Homeland Security Cybersecurity Boots-on-the-Ground Act

Bill: 113-hr-3107
Sponsor: full_name: Rep. Clarke, Yvette D. [D-NY-9]
Introduced: 2013-09-17
Policy area: Emergency Management
Subjects: Computer security and identity theft

Department of Homeland Security

Government employee pay, benefits, personnel management

Homeland security

Public contracts and procurement
Latest action: action_date: 2014-07-29
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2013-09-17
action_desc: Introduced in House
text: <p>Homeland Security Cybersecurity Boots-on-the-Ground Act - Requires the Secretary of Homeland Security to develop:</p> <ul> <li> occupation classifications for individuals performing activities in furtherance of the cybersecurity mission of the Department of Homeland Security (DHS) and to ensure that the such classifications may be used throughout DHS and are made available to other federal agencies;</li> <li>a workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the DHS cybersecurity workforce, including a multiphased recruitment plan and a 10-year projection of federal workforce needs; and</li> <li>a process to verify that employees of independent contractors who serve in DHS cybersecurity positions receive initial and recurrent information security and role-based security training commensurate with assigned responsibilities.</li> </ul> <p>Defines &quot;cybersecurity mission&quot; as threat and vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.</p> <p>Directs the DHS Chief Human Capital Officer and Chief Information Officer to assess the readiness and capacity of DHS to meet such mission.</p> <p>Requires the Secretary to provide Congress with annual updates regarding such strategies, assessments, and training. </p>

action_date: 2013-12-12
action_desc: Reported to House with amendment(s)
text: <p>Homeland Security Cybersecurity Boots-on-the-Ground Act - Requires the Secretary of Homeland Security to: (1) develop occupation classifications for individuals performing activities in furtherance of the cybersecurity mission of the Department of Homeland Security (DHS), (2) ensure that such classifications may be used throughout DHS and are made available to other federal agencies, and (3) assess the readiness and capacity of DHS to meet its cybersecurity mission.</p> <p>Defines "cybersecurity mission" as threat and vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.</p> <p>Directs the Secretary, acting through the DHS Chief Human Capital Officer and Chief Information Officer, to include in such readiness assessment information on which cybersecurity positions are performed by: (1) permanent full time departmental employees (together with demographic information about such employees' race, ethnicity, gender, disability status, and veterans status); (2) individuals employed by independent contractors; and (3) individuals employed by other federal agencies, including the National Security Agency (NSA). Requires the assessment to address vacancies within the supervisory workforce, job training, and recruiting costs. </p> <p>Directs the Secretary to develop: (1) a workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the DHS cybersecurity workforce, including a multiphased recruitment plan, a 5-year implementation plan, and a 10-year projection of federal workforce needs; and (2) a process to verify that employees of independent contractors who serve in DHS cybersecurity positions receive initial and recurrent information security and role-based security training commensurate with assigned responsibilities. </p> <p>Requires the Secretary to provide Congress with annual updates regarding such strategies, assessments, and training. </p> <p>Requires the Comptroller General (GAO) to study and report to the Secretary and Congress with respect to such assessments and strategies.</p> <p>Directs the Secretary to report to Congress regarding the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for&nbsp;DHS for an agreed-upon period of time.</p>

action_date: 2014-07-28
action_desc: Passed House amended
text: <p>(Sec. 1) Amends the Homeland Security Act of 2002 to add provisions entitled the Homeland Security Cybersecurity Boots-on-the-Ground Act, which require the Secretary of Homeland Security (DHS) to: (1) develop occupation categories for individuals performing activities in furtherance of DHS's cybersecurity mission, (2) ensure that such categories may be used throughout DHS and are made available to other federal agencies, and (3) conduct an annual assessment of the readiness and capacity of the DHS workforce to meet its cybersecurity mission. </p> <p>Directs the Secretary to include in such readiness assessment information on which cybersecurity positions are performed by: (1) permanent full time departmental employees (together with demographic information about such employees' race, ethnicity, gender, disability status, and veterans status); (2) individuals employed by independent contractors; and (3) individuals employed by other federal agencies, including the National Security Agency (NSA). Requires the assessment to address vacancies within the supervisory workforce, job training, and recruiting costs.</p> <p> Directs the Secretary to develop: (1) a workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the DHS cybersecurity workforce, including a multi-phased recruitment plan, a 5-year implementation plan, and a 10-year projection of DHS workforce needs; and (2) a process to verify that employees of independent contractors who serve in DHS cybersecurity positions receive initial and recurrent information security and role-based security training commensurate with assigned responsibilities. </p> <p>Requires the Secretary to provide Congress with annual updates regarding such strategies, assessments, and training. Requires the Comptroller General (GAO) to study and report to the Secretary and Congress with respect to such assessments and strategies. </p> <p>Directs the Secretary to report to Congress regarding the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for DHS for an agreed-upon period of time.</p> <p>(Sec. 2) Authorizes the Secretary to exercise personnel authorities (in the same manner as the Secretary of Defense [DOD] exercises authority with respect to civilian intelligence personnel and scholarship programs) to establish positions in the excepted service, appoint individuals, fix pay, and pay retention bonuses if needed to retain essential DHS employees who perform functions relating to the security of federal civilian information systems, critical infrastructure information systems, or related networks. Requires the Secretary to provide an explanation to Congress before announcing a bonus. </p> <p>Requires the Secretary to provide an annual report to Congress for a specified period regarding the processes used in accepting applications, assessing candidates, ensuring adherence to veterans' preference, and selecting applicants for vacancies to be filled by a qualified employee.</p>

tv_txt: I 113th CONGRESS 1st Session H. R. 3107 IN THE HOUSE OF REPRESENTATIVES September 17, 2013 Ms. Clarke introduced the following bill; which was referred to the Committee on Homeland Security A BILL To require the Secretary of Homeland Security to establish cybersecurity occupation classifications, assess the cybersecurity workforce, develop a strategy to address identified gaps in the cybersecurity workforce, and for other purposes.

1. Short title This Act may be cited as the Homeland Security Cybersecurity Boots-on-the-Ground Act . 2. Cybersecurity occupation classifications, workforce assessment, and strategy (a) Cybersecurity occupation classifications (1) In general Not later than 90 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop and issue comprehensive occupation classifications for individuals performing activities in furtherance of the cybersecurity mission of the Department of Homeland Security. (2) Applicability The Secretary of Homeland Security shall ensure that the comprehensive occupation classifications issued under subsection (a) may be used throughout the Department of Homeland Security and are made available to other Federal agencies. (b) Cybersecurity workforce assessment (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Chief Human Capital Officer and Chief Information Officer of the Department of Homeland Security, shall assess the readiness and capacity of the Department to meet its cybersecurity mission. (2) Contents The assessment required under paragraph (1) shall, at a minimum, include the following: (A) Information where cybersecurity positions are located within the Department of Homeland Security, specified in accordance with the cybersecurity occupation classifications issued under subsection (a). (B) Information on which cybersecurity positions are— (i) performed by— (I) permanent full time departmental employees; (II) individuals employed by independent contractors; and (III) individuals employed by other Federal agencies, including the National Security Agency; and (ii) vacant. (C) The number of individuals hired by the Department pursuant to the authority granted to the Secretary of Homeland Security in 2009 to permit the Secretary to fill 1,000 cybersecurity positions across the Department over a three-year period, and information on what challenges, if any, were encountered with respect to the implementation of such authority. (D) Information on vacancies within the Department’s cybersecurity supervisory workforce, from first line supervisory positions through senior departmental cybersecurity positions. (E) Information on the percentage of individuals within each cybersecurity occupation classification who received essential training to perform their jobs, and in cases in which such training is not received, information on what challenges, if any, were encountered with respect to the provision of such training. (c) Workforce strategy (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of the cybersecurity workforce of the Department of Homeland Security. (2) Contents The comprehensive workforce strategy developed under paragraph (1) shall include— (A) a multiphased recruitment plan; and (B) a 10-year projection of Federal workforce needs. (d) Information security training Not later than 270 days after the date of the enactment of this Act, the Secretary of Homeland Security shall establish and maintain a process to verify on an ongoing basis that individuals employed by independent contractors who serve in cybersecurity positions at the Department of Homeland Security receive initial and recurrent information security training comprised of general security awareness training necessary to perform their job functions, and role-based security training that is commensurate with assigned responsibilities. The Secretary shall monitor and maintain documentation to ensure that training provided to an individual under this subsection meets or exceeds requirements for such individual’s job function. (e) Updates Together with the submission to Congress of annual budget requests, the Secretary of Homeland Security shall provide updates regarding the cybersecurity workforce assessment required under subsection (b), information on the progress of carrying out the comprehensive workforce strategy developed under subsection (c), and information on the status of the implementation of the information security training required under subsection (d). 3. Definition In this Act, the term cybersecurity mission means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.

tv_txt: IB Union Calendar No. 212 113th CONGRESS 1st Session H. R. 3107 [Report No. 113–294] IN THE HOUSE OF REPRESENTATIVES September 17, 2013 Ms. Clarke introduced the following bill; which was referred to the Committee on Homeland Security December 12, 2013 Additional sponsors: Mr. Horsford , Mr. Meehan , and Mr. Thompson of Mississippi December 12, 2013 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on September 17, 2013 A BILL To require the Secretary of Homeland Security to establish cybersecurity occupation classifications, assess the cybersecurity workforce, develop a strategy to address identified gaps in the cybersecurity workforce, and for other purposes.

1. Short title This Act may be cited as the Homeland Security Cybersecurity Boots-on-the-Ground Act . 2. Cybersecurity occupation classifications, workforce assessment, and strategy (a) Cybersecurity occupation classifications (1) In general Not later than 90 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop and issue comprehensive occupation classifications for individuals performing activities in furtherance of the cybersecurity mission of the Department of Homeland Security. (2) Applicability The Secretary of Homeland Security shall ensure that the comprehensive occupation classifications issued under paragraph (1) are used throughout the Department of Homeland Security and are made available to other Federal agencies. (b) Cybersecurity workforce assessment (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Chief Human Capital Officer and Chief Information Officer of the Department of Homeland Security, shall assess the readiness and capacity of the Department to meet its cybersecurity mission. (2) Contents The assessment required under paragraph (1) shall, at a minimum, include the following: (A) Information where cybersecurity positions are located within the Department of Homeland Security, specified in accordance with the cybersecurity occupation classifications issued under subsection (a). (B) Information on which cybersecurity positions are— (i) performed by— (I) permanent full time departmental employees, together with demographic information about such employees’ race, ethnicity, gender, disability status, and veterans status; (II) individuals employed by independent contractors; and (III) individuals employed by other Federal agencies, including the National Security Agency; and (ii) vacant. (C) The number of individuals hired by the Department pursuant to the authority granted to the Secretary of Homeland Security in 2009 to permit the Secretary to fill 1,000 cybersecurity positions across the Department over a three year period, and information on what challenges, if any, were encountered with respect to the implementation of such authority. (D) Information on vacancies within the Department’s cybersecurity supervisory workforce, from first line supervisory positions through senior departmental cybersecurity positions. (E) Information on the percentage of individuals within each cybersecurity occupation classification who received essential training to perform their jobs, and in cases in which such training is not received, information on what challenges, if any, were encountered with respect to the provision of such training. (F) Information on recruiting costs incurred with respect to efforts to fill cybersecurity positions across the Department in a manner that allows for tracking of overall recruiting and identifying areas for better coordination and leveraging of resources within the Department. (c) Workforce strategy (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of the cybersecurity workforce of the Department of Homeland Security. (2) Contents The comprehensive workforce strategy developed under paragraph (1) shall include— (A) a multiphased recruitment plan, including relating to experienced professionals, members of disadvantaged or underserved communities, the unemployed, and veterans; (B) a 5-year implementation plan; and (C) a 10-year projection of Federal workforce needs. (d) Information security training Not later than 270 days after the date of the enactment of this Act, the Secretary of Homeland Security shall establish and maintain a process to verify on an ongoing basis that individuals employed by independent contractors who serve in cybersecurity positions at the Department of Homeland Security receive initial and recurrent information security training comprised of general security awareness training necessary to perform their job functions, and role-based security training that is commensurate with assigned responsibilities. The Secretary shall maintain documentation to ensure that training provided to an individual under this subsection meets or exceeds requirements for such individual’s job function. (e) Updates Together with the submission to Congress of annual budget requests, the Secretary of Homeland Security shall provide updates regarding the cybersecurity workforce assessment required under subsection (b), information on the progress of carrying out the comprehensive workforce strategy developed under subsection (c), and information on the status of the implementation of the information security training required under subsection (d). (f) GAO study The Secretary of Homeland Security shall provide the Comptroller General of the United States with information on the cybersecurity workforce assessment required under subsection (a) and progress on carrying out the comprehensive workforce strategy developed under subsection (c). The Comptroller General shall submit to the Secretary, the Committee on Homeland Security of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate a study on such assessment and strategy. 3. Cybersecurity Fellowship Program Not later than 120 days after the date of the enactment of this Act, the Secretary of Homeland Security shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for the Department of Homeland Security for an agreed-upon period of time. 4. Definition In this Act, the term cybersecurity mission means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.

December 12, 2013 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed

tv_txt: I 113th CONGRESS 2d Session H. R. 3107 IN THE HOUSE OF REPRESENTATIVES AN ACT To require the Secretary of Homeland Security to establish cybersecurity occupation classifications, assess the cybersecurity workforce, develop a strategy to address identified gaps in the cybersecurity workforce, and for other purposes.

1. Homeland security cybersecurity workforce (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 226. Cybersecurity occupation categories, workforce assessment, and strategy (a) Short title This section may be cited as the Homeland Security Cybersecurity Boots-on-the-Ground Act . (b) Cybersecurity occupation categories (1) In general Not later than 90 days after the date of the enactment of this section, the Secretary shall develop and issue comprehensive occupation categories for individuals performing activities in furtherance of the cybersecurity mission of the Department. (2) Applicability The Secretary shall ensure that the comprehensive occupation categories issued under paragraph (1) are used throughout the Department and are made available to other Federal agencies. (c) Cybersecurity workforce assessment (1) In general Not later than 180 days after the date of the enactment of this section and annually thereafter, the Secretary shall assess the readiness and capacity of the workforce of the Department to meet its cybersecurity mission. (2) Contents The assessment required under paragraph (1) shall, at a minimum, include the following: (A) Information where cybersecurity positions are located within the Department, specified in accordance with the cybersecurity occupation categories issued under subsection (b). (B) Information on which cybersecurity positions are— (i) performed by— (I) permanent full time departmental employees, together with demographic information about such employees’ race, ethnicity, gender, disability status, and veterans status; (II) individuals employed by independent contractors; and (III) individuals employed by other Federal agencies, including the National Security Agency; and (ii) vacant. (C) The number of individuals hired by the Department pursuant to the authority granted to the Secretary in 2009 to permit the Secretary to fill 1,000 cybersecurity positions across the Department over a three year period, and information on what challenges, if any, were encountered with respect to the implementation of such authority. (D) Information on vacancies within the Department’s cybersecurity supervisory workforce, from first line supervisory positions through senior departmental cybersecurity positions. (E) Information on the percentage of individuals within each cybersecurity occupation category who received essential training to perform their jobs, and in cases in which such training is not received, information on what challenges, if any, were encountered with respect to the provision of such training. (F) Information on recruiting costs incurred with respect to efforts to fill cybersecurity positions across the Department in a manner that allows for tracking of overall recruiting and identifying areas for better coordination and leveraging of resources within the Department. (d) Workforce strategy (1) In general Not later than 180 days after the date of the enactment of this section, the Secretary shall develop, maintain, and, as necessary, update, a comprehensive workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the cybersecurity workforce of the Department. (2) Contents The comprehensive workforce strategy developed under paragraph (1) shall include— (A) a multiphased recruitment plan, including relating to experienced professionals, members of disadvantaged or underserved communities, the unemployed, and veterans; (B) a 5-year implementation plan; (C) a 10-year projection of the Department’s cybersecurity workforce needs; and (D) obstacles impeding the hiring and development of a cybersecurity workforce at the Department. (e) Information security training Not later than 270 days after the date of the enactment of this section, the Secretary shall establish and maintain a process to verify on an ongoing basis that individuals employed by independent contractors who serve in cybersecurity positions at the Department receive initial and recurrent information security training comprised of general security awareness training necessary to perform their job functions, and role-based security training that is commensurate with assigned responsibilities. The Secretary shall maintain documentation to ensure that training provided to an individual under this subsection meets or exceeds requirements for such individual’s job function. (f) Updates The Secretary shall submit to the appropriate congressional committees annual updates regarding the cybersecurity workforce assessment required under subsection (c), information on the progress of carrying out the comprehensive workforce strategy developed under subsection (d), and information on the status of the implementation of the information security training required under subsection (e). (g) GAO study The Secretary shall provide the Comptroller General of the United States with information on the cybersecurity workforce assessment required under subsection (c) and progress on carrying out the comprehensive workforce strategy developed under subsection (d). The Comptroller General shall submit to the Secretary and the appropriate congressional committees a study on such assessment and strategy. (h) Cybersecurity Fellowship Program Not later than 120 days after the date of the enactment of this section, the Secretary shall submit to the appropriate congressional committees a report on the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for the Department for an agreed-upon period of time. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding after the item relating to section 225 the following new item: Sec. 226. Cybersecurity occupation categories, workforce assessment, and strategy. . 2. Personnel authorities (a) In general Subtitle C of title II of the Homeland Security Act of 2002, as amended by section 1 of this Act, is further amended by adding at the end the following new section: 227. Personnel authorities (a) In general (1) Personnel authorities The Secretary may exercise with respect to qualified employees of the Department the same authority that the Secretary of Defense has with respect to civilian intelligence personnel and the scholarship program under sections 1601, 1602, 1603, and 2200a of title 10, United States Code, to establish as positions in the excepted service, appoint individuals to such positions, fix pay, and pay a retention bonus to any employee appointed under this section if the Secretary determines that such is needed to retain essential personnel. Before announcing the payment of a bonus under this paragraph, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a written explanation of such determination. Such authority shall be exercised— (A) to the same extent and subject to the same conditions and limitations that the Secretary of Defense may exercise such authority with respect to civilian intelligence personnel of the Department of Defense; and (B) in a manner consistent with the merit system principles set forth in section 2301 of title 5, United States Code. (2) Civil service protections Sections 1221 and 2302, and chapter 75 of title 5, United States Code, shall apply to the positions established pursuant to the authorities provided under paragraph (1). (3) Plan for execution of authorities Not later than 120 days after the date of the enactment of this section, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report that contains a plan for the use of the authorities provided under this subsection. (b) Annual report Not later than one year after the date of the enactment of this section and annually thereafter for four years, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a detailed report (including appropriate metrics on actions occurring during the reporting period) that discusses the processes used by the Secretary in implementing this section and accepting applications, assessing candidates, ensuring adherence to veterans’ preference, and selecting applicants for vacancies to be filled by a qualified employee. (c) Definition of qualified employee In this section, the term qualified employee means an employee who performs functions relating to the security of Federal civilian information systems, critical infrastructure information systems, or networks of either of such systems. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding after the item relating to section 226 (as added by section 1 of this Act) the following new item: Sec. 227. Personnel authorities. . 3. Clarification regarding authorization of appropriations No additional amounts are authorized to be appropriated by reason of this Act or the amendments made by this Act.

Passed the House of Representatives July 28, 2014. Karen L. Haas, Clerk.

tv_txt: IIB 113th CONGRESS 2d Session H. R. 3107 IN THE SENATE OF THE UNITED STATES July 29, 2014 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To require the Secretary of Homeland Security to establish cybersecurity occupation classifications, assess the cybersecurity workforce, develop a strategy to address identified gaps in the cybersecurity workforce, and for other purposes.

1. Homeland security cybersecurity workforce (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 226. Cybersecurity occupation categories, workforce assessment, and strategy (a) Short title This section may be cited as the Homeland Security Cybersecurity Boots-on-the-Ground Act . (b) Cybersecurity occupation categories (1) In general Not later than 90 days after the date of the enactment of this section, the Secretary shall develop and issue comprehensive occupation categories for individuals performing activities in furtherance of the cybersecurity mission of the Department. (2) Applicability The Secretary shall ensure that the comprehensive occupation categories issued under paragraph (1) are used throughout the Department and are made available to other Federal agencies. (c) Cybersecurity workforce assessment (1) In general Not later than 180 days after the date of the enactment of this section and annually thereafter, the Secretary shall assess the readiness and capacity of the workforce of the Department to meet its cybersecurity mission. (2) Contents The assessment required under paragraph (1) shall, at a minimum, include the following: (A) Information where cybersecurity positions are located within the Department, specified in accordance with the cybersecurity occupation categories issued under subsection (b). (B) Information on which cybersecurity positions are— (i) performed by— (I) permanent full time departmental employees, together with demographic information about such employees’ race, ethnicity, gender, disability status, and veterans status; (II) individuals employed by independent contractors; and (III) individuals employed by other Federal agencies, including the National Security Agency; and (ii) vacant. (C) The number of individuals hired by the Department pursuant to the authority granted to the Secretary in 2009 to permit the Secretary to fill 1,000 cybersecurity positions across the Department over a three year period, and information on what challenges, if any, were encountered with respect to the implementation of such authority. (D) Information on vacancies within the Department’s cybersecurity supervisory workforce, from first line supervisory positions through senior departmental cybersecurity positions. (E) Information on the percentage of individuals within each cybersecurity occupation category who received essential training to perform their jobs, and in cases in which such training is not received, information on what challenges, if any, were encountered with respect to the provision of such training. (F) Information on recruiting costs incurred with respect to efforts to fill cybersecurity positions across the Department in a manner that allows for tracking of overall recruiting and identifying areas for better coordination and leveraging of resources within the Department. (d) Workforce strategy (1) In general Not later than 180 days after the date of the enactment of this section, the Secretary shall develop, maintain, and, as necessary, update, a comprehensive workforce strategy that enhances the readiness, capacity, training, recruitment, and retention of the cybersecurity workforce of the Department. (2) Contents The comprehensive workforce strategy developed under paragraph (1) shall include— (A) a multiphased recruitment plan, including relating to experienced professionals, members of disadvantaged or underserved communities, the unemployed, and veterans; (B) a 5-year implementation plan; (C) a 10-year projection of the Department’s cybersecurity workforce needs; and (D) obstacles impeding the hiring and development of a cybersecurity workforce at the Department. (e) Information security training Not later than 270 days after the date of the enactment of this section, the Secretary shall establish and maintain a process to verify on an ongoing basis that individuals employed by independent contractors who serve in cybersecurity positions at the Department receive initial and recurrent information security training comprised of general security awareness training necessary to perform their job functions, and role-based security training that is commensurate with assigned responsibilities. The Secretary shall maintain documentation to ensure that training provided to an individual under this subsection meets or exceeds requirements for such individual’s job function. (f) Updates The Secretary shall submit to the appropriate congressional committees annual updates regarding the cybersecurity workforce assessment required under subsection (c), information on the progress of carrying out the comprehensive workforce strategy developed under subsection (d), and information on the status of the implementation of the information security training required under subsection (e). (g) GAO study The Secretary shall provide the Comptroller General of the United States with information on the cybersecurity workforce assessment required under subsection (c) and progress on carrying out the comprehensive workforce strategy developed under subsection (d). The Comptroller General shall submit to the Secretary and the appropriate congressional committees a study on such assessment and strategy. (h) Cybersecurity Fellowship Program Not later than 120 days after the date of the enactment of this section, the Secretary shall submit to the appropriate congressional committees a report on the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for the Department for an agreed-upon period of time. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding after the item relating to section 225 the following new item: Sec. 226. Cybersecurity occupation categories, workforce assessment, and strategy. . 2. Personnel authorities (a) In general Subtitle C of title II of the Homeland Security Act of 2002, as amended by section 1 of this Act, is further amended by adding at the end the following new section: 227. Personnel authorities (a) In general (1) Personnel authorities The Secretary may exercise with respect to qualified employees of the Department the same authority that the Secretary of Defense has with respect to civilian intelligence personnel and the scholarship program under sections 1601, 1602, 1603, and 2200a of title 10, United States Code, to establish as positions in the excepted service, appoint individuals to such positions, fix pay, and pay a retention bonus to any employee appointed under this section if the Secretary determines that such is needed to retain essential personnel. Before announcing the payment of a bonus under this paragraph, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a written explanation of such determination. Such authority shall be exercised— (A) to the same extent and subject to the same conditions and limitations that the Secretary of Defense may exercise such authority with respect to civilian intelligence personnel of the Department of Defense; and (B) in a manner consistent with the merit system principles set forth in section 2301 of title 5, United States Code. (2) Civil service protections Sections 1221 and 2302, and chapter 75 of title 5, United States Code, shall apply to the positions established pursuant to the authorities provided under paragraph (1). (3) Plan for execution of authorities Not later than 120 days after the date of the enactment of this section, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report that contains a plan for the use of the authorities provided under this subsection. (b) Annual report Not later than one year after the date of the enactment of this section and annually thereafter for four years, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a detailed report (including appropriate metrics on actions occurring during the reporting period) that discusses the processes used by the Secretary in implementing this section and accepting applications, assessing candidates, ensuring adherence to veterans’ preference, and selecting applicants for vacancies to be filled by a qualified employee. (c) Definition of qualified employee In this section, the term qualified employee means an employee who performs functions relating to the security of Federal civilian information systems, critical infrastructure information systems, or networks of either of such systems. . (b) Clerical amendment The table of contents in section 1(b) of such Act is amended by adding after the item relating to section 226 (as added by section 1 of this Act) the following new item: Sec. 227. Personnel authorities. . 3. Clarification regarding authorization of appropriations No additional amounts are authorized to be appropriated by reason of this Act or the amendments made by this Act.

Passed the House of Representatives July 28, 2014. Karen L. Haas, Clerk