Cybersecurity Workforce: Agencies Need to Accurately Categorize Positions to Effectively Identify Critical Staffing Needs
Released: 2019-03-12T00:00:00

Letter

Background

Federal agencies and our nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The information systems and networks that support federal operations are highly complex and dynamic, technologically diverse, and often geographically dispersed. This complexity increases the difficulty in identifying, managing, and protecting the myriad of operating systems, applications, and devices comprising the systems and networks.

A resilient, well-trained, and dedicated cybersecurity workforce is essential to protecting federal IT systems. Nevertheless, OMB and our prior reports have pointed out that the federal government and private industry face a persistent shortage of cybersecurity and IT professionals to implement and oversee information security protections to combat cyber threats.

As we noted in our prior report, the RAND Corporation and the Partnership for Public Service have reported on a nationwide shortage of cybersecurity experts in the federal government. According to these reports, the existing shortage of cybersecurity professionals makes securing the nation’s networks more challenging and may leave federal IT systems vulnerable to malicious attacks. The persistent shortage of cyber-related workers has given rise to the identification and assessment of the federal cybersecurity workforce across agencies so that efforts to increase the number of those workers can be applied in the most efficient and accurate manner.

The NICE Framework and OPM Coding Structure Describe Federal Cybersecurity Work Roles

NIST coordinates the National Initiative for Cybersecurity Education (NICE) partnership among government, academia, and the private sector. The initiative’s goal is to improve cybersecurity education, awareness, training, and workforce development in an effort to increase the number of skilled cybersecurity professionals.

In August 2017, NIST revised and published the NICE Cybersecurity Workforce Framework (framework). The framework’s purpose is to help the federal government better understand the breadth of cybersecurity work by describing IT, cybersecurity, and cyber-related work roles associated with the categories and specialty areas that make up cybersecurity work. The framework organizes IT, cybersecurity, and cyber-related job functions into categories, representing high-level groupings of cybersecurity functions; and into specialty areas, representing areas of concentrated work or functions.

Figure 1 identifies the seven categories and the 33 specialty areas in the NICE framework.

In addition to categories and specialty areas, the NICE framework introduced the concept of work roles. Work roles provide a more detailed description of the roles and responsibilities of IT, cybersecurity, and cyber-related job functions than do the category and specialty area components of the framework. The framework defines one or more work roles within each specialty area. For example, as depicted in figure 2, the framework defines 11 work roles within the seven specialty areas of the “Securely Provision” category. In total, the framework defines 52 work roles across the 33 specialty areas.

The NICE framework work roles include, among others, the Technical Support Specialist, IT Project Manager, and Software Developer. The framework identifies these IT, cybersecurity, and cyber-related work roles as essential functions. For example, a Technical Support Specialist may have a role in identifying the occurrence of a cybersecurity event, an IT Project Manager may need to manage cybersecurity risk to systems, and a Software Developer may need to implement appropriate cybersecurity safeguards.

In October 2017, OPM updated the federal cybersecurity coding structure to incorporate the work roles identified in the NICE framework. The coding structure assigned a unique 3-digit cybersecurity code to each work role, which supplanted the prior coding structure’s 2-digit codes. According to OPM, the coding of federal positions with these specific 3- digit work role codes is intended to enhance agencies’ ability to identify critical IT, cybersecurity, and cyber-related workforce needs, recruit and hire employees with needed skills, and provide appropriate training and development opportunities to cybersecurity employees. Appendix II provides a summary of the IT, cybersecurity, and cyber-related work roles and corresponding OPM codes.

Federal Cybersecurity Workforce Assessment Act of 2015 Establishes Workforce Planning Requirements

In 2015, Congress and the President enacted the Federal Cybersecurity Workforce Assessment Act, which required OPM, NIST, and other federal agencies to undertake a number of cybersecurity workforce-planning activities. The act required these agencies to complete the activities within specified time frames. We addressed the first six activities in our prior report we issued in June 2018, and addressed the subsequent activities 7 through 10 in this report.

Among the required cybersecurity workforce-planning activities are the following 10 that we selected for our review. 1. OPM, in coordination with NIST, was to develop a cybersecurity coding structure that aligns with the work roles identified in the NICE Cybersecurity Workforce Framework. (Due June 2016) 2. OPM was to establish procedures to implement a cybersecurity coding structure to identify all federal civilian positions that require the performance of IT, cybersecurity, or other cyber-related functions. (Due September 2016) 3. OPM was to submit a report to Congress on the progress that agencies made in identifying and assigning codes to their positions that perform IT, cybersecurity, or cyber-related functions. (Due June 2016) 4. Each federal agency was to submit a report to Congress on its baseline assessment and on the extent to which its employees who perform IT, cybersecurity, or cyber-related functions held certifications. (Due December 2016) 5. Each federal agency was to establish procedures to identify all filled and vacant IT, cybersecurity, or cyber-related positions and assign the appropriate code to each position. (Due April 2017 for civilian positions) 6. The Department of Defense (DOD) was to establish procedures to implement the cybersecurity coding structure to identify all federal noncivilian (i.e., military) positions. (Due June 2017) 7. Each agency was to complete the assignment of work role codes to its filled and vacant positions that perform IT, cybersecurity, or cyber- related functions. (Due April 2018 for civilian positions) 8. OPM was to identify critical needs across federal agencies and submit a progress report to Congress on the identification of critical needs. (Due December 2017) 9. OPM was to provide federal agencies with timely guidance for identifying IT, cybersecurity, or cyber-related work roles of critical need, including work roles with acute and emerging skill shortages. (The act did not specify a due date for this requirement). 10. Federal agencies were to identify their IT, cybersecurity, or cyber- related work roles of critical need in the workforce and submit a report describing these needs to OPM. (Due April 2019)

Prior GAO Report Examined Agencies’ Implementation of the Initial Activities Required by the Federal Cybersecurity Workforce Assessment Act of 2015

In June 2018, we reported on federal agencies’ implementation of the first six of the 10 selected activities required by the Federal Cybersecurity Workforce Assessment Act. Specifically, we reported that, in November 2016, OPM, in coordination with NIST, had issued a cybersecurity coding structure that aligned with the NICE framework work roles (activity 1). Also, these two agencies developed procedures for assigning codes to federal civilian IT, cybersecurity, or cyber-related positions in January 2017 (activity 2). We noted that OPM had issued the cybersecurity coding structure and procedures later than the act’s deadlines because it was working with NIST to align the structure and procedures with the draft version of the NICE Cybersecurity Workforce Framework, which NIST issued later than planned. Regarding activity 3, we noted that OPM had submitted a report to Congress in July 2016 on the agencies’ progress in implementing the act’s required activities, as well as OPM’s efforts to develop a coding structure and government-wide coding procedures.

We also reported that 21 of the 24 agencies had submitted baseline assessment reports identifying the extent to which their IT, cybersecurity, or cyber-related employees held professional certifications (activity 4). However, the three other agencies had not submitted such reports. In addition, four agencies did not include all reportable information in their reports, such as the extent to which personnel without certifications were ready to obtain them, or strategies for mitigating any gaps, as required by the act. We made 10 recommendations to these seven agencies to develop and submit baseline assessment reports, including all reportable information, to the congressional committees. As of February 2019, none of the seven agencies had implemented any of the 10 recommendations relating to the baseline assessment reports.

Further, we reported that 23 of the 24 agencies had established procedures for assigning the appropriate work role codes to civilian positions that perform IT, cybersecurity, or cyber-related functions (activities 5 and 6 above), as required by the act. One agency had not established such procedures.

Further, of the 23 agencies that had established procedures, 6 agencies did not address one or more of seven activities required by OPM in their procedures. For example, the agencies’ procedures did not include activities to review all filled and vacant positions and annotate reviewed position descriptions with the appropriate work role code. In addition, DOD had not established procedures for identifying and assigning work role codes to noncivilian (i.e., military) positions.

Our June 2018 report included 20 recommendations to eight agencies to establish or update their procedures to fully address the required activities in OPM’s guidance. Subsequent to the report, the eight agencies implemented the 20 recommendations related to establishing or improving agencies’ coding procedures to address the required OPM activities. Specifically:

The Department of Energy (Energy) established coding procedures that addressed the seven OPM required activities.

The Department of Education (Education), Department of Labor (Labor), NASA, National Science Foundation (NSF), Nuclear Regulatory Commission (NRC), and United States Agency for International Development (USAID) revised their procedures to ensure that the procedures addressed OPM’s required activities.

DOD established a consolidated government-wide and internal procedure for identifying and assigning work role codes to noncivilian (i.e., military) positions.

Table 1 summarizes the status of agencies’ implementation of the first six selected activities required by the act as of October 2018. We initially reported on the status of these activities in our June 2018 report.

Agencies Generally Categorized Positions, but Did Not Ensure the Reliability of Their Efforts

Regarding the selected activity for agencies to complete the assignment of work role codes to filled and vacant positions that perform IT, cybersecurity, or cyber-related functions (activity 7) as set forth in the Federal Cybersecurity Workforce Assessment Act of 2015, the 24 agencies had generally assigned work roles code to their positions. However, several agencies had not completed assigning codes to their vacant positions. In addition, most agencies had likely miscategorized the work roles of many positions. For example, in these instances, the agencies had assigned a code designated for positions that do not perform IT, cybersecurity, or cyber-related functions to positions that most likely perform these functions.

As indicated in table 2, federal agencies’ efforts to assign work role codes to filled and vacant positions that performed IT, cybersecurity, or cyber- related functions were ongoing as of October 2018.

Agencies Had Generally Assigned Work Role Codes to Positions, but Six Had Not Completely Coded Vacant Positions

To assist agencies with meeting their requirements under the Federal Cybersecurity Workforce Assessment Act of 2015, OPM issued guidance that directed agencies to identify filled and vacant positions with IT, cybersecurity, or cyber-related functions and assign work role codes to those positions using the Federal Cybersecurity Coding Structure by April 2018. As previously mentioned, this coding structure designates a unique 3-digit code for each work role defined in the NICE framework. According to OPM’s guidance, agencies could assign up to three work role codes to each position, and should assign the code of “000” only to positions that did not perform IT, cybersecurity, or cyber-related functions.

The 24 agencies generally had assigned work role codes to their filled workforce positions that performed IT, cybersecurity, or cyber-related functions. Specifically, 22 of the agencies responded to our questionnaire that, as of April 2018, they had completed assigning work role codes to those filled positions. In addition, data from the OPM Enterprise Human Resources Integration system showed that, as of May 2018, the 24 agencies had collectively assigned work role codes or a “000” code to over 99 percent of the filled positions in their entire workforce.

In addition, 18 of the 24 agencies reported they had identified and assigned codes to their vacant IT, cybersecurity, or cyber-related positions by April 2018. However, the remaining six agencies reported that they were not able to identify or assign codes to all of their vacant positions. For example, four agencies—DOD, EPA, GSA, and NASA— responded to our questionnaire that they did not identify and assign codes to vacant IT, cybersecurity, or cyber-related positions.

DOD reported that, while some components assigned codes to vacant positions, the department did not have an enterprise-wide capability to assign codes to vacant positions and had not modified the systems to enable the use of the 3-digit work role codes for vacant positions due to time and funding constraints.

EPA reported that it had assigned codes to vacant positions in April 2018, but it did not have a process for assigning codes to newly created vacant positions.

GSA human resources officials said that they assigned codes to vacant positions that had been authorized and funded. However, they did not code unfunded vacant positions because they did not anticipate filling them. Agency officials noted that they, instead, tracked unfunded vacant positions through staffing plans.

NASA human resources and Office of the Chief Information Officer officials said the agency did not identify and code vacant positions because they did not track vacant positions.

Further, the remaining two agencies—Energy and Justice— stated that they could not provide data regarding the number of vacant IT, cybersecurity, or cyber-related positions that had been identified and coded. For example, Justice said that information on vacant positions was not available through its human resources system, and that it would need to send a data call to components to obtain information on the number of vacancies with an assigned work role code. However, according to management division officials, the department would need additional time to collect this information.

OPM stated that it plans to issue additional guidance for tracking IT, cybersecurity, and cyber-related vacancies by January 2019. OPM officials said that agencies have focused on the assignment of codes to filled positions and that tracking vacancies is challenging because agencies vary in the way they track vacancies.

By not completing their efforts to identify and code their vacant IT, cybersecurity, and cyber-related positions, the six agencies lack important information about the state of their workforces. As a result, these agencies may be limited in their ability to identify work roles of critical need and improve workforce planning.

Most Agencies Had Likely Miscategorized the Work Roles of Many Positions

The Federal Cybersecurity Workforce Assessment Act of 2015 required agencies to assign the appropriate work role codes to each position with cybersecurity, cyber-related, and IT functions, as defined in the NICE framework. In addition, OPM guidance required agencies to assign work role codes using the Federal Cybersecurity Coding Structure. As previously mentioned, according to OPM’s guidance, agencies could assign up to three work role codes to each position. Agencies were to assign a code of “000” only to positions that did not perform IT, cybersecurity, or cyber-related functions. Further, the Standards for Internal Control in the Federal Government states that agencies should obtain relevant data from reliable sources that are complete and consistent.

However, the 24 agencies had likely miscategorized the work roles of many positions. For example, the 24 agencies routinely assigned work role codes to positions that were likely inconsistent with the positions’ functions. Specifically, at least 22 of the 24 agencies assigned the code “000”, which is designated for positions not performing IT, cybersecurity, or cyber-related functions, to many positions that most likely performed these functions.

For example, OPM’s Enterprise Human Resources Integration data from May 2018 showed that 22 of the 24 agencies had assigned the “000” code to between 5 and 86 percent of their positions in the 2210 IT management occupational series. These positions are most likely to perform IT, cybersecurity, or cyber-related functions, as defined by the NICE framework. OPM and agency officials told us that they would expect agencies to assign a NICE work role code to these positions, with a few exceptions, such as in cases where a position’s duties did not align with a NICE work role code.

Table 3 identifies the number and percentage of the 2210 IT management positions that were assigned a “000” code by each of the 24 agencies, according to OPM’s Enterprise Human Resources Integration data, as of May 2018. Collectively, the agencies assigned a “000” code to about 15,779 positions, or about 19 percent of the agencies’ 2210 IT management positions.

Agencies identified varying reasons for why they assigned the “000” code to positions that most likely performed IT, cybersecurity, or cyber-related functions. For example,

Agency human resources and IT officials from 10 agencies said that they may have assigned the “000” code in error (DOD, Education, Energy, Justice, State, Department of Veterans Affairs (VA), NRC, OPM, Small Business Administration (SBA), Social Security Administration (SSA)).

Agency human resources and IT officials from 13 agencies said they had not completed the process to validate the accuracy of their codes (Department of Agriculture (Agriculture), Education, Department of Health and Human Services (HHS), DHS, Department of Housing and Urban Development (HUD), Justice, Treasury, VA, EPA, GSA, NRC, SBA, SSA).

Agency human resources and IT officials from seven agencies said that they assigned the “000” code to positions that did not perform cybersecurity duties for a certain percentage of their time (Commerce, Justice, Labor, Transportation, Treasury, GSA, and NASA).

Agency human resources and IT officials from 12 agencies said that OPM’s guidance was not clear on whether the 2210 IT management positions should be assigned a work role code and not be assigned the “000” code (Agriculture, Energy, DHS, HUD, Interior, Labor, State, VA, EPA, GSA, NASA, and SSA).

Agency human resources and IT officials from three agencies stated that they assigned the “000” code to IT positions when their positions did not align with any of the work roles described in the NICE framework (Interior, Treasury, and NRC).

However, the work roles and duties described in the agencies’ position descriptions for the 2210 IT management positions that we reviewed aligned with the work roles defined in the NICE framework. For example, in examining the position descriptions that NRC officials said did not align to work roles in the NICE framework, we were able to match duties described in the position descriptions to work role tasks in the framework and identify potential work role codes for those positions. Additionally, Treasury officials said that positions in the area of cryptographic key management did not align with the NICE framework; however, these positions would likely align with the Communications Security Manager (i.e., NICE code 723) work role, which covers cryptographic key management.

By assigning work role codes that are inconsistent with the IT, cybersecurity, and cyber-related functions performed by positions, the agencies in our review are diminishing the reliability of the information they will need to identify their workforce roles of critical need.

Agencies Assigned Work Role Codes to Sample Positions That Were Inconsistent with Duties Described In Corresponding Position Descriptions

Similar to the work role data reported in OPM’s Enterprise Human Resources Integration system, the six agencies that we selected for additional review had assigned work role codes to positions in their human resources systems that were not consistent with the duties described in their corresponding position descriptions. Of 120 randomly selected 2210 IT management positions that we reviewed at the six agencies, 63 were assigned work role codes that were inconsistent with the duties described in their position descriptions.

DHS assigned a Network Operational Specialist code (NICE code 441) to a position with duties associated with a Cyber Instructional Curriculum Developer (NICE code 751).

State assigned a Cyber Legal Advisor (NICE code 731) code to a position with duties associated with a Program Manager (NICE code 801).

Table 4 summarizes the consistency of work role coding in comparison to corresponding position description text for the random sample of positions for the six selected agencies.

The six agencies had also assigned different work role codes for positions that had identical position titles and similar functions described in corresponding position descriptions for 46 of 72 positions that we reviewed. For example,

State had two positions associated with a position description that described duties associated with the IT Program Auditor (NICE code 805). Although State assigned the “805” work role code to one position, it assigned the “000” code to the other position.

DOD had two positions associated with a position description that described duties associated with the Information Systems Security Manager work role (NICE code 722). However, DOD assigned the “000” code to one position and assigned an invalid 2-digit code to the other position.

The six agencies provided multiple reasons for why they had assigned codes that were not consistent with the work roles and duties described in their corresponding position descriptions:

DOD officials from the Office of the Chief Information Officer cited the large number of positions that perform IT, cybersecurity, or cyber- related functions and the lack of one-to-one mapping of the NICE framework work roles to positions as impediments.

DHS human resources officials said that position descriptions may not have been consistent with coding because the assignment of the work role codes could be based on specific tasks that are described in separate documents (e.g., job analyses or employee performance plans) outside of the position descriptions.

Information Resource Management officials at State said that their system did not require all IT positions to have a work role code. However, according to the officials, they had plans to create and release a business rule in September 2018 to reduce data errors and require the 2210 IT management positions series to have a work role code.

EPA officials in the Office of Environmental Information and the Office of Human Resources stated that the first-line supervisor made the final determination of each position’s work role code. Officials stated that first-line supervisors may have assigned different codes for similar positions because they interpreted OPM guidance and work roles differently.

GSA human resources officials said they assigned “000” to IT positions because they needed clarification and further interpretive guidance from OPM. According to the officials, once GSA received the guidance, the agency planned to conduct a review of IT positions coded “000.” In addition, GSA had assigned the code “000” if the position description did not include 25 percent or more of cybersecurity functions.

According to NASA officials from the Offices of the Chief Human Capital Officer and Chief Information Officer, the agency miscoded a few positions due to an administrative error that has since been corrected. In addition, NASA officials said that they assigned the “000” code to positions that did not perform cybersecurity duties for a certain percentage of time (e.g., 25 percent or more of the time).

Agencies did not provide further evidence that the positions we evaluated as inconsistently coded were accurate. Moreover, in reviewing 87 position descriptions provided by the six agencies—DOD, DHS, State, EPA, GSA, and NASA—in no case did we find the assignment of the “000” work role code to be consistent with the duties described.

By assigning work role codes that are inconsistent with the IT, cybersecurity, and cyber-related functions performed by positions, the agencies in our review are diminishing the reliability of the information they will need to identify their workforce roles of critical need.

OPM and Agencies Had Taken Steps to Identify IT, Cybersecurity, and Cyber-related Work Roles of Critical Need

As of November 2018, OPM and the 24 agencies had taken steps to address the three selected activities that the Federal Cybersecurity Workforce Assessment Act of 2015 required to identify IT, cybersecurity, and cyber-related work roles of critical need. Specifically, OPM had reported on agencies’ progress in identifying critical needs (activity 8) and had provided agencies with guidance for identifying IT, cybersecurity, and cyber-related work roles of critical need (activity 9). In addition, the 24 agencies had submitted preliminary reports of their identified critical needs to OPM, but their efforts to identify critical needs were ongoing (activity 10).

Table 5 presents the status of the agencies’ efforts to identify work roles of critical need, as of November 2018. Further, appendix III summarizes the status of implementation of each of the 10 selected activities required by the act.

OPM Reported on Progress of Efforts and Provided Guidance for Agencies to Identify Cybersecurity Work Roles of Critical Need

The Federal Cybersecurity Workforce Assessment Act of 2015 required OPM, in consultation with DHS, to identify critical needs for the IT, cybersecurity, or cyber-related workforce across federal agencies and submit a progress report to Congress on the identification of IT, cybersecurity, or cyber-related work roles of critical need by December 2017. The act also required OPM to provide timely guidance for identifying IT, cybersecurity, or cyber-related work roles of critical need, and including current acute and emerging skill shortages.

In December 2017, OPM, in consultation with DHS, reported on the progress of federal agencies’ identification of IT, cybersecurity, and cyber- related work roles of critical need to Congress. In the report, OPM could not identify critical needs across all federal agencies because agencies were still in the process of assigning work role codes and identifying their critical needs. As such, OPM reported that agencies were working toward accurately completing their coding efforts by April 2018, as a foundation for assessing the workforce and identifying needed cybersecurity skills. OPM stated in the report that it would begin to identify and report IT, cybersecurity, and cyber-related work roles of critical need following the agencies’ completion of their assessments and coding of the workforce.

Further, in April 2018, OPM issued a memorandum to federal agencies’ chief human capital officers that provided guidance on identifying IT, cybersecurity, and cyber-related work roles. Specifically, this guidance required agencies to report their greatest skill shortages, analyze the root cause of the shortages, and provide action plans with targets and measures for mitigating the critical skill shortages.

In addition, in June 2018, to ensure that agencies were on track to meet the requirements outlined in the act to submit their critical needs by April 2019, OPM required agencies to provide a preliminary report on work roles of critical need and root causes by August 31, 2018. OPM provided agencies with a template to collect critical information such as critical needs and root causes. OPM guidance stated that these data would provide the Congress with a government-wide perspective of critical needs and insight into how to allocate future resources.

Agencies Have Begun to Identify Cybersecurity Work Roles of Critical Need

The act required agencies to identify IT, cybersecurity, or cyber-related work roles of critical need and submit a report to OPM substantiating these critical need designations by April 2019. OPM also required agencies to submit a preliminary report, which included agencies’ identified work roles of critical need and the associated root causes, by August 31, 2018.

The 24 agencies have begun to identify critical needs and submitted a preliminary report of critical needs to OPM. Seventeen agencies submitted their report by the August 31, 2018 deadline, and seven submitted their report after the deadline in September 2018. Most agencies’ reports included the required critical needs and root causes. Specifically,

Twenty-four agencies’ reports documented work roles of critical need.

Twenty-two agencies’ reports included the root cause of the critical needs identified.

Table 6 shows the status of the 24 agencies’ submissions of preliminary reports on cybersecurity work roles of critical need as of November 2018.

The preliminary reports of critical needs for the 24 agencies showed that, as of November 2018, IT project managers, information systems security managers, and systems security analysts are among the top identified work roles of critical need at these agencies. Twelve agencies reported each of these work roles as a critical need. Agencies’ preliminary reports should provide a basis for agencies to develop strategies to address shortages and skill gaps in their IT, cybersecurity, and cyber-related workforces. For additional information on the top 12 reported work roles of critical need, see appendix IV.

Conclusions

As required by the Federal Cybersecurity Workforce Assessment Act of 2015, the 24 agencies had generally categorized their workforce positions that have IT, cybersecurity, or cyber-related functions; however, agencies did not ensure the work role coding was reliable. For example, six of the 24 agencies had not completed assigning codes to their vacant positions. In addition, 22 of the agencies had assigned a code designated for positions not performing IT, cybersecurity, or cyber-related functions to about 19 percent of filled IT management positions.

Further, six selected agencies—DOD, DHS, State, EPA, GSA, and NASA—had assigned work role codes to positions in their human resources systems that were not consistent with the duties described in the corresponding position descriptions. Until agencies accurately categorize their positions, the agencies may not have reliable information to form a basis for effectively examining their cybersecurity workforce, improving workforce planning, and identifying their workforce roles of critical need.

Although OPM met its deadlines for reporting to congressional committees on agencies’ progress in identifying critical needs, the progress report did not identify critical needs across all federal agencies because agencies were still in the process of assigning work role codes and identifying their critical needs. In addition, OPM has since provided agencies with guidance that should assist them in their efforts to identify critical needs by April 2019. Further, all of the 24 agencies have submitted preliminary reports identifying work roles of critical need to OPM. These efforts should assist these agencies in moving forward to develop strategies to address shortages and skill gaps in their IT, cybersecurity, and cyber-related workforces.

Recommendations for Executive Action

We are making a total of 28 recommendations to 22 agencies to take steps to complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015. Specifically: The Secretary of Agriculture should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 1)

The Secretary of Commerce should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 2)

The Secretary of Defense should complete the identification and coding of vacant positions in the department performing IT, cybersecurity, or cyber-related functions. (Recommendation 3)

The Secretary of Defense should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 4)

The Secretary of Education should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 5)

The Secretary of Energy should complete the identification and coding of vacant positions in the department performing IT, cybersecurity, or cyber- related functions. (Recommendation 6)

The Secretary of Energy should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 7)

The Secretary of Health and Human Services should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 8)

The Secretary of Homeland Security should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 9)

The Secretary of Housing and Urban Development should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 10)

The Secretary of Interior should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 11)

The Attorney General should complete the identification and coding of vacant positions in the Department of Justice performing IT, cybersecurity, or cyber-related functions in the Department of Justice. (Recommendation 12)

The Attorney General should take steps to review the assignment of the “000” code to any positions in the Department of Justice in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 13)

The Secretary of Labor should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 14)

The Secretary of State should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 15)

The Secretary of Transportation should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 16)

The Secretary of Treasury should take steps to review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 17)

The Secretary of Veterans Affairs should take steps review the assignment of the “000” code to any positions in the department in the 2210 IT management occupational series and assign the appropriate NICE work role codes. (Recommendation 18)

The Administrator of the Environmental Protection Agency should complete the identification and coding of vacant positions in the agency performing IT, cybersecurity, or cyber-related functions. (Recommendation 19)

The Administrator of the Environmental Protection Agency should take steps to review the assignment of the “000” code to any positions in the agency in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 20)

The Administrator of the General Services Administration should complete the identification and coding of vacant positions at GSA performing IT, cybersecurity, or cyber-related functions. (Recommendation 21)

The Administrator of the General Services Administration should take steps to review the assignment of the “000” code to any positions at GSA in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 22)

The Administrator of the National Aeronautics and Space Administration should complete the identification and coding of vacant positions at NASA performing IT, cybersecurity, or cyber-related functions. (Recommendation 23)

The Administrator of the National Aeronautics and Space Administration should take steps to review the assignment of the “000” code to any positions at NASA in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 24)

The Chairman of the Nuclear Regulatory Commission should take steps to review the assignment of the “000” code to any positions at NRC in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 25)

The Director of the Office of Personnel Management should take steps to review the assignment of the “000” code to any positions at OPM in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 26)

The Administrator of the Small Business Administration should take steps to review the assignment of the “000” code to any positions at SBA in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 27)

The Commissioner of the Social Security Administration should take steps to review the assignment of the “000” code to any positions at SSA in the 2210 IT management occupational series and assign the appropriate NICE framework work role codes. (Recommendation 28)

Agency Comments and Our Evaluation

We provided a draft of this report to the 24 CFO Act agencies and OMB for their review and comment. Of the 22 agencies to which we made recommendations, 20 agencies stated that they agreed with the recommendations directed to them; one agency partially agreed with the recommendation; and one agency agreed with one recommendation but did not agree with one recommendation.

In addition, of the two agencies to which we did not make recommendations, one agency acknowledged its review of the report but did not otherwise provide comments; the other agency provided technical comments, which we incorporated into the report as appropriate. We also received technical comments from three of the agencies to which we made recommendations, and incorporated them into the report as appropriate. Further, OMB responded that it had no comments on the report.

The following 20 agencies agreed with the recommendations in our report: In comments provided via email on February 19, 2019, the Director of Strategic Planning, Policy, E-government and Audits in Agriculture’s Office of the Chief Information Officer stated that the department concurred with the recommendation in our report.

In written comments (reprinted in appendix V), Commerce agreed with our recommendation and stated that it would ensure the proper coding of 2210 IT management occupational series positions with the appropriate NICE framework work role codes.

In written comments (reprinted in appendix VI), DOD concurred with our two recommendations. With regard to our recommendation that it complete the identification and coding of vacant positions performing IT, cybersecurity, or cyber-related functions, the department stated that its longer-term initiative is to code positions, including vacant positions, in DOD’s manpower requirements systems to provide true gap analysis capabilities. Regarding our recommendation that it review the assignment of “000” codes, the department stated that it would continue efforts to remediate erroneously coded positions.

In written comments (reprinted in appendix VII), Education concurred with our recommendation. The department stated that its Office of Human Resources would continue to review the 2210 IT positions and ensure the assignment of appropriate work role codes.

In written comments (reprinted in appendix VIII), Energy concurred with our two recommendations. Regarding our recommendation that it complete the identification and coding of vacant IT, cybersecurity, and cyber-related positions, the department stated that it had instituted procedures to review and code vacant positions.

Regarding our recommendation that it review the assignment of “000” codes, the department said that it had ensured that all 2210 IT management positions were assigned the appropriate work role codes by April 2018. However, our review of the May 2018 data from OPM’s Enterprise Human Resources Integration System found that Energy had assigned the “000” code to about 16 percent of its 2210 IT management positions. Further, along with its comments on the draft report, in January 2019, the department provided a report indicating that Energy had not assigned the “000” work role code to its positions in the 2210 IT management occupation series. We plan to take follow- up steps to verify the completeness of the department’s actions.

In addition to the aforementioned comments, Energy provided technical comments, which we have incorporated into this report, as appropriate.

In written comments (reprint in appendix IX), HHS concurred with our recommendation and outlined steps to identify, review, and make necessary corrections to its 2210 IT management positions that were coded as “000.”

In written comments (reprinted in appendix X), DHS concurred with our recommendation. The department stated that personnel in its Office of the Chief Human Capital Officer had established processes for periodically reviewing cybersecurity workforce coding data and for collaborating with components to ensure positions with significant responsibilities associated with the NICE framework—including 2210 positions—were properly coded.

Nevertheless, DHS expressed concern with our finding that it had miscategorized the work roles for some positions. The department stated that its position descriptions are often written in a generalized format, and are static, baseline, point-in-time documents. The department added that, several positions may align with the same position description, yet have specific duties and content captured in other human capital documents such as employee performance plans. Thus, some positions may have the same position description yet require different cybersecurity codes.

While we agree that position descriptions do not detail every possible activity, according to OPM, the position descriptions should document the major duties and responsibilities of a position. However, we found that DHS did not always assign codes consistent with major duties and responsibilities described in the position descriptions. For example, the department assigned a Network Operational Specialist code to a position with major duties associated with a Cyber Instructional Curriculum Developer. The department did not provide evidence that the positions we evaluated as inconsistently coded were accurately coded. If work role codes are not consistent with position descriptions, DHS may not have reliable information to form a basis for effectively examining its cybersecurity workforce, improving workforce planning, and identifying its workforce roles of critical need.

The department also provided technical comments, which we have incorporated into this report as appropriate.

In comments provided via email on February 14, 2019, an audit liaison officer in HUD’s Office of the Chief Human Capital Officer stated that the department agreed with our recommendation.

In written comments (reprinted in appendix XI), Interior concurred with our recommendation and stated that it had taken steps to change the designation of the “000” code for the remaining personnel in the 2210 IT management occupational series.

In comments provided via email on February 4, 2019, an audit liaison specialist in Justice’s Management Division stated that the department concurred with the two recommendations.

In written comments (reprinted in appendix XII), Labor concurred with our recommendation and stated that it had taken steps to review and code the department’s 2210 IT positions using the NICE framework.

In written comments (reprinted in appendix XIII), State concurred with our recommendation. The department said that it will conduct a comprehensive review of its 2210 positions and include instructions to change the coding of any such positions that have been assigned a “000” code. In addition, the department stated that it had created a new business rule in its human resources system to ensure that 2210 positions are assigned a primary work role code.

In comments provided via email on December 20, 2018, an audit relations analyst in Transportation’s Office of the Secretary stated via email that the department concurred with our findings and recommendation.

In written comments (reprinted in appendix XIV), VA concurred with our recommendation and stated that the department had begun conducting a review of its cyber coding.

In written comments (reprinted in appendix XV), EPA concurred with our two recommendations to the agency. With regard to our recommendation that it complete the identification and coding of vacant positions performing IT cybersecurity or cyber-related functions, EPA stated that it would update its standard operating procedures to include the requirement to code vacant positions during the position classification process. Nevertheless, while including this requirement in the procedures is an important step, it is imperative that the agency implement the procedures to ensure that its vacant positions are assigned appropriate work role codes.

With regard to our recommendation that the agency review the assignment of the “000” code to its 2210 IT management occupation series, EPA stated that it would review all such positions and assign the appropriate NICE framework codes to any positions that were erroneously coded with the non-IT work role code.

In comments provided via email on January 31, 2019, the Director of the Human Capital Policy and Programs Division stated that GSA agreed with our two recommendations. Also, in written comments (reprinted in appendix XVI), GSA stated that, once it completes the ongoing transition to a position-based human resources system, it will explore options to include vacant positions in its new system. In addition, GSA stated that it had completed an initial review of cyber codes and indicated that it would update all coding by March 2019.

In written comments (reprinted in appendix XVII), NRC agreed with the findings in our draft report and said it had taken actions to address our recommendation by assigning appropriate work role codes to IT management positions previously assigned a “000” code.

In written comments (reprinted in appendix XVIII), OPM concurred with our recommendation to the agency. OPM stated that its human resources and subject matter experts plan to assess the assignment of “000” codes to personnel in the 2210 IT management occupation series to help ensure accurate coding and appropriate application of the NICE framework work role codes.

In written comments (reprinted in appendix XIX), SBA concurred with our recommendation. The agency stated that its Office of the Chief Information Officer, Office of Human Resources Solutions, and appropriate program offices would review the assignment of the “000” code to any 2210 IT management occupation series positions and assign the appropriate NICE framework role codes. The agency also provided technical comments, which we have incorporated into this report as appropriate.

In written comments (reprinted in appendix XX), SSA agreed with our recommendation and stated that it had taken steps to complete the assignment of codes to the remaining 2210 IT management positions.

In addition, one agency partially agreed with the recommendations in our report. In comments provided via email on February 15, 2019, the Acting Director for Treasury’s Office of Human Capital Strategic Management stated that the department partially concurred with our recommendation that it review the assignment of “000” codes. According to the Acting Director, the Deputy Assistant Secretary for Human Resources and Chief Human Capital Officer had issued guidance to all Treasury Bureaus to validate the coding of 2210 IT management positions.

However, Treasury did not agree with our finding that positions in the area of cryptographic key management could be aligned to the NICE framework work role code for the Communications Security Manager. The official stated that the cryptographic key management functions did not completely align with any of the NICE framework work roles.

We acknowledge that there may be positions that do not completely align with work roles described in the NICE framework. However, according to OPM, the framework currently covers a broad array of functions that describe the majority of IT, cybersecurity, and cyber-related work. As noted in our report, OPM officials told us that they would expect agencies to assign a NICE work role code to 2210 IT management positions, with a few exceptions, such as in cases where a position’s duties did not align with a NICE work role code. As such, we maintain that Treasury likely miscategorized over 1,300 IT management positions by assigning a “000” code to them, designating those positions as not performing IT, cybersecurity, or cyber-related work and, thus, should review these positions and assign the appropriate work role codes.

Further, one agency did not agree with one of the two recommendations directed to it. Specifically, in written comments (reproduced in appendix XXI) NASA stated that it concurred with our recommendation to review the assignment of “000” codes to 2210 IT management positions. In this regard, the agency stated that it would complete a review of the assignment of “000” codes to 2210 IT management positions and assign the appropriate NICE framework work role codes.

NASA did not concur with our other recommendation to complete the identification and coding of vacant positions performing IT, cybersecurity, or cyber-related functions. The agency stated that it had met the intention of the recommendation with existing NASA processes that assign a code at the time a vacancy is identified. However, the agency’s workforce planning process is decentralized and the agency previously noted that it did not track vacancies.

We maintain that the Federal Cybersecurity Workforce Assessment Act requires agencies to identify and code vacant positions and that NASA could compile necessary information from components to identify and code vacant IT, cybersecurity, and cyber-related positions. These efforts would provide important information about vacant IT, cybersecurity, and cyber-related positions across the agency to enhance NASA’s workforce planning. Thus, we continue to believe that our recommendation is warranted.

In addition, of the two agencies to which we did not make recommendations, one agency—USAID—provided a letter (reprinted in appendix XXII) acknowledging its review of the report and the other agency—NSF—provided technical comments, which we have incorporated into the report as appropriate.

We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, the secretaries and agency heads of the departments and agencies addressed in this report, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix XXIII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the extent to which federal agencies have assigned work role codes to positions performing information technology (IT), cybersecurity, or cyber-related functions, and (2) describe the steps federal agencies took to identify work roles of critical need. The scope of our review included the 24 major departments and agencies covered by the Chief Financial Officers (CFO) Act of 1990.

To address our objectives, we reviewed the provisions of the Federal Cybersecurity Workforce Assessment Act of 2015 and assessed the workforce planning actions taken by the Office of Personnel Management (OPM) and the other 23 CFO Act agencies against the selected four activities required by the act.

To evaluate the four selected activities of the act and objectives 1 and 2, we reviewed the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework and OPM’s cybersecurity coding structure and guidance. The guidance provided information on how agencies should identify and assign work role codes to IT, cybersecurity, and cyber-related positions. We also designed and administered a questionnaire to each of the 24 agencies regarding their efforts to identify and assign work role codes to IT, cybersecurity, or cyber-related positions, and identify work roles of critical need. In developing the questionnaire, we took steps to ensure the accuracy and reliability of responses. We pre-tested the questionnaire with OPM and the Department of Homeland Security (DHS) officials to ensure that the questions were clear, comprehensive, and unbiased, and to minimize the burden the questionnaire placed on respondents. We also asked the chief information officer and the chief human capital officer of each agency to certify that they reviewed and validated the responses to the questionnaires.

We administered the questionnaire between June and October 2018. We received completed questionnaires from each of the 24 agencies, for a response rate of 100 percent. We examined the questionnaire results and performed computer analyses to identify missing data, inconsistencies, and other indications of error, and addressed such issues as necessary, including through follow-up communications with the 24 agencies. We reviewed and analyzed the agencies’ responses to the questionnaire in comparison to the act’s requirements and OPM’s and NICE’s guidance. We also obtained, reviewed, and analyzed supporting documentation of questionnaire responses, such as reports of cybersecurity employment code data, to assess whether agencies assigned work role codes in accordance with the activities in OPM’s coding guidance, by April 2018.

Further, to analyze how federal agencies assigned work role codes to positions performing IT, cybersecurity, or cyber-related functions, we obtained IT, cybersecurity, or cyber-related workforce coding data for the 24 agencies from OPM’s Enterprise Human Resources Integration system. To assess the reliability of coding data from OPM’s system, we reviewed these data to determine its completeness, and asked officials responsible for entering and reviewing the work role coding data a series of questions about the accuracy and reliability of the data. In addition, we examined the Enterprise Human Resources Integration IT, cybersecurity, or cyber-related coding data to determine the number of positions the 24 agencies had assigned the “000” code to positions in the 2210 IT management occupational series as of May 2018. We reviewed positions from the 2210 IT management occupational series because those positions are likely to perform IT, cybersecurity, or cyber-related functions. In the report, we note some challenges with the reliability of these data and are careful to present our data in line with these limitations.

We then identified a subset of the 24 agencies and performed an additional review of these agencies’ work role coding efforts. We selected these agencies based on their total cybersecurity spending for fiscal year 2016, as reported by the Office of Management and Budget (OMB) in its Federal Information Security Modernization Act annual report. We sorted the 24 agencies’ IT cybersecurity spending from highest to lowest and then divided them into three equal groups of high, medium, and low. We then selected the top two agencies from each group. Based on these factors, we selected six agencies: the (1) Department of Defense (DOD), (2) DHS, (3) Department of State (State), (4) National Aeronautics and Space Administration (NASA), (5) Environmental Protection Agency (EPA), and (6) General Services Administration (GSA).We performed an additional review of the agencies’ work role coding efforts. We did this by evaluating the six selected agencies’ coding processes against their established procedures and OPM requirements. We also obtained and reviewed coding data that included the assigned work role codes for civilian employees from each agency’s human resources system.

To assess the reliability of coding data from the selected six agencies’ systems, we reviewed related documentation such as the agencies’ coding procedures, processing guides, personnel bulletins, and system screen shots. We also conducted electronic testing for missing data, duplicate data, or obvious errors. In addition, we asked officials responsible for entering and reviewing the work role coding data a series of questions about the accuracy and reliability of the data. For any anomalies in the data, we followed up with the six selected agencies’ offices of the chief information officer and chief human capital officer to either understand or correct those anomalies. Further, we assessed the reliability of data in terms of the extent to which codes were completely assigned and reasonably accurate. In the report, we note some challenges with the reliability of these data and are careful to present our data in line with these limitations.

We randomly selected a sample of 20 positions from each of the six selected agencies (120 total positions) within the 2210 IT management occupational series. We reviewed positions from the IT management 2210 series because those positions are likely to perform IT, cybersecurity, or cyber-related functions. For the selected positions, we requested position descriptions and reviewed whether the position work role codes in the coding data were consistent with the corresponding position description text. We also selected a second nonstatistical sample of 12 positions for each of the six agencies (72 total positions) from the 2210 IT management occupational series based on pairs of positions that had identical position titles, occupational series, and sub-agencies, but for which the agencies had assigned different work role codes for the positions. An analyst reviewed the work role coding data and compared them to the duties described by the position descriptions to determine whether they were consistent with the position duties. A second analyst verified whether or not the position’s work role code was consistent with the position description. A third analyst adjudicated cases in which the first and second analysts’ evaluations did not match.

Lastly, to evaluate agencies’ actions to address the last three activities of the act related to the identification of cybersecurity work roles of critical need, we obtained, reviewed, and analyzed OPM’s guidance for identifying critical needs and its progress report to Congress by comparing it to the act’s requirements. We reviewed agencies’ responses to our questionnaire regarding whether they had developed methodologies or project plans for identifying critical needs. We also reviewed any available documentation on the 24 agencies’ progress in identifying critical needs, such as project plans, timelines, and preliminary reports. In addition, OPM required agencies to submit a preliminary report on work roles of critical need by August 31, 2018. We obtained copies of the preliminary reports from the 24 agencies. We evaluated agencies’ efforts to meet the deadline, as well as for meeting OPM’s requirements for documenting work roles of critical need and determining root causes of those needs.

To supplement our analysis, we interviewed agency officials from human resources and chief information officer offices at the 24 agencies regarding their progress in coding and identifying cybersecurity work roles of critical need.

We conducted this performance audit from February 2018 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Office of Personnel Management Information Technology, Cybersecurity, and Cyber-related Work Role Codes

Appendix III: Summary of 24 Chief Financial Officers Act Agencies’ Implementation of the Federal Cybersecurity Workforce Assessment Act of 2015, as of Nov. 2018

Appendix IV: Top 12 Work Roles of Critical Need as Identified by the 24 Chief Financial Officers (CFO) Act Agencies in Their Preliminary Reports of Critical Need

Appendix V: Comments from the Department of Commerce

Appendix VI: Comments from the Department of Defense

Appendix VII: Comments from the Department of Education

Appendix VIII: Comments from the Department of Energy

Appendix IX: Comments from the Department of Health and Human Services

Appendix X: Comments from the Department of Homeland Security

Appendix XI: Comments from the Department of the Interior

Appendix XII: Comments from the Department of Labor

Appendix XIII: Comments from the Department of State

Appendix XIV: Comments from the Department of Veterans Affairs

Appendix XV: Comments from the Environmental Protection Agency

Appendix XVI: Comments from the General Services Administration

Appendix XVII: Comments from the Nuclear Regulatory Commission

Appendix XVIII: Comments from the Office of Personnel Management

Appendix XIX: Comments from the Small Business Administration

Appendix XX: Comments from the Social Security Administration

Appendix XXI: Comments from the National Aeronautics and Space Administration

Appendix XXII: Comments from the United States Agency for International Development

Appendix XXIII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Tammi Kalugdan (Assistant Director), Merry Woo (Analyst-in-Charge), Carlos (Steven) Aguilar, Alexander Anderegg, Christina Bixby, Carl Barden, Chris Businsky, Virginia Chanley, Cynthia Grant, Paris Hawkins, Lee Hinga, James (Andrew) Howard, Assia Khadri, David Plocher, Steven Putansu, and Priscilla Smith made significant contributions to this report.