The information systems and networks that  support federal operations are highly complex and dynamic,  technologically diverse, and often geographically dispersed. Agencies Face Key Challenges in Ensuring an Effective Cybersecurity Workforce

We and others have identified a number of key challenges federal  agencies are facing to ensure that they have a sufficient cybersecurity  workforce with the skills necessary to protect their information and  networks from cyber threats. These challenges pertain to identifying and  closing skill gaps as part of a comprehensive workforce planning process,  recruiting and retaining qualified staff, and navigating the federal hiring  process. For example:  In November 2011, we reported that eight federal agencies had  identified challenges in their workforce planning efforts. These recommendations have not yet been implemented. In an April 2015 report, the Partnership for Public Service noted a  continuing need for the government to develop an understanding of  the size and skills of the current cybersecurity workforce; project the  government’s future cybersecurity human capital needs; assess  qualitative and quantitative gaps between the current workforce and  the workforce needed to address future challenges; and develop  strategies, as well as program and policy goals, designed to close  those gaps. However, we and others have found that agencies have faced persistent  challenges in recruiting and retaining well-qualified cybersecurity talent:  In November 2011, we reported that the quality of cybersecurity  training and development programs varied significantly across the  eight agencies in our review. In August 2016, we reported the results of our review of the current  authorities of agency chief information security officers (CISO). In August 2016, we issued a report on the extent to which federal  hiring authorities were meeting agency needs. As noted previously, we have identified both information security and  strategic human capital management as government-wide high-risk  areas. To address these high-risk areas, agencies need to take focused,  concerted action, including implementing our outstanding  recommendations, which can help mitigate the challenges associated  with developing an effective cybersecurity workforce. Federal Cybersecurity Workforce Strategy: As called for by the  CSIP, OMB and OPM issued the Federal Cybersecurity Workforce  Strategy in July 2016, detailing government-wide actions to identify,  expand, recruit, develop, retain, and sustain a capable and competent  workforce in key functional areas to address complex and ever- evolving cyber threats. Recent Laws Address Cybersecurity Workforce Issues

In addition to the aforementioned executive-level initiatives, several  recently enacted federal laws include provisions aimed at improving the  federal cybersecurity workforce. The Federal Cybersecurity Workforce Assessment Act of 2015  assigns specific workforce planning-related actions to federal  agencies. Other Ongoing Activities Could Assist Agencies in Recruiting and Retaining Cybersecurity Professionals

Beyond the government-wide initiatives and recently enacted legislation  discussed previously, federal agencies have instituted other ongoing  activities that may assist the federal government in enhancing its  cybersecurity workforce. These include the following, among others:
Promoting cyber and science, technology, engineering and  mathematics (STEM) education: A recent presidential commission  on cybersecurity highlighted the need for federal programs that  support education at all levels to incorporate cybersecurity awareness  for students as they are introduced to and provided with Internet- based devices. The curricula developed by NICERC is free to any  K-12 educator within the United States and comprises a library of  cyber-based curricula that provides opportunities for students to  become aware of cyber issues, engage in cyber education, and enter  cyber career fields. One such program—the  Scholarship for Service program operated by DHS and NSF— provides scholarships and stipends to undergraduate and graduate  students who are pursuing information security-related degrees, in  exchange for 2 years of federal service after graduation. National Initiative for Cybersecurity Careers and Studies: DHS, in  partnership with several other agencies, launched the National  Initiative for Cybersecurity Careers and Studies (NICCS) in February  2013 as an online resource to connect government employees,  students, educators, and industry with cybersecurity training providers  across the nation. The federal government  continues to be challenged in key areas—such as identifying skills gaps,  recruiting and retaining qualified staff, and navigating the federal hiring  process—that are essential to ensuring the adequacy of its cybersecurity  workforce. If effectively implemented, these initiatives, laws, and activities could help  establish the cybersecurity workforce needed to secure and protect  federal IT systems.
Why GAO Did This Study

The federal government faces an ever-evolving array of cyber-based threats to its systems and information. Further, federal systems and networks are inherently at risk because of their complexity, technological diversity, and geographic dispersion, among other reasons. GAO has designated the protection of federal information systems as a government-wide high-risk area since 1997. In 2001, GAO introduced strategic government-wide human capital management as another area of high risk. A key component of the government's ability to mitigate and respond to cyber threats is having a qualified, well-trained cybersecurity workforce. However, shortages in qualified cybersecurity professionals have been identified, which can hinder the government's ability to ensure an effective workforce.
This statement discusses challenges agencies face in ensuring an effective cybersecurity workforce, recent initiatives aimed at improving the federal cyber workforce, and ongoing activities that could assist in recruiting and retaining cybersecurity professionals. In preparing this statement, GAO relied on published work related to federal cybersecurity workforce efforts, and information reported by other federal and non-federal entities focusing on cybersecurity workforce challenges.

What GAO Found

GAO and others have identified a number of key challenges facing federal agencies in ensuring that they have an effective cybersecurity workforce:
Identifying skills gaps: As GAO reported in 2011, 2015, and 2016, federal agencies have faced challenges in effectively implementing workforce planning processes for information technology (IT) and defining cybersecurity staffing needs. GAO also reported that the Office of Personnel Management (OPM) could improve its efforts to close government-wide skills gaps.
Recruiting and retaining qualified staff: Federal agencies continue to be challenged in recruiting and retaining qualified cybersecurity staff. For example, in August 2016, GAO reported that federal chief information security officers faced significant challenges in recruiting and retaining personnel with high-demand skills.
Federal hiring activities: The federal hiring process may cause agencies to lose out on qualified candidates. In August 2016 GAO reported that OPM and agencies needed to assess available federal hiring authorities to more effectively meet their workforce needs.
To address these and other challenges, several executive branch initiatives have been launched and federal laws enacted. For example, in July 2016, OPM and the Office of Management and Budget issued a strategy with goals, actions, and timelines for improving the cybersecurity workforce. In addition, laws such as the Federal Cybersecurity Workforce Assessment Act of 2015 require agencies to identify IT and cyber-related positions of greatest need.
Further, other ongoing activities have the potential to assist agencies in developing, recruiting, and retaining an effective cybersecurity workforce. For example:
Promoting cyber and science, technology, engineering and mathematics (STEM) education: A center funded by the Department of Homeland Security (DHS) developed a kindergarten to 12th grade-level cyber-based curriculum that provides opportunities for students to become aware of cyber issues, engage in cyber education, and enter cyber career fields.
Cybersecurity scholarships: Programs such as Scholarship for Service provide tuition assistance to undergraduate and graduate students studying cybersecurity in exchange for a commitment to federal service.
National Initiative for Cybersecurity Careers and Studies: DHS, in partnership with several other agencies, launched the National Initiative for Cybersecurity Careers and Studies in 2013 as an online resource to connect government employees, students, educators, and industry with cybersecurity training providers across the nation.
If effectively implemented, these initiatives, laws, and activities could further agencies' efforts to establish the cybersecurity workforce needed to secure and protect federal IT systems.

What GAO Recommends

Over the past several years, GAO has made several recommendations to federal agencies to enhance their IT workforce efforts. Agencies are in various stages of implementing these recommendations.