S.Amdt. 4420

SA 4420. Ms. ROSEN (for herself and Mrs. Blackburn) submitted an
amendment intended to be proposed to amendment SA 3867 submitted by Mr.
Reed and intended to be proposed to the bill H.R. 4350, to authorize
appropriations for fiscal year 2022 for military activities of the
Department of Defense, for military construction, and for defense
activities of the Department of Energy, to prescribe military personnel
strengths for such fiscal year, and for other purposes; which was
ordered to lie on the table; as follows:

Strike section 1109 and insert the following:

SEC. 1109. CIVILIAN CYBERSECURITY RESERVES PILOT PROJECT.

(a) Definitions.--In this section:
(1) Agency.--The term ``Agency'' means the Cybersecurity
and Infrastructure Security Agency.
(2) Competitive service.--The term ``competitive service''
has the meaning given the term in section 2102 of title 5,
United States Code.
(3) Director.--The term ``Director'' means the Director of
the Agency.
(4) Excepted service.--The term ``excepted service'' has
the meaning given the term in section 2103 of title 5, United
States Code.
(5) Executive agent.--The term ``Executive Agent'' means
the Executive Agent of the United States Cyber Command.
(6) Significant incident.--The term ``significant
incident''--
(A) means an incident or a group of related incidents that
results, or is likely to result, in demonstrable harm to--
(i) the national security interests, foreign relations, or
economy of the United States; or
(ii) the public confidence, civil liberties, or public
health and safety of the people of the United States; and
(B) does not include an incident or a portion of a group of
related incidents that occurs on--
(i) a national security system, as defined in section 3552
of title 44, United States Code; or
(ii) an information system described in paragraph (2) or
(3) of section 3553(e) of title 44, United States Code.
(7) Temporary position.--The term ``temporary position''
means a position in the competitive or excepted service for a
period of 180 days or less.
(8) Uniformed services.--The term ``uniformed services''
has the meaning given the term in section 2101 of title 5,
United States Code.
(b) Pilot Project.--There is established a pilot project
under which--
(1) the Executive Agent, in coordination with the Chief
Information Officer of the Department of Defense, shall
establish a Civilian Cybersecurity Reserve at the United
States Cyber Command in accordance with subsection (c); and
(2) the Director may establish a Civilian Cybersecurity
Reserve at the Agency in accordance with subsection (d).
(c) Civilian Cybersecurity Reserve at the United States
Cyber Command.--
(1) Definitions.--In this subsection:
(A) Appropriate congressional committees.--The term
``appropriate congressional committees'' means--
(i) the Committee on Homeland Security and Governmental
Affairs of the Senate;
(ii) the Committee on Armed Services of the Senate;
(iii) the Committee on Appropriations of the Senate;
(iv) the Committee on Homeland Security of the House of
Representatives;
(v) the Committee on Armed Services of the House of
Representatives; and
(vi) the Committee on Appropriations of the House of
Representatives.
(B) Civilian cybersecurity reserve.--The term ``Civilian
Cybersecurity Reserve'' means the Civilian Cybersecurity
Reserve at the United States Cyber Command established under
subsection (b)(1).
(C) Pilot project.--The term ``pilot project'' means the
pilot project established by subsection (b) with respect to
the United States Cyber Command.
(2) Purpose.--The purpose of the Civilian Cybersecurity
Reserve is to enable the United States Cyber Command to
effectively respond to significant incidents.
(3) Alternative methods.--Consistent with section 4703 of
title 5, United States Code, in carrying out the pilot
project, the Executive Agent may, without further
authorization from the Office of Personnel Management,
provide for alternative methods of--
(A) establishing qualifications requirements for,
recruitment of, and appointment to positions; and
(B) classifying positions.
(4) Appointments.--Under the pilot project, upon occurrence
of a significant incident, the Executive Agent--

[[Page S7930]]

(A) may activate members of the Civilian Cybersecurity
Reserve by--
(i) noncompetitively appointing members of the Civilian
Cybersecurity Reserve to temporary positions in the
competitive service; or
(ii) appointing members of the Civilian Cybersecurity
Reserve to temporary positions in the excepted service;
(B) shall notify Congress whenever a member is activated
under subparagraph (A); and
(C) may appoint not more than 50 members to the Civilian
Cybersecurity Reserve under subparagraph (A) at any time.
(5) Status as employees.--An individual appointed under
paragraph (4) shall be considered a Federal civil service
employee under section 2105 of title 5, United States Code.
(6) Additional employees.--Individuals appointed under
paragraph (4) shall be in addition to any employees of the
United States Cyber Command who provide cybersecurity
services.
(7) Employment protections.--The Secretary of Labor shall
prescribe such regulations as necessary to ensure the
reemployment, continuation of benefits, and non-
discrimination in reemployment of individuals appointed under
paragraph (4), provided that such regulations shall include,
at a minimum, those rights and obligations set forth under
chapter 43 of title 38, United States Code.
(8) Status in reserve.--During the period beginning on the
date on which an individual is recruited by the United States
Cyber Command to serve in the Civilian Cybersecurity Reserve
and ending on the date on which the individual is appointed
under paragraph (4), and during any period in between any
such appointments, the individual shall not be considered a
Federal employee.
(9) Eligibility; application and selection.--
(A) In general.--Under the pilot project, the Executive
Agent shall establish criteria for--
(i) individuals to be eligible for the Civilian
Cybersecurity Reserve; and
(ii) the application and selection processes for the
Civilian Cybersecurity Reserve.
(B) Requirements for individuals.--The criteria established
under subparagraph (A)(i) with respect to an individual shall
include--
(i) if the individual has previously served as a member of
the Civilian Cybersecurity Reserve, that the previous
appointment ended not less than 60 days before the individual
may be appointed for a subsequent temporary position in the
Civilian Cybersecurity Reserve; and
(ii) cybersecurity expertise.
(C) Prescreening.--The Executive Agent shall--
(i) conduct a prescreening of each individual prior to
appointment under paragraph (4) for any topic or product that
would create a conflict of interest; and
(ii) require each individual appointed under paragraph (4)
to notify the Executive Agent if a potential conflict of
interest arises during the appointment.
(D) Agreement required.--An individual may become a member
of the Civilian Cybersecurity Reserve only if the individual
enters into an agreement with the Executive Agent to become
such a member, which shall set forth the rights and
obligations of the individual and the United States Cyber
Command.
(E) Exception for continuing military service
commitments.--A member of the Selected Reserve under section
10143 of title 10, United States Code, may not be a member of
the Civilian Cybersecurity Reserve.
(F) Prohibition.--Any individual who is an employee of the
executive branch may not be recruited or appointed to serve
in the Civilian Cybersecurity Reserve.
(10) Security clearances.--
(A) In general.--The Executive Agent shall ensure that all
members of the Civilian Cybersecurity Reserve undergo the
appropriate personnel vetting and adjudication commensurate
with the duties of the position, including a determination of
eligibility for access to classified information where a
security clearance is necessary, according to applicable
policy and authorities.
(B) Cost of sponsoring clearances.--If a member of the
Civilian Cybersecurity Reserve requires a security clearance
in order to carry out the duties of the member, the United
States Cyber Command shall be responsible for the cost of
sponsoring the security clearance of the member.
(11) Study and implementation plan.--
(A) Study.--Not later than 60 days after the date on which
the Principal Cyber Advisor to the Secretary of Defense, in
conjunction with the Under Secretary for Personnel and
Readiness of the Department of Defense and the Principal
Cyber Advisors of the military services, submits the
evaluation of reserve models tailored to the support of
cyberspace operations for the Department required by section
1730(a) of the William M. (Mac) Thornberry National Defense
Authorization Act for Fiscal Year 2021 (Public Law 116-283),
the Executive Agent shall begin a study on the design and
implementation of the pilot project required under subsection
(b)(1), including--
(i) compensation and benefits for members of the Civilian
Cybersecurity Reserve;
(ii) activities that members may undertake as part of their
duties;
(iii) methods for identifying and recruiting members,
including alternatives to traditional qualifications
requirements;
(iv) methods for preventing conflicts of interest or other
ethical concerns as a result of participation in the pilot
project and details of mitigation efforts to address any
conflict of interest concerns;
(v) resources, including additional funding, needed to
carry out the pilot project;
(vi) possible penalties for individuals who do not respond
to activation when called, in accordance with the rights and
procedures set forth under title 5, Code of Federal
Regulations; and
(vii) processes and requirements for training and
onboarding members.
(B) Implementation plan.--Not later than one year after
beginning the study required under subparagraph (A), the
Executive Agent shall--
(i) submit to the appropriate congressional committees an
implementation plan for the pilot project; and
(ii) provide to the appropriate congressional committees a
briefing on the implementation plan.
(C) Prohibition.--The Executive Agent may not take any
action to begin implementation of the pilot project until the
Executive Agent fulfills the requirements under subparagraph
(B).
(12) Project guidance.--Not later than two years after the
date of the enactment of this Act, the Executive Agent shall,
in consultation with the Office of Personnel Management and
the Office of Government Ethics, issue guidance establishing
and implementing the pilot project.
(13) Briefings and report.--
(A) Briefings.--Not later than one year after the date on
which the Executive Agent issues guidance establishing and
implementing the pilot project under paragraph (12), the
Executive Agent shall provide to the appropriate
congressional committees a briefing on activities carried out
under the pilot project, including--
(i) participation in the Civilian Cybersecurity Reserve,
including the number of participants, the diversity of
participants, and any barriers to recruitment or retention of
members;
(ii) an evaluation of the ethical requirements of the pilot
project;
(iii) whether the Civilian Cybersecurity Reserve has been
effective in providing additional capacity to the United
States Cyber Command during significant incidents; and
(iv) an evaluation of the eligibility requirements for the
pilot project.
(B) Report.--Not earlier than 180 days and not later than
90 days before the date on which the pilot project terminates
under subsection (e), the Executive Agent shall submit to the
appropriate congressional committees a report and provide a
briefing on recommendations relating to the pilot project,
including recommendations for--
(i) whether the pilot project should be modified, extended
in duration, or established as a permanent program, and if
so, an appropriate scope for the program;
(ii) how to attract participants, ensure a diversity of
participants, and address any barriers to recruitment or
retention of members of the Civilian Cybersecurity Reserve;
(iii) the ethical requirements of the pilot project and the
effectiveness of mitigation efforts to address any conflict
of interest concerns; and
(iv) an evaluation of the eligibility requirements for the
pilot project.
(14) Evaluation.--Not later than three years after the
Civilian Cybersecurity Reserve is established under
subsection (b)(1), the Comptroller General of the United
States shall--
(A) conduct a study evaluating the pilot project; and
(B) submit to Congress--
(i) a report on the results of the study; and
(ii) a recommendation with respect to whether the pilot
project should be modified.
(d) Civilian Cybersecurity Reserve at the Cybersecurity and
Infrastructure Security Agency.--
(1) Definitions.--In this subsection:
(A) Appropriate congressional committees.--The term
``appropriate congressional committees'' means--
(i) the Committee on Homeland Security and Governmental
Affairs of the Senate;
(ii) the Committee on Appropriations of the Senate;
(iii) the Committee on Homeland Security of the House of
Representatives;
(iv) the Committee on Oversight and Reform of the House of
Representatives; and
(v) the Committee on Appropriations of the House of
Representatives.
(B) Civilian cybersecurity reserve.--The term ``Civilian
Cybersecurity Reserve'' means the Civilian Cybersecurity
Reserve at the Agency established under subsection (b)(2).
(C) Pilot project.--The term ``pilot project'' means the
pilot project established by subsection (b) with respect to
the Agency.
(2) Purpose.--The purpose of a Civilian Cybersecurity
Reserve is to enable the Agency to effectively respond to
significant incidents.
(3) Alternative methods.--Consistent with section 4703 of
title 5, United States Code, in carrying out the pilot
project, the Director may, without further authorization from
the Office of Personnel Management, provide for alternative
methods of--
(A) establishing qualifications requirements for,
recruitment of, and appointment to positions; and
(B) classifying positions.

[[Page S7931]]

(4) Appointments.--Under the pilot project, upon occurrence
of a significant incident, the Director--
(A) may activate members of the Civilian Cybersecurity
Reserve by--
(i) noncompetitively appointing members of the Civilian
Cybersecurity Reserve to temporary positions in the
competitive service; or
(ii) appointing members of the Civilian Cybersecurity
Reserve to temporary positions in the excepted service;
(B) shall notify Congress whenever a member is activated
under subparagraph (A); and
(C) may appoint not more than 30 members to the Civilian
Cybersecurity Reserve under subparagraph (A) at any time.
(5) Status as employees.--An individual appointed under
paragraph (4) shall be considered a Federal civil service
employee under section 2105 of title 5, United States Code.
(6) Additional employees.--Individuals appointed under
paragraph (4) shall be in addition to any employees of the
Agency who provide cybersecurity services.
(7) Employment protections.--The Secretary of Labor shall
prescribe such regulations as necessary to ensure the
reemployment, continuation of benefits, and non-
discrimination in reemployment of individuals appointed under
paragraph (4), provided that such regulations shall include,
at a minimum, those rights and obligations set forth under
chapter 43 of title 38, United States Code.
(8) Status in reserve.--During the period beginning on the
date on which an individual is recruited by the Agency to
serve in the Civilian Cybersecurity Reserve and ending on the
date on which the individual is appointed under paragraph
(4), and during any period in between any such appointments,
the individual shall not be considered a Federal employee.
(9) Eligibility; application and selection.--
(A) In general.--Under the pilot project, the Director
shall establish criteria for--
(i) individuals to be eligible for the Civilian
Cybersecurity Reserve; and
(ii) the application and selection processes for the
Civilian Cybersecurity Reserve.
(B) Requirements for individuals.--The criteria established
under subparagraph (A)(i) with respect to an individual shall
include--
(i) previous employment--

(I) by the executive branch;
(II) within the uniformed services;
(III) as a Federal contractor within the executive branch;
or
(IV) by a State, local, Tribal, or territorial government;

(ii) if the individual has previously served as a member of
the Civilian Cybersecurity Reserve, that the previous
appointment ended not less than 60 days before the individual
may be appointed for a subsequent temporary position in the
Civilian Cybersecurity Reserve; and
(iii) cybersecurity expertise.
(C) Prescreening.--The Director shall--
(i) conduct a prescreening of each individual prior to
appointment under paragraph (4) for any topic or product that
would create a conflict of interest; and
(ii) require each individual appointed under paragraph (4)
to notify the Director if a potential conflict of interest
arises during the appointment.
(D) Agreement required.--An individual may become a member
of the Civilian Cybersecurity Reserve only if the individual
enters into an agreement with the Director to become such a
member, which shall set forth the rights and obligations of
the individual and the Agency.
(E) Exception for continuing military service
commitments.--A member of the Selected Reserve under section
10143 of title 10, United States Code, may not be a member of
the Civilian Cybersecurity Reserve.
(F) Priority.--In appointing individuals to the Civilian
Cybersecurity Reserve, the Agency shall prioritize the
appointment of individuals described in subclause (I) or (II)
of subparagraph (B)(i) before considering individuals
described in subclause (III) or (IV) of subparagraph (B)(i).
(G) Prohibition.--Any individual who is an employee of the
executive branch may not be recruited or appointed to serve
in the Civilian Cybersecurity Reserve.
(10) Security clearances.--
(A) In general.--The Director shall ensure that all members
of the Civilian Cybersecurity Reserve undergo the appropriate
personnel vetting and adjudication commensurate with the
duties of the position, including a determination of
eligibility for access to classified information where a
security clearance is necessary, according to applicable
policy and authorities.
(B) Cost of sponsoring clearances.--If a member of the
Civilian Cybersecurity Reserve requires a security clearance
in order to carry out the duties of the member, the Agency
shall be responsible for the cost of sponsoring the security
clearance of the member.
(11) Study and implementation plan.--
(A) Study.--Not later than 60 days after the date of the
enactment of this Act, the Director shall begin a study on
the design and implementation of the pilot project,
including--
(i) compensation and benefits for members of the Civilian
Cybersecurity Reserve;
(ii) activities that members may undertake as part of their
duties;
(iii) methods for identifying and recruiting members,
including alternatives to traditional qualifications
requirements;
(iv) methods for preventing conflicts of interest or other
ethical concerns as a result of participation in the pilot
project and details of mitigation efforts to address any
conflict of interest concerns;
(v) resources, including additional funding, needed to
carry out the pilot project;
(vi) possible penalties for individuals who do not respond
to activation when called, in accordance with the rights and
procedures set forth under title 5, Code of Federal
Regulations; and
(vii) processes and requirements for training and
onboarding members.
(B) Implementation plan.--Not later than one year after
beginning the study required under subparagraph (A), the
Director shall--
(i) submit to the appropriate congressional committees an
implementation plan for the pilot project; and
(ii) provide to the appropriate congressional committees a
briefing on the implementation plan.
(C) Prohibition.--The Director may not take any action to
begin implementation of the pilot project until the Director
fulfills the requirements under subparagraph (B).
(12) Project guidance.--If the Director establishes the
Civilian Cybersecurity Reserve, not later than two years
after the date of the enactment of this Act, the Director
shall, in consultation with the Office of Personnel
Management and the Office of Government Ethics, issue
guidance establishing and implementing the pilot project.
(13) Briefings and report.--
(A) Briefings.--Not later than one year after the date on
which the Director issues guidance establishing and
implementing the pilot project under paragraph (12), and
every year thereafter until the date on which the pilot
project terminates under subsection (e), the Director shall
provide to the appropriate congressional committees a
briefing on activities carried out under the pilot project,
including--
(i) participation in the Civilian Cybersecurity Reserve,
including the number of participants, the diversity of
participants, and any barriers to recruitment or retention of
members;
(ii) an evaluation of the ethical requirements of the pilot
project;
(iii) whether the Civilian Cybersecurity Reserve has been
effective in providing additional capacity to the Agency
during significant incidents; and
(iv) an evaluation of the eligibility requirements for the
pilot project.
(B) Report.--Not earlier than 180 days and not later than
90 days before the date on which the pilot project terminates
under subsection (e), the Director shall submit to the
appropriate congressional committees a report and provide a
briefing on recommendations relating to the pilot project,
including recommendations for--
(i) whether the pilot project should be modified, extended
in duration, or established as a permanent program, and if
so, an appropriate scope for the program;
(ii) how to attract participants, ensure a diversity of
participants, and address any barriers to recruitment or
retention of members of the Civilian Cybersecurity Reserve;
(iii) the ethical requirements of the pilot project and the
effectiveness of mitigation efforts to address any conflict
of interest concerns; and
(iv) an evaluation of the eligibility requirements for the
pilot project.
(14) Evaluation.--Not later than three years after the
Civilian Cybersecurity Reserve is established under
subsection (b)(2), the Comptroller General of the United
States shall--
(A) conduct a study evaluating the pilot project; and
(B) submit to Congress--
(i) a report on the results of the study; and
(ii) a recommendation with respect to whether the pilot
project should be modified, extended in duration, or
established as a permanent program.
(e) Sunset.--The pilot project established by subsection
(b) shall terminate on the date that is four years after the
date of the enactment of this Act.
(f) No Additional Funds.--
(1) In general.--No additional funds are authorized to be
appropriated for the purpose of carrying out this section.
(2) Existing authorized amounts.--Funds to carry out this
section may, as provided in advance in appropriations Acts,
only come from amounts authorized to be appropriated to--
(A) the United States Cyber Command, with respect to the
Civilian Cybersecurity Reserve at the United States Cyber
Command established under subsection (b)(1); and
(B) the Agency, with respect to the Civilian Cybersecurity
Reserve at the Agency established under subsection (b)(2).
______