Cybersecurity Workforce: Agencies Need to Improve Baseline Assessments and Procedures for Coding Positions
Released: 2018-06-14T00:00:00

Letter

Background

Federal agencies and our nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The information systems and networks that support federal operations are highly complex and dynamic, technologically diverse, and often geographically dispersed. This complexity increases the difficulty in identifying, managing, and protecting the myriad of operating systems, applications, and devices comprising the systems and networks.

Cybersecurity professionals can help to prevent or mitigate the vulnerabilities that could allow malicious individuals and groups access to federal IT systems. The ability to secure federal systems depends on the knowledge, skills, and abilities of the federal and contractor workforce that uses, implements, secures, and maintains these systems.

Nevertheless, the Office of Management and Budget (OMB) has noted that the federal government and private industry face a persistent shortage of cybersecurity and IT talent to implement and oversee information security protections to combat cyber threats. In addition, the RAND Corporation and the Partnership for Public Service have reported that there is a nationwide shortage of cybersecurity experts, in particular, in the federal government. According to these reports, this shortage of cybersecurity professionals makes securing the nation’s networks more challenging and may leave federal IT systems vulnerable to malicious attacks. The persistent shortage of cyber-related talent has given rise to efforts to identify and assess the federal cybersecurity workforce.

The National Initiative for Cybersecurity Education (NICE) Created a Framework for Defining Cybersecurity Workforce Positions

NICE, led by NIST, is a partnership among government, academia, and the private sector focused on cybersecurity education, training, and workforce development. The mission of NICE is to energize and promote a robust network and an ecosystem of cybersecurity education, training, and workforce development. NICE fulfills this mission by coordinating with government, academic, and industry partners to build on existing successful programs, facilitate change and innovation, and bring leadership and vision to increase the number of skilled cybersecurity professionals that are helping to keep our nation secure. NICE issued an initial draft of the National Cybersecurity Workforce Framework (National Framework) for public comment in September 2011 and the final version 1.0 in April 2013. The National Framework was intended to help identify, describe, and assess all cybersecurity roles within an organization. The National Framework organized cybersecurity job functions into 7 categories and 31 specialty areas:

Category: a high-level grouping of common cybersecurity functions.

Categories group together work and workers that share common major functions, regardless of job titles or other occupational terms.

Specialty area: an area of concentrated work, or function, within cybersecurity and related work. Related specialty areas are grouped together into categories. In version 1.0 of the National Framework, each specialty area was also associated with a distinct set of cybersecurity related tasks and knowledges, skills, and abilities.

In November 2016, NIST issued draft special publication 800-181 which revised and replaced earlier versions of the National Framework. The draft was co-authored by NIST, DOD, and DHS and was renamed the NICE Cybersecurity Workforce Framework (NICE Framework). In August 2017, NIST published the final version of the special publication.

The NICE Framework is intended to help the federal government better identify cybersecurity workforce needs by enabling agencies to examine specific cybersecurity work roles, and identify personnel skills gaps, rather than merely examine the number of vacancies by job series. The NICE Framework added 2 additional specialty areas within the 7 categories. Figure 1 identifies the 7 categories and the 33 specialty areas in the NICE Framework.

The NICE Framework also introduced the concept of work roles as the third component of cybersecurity job functions. Work roles provide a more detailed description of the roles and responsibilities of cybersecurity job functions than do the category and specialty area components of the NICE Framework. The NICE Framework defines one or more work roles within each specialty area. For example, as depicted in figure 2, the NICE Framework defined 11 work roles within the 7 specialty areas in the “Securely Provision” category.

OPM Has Led Several Efforts to Assess the Federal Cybersecurity Workforce

In October 2012, in coordination with a NICE interagency working group, OPM published a cybersecurity employment coding structure that aligned with the initial draft version of the National Cybersecurity Workforce Framework. The coding structure assigned a unique 2-digit cybersecurity employment code to each category and specialty area in the NICE Framework. According to OPM, the coding of federal positions with cybersecurity functions was intended to enhance agencies’ ability to identify critical cybersecurity workforce needs, recruit and hire employees with needed skills, and provide appropriate training and development opportunities to cybersecurity employees.

In July 2013, OPM initiated the Special Cybersecurity Workforce Project to support federal efforts to reduce the cybersecurity workforce skills gaps across agencies. Agencies were to use the definitions of cybersecurity work, as described in the National Cybersecurity Workforce Framework, along with OPM’s cybersecurity coding structure, to code positions performing cybersecurity work by the end of fiscal year 2014. The project was intended to enable agencies to identify and address their needs for cybersecurity skill sets to meet their missions.

In July 2016, OPM and the Office of Management and Budget (OMB) issued the Federal Cybersecurity Workforce Strategy. The strategy details government-wide actions to identify, expand, recruit, develop, retain, and sustain a capable and competent workforce in key functional areas to address complex and ever-evolving cyber threats. The strategy identifies a number of actions intended to address cybersecurity workforce challenges in: (1) identifying cybersecurity workforce needs, (2) expanding the cybersecurity workforce through education and training, (3) recruiting and hiring highly skilled talent, and (4) retaining and developing highly skilled talent.

The strategy states that OPM is to expand cybersecurity position coding and agencies are to conduct strategic workforce planning. These actions are related to the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, under which OPM is to establish an employment coding structure and agencies are to identify and report on cybersecurity workforce critical needs.

Figure 3 depicts a timeline of recent efforts to assess the federal cybersecurity workforce.

OPM Issued a Cybersecurity Position Coding Structure, Procedures, and Progress Report Later Than the Deadlines Established in the Act OPM Developed a 3-digit Cybersecurity Coding Structure

As required by the Federal Cybersecurity Workforce Assessment Act of 2015, OPM developed a cybersecurity coding structure under NICE, issued guidance to implement the coding structure to identify all federal civilian cybersecurity positions, and provided a progress report to Congress on the implementation of the act. However, the coding structure and procedures were issued later than the act’s deadlines because OPM was working with the National Institute of Standards and Technology (NIST) to align the structure and procedures with the draft version of the NICE Cybersecurity Workforce Framework, which NIST issued later than planned. The delays in issuing the coding structure and procedures have extended the expected time frames for implementing subsequent provisions of the act.

The Federal Cybersecurity Workforce Assessment Act of 2015 (the act) required OPM, in coordination with NIST, to develop a cybersecurity coding structure by June 15, 2016.

OPM addressed this requirement by developing a 3-digit cybersecurity employment coding structure that fully aligns with the NICE Cybersecurity Workforce Framework. OPM issued version 1 of the coding structure on November 15, 2016, 5 months after the deadline established in the act.

The coding structure assigns a unique 3-digit cybersecurity employment code to each work role outlined in the draft version of the NICE Cybersecurity Workforce Framework. Table 1 presents an example of the 3-digit employment codes associated with one category—”Securely Provision”—and its component specialty areas and work roles.

Although the act had called for the coding structure to be established by June 15, 2016, OPM officials explained that the coding structure was issued 5 months later than the established deadline because the structure was to be aligned with the NICE Cybersecurity Workforce Framework. However, the draft version of the NICE Framework was not issued until November 2, 2016.

According to NIST officials, the issuance of the draft NICE Framework was delayed because some of the knowledge, skills, and abilities (KSA) and task statements that had been originally developed by the intelligence community were marked as sensitive. NIST delayed publication of the draft NICE Framework until officials in the intelligence community had removed any sensitivity designations on the KSAs and task statements.

OPM Developed Government-wide Procedures for Assigning Codes to Civilian Cybersecurity Positions

The act required OPM, in coordination with NIST, DHS, and ODNI to establish procedures to assist agencies in implementing the cybersecurity coding structure. OPM was to develop the procedures no later than September 18, 2016.

In accordance with this requirement, OPM coordinated with NIST, DHS, and ODNI to develop its Guidance for Assigning New Cybersecurity Codes to Positions with Information Technology, Cybersecurity, and Cyber-Related Functions. The guidance provides instructions on how agencies are to assign the 3-digit cybersecurity employment codes to filled and vacant positions, including required activities for identifying and assigning codes to cybersecurity positions. The guidance also referenced additional updates and guidance that were to be posted on OMB’s MAX website.

OPM posted the guidance on the Chief Human Capital Officers Council website on January 4, 2017, 4 months after the deadline established in the act. OPM officials said they delayed issuance of the guidance so that it could be released in coordination with the cybersecurity coding structure, which was dependent on the release of the draft NICE Framework.

OPM Submitted a Progress Report to Congress

The act required OPM to report on the progress of agencies’ implementation of the act’s requirements, as well as OPM’s efforts to develop a coding structure and government-wide coding procedures. OPM was to submit the progress report to the appropriate congressional committees no later than June 15, 2016.

OPM prepared and submitted its progress report to the congressional committees identified in the act on July 12, 2016, about 1 month after the act’s deadline. Among other things, the report stated the following:

OPM was coordinating closely with NICE to revise the cybersecurity coding structure to align with the latest version of the NICE Framework, which was scheduled to be finalized in September 2016.

OPM had begun an education campaign to inform the federal community of the act and its requirements and was collaborating with stakeholders and interagency partners on ideas for how to implement the requirements of the act.

An official in OPM’s Employee Services division stated that OPM was delayed in completing and submitting the report to congressional committees due to the agency’s internal review process.

OPM’s Delays in Completing Required Activities Have Resulted in Later Implementation of Other Provisions of the Act

Because the deadlines for agencies to implement certain provisions of the act are contingent on the completion of earlier activities, delays by OPM in issuing the revised cybersecurity coding structure and the government- wide coding procedures have extended the due dates for agencies to implement other provisions of the act by about 4 months. Specifically:

The act required agencies to establish procedures for identifying all IT or cybersecurity positions and for assigning the appropriate employment code to each position no later than 3 months after OPM issued the government-wide coding procedures. If OPM had issued the coding procedures by September 2016 as the act required, agencies would have been required to establish their coding procedures by December 2016. However, because OPM did not issue the government-wide procedures until January 2017, agencies did not have to develop their coding procedures until April 2017.

Similarly, agencies were to assign employment codes to all of their cybersecurity positions no later than 1 year after establishing their coding procedures. Had agencies been required to establish their procedures by December 2016, they would have been required to assign the employment codes by December 2017. However, because they did not have to develop coding procedures until April 2017, they were therefore required to complete the assignment of employment codes by April 2018.

Further, agencies are required to identify and report on cybersecurity work roles of critical need beginning 1 year after the employment codes are assigned. If agencies had been required to assign employment codes by December 2017, they would have to begin reporting on their critical needs by December 2018. However, because they did not have to complete the assignment of employment codes until April 2018, they are therefore required to identify and begin reporting on critical needs by April 2019.

Figure 4 depicts the delays in earlier activities which can result or have resulted in later implementation of subsequent provisions of the act.

Most CFO Act Agencies Submitted Baseline Assessments, but the Results May Not Be Reliable

Most of the 24 CFO Act agencies conducted baseline assessments identifying the extent to which their cybersecurity employees held certifications and submitted them to Congress as required by the act. However, 3 agencies did not complete the assessments for various reasons, such as a lack of resources and tools to do so. Further, of the 21 agencies that did complete the assessments, 4 agencies did not address all of the reportable information, such as the extent to which personnel without certifications were ready to obtain them or strategies for mitigating any gaps. In addition, the assessments conducted by the 21 agencies did not contain complete, comprehensive, or consistent information on the certifications held by agencies’ cybersecurity employees due to limitations in the ability of the agencies to collect the needed information. As a result, the information collected and reported by most agencies about the certifications held by agency cybersecurity personnel may be of limited value for assessing the credentials and qualifications of their cybersecurity workforces.

Most CFO Agencies Conducted Baseline Assessments but Several Agencies Did Not Include All Reportable Information

The Federal Cybersecurity Workforce Assessment Act of 2015 required agencies to prepare baseline assessment reports identifying the extent to which their cybersecurity workforces held industry-recognized certifications as identified under NICE. OPM’s August 2016 memorandum on the requirements and time frames of the act further stated that agencies were to report the results of the assessments to the appropriate congressional committees of jurisdiction by December 2016.

In the absence of a NICE-defined list of appropriate industry-recognized certifications, 21 of the 24 agencies covered by the CFO Act had conducted baseline assessments of the certifications held by their cybersecurity workforces and submitted the baseline assessment reports to Congress as of March 2018. Table 2 shows the status of the agencies’ submissions of the baseline assessments as of March 2018.

Three agencies did not conduct baseline assessments: Instead of conducting a baseline assessment as called for by the act, DHS submitted its 2016 Comprehensive Cybersecurity Workforce Update to Congress in March 2017. However, this report did not include a baseline assessment of the department’s workforce as called for by the act. The report noted that DHS’s Office of the Chief Human Capital Officer lacked the ability to view or easily produce consolidated reports on employee certifications from all DHS components, and lacked consistent and detailed information about the readiness of additional employees to complete certification exams and specific certifications identified by components as being required for success in their positions. The report further noted that the department was working with cybersecurity subject matter experts from each component to revalidate the certifications most important to the work of their organizations and to organize the information according to the NICE Framework.

The Department of Housing and Urban Development (HUD) prepared an assessment of IT specialist skills, but did not conduct a baseline assessment that identified the extent to which its cybersecurity workforce held industry-recognized certifications. Officials in HUD’s Office of the Chief Information Officer (CIO) and Office of the Chief Human Capital Officer stated that the department intends to conduct a workforce assessment of its cybersecurity employees. The officials did not provide a time frame for when the assessment would be conducted.

The CIO and Chief Human Capital Officer of the Small Business Administration (SBA) stated that the agency has been unable to complete a baseline assessment due to resource constraints. The officials added that the agency intends to conduct workforce planning efforts in the future. However, they did not provide a time frame for when the assessment would be conducted.

By not conducting baseline assessments, DHS, HUD, and SBA lack valuable information about the knowledge and skills of their cybersecurity employees. This lack of information limits the agencies’ ability to effectively gauge the competency of individuals who are charged with ensuring the confidentiality, integrity, and availability of federal information and information systems. Additionally, by not conducting or reporting on the assessment, the agencies have not provided Congress the information it required in the act regarding existing credentials and certifications of personnel with information technology, cybersecurity, or other cyber-related job functions.

Not All Agencies That Prepared Baseline Assessment Reports Addressed Reportable Information

The act required agencies’ baseline assessment reports to identify the following: the percentage of personnel with cybersecurity job functions who held the appropriate industry-recognized certifications as identified under NICE; the level of preparedness of cybersecurity personnel without existing credentials to take certification exams; and a strategy for mitigating any gaps in (1) personnel holding industry- recognized certifications and (2) the preparedness of personnel without existing credentials to take certification exams.

In September 2016, OPM provided a template that agencies could use in reporting on their baseline assessments. Using the template, agencies could report on the number and percentage of surveyed staff with current certifications and the number and percentage of staff without such certifications that were planning to obtain them within the next year. Human resource strategists and program management officials in OPM’s Employee Services division stated that the template was a guide to help agencies with the reporting process; however, agencies were not required to use the template or report their results in the format described in the template.

The 21 CFO agencies that prepared baseline assessment reports did not always address the reportable information in their baseline assessments. Specifically, of the 21 assessments that the CFO agencies had prepared, all of the assessments included information on the percentage of cybersecurity personnel holding certifications; 17 assessments discussed the level of preparedness for personnel without certifications to take certification exams; and 20 included strategies for mitigating certification gaps. Table 3 shows the extent to which the 21 agencies’ assessments reported this information.

Moreover, 4 of the 21 agencies did not address all reportable information in their baseline assessments. Specifically:

The Department of Commerce did not assess and did not report information on (1) the level of preparedness for personnel who did not hold certifications to take certification exams or (2) strategies for mitigating gaps. Officials in Commerce’s Office of Human Resources Management and Office of the CIO stated that information on the level of preparedness and gaps was not readily available because they have not fully identified and coded the department’s cybersecurity workforce, and there is no federal requirement for cybersecurity personnel to hold certifications. The officials stated that they did not have the time or resources to assess these reporting requirements.

Officials in the Department of Energy’s Office of the Chief Human Capital Officer stated that they did not assess the level of preparedness for personnel without certifications to take certification exams because the department does not require its cybersecurity personnel to hold certifications. As a result, they did not have criteria for identifying personnel who are prepared to take certification exams.

According to the Department of the Interior’s Principal Deputy Assistant Secretary for Policy, Management, and Budget, the department did not assess the level of preparedness for personnel without certifications to take certification exams because neither OPM nor the department currently requires certifications for these cybersecurity positions. However, the department's Office of Human Resources and Office of the Chief Information Officer are exploring options to determine the level of preparedness across its IT workforce.

According to the National Aeronautics and Space Administration’s (NASA) baseline assessment report, the agency did not assess the level of preparedness for personnel without certifications to take certification exams because the agency does not require its cybersecurity personnel to maintain certifications. The agency did not know how many of its personnel were planning to seek certifications on their own.

Data regarding the number of cybersecurity employees that hold certifications and the level of preparedness of personnel without certifications can be a useful indicator of the skills and knowledge of an agency’s cybersecurity workforce. In addition, strategies for addressing gaps can help an agency increase the skills and knowledge of its cybersecurity workforce. By not including all reportable information in the assessments, these four agencies may lack valuable information that could help them identify and meet the certification and training needs of their cybersecurity employees who are charged with protecting federal information and information systems from cyberattacks. However, as discussed later in this report, the absence of NICE identified appropriate industry-recognized certifications may have also contributed to uncertainty for agencies in their efforts to comply with the requirements of the act.

Limitations in Agency Baseline Assessments Raise Concerns About the Reliability of Information about Certifications Held by Agencies’ Cybersecurity Employees

Limitations in the 21 agencies’ baseline assessments raise concerns about the reliability of the assessments, thus constraining the conclusions that can be drawn from their results about the federal cybersecurity workforce’s certifications. The 21 agencies in our review that conducted assessments were not able to collect complete, comprehensive, or consistent information about the certifications held by their cybersecurity workforces for various reasons. As a result, these agencies had limited assurance that the certification information contained in their baseline assessment reports was reliable, thereby diminishing the usefulness of the assessments in determining the certification and training needs of their cybersecurity employees.

Agencies Were Required to Assess Cyber Employees’ Certifications before They Had Fully Defined Their Cybersecurity Workforces

As previously noted, OPM’s August 2016 memorandum on the requirements of the act stated that, agencies were to report their baseline assessments to Congress by December 2016. However, according to OPM’s January 2017 coding guidance, agencies were not required to complete the assignment of the appropriate 3-digit employment codes to each position until April 2018. Consequently, agencies were required to submit their reports on the percentage of personnel performing cybersecurity functions who possessed certifications before the agencies had identified all members of their cybersecurity workforce and assigned the 3-digit cybersecurity employment codes to each position.

Because the agencies had not yet fully defined their cybersecurity workforces using the NICE Framework and the 3-digit coding structure, the 21 agencies in our review that prepared assessments did not use consistent criteria to define the population of personnel with cybersecurity job functions that were included in their baseline assessments. Examples of the criteria that these agencies used to define the target populations for their assessments included: cybersecurity employees who had been coded with the 2-digit cybersecurity employment codes during the 2013 Special Cybersecurity Workforce Project; employees within certain occupational series, such as the 2210 Information Technology Management series; personnel within certain roles or organizations, such as the Office of Information Security or the Office of the CIO; or personnel who performed cybersecurity duties for a defined percentage of the time.

As a result of not having fully defined their cybersecurity workforces prior to conducting their baseline assessments, the agencies have limited assurance that their baseline assessments reflected all relevant agency positions or personnel performing cybersecurity functions as defined by the NICE Framework.

Agencies Were Not Always Able to Obtain Certification Information from All Relevant Employees

Several agencies reported that they were not able to obtain information on certifications from all of the employees they surveyed when conducting their baseline assessments. Specifically, 6 of the 21 agencies that prepared assessments reported response rates of between 15 and 42 percent to their surveys or data calls to employees for such information. Also, officials from two agencies told us that employees’ responses to their information requests were voluntary due to union and legal concerns. As a result, these agencies have limited assurance that their baseline assessment reports conveyed comprehensive information about all agency cybersecurity personnel and the certifications that they held because of the limited response from employees.

NICE Had Not Defined Appropriate Industry- Recognized Certifications

Although the act required agencies to report on the percentage of personnel who held appropriate industry-recognized certifications as identified under NICE, NICE had not defined such a list of certifications as of the agencies’ reporting deadline of December 2016. In August 2017, a NICE official told us that the organization did not believe it was appropriate for NICE, which is led by NIST, to identify industry appropriate certifications because doing so may be perceived as endorsing certain private certifications over other certifications. Currently, the NICE website describes an effort under a NICE working group—which includes representatives from government, academia, and the private sector—to map industry-recognized certifications to work roles based on the updated NICE Framework. However, this effort has not yet been completed. According to NICE officials, the mapping of certifications to the NICE Framework is expected to be completed by November 2018.

In the absence of a defined list of industry-recognized certifications, the agencies in our review developed their own approaches for determining the certifications on which they based their assessments. Examples of agencies’ approaches included: asking that cybersecurity staff provide input on any or all certifications using a list of certifications developed by the DHS National Initiative for Cybersecurity Careers and Studies, which was referenced in OPM’s reporting template; using certifications identified in the Department of Defense’s (DOD)

Information Assurance Workforce Improvement Program; or having the agency Office of the CIO or cybersecurity workforce- planning workgroup identify certifications to include in the assessment.

Because the baseline assessments were not based on a defined list of certifications, there is limited assurance that the assessments consistently or accurately conveyed the extent to which federal cybersecurity professionals held industry-recognized certifications that are appropriate for their job functions.

Most Agencies Did Not Require Cybersecurity Personnel to Hold Certifications

In addition, no government-wide requirement exists for cybersecurity personnel to hold certifications, and most of the agencies in our review did not require certifications. Specifically:

Although OPM guidance states that agencies may use certifications as a selective factor for some positions where specific qualifications are required, no government-wide requirement exists for positions performing cybersecurity related functions to hold certifications.

Most agencies did not require IT or cybersecurity personnel to hold certifications. Only 6 of the 24 agencies reported that they had requirements for personnel to hold an industry-recognized certification, while only one agency—DOD—required certifications for all cybersecurity positions.

As a result, the information collected by most agencies about the certifications held by agency cybersecurity personnel may be of limited value for assessing the qualifications and skills of their cybersecurity workforces.

Most CFO Act Agencies Established Coding Procedures, but Six Agencies’ Procedures Only Partially Addressed Activities Required by OPM

Almost all of the CFO Act agencies established procedures to identify all of their civilian positions and assign the appropriate cybersecurity employment codes to the positions as called for by the act. However, 6 agencies’ procedures did not fully address 1 or more of 7 activities required by OPM, such as the activities to review all encumbered and vacant positions and annotate reviewed position descriptions with the appropriate employment code. Additionally, DOD did not establish procedures for coding noncivilian cybersecurity positions. By not developing coding procedures that address all of the required activities in their procedures, these agencies may not have reasonable assurance that they will fully realize the benefits of (1) comprehensively identifying the cybersecurity workforce, and (2) applying the employment codes to meet the intended goal of defining the workforce and helping to address critical mission needs.

Most Agencies Established Coding Procedures as Required by the Act

The act required agencies to establish procedures for identifying cybersecurity positions and assigning employment codes to each position. In January 2017, OPM issued a memorandum that required agencies to establish their coding procedures by April 2017. The memorandum also required agencies to perform a number of activities to identify and assign codes to cybersecurity positions. Among others, the memorandum stated that agencies were to: use the updated cybersecurity coding structure to find the appropriate cybersecurity employment code(s); identify encumbered and vacant positions with cybersecurity functions; have their CIO staff, managers, and human resources (HR) and classification staff work together to identify cybersecurity positions; annotate reviewed position descriptions with the appropriate employment code(s); account for the fact that cybersecurity positions will extend beyond the Information Technology Management 2210 (GS-2210) occupational series; assign code “000” to positions that do not perform cybersecurity assign up to three employment codes to each position, in the order of the level of criticality.

Most of the agencies in our review had established coding procedures. Specifically, of the 24 CFO Act agencies, 23 had established procedures. Fourteen of these 23 agencies established their procedures by April 2017 as OPM required, while the remaining 9 agencies established their procedures by March 2018.

Officials from the 9 agencies that did not complete their procedures by April 2017 gave several reasons for their late development or completion of the procedures. For example:

General Services Administration officials said that the procedures were delayed due to their internal review processes.

DOD officials said that the procedures were delayed because of the size and complexity of the processes required to identify and code the large number of civilian cybersecurity positions across the department, and because of the length and complexity of the department’s policy review processes.

In October 2017, an official in DHS’s Office of the Chief Human Capital Officer stated that the department did not plan to develop procedures until the National Finance Center (NFC) payroll systems were updated to accept the 3-digit cybersecurity codes. The NFC systems were updated to accept the new codes in December 2017, and DHS issued its procedures in March 2018.

One agency—the Department of Energy—had not established coding procedures:

An official in the Department of Energy’s Office of the Chief Human Capital Officer stated that, because responsibility for IT is not centralized under the department-level CIO organization (but rather, is distributed throughout the component agencies), the official had not determined who had the authority to issue coding procedures for the entire department. By not establishing coding procedures, the Department of Energy faces increased risk that it will not fully identify its cybersecurity workforce or assign the appropriate employment codes to each position, limiting its ability to identify cybersecurity skills gaps or work roles of critical need.

Agency Procedures Did Not Always Address Required Coding Activities

The agencies that developed coding procedures generally, but did not always, address the seven required activities that we reviewed in their procedures. Specifically, 17 of the 23 agencies that developed procedures addressed all 7 activities in their procedures, while the remaining 6 agencies partially addressed or did not address 1 or more of the 7 activities. Table 4 describes the extent to which agency procedures addressed the activities required by OPM.

The six agencies that did not address all activities required by OPM cited a variety of reasons for not including them in their coding procedures. For example:

An official in the Department of Education’s Office of Human Resources explained that it was not necessary for the coding procedures that were provided to each component to address assigning code “000” to noncybersecurity positions because the Office of Human Resources would assign the “000” code to any position that did not have an assigned code.

An official from the National Science Foundation’s Division of Human Resources Management stated that not addressing all activities may have been an oversight by the agency.

Officials in NASA’s Office of Human Capital Management and its Office of the CIO said they felt that it was unnecessary to address assigning code “000” to noncybersecurity positions in the agency’s coding procedures because the agencies’ existing guidance for assigning the old 2-digit codes specified that such positions should be coded with “00.”

By not addressing all of the activities required by OPM in their procedures, these 6 agencies lack assurance that the activities will be performed or performed consistently throughout their organizations.

DOD Did Not Establish Coding Procedures for Noncivilian Cybersecurity Positions

In addition to developing procedures for civilian positions, the act required DOD to establish government-wide procedures for identifying and assigning employment codes to noncivilian (i.e., military) positions with cybersecurity job functions by June 2017. The act also required DOD to establish its internal departmental procedures for military positions by September 30, 2017.

According to officials in the department’s Office of the CIO and Office of the Chief Human Capital Officer, the only military personnel not currently within DOD are in the Coast Guard (which resides within DHS). Therefore, the department planned to fulfill its requirements to establish government-wide procedures and internal departmental procedures for identifying and coding military positions by establishing a single consolidated procedure. The officials added that the consolidated procedure is to include procedures for DHS to implement the coding structure for uniformed Coast Guard personnel along with the internal DOD procedures.

However, as of February 2018, DOD had not finalized its consolidated coding procedures. An official in the department’s Office of the CIO in February 2018 stated that, because the military services use multiple Human Resources systems that all have to be updated to accommodate the cybersecurity employment codes, the office was working with each of the military services on guidance to meet the act’s deadlines while the services develop implementation plans for updating their human resources systems. Until DOD establishes both government-wide and DOD-specific procedures for identifying and coding noncivilian cybersecurity positions, increased risk exists that DOD and DHS will not be able to identify and code all positions in their noncivilian cybersecurity workforce, limiting the departments’ ability to identify cybersecurity skills gaps or work roles of critical need in their noncivilian cybersecurity workforce.

Conclusions

To implement the objectives of the Federal Cybersecurity Workforce Assessment Act of 2015, OPM and NIST, although delayed, have revised the coding structure and cybersecurity workforce framework, and developed coding procedures to support the identification and assignment of codes to federal cybersecurity positions. In addition, most CFO Act agencies have developed baseline assessments to identify cybersecurity personnel within their agencies that held certifications. Having information on the certifications held by cybersecurity employees can be a useful indicator of the skills and knowledge of an agency’s cybersecurity workforce. However, because agencies have not consistently defined the workforce and NICE had not developed a list of appropriate certifications, efforts such as conducting the baseline assessment to determine the percentage of cybersecurity personnel that hold appropriate certifications have yielded inconsistent and potentially unreliable results. By not conducting assessments or including all required information in the assessments, some of these agencies may lack valuable information that could help them identify the certification and training needs of their cybersecurity employees that are charged with protecting federal information and information systems from cyberattacks.

Lastly, while most CFO agencies have developed procedures for assigning cybersecurity codes to positions, several agencies did not address activities required by OPM. Unless those agencies address all of the activities, they may not have reasonable assurance that they are comprehensively identifying the cybersecurity workforce and applying the correct employment codes. As such, increased risk exists that the federal government will not meet its intended goal to define the cybersecurity workforce and address the critical mission needs for a qualified cybersecurity workforce.

Recommendations for Executive Action

We are making a total of 30 recommendations to 13 agencies in our review to develop and submit their baseline assessments and to fully address the required activities in OPM’s guidance in their procedures for assigning employment codes to cybersecurity positions. Specifically: The Secretary of Commerce should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams, identify strategies for mitigating any gaps identified, and report this information to Congress. (Recommendation 1)

The Secretary of Defense should develop, document, and implement government-wide procedures for identifying IT, cybersecurity, and cyber- related noncivilian positions and assigning employment codes to those positions. (Recommendation 2)

The Secretary of Defense should develop, document, and implement internal departmental procedures for identifying IT, cybersecurity, and cyber-related noncivilian positions and assigning employment codes to those positions. (Recommendation 3)

The Secretary of Education should include requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions in departmental procedures. (Recommendation 4)

The Secretary of Energy should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 5)

The Secretary of Energy should develop, document, and implement departmental procedures for identifying IT, cybersecurity, and cyber- related positions and assigning employment codes to those positions, taking into account the key elements described in OPM’s instructions for agencies’ procedures. (Recommendation 6)

The Secretary of Homeland Security should conduct a baseline assessment of the department’s cybersecurity workforce that includes (1) the percentage of personnel with IT, cybersecurity, or other cyber-related job functions who hold certifications; (2) the level of preparedness of other cyber personnel without existing credentials to take certification exams; and (3) a strategy for mitigating any gaps identified with appropriate training and certification for existing personnel. (Recommendation 7)

The Secretary of Homeland Security should submit a report of the department’s baseline assessment of its existing cybersecurity workforce to the appropriate congressional committees of jurisdiction. (Recommendation 8)

The Secretary of Housing and Urban Development should conduct a baseline assessment of the department’s cybersecurity workforce that includes (1) the percentage of personnel with IT, cybersecurity, or other cyber-related job functions who hold certifications; (2) the level of preparedness of other cyber personnel without existing credentials to take certification exams; and (3) a strategy for mitigating any gaps identified with appropriate training and certification for existing personnel. (Recommendation 9)

The Secretary of Housing and Urban Development should submit a report of the department’s baseline assessment of its existing cybersecurity workforce to the appropriate congressional committees of jurisdiction. (Recommendation 10)

The Secretary of the Interior should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 11)

The Secretary of Labor should include requirements to annotate reviewed position descriptions with the appropriate cybersecurity data standard code(s) in departmental procedures. (Recommendation 12)

The Secretary of Labor should ensure that departmental procedures fully account for the fact that IT, cybersecurity, and cyber-related positions will extend beyond the Information Technology Management 2210 occupational series. (Recommendation 13)

The Secretary of Labor should fully clarify requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions in departmental procedures. (Recommendation 14)

The Secretary of Labor should include requirements to assign up to three employment codes per position in order of their criticality in departmental procedures. (Recommendation 15)

The Administrator of the National Aeronautics and Space Administration should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 16)

The Administrator of the National Aeronautics and Space Administration should include requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions in agency procedures. (Recommendation 17)

The Director of the National Science Foundation should fully clarify requirements to review all encumbered and vacant positions performing IT, cybersecurity, and cyber-related functions in agency procedures. (Recommendation 18)

The Director of the National Science Foundation should include requirements to annotate reviewed position descriptions with the appropriate cybersecurity data standard code(s) in agency procedures. (Recommendation 19)

The Director of the National Science Foundation should ensure that agency procedures account for the fact that IT, cybersecurity, and cyber- related positions will extend beyond the Information Technology Management 2210 occupational series. (Recommendation 20)

The Director of the National Science Foundation should include requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions in agency procedures. (Recommendation 21)

The Director of the National Science Foundation should include requirements to assign up to three employment codes per position in order of their criticality in agency procedures. (Recommendation 22)

The Chairman of the Nuclear Regulatory Commission should ensure that agency procedures account for the fact that IT, cybersecurity, and cyber- related positions will extend beyond the Information Technology Management 2210 occupational series. (Recommendation 23)

The Chairman of the Nuclear Regulatory Commission should fully clarify requirements to assign up to three employment codes per position in order of their criticality in agency procedures. (Recommendation 24)

The Administrator of the Small Business Administration should conduct a baseline assessment of the department’s cybersecurity workforce that includes (1) the percentage of personnel with IT, cybersecurity, or other cyber-related job functions who hold certifications; (2) the level of preparedness of other cyber personnel without existing credentials to take certification exams; and (3) a strategy for mitigating any gaps identified with appropriate training and certification for existing personnel. (Recommendation 25)

The Administrator of the Small Business Administration should submit a report of its baseline assessment of its existing cybersecurity workforce to the appropriate congressional committees of jurisdiction. (Recommendation 26)

The Administrator of the U.S. Agency for International Development should fully clarify requirements to review all encumbered and vacant positions performing IT, cybersecurity, and cyber-related functions in agency procedures. (Recommendation 27)

The Administrator of the U.S. Agency for International Development should fully clarify requirements to annotate reviewed position descriptions with the appropriate cybersecurity data standard code(s) in agency procedures. (Recommendation 28)

The Administrator of the U.S. Agency for International Development should include requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions in agency procedures. (Recommendation 29)

The Administrator of the U.S. Agency for International Development should include requirements to assign up to three employment codes per position in order of their criticality in agency procedures. (Recommendation 30)

Agency Comments and Our Evaluation

We provided a draft of this report to the 24 CFO Act agencies for their review and comment. Of the 13 agencies to which we made recommendations, 7 agencies stated that they agreed with all of the recommendations directed to them; 1 agency agreed with one and did not agree with one recommendation; 2 agencies provided comments but did not state whether they agreed or disagreed with the recommendations; 2 agencies stated that they had no comments; and 1 agency—DOD—did not respond to our request for comments on the report.

In addition, of the 11 agencies to which we did not make recommendations, 2 provided comments on the report and 9 responded that they had no comments on the report. We also received technical comments from 2 agencies, which we have incorporated into the report as appropriate.

The following seven agencies agreed with our recommendations: In its written comments (reprinted in appendix II), the Department of Commerce agreed with our recommendation. The department stated that it will evaluate the level of preparedness for cybersecurity personnel who do not hold certifications to take certification exams, identify strategies for mitigating any gaps identified, and report this information to Congress.

In its written comments (reprinted in appendix III), the Department of Education agreed with our recommendation. The department stated that it had updated its coding guidance to require that positions that do not perform substantial work in information technology, cybersecurity, or cyber-related functions be assigned a code of “000.”

In its written comments (reprinted in appendix IV), the Department of Energy agreed with our recommendations and stated that it has planned, or taken steps to address them. Specifically, with regard to our recommendation concerning cybersecurity certification, the department stated that it plans to conduct a department-wide evaluation of the level of preparedness for its cybersecurity personnel without existing credentials to take certification exams and will report the information to Congress.

In addition, the department stated that it had developed and issued procedures for identifying and coding IT, cybersecurity, and cyber- related positions, as we recommended, and that it had since completed its coding of applicable positions across the department. The department also provided us its updated coding procedures, along with its written comments.

In its written comments (reprinted in appendix V), the Department of Homeland Security agreed with our recommendations. Regarding the recommendation to conduct a baseline assessment of its cybersecurity workforce, the department stated that it is taking steps to collect data about certifications relevant to DHS cybersecurity work. The department also stated that it plans to identify the percentage of its cybersecurity workforce that holds certifications, the percentage prepared to take a relevant certification exam, and strategies for mitigating any gaps. The department added that it plans to provide this information to Congress, as we recommended. The department also provided technical comments, which we have incorporated into this report as appropriate.

In its written comments (reprinted in appendix VI), the Department of the Interior stated that it agreed with our recommendation. The department also indicated that it is exploring options to determine the extent to which its cybersecurity employees who currently do not hold certifications are prepared to take certification exams.

In its written comments (reprinted in appendix VII), the Small Business Administration agreed with our recommendations. The agency also stated that it had recently completed an assessment of its IT workforce and reported on existing skills gaps, and that it plans to execute its IT workforce plan to address the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015.

In comments on a draft of this report provided via email on May 15, 2018, a Program Analyst in the National Science Foundation’s Office of Integrative Activities stated that the agency concurred with our recommendations.

One agency did not agree with one of the two recommendations directed to it: In its written comments (reprinted in appendix VIII), the National Aeronautics and Space Administration did not agree with our first recommendation and agreed with the second. Specifically:

NASA did not concur with our recommendation to evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. The agency stated that there is no federal or NASA requirement for employees in cybersecurity positions to hold and/or maintain a certification, and therefore the agency has no plans to assess the readiness of its cybersecurity personnel to take certification exams.

Nonetheless, we continue to believe our recommendation remains valid because the level of preparedness of personnel without certifications to take certification examinations can be a useful indicator of the skills and knowledge of an agency’s cybersecurity workforce. In addition, this information could help the agency identify and meet the certification and training needs of its cybersecurity employees who are charged with protecting NASA’s information and information systems from cyberattacks. Moreover, the act contains provisions that demonstrate congressional interest in assessing agency use of professional certifications.

NASA concurred with our recommendation to include in the agency’s coding procedures, requirements to assign code “000” to positions that do not perform IT, cybersecurity, and cyber-related functions. The agency stated that it planned to update its procedures to include this requirement, and indicated that supervisors and human resource specialists had been trained to assign cybersecurity codes to all positions, including code “000.”

The following two agencies provided comments, but did not state whether they agreed or disagreed with our recommendations: In its written comments (reprinted in appendix IX), the Nuclear Regulatory Commission stated that it was in general agreement with the overall content of the draft report. However, the agency asked that we revise the final report to reflect that the Nuclear Regulatory Commission had updated its cybersecurity coding procedures to include language explaining that IT, cybersecurity, and cyber-related positions will extend beyond the GS-2210 occupational series, and to outline the requirement that positions can be assigned up to three different employment codes in order of criticality. The agency provided its updated coding procedures along with its written comments.

In its written comments (reprinted in appendix X), the U.S. Agency for International Development stated that it had completed various actions related to coding its cybersecurity positions which addressed our four recommendations. For example, among other actions, the agency said it had updated its plan for coding cybersecurity positions to include procedures for assigning codes for multiple functional areas, with the predominant functional area being coded first.

In addition, two agencies to which we made recommendations---the Departments of Housing and Urban Development and Labor—stated via email that they did not have comments on the report. The agencies did not state whether they agreed or disagreed with our recommendations.

Of the agencies to which we did not make recommendations, the Social Security Administration also provided a letter acknowledging its review of the report. The agency’s letter is reprinted in appendix XI.

The remaining nine agencies to which we did not make recommendations—the Departments of Agriculture, Health and Human Services, Justice, State, Transportation, and Treasury; the Environmental Protection Agency; the General Services Administration; and the Office of Personnel Management—stated that they did not have any comments on our report.

We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, the secretaries and agency heads of the departments and agencies addressed in this report, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix XII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine whether (1) OPM developed a coding structure and procedures for assigning codes to cybersecurity positions and submitted a progress report to Congress, (2) Chief Financial Officers (CFO) Act agencies submitted complete and reliable baseline assessment reports of their cybersecurity workforces, and (3) CFO Act agencies established procedures to identify and assign codes to cybersecurity positions.

The scope of our review included the 24 departments and agencies (hereafter referred to as agencies) covered by the Chief Financial Officers Act of 1990. It also included OPM, DOD, DHS, and NIST in their roles related to the development of a cybersecurity coding structure and related guidance. Our work focused on the agencies’ cybersecurity positions and on workforce planning actions that the act required the agencies to complete by November 2017.

To address the first objective, we obtained and compared OPM’s federal cybersecurity employment coding structure, issued in November 2016, to the work roles described in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, issued in draft form by NIST in November 2016. We also examined OPM memorandums to identify if and when OPM had issued procedures to agencies for identifying cybersecurity positions and assigning employment codes. Additionally, we reviewed any progress reports submitted by OPM to Congress on the implementation of the act. We compared the issuance date of each of these documents to the deadlines by which OPM was to issue them, as established in the act. Also, we interviewed OPM and NIST officials about their efforts to develop these documents and the reasons for any delays.

To address the second objective, we obtained available baseline assessments from each of the 24 CFO Act agencies and evaluated them against the act’s requirements to include information on (1) cybersecurity personnel holding certifications, (2) the level of preparedness of other personnel to take certification exams, and (3) strategies for mitigating any gaps identified. We also obtained agencies’ letters transmitting their assessments to the relevant congressional committees and evaluated them against the reporting deadline established in OPM guidance. In addition, we analyzed other relevant agency documentation and interviewed cognizant agency officials about their efforts to identify the appropriate certifications, identify relevant personnel, and collect information on employee certifications. We obtained the officials’ views on the reasons for any delays in agencies’ submissions of the assessments and the reliability of assessment results.

To address the third objective, we obtained and analyzed available cybersecurity coding procedures established by each of the 24 CFO Act agencies. We reviewed the required coding activities described in OPM’s Guidance for Assigning New Cybersecurity Codes to Positions with Information Technology, Cybersecurity, and Cyber-Related Functions. We judgementally selected seven of the activities that we determined to be particularly important for effectively identifying and coding all relevant encumbered and vacant cybersecurity positions. We then evaluated each agency’s procedures against these seven required coding activities. We also compared the issuance date of the procedures to the deadline established in OPM’s coding guidance for agencies to issue the procedures. In addition, we interviewed agency officials about their efforts to complete the procedures by the required deadline and the reasons for any delays.

Further, the Federal Cybersecurity Workforce Assessment Act of 2015 established a separate requirement and deadline for DOD to develop government-wide procedures for implementing the coding structure for federal noncivilian cyber positions. As such, we reviewed relevant documentation and interviewed cognizant officials from the Department of Defense’s Office of the Chief Information Officer and Office of the Under Secretary for Personnel and Readiness about their efforts to establish coding procedures for both civilian and noncivilian positions by the deadlines set forth in the act.

We conducted this performance audit from October 2016 to June 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Commerce

Appendix III: Comments from the Department of Education

Appendix IV: Comments from the Department of Energy

Appendix V: Comments from the Department of Homeland Security

Appendix VI: Comments from the Department of the Interior

Appendix VII: Comments from the Small Business Administration

Appendix VIII: Comments from National Aeronautics and Space Administration

Appendix IX: Comments from the Nuclear Regulatory Commission

Appendix X: Comments from the United States Agency for International Development

Appendix XI: Comments from the Social Security Administration

Appendix XII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Nick Marinos (director), Tammi Kalugdan (assistant director), William Cook (analyst in charge), Chris Businsky, Virginia Chanley, Wayne Emilien, Lisa Maine, David Plocher, Priscilla Smith, Dwayne Staten, Daniel Wexler, and Merry Woo made significant contributions to this report.