Background Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and  electronic data to carry out operations and to process, maintain, and  report essential information. The information systems and networks that  support federal operations are highly complex and dynamic,  technologically diverse, and often geographically dispersed. This  complexity increases the difficulty in identifying, managing, and protecting  the myriad of operating systems, applications, and devices comprising the  systems and networks. Cybersecurity professionals can help to prevent or mitigate the  vulnerabilities that could allow malicious individuals and groups access to  federal information technology (IT) systems. The ability to secure federal  systems depends on the knowledge, skills, and abilities of the federal and  contractor workforce that designs, develops, implements, secures,  maintains, and uses these systems. This includes federal and contractor  employees who use the systems in the course of their work, as well as  the designers, developers, programmers, and administrators of the  programs and systems. However, the Office of Management and Budget has noted that the  federal government and private industry face a persistent shortage of  cybersecurity and IT talent to implement and oversee information security  protections to combat cyber threats. This shortage of cybersecurity  professionals makes securing the nation’s networks more challenging and  may leave federal IT systems vulnerable to malicious attacks. Having  experienced and qualified cybersecurity professionals is important for  DHS to help mitigate vulnerabilities in its own and other agencies’  computer systems as a result of cyber threats. Federal Initiative and  Guidance Are Intended to  Improve Cybersecurity  Workforces In recent years, the federal government has taken various steps aimed at  improving the cybersecurity workforce. These include establishing a  national initiative to promote cybersecurity training and skills and  developing guidance to address cybersecurity workforce challenges. The National Initiative for Cybersecurity Education (NICE): This  initiative, which began in March 2010, is a partnership among  government, academia, and the private sector. It is coordinated by the  National Institute of Standards and Technology (NIST) to help  improve cybersecurity education. According to NICE, its mission  includes promoting cybersecurity education, training, and workforce  development, and coordinating with government, academic, and  industry partners to build on existing successful programs and  facilitate change and innovation. The initiative’s goal is to increase the  number of skilled cybersecurity professionals in order to boost  national IT security. National Cybersecurity Workforce Framework: In April 2013, NICE  published the National Cybersecurity Workforce Framework, which is  intended to provide a consistent way to define and describe  cybersecurity work at any public or private organization, including  federal agencies. The initial framework defined 31 cybersecurity- related specialty areas that were organized into 7 categories. In  August 2017, the framework was revised to include 33 cybersecurity- related specialty areas. The 7 categories are: securely provision,  operate and maintain, protect and defend, investigate, collect and  operate, analyze, and oversee and govern. For example, in the  oversee and govern category, a specialty area is cybersecurity  management, which covers the management of personnel,  infrastructure, policy, and security awareness. Further, in the protect  and defend category, the vulnerability assessment and management  specialty area covers conducting assessments of threats and  vulnerabilities and recommending appropriate mitigation  countermeasures in order to protect information systems from threats. In August 2017, NIST also revised the framework to define work roles  within each specialty area and describe cybersecurity tasks for each  work role. The revision also described the knowledge, skills, and  abilities that a person should have in order to perform each work  role. The revised framework is intended to enable agencies to  examine specific IT and cybersecurity-related work roles and identify  personnel skills gaps. OPM Guidance for Assigning Employment Codes to  Cybersecurity Positions: OPM sets data standards for federal job  classifications, including cybersecurity positions. The data standards,  issued by OPM in November 2014 created a 2-digit employment code  for each work category and specialty area defined in the initial 2013  NICE cybersecurity workforce framework. Federal agencies use the  codes to identify cybersecurity positions in personnel systems, such  as the National Finance Center’s personnel and payroll system.  According to OPM, assigning codes to federal cybersecurity positions  is intended to lay the groundwork for a consistent governmentwide  count of the federal cybersecurity workforce. Use of these codes is  intended to enable OPM and federal agencies to more effectively  identify the cybersecurity workforce; determine baseline capabilities;  examine hiring trends; identify skill gaps; and recruit, hire, train,  develop, and retain an effective cybersecurity workforce. (See  appendix II for a description of the specialty areas defined in the NICE  Cybersecurity Workforce Framework and their corresponding OPM  codes). In January 2017, OPM issued new guidance to agencies for assigning  employment codes to cyber-related positions. This guidance created a  unique 3-digit employment code for each cybersecurity work role  identified in a draft version of the 2017 NICE cybersecurity workforce  framework. To enhance the recruiting and hiring of workers with  needed skills, agencies are to use the new 3-digit employment codes  to identify critical needs, and provide training and development  opportunities for cybersecurity personnel. In October 2017, NIST  issued guidance, which reflected the finalized 2017 NICE framework  and included a crosswalk of the 2-digit employment codes to the 3- digit employment codes. DHS’s Cybersecurity  Workforce Performs a  Wide Range of Critical  Missions DHS is the third largest department in the federal government, employing  approximately 240,000 people and with an annual budget of about $60  billion—$6.4 billion of which was spent on IT in fiscal year 2017. The  department leads the federal government’s efforts to secure our nation’s  public and private critical infrastructure information systems. For example,  DHS collects and shares information related to cyber threats and  cybersecurity risks and incidents with other federal partners to enable  real-time actions to address these risks and incidents. DHS is made up of 15 components: 7 front-line, or operational,  components, and 8 support components. The operational components  lead the department’s front-line activities to protect the nation, while the  support components are to provide the resources, analysis, equipment,  services, and other support to ensure that the operational components  have the tools and resources to accomplish the department’s mission.  The 15 operational and support components, including the 6 that we  reviewed, are identified in figure 1. The components perform a diverse range of cybersecurity functions.  These functions include combating cybercrime; responding to cyber  incidents; sharing cyber-related information, including threats and best  practices; providing cybersecurity training and education; and securing  both privately owned critical infrastructure and non-military federal  networks. The missions and cybersecurity functions for the six  components selected for our review are described in table 1. Federal Laws Require  DHS to Assess Its  Cybersecurity Workforce HSCWAA required DHS to perform several workforce assessment-related  activities. Specifically, the department was to:  1.  Establish procedures for identifying and categorizing cybersecurity  positions and assigning codes to those positions. This was to be done  within 90 days of the law’s enactment.  2.  Identify all positions with cybersecurity functions and determine the  work category and specialty areas of each position. DHS was required  to identify all cybersecurity positions—both filled and vacant—within  the department. In addition, it was to determine the cybersecurity work  category and specialty areas for each such position. Work categories  and specialty areas are defined in the NICE Cybersecurity Workforce  Framework.  3.  Assign codes to all filled and vacant cybersecurity positions. The  department was to assign the appropriate 2-digit employment code,  as set forth in OPM’s Guide to Data Standards, to each position  based on the position’s primary cybersecurity work category and  specialty areas. In addition, after completing the aforementioned activities, the department  was to:  4.  Identify the cybersecurity work categories and specialty areas of  critical need in the department’s cybersecurity workforce and report to  Congress.  5.  Submit to OPM an annual report through 2021 that describes the work  categories and specialty areas of critical need and substantiates the  critical need designations. The act required DHS to complete the majority of the activities by specific  due dates between March 2015 and September 2016 (see table 2). Beyond HSCWAA, the Federal Cybersecurity Workforce Assessment Act  of 2015 was enacted in December 2015. It assigned specific workforce  planning-related activities to all federal agencies, including DHS.  Specifically, the law requires all federal agencies to identify all positions  that perform information technology, cybersecurity, or other cyber-related  functions and assign the appropriate employment code to each position.  Similar to HSCWAA, the federal act also requires all federal agencies,  including DHS, to identify and report to OPM on its cybersecurity work  roles of critical need; each agency also is to submit a progress report on  identifying cyber-related work roles of critical need to Congress.  According to OPM officials within Employee Services, which oversees the  federal cybersecurity workforce activities and implementation, agencies  are not expected to continue coding to the 2-digit data standard and,  instead, are to adopt the 3-digit data standard and complete coding the 3- digit standard by April 2018. DHS Has Not Fully  Identified  Cybersecurity  Positions or Assigned  Employment Codes in  a Complete and  Reliable Manner As defined in OPM’s guidance and required by HSCWAA, DHS has  begun activities related to identifying, categorizing, and assigning the  appropriate employment codes to its cybersecurity positions. However,  DHS has not completed all of these activities, as required. Specifically,  the department did not develop timely and complete procedures or review  its components’ procedures. In addition, it did not completely and reliably  identify and assign employment codes because its processes were  manual, undocumented, and resource-intensive. As indicated in table 3, the department did not complete any of the  activities associated with establishing procedures and identifying and  assigning employment codes to positions by the statutorily defined due  dates, and two of these efforts are still ongoing. DHS Did Not Ensure  Cybersecurity Workforce  Procedures Were Timely,  Complete, or Reviewed HSCWAA required DHS to establish procedures to identify and assign the  appropriate employment code to all of the department’s filled and vacant  positions with cybersecurity functions, in accordance with OPM’s Guide to  Data Standards by March 2015. In addition, DHS’s April 2016  Cybersecurity Workforce Coding guidance stated that components should  ensure procedures are in place to monitor and to update the employment  codes as positions change over time. Further, Standards for Internal  Control in the Federal Government recommends that management assign  responsibility and delegate authority to key roles and that each  component develop individual procedures to implement objectives. The  standard also recommends that management periodically review such  procedures to see that they are developed, relevant, and effective. Toward this end, OCHCO has developed procedures and recommended  implementation steps for coding positions with cybersecurity functions for  the department’s components. The procedures include criteria to be used  in identifying cybersecurity positions. For example, the procedures state  that any position that performs cybersecurity work at least 25 percent of  the time should be identified as a cybersecurity position. The procedures  also include information on how components are to select the appropriate  data element codes. Nevertheless, although OCHCO developed procedures for identifying  positions and assigning codes, the procedures were not timely.  Specifically, DHS did not include in its procedures information on  identifying positions and assigning codes to address the act’s  requirements until April 2016—13 months after the due date. In addition, the procedures were not complete in that they did not include  information related to identifying and coding vacant positions, as the act  required. For example, while the National Finance Center system, which  is DHS’s system of record for employment codes assigned to  cybersecurity employees, was modified to capture the codes for filled  positions, the system was not modified to capture data on vacant  positions. (For an explanation of National Finance Center’s system and  how DHS relates to it, see footnote 12.) In addition, the department’s  procedures did not address how to identify or code vacant positions, or  where such information should be reported in a standardized manner  across the department. Moreover, the departmental procedures did not identify the individual  within each DHS component who was responsible for leading and  overseeing the identification and coding of the component’s cybersecurity  positions. For example, the procedures did not identify a responsible  individual for leading the effort to identify and code CBP’s cybersecurity  positions. Because there was no identified individual responsible for the  entirety of the CBP cybersecurity workforce identification efforts, CBP  officials told us they were unable to comment on, or provide a status  update on, where they were on the cybersecurity coding process. Further, although components were able to supplement the departmental  procedures by developing their own component-specific procedures for  identifying and coding their cybersecurity positions, DHS did not review  selected components’ procedures for consistency with departmental  guidance. The department could not provide documentation that OCHCO  had verified or reviewed component-developed procedures. OCHCO  officials acknowledged that they had not reviewed the components’  procedures and had not developed a process for conducting such  reviews. OCHCO officials identified several factors that they said limited their  ability to develop timely and complete procedures for identifying and  coding cybersecurity positions, and to review the supplemental  procedures developed by the components. For example, they stated that: DHS did not complete its update of the procedures for identifying  cybersecurity positions and assigning codes until April 2016 because  the department could not decide whether or not certain positions  within the department should be considered cybersecurity positions; each component had the best understanding of their human capital  systems and processes, so the development of tailored procedures  was best left up to each component; each of the six selected DHS components recorded and tracked  vacant positions differently; therefore, the department’s human capital  office could not issue department-wide guidance on vacant positions;  the cybersecurity specialty areas for vacant positions were not known  until a position description was developed or verified and a hiring  action was imminent; and DHS did not assign responsibilities for, or review, components’  procedures because, as noted previously, the department believed  that its components had the best understanding of their specific  human capital systems; thus, what the components included in their  own procedures was best left up to them. OCHCO officials said that they plan to work with their internal  accountability team to review component-developed procedures, but they  had not established a time frame for doing so. Without assurance that  procedures are timely, complete, and reviewed, DHS cannot be certain  that components are effectively prepared to identify and code all positions  with cybersecurity functions, as required by the act. DHS Has Not Yet  Completed Required  Identification Activities HSCWAA required DHS to identify all cybersecurity positions, including  vacant positions, by September 2015 in order to meet the act’s other  deadlines. Further, the act called for the department to use OPM’s Guide  to Data Standards to categorize the identified positions and determine the  work category or specialty area of each position. As of December 2016, the department reported that it had identified  10,725 cybersecurity positions, including 6,734 federal civilian positions,  584 military positions, and 3,407 contractor positions. However, as of  November 2017, the department had not completed identifying all of its  cybersecurity positions or determining the work categories or specialty  areas of the positions. For example, three of the six DHS components we  reviewed had not identified their vacant cybersecurity positions. OCHCO  officials stated that components varied in reporting their identified vacant  positions because the department did not have a system to track  vacancies. DHS also reported that it most commonly determined that the work  category or specialty area of its cybersecurity positions were in the  “protect and defend,” “securely provision,” and “oversight and  development” work categories, and in the “security program  management” and “vulnerability assessment and management” specialty  areas of the NICE framework. DHS reported at least 12 of 15 DHS  components as having cybersecurity positions in these categories and  specialty areas. However, DHS could not provide data to show the actual  numbers of positions in each of these categories and specialty areas.  According to OCHCO officials, the department was still in the process of  identifying positions for the 2-digit codes and would continue this effort  until the 3-digit codes were available in the National Finance Center  personnel and payroll system in December 2017. At that time, OCHCO  officials stated that the department intends to start developing procedures  for identifying and coding positions using the 3-digit codes. DHS Has Not Completely  and Accurately Assigned  Employment Codes In addition to identifying all of its positions with cybersecurity functions  and determining the work categories and specialty areas of each position  consistent with the NICE framework, HSCWAA required DHS to assign  positions codes to all such identified positions by September 2015.  According to the Office of Management and Budget, having complete  data consistent with the framework will help agencies to effectively  examine the cybersecurity workforce; identify skill gaps; and improve  workforce planning. Further, Standards for Internal Control in the  Federal Government states that agencies should obtain relevant data  from reliable sources that are accurate. DHS has not completely and accurately assigned employment codes to  its cybersecurity workforce. As of August 2017—23 months after the due  date—the department had not completed the process of assigning the 2- digit employment codes to all of its identified cybersecurity positions. For example, five of the six components we selected for review had not  completed the coding of their cyber positions. In addition, DHS did not completely or accurately assign codes to all filled  and vacant cybersecurity positions as required by the act. In August  2017, OPM provided a progress report to Congress containing DHS data  that stated that 95 percent of DHS-identified cybersecurity positions had  been coded. However, our analysis determined that the department had  assigned cybersecurity position codes to approximately 79 percent, rather  than the reported 95 percent, of identified federal civilian cybersecurity  positions. See figure 2 below. DHS could not demonstrate that it had  assigned codes to 95 percent of its positions, as reported, since its coding  progress data never indicated such a percentage. The percentage of coded positions reported for DHS was overstated  because it was not based on complete information. Specifically, the  percentage reflected information on the progress of filled federal civilian  cybersecurity positions, but excluded vacant positions, even though the  act required DHS to report these positions. Among the six components  that we selected for our review, five of them had not yet completed the  coding of their positions. Figure 2 shows the results of our analysis of DHS’s progress in coding its  cybersecurity positions, which considered both filled and vacant federal  civilian cybersecurity positions, in comparison to what the department  identified, which considered incomplete data—using only filled positions. In addition to being incomplete, DHS’s results were not accurate.  Specifically, OCHCO developed a bi-monthly dashboard to monitor and  report coding progress; however, the office did not have assurance that  its data were accurate. OCHCO officials stated they did not verify the  components’ data for accuracy. For example, while no more than 100  percent of identified positions should be coded, OCHCO reported 122.7  percent of positions as being coded for the Office of the Chief Information  Officer. Such anomalies were due to DHS components reporting the total  number of identified cybersecurity positions on a semi-annual basis, while  OCHCO determined positions coded on a bi-monthly basis using data  from the National Finance Center personnel and payroll system. Yet,  OCHCO analyzed and reported these numbers together, even though  they were representative of different time periods. This produced  unreliable results that were not representative of actual progress. Table 4 provides examples of components’ coding progress, as reflected  in DHS’s August 29, 2017 dashboard report, which showed one  component that had more cybersecurity positions coded than were  identified. OCHCO officials reported several factors related to their processes and  systems that had limited their ability to collect and use data that were  complete and accurate. Specifically, the officials stated that OCHCO did  not have documented processes to collect and verify data from the  components. The officials also stated that the components did not report  vacancies consistently, and that the department does not have a system  to track the vacancies. The officials further stated that the cybersecurity  workforce amounts frequently changed, and that they could not review  workforce data for reliability, as such a review was a resource-intensive  activity. However, if DHS does not assure that processes are in place to obtain  and use data that are complete, including vacant positions, and accurate,  then the department cannot be assured that it will have an accurate  understanding of its internal coding progress. Without the ability to code  its cybersecurity positions in a complete and accurate manner, DHS will  not be able to effectively examine the cybersecurity workforce; identify  skill gaps; and improve workforce planning. DHS Has Not  Identified or Reported  Its Department-wide  Cybersecurity  Workforce Areas of  Critical Need While DHS has identified workforce capacity and capability gaps, it has  not identified or reported to Congress its department-wide cybersecurity  critical needs that align with the NICE framework. Additionally, the  department has not reported its critical needs to OPM or developed plans  and time frames for completing priority actions for reporting critical needs  annually to OPM. Further, as indicated in table 5, the department did  address any required activities by the statutorily defined due dates. DHS Has Not Identified  Critical Needs in  Alignment with the NICE  Framework or Provided  Guidance to Components HSCWAA required DHS to identify its cybersecurity work categories and  specialty areas of critical need in alignment with the NICE framework and  to report this information to the appropriate congressional committees by  June 2016. In addition, according to a DHS directive, the DHS Chief  Human Capital Officer is responsible for providing guidance to the  department’s components on human resources standards, such as  identifying workforce needs. According to GAO’s leading practices on  strategic workforce planning, developing and providing guidance could  help agencies identify their critical needs in order to effectively recruit,  hire, train, and retain cybersecurity personnel. Although required to do so by June 2016, DHS has not yet identified its  cybersecurity work categories and specialty areas of critical need in  alignment with the NICE framework. The department identified workforce  skills gaps and included this information in a report that it submitted to  congressional committees in March 2017. However, the department did  not align the workforce skills gaps report to the NICE framework’s work  categories and specialty areas as required by HSCWAA. (The  categories and specialty areas are described in appendix II.) Specifically, although the framework required that critical needs be align  with a specific specialty area, DHS did not align the skills gaps to a  particular specialty area in the NICE framework. For example, DHS  identified a skill gap called development operations, which is related to 12  different specialty areas in the NICE framework. This skill gap also  overlaps with other DHS skill gaps and creates the potential for double- counting critical needs. Furthermore, although three selected components  reported in our questionnaires that they were able to identify their critical  needs that aligned to the framework, they did not report this information to  OCHCO. According to OCHCO officials, DHS has not identified department-wide  cybersecurity critical needs that align with the framework partly because  OPM had not provided DHS with guidance for identifying cybersecurity  critical needs. According to OPM officials, however, they provided oral  guidance to DHS on using the 2-digit codes for identifying its critical  needs during four meetings in 2016 and 2017. The OPM officials also  stated that they had plans to develop governmentwide guidance for using  the 3-digit codes to identify cybersecurity critical needs by March 2018 to  fulfil the requirements of the Federal Cybersecurity Workforce  Assessment Act of 2015. According to OPM, agencies such as DHS are  required to identify critical needs for the 3-digit codes by April 2019. DHS  OCHCO officials said that DHS plans to transition to identifying cyber- related work roles of critical need once they have completed the 3-digit  coding efforts under the 2015 federal act mentioned previously. Further, DHS has not developed and provided guidance to help its  component-level agencies to identify their critical needs that align to the  NICE framework. Specifically, DHS did not include guidance in its  procedures that instructed components on how to report on their critical  needs or to align to the NICE framework work categories and specialty  areas. Two selected components’ officials told us they required  guidance from OCHCO on how best to identify critical needs. According to OCHCO officials, they did not provide components guidance  on critical needs that align with the NICE framework because the  components were in the best position to determine their critical needs.  Further, OCHCO officials stated that the components do not generally  view critical skills gaps in terms of the categories or specialty areas as  defined in the NICE framework, but instead, describe their skills gaps  using position titles that are familiar to them. For example, one selected  component identified security engineering as a skills gap familiar to them.  However, according to OCHCO officials, this gap may align to five  different specialty areas in the NICE framework’s securely provision work  category. As mentioned previously, the framework required that critical  needs be align with a specific specialty area. In September 2017, OCHCO developed a draft document that crosswalks  identified department-wide cybersecurity skills gaps to one or more  specialty areas in the NICE framework. However, the document does not  adequately help components identify their critical needs by aligning their  gaps with the NICE framework. Half of the DHS skills gaps overlap with  two or more work categories, but the National Finance Center payroll  system allows components to enter only one code per position. Further,  the document does not provide additional decision rules to help  components determine a critical need in cases in which a skills gap is  mapped to multiple work categories. Without providing relevant guidance to help components identify their  critical needs, DHS and the components are hindered from effectively  identifying and prioritizing workforce efforts to recruit, hire, train, develop,  and retain cybersecurity personnel across the department. DHS Did Not Report  Critical Needs Annually to  OPM or Develop Plans  and Time Frames for  Completing Priority  Actions HSCWAA required that, annually from September 2016 through  September 2021, DHS, in consultation with OPM, submit a report to OPM  that describes and substantiates critical need designations. In addition,  Standards for Internal Control in the Federal Government states that  management should develop plans to achieve objectives. Developing  plans to report critical needs is a control activity that could help capture  and sequence all of the activities that DHS must complete in order to  report critical needs. This involves clearly defining what is to be achieved,  who is to achieve it, how it will be achieved, and the time frames for  achievement. DHS did not report cybersecurity critical needs to OPM in September  2016 or September 2017 as required. Instead, the department first  reported its cybersecurity coding progress and skills gaps in the March  2017 report that it sent to OPM and Congress addressing several of the  HSCWAA requirements. The report did not describe or substantiate  critical need designations because DHS has not yet identified them.  OCHCO officials stated that the department plans to submit another  report to OPM; however, they did not indicate whether critical needs will  be included in the report, and did not have a time frame for when they  plan to submit the report to OPM. Additionally, DHS has not developed plans or time frames to complete  priority actions that OCHCO officials said must be completed before it can  report its cybersecurity critical needs to OPM. DHS’s Comprehensive  Cybersecurity Workforce Update reported two priority actions to identify,  describe, and substantiate cybersecurity critical needs—developing a  DHS cybersecurity workforce strategy and completing its initial  cybersecurity workforce research—by the end of fiscal year 2017.  However, DHS did not complete the priority actions by the end of fiscal  year 2017, as planned. As of September 2017, the department was still in the process of  finalizing the DHS cybersecurity workforce strategy and had not yet  completed the initial cybersecurity workforce research. OCHCO officials  said that the strategy is to be influenced by ongoing efforts to finalize the  DHS comprehensive cybersecurity mission strategy, provide DHS reports  required by the May 2017 cybersecurity-related presidential executive  order, and finalize and implement the new cybersecurity-focused  personnel system. According to OCHCO officials, the department plans  to conduct additional interviews and focus groups in fiscal year 2018. According to DHS OCHCO officials, the department did not develop plans  or schedules with time frames to report cybersecurity critical needs.  These officials stated that the report that the department submitted to  Congress in March 2017 had contained plans and schedules. However, it  did not capture and sequence all of the activities that DHS officials said  must be completed in order to report critical needs. For example, the  report did not include a schedule for completing the cybersecurity  workforce strategy or conducting additional interviews and focus groups  to complete the initial cybersecurity workforce research. Until DHS develops plans and schedules with time frames for reporting its  cybersecurity critical needs, the department may not have important  insight into its needs for ensuring that it has the workforce necessary to  carry out its critical role of helping to secure the nation’s cyberspace.  Further, OPM may be hindered from using DHS’s reports to understand  critical needs consistently on a governmentwide basis. Conclusions DHS has begun the required workforce assessment activities to identify,  categorize, and assign codes to its cybersecurity positions. However, the  department did not complete the activities by their statutorily defined due  dates and efforts are still ongoing. Specifically, the department did not  develop timely and complete procedures or review its components’  procedures. In addition, DHS’s efforts to identify, categorize, and code  cybersecurity positions were incomplete and unreliable. Without the ability  to identify, categorize, and code its cybersecurity positions in a complete  and accurate manner, DHS will not be able to effectively examine the  cybersecurity workforce, identify skill gaps, and improve workforce  planning. DHS has identified critical gaps in its cybersecurity workforce, but these  gaps did not align with the NICE framework work categories and specialty  areas of critical need, as required by the act. Specifically, DHS has not  developed guidance to help its component agencies and offices identify  their cybersecurity critical needs. Moreover, DHS lacks plans with defined  time frames for completing its required annual reporting to OPM. Until the  department addresses these issues, it may continue to miss reporting  deadlines and be hindered from effectively identifying and prioritizing  critical workforce efforts to recruit, hire, train, develop, and retain  cybersecurity personnel across its multiple components. In addition, DHS  may not have cybersecurity personnel with the required skills to better  protect federal networks and national critical infrastructure from threats. The commitment of DHS’s leadership is essential to successfully  addressing these issues and the associated management weaknesses.  By taking urgent and diligent action now, DHS will be better positioned to  fulfill the requirements of HSCWAA and to identify and code its filled and  vacant cybersecurity positions accurately when it transitions to using the  revised NICE framework. Recommendations for  Executive Action We are making the following six recommendations to DHS:  The Secretary of Homeland Security should develop procedures on how  to identify and code vacant cybersecurity positions. (Recommendation 1) The Secretary of Homeland Security should identify the individual in each  component who is responsible for leading that component’s efforts in  identifying and coding cybersecurity positions. (Recommendation 2) The Secretary of Homeland Security should establish and implement a  process to periodically review each component’s procedures for  identifying component cybersecurity positions and maintaining accurate  coding. (Recommendation 3) The Secretary of Homeland Security should ensure OCHCO collects  complete and accurate data from its components on all filled and vacant  cybersecurity positions when it conducts its cybersecurity identification  and coding efforts. (Recommendation 4) The Secretary of Homeland Security should develop guidance to assist  DHS components in identifying their cybersecurity work categories and  specialty areas of critical need that align to the NICE framework.  (Recommendation 5) The Secretary of Homeland Security should develop plans with time  frames to identify priority actions to report on specialty areas of critical  need. (Recommendation 6) Agency Comments  and Our Evaluation We received written comments on a draft of this report from DHS. In the  comments (reprinted in appendix III), the department concurred with our  six recommendations and provided estimated completion dates for  implementing each of them. With regard to recommendations 1 and 2, DHS stated that, by February  28, 2018, it plans to finalize and disseminate an updated version of its  cybersecurity position identification and coding guidance to address  vacant positions, as well as issue a memorandum requiring its  components to designate a lead for reporting progress to OCHCO.  Further, by April 30, 2018, the department said it plans to address  recommendation 3 by disseminating a memorandum that includes a  process for periodically reviewing component procedures and instructions  for components to report related data and documents. DHS also stated that, by June 29, 2018, it plans to issue memorandums  to its components that provide instructions, guidance, and plans to  address recommendations 4 through 6. The department added that it  intends to (1) periodically review compliance and cybersecurity workforce  data concerns with component leads to ensure data accuracy; (2)  disseminate a reporting schedule for identifying cybersecurity critical  needs; and (3) develop and disseminate a project plan with milestones,  due dates, and responsibilities for reviewing progress and reporting on  workforce planning actions in fiscal years 2018 and 2019. The aforementioned actions, if implemented effectively, should help DHS  address the intent of our recommendations. In addition, we received  technical comments from the department, which we have incorporated, as  appropriate. We also provided a draft of this report for OPM’s review and comments.  In response, an OPM program analyst stated, via email, that the agency  had no edits, comments, or revisions to the draft report. We are sending copies of this report to appropriate congressional  committees, the Secretary of Homeland Security, and the Director of the  Office of Personnel Management. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or  Chris Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV. Appendix I: Objectives, Scope, and  Methodology Our objectives were to identify the extent to which DHS has:  1.  identified, categorized and assigned employment codes to  2.  identified its cybersecurity workforce areas of critical need. To address both objectives, we examined Department of Homeland  Security (DHS) Office of Chief Human Capital Officer (OCHCO) and  component cybersecurity workforce data and documentation and  interviewed OCHCO and component officials. In addition, we reviewed  Standards for Internal Control in the Federal Government and Key  Principles for Effective Strategic Workforce Planning, and then compared  the cybersecurity workforce internal controls and project management  processes that DHS implemented to address the act to the selected  standard. We also administered a questionnaire and data collection instrument  (DCI) to a nonprobability sample of 6 of 15 DHS components. To select  the 6 components we used OPM’s Enterprise Human Resources  Integration-Statistical Data Mart data on DHS civilian positions. We  segmented the 15 components into 3 groups, based on their reported  total number of cybersecurity personnel in DHS—high, medium, and low.  From each group, we selected 2 DHS components with the highest  number of cybersecurity functions, as reported by DHS. Where  components or offices in the same tier have equivalent cybersecurity  functions, we selected the DHS component or office with the highest  share of cybersecurity employees. This approach resulted in the selection  of the following DHS components: U.S. Customs and Border Protection, Departmental Management and Operations, National Protection and Programs Directorate, U.S. Secret Service, Science & Technology Directorate, and U.S. Citizenship and Immigration Services. The results of this analysis are not generalizable to all DHS components. In both the questionnaire and DCI, we asked questions related to the  status of DHS’s identification, categorization and assignment of  employment codes to cybersecurity positions, and identification of its  cybersecurity workforce areas of critical need. To minimize errors that  might occur from respondents interpreting our questions differently from  our intended purpose, we performed a preliminary review of the  questionnaire and DCI with OCHCO officials. The selection of OCHCO officials for preliminary review was based on  OCHCO’s oversight role in the implementation of the Homeland Security  Cybersecurity Workforce Assessment Act of 2014 (HSCWAA). During this  review, we interviewed the officials to ensure that the questions were  applicable, clear, unambiguous, and easy to understand. We then revised  our questionnaire and DCI based on the feedback provided during the  preliminary review. All respondents completed the final questionnaire and  DCI, although not all survey respondents answered every question. We  then reviewed the responses and interviewed relevant component  officials in order to get clarification and validation of their responses. We determined that the data obtained from the questionnaire and DCI are  sufficiently reliable for the purpose of reporting DHS’ progress in  assigning cybersecurity codes. However, these data have the following  limitations: component responses may be from a particular program or  office and not cover the breadth of the program, and component reported  data may be estimated or unavailable. To address our first objective, we reviewed and analyzed DHS’s  department-level cybersecurity workforce procedures and  communications and organizational documents for identifying  cybersecurity positions and assigning work-position codes in accordance  with the act. Further, we examined department-level data from the  Department of Agriculture’s National Finance Center, DHS dashboard  reports, and DHS progress reports to the Office of Personnel  Management (OPM) and Congress. To assess the reliability of OCHCO  and component cybersecurity workforce data, we compared them with  data from OPM’s Enterprise Human Resources Integration-Statistical  Data Mart data on DHS civilian positions and against the National  Finance Center personnel and payroll system data on the cybersecurity  coding of DHS civilian positions as appropriate. In addition, we reviewed  and analyzed component-level cybersecurity workforce procedures, as  well as cybersecurity workforce data and documentation, including data  calls to selected component-level offices in DHS. We evaluated these  documents against the act’s requirements and Standards for Internal  Control in the Federal Government to ensure that DHS’s processes  addressed leading practices. To address our second objective, we reviewed and analyzed DHS’s  planned actions for identifying its cybersecurity workforce areas of critical  need, including data calls to components, and DHS progress reports to  OPM and Congress. We also examined OCHCO and component  cybersecurity workforce data and department-level workforce planning  documentation to evaluate the status of the department’s efforts to  identify its cybersecurity workforce areas of critical need. We compared  these documents against the act’s requirements, DHS-wide and  component-specific workforce planning processes, the National Initiative  for Cybersecurity Education (NICE) framework categories and specialty  areas, and Standards for Internal Control in the Federal Government to  ensure DHS met its requirements. To assess the reliability of OPM’s Enterprise Human Resources  Integration-Statistical Data Mart data on DHS civilian positions, we  reviewed the data for obvious errors as well as compared OPM’s written  responses to our data reliability questionnaire regarding the generation  and use of the data. We determined that the data were sufficiently reliable  for the purpose of helping inform our selection of a nonprobability sample  of 6 DHS components as described above. To assess the reliability of National Finance Center personnel and payroll  system data on the cybersecurity coding of DHS civilian positions, we  examined the data for outliers and obvious errors and compared those  data to data and documentation from DHS components. In addition, we  interviewed and observed DHS officials generate and use the National  Finance Center data. We determined that the data were sufficiently  reliable for the purposes of reporting DHS cybersecurity workforce coding  progress. The data are limited in that only filled federal civilian positions  were reported in the National Finance Center system. Vacancies,  contractors, and military were not included in those data. To assess the reliability of DHS’s OCHCO and component human capital  systems data on the DHS civilian cybersecurity workforce, we reviewed  the data for outliers and obvious errors, and compared them against data  from the National Finance Center personnel and payroll system. We also  interviewed officials from OCHCO and selected DHS components  regarding the generation and use of the data. We determined that the  data were sufficiently reliable for the purpose of reporting DHS’ progress  in assigning cybersecurity codes. However, the data have the following  limitations: component responses may be from a particular program or  office and not cover the breadth of the program, data may be estimated  by components, and data may be measured at different intervals—for  example, total cybersecurity workforce may be measured at a different  point in time than cybersecurity workforce positions coded. For both objectives, we supplemented the information and knowledge  obtained from our assessments by holding discussions with relevant DHS  OCHCO and the six components’ officials to evaluate the status of the  department’s efforts to implement the act. We conducted this performance audit from March 2017 to February 2018  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix II: National Initiative for  Cybersecurity Education (NICE)  Cybersecurity Workforce Framework  Categories and Specialty Areas Appendix II: National Initiative for  Cybersecurity Education (NICE) Cybersecurity  Workforce Framework Categories and  Specialty Areas Oversees, evaluates, and supports the documentation, validation,  assessment, and authorization processes necessary to assure that existing  and new information technology (IT) systems meet the organization’s  cybersecurity and risk requirements. Ensures appropriate treatment of risk,  compliance, and assurance from internal and external perspectives. Develops and writes/codes new (or modifies existing) computer applications,  software, or specialized utility programs following software assurance best  practices. Works on the development phases of the systems development life cycle. Consults with customers to gather and evaluate functional requirements and  translates these requirements into technical solutions. Provides guidance to  customers about applicability of information systems to meet business needs. Develops system concepts and works on the capabilities phases of the  systems development life cycle; translates technology and environmental  conditions (e.g., law and regulation) into system and security designs and  processes. Conducts technology assessment and integration processes; provides and  supports a prototype capability and/or evaluates its utility. Develops and conducts tests of systems to evaluate compliance with  specifications and requirements by applying principles and methods for cost- effective planning, evaluating, verifying, and validating of technical, functional,  and performance characteristics (including interoperability) of systems or  elements of systems incorporating IT. Addresses problems; installs, configures, troubleshoots, and provides  maintenance and training in response to customer requirements or inquiries  (e.g., tiered-level customer support). Develops and administers databases and/or data management systems that  allow for the storage, query, and utilization of data. Manages and administers processes and tools that enable the organization to  identify, document, and access intellectual capital and information content. Installs, configures, tests, operates, maintains, and manages networks and  their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers,  routers, cables, proxy servers, and protective distributor systems) and  software that permit the sharing and transmission of all spectrum  transmissions of information to support the security of information and  information systems. Installs, configures, troubleshoots, and maintains server configurations  (hardware and software) to ensure their confidentiality, integrity, and  availability. Also, manages accounts, firewalls, and patches. Responsible for  access control, passwords, and account creation and administration. NICE Specialty Area  Systems Analysis NICE Specialty Area definition  Conducts the integration/testing, operations, and maintenance of systems  security. Conducts training of personnel within pertinent subject domain. Develops,  plans, coordinates, delivers and/or evaluates training courses, methods, and  techniques as appropriate. Applies knowledge of data, information, processes, organizational interactions,  skills, and analytical expertise, as well as systems, networks, and information  exchange capabilities to manage acquisition programs. Executes duties  governing hardware, software, and information system acquisition programs  and other program management policies. Provides direct support for  acquisitions that use information technology (IT) (including National Security  Systems), applying IT-related laws and policies, and provides IT-related  guidance throughout the total acquisition life cycle. Provides legally sound advice and recommendations to leadership and staff on  a variety of relevant topics within the pertinent subject domain. Advocates  legal and policy changes, and makes a case on behalf of client via a wide  range of written and oral work products, including legal briefs and proceedings. Oversees the cybersecurity program of an information system or network;  including managing information security implications within the organization,  specific program, or other area of responsibility, to include strategic,  personnel, infrastructure, requirements, policy enforcement, emergency  planning, security awareness, and other resources. Develops policies and plans and/or advocates for changes in policy that  supports organizational cyberspace initiatives or required  changes/enhancements. Supervises, manages, and/or leads work and workers performing  cybersecurity work. Uses defensive measures and information collected from a variety of sources  to identify, analyze, and report events that occur or might occur within the  network in order to protect information, information systems, and networks  from threats. Tests, implements, deploys, maintains, reviews, and administers the  infrastructure hardware and software that are required to effectively manage  the computer network defense service provider network and resources.  Monitors network to actively remediate unauthorized activities. Responds to crises or urgent situations within the pertinent domain to mitigate  immediate and potential threats. Uses mitigation, preparedness, and response  and recovery approaches, as needed, to maximize survival of life, preservation  of property, and information security. Investigates and analyzes all relevant  response activities. Conducts assessments of threats and vulnerabilities; determines deviations  from acceptable configurations, enterprise or local policy; assesses the level of  risk; and develops and/or recommends appropriate mitigation  countermeasures in operational and nonoperational situations. NICE Specialty Area  Analyze category  All-Source Analysis Analyzes threat information from multiple sources, disciplines, and agencies  across the intelligence community. Synthesizes and places intelligence  information in context; draws insights about the possible implications. Analyzes collected information to identify vulnerabilities and potential for  exploitation. Applies current knowledge of one or more regions, countries, non-state  entities, and/or technologies. Identifies and assesses the capabilities and activities of cybersecurity criminals  or foreign intelligence entities; produces findings to help initialize or support  law enforcement and counterintelligence investigations or activities. Applies language, cultural, and technical expertise to support information  collection, analysis, and other cybersecurity activities. Collect and Operate category  Collection Operations Executes collection using appropriate strategies and within the priorities  established through the collection management process. Performs activities to gather evidence on criminal or foreign intelligence  entities in order to mitigate possible or real-time threats, protect against  espionage or insider threats, foreign sabotage, international terrorist activities,  or to support other intelligence activities. Performs in-depth joint targeting and cybersecurity planning process. Gathers  information and develops detailed Operational Plans and Orders supporting  requirements. Conducts strategic and operational-level planning across the full  range of operations for integrated information and cyberspace operations. Investigate category  Digital Forensics Collects, processes, preserves, analyzes, and presents computer-related  evidence in support of network vulnerability mitigation, and/or criminal, fraud,  counterintelligence or law enforcement investigations. Applies tactics, techniques, and procedures for a full range of investigative  tools and processes to include, but not limited to, interview and interrogation  techniques, surveillance, counter surveillance, and surveillance detection, and  appropriately balances the benefits of prosecution versus intelligence  gathering. OPM guidance states that individuals primarily engaged in project or program management for  cybersecurity projects or tasks should be coded with the Cybersecurity Program/Project Management  value (80). Appendix III: Comments from the  Department of Homeland Security Appendix IV: GAO Contacts and Staff  Acknowledgments GAO Contacts Staff  Acknowledgments In addition to the contacts above, Ben Atwater (assistant director), Tammi  Kalugdan (assistant director), David Hong (analyst-in-charge), Christy  Abuyan, Alexander Anderegg, David Blanding, Jr., Chris Businsky,  Wayne Emilien, Jr., David Plocher, Luis E. Rodriguez, and Priscilla Smith  made significant contributions to this report.
DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs. The act included a provision for GAO to analyze and monitor DHS's implementation of the requirements. GAO's objectives were to assess the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. GAO analyzed DHS and OPM workforce documentation and administered a data collection instrument to six major DHS components. GAO also interviewed relevant DHS and OPM officials. The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS has not yet completed its efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to the Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, GAO's analysis determined that the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions. In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to the Congress on its department-wide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table). Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify its critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.