DHS Is Required to Assess Its Cybersecurity Workforce

The Homeland Security Cybersecurity Workforce Assessment Act of  2014 required DHS to perform workforce assessment-related activities to  identify and assign employment codes to its cybersecurity positions. Establish procedures for identifying and categorizing cybersecurity  positions and assigning codes to positions (within 90 days of law’s  enactment). Within DHS, OCHCO is responsible for carrying out these provisions,  including the coordination of the department’s overall efforts to identify,  categorize, code, and report its cybersecurity workforce assessment  progress to OPM and Congress. DHS Has Not Fully Identified Cybersecurity Positions or Assigned Employment Codes in a Complete and Reliable Manner

The act required DHS to establish procedures to identify and assign the  appropriate employment code, in accordance with OPM’s Guide to Data  Standards, to all filled and vacant positions with cybersecurity functions  by March 2015. DHS Has Not Completely and Accurately Assigned Employment Codes

The act also required DHS to assign 2-digit employment codes to all of its  identified cybersecurity positions. Although,  in August 2017, OPM provided a progress report to Congress containing  DHS data which stated that 95 percent of DHS-identified cybersecurity  positions had been coded, our analysis determined that the department  had assigned cybersecurity position codes to approximately 79 percent of  its identified federal civilian cybersecurity positions. The primary reason  for this discrepancy was that DHS did not include the coding of vacant  positions, as required by the act. Without coding cybersecurity positions in a complete and accurate  manner, DHS will not be able to effectively examine its cybersecurity  workforce; identify skill gaps; and improve workforce planning. DHS Has Not Identified or Reported Its Cybersecurity Workforce Areas of Critical Need

According to the act, DHS was to identify its cybersecurity work  categories and specialty areas of critical need in alignment with the NICE  framework and to report this information to the appropriate congressional  committees by June 2016. As of February 2018, the department had not fulfilled its requirements to  identify and report its critical needs. Until DHS develops plans and  schedules with time frames for reporting its cybersecurity critical needs,  DHS may not have insight into its needs for ensuring that it has the  workforce necessary to carry out its critical role of helping to secure the  nation’s cyberspace. In our report, we recommended that DHS 1) develop guidance to assist  DHS components in identifying their cybersecurity work categories and  specialty areas of critical need that align to the NICE framework and 2)  develop plans with time frames to identify priority actions to report on  specialty areas of critical need. DHS concurred with the  recommendations and stated that it plans to implement them by June  2018. In summary, DHS needs to act now to completely and accurately identify,  categorize, and assign codes to all of its cybersecurity positions, and to  identify and report on its cybersecurity workforce areas of critical need. Implementing the six recommendations we made in our February 2018  report should better position the department to meet the requirements of  the 2014 act. Until DHS implements our recommendations, it  will not be able to ensure that it has the necessary cybersecurity  personnel to help protect the department’s and federal networks and the  nation’s critical infrastructure from cyber threats.
Why GAO Did This Study

DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs.
GAO was asked to testify on the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. To do so, GAO summarized the findings discussed in its February 2018 report on DHS's cybersecurity workforce ( GAO-18-175 ).

What GAO Found

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS did not complete efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions.
In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to Congress on its departmentwide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table).
Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its cybersecurity positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.

What GAO Recommends

In its February 2018 report, GAO recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed. DHS concurred with the six recommendations and described actions the department plans to take to address them.