DHS has responsibility for protecting unclassified federal civilian systems and networks and assisting agencies in responding to cyber threats and attacks. Executive Branch Efforts to Define and Identify the Federal Cybersecurity Workforce

The executive branch has several initiatives to define and identify the federal cybersecurity workforce: (1) the national cybersecurity workforce framework, (2) cybersecurity data codes, and (3) a federal cybersecurity workforce dataset. All agencies—identify their top five cyber talent gaps using OPM's cybersecurity dataset. Selected Hiring and Pay Flexibilities Applicable to DOD and DHS Cybersecurity Positions

Congress has authorized hiring and pay flexibilities for DOD and DHS to enhance the recruitment and retention of cybersecurity professionals. In many cases, these incentives can be given to all federal employees. If such interest continues, Congress could enhance its oversight of these efforts to increase its awareness and knowledge of their implementation. OPM, however, is not currently required to report on its progress in identifying and coding all federal cybersecurity positions to Congress, nor has it released its cybersecurity dataset or a government-wide count of the cybersecurity workforce to Congress. Further, OMB's CSIP does not require agencies to report identified skills gaps in their cybersecurity workforces to Congress. Congressional knowledge of the progress of these evolving efforts, therefore, might be limited or incomplete, which might make it difficult for Congress to (1) identify potential conflicting efforts between OMB, OPM, and Congress in assessing the capabilities of the federal cybersecurity workforce, and (2) gauge the utility of hiring and pay flexibilities for cybersecurity positions. OPM is also required under P.L. This discretion can create the potential for discrepancies between the intended and actual use of the flexibilities. Lack of Data on Use of Certain Cybersecurity Hiring Flexibilities at DOD and DHS

The law for DOD intelligence positions, and the OPM-issued hiring flexibilities for certain DOD and DHS cybersecurity positions, do not require the departments to report, among other things, (1) the total number of employees hired using the flexibilities, (2) the specific types of positions filled through the flexibilities, or (3) in which components the positions are located. Training on Structure and Use of Flexibilities

The laws governing flexibilities for DOD intelligence, DHS cybersecurity, and DOD cybersecurity positions at the U.S. Cyber Command do not include provisions to require human resources staff (including component-level hiring managers and department-level staff in the Office of the Chief Human Capital Officer) to receive training on the availability, structure, and operation of cybersecurity hiring and pay flexibilities. In its oversight capacity, Congress could additionally direct GAO to study the operation and effectiveness of the OPM cybersecurity dataset one year after it becomes operational. 4. Report on the Effectiveness of Hiring and Pay Flexibilities

The Inspectors General at DOD and DHS could be required to report on how effective the hiring and pay flexibilities authorized through statute—and the specific features—have been in recruiting and retaining qualified cybersecurity professionals.
The federal cybersecurity workforce is responsible for protecting U.S. government systems and networks against cyber threats and attacks. Federal agencies, however, have reported difficulty in assessing the size and capabilities of their cybersecurity workforces. DOD and DHS, which play prominent roles in the nation's cybersecurity posture, have also noted certain obstacles affecting the recruitment and retention of qualified cybersecurity professionals to fulfill their departments' cybersecurity missions.
The Office of Personnel Management (OPM) is constructing a dataset to catalog all federal cybersecurity positions in the executive branch. The dataset had not been released to Congress or the public. In addition, the Office of Management and Budget (OMB) directed agencies to identify their top five cyber talent gaps by December 31, 2015. Congress has also authorized hiring and pay flexibilities that can be used to fill cybersecurity positions at DOD and DHS. The flexibilities aim to enhance the recruitment and retention of cybersecurity professionals by expediting the federal hiring process and providing such professionals with monetary incentives that are not available to all federal employees. OPM has also established temporary hiring flexibilities for certain DOD and DHS cybersecurity positions.
Congress, pursuant to its oversight authority, might seek to increase its awareness and knowledge of these initiatives. OPM is not required to report to Congress on agencies' progress in coding their federal cybersecurity positions or in completing the agency's cybersecurity dataset. Further, DOD and DHS are not required to report on the use or effectiveness of certain hiring and pay flexibilities for cybersecurity positions. Congress may find it difficult to identify potential implementation issues, such as (1) conflicting efforts to define and identify the federal cybersecurity workforce, (2) discrepancies between the intended and actual use of hiring and pay flexibilities, and (3) measuring the overall effectiveness of the flexibilities.
Congress could consider enhancing its oversight of executive branch initiatives to define and identify federal cybersecurity positions by (1) requiring OPM to notify Congress of its progress on completing the cybersecurity dataset, and (2) directing the Government Accountability Office (GAO) to evaluate the operation and effectiveness of the cybersecurity workforce dataset upon its completion. Congress could also enhance its oversight of the implementation of hiring and pay flexibilities for DOD and DHS by (1) conforming reporting requirements among the three laws governing hiring and pay flexibilities, (2) requiring additional reporting on the use of certain flexibilities, (3) directing DOD and DHS, or GAO, to evaluate the effectiveness of the hiring and pay flexibilities, and (4) requiring DOD and DHS human resources staff to receive training on the structure and operation of the flexibilities.