Agencies Had Generally Assigned Work Role Codes to Positions, but Six Had Not Completely Coded Vacant Positions

To assist agencies with meeting their requirements under the Federal  Cybersecurity Workforce Assessment Act of 2015, OPM issued guidance  that directed agencies to identify filled and vacant positions with IT,  cybersecurity, or cyber-related functions and assign work role codes to  those positions using the Federal Cybersecurity Coding Structure by April  2018. However, the 24 agencies had likely miscategorized the work roles of  many positions. Collectively, the agencies assigned a “000” code to about  15,779 positions, or about 19 percent of the agencies’ 2210 IT  management positions. Agencies Assigned Work Role Codes to Sample Positions That Were Inconsistent with Duties Described In Corresponding Position Descriptions

Similar to the work role data reported in OPM’s Enterprise Human  Resources Integration system, the six agencies that we selected for  additional review had assigned work role codes to positions in their  human resources systems that were not consistent with the duties  described in their corresponding position descriptions. Information Resource Management officials at State said that their  system did not require all IT positions to have a work role code. Officials stated  that first-line supervisors may have assigned different codes for  similar positions because they interpreted OPM guidance and work  roles differently. By assigning work role codes that are inconsistent with the IT,  cybersecurity, and cyber-related functions performed by positions, the  agencies in our review are diminishing the reliability of the information  they will need to identify their workforce roles of critical need. OPM Reported on Progress of Efforts and Provided Guidance for Agencies to Identify Cybersecurity Work Roles of Critical Need

The Federal Cybersecurity Workforce Assessment Act of 2015 required  OPM, in consultation with DHS, to identify critical needs for the IT,  cybersecurity, or cyber-related workforce across federal agencies and  submit a progress report to Congress on the identification of IT,  cybersecurity, or cyber-related work roles of critical need by December  2017. OPM also required  agencies to submit a preliminary report, which included agencies’  identified work roles of critical need and the associated root causes, by  August 31, 2018. The 24 agencies have begun to identify critical needs and submitted a  preliminary report of critical needs to OPM. For example, six of the  24 agencies had not completed assigning codes to their vacant positions. Recommendations for Executive Action

We are making a total of 28 recommendations to 22 agencies to take  steps to complete the appropriate assignment of codes to their positions  performing IT, cybersecurity, or cyber-related functions, in accordance  with the requirements of the Federal Cybersecurity Workforce  Assessment Act of 2015. Of the 22 agencies to which we made  recommendations, 20 agencies stated that they agreed with the  recommendations directed to them; one agency partially agreed with the  recommendation; and one agency agreed with one recommendation but  did not agree with one recommendation. Thus, we continue to believe that our recommendation is  warranted. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the extent to which federal agencies  have assigned work role codes to positions performing information  technology (IT), cybersecurity, or cyber-related functions, and (2)  describe the steps federal agencies took to identify work roles of critical  need. We randomly selected a sample of 20 positions from each of the six  selected agencies (120 total positions) within the 2210 IT management  occupational series. Appendix II: Office of Personnel Management Information Technology, Cybersecurity, and Cyber-related Work Role Codes

Appendix III: Summary of 24 Chief Financial Officers Act Agencies’ Implementation of the Federal Cybersecurity Workforce Assessment Act of 2015, as of Nov. 2018

Appendix IV: Top 12 Work Roles of Critical Need as Identified by the 24 Chief Financial Officers (CFO) Act Agencies in Their Preliminary Reports of Critical Need

Appendix V: Comments from the Department of Commerce

Appendix VI: Comments from the Department of Defense

Appendix VII: Comments from the Department of Education

Appendix VIII: Comments from the Department of Energy

Appendix IX: Comments from the Department of Health and Human Services

Appendix X: Comments from the Department of Homeland Security

Appendix XI: Comments from the Department of the Interior

Appendix XII: Comments from the Department of Labor

Appendix XIII: Comments from the Department of State

Appendix XIV: Comments from the Department of Veterans Affairs

Appendix XV: Comments from the Environmental Protection Agency

Appendix XVI: Comments from the General Services Administration

Appendix XVII: Comments from the Nuclear Regulatory Commission

Appendix XVIII: Comments from the Office of Personnel Management

Appendix XIX: Comments from the Small Business Administration

Appendix XX: Comments from the Social Security Administration

Appendix XXI: Comments from the National Aeronautics and Space Administration

Appendix XXII: Comments from the United States Agency for International Development

Appendix XXIII: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the individual named above, Tammi Kalugdan (Assistant  Director), Merry Woo (Analyst-in-Charge), Carlos (Steven) Aguilar,  Alexander Anderegg, Christina Bixby, Carl Barden, Chris Businsky,  Virginia Chanley, Cynthia Grant, Paris Hawkins, Lee Hinga, James  (Andrew) Howard, Assia Khadri, David Plocher, Steven Putansu, and  Priscilla Smith made significant contributions to this report.
Why GAO Did This Study

A key component of mitigating and responding to cyber threats is having a qualified, well-trained cybersecurity workforce. The act requires OPM and federal agencies to take several actions related to cybersecurity workforce planning. These actions include categorizing all IT, cybersecurity, and cyber-related positions using OPM personnel codes for specific work roles, and identifying critical staffing needs.
The act contains a provision for GAO to analyze and monitor agencies' workforce planning. GAO's objectives were to (1) determine the extent to which federal agencies have assigned work roles for positions performing IT, cybersecurity, or cyber-related functions and (2) describe the steps federal agencies took to identify work roles of critical need. GAO administered a questionnaire to 24 agencies, analyzed coding data from personnel systems, and examined preliminary reports on critical needs. GAO selected six of the 24 agencies based on cybersecurity spending levels to determine the accuracy of codes assigned to a random sample of IT positions. GAO also interviewed relevant OPM and agency officials.

What GAO Found

The 24 reviewed federal agencies generally assigned work roles to filled and vacant positions that performed information technology (IT), cybersecurity, or cyber-related functions as required by the Federal Cybersecurity Workforce Assessment Act of 2015 (the act). However, six of the 24 agencies reported that they had not completed assigning the associated work role codes to their vacant positions, although they were required to do so by April 2018. In addition, most agencies had likely miscategorized the work roles of many positions. Specifically, 22 of the 24 agencies assigned a “non-IT” work role code to 15,779 (about 19 percent) of their IT positions within the 2210 occupational series. Further, the six agencies that GAO selected for additional review had assigned work role codes that were not consistent with the work roles and duties described in corresponding position descriptions for 63 of 120 positions within the 2210 occupational series that GAO examined (see figure).
Human resource and IT officials from the 24 agencies generally reported that they had not completely or accurately categorized work roles for IT positions within the 2210 occupational series, in part, because they may have assigned the associated codes in error or had not completed validating the accuracy of the assigned codes. By assigning work roles that are inconsistent with the IT, cybersecurity, and cyber-related positions, the agencies are diminishing the reliability of the information they need to improve workforce planning.
The act also required agencies to identify work roles of critical need by April 2019. To aid agencies with identifying their critical needs, the Office of Personnel Management (OPM) developed guidance and required agencies to provide a preliminary report by August 2018. The 24 agencies have begun to identify critical needs and submitted a preliminary report to OPM that identified information systems security manager, IT project manager, and systems security analyst as the top three work roles of critical need. Nevertheless, until agencies accurately categorize their positions, their ability to effectively identify critical staffing needs will be impaired.

What GAO Recommends

GAO is making 28 recommendations to 22 agencies to review and assign the appropriate codes to their IT, cybersecurity, and cyber-related positions. Of the 22 agencies to which GAO made recommendations, 20 agreed with the recommendations, one partially agreed, and one did not agree with one of two recommendations. GAO continues to believe that all of the recommendations are warranted.