S.Amdt. 2558

1. Adds TITLE II--FEDERAL CYBERSECURITY WORKFORCE ASSESSMENT at the end of the bill

   Adds a title

   In S. 754 · Placed on Calendar Senate

   (b) Modification of Limitation on Dissemination of Certain Information Concerning Penetrations of Defense Contractor Networks.-- Section 941(c)(3) of the National Defense Authorization Act for Fiscal Year 2013 (Public Law 112-239; 10 U.S.C. 2224 note) is amended by inserting at the end the following: "The Secretary may share such information with other Federal entities if such information consists of cyber threat indicators and defensive measures and such information is shared consistent with the policies and procedures promulgated by the Attorney General under section 5 of the Cybersecurity Information Sharing Act of 2015.".

   Inserted: TITLE II--FEDERAL CYBERSECURITY WORKFORCE ASSESSMENT

   Inserted: SECTION 201. SHORT TITLE.

   Inserted: This title may be cited as the "Federal Cybersecurity Workforce Assessment Act".

   Inserted: SEC. 202. DEFINITIONS.

   Inserted: In this title:

   Inserted: (1) Appropriate congressional committees.--The term "appropriate congressional committees" means--

   Inserted: (A) the Committee on Armed Services of the Senate;

   Inserted: (B) the Committee on Homeland Security and Governmental Affairs of the Senate;

   Inserted: (C) the Committee on Armed Services in the House of Representatives;

   Inserted: (D) the Committee on Homeland Security of the House of Representatives; and

   Inserted: (E) the Committee on Oversight and Government Reform of House of Representatives.

   Inserted: (2) Director.--The term "Director" means the Director of the Office of Personnel Management.

   Show 35 more inserted paragraphsShow less

   Inserted: (3) Roles.--The term "roles" has the meaning given the term in the National Initiative for Cybersecurity Education's Cybersecurity Workforce Framework.

   Inserted: SEC. 203. NATIONAL CYBERSECURITY WORKFORCE MEASUREMENT INITIATIVE.

   Inserted: (a) In General.--The head of each Federal agency shall--

   Inserted: (1) identify all positions within the agency that require the performance of information technology, cybersecurity, or other cyber-related functions; and

   Inserted: (2) assign the corresponding employment code, which shall be added to the National Initiative for Cybersecurity Education's National Cybersecurity Workforce Framework, in accordance with subsection (b).

   Inserted: (b) Employment Codes.--

   Inserted: (1) Procedures.--

   Inserted: (A) Coding structure.--Not later than 180 days after the date of the enactment of this Act, the Secretary of Commerce, acting through the National Institute of Standards and Technology, shall update the National Initiative for Cybersecurity Education's Cybersecurity Workforce Framework to include a corresponding coding structure.

   Inserted: (B) Identification of civilian cyber personnel.--Not later than 9 months after the date of enactment of this Act, the Director, in coordination with the Director of National Intelligence, shall establish procedures to implement the National Initiative for Cybersecurity Education's coding structure to identify all Federal civilian positions that require the performance of information technology, cybersecurity, or other cyber-related functions.

   Inserted: (C) Identification of non-civilian cyber personnel.--Not later than 18 months after the date of enactment of this Act, the Secretary of Defense shall establish procedures to implement the National Initiative for Cybersecurity Education's coding structure to identify all Federal non-civilian positions that require the performance of information technology, cybersecurity or other cyber-related functions.

   Inserted: (D) Baseline assessment of existing cybersecurity workforce.--Not later than 3 months after the date on which the procedures are developed under subparagraphs (B) and (C), respectively, the head of each Federal agency shall submit to the appropriate congressional committees of jurisdiction a report that identifies--

   Inserted: (i) the percentage of personnel with information technology, cybersecurity, or other cyber-related job functions who currently hold the appropriate industry-recognized certifications as identified in the National Initiative for Cybersecurity Education's Cybersecurity Workforce Framework;

   Inserted: (ii) the level of preparedness of other civilian and non-civilian cyber personnel without existing credentials to pass certification exams; and

   Inserted: (iii) a strategy for mitigating any gaps identified in clause (i) or (ii) with the appropriate training and certification for existing personnel.

   Inserted: (E) Procedures for assigning codes.--Not later than 3 months after the date on which the procedures are developed under subparagraphs (B) and (C), respectively, the head of each Federal agency shall establish procedures--

   Inserted: (i) to identify all encumbered and vacant positions with information technology, cybersecurity, or other cyber-related functions (as defined in the National Initiative for Cybersecurity Education's coding structure); and

   Inserted: (ii) to assign the appropriate employment code to each such position, using agreed standards and definitions.

   Inserted: (2) Code assignments.--Not later than 1 year after the date after the procedures are established under paragraph (1)(E), the head of each Federal agency shall complete assignment of the appropriate employment code to each position within the agency with information technology, cybersecurity, or other cyber-related functions.

   Inserted: (c) Progress Report.--Not later than 180 days after the date of enactment of this Act, the Director shall submit a progress report on the implementation of this section to the appropriate congressional committees.

   Inserted: SEC. 204. IDENTIFICATION OF CYBER-RELATED ROLES OF CRITICAL NEED.

   Inserted: (a) In General.--Beginning not later than 1 year after the date on which the employment codes are assigned to employees pursuant to section 203(b)(2), and annually through 2022, the head of each Federal agency, in consultation with the Director and the Secretary of Homeland Security, shall--

   Inserted: (1) identify information technology, cybersecurity, or other cyber-related roles of critical need in the agency's workforce; and

   Inserted: (2) submit a report to the Director that--

   Inserted: (A) describes the information technology, cybersecurity, or other cyber-related roles identified under paragraph (1); and

   Inserted: (B) substantiates the critical need designations.

   Inserted: (b) Guidance.--The Director shall provide Federal agencies with timely guidance for identifying information technology, cybersecurity, or other cyber-related roles of critical need, including--

   Inserted: (1) current information technology, cybersecurity, and other cyber-related roles with acute skill shortages; and

   Inserted: (2) information technology, cybersecurity, or other cyber-related roles with emerging skill shortages.

   Inserted: (c) Cybersecurity Needs Report.--Not later than 2 years after the date of the enactment of this Act, the Director, in consultation with the Secretary of Homeland Security, shall--

   Inserted: (1) identify critical needs for information technology, cybersecurity, or other cyber-related workforce across all Federal agencies; and

   Inserted: (2) submit a progress report on the implementation of this section to the appropriate congressional committees.

   Inserted: SEC. 205. GOVERNMENT ACCOUNTABILITY OFFICE STATUS REPORTS.

   Inserted: The Comptroller General of the United States shall--

   Inserted: (1) analyze and monitor the implementation of sections 203 and 204; and

   Inserted: (2) not later than 3 years after the date of the enactment of this Act, submit a report to the appropriate congressional committees that describes the status of such implementation.

   Original wording

   At the end, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed