II 

113TH CONGRESS 

2D SESSION S. 2372 

To provide additional oversight and guidance to the Department of Homeland 

Security. 

IN THE SENATE OF THE UNITED STATES 

MAY 21, 2014 

Mr. BENNET (for himself and Mr. PORTMAN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To provide additional oversight and guidance to the 

Department of Homeland Security. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Cybersecurity 

5 Workforce Assessment Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) APPROPRIATE CONGRESSIONAL COMMIT9 TEES.—The term ‘‘appropriate congressional com10 mittees’’ means— 


smartinez on DSK6TPTVN1PROD with BILLS
2 

•S 2372 IS

1 (A) the Committee on Homeland Security 

2 and Governmental Affairs of the Senate; 

3 (B) the Committee on Homeland Security 

4 of the House of Representatives; and 

5 (C) the Committee on House Administra6 tion of the House of Representatives. 

7 (2) CYBERSECURITY WORK CATEGORY; DATA

8 ELEMENT CODE; SPECIALTY AREA.—The terms ‘‘Cy9 bersecurity Work Category’’, ‘‘Data Element Code’’, 

10 and ‘‘Specialty Area’’ have the meanings given such 

11 terms in the Office of Personnel Management’s 

12 Guide to Data Standards. 

13 (3) DIRECTOR.—The term ‘‘Director’’ means 

14 the Director of the Office of Personnel Management. 

15 (4) SECRETARY.—The term ‘‘Secretary’’ means 

16 the Secretary of Homeland Security. 

17 SEC. 3. NATIONAL CYBERSECURITY WORKFORCE MEAS18 UREMENT INITIATIVE. 

19 (a) IN GENERAL.—The head of each Federal agency 

20 shall— 

21 (1) identify all cybersecurity workforce positions 

22 within the agency; 

23 (2) determine the primary Cybersecurity Work 

24 Category and Specialty Area of such positions; and 


smartinez on DSK6TPTVN1PROD with BILLS
3 

•S 2372 IS

1 (3) assign the corresponding Data Element 

2 Code, as set forth in the Office of Personnel Man3 agement’s Guide to Data Standards which is aligned 

4 with the National Initiative for Cybersecurity Edu5 cation’s National Cybersecurity Workforce Frame6 work report, in accordance with subsection (b). 

7 (b) EMPLOYMENT CODES.— 

8 (1) PROCEDURES.—Not later than 90 days 

9 after the date of the enactment of this Act, the head 

10 of each Federal agency shall establish procedures— 

11 (A) to identify open positions that include 

12 cybersecurity functions (as defined in the OPM 

13 Guide to Data Standards); and 

14 (B) to assign the appropriate employment 

15 code to each such position, using agreed stand16 ards and definitions. 

17 (2) CODE ASSIGNMENTS.—Not later than 9 

18 months after the date of the enactment of this Act, 

19 the head of each Federal agency shall assign the ap20 propriate employment code to— 

21 (A) each employee within the agency who 

22 carries out cybersecurity functions; and 

23 (B) each open position within the agency 

24 that has been identified as having cybersecurity 

25 functions. 


smartinez on DSK6TPTVN1PROD with BILLS
4 

•S 2372 IS

1 (c) PROGRESS REPORT.—Not later than 1 year after 

2 the date of the enactment of this Act, the Director shall 

3 submit a progress report on the implementation of this 

4 section to the appropriate congressional committees. 

5 SEC. 4. IDENTIFICATION OF CYBERSECURITY WORK CAT6 EGORY AND SPECIALTY AREAS OF CRITICAL 

7 NEED. 

8 (a) IN GENERAL.—Beginning not later than 1 year 

9 after the date on which the employment codes are assigned 

10 to employees pursuant to section 3(b)(2), and annually 

11 through 2021, the head of each Federal agency, in con12 sultation with the Director and the Secretary, shall— 

13 (1) identify Cybersecurity Work Categories and 

14 Specialty Areas of critical need in the agency’s cy15 bersecurity workforce; and 

16 (2) submit a report to the Director that— 

17 (A) describes the Cybersecurity Work Cat18 egories and Specialty Areas identified under 

19 paragraph (1); and 

20 (B) substantiates the critical need designa21 tions. 

22 (b) GUIDANCE.—The Director shall provide Federal 

23 agencies with timely guidance for identifying Cybersecu24 rity Work Categories and Specialty Areas of critical need, 

25 including— 


smartinez on DSK6TPTVN1PROD with BILLS
5 

•S 2372 IS

1 (1) current Cybersecurity Work Categories and 

2 Specialty Areas with acute skill shortages; and 

3 (2) Cybersecurity Work Categories and Spe4 cialty Areas with emerging skill shortages. 

5 (c) CYBERSECURITY CRITICAL NEEDS REPORT.— 

6 Not later than 18 months after the date of the enactment 

7 of this Act, the Director, in consultation with the Sec8 retary, shall— 

9 (1) identify Specialty Areas of critical need for 

10 cybersecurity workforce across all Federal agencies; 

11 and 

12 (2) submit a progress report on the implemen13 tation of this section to the appropriate congres14 sional committees. 

15 SEC. 5. GOVERNMENT ACCOUNTABILITY OFFICE STATUS 

16 REPORTS. 

17 The Comptroller General of the United States shall— 

18 (1) analyze and monitor the implementation of 

19 sections 3 and 4; and 

20 (2) not later than 3 years after the date of the 

21 enactment of this Act, submit a report to the appro22 priate congressional committees that describes the 

23 status of such implementation. 

Æ 


smartinez on DSK6TPTVN1PROD with BILLS