Last month Sen Hassan (D,NH) introduced S 2274, the Federal Cybersecurity Workforce Expansion Act. It would allow CISA to establish an apprenticeship program that would lead to cybersecurity related employment with CISA or a CISA supporting entity. The bill would also require the Veterans Administration to establish a pilot program providing cyber-specific training for eligible individuals. The CISA program is authorized ‘such funds as necessary’, but no funding is specified for the VA program.
Definitions
The two programs are established under separate sections and each section has its own, unrelated definitions.
The CISA program is outlined in a new §2218 added to the Homeland Security Act of 2002. It defines 16 critical terms in §2218(a). Only one of those terms is related to cybersecurity (‘cybersecurity work roles’) and that is defined by reference to National Initiative for Cybersecurity Education Cybersecurity Workforce Framework (NIST SP 800–181).
The VA program is outlined in §4 of the bill. It defines 4 critical terms in §4(a). None of those terms are directly related to cybersecurity.
CISA Apprenticeship Program
Section 3 of the bill amends the Homeland Security Act of 2002 by adding a new §2218 to the subtitle authorizing CISA (this will probably end up being 6 USC 665 if this bill is enacted). This new section would allow CISA, within 2 years, to establish an apprenticeship program that leads directly to cybersecurity employment with CISA, or a position that is certified by the Director as contributing to the national cybersecurity of the United States; and is funded at least in majority part through a contract, grant, or cooperative agreement with the Agency.
Program participants could be entered into “cybersecurity-specific excepted service positions” authorized by 6 USC 658.
VA Cyber Training for Veterans
Section 4(b) would require the VA, within one year, to establish a pilot ‘cyber-specific’ training program for veterans and transitioning military personnel that would be aligned “with the taxonomy, including work roles and associated tasks, knowledge, and skills” of NIST SP 800–181.
Federal Workforce Assessment
A very brief §5 of the bill would extend the annual cyber-related work roles reporting requirements §304(a) of the Federal Cybersecurity Workforce Assessment Act of 2015{Title III of Division N of PL 114-113, 129 STAT. 2977} through 2025.
Moving Forward
Hassan is a member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. She probably has enough influence to see this bill considered in Committee. I see nothing in the bill that would engender any specific opposition. I suspect that it would receive significant bipartisan support in committee. This bill would not be considered on the floor of the Senate under regular order, but it might make it into the DHS spending bill as an amendment.
Commentary
While this bill does not directly address control system security issues, increasing the cybersecurity qualified staffing of CISA is certainly of interest to the ICS security community. While the training programs established under this bill would be targeted at future CISA employment, they should result in a net increase to the nation’s cybersecurity workforce.