Federal Cybersecurity Workforce Expansion Act
Bill: H.R.5138 | Sponsor: Rep. Houlahan, Chrissy (D-PA)
Policy area: Government Operations and Politics

Summary:
Federal Cybersecurity Workforce Expansion Act
This bill establishes an apprenticeship program and a pilot program on cybersecurity.
The Cybersecurity and Infrastructure Agency may establish one or more apprenticeship programs that leads directly to employment in
The Department of Veterans Affairs (VA) shall establish a pilot program under which the VA shall provide cyber-specific training for members of the Armed Forces transitioning from service in the Armed Forces to civilian life and for veterans.
The bill extends through FY2025 the submission of a report on an assessment that identifies information technology, cybersecurity, or other cyber-related work roles of critical need in the workforce of federal agencies.

To authorize the Director of the Cybersecurity and Infrastructure 
Security Agency to establish an apprenticeship program and to establish 
 a pilot program on cybersecurity training for veterans and members of 
    the Armed Forces transitioning to civilian life, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Federal Cybersecurity Workforce 
Expansion Act''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the need for qualified cybersecurity personnel is 
        greater than ever, as demonstrated by the recent SolarWinds 
        breach and the growing spate of ransomware attacks on critical 
        infrastructure entities and State and local governments;
            (2) the Federal Government is facing a shortage of 
        qualified cybersecurity personnel, as noted in a March 2019 
        Government Accountability Office report on critical staffing 
        needs in the Federal cybersecurity workforce;
            (3) there is a national shortage of qualified cybersecurity 
        personnel, and according to CyberSeek, a project supported by 
        the National Initiative for Cybersecurity Education within the 
        National Institute of Standards and Technology, there are 
        approximately 500,000 cybersecurity job openings around the 
        United States;
            (4) in May 2021, the Department of Homeland Security 
        announced that the Department was initiating a 60-day sprint to 
        hire 200 cybersecurity personnel across the Department, with 
        100 of those hires for the Cybersecurity and Infrastructure 
        Security Agency, to address a cybersecurity workforce shortage; 
        and
            (5) the Federal Government needs to--
                    (A) expand the cybersecurity workforce pipeline of 
                the Federal Government to sustainably close a Federal 
                cybersecurity workforce shortage; and
                    (B) work cooperatively with the private sector and 
                State and local government authorities to expand 
                opportunities for new cybersecurity professionals.

SEC. 3. CYBERSECURITY AND INFRASTRUCTURE SECURITY APPRENTICESHIP 
              PROGRAM.

    Subtitle A of title XXII of the Homeland Security Act of 2002 (6 
U.S.C. 651 et seq.) is amended by adding at the end the following:

``SEC. 2220A. APPRENTICESHIP PROGRAM.

    ``(a) Definitions.--In this section:
            ``(1) Area career and technical education school.--The term 
        `area career and technical education school' has the meaning 
        given the term in section 3 of the Carl D. Perkins Career and 
        Technical Education Act of 2006 (20 U.S.C. 2302).
            ``(2) Community college.--The term `community college' 
        means a public institution of higher education at which the 
        highest degree that is predominantly awarded to students is an 
        associate's degree, including--
                    ``(A) a 2-year Tribal College or University, as 
                defined in section 316 of the Higher Education Act of 
                1965 (20 U.S.C. 1059c); and
                    ``(B) a public 2-year State institution of higher 
                education.
            ``(3) Cybersecurity work roles.--The term `cybersecurity 
        work roles' means the work roles outlined in the National 
        Initiative for Cybersecurity Education Cybersecurity Workforce 
        Framework (NIST Special Publication 800-181), or any successor 
        framework.
            ``(4) Education and training provider.--The term `education 
        and training provider' means--
                    ``(A) an area career and technical education 
                school;
                    ``(B) an early college high school;
                    ``(C) an educational service agency;
                    ``(D) a high school;
                    ``(E) a local educational agency or State 
                educational agency;
                    ``(F) a Tribal educational agency, Tribally 
                controlled college or university, or Tribally 
                controlled postsecondary career and technical 
                institution;
                    ``(G) a postsecondary educational institution;
                    ``(H) a minority-serving institution;
                    ``(I) a provider of adult education and literacy 
                activities under the Adult Education and Family 
                Literacy Act (29 U.S.C. 3271 et seq.);
                    ``(J) a local agency administering plans under 
                title I of the Rehabilitation Act of 1973 (29 U.S.C. 
                720 et seq.), other than section 112 or part C of that 
                title (29 U.S.C. 732, 741);
                    ``(K) a related instruction provider, including a 
                qualified intermediary acting as a related instruction 
                provider as approved by a registration agency;
                    ``(L) a Job Corps center, as defined in section 142 
                of the Workforce Innovation and Opportunity Act (29 
                U.S.C. 3192); or
                    ``(M) a consortium of entities described in any of 
                subparagraphs (A) through (L).
            ``(5) Eligible entity.--
                    ``(A) In general.--The term `eligible entity' 
                means--
                            ``(i) a program sponsor;
                            ``(ii) a State workforce development board 
                        or State workforce agency, or a local workforce 
                        development board or local workforce 
                        development agency;
                            ``(iii) an education and training provider;
                            ``(iv) if the applicant is in a State with 
                        a State apprenticeship agency, such State 
                        apprenticeship agency;
                            ``(v) an Indian Tribe or Tribal 
                        organization;
                            ``(vi) an industry or sector partnership, a 
                        group of employers, a trade association, or a 
                        professional association that sponsors or 
                        participates in a program under the national 
                        apprenticeship system;
                            ``(vii) a Governor of a State;
                            ``(viii) a labor organization or joint 
                        labor-management organization; or
                            ``(ix) a qualified intermediary.
                    ``(B) Sponsor requirement.--Not fewer than 1 entity 
                described in subparagraph (A) shall be the sponsor of a 
                program under the national apprenticeship system.
            ``(6) Institution of higher education.--The term 
        `institution of higher education' has the meaning given the 
        term in section 101 of the Higher Education Act of 1965 (20 
        U.S.C. 1001).
            ``(7) Local educational agency; secondary school.--The 
        terms `local educational agency' and `secondary school' have 
        the meanings given those terms in section 8101 of the 
        Elementary and Secondary Education Act of 1965 (20 U.S.C. 
        7801).
            ``(8) Local workforce development board.--The term `local 
        workforce development board' has the meaning given the term 
        `local board' in section 3 of the Workforce Innovation and 
        Opportunity Act (29 U.S.C. 3102).
            ``(9) Nonprofit organization.--The term `nonprofit 
        organization' means an organization that is described in 
        section 501(c) of the Internal Revenue Code of 1986 and exempt 
        from taxation under section 501(a) of such Code.
            ``(10) Provider of adult education.--The term `provider of 
        adult education' has the meaning given the term `eligible 
        provider' in section 203 of the Adult Education and Family 
        Literacy Act (29 U.S.C. 3272).
            ``(11) Related instruction.--The term `related instruction' 
        means an organized and systematic form of instruction designed 
        to provide an individual in an apprenticeship program with the 
        knowledge of the technical subjects related to the intended 
        occupation of the individual after completion of the program.
            ``(12) Sponsor.--The term `sponsor' means any person, 
        association, committee, or organization operating an 
        apprenticeship program and in whose name the program is, or is 
        to be, registered or approved.
            ``(13) State apprenticeship agency.--The term `State 
        apprenticeship agency' has the meaning given the term in 
        section 29.2 of title 29, Code of Federal Regulations, or any 
        corresponding similar regulation or ruling.
            ``(14) State workforce development board.--The term `State 
        workforce development board' has the meaning given the term 
        `State board' in section 3 of the Workforce Innovation and 
        Opportunity Act (29 U.S.C. 3102).
            ``(15) WIOA terms.--The terms `career planning', 
        `community-based organization', `economic development agency', 
        `industry or sector partnership', `on-the-job training', 
        `recognized postsecondary credential', and `workplace learning 
        advisor' have the meanings given those terms in section 3 of 
        the Workforce Innovation and Opportunity Act (29 U.S.C. 3102).
            ``(16) Qualified intermediary.--
                    ``(A) In general.--The term `qualified 
                intermediary' means an entity that demonstrates 
                expertise in building, connecting, sustaining, and 
                measuring the performance of partnerships described in 
                subparagraph (B) and serves program participants and 
                employers by--
                            ``(i) connecting employers to programs 
                        under the national apprenticeship system;
                            ``(ii) assisting in the design and 
                        implementation of such programs, including 
                        curriculum development and delivery for related 
                        instruction;
                            ``(iii) supporting entities, sponsors, or 
                        program administrators in meeting the 
                        registration and reporting requirements of this 
                        Act;
                            ``(iv) providing professional development 
                        activities such as training to mentors;
                            ``(v) supporting the recruitment, 
                        retention, and completion of potential program 
                        participants, including nontraditional 
                        apprenticeship populations and individuals with 
                        barriers to employment;
                            ``(vi) developing and providing 
                        personalized program participant supports, 
                        including by partnering with organizations to 
                        provide access to or referrals for supportive 
                        services and financial advising;
                            ``(vii) providing services, resources, and 
                        supports for development, delivery, expansion, 
                        or improvement of programs under the national 
                        apprenticeship system; or
                            ``(viii) serving as a program sponsor.
                    ``(B) Partnerships.--The term `partnerships 
                described in subparagraph (B)' means partnerships among 
                entities involved in, or applying to participate in, 
                programs under the national apprenticeship system, 
                including--
                            ``(i) industry or sector partnerships;
                            ``(ii) partnerships among employers, joint 
                        labor-management organizations, labor 
                        organizations, community-based organizations, 
                        industry associations, State or local workforce 
                        development boards, education and training 
                        providers, social service organizations, 
                        economic development organizations, Indian 
                        Tribes or Tribal organizations, one-stop 
                        operators, one-stop partners, or veterans 
                        service organizations in the State workforce 
                        development system; or
                            ``(iii) partnerships among 1 or more of the 
                        entities described in clauses (i) and (ii).
    ``(b) Establishment of Apprenticeship Programs.--Not later than 2 
years after the date of enactment of this section, the Director may 
establish 1 or more apprenticeship programs as described in subsection 
(c).
    ``(c) Apprenticeship Programs Described.--An apprenticeship program 
described in this subsection is an apprenticeship program that--
            ``(1) leads directly to employment in--
                    ``(A) a cybersecurity work role with the Agency; or
                    ``(B) a position with a company or other entity 
                provided that the position is--
                            ``(i) certified by the Director as 
                        contributing to the national cybersecurity of 
                        the United States; and
                            ``(ii) funded at least in majority part 
                        through a contract, grant, or cooperative 
                        agreement with the Agency;
            ``(2) is focused on competencies and related learning 
        necessary, as determined by the Director, to meet the immediate 
        and ongoing needs of cybersecurity work roles at the Agency; 
        and
            ``(3) is registered with and approved by the Office of 
        Apprenticeship of the Department of Labor or a State 
        apprenticeship agency pursuant to the Act of August 16, 1937 
        (commonly known as the `National Apprenticeship Act'; 29 U.S.C. 
        50 et seq.).
    ``(d) Coordination.--In the development of an apprenticeships 
program under this section, the Director shall consult with the 
Secretary of Labor, the Director of the National Institute of Standards 
and Technology, the Secretary of Defense, the Director of the National 
Science Foundation, and the Director of the Office of Personnel 
Management to leverage existing resources, research, communities of 
practice, and frameworks for developing cybersecurity apprenticeship 
programs.
    ``(e) Optional Use of Grants or Cooperative Agreements.--An 
apprenticeship program under this section may include entering into a 
contract or cooperative agreement with or making a grant to an eligible 
entity if determined appropriate by the Director based on the eligible 
entity--
            ``(1) demonstrating experience in implementing and 
        providing career planning and career pathways toward 
        apprenticeship programs;
            ``(2) having knowledge of cybersecurity workforce 
        development;
            ``(3) being eligible to enter into a contract or 
        cooperative agreement with or receive grant funds from the 
        Agency as described in this section;
            ``(4) providing students who complete the apprenticeship 
        program with a recognized postsecondary credential;
            ``(5) using related instruction that is specifically 
        aligned with the needs of the Agency and utilizes workplace 
        learning advisors and on-the-job training to the greatest 
        extent possible; and
            ``(6) demonstrating successful outcomes connecting 
        graduates of the apprenticeship program to careers relevant to 
        the program.
    ``(f) Applications.--If the Director enters into an arrangement as 
described in subsection (e), an eligible entity seeking a contract, 
cooperative agreement, or grant under the program shall submit to the 
Director an application at such time, in such manner, and containing 
such information as the Director may require.
    ``(g) Priority.--In selecting eligible entities to receive a 
contract, grant, or cooperative agreement under this section, the 
Director may prioritize an eligible entity that--
            ``(1) is a member of an industry or sector partnership;
            ``(2) provides related instruction for an apprenticeship 
        program through--
                    ``(A) a local educational agency, a secondary 
                school, a provider of adult education, an area career 
                and technical education school, or an institution of 
                higher education; or
                    ``(B) an apprenticeship program that was registered 
                with the Department of Labor or a State apprenticeship 
                agency before the date on which the eligible entity 
                applies for the grant under subsection (g);
            ``(3) works with the Secretary of Defense, the Secretary of 
        Veterans Affairs, or veterans organizations to transition 
        members of the Armed Forces and veterans to apprenticeship 
        programs in a relevant sector; or
            ``(4) plans to use the grant to carry out the 
        apprenticeship program with an entity that receives State 
        funding or is operated by a State agency.
    ``(h) Technical Assistance.--The Director shall provide technical 
assistance to eligible entities to leverage the existing job training 
and education programs of the Agency and other relevant programs at 
appropriate Federal agencies.
    ``(i) Excepted Service.--Participants in the program may be entered 
into cybersecurity-specific excepted service positions as determined 
appropriate by the Director and authorized by section 2208.
    ``(j) Report.--
            ``(1) In general.--Not less than once every 2 years after 
        the establishment of an apprenticeship program under this 
        section, the Director shall submit to Congress a report on the 
        program, including--
                    ``(A) a description of--
                            ``(i) any activity carried out by the 
                        Agency under this section;
                            ``(ii) any entity that enters into a 
                        contract or agreement with or receives a grant 
                        from the Agency under subsection (e);
                            ``(iii) any activity carried out using a 
                        contract, agreement, or grant under this 
                        section as described in subsection (e); and
                            ``(iv) best practices used to leverage the 
                        investment of the Federal Government under this 
                        section; and
                    ``(B) an assessment of the results achieved by the 
                program, including the rate of continued employment at 
                the Agency for participants after completing an 
                apprenticeship program carried out under this section.
    ``(k) Performance Reports.--Not later than 1 year after the 
establishment of an apprenticeship program under this section, and 
annually thereafter, the Director shall submit to Congress and the 
Secretary of Labor a report on the effectiveness of the program based 
on the accountability measures described in clauses (i) and (ii) of 
section 116(b)(2)(A) of the Workforce Innovation and Opportunity Act 
(29 U.S.C. 3141(b)(2)(A)).
    ``(l) Authorization of Appropriations.--There is authorized to be 
appropriated to the Agency such sums as necessary to carry out this 
section.''.

SEC. 4. PILOT PROGRAM ON CYBER TRAINING FOR VETERANS AND MEMBERS OF THE 
              ARMED FORCES TRANSITIONING TO CIVILIAN LIFE.

    (a) Definitions.--In this section:
            (1) Eligible individual.--The term ``eligible individual'' 
        means an individual who is--
                    (A) a member of the Armed Forces transitioning from 
                service in the Armed Forces to civilian life; or
                    (B) a veteran.
            (2) Portable credential.--The term ``portable 
        credential''--
                    (A) means a documented award by a responsible and 
                authorized entity that has determined that an 
                individual has achieved specific learning outcomes 
                relative to a given standard; and
                    (B) includes a degree, diploma, license, 
                certificate, badge, and professional or industry 
                certification that--
                            (i) has value locally and nationally in 
                        labor markets, educational systems, or other 
                        contexts;
                            (ii) is defined publicly in such a way that 
                        allows educators, employers, and other 
                        individuals and entities to understand and 
                        verify the full set of skills represented by 
                        the credential; and
                            (iii) enables a holder of the credential to 
                        move vertically and horizontally within and 
                        across training and education systems for the 
                        attainment of other credentials.
            (3) Veteran.--The term ``veteran'' has the meaning given 
        the term in section 101 of title 31, United States Code.
            (4) Work-based learning.--The term ``work-based learning'' 
        has the meaning given the term in section 3 of the Carl D. 
        Perkins Career and Technical Education Act of 2006 (20 U.S.C. 
        2302).
    (b) Establishment.--Not later than 1 year after the date of 
enactment of this Act, the Secretary of Veterans Affairs shall 
establish a pilot program under which the Secretary shall provide 
cyber-specific training for eligible individuals.
    (c) Elements.--The pilot program established under subsection (b) 
shall incorporate--
            (1) virtual platforms for coursework and training;
            (2) hands-on skills labs and assessments;
            (3) Federal work-based learning opportunities and programs; 
        and
            (4) the provision of portable credentials to eligible 
        individuals who graduate from the pilot program.
    (d) Alignment With NICE Workforce Framework for Cybersecurity.--The 
pilot program established under subsection (b) shall align with the 
taxonomy, including work roles and associated tasks, knowledge, and 
skills, from the National Initiative for Cybersecurity Education 
Workforce Framework for Cybersecurity (NIST Special Publication 800-
181), or any successor framework.
    (e) Coordination.--
            (1) Training, platforms, and frameworks.--In developing the 
        pilot program under subsection (b), the Secretary of Veterans 
        Affairs shall coordinate with the Secretary of Defense, the 
        Secretary of Homeland Security, the Secretary of Labor, and the 
        Director of the Office of Personnel Management to evaluate and, 
        where possible, leverage existing training, platforms, and 
        frameworks of the Federal Government for providing cyber 
        education and training to prevent duplication of efforts.
            (2) Federal work-based learning opportunities and 
        programs.--In developing the Federal work-based learning 
        opportunities and programs required under subsection (c)(3), 
        the Secretary of Veterans Affairs shall coordinate with the 
        Secretary of Defense, the Secretary of Homeland Security, the 
        Secretary of Labor, the Director of the Office of Personnel 
        Management, and the heads of other appropriate Federal agencies 
        to identify or create interagency opportunities that will 
        enable the pilot program established under subsection (b) to--
                    (A) bridge the gap between knowledge acquisition 
                and skills application for participants; and
                    (B) give participants the experience necessary to 
                pursue Federal employment.
    (f) Resources.--
            (1) In general.--In any case in which the pilot program 
        established under subsection (b)--
                    (A) uses a program of the Department of Veterans 
                Affairs or platforms and frameworks described in 
                subsection (e)(1), the Secretary of Veterans Affairs 
                shall take such actions as may be necessary to ensure 
                that those programs, platforms, and frameworks are 
                expanded and resourced to accommodate usage by eligible 
                individuals participating in the pilot program; or
                    (B) does not use a program of the Department of 
                Veterans Affairs or platforms and frameworks described 
                in subsection (e)(1), the Secretary of Veterans Affairs 
                shall take such actions as may be necessary to develop 
                or procure programs, platforms, and frameworks 
                necessary to carry out the requirements of subsection 
                (c) and accommodate the usage by eligible individuals 
                participating in the pilot program.
            (2) Actions.--Actions described in paragraph (1) may 
        include providing additional funding, staff, or other resources 
        to--
                    (A) provide administrative support for basic 
                functions of the pilot program;
                    (B) ensure the success and ongoing engagement of 
                eligible individuals participating in the pilot 
                program;
                    (C) connect graduates of the pilot program to job 
                opportunities within the Federal Government; and
                    (D) allocate dedicated positions for term 
                employment to enable Federal work-based learning 
                opportunities and programs for participants to gain the 
                experience necessary to pursue permanent Federal 
                employment.

SEC. 5. FEDERAL WORKFORCE ASSESSMENT EXTENSION.

    Section 304(a) of the Federal Cybersecurity Workforce Assessment 
Act of 2015 (5 U.S.C. 301 note) is amended, in the matter preceding 
paragraph (1), by striking ``2022'' and inserting ``2025''.

SEC. 6. TITLE XXII TECHNICAL AND CLERICAL AMENDMENTS.

    (a) Technical Amendments.--
            (1) Homeland security act of 2002.--Subtitle A of title 
        XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et 
        seq.) is amended--
                    (A) in the first section 2215 (6 U.S.C. 665; 
                relating to the duties and authorities relating to .gov 
                internet domain), by amending the section enumerator 
                and heading to read as follows:

``SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV INTERNET 
              DOMAIN.'';

                    (B) in the second section 2215 (6 U.S.C. 665b; 
                relating to the joint cyber planning office), by 
                amending the section enumerator and heading to read as 
                follows:

``SEC. 2216. JOINT CYBER PLANNING OFFICE.'';

                    (C) in the third section 2215 (6 U.S.C. 665c; 
                relating to the Cybersecurity State Coordinator), by 
                amending the section enumerator and heading to read as 
                follows:

``SEC. 2217. CYBERSECURITY STATE COORDINATOR.'';

                    (D) in the fourth section 2215 (6 U.S.C. 665d; 
                relating to Sector Risk Management Agencies), by 
                amending the section enumerator and heading to read as 
                follows:

``SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.'';

                    (E) in section 2216 (6 U.S.C. 665e; relating to the 
                Cybersecurity Advisory Committee), by amending the 
                section enumerator and heading to read as follows:

``SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.'';

                and
                    (F) in section 2217 (6 U.S.C. 665f; relating to 
                Cybersecurity Education and Training Programs), by 
                amending the section enumerator and heading to read as 
                follows:

``SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING PROGRAMS.''.

            (2) Consolidated appropriations act, 2021.--Paragraph (1) 
        of section 904(b) of division U of the Consolidated 
        Appropriations Act, 2021 (Public Law 116-260) is amended, in 
        the matter preceding subparagraph (A), by inserting ``of 2002'' 
        after ``Homeland Security Act''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
the Homeland Security Act of 2002 is amended by striking the items 
relating to sections 2214 through 2217 and inserting the following new 
items:

``Sec. 2214. National Asset Database.
``Sec. 2215. Duties and authorities relating to .gov internet domain.
``Sec. 2216. Joint cyber planning office.
``Sec. 2217. Cybersecurity State Coordinator.
``Sec. 2218. Sector Risk Management Agencies.
``Sec. 2219. Cybersecurity Advisory Committee.
``Sec. 2220. Cybersecurity Education and Training Programs.
``Sec. 2220A. Apprenticeship program.''.
                                 <all>