IIB 

113TH CONGRESS 

2D SESSION H. R. 3107 

IN THE SENATE OF THE UNITED STATES 

JULY 29, 2014 

Received; read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

AN ACT 

To require the Secretary of Homeland Security to establish 

cybersecurity occupation classifications, assess the cybersecurity workforce, develop a strategy to address identified gaps in the cybersecurity workforce, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


jbell on DSK4SPTVN1PROD with BILLS
2 

HR 3107 RFS

1 SECTION 1. HOMELAND SECURITY CYBERSECURITY WORK2 FORCE. 

3 (a) IN GENERAL.—Subtitle C of title II of the Home4 land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend5 ed by adding at the end the following new section: 

6 ‘‘SEC. 226. CYBERSECURITY OCCUPATION CATEGORIES, 

7 WORKFORCE ASSESSMENT, AND STRATEGY. 

8 ‘‘(a) SHORT TITLE.—This section may be cited as the 

9 ‘Homeland Security Cybersecurity Boots-on-the-Ground 

10 Act’. 

11 ‘‘(b) CYBERSECURITY OCCUPATION CATEGORIES.— 

12 ‘‘(1) IN GENERAL.—Not later than 90 days 

13 after the date of the enactment of this section, the 

14 Secretary shall develop and issue comprehensive oc15 cupation categories for individuals performing activi16 ties in furtherance of the cybersecurity mission of 

17 the Department. 

18 ‘‘(2) APPLICABILITY.—The Secretary shall en19 sure that the comprehensive occupation categories 

20 issued under paragraph (1) are used throughout the 

21 Department and are made available to other Federal 

22 agencies. 

23 ‘‘(c) CYBERSECURITY WORKFORCE ASSESSMENT.— 

24 ‘‘(1) IN GENERAL.—Not later than 180 days 

25 after the date of the enactment of this section and 

26 annually thereafter, the Secretary shall assess the 


jbell on DSK4SPTVN1PROD with BILLS
3 

HR 3107 RFS

1 readiness and capacity of the workforce of the De2 partment to meet its cybersecurity mission. 

3 ‘‘(2) CONTENTS.—The assessment required 

4 under paragraph (1) shall, at a minimum, include 

5 the following: 

6 ‘‘(A) Information where cybersecurity posi7 tions are located within the Department, speci8 fied in accordance with the cybersecurity occu9 pation categories issued under subsection (b). 

10 ‘‘(B) Information on which cybersecurity 

11 positions are— 

12 ‘‘(i) performed by— 

13 ‘‘(I) permanent full time depart14 mental employees, together with de15 mographic information about such 

16 employees’ race, ethnicity, gender, dis17 ability status, and veterans status; 

18 ‘‘(II) individuals employed by 

19 independent contractors; and 

20 ‘‘(III) individuals employed by 

21 other Federal agencies, including the 

22 National Security Agency; and 

23 ‘‘(ii) vacant. 

24 ‘‘(C) The number of individuals hired by 

25 the Department pursuant to the authority 


jbell on DSK4SPTVN1PROD with BILLS
4 

HR 3107 RFS

1 granted to the Secretary in 2009 to permit the 

2 Secretary to fill 1,000 cybersecurity positions 

3 across the Department over a three year period, 

4 and information on what challenges, if any, 

5 were encountered with respect to the implemen6 tation of such authority. 

7 ‘‘(D) Information on vacancies within the 

8 Department’s cybersecurity supervisory work9 force, from first line supervisory positions 

10 through senior departmental cybersecurity posi11 tions. 

12 ‘‘(E) Information on the percentage of in13 dividuals within each cybersecurity occupation 

14 category who received essential training to per15 form their jobs, and in cases in which such 

16 training is not received, information on what 

17 challenges, if any, were encountered with re18 spect to the provision of such training. 

19 ‘‘(F) Information on recruiting costs in20 curred with respect to efforts to fill cybersecu21 rity positions across the Department in a man22 ner that allows for tracking of overall recruiting 

23 and identifying areas for better coordination 

24 and leveraging of resources within the Depart25 ment. 


jbell on DSK4SPTVN1PROD with BILLS
5 

HR 3107 RFS

1 ‘‘(d) WORKFORCE STRATEGY.— 

2 ‘‘(1) IN GENERAL.—Not later than 180 days 

3 after the date of the enactment of this section, the 

4 Secretary shall develop, maintain, and, as necessary, 

5 update, a comprehensive workforce strategy that en6 hances the readiness, capacity, training, recruitment, 

7 and retention of the cybersecurity workforce of the 

8 Department. 

9 ‘‘(2) CONTENTS.—The comprehensive work10 force strategy developed under paragraph (1) shall 

11 include— 

12 ‘‘(A) a multiphased recruitment plan, in13 cluding relating to experienced professionals, 

14 members of disadvantaged or underserved com15 munities, the unemployed, and veterans; 

16 ‘‘(B) a 5-year implementation plan; 

17 ‘‘(C) a 10-year projection of the Depart18 ment’s cybersecurity workforce needs; and 

19 ‘‘(D) obstacles impeding the hiring and de20 velopment of a cybersecurity workforce at the 

21 Department. 

22 ‘‘(e) INFORMATION SECURITY TRAINING.—Not later 

23 than 270 days after the date of the enactment of this sec24 tion, the Secretary shall establish and maintain a process 

25 to verify on an ongoing basis that individuals employed 


jbell on DSK4SPTVN1PROD with BILLS
6 

HR 3107 RFS

1 by independent contractors who serve in cybersecurity po2 sitions at the Department receive initial and recurrent in3 formation security training comprised of general security 

4 awareness training necessary to perform their job func5 tions, and role-based security training that is commensu6 rate with assigned responsibilities. The Secretary shall 

7 maintain documentation to ensure that training provided 

8 to an individual under this subsection meets or exceeds 

9 requirements for such individual’s job function. 

10 ‘‘(f) UPDATES.—The Secretary shall submit to the 

11 appropriate congressional committees annual updates re12 garding the cybersecurity workforce assessment required 

13 under subsection (c), information on the progress of car14 rying out the comprehensive workforce strategy developed 

15 under subsection (d), and information on the status of the 

16 implementation of the information security training re17 quired under subsection (e). 

18 ‘‘(g) GAO STUDY.—The Secretary shall provide the 

19 Comptroller General of the United States with information 

20 on the cybersecurity workforce assessment required under 

21 subsection (c) and progress on carrying out the com22 prehensive workforce strategy developed under subsection 

23 (d). The Comptroller General shall submit to the Sec24 retary and the appropriate congressional committees a 

25 study on such assessment and strategy. 


jbell on DSK4SPTVN1PROD with BILLS
7 

HR 3107 RFS

1 ‘‘(h) CYBERSECURITY FELLOWSHIP PROGRAM.—Not 

2 later than 120 days after the date of the enactment of 

3 this section, the Secretary shall submit to the appropriate 

4 congressional committees a report on the feasibility of es5 tablishing a Cybersecurity Fellowship Program to offer a 

6 tuition payment plan for undergraduate and doctoral can7 didates who agree to work for the Department for an 

8 agreed-upon period of time.’’. 

9 (b) CLERICAL AMENDMENT.—The table of contents 

10 in section 1(b) of such Act is amended by adding after 

11 the item relating to section 225 the following new item: 

‘‘Sec. 226. Cybersecurity occupation categories, workforce assessment, and 

strategy.’’. 

12 SEC. 2. PERSONNEL AUTHORITIES. 

13 (a) IN GENERAL.—Subtitle C of title II of the Home14 land Security Act of 2002, as amended by section 1 of 

15 this Act, is further amended by adding at the end the fol16 lowing new section: 

17 ‘‘SEC. 227. PERSONNEL AUTHORITIES. 

18 ‘‘(a) IN GENERAL.— 

19 ‘‘(1) PERSONNEL AUTHORITIES.—The Sec20 retary may exercise with respect to qualified employ21 ees of the Department the same authority that the 

22 Secretary of Defense has with respect to civilian in23 telligence personnel and the scholarship program 

24 under sections 1601, 1602, 1603, and 2200a of title 


jbell on DSK4SPTVN1PROD with BILLS
8 

HR 3107 RFS

1 10, United States Code, to establish as positions in 

2 the excepted service, appoint individuals to such po3 sitions, fix pay, and pay a retention bonus to any 

4 employee appointed under this section if the Sec5 retary determines that such is needed to retain es6 sential personnel. Before announcing the payment of 

7 a bonus under this paragraph, the Secretary shall 

8 submit to the Committee on Homeland Security of 

9 the House of Representatives and the Committee on 

10 Homeland Security and Governmental Affairs of the 

11 Senate a written explanation of such determination. 

12 Such authority shall be exercised— 

13 ‘‘(A) to the same extent and subject to the 

14 same conditions and limitations that the Sec15 retary of Defense may exercise such authority 

16 with respect to civilian intelligence personnel of 

17 the Department of Defense; and 

18 ‘‘(B) in a manner consistent with the merit 

19 system principles set forth in section 2301 of 

20 title 5, United States Code. 

21 ‘‘(2) CIVIL SERVICE PROTECTIONS.—Sections 

22 1221 and 2302, and chapter 75 of title 5, United 

23 States Code, shall apply to the positions established 

24 pursuant to the authorities provided under para25 graph (1). 


jbell on DSK4SPTVN1PROD with BILLS
9 

HR 3107 RFS

1 ‘‘(3) PLAN FOR EXECUTION OF AUTHORI2 TIES.—Not later than 120 days after the date of the 

3 enactment of this section, the Secretary shall submit 

4 to the Committee on Homeland Security of the 

5 House of Representatives and the Committee on 

6 Homeland Security and Governmental Affairs of the 

7 Senate a report that contains a plan for the use of 

8 the authorities provided under this subsection. 

9 ‘‘(b) ANNUAL REPORT.—Not later than one year 

10 after the date of the enactment of this section and annu11 ally thereafter for four years, the Secretary shall submit 

12 to the Committee on Homeland Security of the House of 

13 Representatives and the Committee on Homeland Security 

14 and Governmental Affairs of the Senate a detailed report 

15 (including appropriate metrics on actions occurring during 

16 the reporting period) that discusses the processes used by 

17 the Secretary in implementing this section and accepting 

18 applications, assessing candidates, ensuring adherence to 

19 veterans’ preference, and selecting applicants for vacancies 

20 to be filled by a qualified employee. 

21 ‘‘(c) DEFINITION OF QUALIFIED EMPLOYEE.—In 

22 this section, the term ‘qualified employee’ means an em23 ployee who performs functions relating to the security of 

24 Federal civilian information systems, critical infrastrucVerDate Mar 15 2010 02:49 Jul 30, 2014 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3107.RFS H3107

jbell on DSK4SPTVN1PROD with BILLS
10 

HR 3107 RFS

1 ture information systems, or networks of either of such 

2 systems.’’. 

3 (b) CLERICAL AMENDMENT.—The table of contents 

4 in section 1(b) of such Act is amended by adding after 

5 the item relating to section 226 (as added by section 1 

6 of this Act) the following new item: 

‘‘Sec. 227. Personnel authorities.’’. 

7 SEC. 3. CLARIFICATION REGARDING AUTHORIZATION OF 

8 APPROPRIATIONS. 

9 No additional amounts are authorized to be appro10 priated by reason of this Act or the amendments made 

11 by this Act. 

Passed the House of Representatives July 28, 2014. 

Attest: KAREN L. HAAS, 

Clerk. 


jbell on DSK4SPTVN1PROD with BILLS