August 2, 2017

Cybersecurity Workforce RFI

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000

Gaithersburg, MD 20899

RE: Comments of ACT | The App Association Regarding Strengthening the Cybersecurity 

of Federal Networks and Critical Infrastructure: Workforce Development (82 FR 

32172) 

In response to the National Institute of Standards and Technology’s (NIST) request for 

information as published in the Federal Register on July 12, 2017,

1 ACT | The App 

Association hereby submits comments to help assess the scope and effectiveness of efforts 

to educate and train the American cybersecurity workforce of the future, which was required 

by Executive Order 13796.2

The App Association represents 5,000 small business software application development 

companies and technology firms across the United States.3 As the world has quickly 

embraced mobile technology, our members have developed innovative, job-creating

products and services that improve workplace productivity, accelerate academic 

achievement, help people lead healthier lives, and drive the global digital economy. 

Supporting an app ecosystem worth more than $143 billion, our members’ innovations will 

continue to grow and power the rise of the internet of things (IoT).4

 

1 Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure: Workforce Development, 

82 FR 32172 (July 12, 2017).

2 Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, Exec. Order 13800, 82 FR 

22391 (May 16, 2017).

3 See http://actonline.org/about.

4 See http://actonline.org/wp-content/uploads/App_Economy_Report_2017_Digital.pdf.
2

The app economy has created employment opportunities for people in all parts of the 

country with a variety of skill sets. From engineers who code to farmers who use sensors to 

manage their crops to marketing and sales experts, white-collar and blue-collar workers 

alike are turning to the app economy. According the Bureau of Labor Statistics, the app 

economy added more than 110,000 software application developer jobs to the U.S. 

workforce between May 20145 and May 2016,6 and these jobs have a significant multiplier 

effect. For every high-tech job introduced, five additional jobs were created in local 

communities across the country.

7 These opportunities are found in rural and urban 

communities across the country; more than eight out of ten software developers live outside 

of Silicon Valley.8

For example, ProjectHosts is a company based in rural Conneautville, Pennsylvania, that 

provides secure cloud apps for healthcare and government clients. The company started 

the OnRamp Training Program to develop and train un- and underemployed members of 

the local community in cloud technology, teaching them the necessary programming skills

to be successful at the company. With limited talent available in their rural enclave, 

ProjectHosts took new avenues to train local workers to support their company’s growth, 

while providing high quality, well-paying jobs in their local community.

Despite offering a highly competitive annual salary—upwards of $102,1609for an app 

developer—the app economy is particularly starved for skilled workers with computer 

science training. At present, more than 500,000 computing jobs are unfilled,10 and by 2024, 

it is estimated more than 1 million computing jobs will be available and unfilled. Only one in 

four K-12 schools teach computer science, leaving 75 percent of American students illequipped to enter the modern workforce.

 

5

“Occupational Employment and Wages” Bureau of Labor Statistics (May 2014), available at

https://www.bls.gov/oes/2014/may/oes151132.htm. 

6 Occupational Employment and Wages,” Bureau of Labor Statistics (May 2016), available at

https://www.bls.gov/oes/current/oes151132.htm. 

7

“Multiplier Effects: Connecting the Innovation and Opportunity Agendas,” Brookings Institute (August 23, 

2012), available at https://www.brookings.edu/blog/the-avenue/2012/08/23/multiplier-effects-connectingthe-innovation-and-opportunity-agendas/. 

8

“Six-Figure Tech Salaries: Creating the Next Developer Workforce,” ACT | The App Association (August 2, 

2016), available at

http://www.arcgis.com/apps/MapJournal/index.html?appid=b1c59eaadfd945a68a59724a59dbf7b1.

9

“Occupational Employment and Wages, May 2016: 15-1132 Software Developers, Applications,” Bureau of 

Labor Statistics (March 31, 2017), available at https://www.bls.gov/oes/current/oes151132.htm. 

10 “Code.org 2016 Annual Report,” Code.org (February 9, 2017), available at https://code.org/about/2016. 
3

Per a study by the Center for Strategic and International Studies, the United States needs 

between 10,000 to 30,000 cybersecurity specialists to effectively address cybersecurity 

issues;

11 however, there are only about 1,000 security specialists in the United States with

specialized skills to operate effectively in cyberspace. Our dynamic, internet-enabled world 

carries a growing threat of cyber-attacks, and American workers and students must be 

prepared to engage in the digital economy in a safe and secure way. 

All sectors of the U.S. economy increasingly depend on a workforce equipped with 

computer science skills; therefore, the growing scarcity of workers with computer science

skills is placing America’s global leadership in peril and undermining our country’s national 

security. The App Association strongly urges the U.S. government to take steps to provide 

our current and future workforce with the necessary skillset to succeed in the jobs that will 

drive our economic development and protect our national security.

The App Association is committed to the development of a competitive American 

workforce and is a founding member of the Computer Science Education Coalition

(CSEC).

12 The nonprofit organization is comprised of businesses and NGOs focused on 

securing federal funds to provide computer science education for all K-12 students. The 

CSEC has urged Congress to provide $250 million in federal funding for K-12 computer 

science education to prepare American students to fill critical jobs and support U.S. global 

competitiveness. The federal funds would complement computer science projects 

undertaken at the state-level, and we encourage the Administration to join the CSEC in a 

public-private partnership supporting the development of a skilled workforce.

Separately, the App Association has observed widespread confusion and misalignment in 

the public and private sectors regarding workforce categories, specialty areas, work roles, 

and skill sets. Cybersecurity threats, and the skills needed to combat them, are constantly 

in flux, and the education and workforce programs needed to address them differ between 

public, private, government, and educational initiatives. We encourage the U.S. 

government, in partnership with NIST, industry, and public stakeholders, to provide a 

framework for these programs. Guidance that is clear and not overly-prescriptive is a 

welcome step forward.

 

11 Karen Evans and Franklin Reeder, “A Human Capital Crisis in Cybersecurity,” Center for Strategic and 

International Studies. https://www.csis.org/analysis/human-capital-crisis-cybersecurity

12 See http://www.csecoalition.org/. 
4

Currently, cybersecurity professionals have access to a wide variety of valuable education 

programs to keep them up to date on the latest cybersecurity trends and certifications.

Unfortunately, these programs are often prohibitively expensive, creating a barrier for small 

businesses and their employees. The App Association believes market effects should 

define the success of certification programs, and strongly discourages the development of 

a cybersecurity workforce that endorses a particular third party certification program.

Cybersecurity professionals, particularly those in small businesses, should have the 

flexibility to utilize certifications to build their expertise in any, and all, areas of data security.

Following the growing need for cybersecurity professionals, universities are increasingly 

offering degrees in cybersecurity disciplines, but it is not currently known how wellingrained cybersecurity is into computer science curricula across colleges and universities.

While the effectiveness of these programs is often masked by changes in the cybersecurity 

field, we believe the U.S. government should support the university-level development of a 

U.S. cybersecurity workforce curriculum across classes (as opposed to standalone

classes). As a first step towards assisting in this way, we strongly urge the U.S.

government to evaluate how much and to what degree cybersecurity training is

incorporated into these curricula.

Similarly, cybersecurity education programs within public and private sectors also vary in 

type and effectiveness. There is currently no standard, scalable training, education, or

awareness program for the cybersecurity discipline. As a result, industry groups offer their 

own solutions to this challenge,

13 and we appreciate the U.S. government’s support for

cybersecurity education efforts through grants and public-private partnerships.

We have witnessed firsthand that cybersecurity professionals must be well-versed in wide 

range of technologies and potential risk vectors, including industry specific skills such as 

supervisory control and data acquisition, or SCADA, (industrial controls) in the energy 

industry, or blockchain in the financial industry. We urge the U.S. government to help 

employers invest in the education and training of their current cybersecurity workforce and 

to utilize innovative programs, such as apprenticeships, to build the future workforce.

As IoT, cloud-based services, and cognitive computing play an increasingly vital role in our 

world, the demand for skilled cybersecurity professionals will steadily rise. While artificial 

intelligence and cognitive computing will greatly assist cybersecurity professionals in 

predicting and responding to cyberattacks, these technologies will bring their own 

vulnerabilities that will need to be addressed by security and data professionals.

 

1313 E.g., Microsoft’s Virtual Academy, available at https://mva.microsoft.com/training-topics/enterprise-security.
5

The App Association appreciates the opportunity to submit these comments regarding the 

development of a competitive and robust U.S. cybersecurity workforce, and we commit to 

work with all stakeholders to achieve this goal.

Sincerely,

Brian Scarpelli

Senior Policy Counsel

Joel Thayer

Associate Policy Counsel

ACT | The App Association

1401 K St NW (Suite 501)

Washington, District of Columbia 20005