) for any topic or product that would cre10 ate a conflict of interest; and 

11 (B) require each individual appointed 

12 under subsection (b)(4) to notify the Secretary 

13 if a potential conflict of interest arises during 

14 the appointment. 

15 (4) AGREEMENT REQUIRED.—An individual 

16 may become a member of the Civilian Cybersecurity 

17 Reserve only if the individual enters into an agree18 ment with the Secretary to become such a member, 

19 which shall set forth the rights and obligations of 

20 the individual and the Army. 

21 (5) EXCEPTION FOR CONTINUING MILITARY

22 SERVICE COMMITMENTS.—A member of the Selected 

23 Reserve under section 10143 of title 10, United 

24 States Code, may not be a member of the Civilian 

25 Cybersecurity Reserve. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 903 IS

1 (6) PROHIBITION.—Any individual who is an 

2 employee of the executive branch may not be re3 cruited or appointed to serve in the Civilian Cyberse4 curity Reserve. 

5 (d) SECURITY CLEARANCES.— 

6 (1) IN GENERAL.—The Secretary of the Army 

7 shall ensure that all members of the Civilian Cyber8 security Reserve undergo the appropriate personnel 

9 vetting and adjudication commensurate with the du10 ties of the position, including a determination of eli11 gibility for access to classified information where a 

12 security clearance is necessary, according to applica13 ble policy and authorities. 

14 (2) COST OF SPONSORING CLEARANCES.—If a 

15 member of the Civilian Cybersecurity Reserve re16 quires a security clearance in order to carry out the 

17 duties of the member, the Army shall be responsible 

18 for the cost of sponsoring the security clearance of 

19 the member. 

20 (e) IMPLEMENTATION PLAN.— 

21 (1) IN GENERAL.—Not later than 180 days 

22 after the date on which the Secretary of Defense 

23 submits to the Committee on Armed Services of the 

24 Senate and the Committee on Armed Services of the 

25 House of Representatives the report required under 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 903 IS

1 section 1540(d)(2) of the James M. Inhofe National 

2 Defense Authorization Act for Fiscal Year 2023 

3 (Public Law 117–263) on the feasibility and advis4 ability of creating and maintaining a civilian cyber5 security reserve corps, the Secretary of the Army 

6 shall— 

7 (A) submit to the appropriate congres8 sional committees an implementation plan for 

9 the pilot project required under subsection 

10 (b)(1); and 

11 (B) provide to the appropriate congres12 sional committees a briefing on the implementa13 tion plan. 

14 (2) PROHIBITION.—The Secretary of the Army 

15 may not take any action to begin implementation of 

16 the pilot project required under subsection (b)(1) 

17 until the Secretary fulfills the requirements under 

18 paragraph (1). 

19 (f) PROJECT GUIDANCE.—Not later than two years 

20 after the date of the enactment of this Act, the Secretary 

21 of the Army shall, in consultation with the Office of Per22 sonnel Management and the Office of Government Ethics, 

23 issue guidance establishing and implementing the pilot 

24 project required under subsection (b)(1). 

25 (g) BRIEFINGS AND REPORT.— 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 903 IS

1 (1) BRIEFINGS.—Not later than one year after 

2 the date on which the guidance required under sub3 section (f) is issued, and every year thereafter until 

4 the date on which the pilot project required under 

5 subsection (b)(1) terminates under subsection (i), 

6 the Secretary of the Army shall provide to the ap7 propriate congressional committees a briefing on ac8 tivities carried out under the pilot project, includ9 ing— 

10 (A) participation in the Civilian Cybersecu11 rity Reserve, including the number of partici12 pants, the diversity of participants, and any 

13 barriers to recruitment or retention of mem14 bers; 

15 (B) an evaluation of the ethical require16 ments of the pilot project; 

17 (C) whether the Civilian Cybersecurity Re18 serve has been effective in providing additional 

19 capacity to the Army; and 

20 (D) an evaluation of the eligibility require21 ments for the pilot project. 

22 (2) REPORT.—Not earlier than 180 days and 

23 not later than 90 days before the date on which the 

24 pilot project required under subsection (b)(1) termi25 nates under subsection (i), the Secretary shall subVerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903

kjohnson on DSK79L0C42PROD with BILLS
10 

•S 903 IS

1 mit to the appropriate congressional committees a 

2 report and provide a briefing on recommendations 

3 relating to the pilot project, including recommenda4 tions for— 

5 (A) whether the pilot project should be 

6 modified, extended in duration, or established 

7 as a permanent program, and if so, an appro8 priate scope for the program; 

9 (B) how to attract participants, ensure a 

10 diversity of participants, and address any bar11 riers to recruitment or retention of members of 

12 the Civilian Cybersecurity Reserve; 

13 (C) the ethical requirements of the pilot 

14 project and the effectiveness of mitigation ef15 forts to address any conflict of interest con16 cerns; and 

17 (D) an evaluation of the eligibility require18 ments for the pilot project. 

19 (h) EVALUATION.—Not later than three years after 

20 the pilot project required under subsection (b)(1) is estab21 lished, the Comptroller General of the United States 

22 shall— 

23 (1) conduct a study evaluating the pilot project; 

24 and 

25 (2) submit to Congress— 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 903 IS

1 (A) a report on the results of the study; 

2 and 

3 (B) a recommendation with respect to 

4 whether the pilot project should be modified. 

5 (i) SUNSET.—The pilot project required under sub6 section (b)(1) shall terminate on the date that is four 

7 years after the date on which the pilot project is estab8 lished. 

9 (j) NO ADDITIONAL FUNDS.— 

10 (1) IN GENERAL.—No additional funds are au11 thorized to be appropriated for the purpose of car12 rying out this Act. 

13 (2) EXISTING AUTHORIZED AMOUNTS.—Funds 

14 to carry out this Act may, as provided in advance in 

15 appropriations Acts, only come from amounts au16 thorized to be appropriated to the Army. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS