U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

1 

89–010 

" ! SENATE 115th CONGRESS

2d Session 

REPORT

2018

115–385 

Calendar No. 671 

FEDERAL ROTATIONAL CYBER WORKFORCE 

PROGRAM ACT OF 2018 

R E P O R T 

OF THE

COMMITTEE ON HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

TO ACCOMPANY

S. 3437 

TO ESTABLISH A FEDERAL ROTATIONAL CYBER WORKFORCE 

PROGRAM FOR THE FEDERAL CYBER WORKFORCE 

NOVEMBER 26, 2018.—Ordered to be printed 


E:\Seals\Congress.#13
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

RON JOHNSON, Wisconsin, Chairman 

JOHN MCCAIN, Arizona 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

JAMES LANKFORD, Oklahoma 

MICHAEL B. ENZI, Wyoming 

JOHN HOEVEN, North Dakota 

STEVE DAINES, Montana 

CLAIRE MCCASKILL, Missouri 

THOMAS R. CARPER, Delaware 

HEIDI HEITKAMP, North Dakota 

GARY C. PETERS, Michigan 

MAGGIE HASSAN, New Hampshire 

KAMALA D. HARRIS, California 

DOUG JONES, Alabama 

CHRISTOPHER R. HIXON, Staff Director 

GABRIELLE D’ADAMO SINGER, Chief Counsel 

COURTNEY J. ALLEN, Deputy Chief Counsel for Governmental Affairs 

MARGARET E. DAUM, Minority Staff Director 

CHARLES A. MOSKOWITZ, Minority Senior Legislative Counsel 

JULIE G. KLEIN, Minority Professional Staff Member 

LAURA W. KILBRIDE, Chief Clerk 

Calendar No. 671 

115th Congress REPORT " ! SENATE 2nd Session 115–385 

FEDERAL ROTATIONAL CYBER WORKFORCE PROGRAM 

ACT OF 2018 

NOVEMBER 26, 2018.—Ordered to be printed 

Mr. JOHNSON, from the Committee on Homeland Security and 

Governmental Affairs, submitted the following 

R E P O R T 

[To accompany S. 3437] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Homeland Security and Governmental Affairs, 

to which was referred the bill (S. 3437) to establish a Federal rotational cyber workforce program for the Federal cyber workforce, 

having considered the same, reports favorably thereon with an 

amendment (in the nature of a substitute), and recommends that 

the bill, as amended, do pass. 

CONTENTS 

Page 

I. Purpose and Summary .................................................................................. 1 

II. Background and the Need for Legislation ................................................... 2 

III. Legislative History ......................................................................................... 4 

IV. Section-by-Section Analysis .......................................................................... 4 

V. Evaluation of Regulatory Impact .................................................................. 5 

VI. Congressional Budget Office Cost Estimate ................................................ 6 

VII. Changes in Existing Law Made by the Bill, as Reported ........................... 6 

I. PURPOSE AND SUMMARY

The purpose of S. 3437 is to create a rotational cyber workforce 

program in which Federal employees in cyber workforce positions 

can be detailed to another agency to perform cyber functions. This 

program will enable Federal cyber workforce employees to enhance 

their cyber skills with experience from executing the cyber missions 

of other agencies. 

2 

1 Gov’t Accountability Off., GAO–03–121, High-Risk Series: Protecting Information Systems 

Supporting the Federal Government and the Nation’s Critical Infrastructures 14–15 (Jan. 2003). 2 Id. 3 Gov’t Accountability Off., GAO–12–8, Cybersecurity Human Capital: Initiatives Need Better 

Planning and Coordination 20–22 (Nov. 2011). 4 Gov’t Accountability Off., GAO–17–317, High-Risk Series: Progress on Many High-Risk 

Areas, While Substantial Efforts Needed on Others 342 (Feb. 2017). 5 Federal Cybersecurity Workforce Assessment Act of 2015, Pub. L. No. 114–113, § 303, 129 

Stat. 2242, 2975, 2975–77 (2015). 6Memorandum from Mark D. Reinhold, Associate Director, Employee Services, Off. of Personnel Mgmt., to Human Resource Directors, U.S. Gov’t (Apr. 2, 2018). 7 Id. 8 Id. 9 Off. of Mgmt. and Budget, Exec. Office of the President, Delivering Government Solutions 

in the 21st Century: Reform Plan and Reorganization Recommendations 108 (June 21, 2018), 

available at https://www.performance.gov/GovReform/Reform-and-Reorg-Plan-Final.pdf. 10 Id. 

II. BACKGROUND AND THE NEED FOR LEGISLATION

Federal cyber workforce management challenges have been on 

the High-Risk List of the Government Accountability Office (GAO) 

since 2003.1 In that report, GAO stated that ‘‘agencies must have 

the technical expertise they need to select, implement, and maintain controls that protect their information systems. Similarly, the 

federal government must maximize the value of its technical staff 

by sharing expertise and information. [T]he availability of adequate 

technical and audit expertise is a continuing concern to agencies.’’ 2

In 2011, GAO reported that many Federal agencies still experienced difficulty hiring employees for more technical cyber positions 

or for positions that require other more specialized skills.3 In its 

2017 High-Risk List, GAO reported that ‘‘the federal government 

needs to expand its cyber workforce planning and training efforts. 

Federal agencies need to enhance efforts for recruiting and retaining a qualified cybersecurity workforce and improve cybersecurity 

workforce planning activities.’’ 4

The Federal Cybersecurity Workforce Assessment Act of 2015 

initiated cyber workforce planning efforts by requiring agencies to 

identify cyber positions in the Federal workforce.5 The Office of 

Personnel Management (OPM), the agency tasked with managing 

human resources of the Federal Government, issued guidance for 

Federal agencies to identify their current cyber workforce positions.6 OPM’s guidance included a deadline of April 2019 for Federal agencies to ‘‘report their greatest skill shortages; analyze the 

root cause of the shortages; and provide action plans, targets and 

measures for mitigating the critical skill shortages.’’ 7 OPM stated 

it would use these agency reports to ‘‘identify common needs to address from the Governmentwide perspective.’’ 8

On June 23, 2018, the Office of Management and Budget (OMB) 

issued a government reorganization plan for the purposes of improving efficiencies in government operations and realigning the 

structure of the Federal Government to effectuate those improvements.9 Included in the reorganization plan is a proposal to address the cyber workforce shortage in the Federal Government.10

OMB noted: 

[E]ach Federal department and agency was responsible for 

addressing its own cybersecurity workforce gaps independently, which has led to disaggregated and redundant Federal programs. As a result, the Government lacks a comprehensive, risk-derived understanding of which cybersecuVerDate Sep 11 2014 04:02 Nov 29, 2018 Jkt 089010 PO 00000 Frm 00004 Fmt 6659 Sfmt 6602 E:\HR\OC\SR385.XXX SR385
3 

11 Id. 12 Id. 13 Id. 14 Id at 109. 

rity skillsets the Federal enterprise needs to develop and 

which positions are most critical to fill. 

Moreover, the manner in which departments and agencies recruit, hire, retain, and compensate cybersecurity 

personnel varies by agency. This uneven approach has created internal competition for talent, which in turn creates 

disparities and discontinuities that degrade agencies’ ability to defend networks from malicious actors and respond 

to cyber incidents. A unified approach to attracting and retaining cybersecurity talent within the Federal Government would better support the Government’s cybersecurity 

enterprise.11

The reorganization plan calls for the establishment of a unified 

cybersecurity Federal workforce across the Government.12 In order 

to unify the cybersecurity workforce, Federal agencies are categorizing and cataloguing their cybersecurity workforces ‘‘to better understand our current set of knowledge, skills, abilities, and identify 

any gaps.’’ 13 This inventory of cybersecurity workforce positions 

will provide ‘‘Government-wide insight into where [the] most pressing needs are, and, for the first time, enable the development of an 

enterprise-wide approach to the recruitment, placement, and training of cybersecurity talent.’’ 14

This bill would complement the Federal cyber workforce initiatives begun under the Federal Cybersecurity Workforce Assessment 

Act of 2015 and the OMB reorganization plan by creating a Federal 

rotational cyber workforce program in which cyber personnel can 

detail to other agencies to help fill skills gaps for agencies’ cyberrelated functions. S. 3437 requires Federal agencies to determine 

which cyber positions should be eligible for the rotation and report 

those positions to OPM. OPM will then distribute a list of positions 

available for participation in the program to each agency. It also 

requires OPM, the Chief Human Capital Officers Council, and DHS 

to develop an operation plan for the Federal rotational cyber workforce program that establishes the procedures and requirements for 

the program, including the employee application and selection process and agency management of cyber employees participating in 

the program. 

The bill limits a cyber employee’s participation in the Federal rotational cyber workforce program to a period of 180 days, with the 

option for a 60-day extension. Once a cyber employee completes 

participation in the program, the employee is required to return to 

the Federal agency from which he or she was detailed to serve for 

a period of time that is equal in length to the period of the detail. 

The Federal rotational cyber workforce program sunsets five 

years after the date of enactment of this bill. This bill also requires 

GAO to issue a report on the program and any effect the program 

has on improving Federal employees’ cyber-related skills or on 

intra-agency and interagency coordination of cyber functions and 

personnel management. 

4 

III. LEGISLATIVE HISTORY

S. 3437 was introduced on September 12, 2018, by Senators Gary 

Peters (D–MI) and John Hoeven (R–ND). The bill was referred to 

the Committee on Homeland Security and Governmental Affairs on 

September 12, 2018. 

The Committee considered S. 3437 at a business meeting on September 26, 2018. During the business meeting, Senator Peters offered a substitute amendment that removed the program’s exemptions from the Federal Service Labor-Management Relations Statute. The substitute amendment was modified to clarify that participation in the program is not subject to collective bargaining. The 

amendment, as modified, was adopted by voice vote en bloc with 

Senators Johnson, Portman, Lankford, Enzi, Hoeven, McCaskill, 

Carper, Heitkamp, Peters, Hassan, Harris, and Jones present. 

The legislation, as amended, was passed by voice vote en bloc 

with Senators Johnson, Portman, Lankford, Enzi, Hoeven, McCaskill, Carper, Heitkamp, Peters, Hassan, Harris, and Jones present. 

IV. SECTION-BY-SECTION ANALYSIS OF THE BILL, AS REPORTED

Section 1. Short title 

This section established the short title of the bill as the ‘‘Federal 

Rotational Cyber Workforce Program Act of 2018.’’ 

Section 2. Definitions 

This section defines the terms ‘‘agency,’’ ‘‘Council,’’ ‘‘cyber workforce position,’’ ‘‘Director,’’ ‘‘employee,’’ ‘‘employing agency,’’ ‘‘rotational cyber workforce position,’’ and ‘‘rotational cyber workforce 

program.’’ 

Section 3. Rotational cyber workforce positions 

This section determines how agencies will select positions that 

are eligible for participation in the Federal rotational cyber workforce program. 

Under subsection (a), the head of an agency determines whether 

a cyber workforce position is eligible for participation in the program and submits to the OPM Director a notice of such determination. 

Subsection (b) requires the OPM Director, with assistance from 

the Chief Human Capital Officers Council and the Department of 

Homeland Security, to develop a list of rotational cyber workforce 

positions in the program and information about each position. 

Subsection (c) requires the OPM Director to distribute the list developed under subsection (b) on an annual basis to each agency. 

Section 4. Rotational cyber workforce program 

This section prescribes the development and operation of the 

Federal rotational cyber workforce program. 

Subsection (a) requires the OPM Director to consult with the 

Chief Human Capital Officers Council and the Chief Information 

Officer for the Department of Homeland Security and develop and 

issue an operation plan for the Federal rotational cyber workforce 

program. 

Subsection (b) lists requirements for the operation plan developed in subsection (a). The operation plan must identify agencies 

5 

and establish procedures for participation in the program, such as 

requirements for training, education, and career development for 

participation and any other prerequisites or other requirements to 

participate. The operation plan for the program must also include 

performance measures and other accountability measures in order 

to evaluate the program. The plan must ensure voluntary participation in the program and agency approval of any participating 

employee. The operation plan must also establish the logistics of 

detailing employees between agencies or at other agencies on a 

non-reimbursable basis, of managing employees detailed in the program, and of returning program participants to their positions in 

their employing agencies after participating in the program. 

Subsection (c) establishes the process by which employees are selected to participate in the program. An employee in a cyber workforce position must seek approval from their agency to apply for a 

rotational cyber workforce position included in the list of eligible 

program positions developed under subsection 3(b). When selecting 

participants for a rotational cyber workforce position, the agency in 

which that position is located must adhere to the merit system 

principles. The duration of a detail to a rotational cyber workforce 

position under this program is for a period of 180 days to up to 1 

year, with an option to extend this period for up to an additional 

60 days. Under this subsection, an employee participating in the 

program must enter into a written service agreement with the employing agency to complete a period of employment after participating in the program. 

Section 5. Reporting by GAO 

This section requires GAO to assess and report on the operation 

of the Federal rotational cyber workforce program and any effect 

the program has on improving employees’ cyber-related skills or on 

intra-agency and interagency coordination of cyber functions and 

personnel management. 

Section 6. Sunset 

Under this section, the Federal rotational cyber workforce program terminates five years after the date of enactment of this bill. 

V. EVALUATION OF REGULATORY IMPACT

Pursuant to the requirements of paragraph 11(b) of rule XXVI of 

the Standing Rules of the Senate, the Committee has considered 

the regulatory impact of this bill and determined that the bill will 

have no regulatory impact within the meaning of the rules. The 

Committee agrees with the Congressional Budget Office’s statement that the bill contains no intergovernmental or private-sector 

mandates as defined in the Unfunded Mandates Reform Act 

(UMRA) and would impose no costs on state, local, or tribal governments. 

6 

VI. CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

U.S. CONGRESS, 

CONGRESSIONAL BUDGET OFFICE, 

Washington, DC, October 26, 2018. 

Hon. RON JOHNSON, 

Chairman, Committee on Homeland Security and Governmental Affairs, U.S. Senate, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for S. 3437, the Federal Rotational 

Cyber Workforce Program Act of 2018. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Matthew Pickford. 

Sincerely, 

KEITH HALL, 

Director. 

Enclosure. 

S. 3437—Federal Rotational Cyber Workforce Program Act of 2018 

S. 3437 would direct the Office of Personnel Management to create policies and procedures to allow federal cybersecurity professionals to temporarily move from one agency to another for up to 

one year. The authority would expire in five years. CBO estimates 

that implementing S. 3437 would cost less than $500,000 annually 

over the 2019–2023 period for new regulations, additional staff 

training, and administrative expenses. Any spending would be subject to the availability of appropriated funds. 

Enacting S. 3437 could affect direct spending by some agencies 

(such as the Tennessee Valley Authority) because they are authorized to use receipts from the sale of goods, fees, and other collections to cover their operating costs; therefore, pay-as-you-go procedures apply. Because most of those agencies can make adjustments 

to the amounts collected, CBO estimates that any net changes in 

direct spending by those agencies would not be significant. Enacting the bill would not affect revenues. 

CBO estimates that enacting S. 3437 would not significantly increase net direct spending or on-budget deficits in any of the four 

consecutive 10-year periods beginning in 2029. 

S. 3437 contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act. 

The CBO staff contact for this estimate is Matthew Pickford. The 

estimate was reviewed by H. Samuel Papenfuss, Deputy Assistant 

Director for Budget Analysis. 

VII. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

Because S. 3437 would not repeal or amend any provision of current law, it would make no changes in existing law within the 

meaning of clauses (a) and (b) of paragraph 12 of rule XXVI of the 

Standing Rules of the Senate. 

Æ