Cybersecurity refers to a broad set of concepts for which there is no standard definition—it often varies by the entity employing it. DHS, for example, has defined cybersecurity as "the activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation." The Committee on National Security Systems has defined a "cyber attack" as An attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information. Strengthening federal cybersecurity has been a priority for Congress and the executive branch for several years. The focus on cybersecurity has increased since the Office of Personnel Management (OPM) data intrusion was revealed in June 2015, which heightened concerns about vulnerabilities within the government's systems and networks. All federal agencies have responsibilities for protecting their individual systems and networks under federal law. Some agencies, such as DHS and DOD, possess broader cybersecurity roles compared to other agencies. DHS has responsibility for protecting unclassified federal civilian systems and networks and assisting agencies in responding to cyber threats and attacks. DHS is also the lead agency for coordinating with the private sector to protect critical cyber infrastructure assets. DOD is responsible for defending the nation against cyberattacks of "significant consequence," as well as conducting military operations in cyberspace. DOD is also responsible for assisting DHS in fulfilling its government-wide cybersecurity roles. The federal cybersecurity workforce plays an integral role in maintaining and improving the government's cybersecurity. Cybersecurity professionals are responsible for designing and building secure information networks and systems, identifying and addressing vulnerabilities within those networks and systems, and collecting and analyzing data necessary to respond to cyberattacks efficiently and effectively, among other things. Federal stakeholders and researchers have stated that robust federal cybersecurity is not possible without cybersecurity professionals. Developing and maintaining a robust federal cybersecurity workforce, however, has been an ongoing challenge. The Chief Human Capital Officers Council Working Group found skills gaps in cybersecurity positions (and other positions) government-wide, which prompted the Obama Administration to create a Cross-Agency Priority (CAP) to reduce those gaps by half by the end of FY2013. According to a January 2015 GAO report, however, efforts to close these cybersecurity gaps were at an "early stage of maturity." This report examines congressional oversight of two strategies undertaken by Congress and the executive branch to strengthen the federal cybersecurity workforce: (1) initiatives to define and identify the federal cybersecurity workforce, and (2) hiring and pay flexibilities applicable to cybersecurity positions at DOD and DHS. This report focuses on DOD and DHS because of their key roles in federal cybersecurity and because the majority of hiring and pay flexibilities for cybersecurity professionals authorized by Congress apply to DOD and DHS. Cybersecurity functions are embedded within a wide range of federal positions that span more than 100 federal occupational series (see the text box below for a definition of occupational series). The specific cybersecurity functions undertaken within an occupation series often vary by agency. For example, one DHS position in the 2210 occupation series that performs cybersecurity functions is responsible for identifying vulnerabilities and weaknesses within IT systems and developing procedures to defend against unauthorized access to the systems. A different DHS position in the 2210 occupation series that performs cybersecurity functions, in contrast, is responsible for evaluating and responding to cyber incidents. The full range of federal positions that undertake cybersecurity responsibilities is challenging to assess. Researchers have found that agencies have experienced difficulty in accurately defining and measuring their cybersecurity workforces. For example, a 2011 GAO report found wide disparities in counts of DOD cybersecurity employees—88,159 employees reported by GAO, compared to 18,955 reported by OPM. The GAO report partly attributed these inconsistent counts to the lack of a standard definition of a cybersecurity employee. Federal stakeholders and researchers have reported ongoing challenges to developing and maintaining a robust federal cybersecurity workforce. Commonly reported challenges are listed below and include government-wide and agency-specific concerns: demand outstripping supply for cybersecurity professionals in the federal government and difficulty filling vacant cybersecurity positions; skills gaps in cybersecurity positions; and agency strategic workforce plans that do not specifically address cybersecurity workforce needs. DOD and DHS have reported recruitment and retention challenges for their cybersecurity workforces, including an inadequate number of qualified cybersecurity professionals. DOD and DHS have partly attributed these challenges to the following factors: Federal hiring process – DOD noted that the length and complexity of the hiring process may deter cybersecurity professionals from pursuing federal careers. General Schedule (GS) pay system – DHS and other agencies believed that the GS system placed them at a competitive disadvantage for attracting cyber talent, noting that other agencies using non-GS systems were able to pay cybersecurity professionals higher salaries. Federal s ecurity clearance process – DOD and DHS cited the amount of time required to obtain security clearances for new employees as a barrier to filling cybersecurity positions. The executive branch has several initiatives to define and identify the federal cybersecurity workforce: (1) the national cybersecurity workforce framework, (2) cybersecurity data codes, and (3) a federal cybersecurity workforce dataset. Laws aiming to define and identify the workforce mandate the use of these initiatives. In November 2011, the National Initiative for Cybersecurity Education (NICE), within the National Institute of Standards and Technology (NIST), released the national cybersecurity workforce framework. The framework provides a consistent way to define and describe cybersecurity work at any public or private organization, including federal agencies. The framework classifies and categorizes cybersecurity work under specialty areas, which are grouped into seven categories ( Figure 1 illustrates these specialty areas and categories). Within each specialty area, the framework defines standard duties and competencies for cybersecurity professionals, as well as job titles that typically involve such duties. In October 2012, OPM, in coordination with NIST, published a coding structure for federal cybersecurity positions based on the national cybersecurity workforce framework. The structure assigns unique numeric codes to each of the seven categories and specialty areas within the framework and three new categories not included in the framework: (1) Cybersecurity Program/Project Management; (2) Cybersecurity Supervision, Management, and Leadership; and (3) Not Applicable. The codes are intended to allow OPM and agencies to identify and categorize all federal cybersecurity positions, thereby laying the groundwork for a consistent government-wide count of the federal cybersecurity workforce. In June 2013, OPM launched an initiative to build and use a comprehensive dataset of existing and future executive branch cybersecurity positions. The initiative, known as the Special Cybersecurity Workforce Project, was created to support the FY2013 Cross-Agency Priority (CAP) goal to close cybersecurity workforce skills gaps. The project includes three phases: 1. build a dataset of all federal cybersecurity positions, 2. assess the accuracy of data contained therein, and 3. use the dataset to identify and address needs of the federal cybersecurity workforce. To support construction of the dataset, OPM directed agencies to assign OPM cybersecurity data codes to their positions. As of November 2015, roughly 95% of all federal positions (not just cybersecurity positions), and 96% of positions in the 2210 occupation series, had been assigned an OPM cybersecurity data code. The OPM dataset, as well as a government-wide count of the federal cybersecurity workforce, however, has not been released to the public. OPM staff did not indicate when the dataset would be available on OPM's online workforce data portal, noting that the release date will depend on the accuracy of the data. On October 30, 2015, OMB issued the Cybersecurity Strategy and Implementation Plan (CSIP). The CSIP directs agencies to, among other things, complete the following activities to identify skills gaps in the federal cybersecurity workforce: 1. All agencies—identify their top five cyber talent gaps using OPM's cybersecurity dataset. 2. OPM, DHS, and OMB—issue a report that maps "the entire cyber workforce landscape across all agencies using the NICE national cybersecurity workforce framework and identify cyber talent gaps and recommendations for closing them." Figure 2 , below, includes key activities for OPM's cybersecurity dataset initiative and related CSIP activities. OPM has completed Phase 1, anticipates completing Phase 2 by March 31, 2016, and anticipates beginning Phase 3 during the "latter part of FY2016." These CSIP activities may accelerate planned implementation of Phase 3, as they require agencies to use the dataset for workforce planning purposes. Two laws include provisions that aim to define and identify federal cybersecurity positions: 1. The Border Patrol Pay Agent Reform Act of 2013 ( P.L. 113-277 ) 2. The Consolidated Appropriations Act, 2016 ( P.L. 114-113 ) The laws codify, and in some ways enhance, OPM's ongoing efforts to define and code federal cybersecurity positions since 2013. The laws also enhance OMB's efforts to assess agencies' cybersecurity workforce capabilities. Broadly, the laws require all agencies to (1) assign data codes to all cybersecurity positions according to the national cybersecurity workforce framework; (2) conduct critical needs assessments for identified cyber positions; and (3) submit progress reports on completing these tasks. Table 1 , below, compares efforts to define, identify, and assess federal cybersecurity positions between the laws and the OPM/OMB directives described above. Congress has authorized hiring and pay flexibilities for DOD and DHS to enhance the recruitment and retention of cybersecurity professionals. OPM has also provided similar, but distinct, hiring flexibilities for certain DOD and DHS cybersecurity positions.