Cybersecurity Workforce: Agencies Need to Accurately Categorize Positions to Effectively Identify Critical Staffing Needs

A key component of mitigating and responding to cyber threats is having a qualified, well-trained cybersecurity workforce. The act requires OPM and federal agencies to take several actions related to cybersecurity workforce planning. These actions include categorizing all IT, cybersecurity, and cyber-related positions using OPM personnel codes for specific work roles, and identifying critical staffing needs.

The act contains a provision for GAO to analyze and monitor agencies' workforce planning. GAO's objectives were to (1) determine the extent to which federal agencies have assigned work roles for positions performing IT, cybersecurity, or cyber-related functions and (2) describe the steps federal agencies took to identify work roles of critical need. GAO administered a questionnaire to 24 agencies, analyzed coding data from personnel systems, and examined preliminary reports on critical needs. GAO selected six of the 24 agencies based on cybersecurity spending levels to determine the accuracy of codes assigned to a random sample of IT positions. GAO also interviewed relevant OPM and agency officials.

The 24 reviewed federal agencies generally assigned work roles to filled and vacant positions that performed information technology (IT), cybersecurity, or cyber-related functions as required by the Federal Cybersecurity Workforce Assessment Act of 2015 (the act). However, six of the 24 agencies reported that they had not completed assigning the associated work role codes to their vacant positions, although they were required to do so by April 2018. In addition, most agencies had likely miscategorized the work roles of many positions. Specifically, 22 of the 24 agencies assigned a “non-IT” work role code to 15,779 (about 19 percent) of their IT positions within the 2210 occupational series. Further, the six agencies that GAO selected for additional review had assigned work role codes that were not consistent with the work roles and duties described in corresponding position descriptions for 63 of 120 positions within the 2210 occupational series that GAO examined (see figure).

Human resource and IT officials from the 24 agencies generally reported that they had not completely or accurately categorized work roles for IT positions within the 2210 occupational series, in part, because they may have assigned the associated codes in error or had not completed validating the accuracy of the assigned codes. By assigning work roles that are inconsistent with the IT, cybersecurity, and cyber-related positions, the agencies are diminishing the reliability of the information they need to improve workforce planning.

The act also required agencies to identify work roles of critical need by April 2019. To aid agencies with identifying their critical needs, the Office of Personnel Management (OPM) developed guidance and required agencies to provide a preliminary report by August 2018. The 24 agencies have begun to identify critical needs and submitted a preliminary report to OPM that identified information systems security manager, IT project manager, and systems security analyst as the top three work roles of critical need. Nevertheless, until agencies accurately categorize their positions, their ability to effectively identify critical staffing needs will be impaired.

GAO is making 28 recommendations to 22 agencies to review and assign the appropriate codes to their IT, cybersecurity, and cyber-related positions. Of the 22 agencies to which GAO made recommendations, 20 agreed with the recommendations, one partially agreed, and one did not agree with one of two recommendations. GAO continues to believe that all of the recommendations are warranted.

The security of federal information systems and data is critical to the  nation’s safety, prosperity, and well-being. However, federal systems and  networks are inherently at risk because of their complexity, technological  diversity, and geographic dispersion. Further, threats to federal  information technology (IT) infrastructure continue to grow in number and  sophistication, posing a risk to the reliable functioning of our government.

A key component of the government’s ability to mitigate and respond to  cybersecurity threats is having a qualified, well-trained cybersecurity  workforce. Cybersecurity professionals can help to prevent or mitigate the  vulnerabilities that could allow malicious individuals and groups access to  federal IT systems. However, skills gaps in personnel who perform IT,  cybersecurity, or other cyber-related functions may impede the federal  government from protecting information systems and data that are vital to  the nation.

We and other organizations have previously reported that federal  agencies face challenges in ensuring that they have an effective  cybersecurity workforce. In 1997, we designated the security of federal  information systems as a government-wide high-risk area and cited the  shortage of information security personnel with technical expertise  required to manage controls in these systems.

In 2001, we added strategic human capital management to our high-risk  list, and reported that human capital shortfalls are eroding the ability of  some agencies to perform their core missions. In addition, in our 2017  update to the high-risk list, we reported that the federal government  continued to face challenges in addressing mission critical skills gaps,  including cybersecurity skills gaps. Further, in September 2018, we  reported that effective cybersecurity workforce management was a critical  action for addressing cybersecurity challenges facing the nation.

To address the cybersecurity skills gaps within the executive branch of  the federal government, the Federal Cybersecurity Workforce  Assessment Act of 2015 (the act) requires the Office of Personnel  Management (OPM), the National Institute of Standards and Technology  (NIST), and other federal agencies to take several actions related to  cybersecurity workforce planning. Among other things, the act requires:

OPM, in coordination with NIST, to develop a cybersecurity coding  structure that aligns with the work roles identified in the National  Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce  Framework, for agencies to identify and categorize all federal IT,  cybersecurity, and cyber-related positions.

Federal agencies to complete the assignment of work role codes to  their filled and vacant IT, cybersecurity, or cyber-related positions that  perform these functions.

Federal agencies to identify their IT, cybersecurity, or cyber-related  work roles of critical need in the workforce and submit a report  describing these needs to OPM.

The act also includes a provision for us to review the agencies’  implementation of these requirements and report on our assessment to  Congress. Toward this end, in June 2018, we issued an initial report on  agencies’ efforts to implement selected activities that the act required  them to complete by November 2017. In that report, we made 30  recommendations to 13 agencies to develop and submit their baseline  assessment reports and to fully address the required activities in OPM’s  guidance in their procedures for assigning work role codes to their civilian  IT, cybersecurity, or cyber-related positions.

This second report addresses agencies’ efforts in implementing selected  additional activities required by the act. Specifically, our objectives for this  report were to (1) determine the extent to which federal agencies have  assigned work role codes to positions performing IT, cybersecurity, or  cyber-related functions and (2) describe the steps federal agencies took  to identify work roles of critical need. The scope of our review included  the 24 major departments and agencies covered by the Chief Financial  Officers (CFO) Act of 1990.

To address our objectives, we administered a questionnaire to the 24  CFO Act agencies to obtain information on their efforts in assigning work  role codes to positions performing IT, cybersecurity, or cyber-related  functions, and in identifying work roles of critical need. We reviewed and  analyzed the agencies’ responses to the questionnaire in comparison to  the act’s requirements, OPM guidance, and the NICE Cybersecurity  Workforce Framework (framework). We also obtained, reviewed, and  analyzed reports and other documents supporting questionnaire  responses to assess whether agencies assigned codes in accordance  with OPM’s coding guidance.

Further, to analyze the extent to which federal agencies have assigned  work role codes to positions performing IT, cybersecurity, or cyber-related functions, we obtained workforce data for the 24 agencies from OPM’s  Enterprise Human Resources Integration system. We reviewed this  collection of data to determine its completeness and to determine the  number of positions in the 2210 IT management occupational series to  which the 24 agencies had assigned the code of “000” as of May 2018.  We reviewed positions from the 2210 IT management series because,  based on the definition of the series, these positions are most likely to  perform IT, cybersecurity, or cyber-related functions.

We then identified a subset of the 24 agencies and performed an  additional review of these agencies’ work role coding efforts. We selected  these agencies based on their total cybersecurity spending for fiscal year  2016, as reported by the Office of Management and Budget (OMB) in its  Federal Information Security Modernization Act annual report. We  sorted the 24 agencies’ IT cybersecurity spending from highest to lowest  and then divided the agencies into three equal groups of high, medium,  and low cybersecurity spending. We then selected the top two agencies  from each group. Based on these factors, we selected six agencies: the  (1) Department of Defense (DOD), (2) Department of Homeland Security  (DHS), (3) Department of State (State), (4) National Aeronautics and  Space Administration (NASA), (5) Environmental Protection Agency  (EPA), and (6) General Services Administration (GSA).

We randomly selected a sample of 20 positions from each of the six  selected agencies (120 total positions) within the 2210 IT management  occupational series. We also selected a second nonstatistical sample of  12 positions for each of the six agencies (72 total positions) from the 2210  IT management occupational series based on pairs of positions that had  identical position titles, occupational series, and sub-agencies, but for  which the agencies had assigned different work role codes for the  positions. For the selected positions, we reviewed the work role coding  data from the agencies’ human resources systems and compared them to  the duties described in the corresponding position descriptions to  determine whether agencies had assigned work role codes that were  consistent with the duties described in the position descriptions.

To address our second objective, we evaluated OPM’s and agencies’  actions to identify IT, cybersecurity, or cyber-related work roles of critical  need. To do this, we obtained and analyzed OPM’s progress report to  Congress and its guidance for identifying critical needs by comparing the  contents of these documents to the act’s requirements. We also reviewed  any available documentation from the 24 agencies on their progress in  identifying critical needs, such as project plans or preliminary critical  needs reports. We supplemented our analysis with interviews of the  agencies’ human capital and IT officials regarding their progress in  assigning work role codes and identifying critical needs. Appendix I  provides a full description of our objectives, scope, and methodology.

We conducted this performance audit from February 2018 to March 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and  electronic data to carry out operations and to process, maintain, and  report essential information. The information systems and networks that  support federal operations are highly complex and dynamic,  technologically diverse, and often geographically dispersed. This  complexity increases the difficulty in identifying, managing, and protecting  the myriad of operating systems, applications, and devices comprising the  systems and networks.

A resilient, well-trained, and dedicated cybersecurity workforce is  essential to protecting federal IT systems. Nevertheless, OMB and our  prior reports have pointed out that the federal government and private  industry face a persistent shortage of cybersecurity and IT professionals  to implement and oversee information security protections to combat  cyber threats.

As we noted in our prior report, the RAND Corporation and the  Partnership for Public Service have reported on a nationwide shortage of  cybersecurity experts in the federal government. According to these  reports, the existing shortage of cybersecurity professionals makes  securing the nation’s networks more challenging and may leave federal IT  systems vulnerable to malicious attacks. The persistent shortage of  cyber-related workers has given rise to the identification and assessment  of the federal cybersecurity workforce across agencies so that efforts to  increase the number of those workers can be applied in the most efficient  and accurate manner.

The NICE Framework and OPM Coding Structure Describe Federal Cybersecurity Work Roles

NIST coordinates the National Initiative for Cybersecurity Education  (NICE) partnership among government, academia, and the private sector.  The initiative’s goal is to improve cybersecurity education, awareness,  training, and workforce development in an effort to increase the number  of skilled cybersecurity professionals.

In August 2017, NIST revised and published the NICE Cybersecurity  Workforce Framework (framework). The framework’s purpose is to help  the federal government better understand the breadth of cybersecurity  work by describing IT, cybersecurity, and cyber-related work roles  associated with the categories and specialty areas that make up  cybersecurity work. The framework organizes IT, cybersecurity, and  cyber-related job functions into categories, representing high-level  groupings of cybersecurity functions; and into specialty areas,  representing areas of concentrated work or functions.

Figure 1 identifies the seven categories and the 33 specialty areas in the  NICE framework.

In addition to categories and specialty areas, the NICE framework  introduced the concept of work roles. Work roles provide a more detailed  description of the roles and responsibilities of IT, cybersecurity, and  cyber-related job functions than do the category and specialty area  components of the framework. The framework defines one or more work  roles within each specialty area. For example, as depicted in figure 2, the  framework defines 11 work roles within the seven specialty areas of the  “Securely Provision” category. In total, the framework defines 52 work  roles across the 33 specialty areas.

The NICE framework work roles include, among others, the Technical  Support Specialist, IT Project Manager, and Software Developer. The  framework identifies these IT, cybersecurity, and cyber-related work roles  as essential functions. For example, a Technical Support Specialist may  have a role in identifying the occurrence of a cybersecurity event, an IT  Project Manager may need to manage cybersecurity risk to systems, and  a Software Developer may need to implement appropriate cybersecurity  safeguards.

In October 2017, OPM updated the federal cybersecurity coding structure  to incorporate the work roles identified in the NICE framework. The  coding structure assigned a unique 3-digit cybersecurity code to each  work role, which supplanted the prior coding structure’s 2-digit codes.  According to OPM, the coding of federal positions with these specific 3- digit work role codes is intended to enhance agencies’ ability to identify  critical IT, cybersecurity, and cyber-related workforce needs, recruit and  hire employees with needed skills, and provide appropriate training and  development opportunities to cybersecurity employees. Appendix II  provides a summary of the IT, cybersecurity, and cyber-related work roles  and corresponding OPM codes.

Federal Cybersecurity Workforce Assessment Act of 2015 Establishes Workforce Planning Requirements

In 2015, Congress and the President enacted the Federal Cybersecurity  Workforce Assessment Act, which required OPM, NIST, and other federal  agencies to undertake a number of cybersecurity workforce-planning  activities. The act required these agencies to complete the activities  within specified time frames. We addressed the first six activities in our  prior report we issued in June 2018, and addressed the subsequent  activities 7 through 10 in this report.

Among the required cybersecurity workforce-planning activities are the  following 10 that we selected for our review.  1.  OPM, in coordination with NIST, was to develop a cybersecurity  coding structure that aligns with the work roles identified in the NICE  Cybersecurity Workforce Framework. (Due June 2016)  2.  OPM was to establish procedures to implement a cybersecurity  coding structure to identify all federal civilian positions that require the  performance of IT, cybersecurity, or other cyber-related functions.  (Due September 2016)  3.  OPM was to submit a report to Congress on the progress that  agencies made in identifying and assigning codes to their positions  that perform IT, cybersecurity, or cyber-related functions. (Due June  2016)  4.  Each federal agency was to submit a report to Congress on its  baseline assessment and on the extent to which its employees who  perform IT, cybersecurity, or cyber-related functions held  certifications. (Due December 2016)  5.  Each federal agency was to establish procedures to identify all filled  and vacant IT, cybersecurity, or cyber-related positions and assign the  appropriate code to each position. (Due April 2017 for civilian  positions)  6.  The Department of Defense (DOD) was to establish procedures to  implement the cybersecurity coding structure to identify all federal  noncivilian (i.e., military) positions. (Due June 2017)  7.  Each agency was to complete the assignment of work role codes to  its filled and vacant positions that perform IT, cybersecurity, or cyber- related functions. (Due April 2018 for civilian positions)  8.  OPM was to identify critical needs across federal agencies and submit  a progress report to Congress on the identification of critical needs.  (Due December 2017)  9.  OPM was to provide federal agencies with timely guidance for  identifying IT, cybersecurity, or cyber-related work roles of critical  need, including work roles with acute and emerging skill shortages.  (The act did not specify a due date for this requirement).  10. Federal agencies were to identify their IT, cybersecurity, or cyber- related work roles of critical need in the workforce and submit a report  describing these needs to OPM. (Due April 2019)

Prior GAO Report Examined Agencies’ Implementation of the Initial Activities Required by the Federal Cybersecurity Workforce Assessment Act of 2015

In June 2018, we reported on federal agencies’ implementation of the first  six of the 10 selected activities required by the Federal Cybersecurity  Workforce Assessment Act. Specifically, we reported that, in November  2016, OPM, in coordination with NIST, had issued a cybersecurity coding  structure that aligned with the NICE framework work roles (activity 1).  Also, these two agencies developed procedures for assigning codes to  federal civilian IT, cybersecurity, or cyber-related positions in January  2017 (activity 2). We noted that OPM had issued the cybersecurity coding  structure and procedures later than the act’s deadlines because it was  working with NIST to align the structure and procedures with the draft  version of the NICE Cybersecurity Workforce Framework, which NIST  issued later than planned. Regarding activity 3, we noted that OPM had  submitted a report to Congress in July 2016 on the agencies’ progress in  implementing the act’s required activities, as well as OPM’s efforts to  develop a coding structure and government-wide coding procedures.

We also reported that 21 of the 24 agencies had submitted baseline  assessment reports identifying the extent to which their IT, cybersecurity,  or cyber-related employees held professional certifications (activity 4).  However, the three other agencies had not submitted such reports. In  addition, four agencies did not include all reportable information in their  reports, such as the extent to which personnel without certifications were  ready to obtain them, or strategies for mitigating any gaps, as required by  the act. We made 10 recommendations to these seven agencies to  develop and submit baseline assessment reports, including all reportable  information, to the congressional committees. As of February 2019, none  of the seven agencies had implemented any of the 10 recommendations  relating to the baseline assessment reports.

Further, we reported that 23 of the 24 agencies had established  procedures for assigning the appropriate work role codes to civilian  positions that perform IT, cybersecurity, or cyber-related functions  (activities 5 and 6 above), as required by the act. One agency had not  established such procedures.

Further, of the 23 agencies that had established procedures, 6 agencies  did not address one or more of seven activities required by OPM in their  procedures. For example, the agencies’ procedures did not include  activities to review all filled and vacant positions and annotate reviewed  position descriptions with the appropriate work role code. In addition,  DOD had not established procedures for identifying and assigning work  role codes to noncivilian (i.e., military) positions.

Our June 2018 report included 20 recommendations to eight agencies to  establish or update their procedures to fully address the required activities  in OPM’s guidance. Subsequent to the report, the eight agencies  implemented the 20 recommendations related to establishing or  improving agencies’ coding procedures to address the required OPM  activities. Specifically:

The Department of Energy (Energy) established coding procedures  that addressed the seven OPM required activities.

The Department of Education (Education), Department of Labor  (Labor), NASA, National Science Foundation (NSF), Nuclear  Regulatory Commission (NRC), and United States Agency for  International Development (USAID) revised their procedures to  ensure that the procedures addressed OPM’s required activities.

DOD established a consolidated government-wide and internal  procedure for identifying and assigning work role codes to noncivilian  (i.e., military) positions.

Table 1 summarizes the status of agencies’ implementation of the first six  selected activities required by the act as of October 2018. We initially  reported on the status of these activities in our June 2018 report.

Agencies Generally Categorized Positions, but Did Not Ensure the Reliability of Their Efforts

Regarding the selected activity for agencies to complete the assignment  of work role codes to filled and vacant positions that perform IT,  cybersecurity, or cyber-related functions (activity 7) as set forth in the  Federal Cybersecurity Workforce Assessment Act of 2015, the 24  agencies had generally assigned work roles code to their positions.  However, several agencies had not completed assigning codes to their  vacant positions. In addition, most agencies had likely miscategorized the  work roles of many positions. For example, in these instances, the  agencies had assigned a code designated for positions that do not  perform IT, cybersecurity, or cyber-related functions to positions that most  likely perform these functions.

As indicated in table 2, federal agencies’ efforts to assign work role codes  to filled and vacant positions that performed IT, cybersecurity, or cyber- related functions were ongoing as of October 2018.

Agencies Had Generally Assigned Work Role Codes to Positions, but Six Had Not Completely Coded Vacant Positions

To assist agencies with meeting their requirements under the Federal  Cybersecurity Workforce Assessment Act of 2015, OPM issued guidance  that directed agencies to identify filled and vacant positions with IT,  cybersecurity, or cyber-related functions and assign work role codes to  those positions using the Federal Cybersecurity Coding Structure by April  2018. As previously mentioned, this coding structure designates a  unique 3-digit code for each work role defined in the NICE framework.  According to OPM’s guidance, agencies could assign up to three work  role codes to each position, and should assign the code of “000” only to  positions that did not perform IT, cybersecurity, or cyber-related functions.

The 24 agencies generally had assigned work role codes to their filled  workforce positions that performed IT, cybersecurity, or cyber-related  functions. Specifically, 22 of the agencies responded to our questionnaire  that, as of April 2018, they had completed assigning work role codes to  those filled positions. In addition, data from the OPM Enterprise Human Resources Integration system showed that, as of May 2018, the 24  agencies had collectively assigned work role codes or a “000” code to  over 99 percent of the filled positions in their entire workforce.

In addition, 18 of the 24 agencies reported they had identified and  assigned codes to their vacant IT, cybersecurity, or cyber-related  positions by April 2018. However, the remaining six agencies reported  that they were not able to identify or assign codes to all of their vacant  positions. For example, four agencies—DOD, EPA, GSA, and NASA— responded to our questionnaire that they did not identify and assign  codes to vacant IT, cybersecurity, or cyber-related positions.

DOD reported that, while some components assigned codes to vacant  positions, the department did not have an enterprise-wide capability to  assign codes to vacant positions and had not modified the systems to  enable the use of the 3-digit work role codes for vacant positions due  to time and funding constraints.

EPA reported that it had assigned codes to vacant positions in April  2018, but it did not have a process for assigning codes to newly  created vacant positions.

GSA human resources officials said that they assigned codes to  vacant positions that had been authorized and funded. However, they  did not code unfunded vacant positions because they did not  anticipate filling them. Agency officials noted that they, instead,  tracked unfunded vacant positions through staffing plans.

NASA human resources and Office of the Chief Information Officer  officials said the agency did not identify and code vacant positions  because they did not track vacant positions.

Further, the remaining two agencies—Energy and Justice— stated that  they could not provide data regarding the number of vacant IT,  cybersecurity, or cyber-related positions that had been identified and  coded. For example, Justice said that information on vacant positions was  not available through its human resources system, and that it would need  to send a data call to components to obtain information on the number of  vacancies with an assigned work role code. However, according to  management division officials, the department would need additional time  to collect this information.

OPM stated that it plans to issue additional guidance for tracking IT,  cybersecurity, and cyber-related vacancies by January 2019. OPM  officials said that agencies have focused on the assignment of codes to  filled positions and that tracking vacancies is challenging because  agencies vary in the way they track vacancies.

By not completing their efforts to identify and code their vacant IT,  cybersecurity, and cyber-related positions, the six agencies lack important  information about the state of their workforces. As a result, these  agencies may be limited in their ability to identify work roles of critical  need and improve workforce planning.

Most Agencies Had Likely Miscategorized the Work Roles of Many Positions

The Federal Cybersecurity Workforce Assessment Act of 2015 required  agencies to assign the appropriate work role codes to each position with  cybersecurity, cyber-related, and IT functions, as defined in the NICE  framework. In addition, OPM guidance required agencies to assign work  role codes using the Federal Cybersecurity Coding Structure. As  previously mentioned, according to OPM’s guidance, agencies could  assign up to three work role codes to each position. Agencies were to  assign a code of “000” only to positions that did not perform IT,  cybersecurity, or cyber-related functions. Further, the Standards for  Internal Control in the Federal Government states that agencies should  obtain relevant data from reliable sources that are complete and  consistent.

However, the 24 agencies had likely miscategorized the work roles of  many positions. For example, the 24 agencies routinely assigned work  role codes to positions that were likely inconsistent with the positions’  functions. Specifically, at least 22 of the 24 agencies assigned the code  “000”, which is designated for positions not performing IT, cybersecurity,  or cyber-related functions, to many positions that most likely performed  these functions.

For example, OPM’s Enterprise Human Resources Integration data from  May 2018 showed that 22 of the 24 agencies had assigned the “000”  code to between 5 and 86 percent of their positions in the 2210 IT  management occupational series. These positions are most likely to  perform IT, cybersecurity, or cyber-related functions, as defined by the  NICE framework. OPM and agency officials told us that they would expect  agencies to assign a NICE work role code to these positions, with a few  exceptions, such as in cases where a position’s duties did not align with a  NICE work role code.

Table 3 identifies the number and percentage of the 2210 IT management  positions that were assigned a “000” code by each of the 24 agencies,  according to OPM’s Enterprise Human Resources Integration data, as of  May 2018. Collectively, the agencies assigned a “000” code to about  15,779 positions, or about 19 percent of the agencies’ 2210 IT  management positions.

Agencies identified varying reasons for why they assigned the “000” code  to positions that most likely performed IT, cybersecurity, or cyber-related  functions. For example,

Agency human resources and IT officials from 10 agencies said that  they may have assigned the “000” code in error (DOD, Education,  Energy, Justice, State, Department of Veterans Affairs (VA), NRC,  OPM, Small Business Administration (SBA), Social Security  Administration (SSA)).

Agency human resources and IT officials from 13 agencies said they  had not completed the process to validate the accuracy of their codes  (Department of Agriculture (Agriculture), Education, Department of  Health and Human Services (HHS), DHS, Department of Housing and  Urban Development (HUD), Justice, Treasury, VA, EPA, GSA, NRC,  SBA, SSA).

Agency human resources and IT officials from seven agencies said  that they assigned the “000” code to positions that did not perform  cybersecurity duties for a certain percentage of their time (Commerce,  Justice, Labor, Transportation, Treasury, GSA, and NASA).

Agency human resources and IT officials from 12 agencies said that  OPM’s guidance was not clear on whether the 2210 IT management  positions should be assigned a work role code and not be assigned  the “000” code (Agriculture, Energy, DHS, HUD, Interior, Labor, State,  VA, EPA, GSA, NASA, and SSA).

Agency human resources and IT officials from three agencies stated  that they assigned the “000” code to IT positions when their positions  did not align with any of the work roles described in the NICE  framework (Interior, Treasury, and NRC).

However, the work roles and duties described in the agencies’ position  descriptions for the 2210 IT management positions that we reviewed  aligned with the work roles defined in the NICE framework. For example,  in examining the position descriptions that NRC officials said did not align  to work roles in the NICE framework, we were able to match duties  described in the position descriptions to work role tasks in the framework  and identify potential work role codes for those positions. Additionally,  Treasury officials said that positions in the area of cryptographic key  management did not align with the NICE framework; however, these  positions would likely align with the Communications Security Manager  (i.e., NICE code 723) work role, which covers cryptographic key  management.

By assigning work role codes that are inconsistent with the IT,  cybersecurity, and cyber-related functions performed by positions, the  agencies in our review are diminishing the reliability of the information  they will need to identify their workforce roles of critical need.

Agencies Assigned Work Role Codes to Sample Positions That Were Inconsistent with Duties Described In Corresponding Position Descriptions

Similar to the work role data reported in OPM’s Enterprise Human  Resources Integration system, the six agencies that we selected for  additional review had assigned work role codes to positions in their  human resources systems that were not consistent with the duties  described in their corresponding position descriptions. Of 120 randomly  selected 2210 IT management positions that we reviewed at the six  agencies, 63 were assigned work role codes that were inconsistent with  the duties described in their position descriptions.

DHS assigned a Network Operational Specialist code (NICE code  441) to a position with duties associated with a Cyber Instructional  Curriculum Developer (NICE code 751).

State assigned a Cyber Legal Advisor (NICE code 731) code to a  position with duties associated with a Program Manager (NICE code  801).

Table 4 summarizes the consistency of work role coding in comparison to  corresponding position description text for the random sample of positions  for the six selected agencies.

The six agencies had also assigned different work role codes for positions  that had identical position titles and similar functions described in  corresponding position descriptions for 46 of 72 positions that we  reviewed. For example,

State had two positions associated with a position description that  described duties associated with the IT Program Auditor (NICE code  805). Although State assigned the “805” work role code to one  position, it assigned the “000” code to the other position.

DOD had two positions associated with a position description that  described duties associated with the Information Systems Security  Manager work role (NICE code 722). However, DOD assigned the  “000” code to one position and assigned an invalid 2-digit code to the  other position.

The six agencies provided multiple reasons for why they had assigned  codes that were not consistent with the work roles and duties described in  their corresponding position descriptions:

DOD officials from the Office of the Chief Information Officer cited the  large number of positions that perform IT, cybersecurity, or cyber- related functions and the lack of one-to-one mapping of the NICE  framework work roles to positions as impediments.

DHS human resources officials said that position descriptions may not  have been consistent with coding because the assignment of the work  role codes could be based on specific tasks that are described in  separate documents (e.g., job analyses or employee performance  plans) outside of the position descriptions.

Information Resource Management officials at State said that their  system did not require all IT positions to have a work role code.  However, according to the officials, they had plans to create and  release a business rule in September 2018 to reduce data errors and  require the 2210 IT management positions series to have a work role  code.

EPA officials in the Office of Environmental Information and the Office  of Human Resources stated that the first-line supervisor made the  final determination of each position’s work role code. Officials stated  that first-line supervisors may have assigned different codes for  similar positions because they interpreted OPM guidance and work  roles differently.

GSA human resources officials said they assigned “000” to IT  positions because they needed clarification and further interpretive  guidance from OPM. According to the officials, once GSA received  the guidance, the agency planned to conduct a review of IT positions  coded “000.” In addition, GSA had assigned the code “000” if the  position description did not include 25 percent or more of  cybersecurity functions.

According to NASA officials from the Offices of the Chief Human  Capital Officer and Chief Information Officer, the agency miscoded a  few positions due to an administrative error that has since been  corrected. In addition, NASA officials said that they assigned the “000”  code to positions that did not perform cybersecurity duties for a  certain percentage of time (e.g., 25 percent or more of the time).

Agencies did not provide further evidence that the positions we evaluated  as inconsistently coded were accurate. Moreover, in reviewing 87 position  descriptions provided by the six agencies—DOD, DHS, State, EPA, GSA,  and NASA—in no case did we find the assignment of the “000” work role  code to be consistent with the duties described.

OPM and Agencies Had Taken Steps to Identify IT, Cybersecurity, and Cyber-related Work Roles of Critical Need

As of November 2018, OPM and the 24 agencies had taken steps to  address the three selected activities that the Federal Cybersecurity  Workforce Assessment Act of 2015 required to identify IT, cybersecurity,  and cyber-related work roles of critical need. Specifically, OPM had  reported on agencies’ progress in identifying critical needs (activity 8) and  had provided agencies with guidance for identifying IT, cybersecurity, and  cyber-related work roles of critical need (activity 9). In addition, the 24  agencies had submitted preliminary reports of their identified critical  needs to OPM, but their efforts to identify critical needs were ongoing  (activity 10).

Table 5 presents the status of the agencies’ efforts to identify work roles  of critical need, as of November 2018. Further, appendix III summarizes  the status of implementation of each of the 10 selected activities required  by the act.

OPM Reported on Progress of Efforts and Provided Guidance for Agencies to Identify Cybersecurity Work Roles of Critical Need

The Federal Cybersecurity Workforce Assessment Act of 2015 required  OPM, in consultation with DHS, to identify critical needs for the IT,  cybersecurity, or cyber-related workforce across federal agencies and  submit a progress report to Congress on the identification of IT,  cybersecurity, or cyber-related work roles of critical need by December  2017. The act also required OPM to provide timely guidance for  identifying IT, cybersecurity, or cyber-related work roles of critical need,  and including current acute and emerging skill shortages.

In December 2017, OPM, in consultation with DHS, reported on the  progress of federal agencies’ identification of IT, cybersecurity, and cyber- related work roles of critical need to Congress. In the report, OPM could  not identify critical needs across all federal agencies because agencies  were still in the process of assigning work role codes and identifying their  critical needs. As such, OPM reported that agencies were working toward  accurately completing their coding efforts by April 2018, as a foundation  for assessing the workforce and identifying needed cybersecurity skills.  OPM stated in the report that it would begin to identify and report IT,  cybersecurity, and cyber-related work roles of critical need following the  agencies’ completion of their assessments and coding of the workforce.

Further, in April 2018, OPM issued a memorandum to federal agencies’  chief human capital officers that provided guidance on identifying IT,  cybersecurity, and cyber-related work roles. Specifically, this guidance  required agencies to report their greatest skill shortages, analyze the root  cause of the shortages, and provide action plans with targets and  measures for mitigating the critical skill shortages.

In addition, in June 2018, to ensure that agencies were on track to meet  the requirements outlined in the act to submit their critical needs by April  2019, OPM required agencies to provide a preliminary report on work  roles of critical need and root causes by August 31, 2018. OPM  provided agencies with a template to collect critical information such as  critical needs and root causes. OPM guidance stated that these data  would provide the Congress with a government-wide perspective of  critical needs and insight into how to allocate future resources.

Agencies Have Begun to Identify Cybersecurity Work Roles of Critical Need

The act required agencies to identify IT, cybersecurity, or cyber-related  work roles of critical need and submit a report to OPM substantiating  these critical need designations by April 2019. OPM also required  agencies to submit a preliminary report, which included agencies’  identified work roles of critical need and the associated root causes, by  August 31, 2018.

The 24 agencies have begun to identify critical needs and submitted a  preliminary report of critical needs to OPM. Seventeen agencies  submitted their report by the August 31, 2018 deadline, and seven  submitted their report after the deadline in September 2018. Most  agencies’ reports included the required critical needs and root causes.  Specifically,

Twenty-four agencies’ reports documented work roles of critical need.

Twenty-two agencies’ reports included the root cause of the critical  needs identified.

Table 6 shows the status of the 24 agencies’ submissions of preliminary  reports on cybersecurity work roles of critical need as of November 2018.

The preliminary reports of critical needs for the 24 agencies showed that,  as of November 2018, IT project managers, information systems security  managers, and systems security analysts are among the top identified  work roles of critical need at these agencies. Twelve agencies reported  each of these work roles as a critical need. Agencies’ preliminary reports  should provide a basis for agencies to develop strategies to address  shortages and skill gaps in their IT, cybersecurity, and cyber-related  workforces. For additional information on the top 12 reported work roles  of critical need, see appendix IV.

As required by the Federal Cybersecurity Workforce Assessment Act of  2015, the 24 agencies had generally categorized their workforce positions  that have IT, cybersecurity, or cyber-related functions; however, agencies  did not ensure the work role coding was reliable. For example, six of the  24 agencies had not completed assigning codes to their vacant positions.  In addition, 22 of the agencies had assigned a code designated for  positions not performing IT, cybersecurity, or cyber-related functions to  about 19 percent of filled IT management positions.

Further, six selected agencies—DOD, DHS, State, EPA, GSA, and  NASA—had assigned work role codes to positions in their human  resources systems that were not consistent with the duties described in  the corresponding position descriptions. Until agencies accurately  categorize their positions, the agencies may not have reliable information  to form a basis for effectively examining their cybersecurity workforce,  improving workforce planning, and identifying their workforce roles of  critical need.

Although OPM met its deadlines for reporting to congressional  committees on agencies’ progress in identifying critical needs, the  progress report did not identify critical needs across all federal agencies  because agencies were still in the process of assigning work role codes  and identifying their critical needs. In addition, OPM has since provided  agencies with guidance that should assist them in their efforts to identify  critical needs by April 2019. Further, all of the 24 agencies have  submitted preliminary reports identifying work roles of critical need to  OPM. These efforts should assist these agencies in moving forward to  develop strategies to address shortages and skill gaps in their IT,  cybersecurity, and cyber-related workforces.

We are making a total of 28 recommendations to 22 agencies to take  steps to complete the appropriate assignment of codes to their positions  performing IT, cybersecurity, or cyber-related functions, in accordance  with the requirements of the Federal Cybersecurity Workforce  Assessment Act of 2015. Specifically:  The Secretary of Agriculture should take steps to review the assignment  of the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 1)

The Secretary of Commerce should take steps to review the assignment  of the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 2)

The Secretary of Defense should complete the identification and coding  of vacant positions in the department performing IT, cybersecurity, or  cyber-related functions. (Recommendation 3)

The Secretary of Defense should take steps to review the assignment of  the “000” code to any positions in the department in the 2210 IT  management occupational series, assign the appropriate NICE  framework work role codes, and assess the accuracy of position  descriptions. (Recommendation 4)

The Secretary of Education should take steps to review the assignment of  the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 5)

The Secretary of Energy should complete the identification and coding of  vacant positions in the department performing IT, cybersecurity, or cyber- related functions. (Recommendation 6)

The Secretary of Energy should take steps to review the assignment of  the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 7)

The Secretary of Health and Human Services should take steps to review  the assignment of the “000” code to any positions in the department in the  2210 IT management occupational series and assign the appropriate  NICE framework work role codes. (Recommendation 8)

The Secretary of Homeland Security should take steps to review the  assignment of the “000” code to any positions in the department in the  2210 IT management occupational series, assign the appropriate NICE  framework work role codes, and assess the accuracy of position  descriptions. (Recommendation 9)

The Secretary of Housing and Urban Development should take steps to  review the assignment of the “000” code to any positions in the  department in the 2210 IT management occupational series and assign  the appropriate NICE framework work role codes. (Recommendation 10)

The Secretary of Interior should take steps to review the assignment of  the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 11)

The Attorney General should complete the identification and coding of  vacant positions in the Department of Justice performing IT,  cybersecurity, or cyber-related functions in the Department of Justice.  (Recommendation 12)

The Attorney General should take steps to review the assignment of the  “000” code to any positions in the Department of Justice in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 13)

The Secretary of Labor should take steps to review the assignment of the  “000” code to any positions in the department in the 2210 IT management  occupational series and assign the appropriate NICE framework work role  codes. (Recommendation 14)

The Secretary of State should take steps to review the assignment of the  “000” code to any positions in the department in the 2210 IT management  occupational series, assign the appropriate NICE framework work role  codes, and assess the accuracy of position descriptions.  (Recommendation 15)

The Secretary of Transportation should take steps to review the  assignment of the “000” code to any positions in the department in the  2210 IT management occupational series and assign the appropriate  NICE framework work role codes. (Recommendation 16)

The Secretary of Treasury should take steps to review the assignment of  the “000” code to any positions in the department in the 2210 IT  management occupational series and assign the appropriate NICE  framework work role codes. (Recommendation 17)

The Secretary of Veterans Affairs should take steps review the  assignment of the “000” code to any positions in the department in the  2210 IT management occupational series and assign the appropriate  NICE work role codes. (Recommendation 18)

The Administrator of the Environmental Protection Agency should  complete the identification and coding of vacant positions in the agency  performing IT, cybersecurity, or cyber-related functions.  (Recommendation 19)

The Administrator of the Environmental Protection Agency should take  steps to review the assignment of the “000” code to any positions in the  agency in the 2210 IT management occupational series, assign the  appropriate NICE framework work role codes, and assess the accuracy of  position descriptions. (Recommendation 20)

The Administrator of the General Services Administration should  complete the identification and coding of vacant positions at GSA  performing IT, cybersecurity, or cyber-related functions.  (Recommendation 21)

The Administrator of the General Services Administration should take  steps to review the assignment of the “000” code to any positions at GSA  in the 2210 IT management occupational series and assign the  appropriate NICE framework work role codes, and assess the accuracy of  position descriptions. (Recommendation 22)

The Administrator of the National Aeronautics and Space Administration  should complete the identification and coding of vacant positions at NASA  performing IT, cybersecurity, or cyber-related functions.  (Recommendation 23)

The Administrator of the National Aeronautics and Space Administration  should take steps to review the assignment of the “000” code to any  positions at NASA in the 2210 IT management occupational series,  assign the appropriate NICE framework work role codes, and assess the  accuracy of position descriptions. (Recommendation 24)

The Chairman of the Nuclear Regulatory Commission should take steps  to review the assignment of the “000” code to any positions at NRC in the  2210 IT management occupational series and assign the appropriate  NICE framework work role codes. (Recommendation 25)

The Director of the Office of Personnel Management should take steps to  review the assignment of the “000” code to any positions at OPM in the  2210 IT management occupational series and assign the appropriate  NICE framework work role codes. (Recommendation 26)

The Administrator of the Small Business Administration should take steps  to review the assignment of the “000” code to any positions at SBA in the  2210 IT management occupational series and assign the appropriate  NICE framework work role codes. (Recommendation 27)

The Commissioner of the Social Security Administration should take  steps to review the assignment of the “000” code to any positions at SSA  in the 2210 IT management occupational series and assign the  appropriate NICE framework work role codes. (Recommendation 28)

We provided a draft of this report to the 24 CFO Act agencies and OMB  for their review and comment. Of the 22 agencies to which we made  recommendations, 20 agencies stated that they agreed with the  recommendations directed to them; one agency partially agreed with the  recommendation; and one agency agreed with one recommendation but  did not agree with one recommendation.

In addition, of the two agencies to which we did not make  recommendations, one agency acknowledged its review of the report but  did not otherwise provide comments; the other agency provided technical  comments, which we incorporated into the report as appropriate. We also  received technical comments from three of the agencies to which we  made recommendations, and incorporated them into the report as  appropriate. Further, OMB responded that it had no comments on the  report.

The following 20 agencies agreed with the recommendations in our  report:  In comments provided via email on February 19, 2019, the Director of  Strategic Planning, Policy, E-government and Audits in Agriculture’s  Office of the Chief Information Officer stated that the department  concurred with the recommendation in our report.

In written comments (reprinted in appendix V), Commerce agreed with  our recommendation and stated that it would ensure the proper  coding of 2210 IT management occupational series positions with the  appropriate NICE framework work role codes.

In written comments (reprinted in appendix VI), DOD concurred with  our two recommendations. With regard to our recommendation that it  complete the identification and coding of vacant positions performing  IT, cybersecurity, or cyber-related functions, the department stated  that its longer-term initiative is to code positions, including vacant  positions, in DOD’s manpower requirements systems to provide true  gap analysis capabilities. Regarding our recommendation that it  review the assignment of “000” codes, the department stated that it  would continue efforts to remediate erroneously coded positions.

In written comments (reprinted in appendix VII), Education concurred  with our recommendation. The department stated that its Office of  Human Resources would continue to review the 2210 IT positions and  ensure the assignment of appropriate work role codes.

In written comments (reprinted in appendix VIII), Energy concurred  with our two recommendations. Regarding our recommendation that it  complete the identification and coding of vacant IT, cybersecurity, and  cyber-related positions, the department stated that it had instituted  procedures to review and code vacant positions.

Regarding our recommendation that it review the assignment of “000”  codes, the department said that it had ensured that all 2210 IT  management positions were assigned the appropriate work role codes  by April 2018. However, our review of the May 2018 data from OPM’s  Enterprise Human Resources Integration System found that Energy  had assigned the “000” code to about 16 percent of its 2210 IT  management positions. Further, along with its comments on the draft  report, in January 2019, the department provided a report indicating  that Energy had not assigned the “000” work role code to its positions  in the 2210 IT management occupation series. We plan to take follow- up steps to verify the completeness of the department’s actions.

In addition to the aforementioned comments, Energy provided  technical comments, which we have incorporated into this report, as  appropriate.

In written comments (reprint in appendix IX), HHS concurred with our  recommendation and outlined steps to identify, review, and make  necessary corrections to its 2210 IT management positions that were  coded as “000.”

In written comments (reprinted in appendix X), DHS concurred with  our recommendation. The department stated that personnel in its  Office of the Chief Human Capital Officer had established processes  for periodically reviewing cybersecurity workforce coding data and for  collaborating with components to ensure positions with significant  responsibilities associated with the NICE framework—including 2210  positions—were properly coded.

Nevertheless, DHS expressed concern with our finding that it had  miscategorized the work roles for some positions. The department  stated that its position descriptions are often written in a generalized  format, and are static, baseline, point-in-time documents. The  department added that, several positions may align with the same  position description, yet have specific duties and content captured in  other human capital documents such as employee performance  plans. Thus, some positions may have the same position description  yet require different cybersecurity codes.

While we agree that position descriptions do not detail every possible  activity, according to OPM, the position descriptions should document  the major duties and responsibilities of a position. However, we  found that DHS did not always assign codes consistent with major  duties and responsibilities described in the position descriptions. For  example, the department assigned a Network Operational Specialist  code to a position with major duties associated with a Cyber  Instructional Curriculum Developer. The department did not provide  evidence that the positions we evaluated as inconsistently coded were  accurately coded. If work role codes are not consistent with position  descriptions, DHS may not have reliable information to form a basis  for effectively examining its cybersecurity workforce, improving  workforce planning, and identifying its workforce roles of critical need.

The department also provided technical comments, which we have  incorporated into this report as appropriate.

In comments provided via email on February 14, 2019, an audit  liaison officer in HUD’s Office of the Chief Human Capital Officer  stated that the department agreed with our recommendation.

In written comments (reprinted in appendix XI), Interior concurred with  our recommendation and stated that it had taken steps to change the  designation of the “000” code for the remaining personnel in the 2210  IT management occupational series.

In comments provided via email on February 4, 2019, an audit liaison  specialist in Justice’s Management Division stated that the  department concurred with the two recommendations.

In written comments (reprinted in appendix XII), Labor concurred with  our recommendation and stated that it had taken steps to review and  code the department’s 2210 IT positions using the NICE framework.

In written comments (reprinted in appendix XIII), State concurred with  our recommendation. The department said  that it will conduct a  comprehensive review of its 2210 positions and include instructions to  change the coding of any such positions that have been assigned a  “000” code. In addition, the department stated that it had created a  new business rule in its human resources system to ensure that 2210  positions are assigned a primary work role code.

In comments provided via email on December 20, 2018, an audit  relations analyst in Transportation’s Office of the Secretary stated via  email that the department concurred with our findings and  recommendation.

In written comments (reprinted in appendix XIV), VA concurred with  our recommendation and stated that the department had begun  conducting a review of its cyber coding.

In written comments (reprinted in appendix XV), EPA concurred with  our two recommendations to the agency. With regard to our  recommendation that it complete the identification and coding of  vacant positions performing IT cybersecurity or cyber-related  functions, EPA stated that it would update its standard operating  procedures to include the requirement to code vacant positions during  the position classification process. Nevertheless, while including this  requirement in the procedures is an important step, it is imperative  that the agency implement the procedures to ensure that its vacant  positions are assigned appropriate work role codes.

With regard to our recommendation that the agency review the  assignment of the “000” code to its 2210 IT management occupation  series, EPA stated that it would review all such positions and assign  the appropriate NICE framework codes to any positions that were  erroneously coded with the non-IT work role code.

In comments provided via email on January 31, 2019, the Director of  the Human Capital Policy and Programs Division stated that GSA  agreed with our two recommendations. Also, in written comments  (reprinted in appendix XVI), GSA stated that, once it completes the  ongoing transition to a position-based human resources system, it will  explore options to include vacant positions in its new system. In  addition, GSA stated that it had completed an initial review of cyber  codes and indicated that it would update all coding by March 2019.

In written comments (reprinted in appendix XVII), NRC agreed with  the findings in our draft report and said it had taken actions to address  our recommendation by assigning appropriate work role codes to IT  management positions previously assigned a “000” code.

In written comments (reprinted in appendix XVIII), OPM concurred  with our recommendation to the agency. OPM stated that its human  resources and subject matter experts plan to assess the assignment  of “000” codes to personnel in the 2210 IT management occupation  series to help ensure accurate coding and appropriate application of  the NICE framework work role codes.

In written comments (reprinted in appendix XIX), SBA concurred with  our recommendation. The agency stated that its Office of the Chief  Information Officer, Office of Human Resources Solutions, and  appropriate program offices would review the assignment of the “000”  code to any 2210 IT management occupation series positions and  assign the appropriate NICE framework role codes. The agency also  provided technical comments, which we have incorporated into this  report as appropriate.

In written comments (reprinted in appendix XX), SSA agreed with our  recommendation and stated that it had taken steps to complete the  assignment of codes to the remaining 2210 IT management positions.

In addition, one agency partially agreed with the recommendations in our  report. In comments provided via email on February 15, 2019, the Acting  Director for Treasury’s Office of Human Capital Strategic Management  stated that the department partially concurred with our recommendation  that it review the assignment of “000” codes. According to the Acting  Director, the Deputy Assistant Secretary for Human Resources and Chief  Human Capital Officer had issued guidance to all Treasury Bureaus to  validate the coding of 2210 IT management positions.

However, Treasury did not agree with our finding that positions in the  area of cryptographic key management could be aligned to the NICE  framework work role code for the Communications Security Manager. The  official stated that the cryptographic key management functions did not  completely align with any of the NICE framework work roles.

We acknowledge that there may be positions that do not completely align  with work roles described in the NICE framework. However, according to  OPM, the framework currently covers a broad array of functions that  describe the majority of IT, cybersecurity, and cyber-related work. As  noted in our report, OPM officials told us that they would expect agencies  to assign a NICE work role code to 2210 IT management positions, with a  few exceptions, such as in cases where a position’s duties did not align  with a NICE work role code. As such, we maintain that Treasury likely  miscategorized over 1,300 IT management positions by assigning a “000”  code to them, designating those positions as not performing IT,  cybersecurity, or cyber-related work and, thus, should review these  positions and assign the appropriate work role codes.

Further, one agency did not agree with one of the two recommendations  directed to it. Specifically, in written comments (reproduced in appendix  XXI) NASA stated that it concurred with our recommendation to review  the assignment of “000” codes to 2210 IT management positions. In this  regard, the agency stated that it would complete a review of the  assignment of “000” codes to 2210 IT management positions and assign  the appropriate NICE framework work role codes.

NASA did not concur with our other recommendation to complete the  identification and coding of vacant positions performing IT, cybersecurity,  or cyber-related functions. The agency stated that it had met the intention  of the recommendation with existing NASA processes that assign a code  at the time a vacancy is identified. However, the agency’s workforce  planning process is decentralized and the agency previously noted that it  did not track vacancies.

We maintain that the Federal Cybersecurity Workforce Assessment Act  requires agencies to identify and code vacant positions and that NASA  could compile necessary information from components to identify and  code vacant IT, cybersecurity, and cyber-related positions. These efforts  would provide important information about vacant IT, cybersecurity, and  cyber-related positions across the agency to enhance NASA’s workforce  planning. Thus, we continue to believe that our recommendation is  warranted.

In addition, of the two agencies to which we did not make  recommendations, one agency—USAID—provided a letter (reprinted in  appendix XXII) acknowledging its review of the report and the other  agency—NSF—provided technical comments, which we have  incorporated into the report as appropriate.

We are sending copies of this report to interested congressional  committees, the Director of the Office of Management and Budget, the  secretaries and agency heads of the departments and agencies  addressed in this report, and other interested parties. In addition, this  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you have any questions regarding this report, please contact me at  (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix XXIII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the extent to which federal agencies  have assigned work role codes to positions performing information  technology (IT), cybersecurity, or cyber-related functions, and (2)  describe the steps federal agencies took to identify work roles of critical  need. The scope of our review included the 24 major departments and  agencies covered by the Chief Financial Officers (CFO) Act of 1990.

To address our objectives, we reviewed the provisions of the Federal  Cybersecurity Workforce Assessment Act of 2015 and assessed the  workforce planning actions taken by the Office of Personnel Management  (OPM) and the other 23 CFO Act agencies against the selected four  activities required by the act.

To evaluate the four selected activities of the act and objectives 1 and 2,  we reviewed the National Initiative for Cybersecurity Education (NICE)  Cybersecurity Workforce Framework and OPM’s cybersecurity coding  structure and guidance. The guidance provided information on how  agencies should identify and assign work role codes to IT, cybersecurity,  and cyber-related positions. We also designed and administered a  questionnaire to each of the 24 agencies regarding their efforts to identify and assign work role codes to IT, cybersecurity, or cyber-related  positions, and identify work roles of critical need. In developing the  questionnaire, we took steps to ensure the accuracy and reliability of  responses. We pre-tested the questionnaire with OPM and the  Department of Homeland Security (DHS) officials to ensure that the  questions were clear, comprehensive, and unbiased, and to minimize the  burden the questionnaire placed on respondents. We also asked the chief  information officer and the chief human capital officer of each agency to  certify that they reviewed and validated the responses to the  questionnaires.

We administered the questionnaire between June and October 2018. We  received completed questionnaires from each of the 24 agencies, for a  response rate of 100 percent. We examined the questionnaire results and  performed computer analyses to identify missing data, inconsistencies,  and other indications of error, and addressed such issues as necessary,  including through follow-up communications with the 24 agencies. We  reviewed and analyzed the agencies’ responses to the questionnaire in  comparison to the act’s requirements and OPM’s and NICE’s guidance.  We also obtained, reviewed, and analyzed supporting documentation of  questionnaire responses, such as reports of cybersecurity employment  code data, to assess whether agencies assigned work role codes in  accordance with the activities in OPM’s coding guidance, by April 2018.

Further, to analyze how federal agencies assigned work role codes to  positions performing IT, cybersecurity, or cyber-related functions, we  obtained IT, cybersecurity, or cyber-related workforce coding data for the  24 agencies from OPM’s Enterprise Human Resources Integration  system. To assess the reliability of coding data from OPM’s system, we  reviewed these data to determine its completeness, and asked officials  responsible for entering and reviewing the work role coding data a series  of questions about the accuracy and reliability of the data. In addition, we  examined the Enterprise Human Resources Integration IT, cybersecurity,  or cyber-related coding data to determine the number of positions the 24  agencies had assigned the “000” code to positions in the 2210 IT  management occupational series as of May 2018. We reviewed  positions from the 2210 IT management occupational series because  those positions are likely to perform IT, cybersecurity, or cyber-related  functions. In the report, we note some challenges with the reliability of  these data and are careful to present our data in line with these  limitations.

We then identified a subset of the 24 agencies and performed an  additional review of these agencies’ work role coding efforts. We selected  these agencies based on their total cybersecurity spending for fiscal year  2016, as reported by the Office of Management and Budget (OMB) in its  Federal Information Security Modernization Act annual report. We sorted  the 24 agencies’ IT cybersecurity spending from highest to lowest and  then divided them into three equal groups of high, medium, and low. We  then selected the top two agencies from each group. Based on these  factors, we selected six agencies: the (1) Department of Defense (DOD),  (2) DHS, (3) Department of State (State), (4) National Aeronautics and  Space Administration (NASA), (5) Environmental Protection Agency  (EPA), and (6) General Services Administration (GSA).We performed an  additional review of the agencies’ work role coding efforts. We did this by  evaluating the six selected agencies’ coding processes against their  established procedures and OPM requirements. We also obtained and  reviewed coding data that included the assigned work role codes for  civilian employees from each agency’s human resources system.

To assess the reliability of coding data from the selected six agencies’  systems, we reviewed related documentation such as the agencies’  coding procedures, processing guides, personnel bulletins, and system  screen shots. We also conducted electronic testing for missing data,  duplicate data, or obvious errors. In addition, we asked officials  responsible for entering and reviewing the work role coding data a series  of questions about the accuracy and reliability of the data. For any  anomalies in the data, we followed up with the six selected agencies’  offices of the chief information officer and chief human capital officer to  either understand or correct those anomalies. Further, we assessed the  reliability of data in terms of the extent to which codes were completely  assigned and reasonably accurate. In the report, we note some  challenges with the reliability of these data and are careful to present our  data in line with these limitations.

We randomly selected a sample of 20 positions from each of the six  selected agencies (120 total positions) within the 2210 IT management  occupational series. We reviewed positions from the IT management  2210 series because those positions are likely to perform IT,  cybersecurity, or cyber-related functions. For the selected positions, we  requested position descriptions and reviewed whether the position work  role codes in the coding data were consistent with the corresponding  position description text. We also selected a second nonstatistical sample  of 12 positions for each of the six agencies (72 total positions) from the  2210 IT management occupational series based on pairs of positions that  had identical position titles, occupational series, and sub-agencies, but for  which the agencies had assigned different work role codes for the  positions. An analyst reviewed the work role coding data and compared  them to the duties described by the position descriptions to determine  whether they were consistent with the position duties. A second analyst  verified whether or not the position’s work role code was consistent with  the position description. A third analyst adjudicated cases in which the  first and second analysts’ evaluations did not match.

Lastly, to evaluate agencies’ actions to address the last three activities of  the act related to the identification of cybersecurity work roles of critical  need, we obtained, reviewed, and analyzed OPM’s guidance for  identifying critical needs and its progress report to Congress by  comparing it to the act’s requirements. We reviewed agencies’  responses to our questionnaire regarding whether they had developed  methodologies or project plans for identifying critical needs. We also  reviewed any available documentation on the 24 agencies’ progress in  identifying critical needs, such as project plans, timelines, and preliminary  reports. In addition, OPM required agencies to submit a preliminary report  on work roles of critical need by August 31, 2018. We obtained copies  of the preliminary reports from the 24 agencies. We evaluated agencies’  efforts to meet the deadline, as well as for meeting OPM’s requirements  for documenting work roles of critical need and determining root causes  of those needs.

To supplement our analysis, we interviewed agency officials from human  resources and chief information officer offices at the 24 agencies  regarding their progress in coding and identifying cybersecurity work roles  of critical need.

Appendix II: Office of Personnel Management Information Technology, Cybersecurity, and Cyber-related Work Role Codes

Appendix III: Summary of 24 Chief Financial Officers Act Agencies’ Implementation of the Federal Cybersecurity Workforce Assessment Act of 2015, as of Nov. 2018

Appendix IV: Top 12 Work Roles of Critical Need as Identified by the 24 Chief Financial Officers (CFO) Act Agencies in Their Preliminary Reports of Critical Need

Appendix V: Comments from the Department of Commerce

Appendix VI: Comments from the Department of Defense

Appendix VII: Comments from the Department of Education

Appendix VIII: Comments from the Department of Energy

Appendix IX: Comments from the Department of Health and Human Services

Appendix X: Comments from the Department of Homeland Security

Appendix XI: Comments from the Department of the Interior

Appendix XII: Comments from the Department of Labor

Appendix XIII: Comments from the Department of State

Appendix XIV: Comments from the Department of Veterans Affairs

Appendix XV: Comments from the Environmental Protection Agency

Appendix XVI: Comments from the General Services Administration

Appendix XVII: Comments from the Nuclear Regulatory Commission

Appendix XVIII: Comments from the Office of Personnel Management

Appendix XIX: Comments from the Small Business Administration

Appendix XX: Comments from the Social Security Administration

Appendix XXI: Comments from the National Aeronautics and Space Administration

Appendix XXII: Comments from the United States Agency for International Development

Appendix XXIII: GAO Contact and Staff Acknowledgments

In addition to the individual named above, Tammi Kalugdan (Assistant  Director), Merry Woo (Analyst-in-Charge), Carlos (Steven) Aguilar,  Alexander Anderegg, Christina Bixby, Carl Barden, Chris Businsky,  Virginia Chanley, Cynthia Grant, Paris Hawkins, Lee Hinga, James  (Andrew) Howard, Assia Khadri, David Plocher, Steven Putansu, and  Priscilla Smith made significant contributions to this report.

The federal government needs a qualified, well-trained cybersecurity workforce to protect vital IT systems. Not having enough of these workers is one reason why securing federal systems is on our High Risk list.

To help agencies identify their critical workforce needs, they were required to identify and categorize all of their IT and cyber-related positions.

However, most of the agencies we reviewed likely miscategorized the work involved in many positions. For example, 22 of 24 agencies assigned a "non-IT" code to 15,779 (about 19%) of their IT positions.

We recommended agencies improve how they track and code their IT and cyber workforce.