Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements
Released: 2018-02-06T00:00:00

Letter

Background

Federal agencies and our nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The information systems and networks that support federal operations are highly complex and dynamic, technologically diverse, and often geographically dispersed. This complexity increases the difficulty in identifying, managing, and protecting the myriad of operating systems, applications, and devices comprising the systems and networks.

Cybersecurity professionals can help to prevent or mitigate the vulnerabilities that could allow malicious individuals and groups access to federal information technology (IT) systems. The ability to secure federal systems depends on the knowledge, skills, and abilities of the federal and contractor workforce that designs, develops, implements, secures, maintains, and uses these systems. This includes federal and contractor employees who use the systems in the course of their work, as well as the designers, developers, programmers, and administrators of the programs and systems.

However, the Office of Management and Budget has noted that the federal government and private industry face a persistent shortage of cybersecurity and IT talent to implement and oversee information security protections to combat cyber threats. This shortage of cybersecurity professionals makes securing the nation’s networks more challenging and may leave federal IT systems vulnerable to malicious attacks. Having experienced and qualified cybersecurity professionals is important for DHS to help mitigate vulnerabilities in its own and other agencies’ computer systems as a result of cyber threats.

Federal Initiative and Guidance Are Intended to Improve Cybersecurity Workforces

In recent years, the federal government has taken various steps aimed at improving the cybersecurity workforce. These include establishing a national initiative to promote cybersecurity training and skills and developing guidance to address cybersecurity workforce challenges.

The National Initiative for Cybersecurity Education (NICE): This initiative, which began in March 2010, is a partnership among government, academia, and the private sector. It is coordinated by the National Institute of Standards and Technology (NIST) to help improve cybersecurity education. According to NICE, its mission includes promoting cybersecurity education, training, and workforce development, and coordinating with government, academic, and industry partners to build on existing successful programs and facilitate change and innovation. The initiative’s goal is to increase the number of skilled cybersecurity professionals in order to boost national IT security.

National Cybersecurity Workforce Framework: In April 2013, NICE published the National Cybersecurity Workforce Framework, which is intended to provide a consistent way to define and describe cybersecurity work at any public or private organization, including federal agencies. The initial framework defined 31 cybersecurity- related specialty areas that were organized into 7 categories. In August 2017, the framework was revised to include 33 cybersecurity- related specialty areas. The 7 categories are: securely provision, operate and maintain, protect and defend, investigate, collect and operate, analyze, and oversee and govern. For example, in the oversee and govern category, a specialty area is cybersecurity management, which covers the management of personnel, infrastructure, policy, and security awareness. Further, in the protect and defend category, the vulnerability assessment and management specialty area covers conducting assessments of threats and vulnerabilities and recommending appropriate mitigation countermeasures in order to protect information systems from threats.

In August 2017, NIST also revised the framework to define work roles within each specialty area and describe cybersecurity tasks for each work role. The revision also described the knowledge, skills, and abilities that a person should have in order to perform each work role. The revised framework is intended to enable agencies to examine specific IT and cybersecurity-related work roles and identify personnel skills gaps.

OPM Guidance for Assigning Employment Codes to Cybersecurity Positions: OPM sets data standards for federal job classifications, including cybersecurity positions. The data standards, issued by OPM in November 2014 created a 2-digit employment code for each work category and specialty area defined in the initial 2013 NICE cybersecurity workforce framework. Federal agencies use the codes to identify cybersecurity positions in personnel systems, such as the National Finance Center’s personnel and payroll system. According to OPM, assigning codes to federal cybersecurity positions is intended to lay the groundwork for a consistent governmentwide count of the federal cybersecurity workforce. Use of these codes is intended to enable OPM and federal agencies to more effectively identify the cybersecurity workforce; determine baseline capabilities; examine hiring trends; identify skill gaps; and recruit, hire, train, develop, and retain an effective cybersecurity workforce. (See appendix II for a description of the specialty areas defined in the NICE Cybersecurity Workforce Framework and their corresponding OPM codes).

In January 2017, OPM issued new guidance to agencies for assigning employment codes to cyber-related positions. This guidance created a unique 3-digit employment code for each cybersecurity work role identified in a draft version of the 2017 NICE cybersecurity workforce framework. To enhance the recruiting and hiring of workers with needed skills, agencies are to use the new 3-digit employment codes to identify critical needs, and provide training and development opportunities for cybersecurity personnel. In October 2017, NIST issued guidance, which reflected the finalized 2017 NICE framework and included a crosswalk of the 2-digit employment codes to the 3- digit employment codes.

DHS’s Cybersecurity Workforce Performs a Wide Range of Critical Missions

DHS is the third largest department in the federal government, employing approximately 240,000 people and with an annual budget of about $60 billion—$6.4 billion of which was spent on IT in fiscal year 2017. The department leads the federal government’s efforts to secure our nation’s public and private critical infrastructure information systems. For example, DHS collects and shares information related to cyber threats and cybersecurity risks and incidents with other federal partners to enable real-time actions to address these risks and incidents.

DHS is made up of 15 components: 7 front-line, or operational, components, and 8 support components. The operational components lead the department’s front-line activities to protect the nation, while the support components are to provide the resources, analysis, equipment, services, and other support to ensure that the operational components have the tools and resources to accomplish the department’s mission. The 15 operational and support components, including the 6 that we reviewed, are identified in figure 1.

The components perform a diverse range of cybersecurity functions. These functions include combating cybercrime; responding to cyber incidents; sharing cyber-related information, including threats and best practices; providing cybersecurity training and education; and securing both privately owned critical infrastructure and non-military federal networks. The missions and cybersecurity functions for the six components selected for our review are described in table 1.

Federal Laws Require DHS to Assess Its Cybersecurity Workforce

HSCWAA required DHS to perform several workforce assessment-related activities. Specifically, the department was to: 1. Establish procedures for identifying and categorizing cybersecurity positions and assigning codes to those positions. This was to be done within 90 days of the law’s enactment. 2. Identify all positions with cybersecurity functions and determine the work category and specialty areas of each position. DHS was required to identify all cybersecurity positions—both filled and vacant—within the department. In addition, it was to determine the cybersecurity work category and specialty areas for each such position. Work categories and specialty areas are defined in the NICE Cybersecurity Workforce Framework. 3. Assign codes to all filled and vacant cybersecurity positions. The department was to assign the appropriate 2-digit employment code, as set forth in OPM’s Guide to Data Standards, to each position based on the position’s primary cybersecurity work category and specialty areas.

In addition, after completing the aforementioned activities, the department was to: 4. Identify the cybersecurity work categories and specialty areas of critical need in the department’s cybersecurity workforce and report to Congress. 5. Submit to OPM an annual report through 2021 that describes the work categories and specialty areas of critical need and substantiates the critical need designations.

The act required DHS to complete the majority of the activities by specific due dates between March 2015 and September 2016 (see table 2).

Beyond HSCWAA, the Federal Cybersecurity Workforce Assessment Act of 2015 was enacted in December 2015. It assigned specific workforce planning-related activities to all federal agencies, including DHS. Specifically, the law requires all federal agencies to identify all positions that perform information technology, cybersecurity, or other cyber-related functions and assign the appropriate employment code to each position. Similar to HSCWAA, the federal act also requires all federal agencies, including DHS, to identify and report to OPM on its cybersecurity work roles of critical need; each agency also is to submit a progress report on identifying cyber-related work roles of critical need to Congress. According to OPM officials within Employee Services, which oversees the federal cybersecurity workforce activities and implementation, agencies are not expected to continue coding to the 2-digit data standard and, instead, are to adopt the 3-digit data standard and complete coding the 3- digit standard by April 2018.

DHS Has Not Fully Identified Cybersecurity Positions or Assigned Employment Codes in a Complete and Reliable Manner

As defined in OPM’s guidance and required by HSCWAA, DHS has begun activities related to identifying, categorizing, and assigning the appropriate employment codes to its cybersecurity positions. However, DHS has not completed all of these activities, as required. Specifically, the department did not develop timely and complete procedures or review its components’ procedures. In addition, it did not completely and reliably identify and assign employment codes because its processes were manual, undocumented, and resource-intensive.

As indicated in table 3, the department did not complete any of the activities associated with establishing procedures and identifying and assigning employment codes to positions by the statutorily defined due dates, and two of these efforts are still ongoing.

DHS Did Not Ensure Cybersecurity Workforce Procedures Were Timely, Complete, or Reviewed

HSCWAA required DHS to establish procedures to identify and assign the appropriate employment code to all of the department’s filled and vacant positions with cybersecurity functions, in accordance with OPM’s Guide to Data Standards by March 2015. In addition, DHS’s April 2016 Cybersecurity Workforce Coding guidance stated that components should ensure procedures are in place to monitor and to update the employment codes as positions change over time. Further, Standards for Internal Control in the Federal Government recommends that management assign responsibility and delegate authority to key roles and that each component develop individual procedures to implement objectives. The standard also recommends that management periodically review such procedures to see that they are developed, relevant, and effective.

Toward this end, OCHCO has developed procedures and recommended implementation steps for coding positions with cybersecurity functions for the department’s components. The procedures include criteria to be used in identifying cybersecurity positions. For example, the procedures state that any position that performs cybersecurity work at least 25 percent of the time should be identified as a cybersecurity position. The procedures also include information on how components are to select the appropriate data element codes.

Nevertheless, although OCHCO developed procedures for identifying positions and assigning codes, the procedures were not timely. Specifically, DHS did not include in its procedures information on identifying positions and assigning codes to address the act’s requirements until April 2016—13 months after the due date.

In addition, the procedures were not complete in that they did not include information related to identifying and coding vacant positions, as the act required. For example, while the National Finance Center system, which is DHS’s system of record for employment codes assigned to cybersecurity employees, was modified to capture the codes for filled positions, the system was not modified to capture data on vacant positions. (For an explanation of National Finance Center’s system and how DHS relates to it, see footnote 12.) In addition, the department’s procedures did not address how to identify or code vacant positions, or where such information should be reported in a standardized manner across the department.

Moreover, the departmental procedures did not identify the individual within each DHS component who was responsible for leading and overseeing the identification and coding of the component’s cybersecurity positions. For example, the procedures did not identify a responsible individual for leading the effort to identify and code CBP’s cybersecurity positions. Because there was no identified individual responsible for the entirety of the CBP cybersecurity workforce identification efforts, CBP officials told us they were unable to comment on, or provide a status update on, where they were on the cybersecurity coding process.

Further, although components were able to supplement the departmental procedures by developing their own component-specific procedures for identifying and coding their cybersecurity positions, DHS did not review selected components’ procedures for consistency with departmental guidance. The department could not provide documentation that OCHCO had verified or reviewed component-developed procedures. OCHCO officials acknowledged that they had not reviewed the components’ procedures and had not developed a process for conducting such reviews.

OCHCO officials identified several factors that they said limited their ability to develop timely and complete procedures for identifying and coding cybersecurity positions, and to review the supplemental procedures developed by the components. For example, they stated that:

DHS did not complete its update of the procedures for identifying cybersecurity positions and assigning codes until April 2016 because the department could not decide whether or not certain positions within the department should be considered cybersecurity positions; each component had the best understanding of their human capital systems and processes, so the development of tailored procedures was best left up to each component; each of the six selected DHS components recorded and tracked vacant positions differently; therefore, the department’s human capital office could not issue department-wide guidance on vacant positions; the cybersecurity specialty areas for vacant positions were not known until a position description was developed or verified and a hiring action was imminent; and

DHS did not assign responsibilities for, or review, components’ procedures because, as noted previously, the department believed that its components had the best understanding of their specific human capital systems; thus, what the components included in their own procedures was best left up to them.

OCHCO officials said that they plan to work with their internal accountability team to review component-developed procedures, but they had not established a time frame for doing so. Without assurance that procedures are timely, complete, and reviewed, DHS cannot be certain that components are effectively prepared to identify and code all positions with cybersecurity functions, as required by the act.

DHS Has Not Yet Completed Required Identification Activities

HSCWAA required DHS to identify all cybersecurity positions, including vacant positions, by September 2015 in order to meet the act’s other deadlines. Further, the act called for the department to use OPM’s Guide to Data Standards to categorize the identified positions and determine the work category or specialty area of each position.

As of December 2016, the department reported that it had identified 10,725 cybersecurity positions, including 6,734 federal civilian positions, 584 military positions, and 3,407 contractor positions. However, as of November 2017, the department had not completed identifying all of its cybersecurity positions or determining the work categories or specialty areas of the positions. For example, three of the six DHS components we reviewed had not identified their vacant cybersecurity positions. OCHCO officials stated that components varied in reporting their identified vacant positions because the department did not have a system to track vacancies.

DHS also reported that it most commonly determined that the work category or specialty area of its cybersecurity positions were in the “protect and defend,” “securely provision,” and “oversight and development” work categories, and in the “security program management” and “vulnerability assessment and management” specialty areas of the NICE framework. DHS reported at least 12 of 15 DHS components as having cybersecurity positions in these categories and specialty areas. However, DHS could not provide data to show the actual numbers of positions in each of these categories and specialty areas. According to OCHCO officials, the department was still in the process of identifying positions for the 2-digit codes and would continue this effort until the 3-digit codes were available in the National Finance Center personnel and payroll system in December 2017. At that time, OCHCO officials stated that the department intends to start developing procedures for identifying and coding positions using the 3-digit codes.

DHS Has Not Completely and Accurately Assigned Employment Codes

In addition to identifying all of its positions with cybersecurity functions and determining the work categories and specialty areas of each position consistent with the NICE framework, HSCWAA required DHS to assign positions codes to all such identified positions by September 2015. According to the Office of Management and Budget, having complete data consistent with the framework will help agencies to effectively examine the cybersecurity workforce; identify skill gaps; and improve workforce planning. Further, Standards for Internal Control in the Federal Government states that agencies should obtain relevant data from reliable sources that are accurate.

DHS has not completely and accurately assigned employment codes to its cybersecurity workforce. As of August 2017—23 months after the due date—the department had not completed the process of assigning the 2- digit employment codes to all of its identified cybersecurity positions. For example, five of the six components we selected for review had not completed the coding of their cyber positions.

In addition, DHS did not completely or accurately assign codes to all filled and vacant cybersecurity positions as required by the act. In August 2017, OPM provided a progress report to Congress containing DHS data that stated that 95 percent of DHS-identified cybersecurity positions had been coded. However, our analysis determined that the department had assigned cybersecurity position codes to approximately 79 percent, rather than the reported 95 percent, of identified federal civilian cybersecurity positions. See figure 2 below. DHS could not demonstrate that it had assigned codes to 95 percent of its positions, as reported, since its coding progress data never indicated such a percentage.

The percentage of coded positions reported for DHS was overstated because it was not based on complete information. Specifically, the percentage reflected information on the progress of filled federal civilian cybersecurity positions, but excluded vacant positions, even though the act required DHS to report these positions. Among the six components that we selected for our review, five of them had not yet completed the coding of their positions.

Figure 2 shows the results of our analysis of DHS’s progress in coding its cybersecurity positions, which considered both filled and vacant federal civilian cybersecurity positions, in comparison to what the department identified, which considered incomplete data—using only filled positions.

In addition to being incomplete, DHS’s results were not accurate. Specifically, OCHCO developed a bi-monthly dashboard to monitor and report coding progress; however, the office did not have assurance that its data were accurate. OCHCO officials stated they did not verify the components’ data for accuracy. For example, while no more than 100 percent of identified positions should be coded, OCHCO reported 122.7 percent of positions as being coded for the Office of the Chief Information Officer. Such anomalies were due to DHS components reporting the total number of identified cybersecurity positions on a semi-annual basis, while OCHCO determined positions coded on a bi-monthly basis using data from the National Finance Center personnel and payroll system. Yet, OCHCO analyzed and reported these numbers together, even though they were representative of different time periods. This produced unreliable results that were not representative of actual progress.

Table 4 provides examples of components’ coding progress, as reflected in DHS’s August 29, 2017 dashboard report, which showed one component that had more cybersecurity positions coded than were identified.

OCHCO officials reported several factors related to their processes and systems that had limited their ability to collect and use data that were complete and accurate. Specifically, the officials stated that OCHCO did not have documented processes to collect and verify data from the components. The officials also stated that the components did not report vacancies consistently, and that the department does not have a system to track the vacancies. The officials further stated that the cybersecurity workforce amounts frequently changed, and that they could not review workforce data for reliability, as such a review was a resource-intensive activity.

However, if DHS does not assure that processes are in place to obtain and use data that are complete, including vacant positions, and accurate, then the department cannot be assured that it will have an accurate understanding of its internal coding progress. Without the ability to code its cybersecurity positions in a complete and accurate manner, DHS will not be able to effectively examine the cybersecurity workforce; identify skill gaps; and improve workforce planning.

DHS Has Not Identified or Reported Its Department-wide Cybersecurity Workforce Areas of Critical Need

While DHS has identified workforce capacity and capability gaps, it has not identified or reported to Congress its department-wide cybersecurity critical needs that align with the NICE framework. Additionally, the department has not reported its critical needs to OPM or developed plans and time frames for completing priority actions for reporting critical needs annually to OPM. Further, as indicated in table 5, the department did address any required activities by the statutorily defined due dates.

DHS Has Not Identified Critical Needs in Alignment with the NICE Framework or Provided Guidance to Components

HSCWAA required DHS to identify its cybersecurity work categories and specialty areas of critical need in alignment with the NICE framework and to report this information to the appropriate congressional committees by June 2016. In addition, according to a DHS directive, the DHS Chief Human Capital Officer is responsible for providing guidance to the department’s components on human resources standards, such as identifying workforce needs. According to GAO’s leading practices on strategic workforce planning, developing and providing guidance could help agencies identify their critical needs in order to effectively recruit, hire, train, and retain cybersecurity personnel.

Although required to do so by June 2016, DHS has not yet identified its cybersecurity work categories and specialty areas of critical need in alignment with the NICE framework. The department identified workforce skills gaps and included this information in a report that it submitted to congressional committees in March 2017. However, the department did not align the workforce skills gaps report to the NICE framework’s work categories and specialty areas as required by HSCWAA. (The categories and specialty areas are described in appendix II.)

Specifically, although the framework required that critical needs be align with a specific specialty area, DHS did not align the skills gaps to a particular specialty area in the NICE framework. For example, DHS identified a skill gap called development operations, which is related to 12 different specialty areas in the NICE framework. This skill gap also overlaps with other DHS skill gaps and creates the potential for double- counting critical needs. Furthermore, although three selected components reported in our questionnaires that they were able to identify their critical needs that aligned to the framework, they did not report this information to OCHCO.

According to OCHCO officials, DHS has not identified department-wide cybersecurity critical needs that align with the framework partly because OPM had not provided DHS with guidance for identifying cybersecurity critical needs. According to OPM officials, however, they provided oral guidance to DHS on using the 2-digit codes for identifying its critical needs during four meetings in 2016 and 2017. The OPM officials also stated that they had plans to develop governmentwide guidance for using the 3-digit codes to identify cybersecurity critical needs by March 2018 to fulfil the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015. According to OPM, agencies such as DHS are required to identify critical needs for the 3-digit codes by April 2019. DHS OCHCO officials said that DHS plans to transition to identifying cyber- related work roles of critical need once they have completed the 3-digit coding efforts under the 2015 federal act mentioned previously.

Further, DHS has not developed and provided guidance to help its component-level agencies to identify their critical needs that align to the NICE framework. Specifically, DHS did not include guidance in its procedures that instructed components on how to report on their critical needs or to align to the NICE framework work categories and specialty areas. Two selected components’ officials told us they required guidance from OCHCO on how best to identify critical needs.

According to OCHCO officials, they did not provide components guidance on critical needs that align with the NICE framework because the components were in the best position to determine their critical needs. Further, OCHCO officials stated that the components do not generally view critical skills gaps in terms of the categories or specialty areas as defined in the NICE framework, but instead, describe their skills gaps using position titles that are familiar to them. For example, one selected component identified security engineering as a skills gap familiar to them. However, according to OCHCO officials, this gap may align to five different specialty areas in the NICE framework’s securely provision work category. As mentioned previously, the framework required that critical needs be align with a specific specialty area.

In September 2017, OCHCO developed a draft document that crosswalks identified department-wide cybersecurity skills gaps to one or more specialty areas in the NICE framework. However, the document does not adequately help components identify their critical needs by aligning their gaps with the NICE framework. Half of the DHS skills gaps overlap with two or more work categories, but the National Finance Center payroll system allows components to enter only one code per position. Further, the document does not provide additional decision rules to help components determine a critical need in cases in which a skills gap is mapped to multiple work categories.

Without providing relevant guidance to help components identify their critical needs, DHS and the components are hindered from effectively identifying and prioritizing workforce efforts to recruit, hire, train, develop, and retain cybersecurity personnel across the department.

DHS Did Not Report Critical Needs Annually to OPM or Develop Plans and Time Frames for Completing Priority Actions

HSCWAA required that, annually from September 2016 through September 2021, DHS, in consultation with OPM, submit a report to OPM that describes and substantiates critical need designations. In addition, Standards for Internal Control in the Federal Government states that management should develop plans to achieve objectives. Developing plans to report critical needs is a control activity that could help capture and sequence all of the activities that DHS must complete in order to report critical needs. This involves clearly defining what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement.

DHS did not report cybersecurity critical needs to OPM in September 2016 or September 2017 as required. Instead, the department first reported its cybersecurity coding progress and skills gaps in the March 2017 report that it sent to OPM and Congress addressing several of the HSCWAA requirements. The report did not describe or substantiate critical need designations because DHS has not yet identified them. OCHCO officials stated that the department plans to submit another report to OPM; however, they did not indicate whether critical needs will be included in the report, and did not have a time frame for when they plan to submit the report to OPM.

Additionally, DHS has not developed plans or time frames to complete priority actions that OCHCO officials said must be completed before it can report its cybersecurity critical needs to OPM. DHS’s Comprehensive Cybersecurity Workforce Update reported two priority actions to identify, describe, and substantiate cybersecurity critical needs—developing a DHS cybersecurity workforce strategy and completing its initial cybersecurity workforce research—by the end of fiscal year 2017. However, DHS did not complete the priority actions by the end of fiscal year 2017, as planned.

As of September 2017, the department was still in the process of finalizing the DHS cybersecurity workforce strategy and had not yet completed the initial cybersecurity workforce research. OCHCO officials said that the strategy is to be influenced by ongoing efforts to finalize the DHS comprehensive cybersecurity mission strategy, provide DHS reports required by the May 2017 cybersecurity-related presidential executive order, and finalize and implement the new cybersecurity-focused personnel system. According to OCHCO officials, the department plans to conduct additional interviews and focus groups in fiscal year 2018.

According to DHS OCHCO officials, the department did not develop plans or schedules with time frames to report cybersecurity critical needs. These officials stated that the report that the department submitted to Congress in March 2017 had contained plans and schedules. However, it did not capture and sequence all of the activities that DHS officials said must be completed in order to report critical needs. For example, the report did not include a schedule for completing the cybersecurity workforce strategy or conducting additional interviews and focus groups to complete the initial cybersecurity workforce research.

Until DHS develops plans and schedules with time frames for reporting its cybersecurity critical needs, the department may not have important insight into its needs for ensuring that it has the workforce necessary to carry out its critical role of helping to secure the nation’s cyberspace. Further, OPM may be hindered from using DHS’s reports to understand critical needs consistently on a governmentwide basis.

Conclusions

DHS has begun the required workforce assessment activities to identify, categorize, and assign codes to its cybersecurity positions. However, the department did not complete the activities by their statutorily defined due dates and efforts are still ongoing. Specifically, the department did not develop timely and complete procedures or review its components’ procedures. In addition, DHS’s efforts to identify, categorize, and code cybersecurity positions were incomplete and unreliable. Without the ability to identify, categorize, and code its cybersecurity positions in a complete and accurate manner, DHS will not be able to effectively examine the cybersecurity workforce, identify skill gaps, and improve workforce planning.

DHS has identified critical gaps in its cybersecurity workforce, but these gaps did not align with the NICE framework work categories and specialty areas of critical need, as required by the act. Specifically, DHS has not developed guidance to help its component agencies and offices identify their cybersecurity critical needs. Moreover, DHS lacks plans with defined time frames for completing its required annual reporting to OPM. Until the department addresses these issues, it may continue to miss reporting deadlines and be hindered from effectively identifying and prioritizing critical workforce efforts to recruit, hire, train, develop, and retain cybersecurity personnel across its multiple components. In addition, DHS may not have cybersecurity personnel with the required skills to better protect federal networks and national critical infrastructure from threats.

The commitment of DHS’s leadership is essential to successfully addressing these issues and the associated management weaknesses. By taking urgent and diligent action now, DHS will be better positioned to fulfill the requirements of HSCWAA and to identify and code its filled and vacant cybersecurity positions accurately when it transitions to using the revised NICE framework.

Recommendations for Executive Action

We are making the following six recommendations to DHS: The Secretary of Homeland Security should develop procedures on how to identify and code vacant cybersecurity positions. (Recommendation 1)

The Secretary of Homeland Security should identify the individual in each component who is responsible for leading that component’s efforts in identifying and coding cybersecurity positions. (Recommendation 2)

The Secretary of Homeland Security should establish and implement a process to periodically review each component’s procedures for identifying component cybersecurity positions and maintaining accurate coding. (Recommendation 3)

The Secretary of Homeland Security should ensure OCHCO collects complete and accurate data from its components on all filled and vacant cybersecurity positions when it conducts its cybersecurity identification and coding efforts. (Recommendation 4)

The Secretary of Homeland Security should develop guidance to assist DHS components in identifying their cybersecurity work categories and specialty areas of critical need that align to the NICE framework. (Recommendation 5)

The Secretary of Homeland Security should develop plans with time frames to identify priority actions to report on specialty areas of critical need. (Recommendation 6)

Agency Comments and Our Evaluation

We received written comments on a draft of this report from DHS. In the comments (reprinted in appendix III), the department concurred with our six recommendations and provided estimated completion dates for implementing each of them.

With regard to recommendations 1 and 2, DHS stated that, by February 28, 2018, it plans to finalize and disseminate an updated version of its cybersecurity position identification and coding guidance to address vacant positions, as well as issue a memorandum requiring its components to designate a lead for reporting progress to OCHCO. Further, by April 30, 2018, the department said it plans to address recommendation 3 by disseminating a memorandum that includes a process for periodically reviewing component procedures and instructions for components to report related data and documents.

DHS also stated that, by June 29, 2018, it plans to issue memorandums to its components that provide instructions, guidance, and plans to address recommendations 4 through 6. The department added that it intends to (1) periodically review compliance and cybersecurity workforce data concerns with component leads to ensure data accuracy; (2) disseminate a reporting schedule for identifying cybersecurity critical needs; and (3) develop and disseminate a project plan with milestones, due dates, and responsibilities for reviewing progress and reporting on workforce planning actions in fiscal years 2018 and 2019.

The aforementioned actions, if implemented effectively, should help DHS address the intent of our recommendations. In addition, we received technical comments from the department, which we have incorporated, as appropriate.

We also provided a draft of this report for OPM’s review and comments. In response, an OPM program analyst stated, via email, that the agency had no edits, comments, or revisions to the draft report.

We are sending copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and the Director of the Office of Personnel Management. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Chris Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify the extent to which DHS has: 1. identified, categorized and assigned employment codes to 2. identified its cybersecurity workforce areas of critical need.

To address both objectives, we examined Department of Homeland Security (DHS) Office of Chief Human Capital Officer (OCHCO) and component cybersecurity workforce data and documentation and interviewed OCHCO and component officials. In addition, we reviewed Standards for Internal Control in the Federal Government and Key Principles for Effective Strategic Workforce Planning, and then compared the cybersecurity workforce internal controls and project management processes that DHS implemented to address the act to the selected standard.

We also administered a questionnaire and data collection instrument (DCI) to a nonprobability sample of 6 of 15 DHS components. To select the 6 components we used OPM’s Enterprise Human Resources Integration-Statistical Data Mart data on DHS civilian positions. We segmented the 15 components into 3 groups, based on their reported total number of cybersecurity personnel in DHS—high, medium, and low. From each group, we selected 2 DHS components with the highest number of cybersecurity functions, as reported by DHS. Where components or offices in the same tier have equivalent cybersecurity functions, we selected the DHS component or office with the highest share of cybersecurity employees. This approach resulted in the selection of the following DHS components:

U.S. Customs and Border Protection,

Departmental Management and Operations,

National Protection and Programs Directorate,

U.S. Secret Service,

Science & Technology Directorate, and

U.S. Citizenship and Immigration Services.

The results of this analysis are not generalizable to all DHS components.

In both the questionnaire and DCI, we asked questions related to the status of DHS’s identification, categorization and assignment of employment codes to cybersecurity positions, and identification of its cybersecurity workforce areas of critical need. To minimize errors that might occur from respondents interpreting our questions differently from our intended purpose, we performed a preliminary review of the questionnaire and DCI with OCHCO officials.

The selection of OCHCO officials for preliminary review was based on OCHCO’s oversight role in the implementation of the Homeland Security Cybersecurity Workforce Assessment Act of 2014 (HSCWAA). During this review, we interviewed the officials to ensure that the questions were applicable, clear, unambiguous, and easy to understand. We then revised our questionnaire and DCI based on the feedback provided during the preliminary review. All respondents completed the final questionnaire and DCI, although not all survey respondents answered every question. We then reviewed the responses and interviewed relevant component officials in order to get clarification and validation of their responses.

We determined that the data obtained from the questionnaire and DCI are sufficiently reliable for the purpose of reporting DHS’ progress in assigning cybersecurity codes. However, these data have the following limitations: component responses may be from a particular program or office and not cover the breadth of the program, and component reported data may be estimated or unavailable.

To address our first objective, we reviewed and analyzed DHS’s department-level cybersecurity workforce procedures and communications and organizational documents for identifying cybersecurity positions and assigning work-position codes in accordance with the act. Further, we examined department-level data from the Department of Agriculture’s National Finance Center, DHS dashboard reports, and DHS progress reports to the Office of Personnel Management (OPM) and Congress. To assess the reliability of OCHCO and component cybersecurity workforce data, we compared them with data from OPM’s Enterprise Human Resources Integration-Statistical Data Mart data on DHS civilian positions and against the National Finance Center personnel and payroll system data on the cybersecurity coding of DHS civilian positions as appropriate. In addition, we reviewed and analyzed component-level cybersecurity workforce procedures, as well as cybersecurity workforce data and documentation, including data calls to selected component-level offices in DHS. We evaluated these documents against the act’s requirements and Standards for Internal Control in the Federal Government to ensure that DHS’s processes addressed leading practices.

To address our second objective, we reviewed and analyzed DHS’s planned actions for identifying its cybersecurity workforce areas of critical need, including data calls to components, and DHS progress reports to OPM and Congress. We also examined OCHCO and component cybersecurity workforce data and department-level workforce planning documentation to evaluate the status of the department’s efforts to identify its cybersecurity workforce areas of critical need. We compared these documents against the act’s requirements, DHS-wide and component-specific workforce planning processes, the National Initiative for Cybersecurity Education (NICE) framework categories and specialty areas, and Standards for Internal Control in the Federal Government to ensure DHS met its requirements.

To assess the reliability of OPM’s Enterprise Human Resources Integration-Statistical Data Mart data on DHS civilian positions, we reviewed the data for obvious errors as well as compared OPM’s written responses to our data reliability questionnaire regarding the generation and use of the data. We determined that the data were sufficiently reliable for the purpose of helping inform our selection of a nonprobability sample of 6 DHS components as described above.

To assess the reliability of National Finance Center personnel and payroll system data on the cybersecurity coding of DHS civilian positions, we examined the data for outliers and obvious errors and compared those data to data and documentation from DHS components. In addition, we interviewed and observed DHS officials generate and use the National Finance Center data. We determined that the data were sufficiently reliable for the purposes of reporting DHS cybersecurity workforce coding progress. The data are limited in that only filled federal civilian positions were reported in the National Finance Center system. Vacancies, contractors, and military were not included in those data.

To assess the reliability of DHS’s OCHCO and component human capital systems data on the DHS civilian cybersecurity workforce, we reviewed the data for outliers and obvious errors, and compared them against data from the National Finance Center personnel and payroll system. We also interviewed officials from OCHCO and selected DHS components regarding the generation and use of the data. We determined that the data were sufficiently reliable for the purpose of reporting DHS’ progress in assigning cybersecurity codes. However, the data have the following limitations: component responses may be from a particular program or office and not cover the breadth of the program, data may be estimated by components, and data may be measured at different intervals—for example, total cybersecurity workforce may be measured at a different point in time than cybersecurity workforce positions coded.

For both objectives, we supplemented the information and knowledge obtained from our assessments by holding discussions with relevant DHS OCHCO and the six components’ officials to evaluate the status of the department’s efforts to implement the act.

We conducted this performance audit from March 2017 to February 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework Categories and Specialty Areas

Appendix II: National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework Categories and Specialty Areas Oversees, evaluates, and supports the documentation, validation, assessment, and authorization processes necessary to assure that existing and new information technology (IT) systems meet the organization’s cybersecurity and risk requirements. Ensures appropriate treatment of risk, compliance, and assurance from internal and external perspectives.

Develops and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs following software assurance best practices.

Works on the development phases of the systems development life cycle.

Consults with customers to gather and evaluate functional requirements and translates these requirements into technical solutions. Provides guidance to customers about applicability of information systems to meet business needs.

Develops system concepts and works on the capabilities phases of the systems development life cycle; translates technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.

Conducts technology assessment and integration processes; provides and supports a prototype capability and/or evaluates its utility.

Develops and conducts tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost- effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of systems or elements of systems incorporating IT.

Addresses problems; installs, configures, troubleshoots, and provides maintenance and training in response to customer requirements or inquiries (e.g., tiered-level customer support).

Develops and administers databases and/or data management systems that allow for the storage, query, and utilization of data.

Manages and administers processes and tools that enable the organization to identify, document, and access intellectual capital and information content.

Installs, configures, tests, operates, maintains, and manages networks and their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers, cables, proxy servers, and protective distributor systems) and software that permit the sharing and transmission of all spectrum transmissions of information to support the security of information and information systems.

Installs, configures, troubleshoots, and maintains server configurations (hardware and software) to ensure their confidentiality, integrity, and availability. Also, manages accounts, firewalls, and patches. Responsible for access control, passwords, and account creation and administration.

NICE Specialty Area Systems Analysis

NICE Specialty Area definition Conducts the integration/testing, operations, and maintenance of systems security.

Conducts training of personnel within pertinent subject domain. Develops, plans, coordinates, delivers and/or evaluates training courses, methods, and techniques as appropriate.

Applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies. Provides direct support for acquisitions that use information technology (IT) (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Provides legally sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocates legal and policy changes, and makes a case on behalf of client via a wide range of written and oral work products, including legal briefs and proceedings.

Oversees the cybersecurity program of an information system or network; including managing information security implications within the organization, specific program, or other area of responsibility, to include strategic, personnel, infrastructure, requirements, policy enforcement, emergency planning, security awareness, and other resources.

Develops policies and plans and/or advocates for changes in policy that supports organizational cyberspace initiatives or required changes/enhancements.

Supervises, manages, and/or leads work and workers performing cybersecurity work.

Uses defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats.

Tests, implements, deploys, maintains, reviews, and administers the infrastructure hardware and software that are required to effectively manage the computer network defense service provider network and resources. Monitors network to actively remediate unauthorized activities.

Responds to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigates and analyzes all relevant response activities.

Conducts assessments of threats and vulnerabilities; determines deviations from acceptable configurations, enterprise or local policy; assesses the level of risk; and develops and/or recommends appropriate mitigation countermeasures in operational and nonoperational situations.

NICE Specialty Area Analyze category All-Source Analysis

Analyzes threat information from multiple sources, disciplines, and agencies across the intelligence community. Synthesizes and places intelligence information in context; draws insights about the possible implications.

Analyzes collected information to identify vulnerabilities and potential for exploitation.

Applies current knowledge of one or more regions, countries, non-state entities, and/or technologies.

Identifies and assesses the capabilities and activities of cybersecurity criminals or foreign intelligence entities; produces findings to help initialize or support law enforcement and counterintelligence investigations or activities.

Applies language, cultural, and technical expertise to support information collection, analysis, and other cybersecurity activities.

Collect and Operate category Collection Operations

Executes collection using appropriate strategies and within the priorities established through the collection management process.

Performs activities to gather evidence on criminal or foreign intelligence entities in order to mitigate possible or real-time threats, protect against espionage or insider threats, foreign sabotage, international terrorist activities, or to support other intelligence activities.

Performs in-depth joint targeting and cybersecurity planning process. Gathers information and develops detailed Operational Plans and Orders supporting requirements. Conducts strategic and operational-level planning across the full range of operations for integrated information and cyberspace operations.

Investigate category Digital Forensics

Collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability mitigation, and/or criminal, fraud, counterintelligence or law enforcement investigations.

Applies tactics, techniques, and procedures for a full range of investigative tools and processes to include, but not limited to, interview and interrogation techniques, surveillance, counter surveillance, and surveillance detection, and appropriately balances the benefits of prosecution versus intelligence gathering.

OPM guidance states that individuals primarily engaged in project or program management for cybersecurity projects or tasks should be coded with the Cybersecurity Program/Project Management value (80).

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts above, Ben Atwater (assistant director), Tammi Kalugdan (assistant director), David Hong (analyst-in-charge), Christy Abuyan, Alexander Anderegg, David Blanding, Jr., Chris Businsky, Wayne Emilien, Jr., David Plocher, Luis E. Rodriguez, and Priscilla Smith made significant contributions to this report.