The Federal Cybersecurity Workforce: Background and Congressional Oversight Issues for the Departments of Defense and Homeland Security
Released: 2016-01-08T00:00:00

Introduction

Cybersecurity refers to a broad set of concepts for which there is no standard definition—it often varies by the entity employing it. DHS, for example, has defined cybersecurity as "the activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation." The Committee on National Security Systems has defined a "cyber attack" as

An attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information.

Strengthening federal cybersecurity has been a priority for Congress and the executive branch for several years. The focus on cybersecurity has increased since the Office of Personnel Management (OPM) data intrusion was revealed in June 2015, which heightened concerns about vulnerabilities within the government's systems and networks.

All federal agencies have responsibilities for protecting their individual systems and networks under federal law. Some agencies, such as DHS and DOD, possess broader cybersecurity roles compared to other agencies. DHS has responsibility for protecting unclassified federal civilian systems and networks and assisting agencies in responding to cyber threats and attacks. DHS is also the lead agency for coordinating with the private sector to protect critical cyber infrastructure assets. DOD is responsible for defending the nation against cyberattacks of "significant consequence," as well as conducting military operations in cyberspace. DOD is also responsible for assisting DHS in fulfilling its government-wide cybersecurity roles.

The federal cybersecurity workforce plays an integral role in maintaining and improving the government's cybersecurity. Cybersecurity professionals are responsible for designing and building secure information networks and systems, identifying and addressing vulnerabilities within those networks and systems, and collecting and analyzing data necessary to respond to cyberattacks efficiently and effectively, among other things. Federal stakeholders and researchers have stated that robust federal cybersecurity is not possible without cybersecurity professionals.

Developing and maintaining a robust federal cybersecurity workforce, however, has been an ongoing challenge. The Chief Human Capital Officers Council Working Group found skills gaps in cybersecurity positions (and other positions) government-wide, which prompted the Obama Administration to create a Cross-Agency Priority (CAP) to reduce those gaps by half by the end of FY2013. According to a January 2015 GAO report, however, efforts to close these cybersecurity gaps were at an "early stage of maturity."

This report examines congressional oversight of two strategies undertaken by Congress and the executive branch to strengthen the federal cybersecurity workforce: (1) initiatives to define and identify the federal cybersecurity workforce, and (2) hiring and pay flexibilities applicable to cybersecurity positions at DOD and DHS. This report focuses on DOD and DHS because of their key roles in federal cybersecurity and because the majority of hiring and pay flexibilities for cybersecurity professionals authorized by Congress apply to DOD and DHS.

Background on the Federal Cybersecurity Workforce

Defining the Federal Cybersecurity Workforce

Cybersecurity functions are embedded within a wide range of federal positions that span more than 100 federal occupational series (see the text box below for a definition of occupational series). The specific cybersecurity functions undertaken within an occupation series often vary by agency. For example, one DHS position in the 2210 occupation series that performs cybersecurity functions is responsible for identifying vulnerabilities and weaknesses within IT systems and developing procedures to defend against unauthorized access to the systems. A different DHS position in the 2210 occupation series that performs cybersecurity functions, in contrast, is responsible for evaluating and responding to cyber incidents.

The full range of federal positions that undertake cybersecurity responsibilities is challenging to assess. Researchers have found that agencies have experienced difficulty in accurately defining and measuring their cybersecurity workforces. For example, a 2011 GAO report found wide disparities in counts of DOD cybersecurity employees—88,159 employees reported by GAO, compared to 18,955 reported by OPM. The GAO report partly attributed these inconsistent counts to the lack of a standard definition of a cybersecurity employee.

Challenges to Developing and Maintaining the Workforce

Federal stakeholders and researchers have reported ongoing challenges to developing and maintaining a robust federal cybersecurity workforce. Commonly reported challenges are listed below and include government-wide and agency-specific concerns:

demand outstripping supply for cybersecurity professionals in the federal government and difficulty filling vacant cybersecurity positions; skills gaps in cybersecurity positions; and agency strategic workforce plans that do not specifically address cybersecurity workforce needs.

DOD and DHS have reported recruitment and retention challenges for their cybersecurity workforces, including an inadequate number of qualified cybersecurity professionals. DOD and DHS have partly attributed these challenges to the following factors:

Federal hiring process – DOD noted that the length and complexity of the hiring process may deter cybersecurity professionals from pursuing federal careers. General Schedule (GS) pay system – DHS and other agencies believed that the GS system placed them at a competitive disadvantage for attracting cyber talent, noting that other agencies using non-GS systems were able to pay cybersecurity professionals higher salaries. Federal s ecurity clearance process – DOD and DHS cited the amount of time required to obtain security clearances for new employees as a barrier to filling cybersecurity positions.

Executive Branch Efforts to Define and Identify the Federal Cybersecurity Workforce

The executive branch has several initiatives to define and identify the federal cybersecurity workforce: (1) the national cybersecurity workforce framework, (2) cybersecurity data codes, and (3) a federal cybersecurity workforce dataset. Laws aiming to define and identify the workforce mandate the use of these initiatives.

The National Cybersecurity Workforce Framework

In November 2011, the National Initiative for Cybersecurity Education (NICE), within the National Institute of Standards and Technology (NIST), released the national cybersecurity workforce framework. The framework provides a consistent way to define and describe cybersecurity work at any public or private organization, including federal agencies. The framework classifies and categorizes cybersecurity work under specialty areas, which are grouped into seven categories ( Figure 1 illustrates these specialty areas and categories). Within each specialty area, the framework defines standard duties and competencies for cybersecurity professionals, as well as job titles that typically involve such duties.

Cybersecurity Data Codes

In October 2012, OPM, in coordination with NIST, published a coding structure for federal cybersecurity positions based on the national cybersecurity workforce framework. The structure assigns unique numeric codes to each of the seven categories and specialty areas within the framework and three new categories not included in the framework: (1) Cybersecurity Program/Project Management; (2) Cybersecurity Supervision, Management, and Leadership; and (3) Not Applicable. The codes are intended to allow OPM and agencies to identify and categorize all federal cybersecurity positions, thereby laying the groundwork for a consistent government-wide count of the federal cybersecurity workforce.

Federal Cybersecurity Workforce Dataset

In June 2013, OPM launched an initiative to build and use a comprehensive dataset of existing and future executive branch cybersecurity positions. The initiative, known as the Special Cybersecurity Workforce Project, was created to support the FY2013 Cross-Agency Priority (CAP) goal to close cybersecurity workforce skills gaps. The project includes three phases:

1. build a dataset of all federal cybersecurity positions, 2. assess the accuracy of data contained therein, and 3. use the dataset to identify and address needs of the federal cybersecurity workforce.

To support construction of the dataset, OPM directed agencies to assign OPM cybersecurity data codes to their positions. As of November 2015, roughly 95% of all federal positions (not just cybersecurity positions), and 96% of positions in the 2210 occupation series, had been assigned an OPM cybersecurity data code. The OPM dataset, as well as a government-wide count of the federal cybersecurity workforce, however, has not been released to the public. OPM staff did not indicate when the dataset would be available on OPM's online workforce data portal, noting that the release date will depend on the accuracy of the data.

Cybersecurity Workforce Skills Gap Assessments

On October 30, 2015, OMB issued the Cybersecurity Strategy and Implementation Plan (CSIP). The CSIP directs agencies to, among other things, complete the following activities to identify skills gaps in the federal cybersecurity workforce:

1. All agencies—identify their top five cyber talent gaps using OPM's cybersecurity dataset. 2. OPM, DHS, and OMB—issue a report that maps "the entire cyber workforce landscape across all agencies using the NICE national cybersecurity workforce framework and identify cyber talent gaps and recommendations for closing them."

Figure 2 , below, includes key activities for OPM's cybersecurity dataset initiative and related CSIP activities. OPM has completed Phase 1, anticipates completing Phase 2 by March 31, 2016, and anticipates beginning Phase 3 during the "latter part of FY2016." These CSIP activities may accelerate planned implementation of Phase 3, as they require agencies to use the dataset for workforce planning purposes.

Efforts to Define and Identify the Federal Cybersecurity Workforce Through Legislation

Two laws include provisions that aim to define and identify federal cybersecurity positions:

1. The Border Patrol Pay Agent Reform Act of 2013 ( P.L. 113-277 ) 2. The Consolidated Appropriations Act, 2016 ( P.L. 114-113 )

The laws codify, and in some ways enhance, OPM's ongoing efforts to define and code federal cybersecurity positions since 2013. The laws also enhance OMB's efforts to assess agencies' cybersecurity workforce capabilities. Broadly, the laws require all agencies to (1) assign data codes to all cybersecurity positions according to the national cybersecurity workforce framework; (2) conduct critical needs assessments for identified cyber positions; and (3) submit progress reports on completing these tasks. Table 1 , below, compares efforts to define, identify, and assess federal cybersecurity positions between the laws and the OPM/OMB directives described above.

Selected Hiring and Pay Flexibilities Applicable to DOD and DHS Cybersecurity Positions

Congress has authorized hiring and pay flexibilities for DOD and DHS to enhance the recruitment and retention of cybersecurity professionals. OPM has also provided similar, but distinct, hiring flexibilities for certain DOD and DHS cybersecurity positions. The text box, below, provides a brief background on hiring and pay flexibilities. The subsections below discuss

selected hiring and pay flexibilities authorized by statute; selected OPM-issued hiring flexibilities; key functions of selected hiring and pay flexibilities; and an analysis of selected statutory provisions on hiring and pay flexibilities.

Selected Hiring and Pay Flexibilities Authorized by Statute

Congress enacted three laws that authorize hiring and pay flexibilities applicable to cybersecurity positions at DOD and DHS:

P.L. 104-201, the National Defense Authorization Act for FY1997 P.L. 113-277, the Border Patrol Pay Agent Reform Act of 2014 P.L. 114-92, the National Defense Authorization Act for FY2016

The flexibilities were first established in P.L. 104-201 for DOD intelligence positions, although they have been used to fill positions that perform cybersecurity functions. For example, the Department of the Army used the flexibilities to fill a "Senior Intelligence Advisor, Cyber" position. The hiring flexibilities authorized in P.L. 104-201 were used to justify establishing nearly identical flexibilities for cybersecurity positions at DOD and DHS. Table 2 , below, briefly describes the coverage and legislative background of the three laws.

Selected OPM-Issued Hiring Flexibilities

OPM has also issued temporary hiring flexibilities for a limited number of cybersecurity positions at DOD and DHS. The positions must require unique cybersecurity skills and knowledge that are explicitly specified in the flexibilities. The DOD flexibility must be used to fill positions within certain occupational series, while the DHS flexibility does not include such limitations. The DHS flexibility appears to be an interim recruiting solution for cybersecurity professionals until the regulations governing the hiring and pay flexibilities under P.L. 113-277 become effective. Table 3 , below, summarizes key features of the flexibilities.

Key Functions of Hiring and Pay Flexibilities

The aforementioned hiring and pay flexibilities aim, respectively, to enhance the recruitment and retention of cybersecurity professionals at DOD and DHS by (1) designating cybersecurity positions as within the excepted service, and (2) allowing for additional compensation for cybersecurity professionals. The OPM-issued flexibilities do not explicitly authorize the use of the pay flexibilities.

Hiring Flexibilities: Excepted Service Designation

The hiring flexibilities described above allow covered DOD and DHS positions to be placed in the excepted service (see text box below for an explanation). As a result, DOD and DHS are not subject to the competitive hiring requirements in Title 5 of the United States Code that are placed on other agencies for covered positions. Rather, the authorized agencies can use alternative (and often agency-developed) recruitment, assessment, and selection methods for the positions that are sometimes seen as more flexible and efficient than regular competitive hiring procedures. These alternative hiring procedures are intended to allow for streamlined and tailored recruitment, which could expedite the hiring process. For example, DOD and DHS may waive public notice requirements, including posting job announcements on USAJobs.gov, for covered positions. This exception might allow the departments to reduce the number of applications to review and hire from a narrower group of individuals, thereby accelerating the hiring process.

Pay Flexibilities: Additional Compensation

The laws described above provide DOD and DHS with the opportunity to offer cybersecurity professionals additional compensation that is not typically available to all federal employees. The flexibilities seek to increase DOD's and DHS's abilities to compete for top cybersecurity talent. A report accompanying the DHS Cybersecurity Workforce Recruitment and Retention Act of 2014, for example, asserted that the pay flexibilities for DOD intelligence positions provide DOD with "significant latitude in setting pay and benefits [for cybersecurity positions], adding on regional or other adjustments to pay, and offering further specific financial incentives."

Fixed Rates of Pay

The laws for DOD and DHS authorize the departments to fix salaries for positions covered under their respective workforce flexibilities at rates of comparable DOD positions and fill such positions without regard to the classification and compensation requirements in any other law. Using these flexibilities, the departments can establish alternative pay systems outside of the GS system and develop their own criteria for setting and adjusting salaries for positions within that system. According to a 2011 GAO report on the federal cybersecurity workforce, characteristics of certain non-GS systems can allow agencies to offer employees higher salaries compared to their GS system-bound counterparts. As stated earlier, agencies have argued that non-GS systems can increase an agency's ability to attract and retain cybersecurity professionals.

Additional Monetary Incentives

Individuals filling DOD and DHS cybersecurity positions through the flexibilities authorized by statute are eligible for additional monetary incentives. These incentives can include one-time cash payments or base pay increases and can be performance or non-performance based. In many cases, these incentives can be given to all federal employees. For example, regarding non-performance-based flexibilities, all agencies have the discretion to provide recruitment incentives for positions that would be difficult to fill in the absence of such an incentive. Agencies also have the discretion to provide performance-based cash awards to employees for work that "contributes to the efficiency, economy, or other improvement of government operations."

Some monetary incentives authorized under the DOD and DHS laws, however, are only available to employees covered under the laws and can allow these employees—including cybersecurity professionals—to earn higher base salaries (exclusive of locality-pay adjustments) than their GS counterparts. For example, cybersecurity employees covered under the Defense Civilian Intelligence Personnel System (DCIPS) can receive awards that cause their base salaries to exceed the maximum pay rate of their position's grade, while GS employees cannot (the text box below provides an example). DCIPS is a DOD-specific, alternative personnel management system that encompasses DOD intelligence positions covered under P.L. 104-201 and includes a General Grade (GG) salary structure that aligns with the GS system's 15-grade structure.

Analysis of Selected Statutory Provisions for Hiring and Pay Flexibilities

This section includes an analysis of selected provisions from the three laws authorizing hiring and pay flexibilities for DOD intelligence positions (P.L. 104-201), DHS cybersecurity positions (P.L. 113-277), and DOD cybersecurity positions affiliated with the U.S. Cyber Command (P.L. 114-92). The analysis highlights key structural differences between the selected provisions. Appendix A includes a side-by-side analysis of key provisions in each of the laws.

Probationary Period

New employees hired into DOD or DHS cybersecurity positions are subject to a three-year probationary period. While no similar extended probationary period is statutorily required for DOD intelligence personnel, DOD has instituted a two-year "trial period" for many of these positions. In addition, existing DOD and DHS cybersecurity employees that are scheduled to be converted to the excepted service have the right to refuse moving to the excepted service. The law governing DOD intelligence positions contains no similar language. Employees in the excepted service cannot apply for career and career-conditional federal jobs (i.e., jobs that are not open to all U.S. citizens) and therefore might be less inclined to accept the conversion.

Implementation Plan

The laws for DOD and DHS cybersecurity positions require an implementation plan describing how the hiring and pay flexibilities will be used, while the law for DOD intelligence positions does not. The content and submission requirements, however, differ between plans. P.L. 114-92 requires DOD to submit an implementation plan to Congress prior to using the flexibilities. The flexibilities will only become effective 30 days after Congress receives the plan. In addition, the plan's content must include "(1) an assessment of the scope of positions covered by the flexibilities, (2) a plan for using the flexibilities, and (3) an assessment of the anticipated workforce needs of the U.S. Cyber Command across the future-years' defense plan." P.L. 113-277, in contrast, does not require DHS to include specific information in the implementation plan, nor does it preclude DHS from using the flexibilities therein prior to submitting the plan.

Reporting Requirements

DOD and DHS are required to report annually on the use of hiring and pay flexibilities for covered cybersecurity positions. The reports' content requirements are identical and must include recruitment and retention data—such as the number of hires, separations, and retirements for covered cybersecurity positions—among other things. The report authors and submission timelines, however, differ. P.L. 113-277 directs DHS to develop the annual report, while P.L. 114-92 requires OPM, in coordination with DOD, to develop the report. Further, the plan for DHS flexibilities must be submitted annually for four years after the date of enactment, compared to annually for five years after the date of enactment under the plan for DOD flexibilities. The law for DOD intelligence positions does not contain any reporting requirements.

Congressional Oversight Issues

Congress has shown an interest in ensuring that the federal cybersecurity workforce is defined and identified. Congress has also shown an interest in ensuring that hiring and pay flexibilities for cybersecurity positions at DOD and DHS are properly implemented and achieve their intended purposes. If such interest continues, Congress could enhance its oversight of these efforts to increase its awareness and knowledge of their implementation. The subsections below discuss potential issues in the absence of enhanced congressional oversight related to (1) identifying and defining the federal cybersecurity workforce, and (2) hiring and pay flexibilities that can be used to fill DOD and DHS cybersecurity positions.

Identifying and Defining the Federal Cybersecurity Workforce

Efforts to define and identify federal cybersecurity workforce positions have largely been undertaken by OPM. OPM, however, is not currently required to report on its progress in identifying and coding all federal cybersecurity positions to Congress, nor has it released its cybersecurity dataset or a government-wide count of the cybersecurity workforce to Congress. Further, OMB's CSIP does not require agencies to report identified skills gaps in their cybersecurity workforces to Congress. Congressional knowledge of the progress of these evolving efforts, therefore, might be limited or incomplete, which might make it difficult for Congress to (1) identify potential conflicting efforts between OMB, OPM, and Congress in assessing the capabilities of the federal cybersecurity workforce, and (2) gauge the utility of hiring and pay flexibilities for cybersecurity positions.

Potential Conflicting Efforts to Assess the Federal Cybersecurity Workforce

The lack of a requirement for progress reports may make it difficult for Congress to identify or prevent potentially conflicting efforts to identify cybersecurity workforce gaps between existing laws and OMB/OPM directives. For example, as stated previously, the CSIP required all agencies to identify their top five cyber talent gaps, and P.L. 113-277 and P.L. 114-113 require DHS and executive branch agencies to identify cybersecurity specialty areas of critical need—including those facing acute and emerging skill shortages. OPM issued guidance to help agencies identify their top five cyber talent gaps. OPM is also required under P.L. 113-277 and P.L. 114-92 to issue separate guidance to help DHS and executive branch agencies identify cybersecurity areas of critical need. If OPM's guidance for identifying cyber talent gaps differs substantially from its guidance for identifying cybersecurity areas facing acute or emerging skill shortages, it could result in different positions identified as facing workforce gaps. This might affect agencies' ability to address staffing needs.

Utility of Hiring and Pay Flexibilities

Congress's knowledge of agencies' cybersecurity workforce capabilities and needs might be affected by lack of access to OPM's dataset and lack of formal notification about cybersecurity skills gaps identified through the CSIP. Consequently, it might be difficult for Congress to definitively determine the need for or the proper structure of hiring and pay flexibilities to address those needs. This could lead to the absence of certain hiring and pay flexibilities, authorization of new flexibilities that are not necessarily needed, or the realization that existing flexibilities do apply to the specific agency components. For instance, suppose a federal department identifies cybersecurity skills gaps in one of its major components without a full and accurate count of its workforce and Congress subsequently authorizes hiring and pay flexibilities to fill those positions. If the agency, after accurately measuring the size and composition of its workforce, determines that a different component faces skills gaps, the existing flexibilities would not help to address such gaps.

Issues Related to Hiring and Pay Flexibilities for DOD and DHS Cybersecurity Positions

The laws governing flexibilities for DOD and DHS cybersecurity positions require the departments to report to Congress on their use, while neither the law for DOD intelligence positions nor the OPM-issued flexibilities do. Further, existing reporting requirements for the flexibilities do not require the departments to identify challenges to using the flexibilities or to measure their effectiveness. DOD and DHS have broad discretion to determine the structure and implementation of statutorily authorized hiring and pay flexibilities, such as what positions the flexibilities apply to and how they are to be used. This discretion can create the potential for discrepancies between the intended and actual use of the flexibilities. Were Congress to be interested in identifying and addressing any potential discrepancies, as well as gauging the flexibilities' effectiveness in improving the recruitment and retention of cybersecurity professionals at DOD and DHS, it might need to enhance its oversight by clarifying reporting requirements.

The subsections below discuss issues related to (1) usage data and its potential impact, (2) effectiveness measurement, and (3) training with regard to the DOD and DHS hiring and pay flexibilities.

Lack of Data on Use of Certain Cybersecurity Hiring Flexibilities at DOD and DHS

The law for DOD intelligence positions, and the OPM-issued hiring flexibilities for certain DOD and DHS cybersecurity positions, do not require the departments to report, among other things, (1) the total number of employees hired using the flexibilities, (2) the specific types of positions filled through the flexibilities, or (3) in which components the positions are located. A lack of data on the use of hiring and pay flexibilities could reduce Congress's ability to determine how much they are used and to what effect.

Appropriate Use of Flexibilities

In the absence of data on use of the flexibilities issued by OPM or authorized under the law for DOD intelligence positions, Congress might find it difficult to ensure that these flexibilities are being used to fill appropriate positions. For example, at least one cybersecurity workforce expert expressed concern that DHS may have used a past OPM-issued cybersecurity hiring flexibility to fill non-cybersecurity positions.

Maximized Use of Flexibilities

The absence of data may make it difficult for Congress to determine to what extent the flexibilities are used, and what challenges may inhibit their maximum use. Ultimately, this could affect future decisions regarding the authorization of additional flexibilities or changes to the structure of existing flexibilities. For example, suppose that DHS uses the OPM-issued hiring flexibility to fill 200 cybersecurity positions—20% of the maximum allowed by the flexibility (up to 1,000 positions). If DHS had no additional positions to fill, additional flexibilities might not be needed. If DHS encountered implementation challenges that prevented further use of the flexibility, however, structural changes to the flexibility may be needed. Similarly, suppose that DHS does not use the pay flexibilities authorized under P.L. 113-277. While the lack of use could indicate that the flexibilities are not needed, it may also stem from budget constraints.

Utility of Flexibilities for the U.S. Cyber Command

A lack of data on how frequently the flexibilities for DOD intelligence positions are being used to fill positions affiliated with the U.S. Cyber Command may make it difficult for Congress to gauge the utility of new flexibilities authorized for Command positions under P.L. 114-92. It appears that some positions affiliated with the Command are being filled using the existing flexibilities for DOD intelligence positions. The Departments of the Army and Navy, for example, are using the flexibilities to fill cybersecurity positions in units that support the Command. The flexibilities, therefore, might not be needed as much or used as often as envisioned if a sizeable portion of covered positions can be filled using existing flexibilities.

Effectiveness of Hiring and Pay Flexibilities

Existing reporting requirements for the hiring and pay flexibilities measure the use of hiring and pay flexibilities, but do not necessarily measure their effectiveness . For example, the law for DHS cybersecurity positions requires the department to detail how it plans to recruit and retain employees in cybersecurity positions and how it will measure progress in doing so. The laws do not, however, task DHS and DOD with determining whether and in what ways specific aspects of the hiring and pay flexibilities improved the departments' ability to attract and retain qualified cybersecurity professionals, or whether these professionals have improved the quality and capacity of the departments' cybersecurity workforces.

Training on Structure and Use of Flexibilities

The laws governing flexibilities for DOD intelligence, DHS cybersecurity, and DOD cybersecurity positions at the U.S. Cyber Command do not include provisions to require human resources staff (including component-level hiring managers and department-level staff in the Office of the Chief Human Capital Officer) to receive training on the availability, structure, and operation of cybersecurity hiring and pay flexibilities. Rather, P.L. 113-277 and P.L. 114-92 require DOD and DHS to describe the training provided to supervisors using the flexibilities in the aforementioned annual reports to Congress.

A lack of staff training might impact effective use of the flexibilities. Untrained hiring managers and human resources staff might not know about the flexibilities, the positions they apply to, how to properly implement them, and the positions for which they are most appropriate. For example, as mentioned earlier, it appears that certain cybersecurity positions affiliated with the U.S. Cyber Command could be filled under the flexibilities authorized under P.L. 104-201 or P.L. 114-92.

Oversight Policy Options

Pursuant to its oversight authority, Congress could consider several oversight policy options to enhance its knowledge and awareness of identification and recruitment efforts for the federal cybersecurity workforce. Seven options are presented in this section, though other policy options exist. The first two policy options relate to monitoring OPM and OMB initiatives to define and identify federal cybersecurity positions. The remaining five options relate to monitoring the implementation of hiring and pay flexibilities used to fill DOD and DHS cybersecurity positions. CRS takes no position on the advisability of these and other potential policy options.

This section does not present broader policy options that address the capabilities of the federal cybersecurity workforce, such as the establishment of additional hiring and pay flexibilities, other personnel tools that could be used to recruit and retain cybersecurity professionals, and whether federal cybersecurity professionals are enabling agencies to fulfill their respective missions.

1. Notification of Progress on OPM Cybersecurity Dataset

OPM could be required to notify appropriate congressional committees on the status of the cybersecurity dataset, including when the dataset is completed and released to the public on OPM's online workforce data portal. In exercising its oversight authority, Congress may require these notifications to occur annually, semi-annually, quarterly, or on any other standard timeline. OPM could also be required to brief appropriate congressional committees on the structure and functions of the dataset upon its release. This could include (but not be limited to) the data it presents, how the data can be used to generate a government-wide count of the cybersecurity workforce, how it will be kept up to date, and anticipated enhancements and adjustments to be made.

2. GAO Evaluation of OPM Cybersecurity Dataset

As mentioned previously, P.L. 113-277 and P.L. 114-113 require GAO to submit a report to Congress describing the status of identifying, coding, and evaluating critical needs of cybersecurity positions at DHS and executive branch agencies. The laws do not, however, explicitly require GAO to evaluate OPM's dataset. In its oversight capacity, Congress could additionally direct GAO to study the operation and effectiveness of the OPM cybersecurity dataset one year after it becomes operational. The study could evaluate, whether the dataset and OPM cybersecurity data codes accomplish the goals listed below. The study could also evaluate the validity of reported skills gaps in agencies' cybersecurity positions.

(1) identify positions for which the primary function is cybersecurity;

(2) enable OPM and agencies to determine the baseline capabilities of the workforce, examine hiring trends, identify skills gaps, and more effectively recruit, hire, train, develop, and retain an effective cybersecurity workforce;

(3) allow HR professionals to better understand the workforce and what issues need to be addressed; and

(4) provide a platform for organizations outside of the federal government to similarly organize their cybersecurity professionals.

3. Conform Reporting Requirements for DOD and DHS Flexibilities

Congress could amend existing statues to extend the reporting requirements articulated in the law for DHS cybersecurity positions—or the law for DOD cybersecurity positions—to DOD intelligence positions. Congress could also add a new reporting provision that requires DOD and DHS to provide information on any challenges encountered in implementing the flexibilities under P.L. 104-201, P.L. 114-92, and P.L. 113-277. Reporting requirements enhance congressional oversight of the hiring and pay flexibilities used for DOD intelligence positions. In addition, the reporting requirements might allow Congress to compare the use of the DOD and DHS hiring and pay flexibilities.

4. Additional Data on DOD Flexibilities

Congress could include the metrics listed below in the annual reporting requirements for DOD intelligence positions (P.L. 104-201) and DOD positions affiliated with the U.S. Cyber Command (P.L. 114-92). The metrics could provide Congress with greater clarity on the extent to which the flexibilities under the laws are being used to fill cybersecurity positions. Such clarity might better position Congress to determine the utility of the flexibilities and the need (or lack thereof) for additional flexibilities for DOD cybersecurity positions.

For DOD i ntelligence positions (P.L. 104-201) :

1. Total number of covered cybersecurity positions filled using the hiring flexibilities authorized by P.L. 104-201. 2. Total number of covered cybersecurity positions filled using other hiring flexibilities. 3. Percentage of filled cybersecurity positions that are affiliated with the U.S. Cyber Command.

For DOD positions affiliated with the U.S. Cyber Command (P.L. 114-49 ) :

1. Total number of covered cybersecurity positions filled using the hiring flexibilities authorized by P.L. 114-49. 2. Total number of covered positions filled using other hiring flexibilities. 3. Percentage of covered positions filled through other existing hiring flexibilities.

5. Additional Data on OPM-Issued Flexibilities

DOD and DHS could be required to report their use of OPM-issued hiring flexibilities for cybersecurity positions. The requirements could include, (1) the number of positions filled using the flexibility; (2) the pay plan, occupation, series, and grade of the position; (3) the nature of action of each hire; and (4) any challenges encountered in implementing the flexibilities. Such data might enhance Congress's capacity to determine the extent to which these flexibilities are being, or have been used—and any barriers to maximizing their use. This information could, in turn, assist Congress in addressing any barriers to using statutorily authorized flexibilities and determining the utility of additional flexibilities.

6. Training for DOD and DHS Staff on Flexibilities

DOD and DHS could be required to provide training on the proper use and implementation of the hiring and pay flexibilities for cybersecurity positions to hiring managers and human resources staff listed below. Congress could require the training to include a review of the existing authorities that can be applied to cybersecurity positions. Training might allow staff to better understand when and how to use the flexibilities.

1. Department-level human resources (HR) staff that manage the civilian workforce

This could include staff within the Office of Chief Human Capital Officer (CHCO), as well as other HR units that might be involved in civilian workforce issues.

1. Department and component-level staff that develop implementing guidance for hiring and pay flexibilities

DHS and DOD often issue implementing guidance for hiring and pay flexibilities at the department and component levels. It might be useful for staff charged with issuing implementing guidance to receive training on the structure and functions of the flexibilities.

1. Component-level supervisors and hiring managers that use, or would use, the flexibilities

DHS and DOD supervisors and hiring managers that use, or would use, the flexibilities might also benefit from training.

7. Report on the Effectiveness of Hiring and Pay Flexibilities

The Inspectors General at DOD and DHS could be required to report on how effective the hiring and pay flexibilities authorized through statute—and the specific features—have been in recruiting and retaining qualified cybersecurity professionals. For example, the reports could include an analysis of whether the hiring flexibilities reduced time to hire, and whether the reduced time to hire attracted qualified cybersecurity professionals to the departments, whether monetary incentives were a primary factor in attracting and retaining cybersecurity professionals to the federal government, which types of monetary incentives were most effective in doing so (e.g., performance awards or student loan repayments), and potentially other related matters.

Appendix A. Side-by-Side Analysis of Selected Provisions from Statutory Authorities for DOD Intelligence, DHS Cybersecurity, and DOD Positions at the U.S. Cyber Command

Appendix B. Reporting Requirements