The Federal Cybersecurity Workforce: Background and Congressional Oversight Issues for the Departments of Defense and Homeland Security

Summary

The federal cybersecurity workforce is responsible for protecting U.S. government systems and networks against cyber threats and attacks. Federal agencies, however, have reported difficulty in assessing the size and capabilities of their cybersecurity workforces. DOD and DHS, which play prominent roles in the nation’s cybersecurity posture, have also noted certain obstacles affecting the recruitment and retention of qualified cybersecurity professionals to fulfill their departments’ cybersecurity missions.

The Office of Personnel Management (OPM) is constructing a dataset to catalog all federal cybersecurity positions in the executive branch. The dataset had not been released to Congress or the public. In addition, the Office of Management and Budget (OMB) directed agencies to identify their top five cyber talent gaps by December 31, 2015. Congress has also authorized hiring and pay flexibilities that can be used to fill cybersecurity positions at DOD and DHS. The flexibilities aim to enhance the recruitment and retention of cybersecurity professionals by expediting the federal hiring process and providing such professionals with monetary incentives that are not available to all federal employees. OPM has also established temporary hiring flexibilities for certain DOD and DHS cybersecurity positions.

Congress, pursuant to its oversight authority, might seek to increase its awareness and knowledge of these initiatives. OPM is not required to report to Congress on agencies’ progress in coding their federal cybersecurity positions or in completing the agency’s cybersecurity dataset. Further, DOD and DHS are not required to report on the use or effectiveness of certain hiring and pay flexibilities for cybersecurity positions. Congress may find it difficult to identify potential implementation issues, such as (1) conflicting efforts to define and identify the federal cybersecurity workforce, (2) discrepancies between the intended and actual use of hiring and pay flexibilities, and (3) measuring the overall effectiveness of the flexibilities.

Congress could consider enhancing its oversight of executive branch initiatives to define and identify federal cybersecurity positions by (1) requiring OPM to notify Congress of its progress on completing the cybersecurity dataset, and (2) directing the Government Accountability Office (GAO) to evaluate the operation and effectiveness of the cybersecurity workforce dataset upon its completion. Congress could also enhance its oversight of the implementation of hiring and pay flexibilities for DOD and DHS by (1) conforming reporting requirements among the three laws governing hiring and pay flexibilities, (2) requiring additional reporting on the use of certain flexibilities, (3) directing DOD and DHS, or GAO, to evaluate the effectiveness of the hiring and pay flexibilities, and (4) requiring DOD and DHS human resources staff to receive training on the structure and operation of the flexibilities.