Title: Civilian Cybersecurity Reserve Act
Policy area: Government Operations and Politics

Summary:
Civilian Cyber Security Reserve Act
This bill authorizes the Department of Homeland Security and the Department of Defense to each create a temporary Civilian Cyber Security Reserve within their agencies to address U.S. cybersecurity needs with respect to national security.
Reserve members must be former federal employees or former military personnel, have cybersecurity expertise, and obtain any necessary security clearances, in addition to any other criteria specified by each agency. Membership in the reserves is contingent on a mutual agreement between the agency and the individual. Reserves may consist of different components, with one component obligated to respond to a call to activation and the other not obligated to do so; each agency may establish penalties for those individuals who fail to respond when required.
The Government Accountability Office and each agency must evaluate and report on the reserves, including whether they should be made permanent.

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 1324 Introduced in Senate (IS)]

<DOC>






117th CONGRESS
  1st Session
                                S. 1324

 To establish a Civilian Cyber Security Reserve as a pilot project to 
 address the cyber security needs of the United States with respect to 
               national security, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             April 22, 2021

  Ms. Rosen (for herself and Mrs. Blackburn) introduced the following 
 bill; which was read twice and referred to the Committee on Homeland 
                   Security and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
 To establish a Civilian Cyber Security Reserve as a pilot project to 
 address the cyber security needs of the United States with respect to 
               national security, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Civilian Cyber Security Reserve 
Act''.

SEC. 2. CIVILIAN CYBER SECURITY RESERVE PILOT PROJECT.

    (a) Definitions.--In this section:
            (1) Appropriate agency head.--The term ``appropriate agency 
        head'' means--
                    (A) in the case of the Department of Homeland 
                Security, the Secretary of Homeland Security; and
                    (B) in the case of the Department of Defense, the 
                Secretary of Defense.
            (2) Competitive service.--The term ``competitive service'' 
        has the meaning given the term in section 2102 of title 5, 
        United States Code.
            (3) Covered agency.--The term ``covered agency'' means the 
        Department of Homeland Security or the Department of Defense.
            (4) Excepted service.--The term ``excepted service'' has 
        the meaning given the term in section 2103 of title 5, United 
        States Code.
            (5) Temporary.--The term ``temporary'' means a period of 
        not more than 6 months.
            (6) Uniformed services.--The term ``uniformed services'' 
        has the meaning given the term in section 2101 of title 5, 
        United States Code.
    (b) Pilot Project.--
            (1) In general.--Each appropriate agency head may carry out 
        a pilot project to establish a Civilian Cyber Security Reserve 
        at the covered agency to address the cyber security needs of 
        the United States with respect to national security.
            (2) Appointments.--Under a pilot project authorized under 
        paragraph (1), the appropriate agency head may noncompetitively 
        appoint members of the Civilian Cyber Security Reserve to 
        temporary positions in the competitive or excepted service.
            (3) Status as employees.--An individual appointed under 
        paragraph (2) shall be considered a Federal civil service 
        employee under section 2105 of title 5, United States Code.
            (4) Additional employees.--Individuals appointed under 
        paragraph (2) shall be in addition to any employees of the 
        covered agency who provide cyber security services.
            (5) Employment protections.--The Secretary of Labor shall 
        prescribe such regulations as necessary to ensure the 
        reemployment, continuation of benefits, and non-discrimination 
        in reemployment of individuals appointed under paragraph (2), 
        provided that such regulations shall include, at a minimum, 
        those rights and obligations set forth under chapter 43 of 
        title 38, United States Code.
    (c) Eligibility; Application and Selection.--
            (1) In general.--Under a pilot project authorized under 
        subsection (b), the appropriate agency head shall establish 
        criteria for--
                    (A) individuals to be eligible for the Civilian 
                Cyber Security Reserve in the covered agency; and
                    (B) the application and selection processes for the 
                Reserve.
            (2) Requirements for individuals.--The criteria established 
        under paragraph (1)(A) with respect to an individual shall 
        include--
                    (A) previous employment by the Federal Government 
                or within the uniformed services; and
                    (B) cyber security expertise.
            (3) Agreement required.--An individual may become a member 
        of the Civilian Cyber Security Reserve only if the individual 
        enters into an agreement with the appropriate agency head to 
        become such a member, which shall set forth the rights and 
        obligations of the individual and the covered agency.
            (4) Exception for continuing military service 
        commitments.--A member of the Selected Reserve under section 
        10143 of title 10, United States Code, may not be a member of 
        the Civilian Cyber Security Reserve.
    (d) Components of the Civilian Cyber Security Reserve.--The 
appropriate agency head may consider, in carrying out a pilot project 
authorized under subsection (b), developing different components of the 
Civilian Cyber Security Reserve in the covered agency, one with an 
obligation to respond when called into activation at the direction of 
the appropriate agency head and one that is not compelled to so 
respond, with appropriate corresponding differing benefits for each 
such component.
    (e) Security Clearances.--
            (1) In general.--The appropriate agency head shall ensure 
        that all members of the Civilian Cyber Security Reserve in the 
        covered agency undergo the appropriate personnel vetting and 
        adjudication commensurate with the duties of the position, 
        including a determination of eligibility for access to 
        classified information where a security clearance is necessary, 
        in accordance with Executive Order 12968 (50 U.S.C. 3161 note; 
        relating to access to classified information) and Executive 
        Order 13467 (50 U.S.C. 3161 note; relating to reforming 
        processes related to suitability for Government employment, 
        fitness for contractor employees, and eligibility for access to 
        classified national security information).
            (2) Cost of maintaining clearances.--The original sponsor 
        of a security clearance of a member of a Civilian Cyber 
        Security Reserve at a covered agency shall be responsible for 
        the cost of maintaining that security clearance.
    (f) Project Guidance.--
            (1) In general.--Not later than 180 days after the date of 
        enactment of this Act, each appropriate agency head may issue 
        guidance establishing and implementing a pilot project 
        authorized under subsection (b) at the covered agency.
            (2) Penalties.--
                    (A) In general.--In developing guidance under 
                paragraph (1), an appropriate agency head may provide 
                for penalties for individuals who do not respond to 
                activation when called, such as recoupment of pay or 
                benefits earned as a member of the Civilian Cyber 
                Security Reserve or recoupment of civilian service 
                creditable under section 8411 of title 5, United States 
                Code.
                    (B) Procedures.--In the case of a proposed penalty 
                or action under this paragraph, the individual shall be 
                entitled to the applicable procedures set forth in 
                title 5, Code of Federal Regulations, or as otherwise 
                specified in applicable guidance.
    (g) Evaluation.--Not later than 5 years after the pilot project 
authorized under subsection (b) is established in each covered agency, 
the Comptroller General of the United States shall--
            (1) conduct a study evaluating the pilot project at the 
        covered agency; and
            (2) submit to Congress--
                    (A) a report on the results of the study; and
                    (B) a recommendation with respect to whether the 
                pilot project should be modified, extended in duration, 
                or established as a permanent program.
    (h) Report.--Not later than 5 years after the pilot project 
authorized under subsection (b) is established in a covered agency, the 
appropriate agency head shall submit to the Committee on Homeland 
Security and Governmental Affairs and the Committee on Armed Services 
of the Senate and the Committee on Homeland Security and the Committee 
on Armed Services of the House of Representatives a report--
            (1) on the activities carried out under the pilot project; 
        and
            (2) that includes a recommendation with respect to whether 
        the pilot project should be modified, extended in duration, or 
        established as a permanent program.
    (i) Sunset.--A pilot project authorized under this section shall 
terminate on the date that is 6 years after the date on which the pilot 
project is established.
    (j) Authorization of Appropriations.--There are authorized to be 
appropriated to each appropriate agency head such sums as may be 
necessary to carry out this section.
                                 <all>