Cybersecurity Workforce: DHS Needs to Take Urgent Action to Identify Its Position and Critical Skill Requirements

DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs.

GAO was asked to testify on the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. To do so, GAO summarized the findings discussed in its February 2018 report on DHS's cybersecurity workforce ( GAO-18-175 ).

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS did not complete efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions.

In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to Congress on its departmentwide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table).

Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its cybersecurity positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.

In its February 2018 report, GAO recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed. DHS concurred with the six recommendations and described actions the department plans to take to address them.

Thank you for the opportunity to appear at today’s hearing to discuss the  Department of Homeland Security’s (DHS) efforts to strengthen its  cybersecurity workforce. In its important role of securing the nation’s  cyberspace, DHS is responsible for protecting the confidentiality, integrity,  and availability of its own computer systems and information, and for  leading the coordination with partners in the public and private sectors to  protect the computer networks of federal civilian agencies and the  nation’s critical infrastructure from threats. As such, having an effective  cybersecurity workforce is essential to accomplishing the department’s  mission.

Toward ensuring that it has an effective workforce, the Homeland  Security Cybersecurity Workforce Assessment Act of 2014 (hereafter  referred to as “the act”) required DHS to identify all cybersecurity  workforce positions within the department, determine the cybersecurity  work category and specialty area of such positions, and assign the  corresponding employment code to each cybersecurity position. The act  also required DHS to identify and report on its cybersecurity workforce  areas of critical need.

In addition to the aforementioned requirements for DHS, the act included  a provision for GAO to analyze and monitor the department’s efforts to  address its requirements. My testimony today provides an overview of our  recently issued (February 2018) report, Cybersecurity Workforce: Urgent  Need for DHS to Take Actions to Identify Its Position and Critical Skill  Requirements, based on our review of the its efforts.

In preparing this statement, we relied on our work supporting the  February report. This work included comparing the department’s actions  to identify, categorize, and assign employment codes to its cybersecurity  positions and to identify its cybersecurity workforce areas of critical need  with the required activities specified in the act. We analyzed that  information, including data on the coding of cybersecurity workforce  positions, and also administered a data collection instrument to six  components of DHS. Further, we interviewed relevant officials from the  DHS Office of Chief Human Capital Officer (OCHCO) and from the  selected DHS components. We also interviewed relevant officials at the  Office of Personnel Management (OPM).

The work on which this statement is based was conducted in accordance  with generally accepted government auditing standards, which require  audits to be planned and performed to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides such a reasonable basis for our findings and conclusions based  on our audit objectives.

DHS leads the federal government’s efforts to secure our nation’s public  and private critical infrastructure information systems against cyber  threats. As part of these efforts, cybersecurity professionals can help to  prevent or mitigate the vulnerabilities that could allow malicious  individuals and groups access to federal information technology (IT)  systems. The ability to secure federal systems depends on the  knowledge, skills, and abilities of the federal and contractor workforce that  designs, develops, implements, secures, maintains, and uses these  systems.

The Office of Management and Budget has noted that the federal  government and private industry face a persistent shortage of  cybersecurity and IT talent to implement and oversee information security  protections. This shortage may leave federal IT systems vulnerable to  malicious attacks. Experienced and qualified cybersecurity professionals  are essential in performing DHS’s work to mitigate vulnerabilities in its  own and other agencies’ computer systems and to defend against cyber  threats.

Since 1997, we have identified the protection of federal information  systems as a governmentwide high-risk area. In addition, in 2001, we  introduced strategic governmentwide human capital management as  another area of high risk. We have also identified a number of  challenges federal agencies are facing to ensure that they have a  sufficient cybersecurity workforce with the skills necessary to protect their  information and networks from cyber threats. These challenges pertain  to identifying and closing skill gaps as part of a comprehensive workforce  planning process, recruiting and retaining qualified staff, and navigating  the federal hiring process.

Federal Initiative and Guidance Are Intended to Improve Cybersecurity Workforces

In recent years, the federal government has taken various steps aimed at  improving the cybersecurity workforce. These include establishing a  national initiative to promote cybersecurity training and skills and  developing guidance to address cybersecurity workforce challenges.

Founded in 2010, the National Initiative for Cybersecurity Education  (NICE) is a partnership among government, academia, and the private  sector, and is coordinated by the National Institute of Standards and  Technology (NIST). The NICE mission promotes cybersecurity education,  training, and workforce development in coordination with its partners. The  initiative’s goal is to increase the number of skilled cybersecurity  professionals in order to boost national IT security.

In 2013, NICE published the National Cybersecurity Workforce  Framework to provide a consistent way to define and describe  cybersecurity work at any public or private organization, including federal  agencies. In 2014, OPM developed guidance for assigning 2-digit  employment codes for each cybersecurity work category and specialty  area identified in the 2013 NICE framework. Federal agencies can use  the codes to identify cybersecurity positions in personnel and payroll  systems, such the system of the National Finance Center.

To further enhance efforts to strengthen the cybersecurity workforce,  NICE subsequently revised the framework in 2017 to include 33  cybersecurity-related specialty areas organized into 7 categories— securely provision, operate and maintain, protect and defend, investigate,  collect and operate, analyze, and oversee and govern. The revision  defined work roles in specialty areas and cybersecurity tasks for each  work role, as well as the knowledge, skills, and abilities that a person  should have in order to perform each work role. Also, in 2017, OPM  issued guidance creating a unique 3-digit employment code for each  cybersecurity work role. In October 2017, NIST issued guidance that  reflected the finalized 2017 NICE framework and included a crosswalk of  OPM’s 2-digit employment codes to the 3-digit codes.

DHS’s Cybersecurity Workforce Performs a Wide Range of Critical Missions

DHS is the third largest department in the federal government, employing  approximately 240,000 people, and operating with an annual budget of  about $60 billion, of which about $6.4 billion was reportedly spent on IT in  fiscal year 2017. In leading the federal government’s efforts to secure our  nation’s public and private critical infrastructure information systems, the  department, among other things, collects and shares information related  to cyber threats and cybersecurity risks and incidents with other federal  partners to enable real-time actions to address these risks and incidents.

The department is made up of 15 operational and support components  that perform its critical mission functions. Table 1 describes the 6  components that we included in our review.

DHS Is Required to Assess Its Cybersecurity Workforce

The Homeland Security Cybersecurity Workforce Assessment Act of  2014 required DHS to perform workforce assessment-related activities to  identify and assign employment codes to its cybersecurity positions.  Specifically, the act called for DHS to:  1.  Establish procedures for identifying and categorizing cybersecurity  positions and assigning codes to positions (within 90 days of law’s  enactment).  2.  Identify all filled and vacant positions with cybersecurity functions and  determine the work category and specialty area of each.  3.  Assign OPM 2-digit employment codes to all filled and vacant  cybersecurity positions based on the position’s primary cybersecurity  work category and specialty areas, as set forth in OPM’s Guide to  Data Standards.

In addition, after completing the aforementioned activities, the act called  for the department to take steps to identify and report its cybersecurity  workforce areas of critical need. Specifically, DHS was to:  4.  Identify the cybersecurity work categories and specialty areas of  critical need in the department’s cybersecurity workforce and report to  Congress.  5.  Submit to OPM an annual report through 2021 that describes work  categories and specialty areas of critical need and substantiates the  critical need designations.

The act required DHS to complete the majority of these activities by  specific due dates between March 2015 and September 2016.

Within DHS, OCHCO is responsible for carrying out these provisions,  including the coordination of the department’s overall efforts to identify,  categorize, code, and report its cybersecurity workforce assessment  progress to OPM and Congress.

DHS Has Not Fully Identified Cybersecurity Positions or Assigned Employment Codes in a Complete and Reliable Manner

The act required DHS to establish procedures to identify and assign the  appropriate employment code, in accordance with OPM’s Guide to Data  Standards, to all filled and vacant positions with cybersecurity functions  by March 2015. In addition, DHS’s April 2016 Cybersecurity Workforce  Coding guidance states that components should ensure procedures are  in place to monitor and to update the employment codes as positions  change over time.

Further, the Standards for Internal Control in the Federal Government  recommends that management assign responsibility and delegate  authority to key roles and that each component develop individual  procedures to implement objectives. The standards also recommend that  management periodically review such procedures to see that they are  developed, relevant, and effective.

DHS OCHCO developed departmental procedures in May 2014 and  recommended implementation steps for coding positions with  cybersecurity functions for the department’s components. However,  OCHCO did not update its procedures to include information on  identifying positions and assigning codes until April 2016—13 months  after the due date specified by the act.

In addition, the procedures were not complete because they did not  include information related to identifying and coding vacant positions, as  the act required. Moreover, the departmental procedures did not identify  the individual within each DHS component who was responsible for  leading and overseeing the identification and coding of the component’s  cybersecurity positions.

Further, although components were able to supplement the departmental  procedures by developing their own component-specific procedures for  identifying and coding their cybersecurity positions, OCHCO did not  review those procedures for consistency with departmental guidance. The  department could not provide documentation that OCHCO had verified or  reviewed component-developed procedures. In addition, OCHCO officials  acknowledged that they had not reviewed the components’ procedures  and had not developed a process for conducting such reviews.

OCHCO officials stated that several factors had limited their ability to  develop the procedures and to review component-developed procedures  in a timely and complete manner. These factors were (1) a delayed  departmental decision until April 2016 as to whether certain positions  should be considered cybersecurity positions; (2) a belief that each  component had the best understanding of their human capital systems,  so procedure development was best left up to each component; (3) a  condition where each of the six selected DHS components recorded and  tracked vacant positions differently; and (4) cybersecurity specialty areas  for vacant positions were not known until a position description was  developed or verified and a hiring action was imminent. Without  assurance that procedures are timely, complete, and reviewed, DHS  cannot be certain that its components have the procedures to identify and  code all positions with cybersecurity functions, as required by the act.

Accordingly, our February 2018 report included recommendations that  DHS 1) develop procedures on how to identify and code vacant  cybersecurity positions, 2) identify the individual in each component who  is responsible for leading that component’s efforts in identifying and  coding cybersecurity positions, and 3) establish and implement a process  to periodically review each component’s procedures for identifying  component cybersecurity positions and maintaining accurate coding.  DHS concurred with the recommendations and stated that it would  implement them by April 30, 2018.

DHS Has Not Yet Completed Required Identification Activities

The act required DHS to identify all of its cybersecurity positions,  including vacant positions, by September 2015. Further, the act called for  the department to use OPM’s Guide to Data Standards to categorize the  identified positions and determine the work category or specialty area of  each position.

As of December 2016, the department reported that it had identified  10,725 cybersecurity positions, including 6,734 federal civilian positions,  584 military positions, and 3,407 contractor positions. Nevertheless, as  of November 2017, the department had not completed identifying all of its  cybersecurity positions and it had not determined the work categories or  specialty areas of the positions. In explaining why the department had not  identified all its positions, OCHCO officials stated that components varied  in reporting their identified vacant positions because the department did  not have a system to track vacancies.

Of the 7 work categories and 33 specialty areas in the NICE framework,  DHS reported that its 3 most common work categories were “protect and  defend”, “securely provision,” and “oversight and development;” and its 2  most common specialty areas were “security program management” and  “vulnerability assessment and management.” However, DHS could not  provide data to show the actual numbers of positions in each of these  categories and specialty areas.

According to OCHCO officials, the department was still in the process of  identifying positions for the 2-digit codes and would continue this effort  until the 3-digit codes were available in the National Finance Center  personnel and payroll system in December 2017. At that time, OCHCO  officials stated that the department intends to start developing procedures  for identifying and coding positions using the 3-digit codes.

DHS Has Not Completely and Accurately Assigned Employment Codes

The act also required DHS to assign 2-digit employment codes to all of its  identified cybersecurity positions. This action was to be completed by  September 2015.

However, as of August 2017—23 months after the due date—the  department had not completed the coding assignment process. Although,  in August 2017, OPM provided a progress report to Congress containing  DHS data which stated that 95 percent of DHS-identified cybersecurity  positions had been coded, our analysis determined that the department  had assigned cybersecurity position codes to approximately 79 percent of  its identified federal civilian cybersecurity positions. The primary reason  for this discrepancy was that DHS did not include the coding of vacant  positions, as required by the act. Further, OCHCO officials stated they did  not verify the accuracy of the components’ cybersecurity workforce data.  Without coding cybersecurity positions in a complete and accurate  manner, DHS will not be able to effectively examine its cybersecurity  workforce; identify skill gaps; and improve workforce planning.

Thus, in our recently issued report, we recommended that OCHCO collect  complete and accurate data on all filled and vacant cybersecurity  positions when it conducts its cybersecurity identification and coding  efforts. DHS concurred with the recommendation and stated that, by June  29, 2018, it intends to issue memorandums to its components that  provide instructions for the components to periodically review compliance  and cybersecurity workforce data concerns to ensure data accuracy.

DHS Has Not Identified or Reported Its Cybersecurity Workforce Areas of Critical Need

According to the act, DHS was to identify its cybersecurity work  categories and specialty areas of critical need in alignment with the NICE  framework and to report this information to the appropriate congressional  committees by June 2016. In addition, a DHS directive required the DHS  Chief Human Capital Officer to provide guidance to the department’s  components on human resources procedures, including identifying  workforce needs.

As of February 2018, the department had not fulfilled its requirements to  identify and report its critical needs. Although DHS identified workforce  skills gaps in a report that it submitted to congressional committees in  March 2017, the department did not align the skills gaps to the NICE  framework’s defined work categories and specialty areas of critical need.

In September 2017, OCHCO developed a draft document that attempted  to crosswalk identified department-wide cybersecurity skills gaps to one  or more specialty areas in the NICE framework. However, the document  did not adequately help components identify their critical needs by  aligning their gaps with the NICE framework because it did not provide  clear guidance to help components determine a critical need in cases in  which a skills gap is mapped to multiple work categories.

According to OCHCO officials, DHS had not identified department-wide  cybersecurity critical needs that aligned with the framework partly  because OPM did not provide DHS with guidance for identifying  cybersecurity critical needs. In addition, OCHCO officials stated that the  components did not generally view critical skills gaps in terms of the  categories or specialty areas as defined in the NICE framework, but  instead, described their skills gaps using position titles that are familiar to  them. In the absence of relevant guidance to help components identify  their critical needs, DHS and the components are hindered from  effectively identifying and prioritizing workforce efforts to recruit, hire,  train, develop, and retain cybersecurity personnel.

DHS also did not report cybersecurity critical needs to OPM in September  2016 or September 2017, as required. Instead, the department first  reported its cybersecurity coding progress and skills gaps in a March  2017 report that it sent to OPM and Congress to address several of the  act’s requirements. However, the report did not describe or substantiate  critical need designations because DHS has not yet identified them.

Additionally, DHS had not developed plans or time frames to complete  priority actions—developing a DHS cybersecurity workforce strategy and  completing its initial cybersecurity workforce research— that OCHCO  officials said must be completed before it can report its cybersecurity  critical needs to OPM. According to OCHCO officials, the report that the  department submitted to Congress in March 2017 had contained plans  and schedules. However, we found that the March 2017 report did not  capture and sequence all of the activities that DHS officials said must be  completed in order to report critical needs. Until DHS develops plans and  schedules with time frames for reporting its cybersecurity critical needs,  DHS may not have insight into its needs for ensuring that it has the  workforce necessary to carry out its critical role of helping to secure the  nation’s cyberspace.

In our report, we recommended that DHS 1) develop guidance to assist  DHS components in identifying their cybersecurity work categories and  specialty areas of critical need that align to the NICE framework and 2)  develop plans with time frames to identify priority actions to report on  specialty areas of critical need. DHS concurred with the  recommendations and stated that it plans to implement them by June  2018.

In summary, DHS needs to act now to completely and accurately identify,  categorize, and assign codes to all of its cybersecurity positions, and to  identify and report on its cybersecurity workforce areas of critical need.  Implementing the six recommendations we made in our February 2018  report should better position the department to meet the requirements of  the 2014 act. Further, doing so will help DHS understand its needs for  recruiting, hiring, developing, and retaining a cybersecurity workforce with  the skills necessary to accomplish the department’s varied and essential  cybersecurity mission. Until DHS implements our recommendations, it  will not be able to ensure that it has the necessary cybersecurity  personnel to help protect the department’s and federal networks and the  nation’s critical infrastructure from cyber threats.

Chairmen Ratcliffe and Perry, Ranking Members Richmond and Correa,  and Members of the Subcommittees, this concludes my statement. I  would be pleased to respond to your questions.

If you or your staffs have any questions about this testimony, please  contact Gregory C. Wilshusen at (202) 512-6244 or  wilshuseng@gao.gov, or Chris P. Currie at (404) 679-1875 or  curriec@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement.

GAO staff who made key contributions to this testimony are Alexander  Anderegg, Ben Atwater, David Blanding, Jr., Chris Businsky, Wayne  Emilien, Jr., Nancy Glover, David Hong, Tammi Kalugdan, David Plocher,  Luis E. Rodriguez, and Priscilla Smith.

GAO, Cybersecurity: Federal Efforts Are Under Way That May Address  Workforce Challenges, GAO-17-533T (Washington, D.C.: Apr. 4, 2017).

GAO, Information Security: DHS Needs to Continue to Advance Initiatives  to Protect Federal Systems, GAO-17-518T (Washington, D.C.: Mar. 28,  2017).

GAO, High-Risk Series: Progress on Many High-Risk Areas, While  Substantial Efforts Needed on Others, GAO-17-317 (Washington, D.C.:  Feb. 15, 2017).

GAO, Cybersecurity: Actions Needed to Strengthen U.S. Capabilities,  GAO-17-440T (Washington, D.C.: Feb. 14, 2017).

GAO IT Workforce: Key Practices Help Ensure Strong Integrated  Program Teams; Selected Departments Need to Assess Skill Gaps,  GAO-17-8 (Washington, D.C.: Nov. 30, 2016).

GAO, Federal Chief Information Security Officers: Opportunities Exist to  Improve Roles and Address Challenges to Authority, GAO-16-686  (Washington, D.C.: Aug. 26, 2016).

GAO, Federal Hiring: OPM Needs to Improve Management and Oversight  of Hiring Authorities, GAO-16-521 (Washington, D.C.: Aug. 2, 2016).

GAO, Information Security: DHS Needs to Enhance Capabilities, Improve  Planning, and Support Greater Adoption of Its National Cybersecurity  Protection System, GAO-16-294 (Washington, D.C.: Jan. 28, 2016).

GAO, Federal Workforce: OPM and Agencies Need to Strengthen Efforts  to Identify and Close Mission-Critical Skills Gaps, GAO-15-223  (Washington, D.C.: Jan. 30, 2015).

GAO, Cybersecurity Human Capital: Initiatives Need Better Planning and  Coordination, GAO-12-8 (Washington, D.C.: Nov. 29, 2011).

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.