Cybersecurity: Federal Efforts Are Under Way That May Address Workforce Challenges
Published: 2017-04-04T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government faces an ever-evolving array of cyber-based threats to its systems and information. Further, federal systems and networks are inherently at risk because of their complexity, technological diversity, and geographic dispersion, among other reasons. GAO has designated the protection of federal information systems as a government-wide high-risk area since 1997. In 2001, GAO introduced strategic government-wide human capital management as another area of high risk. A key component of the government's ability to mitigate and respond to cyber threats is having a qualified, well-trained cybersecurity workforce. However, shortages in qualified cybersecurity professionals have been identified, which can hinder the government's ability to ensure an effective workforce.
This statement discusses challenges agencies face in ensuring an effective cybersecurity workforce, recent initiatives aimed at improving the federal cyber workforce, and ongoing activities that could assist in recruiting and retaining cybersecurity professionals. In preparing this statement, GAO relied on published work related to federal cybersecurity workforce efforts, and information reported by other federal and non-federal entities focusing on cybersecurity workforce challenges.
section_title: What GAO Found
paragraphs: GAO and others have identified a number of key challenges facing federal agencies in ensuring that they have an effective cybersecurity workforce:
Identifying skills gaps: As GAO reported in 2011, 2015, and 2016, federal agencies have faced challenges in effectively implementing workforce planning processes for information technology (IT) and defining cybersecurity staffing needs. GAO also reported that the Office of Personnel Management (OPM) could improve its efforts to close government-wide skills gaps.
Recruiting and retaining qualified staff: Federal agencies continue to be challenged in recruiting and retaining qualified cybersecurity staff. For example, in August 2016, GAO reported that federal chief information security officers faced significant challenges in recruiting and retaining personnel with high-demand skills.
Federal hiring activities: The federal hiring process may cause agencies to lose out on qualified candidates. In August 2016 GAO reported that OPM and agencies needed to assess available federal hiring authorities to more effectively meet their workforce needs.
To address these and other challenges, several executive branch initiatives have been launched and federal laws enacted. For example, in July 2016, OPM and the Office of Management and Budget issued a strategy with goals, actions, and timelines for improving the cybersecurity workforce. In addition, laws such as the Federal Cybersecurity Workforce Assessment Act of 2015 require agencies to identify IT and cyber-related positions of greatest need.
Further, other ongoing activities have the potential to assist agencies in developing, recruiting, and retaining an effective cybersecurity workforce. For example:
Promoting cyber and science, technology, engineering and mathematics (STEM) education: A center funded by the Department of Homeland Security (DHS) developed a kindergarten to 12th grade-level cyber-based curriculum that provides opportunities for students to become aware of cyber issues, engage in cyber education, and enter cyber career fields.
Cybersecurity scholarships: Programs such as Scholarship for Service provide tuition assistance to undergraduate and graduate students studying cybersecurity in exchange for a commitment to federal service.
National Initiative for Cybersecurity Careers and Studies: DHS, in partnership with several other agencies, launched the National Initiative for Cybersecurity Careers and Studies in 2013 as an online resource to connect government employees, students, educators, and industry with cybersecurity training providers across the nation.
If effectively implemented, these initiatives, laws, and activities could further agencies' efforts to establish the cybersecurity workforce needed to secure and protect federal IT systems.
section_title: What GAO Recommends
paragraphs: Over the past several years, GAO has made several recommendations to federal agencies to enhance their IT workforce efforts. Agencies are in various stages of implementing these recommendations.

section_title: Letter
paragraphs: Thank you for inviting me to participate in today’s hearing on the federal  information technology (IT) and cybersecurity workforce. As recent  cyberattacks have illustrated, the need for robust and effective  cybersecurity has never been greater. Threats to federal IT infrastructure  continue to grow in number and sophistication, posing a risk to the  reliable functioning of our government. Compounding the risk, systems  used by federal agencies often have security vulnerabilities.
Accordingly, having cybersecurity professionals in the federal workforce  to help to prevent or mitigate vulnerabilities in federal IT systems that can  be exploited by the increasing number of threats from a variety of sources  is essential. However, achieving a resilient, well-trained, and dedicated  cybersecurity workforce to help protect our information and infrastructure  has been a long-standing challenge for the federal government. Since  1997 we have identified the protection of federal information systems as a  government-wide high-risk area. In addition, in 2001, we introduced  strategic government-wide human capital management as another area  of high risk.
My statement today discusses a number of the key challenges federal  agencies face in ensuring that they have an effective cybersecurity  workforce with the right knowledge, skills, and abilities to secure federal  systems and critical cyber infrastructure. I will also discuss executive  branch initiatives and federal laws aimed at improving the federal  cybersecurity workforce, as well as other ongoing activities that could  assist agencies in recruiting and retaining cybersecurity professionals.
In preparing this statement, we relied on our previously published work  related to cybersecurity and government-wide workforce efforts and  challenges faced by the federal government in establishing an effective  cybersecurity workforce. Based on this work, we examined recently  enacted legislation, executive branch initiatives, and other ongoing  activities intended to address these challenges. Further, we reviewed  information reported by other federal and non-federal entities focusing on  cybersecurity workforce challenges. Our reports cited in this statement  include detailed discussions of the objectives, scope, and methodology  for the work that we conducted.
The work on which this statement is based was conducted in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: Background
paragraphs: Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services—  are dependent on computerized (cyber) information systems and  electronic data to carry out operations and to process, maintain, and  report essential information. The information systems and networks that  support federal operations are highly complex and dynamic,  technologically diverse, and often geographically dispersed. This  complexity increases the difficulty in identifying, managing, and protecting  the myriad of operating systems, applications, and devices comprising the  systems and networks.
The security of federal information systems and data is vital to public  confidence and the nation’s safety, prosperity, and well-being. However,  systems used by federal agencies are often riddled with security  vulnerabilities—both known and unknown. For example, the national  vulnerability database maintained by the National Institute of Standards  and Technology (NIST) identified 82,384 publicly known cybersecurity  vulnerabilities and exposures as of February 9, 2017, with more being  added each day.
Federal systems and networks are also often interconnected with other  internal and external systems and networks, including the Internet,  thereby increasing the number of avenues of attack and expanding their  attack surface. In addition, cyber threats to systems supporting the  federal government and critical infrastructure are evolving and becoming  more sophisticated. These threats come from a variety of sources and  vary in terms of the types and capabilities of the actors, their willingness  to act, and their motives. For example, foreign nations—where  adversaries possess sophisticated levels of expertise and significant  resources to pursue their objectives—pose increasing risks.
Cybersecurity professionals can help to prevent or mitigate the  vulnerabilities that could allow malicious individuals and groups access to  federal IT systems. The ability to secure federal systems depends on the  knowledge, skills, and abilities of the federal and contractor workforce that  uses, implements, secures, and maintains these systems. This includes  federal and contractor employees who use the IT systems in the course  of their work as well as the designers, developers, programmers, and  administrators of the programs and systems.
However, the Office of Management and Budget (OMB) has noted that  the federal government and private industry face a persistent shortage of  cybersecurity and IT talent to implement and oversee information security  protections to combat cyber threats. In addition, the RAND Corporation  and the Partnership for Public Service have reported that there is a  nationwide shortage of cybersecurity experts, in particular in the federal  government. According to these reports, this shortage of cybersecurity  professionals makes securing the nation’s networks more challenging and  may leave federal IT systems vulnerable to malicious attacks.
section_title: Agencies Face Key Challenges in Ensuring an Effective Cybersecurity Workforce
paragraphs: We and others have identified a number of key challenges federal  agencies are facing to ensure that they have a sufficient cybersecurity  workforce with the skills necessary to protect their information and  networks from cyber threats. These challenges pertain to identifying and  closing skill gaps as part of a comprehensive workforce planning process,  recruiting and retaining qualified staff, and navigating the federal hiring  process.
subsections: section_title: Identifying and Closing Skill Gaps
paragraphs: A high-performance organization needs a workforce with talent,  multidisciplinary knowledge, and up-to-date skills in order to achieve its  mission. To ensure such a workforce for cybersecurity, we have identified  key practices for strategic IT workforce planning that focus especially on  the need for organizations to identify and address gaps in critical skills.  These practices include (1) setting the strategic direction for IT workforce  planning, (2) analyzing the workforce to identify skill gaps, (3) developing strategies and implementing activities to address these gaps, and (4)  monitoring and reporting progress in addressing gaps.
However, over the last several years, we and others have reported on  federal agencies’ challenges to define their cybersecurity workforces and  address their IT skills gaps. For example:  In November 2011, we reported that eight federal agencies had  identified challenges in their workforce planning efforts. For example,  they were not able to determine the size of their cybersecurity  workforce because of variations in how the cyber-related work was  defined and the lack of a cybersecurity specific occupational series. In  addition, we noted that the eight agencies had taken varied steps to  implement workforce planning practices for cybersecurity personnel.  For example, five of the eight agencies had established cybersecurity  workforce plans or other agency-wide activities addressing  cybersecurity workforce planning. However, these plans did not  always include strategies for addressing gaps in critical skills or  competencies, among other things. To address these shortcomings,  we made six recommendations to enhance individual agency  workforce planning activities. Of the six agencies to which we made  individual recommendations, five agreed and one neither agreed nor  disagreed with our recommendations. Since our report was issued,  the agencies have implemented most of these recommendations.
In January 2015, we reported that the Office of Personnel  Management (OPM) and a Chief Human Capital Officers Council  working group had identified skills gaps in government-wide, mission- critical occupations, including cybersecurity. We noted that, although  these initial efforts had created an infrastructure for addressing skills  gaps, overall progress was mixed. At times, goals had targets that  were difficult to measure. Likewise, agency officials chose to track  metrics that often did not allow for an accurate assessment of  progress made toward these goals for closing skills gaps. In addition,  OPM had not established time frames or a process for collecting  government-wide staffing and competency data to help agencies  determine the competencies that are critical to successfully achieving  their mission. We pointed out that OPM and selected agencies could  improve efforts to address skills gaps by strengthening their use of  quarterly data-driven reviews (known as HRstats). Based on these  findings, we recommended that OPM (1) strengthen its methodology  for identifying and addressing skills gaps, (2) establish a schedule and  process for collecting government-wide staffing and competency data,  and (3) develop a set of metrics for agency HRstat reviews. OPM  generally concurred with the first and third recommendations, but did  not concur with the second recommendation, citing funding  constraints. These recommendations have not yet been implemented.
In an April 2015 report, the Partnership for Public Service noted a  continuing need for the government to develop an understanding of  the size and skills of the current cybersecurity workforce; project the  government’s future cybersecurity human capital needs; assess  qualitative and quantitative gaps between the current workforce and  the workforce needed to address future challenges; and develop  strategies, as well as program and policy goals, designed to close  those gaps. The Partnership attributed these challenges to the lack of  a government-wide master cybersecurity workforce strategy, leaving  agencies to operate largely on their own under a haphazard system.
In November 2016, we reported that five selected agencies had made  mixed progress in assessing their IT skill gaps. These agencies had  started focusing on identifying cybersecurity staffing gaps, but more  work remained in assessing competency gaps and in broadening the  focus to include the entire IT community. For example, four of the five  agencies had not demonstrated an established IT workforce planning  process, which would assist them in identifying and addressing skill  gaps. In several cases, these shortcomings were due to a lack of  comprehensive policies and procedures for assessing workforce  needs. We recommended that the agencies take steps to fully  implement IT workforce planning practices. The agencies agreed or  partially agreed with our recommendations; however, the  recommendations have not yet been implemented.
section_title: Recruiting and Retaining Qualified Staff
paragraphs: An effective hiring process meets the needs of agencies and managers  by filling positions with quality employees through the use of a timely,  efficient, and transparent process. To recruit and retain personnel with the  critical skills needed to accomplish their missions, federal agencies can  offer incentives, such as recruitment, relocation, and retention incentive  payments; student loan repayments; annual leave enhancements; and  scholarships. Agencies can also use training and development  opportunities as an incentive to help recruit and retain employees.
However, we and others have found that agencies have faced persistent  challenges in recruiting and retaining well-qualified cybersecurity talent:  In November 2011, we reported that the quality of cybersecurity  training and development programs varied significantly across the  eight agencies in our review. Additionally, most of the eight agencies  in our review said they used some incentives to support their  cybersecurity workforce; however, they either had not evaluated or  had difficulty evaluating whether incentives effectively support hiring  and retaining highly skilled personnel in hard-to-fill positions. We also  found that, although OPM had planned to develop guidance and tools  to assist agencies in the administration and oversight of their incentive  programs, it had not yet done so. To address this shortcoming, we  recommended that OPM finalize and issue guidance to agencies on  how to track the use and effectiveness of incentives for hard-to-fill  positions, including cybersecurity positions; OPM has since  implemented this recommendation.
In August 2016, we reported the results of our review of the current  authorities of agency chief information security officers (CISO).  Among other things, CISOs identified key challenges they faced in  fulfilling their responsibilities. Several of these challenges related to  the cybersecurity workforce, such as not having enough personnel to  oversee the implementation of the number and scope of security  requirements. In addition, CISOs stated that they were not able to  offer salaries that were competitive with the private sector for  candidates with high-demand technical skills. Furthermore, CISOs  said that some security personnel lacked security skills or were not  sufficiently trained.
Others have also noted the challenge of hiring and retaining qualified  cybersecurity professionals. For example, the April 2015 Partnership  for Public Service report highlighted obstacles to federal recruitment  of cybersecurity talent, including the inability of the government to  offer salaries competitive with those in the private sector. In addition,  according to a January 2017 report from the federal CIO Council,  chief information officers (CIO) reported that it is difficult for agencies  to offer well-qualified candidates a salary that is competitive with the  private sector. This salary issue in turn can create problems in  retaining talented government employees. OMB has also identified  additional potential issues, such as job candidates’ concern that a  private sector position may give them more autonomy and a more  flexible work culture than a federal information security position.
section_title: Navigating the Federal Hiring Process
paragraphs: We have previously reported that the federal hiring process all too often  does not meet the needs of (1) agencies in achieving their missions; (2)  managers in filling positions with the right talent; and (3) applicants for a  timely, efficient, transparent, and merit-based process. In short, we noted  that the federal hiring process is often an impediment to the very  customers it is designed to serve in that it makes it difficult for agencies  and managers to obtain the right people with the right skills, and  applicants can be dissuaded from public service because of the complex  and lengthy procedures.
As we and others have reported, the federal hiring process can pose  obstacles to the efficient and effective hiring of cybersecurity talent:
The Partnership for Public Service reported in 2015 that the  government loses top candidates to a slow and ineffective hiring  process characterized by “self-inflicted” process delays and outdated  assessment methods. The CIO Council also reported in January  2017 that CIOs were often frustrated with the federal hiring process.  Its report noted that the hiring process for federal agencies often takes  significantly longer than in the private sector and that selection  officials with limited cybersecurity expertise may misevaluate  candidates’ capabilities, leading to under-qualified candidates  advancing ahead of well-qualified ones.
In August 2016, we issued a report on the extent to which federal  hiring authorities were meeting agency needs. Although competitive  hiring has been the traditional method of hiring, agencies can use  additional hiring authorities to expedite the hiring process or achieve  certain public policy goals. Among other things, we noted that  agencies rely on a relatively small number of hiring authorities (as  established by law, executive order, or regulation) to fill the vast  majority of hires into the federal civil service. Further, while OPM  collects a variety of data to assess the federal hiring process, neither  it nor agencies used this information to assess the effectiveness of  hiring authorities. Conducting such assessments would be a critical  first step in making more strategic use of the available hiring  authorities to more effectively meet their hiring needs. We  recommended that OPM work with agencies to determine the extent  to which hiring authorities were meeting agency needs and use this  information to refine, eliminate, or expand authorities as needed. OPM  generally concurred with these recommendations but has not yet  implemented them.
As noted previously, we have identified both information security and  strategic human capital management as government-wide high-risk  areas. To address these high-risk areas, agencies need to take focused,  concerted action, including implementing our outstanding  recommendations, which can help mitigate the challenges associated  with developing an effective cybersecurity workforce. This will help ensure  that the federal government has a capable cybersecurity workforce with  the necessary knowledge, skills, and competencies for carrying out its  mission.
section_title: Recent Federal Initiatives, Legislation, and Ongoing Activities Are Intended to Improve the Federal Cybersecurity Workforce
paragraphs: Based on a review of our previous work, we identified a number of  ongoing efforts to improve the cybersecurity workforce. The executive  branch, Congress, and federal agencies have recognized the need for,  and taken actions aimed at achieving, an effective federal cybersecurity  workforce. Specifically, executive branch organizations have initiatives  under way to help government agencies address workforce-related  challenges; Congress passed legislation intended to improve workforce  planning and hiring; and federal agencies have instituted other ongoing  activities that may assist the federal government in enhancing its  cybersecurity workforce.
subsections: section_title: Multiple Executive Branch Initiatives Are Under Way to Address Workforce Challenges
paragraphs: A number of executive branch initiatives have been undertaken over the  last several years intended to improve the federal cybersecurity  workforce. They include the following, among others:
The National Initiative for Cybersecurity Education (NICE): This  initiative, which began in March 2010, is a partnership between  government, academia, and the private sector that is coordinated by  NIST to help improve cybersecurity education, including efforts  directed at training, public awareness, and the federal cybersecurity  workforce. The mission of NICE is to energize and promote a robust  network and an ecosystem of cybersecurity education, training, and  workforce development. NICE fulfills this mission by coordinating with  government, academic, and industry partners to build on existing  successful programs, facilitate change and innovation, and bring  leadership and vision to increase the number of skilled cybersecurity  professionals helping to keep our nation secure.
National Cybersecurity Workforce Framework: In April 2013, NICE  published a national cybersecurity workforce framework, which was  intended to provide a consistent way to define and describe  cybersecurity work at any public or private organization, including  federal agencies. The framework defined 31 cybersecurity-related  specialty areas that were organized into seven categories: (1)  securely provision, (2) operate and maintain, (3) protect and defend,  (4) investigate, (5) collect and operate, (6) analyze, and (7) oversight  and development.
In November 2016, NIST issued a draft revision to the framework.  Among other things, the revised framework defines work roles within  each specialty area and also describes cybersecurity tasks for each  work role and the knowledge, skills, and abilities demonstrated by a  person whose cybersecurity position includes each work role. The  revised framework is intended to enable agencies to examine specific  IT, cybersecurity, and cyber-related work roles, and identify personnel  skills gaps, rather than merely examining the number of vacancies by  job series.
OMB Cybersecurity Strategy and Implementation Plan: In October  2015, OMB issued its Cybersecurity Strategy and Implementation  Plan (CSIP) for the Federal Civilian Government to present the results  of a comprehensive review of the federal government’s cybersecurity  (known as the “Cybersecurity Sprint”). According to the CSIP, the  Cybersecurity Sprint identified two key observations related to the  federal cybersecurity workforce: (1) the vast majority of federal  agencies cited a lack of cyber and IT talent as a major resource  constraint that impacted their ability to protect information and assets;  and (2) there were a number of existing federal initiatives to address  this challenge, but implementation and awareness of these programs  was inconsistent. To address these challenges, among other things,  the CSIP tasked OPM to provide agencies with information on a  number of hiring, pay, and leave flexibilities to help recruit and retain  individuals in cybersecurity positions, and called for OMB and OPM to  publish a cybersecurity human resources strategy and identify  possible actions to help the federal government recruit, develop, and  maintain a pipeline of cybersecurity talent.
Cybersecurity National Action Plan: Announced by the White  House in February 2016, the Cybersecurity National Action Plan was  intended to build on the CSIP activities while calling for innovation and  investments in cybersecurity education and training to strengthen the  talent pipeline. As part of this plan, the fiscal year 2017 President’s  Budget proposed investing $62 million to, among other things, expand  the CyberCorps Scholarship for Service program to include a  CyberCorps Reserve program offering scholarships for americans  who wish to gain cybersecurity education and serve their country in  the civilian federal government; develop a cybersecurity core  curriculum for academic institutions; and strengthen the National  Centers for Academic Excellence in Cybersecurity Program to  increase the number of participating academic institutions and expand  cybersecurity education across the nation. These initiatives were  intended to help the federal government recruit and retain  cybersecurity talent with the technical skills, policy expertise, and  leadership abilities necessary to secure federal assets and networks  well into the future.
Federal Cybersecurity Workforce Strategy: As called for by the  CSIP, OMB and OPM issued the Federal Cybersecurity Workforce  Strategy in July 2016, detailing government-wide actions to identify,  expand, recruit, develop, retain, and sustain a capable and competent  workforce in key functional areas to address complex and ever- evolving cyber threats. The strategy identified a number of key  actions within four broad goals to address cybersecurity workforce  challenges. Table 1 describes the goals of the strategy and  associated activities.
According to OMB’s 2016 report on agency implementation of the Federal  Information Security Modernization Act of 2014 (FISMA), agencies had  made progress in implementing this strategy to address workforce  shortages. Specifically, OMB reported that agencies hired over 7,500  cybersecurity and IT employees in 2016; by comparison, federal agencies  hired 5,100 cybersecurity and IT employees in 2015.
These executive branch initiatives include many actions that could help  address the challenges of identifying and closing skill gaps, recruiting and  retaining staff, and navigating the federal hiring process. While  responsible agencies have begun to take action on many of these items,  it will be important to continue this momentum if these efforts are to be  effectively implemented and foster a significant improvement in the  federal cybersecurity workforce.
section_title: Recent Laws Address Cybersecurity Workforce Issues
paragraphs: In addition to the aforementioned executive-level initiatives, several  recently enacted federal laws include provisions aimed at improving the  federal cybersecurity workforce. For example:
The Cybersecurity Enhancement Act of 2014 includes provisions  intended to address challenges related to recruiting and hiring.
Specifically, the law requires the Department of Commerce, National  Science Foundation (NSF), and DHS, in consultation with OPM, to  support competitions and challenges to identify, develop, and recruit  talented individuals to perform duties relating to the security of  information technology in federal, state, local, and tribal government  agencies, and the private sector. The law also calls for NSF, in  coordination with OPM and DHS, to continue a federal cyber  scholarship-for-service program to recruit and train the next  generation of information technology professionals, industrial control  system security professionals, and security managers to meet the  needs of the cybersecurity mission for federal, state, local, and tribal  governments.
The Border Patrol Agent Pay Reform Act of 2014 includes  provisions intended to improve recruiting and hiring of cybersecurity  staff at DHS. Specifically, the law authorizes the Secretary of  Homeland Security to establish, as positions in the excepted service,  such positions in DHS as the Secretary determines to be necessary to  carry out certain responsibilities relating to cybersecurity.
The Homeland Security Cybersecurity Workforce Assessment  Act (2014) requires DHS to take certain actions related to  cybersecurity workforce planning. Specifically, the Secretary of  Homeland Security is to identify all positions in DHS that perform  cybersecurity functions and identify cybersecurity work categories and  specialty areas of critical need.
The Federal Cybersecurity Workforce Assessment Act of 2015  assigns specific workforce planning-related actions to federal  agencies. These actions include developing a coding structure to capture the work roles outlined in  the revised National Cybersecurity Workforce Framework (OPM,  in coordination with NIST); establishing procedures for implementing the coding structure to  identify all civilian cybersecurity positions (OPM, in coordination  with DHS, NIST, and the Office of the Director of National  Intelligence);  identifying all IT or cyber positions at agencies, and assigning the  appropriate codes to each (federal agencies); and  identifying IT and cyber-related work roles of critical need, and  report these needs to OPM (each federal agency, in consultation  with OPM, NIST, and DHS).
The act also requires GAO to analyze and monitor the implementation  of the act’s requirements and report on this assessment to  Congress. We plan to report on the results of our review by no later  than December 18, 2018.
Similar to the executive branch initiatives discussed above, these laws  call for actions that, if effectively implemented, can address challenges  related to skill gaps and recruiting, hiring, and retaining skilled  cybersecurity professionals. Further, these laws are an important  mechanism to hold agencies accountable for taking action and  demonstrating results in building an effective cybersecurity workforce.
section_title: Other Ongoing Activities Could Assist Agencies in Recruiting and Retaining Cybersecurity Professionals
paragraphs: Beyond the government-wide initiatives and recently enacted legislation  discussed previously, federal agencies have instituted other ongoing  activities that may assist the federal government in enhancing its  cybersecurity workforce. These include the following, among others:
Promoting cyber and science, technology, engineering and  mathematics (STEM) education: A recent presidential commission  on cybersecurity highlighted the need for federal programs that  support education at all levels to incorporate cybersecurity awareness  for students as they are introduced to and provided with Internet- based devices. As an example of such a program, the National  Integrated Cyber Education Research Center (NICERC), an academic  division of the Cyber Innovation Center funded by DHS, was created  to design, develop, and advance both cyber and STEM academic  outreach and workforce development programs across the nation.  NICERC develops cyber-based curricula for use by K-12 teachers  across the country. The curricula developed by NICERC is free to any  K-12 educator within the United States and comprises a library of  cyber-based curricula that provides opportunities for students to  become aware of cyber issues, engage in cyber education, and enter  cyber career fields.
CyberCorps scholarship: According to the Partnership for Public  Service, one way agencies can increase the supply of cyber talent is  through the use of undergraduate and graduate scholarships to  promising cybersecurity and STEM students. One such program—the  Scholarship for Service program operated by DHS and NSF— provides scholarships and stipends to undergraduate and graduate  students who are pursuing information security-related degrees, in  exchange for 2 years of federal service after graduation. According to  a November 2015 memo from the federal Chief Human Capital Officer  Council, since 2000 these scholarships have been awarded to more  than 1,650 students. There are also nearly 400 graduating students in  related academic programs to meet agencies’ cybersecurity needs  each year.
National Centers of Academic Excellence: Sponsored by DHS and  the National Security Agency, this program designates specific 2- and  4-year colleges and universities as “centers of academic excellence”  (CAE) based on their robust degree programs and close alignment to  specific cybersecurity-related knowledge units, validated by subject  matter experts. Currently, over 200 colleges and universities across  44 states, the District of Columbia, and the Commonwealth of Puerto  Rico are designated CAEs for cyber-related degree programs. This  program is intended to help institutions of higher education produce  skilled and capable cybersecurity professionals and equip students  with the necessary knowledge, skills, and abilities needed to protect  and defend our nation’s infrastructures.
National Initiative for Cybersecurity Careers and Studies: DHS, in  partnership with several other agencies, launched the National  Initiative for Cybersecurity Careers and Studies (NICCS) in February  2013 as an online resource to connect government employees,  students, educators, and industry with cybersecurity training providers  across the nation. NICCS provides a catalog of cybersecurity-focused  training courses that are delivered by accredited universities, CAEs,  federal agencies, and other training providers. Each course is mapped  to the National Cybersecurity Workforce Framework.
In coordination with a strategic, government-wide approach to improving  the workforce, these programs and activities are intended to provide  valuable resources for agencies as they attempt to mitigate the shortage  of cybersecurity professionals.
In summary, recruiting, developing, and retaining a qualified and  competent cybersecurity workforce remains a critical challenge for the  federal government. This is highlighted by the ever-evolving nature of the  cyber threat and the vulnerabilities that we have identified over the years  in agencies’ information security programs. The federal government  continues to be challenged in key areas—such as identifying skills gaps,  recruiting and retaining qualified staff, and navigating the federal hiring  process—that are essential to ensuring the adequacy of its cybersecurity  workforce. To better equip agencies to adequately protect federal  information and information systems from increasingly sophisticated and  ever-changing cyber threats, it is critical that a number of our open  recommendations be addressed.
Recent federal initiatives and legislation are intended to address the  challenges associated with the cybersecurity workforce, and agencies  may also be able to draw on other ongoing activities to help assist in  mitigating cybersecurity workforce gaps.
If effectively implemented, these initiatives, laws, and activities could help  establish the cybersecurity workforce needed to secure and protect  federal IT systems.
Chairman Hurd, Ranking Member Kelly, and Members of the  Subcommittee, this concludes my statement. I would be pleased to  address any questions that you have.
section_title: Contact and Staff Acknowledgments
paragraphs: If you have any questions about this statement, please contact Nick  Marinos at (202) 512-9342 or marinosn@gao.gov. Other contributors to  this statement include Tammi Kalugdan, assistant director; William Cook,  analyst-in-charge; Chris Businsky; David Hong; Franklin Jackson; Lee  McCracken; Luis Rodriguez; Adam Vodraska; Daniel Wexler; and Merry  Woo.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.