Similar to HSCWAA, the federal act also requires all federal agencies,  including DHS, to identify and report to OPM on its cybersecurity work  roles of critical need; each agency also is to submit a progress report on  identifying cyber-related work roles of critical need to Congress. DHS Did Not Ensure Cybersecurity Workforce Procedures Were Timely, Complete, or Reviewed

HSCWAA required DHS to establish procedures to identify and assign the  appropriate employment code to all of the department’s filled and vacant  positions with cybersecurity functions, in accordance with OPM’s Guide to  Data Standards by March 2015. For example, they stated that:
DHS did not complete its update of the procedures for identifying  cybersecurity positions and assigning codes until April 2016 because  the department could not decide whether or not certain positions  within the department should be considered cybersecurity positions; each component had the best understanding of their human capital  systems and processes, so the development of tailored procedures  was best left up to each component; each of the six selected DHS components recorded and tracked  vacant positions differently; therefore, the department’s human capital  office could not issue department-wide guidance on vacant positions;  the cybersecurity specialty areas for vacant positions were not known  until a position description was developed or verified and a hiring  action was imminent; and
DHS did not assign responsibilities for, or review, components’  procedures because, as noted previously, the department believed  that its components had the best understanding of their specific  human capital systems; thus, what the components included in their  own procedures was best left up to them. DHS Has Not Completely and Accurately Assigned Employment Codes

In addition to identifying all of its positions with cybersecurity functions  and determining the work categories and specialty areas of each position  consistent with the NICE framework, HSCWAA required DHS to assign  positions codes to all such identified positions by September 2015. DHS has not completely and accurately assigned employment codes to  its cybersecurity workforce. However, our analysis determined that the department had  assigned cybersecurity position codes to approximately 79 percent, rather  than the reported 95 percent, of identified federal civilian cybersecurity  positions. Specifically, the  percentage reflected information on the progress of filled federal civilian  cybersecurity positions, but excluded vacant positions, even though the  act required DHS to report these positions. DHS Has Not Identified or Reported Its Department-wide Cybersecurity Workforce Areas of Critical Need

While DHS has identified workforce capacity and capability gaps, it has  not identified or reported to Congress its department-wide cybersecurity  critical needs that align with the NICE framework. Additionally, the  department has not reported its critical needs to OPM or developed plans  and time frames for completing priority actions for reporting critical needs  annually to OPM. Until DHS develops plans and schedules with time frames for reporting its  cybersecurity critical needs, the department may not have important  insight into its needs for ensuring that it has the workforce necessary to  carry out its critical role of helping to secure the nation’s cyberspace. Conclusions

DHS has begun the required workforce assessment activities to identify,  categorize, and assign codes to its cybersecurity positions. Without the ability  to identify, categorize, and code its cybersecurity positions in a complete  and accurate manner, DHS will not be able to effectively examine the  cybersecurity workforce, identify skill gaps, and improve workforce  planning. In addition, DHS  may not have cybersecurity personnel with the required skills to better  protect federal networks and national critical infrastructure from threats. The commitment of DHS’s leadership is essential to successfully  addressing these issues and the associated management weaknesses. Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify the extent to which DHS has:  1.  identified, categorized and assigned employment codes to  2.  identified its cybersecurity workforce areas of critical need. To address both objectives, we examined Department of Homeland  Security (DHS) Office of Chief Human Capital Officer (OCHCO) and  component cybersecurity workforce data and documentation and  interviewed OCHCO and component officials. The selection of OCHCO officials for preliminary review was based on  OCHCO’s oversight role in the implementation of the Homeland Security  Cybersecurity Workforce Assessment Act of 2014 (HSCWAA). We evaluated these  documents against the act’s requirements and Standards for Internal  Control in the Federal Government to ensure that DHS’s processes  addressed leading practices.
Why GAO Did This Study

DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs.
The act included a provision for GAO to analyze and monitor DHS's implementation of the requirements. GAO's objectives were to assess the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. GAO analyzed DHS and OPM workforce documentation and administered a data collection instrument to six major DHS components. GAO also interviewed relevant DHS and OPM officials.

What GAO Found

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS has not yet completed its efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to the Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, GAO's analysis determined that the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions.
In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to the Congress on its department-wide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table).
Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify its critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.

What GAO Recommends

GAO recommends that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed. DHS concurred with our six recommendations and described actions the department plans to take to address them. OPM did not have any comments.