    [House Hearing, 117 Congress]
    [From the U.S. Government Publishing Office]

                      THE CYBER TALENT PIPELINE: EDUCATING A
                       WORKFORCE TO MATCH TODAY'S THREATS

    =======================================================================

                                    HEARING

                                   BEFORE THE

                                SUBCOMMITTEE ON
                         CYBERSECURITY, INFRASTRUCTURE
                           PROTECTION, AND INNOVATION

                                     OF THE

                         COMMITTEE ON HOMELAND SECURITY
                            HOUSE OF REPRESENTATIVES

                        ONE HUNDRED SEVENTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 JULY 29, 2021

                                   __________

                               Serial No. 117-27

                                   __________

           Printed for the use of the Committee on Homeland Security

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

            Available via the World Wide Web: http://www.govinfo.gov

                                   __________

                        U.S. GOVERNMENT PUBLISHING OFFICE
    46-039 PDF                 WASHINGTON : 2021

    -----------------------------------------------------------------------------------

                         COMMITTEE ON HOMELAND SECURITY

                   Bennie G. Thompson, Mississippi, Chairman
    Sheila Jackson Lee, Texas            John Katko, New York
    James R. Langevin, Rhode Island      Michael T. McCaul, Texas
    Donald M. Payne, Jr., New Jersey     Clay Higgins, Louisiana
    J. Luis Correa, California           Michael Guest, Mississippi
    Elissa Slotkin, Michigan             Dan Bishop, North Carolina
    Emanuel Cleaver, Missouri            Jefferson Van Drew, New Jersey
    Al Green, Texas                      Ralph Norman, South Carolina
    Yvette D. Clarke, New York           Mariannette Miller-Meeks, Iowa
    Eric Swalwell, California            Diana Harshbarger, Tennessee
    Dina Titus, Nevada                   Andrew S. Clyde, Georgia
    Bonnie Watson Coleman, New Jersey    Carlos A. Gimenez, Florida
    Kathleen M. Rice, New York           Jake LaTurner, Kansas
    Val Butler Demings, Florida          Peter Meijer, Michigan
    Nanette Diaz Barragan, California    Kat Cammack, Florida
    Josh Gottheimer, New Jersey          August Pfluger, Texas
    Elaine G. Luria, Virginia            Andrew R. Garbarino, New York
    Tom Malinowski, New Jersey
    Ritchie Torres, New York
                           Hope Goins, Staff Director
                     Daniel Kroese, Minority Staff Director
                              Natalie Nixon, Clerk
                                     ------

         SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND
                                   INNOVATION

                     Yvette D. Clarke, New York, Chairwoman
    Sheila Jackson Lee, Texas            Andrew R. Garbarino, New York,
    James R. Langevin, Rhode Island          Ranking Member
    Elissa Slotkin, Michigan             Ralph Norman, South Carolina
    Kathleen M. Rice, New York           Diana Harshbarger, Tennessee
    Ritchie Torres, New York             Andrew Clyde, Georgia
    Bennie G. Thompson, Mississippi (ex  Jake LaTurner, Kansas
        officio)                         John Katko, New York (ex officio)
                   Moira Bergin, Subcommittee Staff Director
              Austin Agrella, Minority Subcommittee Staff Director
                       Mariah Harding, Subcommittee Clerk

                                C O N T E N T S

                                  ----------
                                                                       Page

                                   Statements

    The Honorable Yvette D. Clarke, a Representative in Congress From
      the State of New York, and Chairwoman, Subcommittee on
      Cybersecurity, Infrastructure Protection, and Innovation:
      Oral Statement.................................................     1
      Prepared Statement.............................................     3
    The Honorable Andrew R. Garbarino, a Representative in Congress
      From the State of New York, and Ranking Member, Subcommittee on
      Cybersecurity, Infrastructure Protection, and Innovation:
      Oral Statement.................................................     4
      Prepared Statement.............................................     5
    The Honorable Bennie G. Thompson, a Representative in Congress
      From the State of Mississippi, and Chairman, Committee on
      Homeland Security:
      Prepared Statement.............................................     6

                                   Witnesses

    Mr. Kevin Nolten, Director of Academic Outreach, Cyber.Org, Cyber
      Innovation Center:
      Oral Statement.................................................     7
      Prepared Statement.............................................     9
    Dr. Tony Coulson, Ph.D., Professor and Executive Director,
      Cybersecurity Center Lead, National Centers of Academic
      Excellence in Cybersecurity Community:
      Oral Statement.................................................    15
      Prepared Statement.............................................    16
    Mr. Ralph F. Ley, Department Manager, Workforce Development and
      Training Infrastructure Assurance & Analysis Division, National
      & Homeland Security, Idaho National Laboratory:
      Oral Statement.................................................    25
      Prepared Statement.............................................    26
    Mr. Max Stier, President and CEO, Partnership for Public Service:
      Oral Statement.................................................    29
      Prepared Statement.............................................    31

                                    Appendix

    Statement of Bitwise Industries..................................    59

       THE CYBER TALENT PIPELINE: EDUCATING A WORKFORCE TO MATCH TODAY'S
                                    THREATS

                                  ----------

                            Thursday, July 29, 2021

                 U.S. House of Representatives,
                        Committee on Homeland Security,
                                Subcommittee on Cybersecurity,
                                     Infrastructure Protection,
                                                and Innovation,
                                                        Washington, DC.
        The subcommittee met, pursuant to notice, at 10 a.m., via
    Webex, Hon. Yvette D. Clarke [Chairwoman of the subcommittee]
    presiding.
        Present: Representatives Clarke, Langevin, Slotkin, Rice,
    Torres, Garbarino, Harshbarger, and Clyde.
        Chairwoman Clarke. The Subcommittee on Cybersecurity
    Infrastructure Protection and Innovation will come to order.
        Without objection, the Chair is authorized to declare the
    subcommittee in recess at any point.
        Good morning and thank you to our witnesses for joining us
    today for this hearing on strengthening our Nation's
    cybersecurity work force.
        A recent report by the cybersecurity firm Sonicwall found
    that ransomware attacks in North America increased 158 percent
    between 2019 and 2020. Another report by Comparitech found that
    cyber attacks against U.S. Government organizations affected 71
    million Americans and cost over $18 billion in down time and
    recovery.
        The surge in cyber attacks against State and local
    governments, hospitals, and school districts, coupled with
    recent headlines about SolarWinds, Colonial Pipeline, and
    Kaseya have galvanized new calls to action to better defend the
    internet ecosystem. I am encouraged by the momentum, and I am
    committed to putting more resources in the hands of State and
    local governments and improving CISA's awareness of malicious
    cyber activity through cyber incident reporting.
        But without a capable cyber work force, all of our
    investments in tools and data will be in vain. The number of
    high-profile cyber incidents over the past year has emphasized
    just how essential cybersecurity has become. The truth is the
    number of trained cybersecurity professionals has not increased
    to the levels necessary to meet the demand from industry and
    Government. In fact, recent data show a deficit of over 460,000
    trained cybersecurity professionals in the United States,
    relative to our current needs.
        While the Federal Government has undertaken several
    initiatives in recent years to expand and better train our
    Nation's cybersecurity work force, we must do more. This
    hearing will give us an opportunity to hear from experts in the
    field who are working to educate the next generation of
    cybersecurity workers, so we can learn more about the programs
    that are currently in place and where greater investment is
    needed. There is no silver bullet. We will need a multi-pronged
    approach that focuses on training the cybersecurity work force
    of the future in schools and universities, re-skilling existing
    workers for the jobs that are currently available, and making
    sure we have the right training in place to address the
    disparate cybersecurity challenges in information technology
    and operational technology.
        During my 15 years in Congress working on cybersecurity
    issues, I have heard consistently about the importance of
    prioritizing K-12 cyber education to grow and diversify the
    talent pipeline. Over that time, an entire generation of
    students has graduated high school and entered higher education
    or the work force, and we still are behind where we need to be
    in including cyber education at the elementary and secondary
    level. However, CISA's Cybersecurity Education and Training
    Assistance Program, CETAP, has begun to show meaningful
    results. I am glad Congress demonstrated support for CETAP by
    formally authorizing the program in last year's National
    Defense Authorization Act, and it is essential that Congress
    continues to provide it with the resources necessary to carry
    out its mission.
        I look forward to hearing today from the CETAP grant
    recipient, cyber.org, to learn more about their progress in
    developing curriculums for K-12 educators and what more can be
    done to both expand resources to teachers and build awareness
    of existing programs. Reaching children in the K-12 environment
    is an important step in making sure we don't leave talent
    untapped. Just as important, however, is that we reach students
    in college, contemplating college, or mid-career who may not
    have considered a career in cybersecurity to be a viable
    option. That is is where bringing cybersecurity work force
    programs to overlooked communities and re-skilling programs
    come in, and I look forward to hearing from California State
    University at San Bernardino on its important work in this
    space.
        Finally, as we look for new opportunities to redouble our
    efforts to grow our Nation's cyber talent, I want to be mindful
    that cybersecurity training is not one size fits all. The
    recent Colonial Pipeline ransomware attack highlighted the
    significant impact any incident involving critical
    infrastructure can have. While the attack only affected the
    information technology systems of the pipeline company, the
    precautionary decision to shut off operational technology
    systems reflected the vulnerability of our industrial control
    systems.
        As we work to address our cyber work force shortage, we
    must remain cognizant of the different skills and positions
    involved in securing industrial control systems and ensure that
    our training programs fully reflect the broad range of
    cybersecurity threats we face.
        Before I close, I want to commend Secretary Mayorkas for
    making enhancing the cyber work force the second of DHS's 60-
    day cyber sprints. By prioritizing this aggressive approach,
    Secretary Mayorkas has made meaningful progress in reducing the
    significant number of cyber vacancies at the Department while
    taking additional steps to address the shortage of cyber
    professionals nationally. A diverse and skilled work force has
    always been a competitive advantage for our Nation against our
    adversaries, but with constantly evolving cyber threats, we
    must continuously be looking to enhance our cyber education to
    stay ahead.
        I look forward to the testimony of our witnesses and the
    discussion today so this subcommittee can continue working to
    enhance our Nation's cyber work force.
        [The statement of Chairwoman Clarke follows:]
                    Statement of Chairwoman Yvette D. Clarke
                                 July 29, 2021
        A recent report by the cybersecurity firm Sonicwall found that
    ransomware attacks in North America increased 158 percent between 2019
    and 2020. Another report by Comparitech found that cyber attacks
    against U.S. Government organizations affected 71 million Americans and
    cost over $18 billion in downtime and recovery. The surge in cyber
    attacks against State and local governments, hospitals, and school
    districts, coupled with recent headlines about SolarWinds, Colonial
    Pipeline, and Kaseya have galvanized new calls to action to better
    defend the internet ecosystem.
        I am encouraged by the momentum, and I am committed to putting more
    resources in the hands of State and local governments and improving
    CISA's awareness of malicious cyber activity through cyber incident
    reporting. But without a capable cyber workforce, all of our
    investments in tools and data will be in vain. The number of high-
    profile cyber incidents over the past year has emphasized just how
    essential cybersecurity has become. And the truth is the number of
    trained cybersecurity professionals has not increased to the levels
    necessary to meet the demand from industry and Government. In fact,
    recent data show a deficit of over 460,000 trained cybersecurity
    professionals in the United States, relative to our current needs.
        While the Federal Government has undertaken several initiatives in
    recent years to expand and better train our Nation's cybersecurity
    workforce, we must do more. This hearing will give us an opportunity to
    hear from experts in the field who are working to educate the next
    generation of cybersecurity workers, so we can learn more about the
    programs that are currently in place and where greater investment is
    needed.
        There is no silver bullet. We will need a multi-pronged approach
    that focuses on training the cybersecurity workforce of the future in
    schools and universities, re-skilling existing workers for the jobs
    that are currently available, and making sure we have the right
    training in place to address the disparate cybersecurity challenges in
    Information Technology and Operational Technology.
        During my 15 years in Congress working on cybersecurity issues, I
    have heard consistently about the importance of prioritizing K-12 cyber
    education to grow and diversify the talent pipeline. Over that time, an
    entire generation of students has graduated high school and entered
    higher education or the workforce, and we still are behind where we
    need to be in including cyber education at the elementary and secondary
    level. However, CISA's Cybersecurity Education and Training Assistance
    Program, or CETAP has begun to show meaningful results.
        I am glad Congress demonstrated support for CETAP by formally
    authorizing the program in last year's National Defense Authorization
    Act, and it is essential that Congress continues to provide it with the
    resources necessary to carry out its mission. I look forward to hearing
    today from the CETAP grant recipient, CYBER.ORG, to learn more about
    their progress in developing curriculums for K-12 educators and what
    more can be done to both expand resources to teachers and build
    awareness of existing programs. Reaching children in the K-12
    environment is an important step in making sure we don't leave talent
    untapped.
        Just as important, however, is that we reach students in college,
    contemplating college, or mid-career who may not have considered a
    career in cybersecurity to be a viable option. That is where bringing
    cybersecurity workforce programs to overlooked communities and
    reskilling programs come in, and I look forward to hearing from
    California State University, San Bernardino on its important work in
    this space.
        Finally, as we look for new opportunities to redouble our efforts
    to grow our Nation's cyber talent, I want to be mindful that
    cybersecurity training is not one size fits all. The recent Colonial
    Pipeline ransomware attack highlighted the significant impact any
    incident involving critical infrastructure can have. While the attack
    only affected the information technology systems of the pipeline
    company, the precautionary decision to shut off operational technology
    systems reflected the vulnerability of our industrial control systems.
    As we work to address our cyber workforce shortage, we must remain
    cognizant of the different skills and positions involved in securing
    industrial control systems and ensure that our training programs fully
    reflect the broad range of cybersecurity threats we face.
        Before I close, I want to commend Secretary Mayorkas for making
    enhancing the cyber workforce the second of DHS's 60-day cyber sprints.
    By prioritizing this aggressive approach, Secretary Mayorkas has made
    meaningful progress in reducing the significant number of cyber
    vacancies at the Department while taking additional steps to address
    the shortage of cyber professionals Nationally. A diverse and skilled
    workforce has always been a competitive advantage for our Nation
    against our adversaries, but with constantly-evolving cyber threats, we
    must continuously be looking to enhance our cyber education to stay
    ahead.

        Chairwoman Clarke. The Chair now recognizes the Ranking
    Member of the subcommittee, the gentleman from New York, Mr.
    Garbarino, for an opening statement.
        Mr. Garbarino. Thank you, Chairwoman. Thank you very much.
    This is a great hearing. Thank you for holding this critical
    conversation regarding our cyber talent pipeline and our shared
    efforts to develop a robust cyber work force.
        I would like to thank our witnesses for being here today. I
    look forward to a constructive dialog on this important issue.
        Is it not working?
        Chairwoman Clarke. Mr. Garbarino, I think for some reason
    we are not hearing you. Try unmuting once again. We still
    aren't hearing you.
        Ms. Slotkin. Madam Chair? I could hear him the first time.
    I heard him loud and----
        Mr. Garbarino. Can you hear me now?
        Ms. Slotkin. I can.
        Mr. Garbarino. It worked? So now it is working? OK. Thank
    you.
        All right. Thank you, Madam Chair, for holding this
    critical conversation regarding our cyber talent pipeline and
    our shared efforts to develop a robust cyber work force.
        I would like to thank our witnesses for being here today. I
    look forward to a constructive dialog on this important issue.
        Everyone in this hearing should understand the multitude of
    issues contributing to our cyber work force shortage, which is
    particularly acute in the Federal sector. Lack of exposure,
    uneven education, and issues with Federal agency on-boarding
    all contribute to the problem. Fortunately, President Biden's
    choices for the top three cyber professionals in the
    administration are real professionals and there is a wealth of
    private and Federal sector experience among them. I am
    confident that Jen Easterly, Anne Neuberger, and Chris Inglis
    will have the experience, the talent, and drive to address the
    issue, as well as the many others facing our Nation in the
    space.
        The administration's work has already been seen in CISA's
    deployment of Stopransomware.gov, the U.S. Government's
    official one-stop location for resources to tackle ransomware
    more effectively.
        But their work is not done. CISA has been plagued by hiring
    delays, elongated on-boarding processes, a lack of professional
    human resources specialists, and duplicative and arbitrarily
    onerous vetting requirements. It is important that we continue
    to hold CISA and the Department accountable when it comes to
    these troubling issues. I appreciate the Chairwoman working
    with me on our oversight of the cyber talent management system
    roll-out. I am pleased that CISA director Jen Easterly has said
    this will be a top priority during her tenure.
        Our concerns are particularly relevant to today's hearing
    because no matter how much education we provide to our
    students, no matter how much interest we cultivate, none of it
    matters if we can't bring qualified and interested individuals
    into the Government service in a professional and timely
    manner. Quite simply, we will continue shouting into the wind
    until we fix these issues.
        I look forward to exploring all these issues with our
    witnesses today and I hope to hear about concrete proposals for
    oversight in legislation, not just broad stroke ideas, which
    have been the output of similar hearings in the past and have
    proven ineffective.
        Again, I thank the Chairwoman for holding this timely and
    important hearing today.
        Thank you.
        [The statement of Ranking Member Garbarino follows:]
                Statement of Ranking Member Andrew R. Garbarino
        Thank you, Madam Chair, for holding this critical conversation
    regarding our cyber talent pipeline and our shared efforts to develop a
    robust cyber workforce. I'd like to thank our witnesses for being here
    today. I look forward to a constructive dialog on this important issue.
        Everyone in this hearing should understand the multitude of issues
    contributing to our cyber workforce shortage, which is particularly
    acute in the Federal sector. Lack of exposure, uneven education, and
    Federal agency on-boarding issues all contribute to the problem.
        Fortunately, President Biden's choices for the top three cyber
    professionals in the administration are real professionals, and there
    is a wealth of private and Federal sector experience among them. I am
    confident that Jen Easterly, Anne Neuberger, and Chris Inglis have the
    experience, the talent, and drive to address this issue as well as the
    many others facing our Nation in the space.
        The administration's work has already been seen in CISA's
    deployment of stopransomware.gov, the U.S. Government's official one-
    stop location for resources to tackle ransomware more effectively.
        But their work is not done. CISA has been plagued by hiring delays,
    elongated on-boarding processes, a lack of professional human resource
    specialists, and duplicative and arbitrarily onerous vetting
    requirements.
        It is important that we continue to hold CISA and the Department
    accountable when it comes to these troubling issues, and I appreciate
    the Chairwoman working with me on our oversight of the Cyber Talent
    Management System rollout. I am pleased that CISA Director Jen Easterly
    has said this will be a top priority during her tenure.
        Our concerns are particularly relevant to today's hearing, because
    no matter how much education we provide to our students, no matter how
    much interest we cultivate, none of it matters if we can't bring
    qualified and interested individuals into Government service in a
    professional and timely manner. Quite simply, we will continue shouting
    into the wind until we fix these issues.
        I look forward to exploring all of these issues with our witnesses
    today and I hope to hear about concrete proposals for oversight and
    legislation, not just broad strokes ideas, which have been the output
    of similar hearings in the past and have proven ineffective.
        I again thank the Chairwoman for holding this timely and important
    hearing today.

        Chairwoman Clarke. I thank the Ranking Member.
        Members of the committee are reminded that the committee
    will operate according to the guidelines laid out by the
    Chairman and Ranking Member in their February 3 colloquy
    regarding remote procedures.
        I am looking to see whether our Chairman or Ranking Member
    have joined us today. They are not present yet, so let me move
    forward. Statements may be submitted for the record.
        [The statement of Chairman Thompson follows:]
                    Statement of Chairman Bennie G. Thompson
                                 July 29, 2021
        Today's hearing builds on a long-standing priority for the Homeland
    Security Committee--addressing the shortage of skilled cybersecurity
    professionals. This problem is not new, but the urgency is greater than
    ever in light of the increasing number of ransomware attacks and other
    significant cyber incidents.
        Fortunately, the Biden administration has made addressing
    cybersecurity workforce issues a priority, with Secretary Mayorkas
    launching a 60-day sprint on strengthening the cyber workforce earlier
    this year. This decision reflects an understanding that investments in
    technology are not sufficient on their own--we must also have a well-
    trained workforce.
        In today's digital age, a basic cybersecurity education is
    essential for everyone, not just cybersecurity professionals.
    Individuals are vulnerable to cyber criminals, and an employee clicking
    on a link in a phishing email can expose a company's networks to
    intruders.
        By investing in K-12 cyber education, we improve cyber literacy
    across the board, while developing a pipeline of young people who can
    move into more advanced training and join the cybersecurity workforce.
    Unfortunately, many students currently receive limited cybersecurity
    education in school today, and the evidence suggests rural and low-
    income schools with fewer resources are less likely to offer this
    important training.
        The Federal Government can help address this gap by providing
    resources to schools across the country, offering trainings to
    teachers, and developing cybersecurity curriculum that can be used
    nationally. Additionally, by starting education early, we can help
    address a long-standing concern of mine regarding the cybersecurity
    workforce--the low number of women and minorities in the field,
    particularly in senior roles.
        I am glad DHS is taking steps to address this through a partnership
    with the Girl Scouts that will help to educate school-aged girls in
    cybersecurity and that CYBER.ORG is partnering with HBCUs to help
    develop a pipeline of Black high school students into cybersecurity
    programs. These actions demonstrate the important role DHS can and
    should play in encouraging cyber education. These are important
    programs, but we'll need a lot more of them to make up for the current
    gaps. Many cybersecurity jobs are high-paying, and they required a
    variety of education levels, but many young people may not know about
    them or may not believe they are attainable.
        Federal investment in K-12 cyber education can raise awareness of
    these career opportunities to more students, increase the diversity of
    our workforce, and strengthen our National security. Additionally,
    programs supporting cyber education must continue at higher education
    institutions and in trainings that can provide cyber skills education
    to those already in the workforce. DHS's support for the National
    Centers for Academic Excellence in Cybersecurity and partnerships with
    other entities like the National labs are important examples of how
    Government, researchers, and teachers can work collaboratively to
    address our cyber workforce shortage. DHS must continue to strengthen
    these partnerships--particularly in collaboration with HBCUs and MSIs--
    in order to develop the workforce we need to address the varied cyber
    threats we face today.
        I thank Chairwoman Clarke for her leadership in holding this
    hearing and for prioritizing this critical issue. The excellent
    witnesses here today have a broad range of expertise in the field of
    cybersecurity education and their insights will be valuable as we
    continue our work in defending the homeland from cyber threats.

        Chairwoman Clarke. I now welcome our panel of witnesses.
        First, I welcome Mr. Kevin Nolten, the director of academic
    outreach for the Cyber Innovation Center at cyber.org. At
    cyber.org Mr. Nolten helps advance cyber.org's K-12 cyber
    education program within age-appropriate content that aligns
    with State standards for education.
        Next is Dr. Tony Coulson who serves as the executive
    director of the Cybersecurity Center at California State
    University, San Bernardino, and as lead of National Centers of
    Academic Excellence in Cybersecurity Community.
        California State University, San Bernardino is designed at
    a center of academic excellence in cyber defense education by
    the National Security Agency and the Department of Homeland
    Security and it is also a minority-serving institution.
        Next is Mr. Ralph Ley, the department manager for Workforce
    Development and Training Infrastructure within the National and
    Homeland Security Directorate at Idaho National Labs.
        Mr. Ley leads educational programs and research to address
    cybersecurity issues and work force development needs.
        Finally, Max Stier, the president and CEO of the
    Partnership for Public Service.
        In that capacity, he is overseeing the creation and growth
    of a network connecting more than 1,000 colleges and
    universities with 80 Federal agencies. He is a thought leader
    on Federal work force issues and his work is aimed at inspiring
    a new generation to serve in Government.
        Without objection, the witnesses' full statements will be
    inserted in the record.
        I will now ask each witness to summarize his or her
    statement for 5 minutes, beginning with Mr. Nolten.

       STATEMENT OF KEVIN NOLTEN, DIRECTOR OF ACADEMIC OUTREACH,
                   CYBER.ORG, CYBER INNOVATION CENTER

        Mr. Nolten. Good morning, Chairwoman Clarke, Ranking Member
    Garbarino, and distinguished Members of the committee. Thank
    you for the opportunity to testify today.
        I am Kevin Nolten, director of cyber.org, an academic
    initiative of the Cyber Innovation Center, headquartered in
    Bossier City, Louisiana.
        As a nonprofit focused on National security and
    cybersecurity work force development for the past 4 years, we
    are supported by Federal grants and contracts, one of which is
    a Cybersecurity Education Training Assistance Program, as the
    Chairwoman mentioned, or CETAP, a competitive grant
    administered by CISA.
        One of the greatest threats to our National security is the
    lack of K-12 cybersecurity education. Recent cyber attacks have
    demonstrated our vulnerabilities, which can be partially
    attributed to the growing shortage of cybersecurity
    professionals.
        As a former K-12 administrator, I know the impact K-12
    education has on a child's future degree and/or career. A cyber
    literate population will secure our critical infrastructure.
    Cyber.org's K-12 cyber education program provides teachers with
    curriculum and professional development that align with
    individual State and local education standard and promotes
    cybersecurity technical knowledge and degree and career
    awareness opportunities for students.
        Through CETAP we have reached over 23,000 educators in all
    50 States. It impacted over 3 million students. We embrace a
    focus on underserved schools in low socioeconomic regions as 64
    percent of all new teachers are from Title 1 schools. We
    embrace programming specific to ensuring HBCUs have a talent
    pipeline and that we are focusing on opportunities for students
    with disabilities.
        While we are tremendously proud of the success we have had,
    however, with nearly 1 million educators and 52 million across
    the country, our work has just begun.
        Chair and Ranking Member, in your home State of New York,
    690 educators are accessing the curricula and my team has
    trained 301 teachers. Further, in all of the subcommittee
    Members' States combined, over 4,400 educators are accessing
    the curricula and my team has trained over 3,800 teachers. This
    is a program that works.
        As a recent study shows, high schools using cyber.org's
    curricula sent four times more students into cyber-related
    college or university degree programs, such as Cal State San
    Bernardino. We appreciate that Congress has begun to recognize
    the importance of cybersecurity education to combat the threats
    of tomorrow, as CETAP has received bipartisan support.
        For example, the Cyberspace Solarium Commission called for
    additional support for CETAP. As the Chairwoman mentioned, the
    fiscal year 2021 NDAA formally authorized CETAP within CISA. In
    fiscal year 2021 CETAP received an increase of funding
    totalling $6 million.
        This year we are requesting that CETAP be funded at $10
    million, which would enable further scaling of the program to
    reach more teachers and ultimately benefiting more students.
        As your committee considers the future of cybersecurity
    education, cyber.org offers the following recommendations:
    First, we recommend increased and sustained funding for
    cybersecurity education and work-force development. It is
    critical that CISA include funding in its annual budget request
    to expand the reach of CETAP in classrooms across the country.
    Second, CETAP should be formally recognized as the K-12 feeder
    program for other Federal cybersecurity work force programs.
    Third, we recommend special attention be given to the what is
    next after the different academic milestones, whether K-12,
    higher education, et cetera, to better connect students
    directly to cybersecurity jobs.
        CISA and cyber.org have made tremendous impact in States
    across the country, but it is time to scale. Stable continuous
    funding and legislative support for CETAP will enable the
    program to reach saturation in all 50 States and grow the
    talent pipeline. Further investment by Congress to build our
    National cybersecurity defenses must include K-12 education
    resources.
        Cyber.org appreciates the time to testify and we are
    willing to serve as a resource for the development of any
    future cybersecurity education legislation.
        Thank you for your time.
        [The prepared statement of Mr. Nolten follows:]
                       Prepared Statement of Kevin Nolten
                      Thursday July 29, 2021 10 o'clock AM
        Good morning, Chair Clarke, Ranking Member Garbarino, and
    distinguished Members of the House Homeland Security Committee's
    Subcommittee on Cybersecurity, Infrastructure Protection, & Innovation.
    Thank you for the opportunity to testify before you today. I am Kevin
    Nolten, director of CYBER.ORG, the academic initiative of the Cyber
    Innovation Center, headquartered in Bossier City, LA.
        CYBER.ORG is an initiative focused on cybersecurity workforce
    education and development. CYBER.ORG is appreciative of the support we
    receive from a grant from the Department of Homeland Security's (DHS)
    Cybersecurity Infrastructure and Security Agency (CISA) as the lead
    performer of the Cybersecurity Education Training Assistance Program
    (CETAP) program.
        I commend this subcommittee for seeking to address the long-
    standing challenges facing cyber workforce development efforts,
    specifically as they relate to K-12 cybersecurity education and
    preparing the next generation for the jobs of tomorrow. My testimony
    will address the role K-12 cybersecurity education plays in creating a
    foundation of future cyber workers by closing the cybersecurity skills
    gap and supercharging the future cybersecurity workforce for DHS and
    industry.
        I would first like to provide the subcommittee with a brief
    overview of my background in education and the origin of CYBER.ORG.
    Prior to joining CYBER.ORG, I was an educator and school administrator,
    which provided me with a unique perspective on the education system and
    the critically important role educators play in providing students with
    the skills they need to succeed. This ignited my life-long passion for
    educating students, helping them prepare for their futures and
    ultimately improving K-12 education Nation-wide. In my role at
    CYBER.ORG, I direct the organization's programmatic outreach efforts
    and partnerships with the goal of increasing students' access to K-12
    cybersecurity curriculum. At CYBER.ORG, we approach the cybersecurity
    workforce gap as a National competitiveness issue and believe that
    increasing cybersecurity literacy will improve U.S. economic and
    National security. Providing students with an educational foundation
    and career awareness is imperative to advancing the U.S. cybersecurity
    workforce.
                                about cyber.org
        CYBER.ORG is the academic initiative of the Cyber Innovation Center
    (CIC), an economic development and technology innovation organization
    focused on growing the regional economy and supporting the National
    security enterprise through collaboration in mission-critical areas,
    such as the cybersecurity of our nuclear command, control, and
    communications systems. The CIC was founded in 2007 with the mission of
    diversifying the regional economy from primarily oil & gas and
    agriculture to include 21st Century, knowledge-based jobs in the cyber
    and information technology (IT) fields. The CIC recognized that to
    attract cyber and IT companies and jobs, the region would need a ready
    and able cyber workforce, and building that workforce would require a
    new approach to education. The success of our model has completely
    transformed the regional economy in northwest Louisiana: Cyber and IT
    are now equal to the oil & gas sector in economic impact and jobs. The
    operational success around cybersecurity the CIC gained at its
    inception furthered the demand for a comprehensive workforce
    development program--thus the launch of CYBER.ORG, whose K12 focus
    represents the entry point onto the Cyber Interstate.
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

        Created in 2011, CYBER.ORG (formerly the National Integrated Cyber
    Education Research Center or NICERC) identified a specific need in K-12
    education for a systematic and integrated solution that would build the
    foundation for educating the next-generation, cyber-literate workforce.
    Our goal was to engage K-12 students in STEM, computer science and most
    importantly, cybersecurity. Since then, we have implemented an
    integrated curricular experience across multiple academic disciplines
    through the development of project-driven, hands-on curricula;
    delivered educator professional development; established K-12
    cybersecurity-based pathways; and created National cybersecurity
    competitions; and.[sic]
        CYBER.ORG was initially created using State and local funds but was
    identified by the Department of Homeland Security in 2011 as an
    exemplar program and received funding to scale its efforts across the
    country. As a result of this funding and support, over the last 8 years
    CYBER.ORG has built a K-12 cyber education program with age-appropriate
    content that aligns with individual State standards for education. The
    impact of that work is measured in thousands of teachers and millions
    of students with access to more content, resources, and training that
    will fuel the cyber workforce pipeline for the future.
                                 the challenge
        The United States has been struggling to solve the cyber workforce
    shortage in this country for too long. The workforce gap that exists
    today is directly connected to the country's lack of attention to STEM
    (science, technology, engineering, mathematics) education 15-20 years
    ago. Very similar to the Space Race, the United States must ensure that
    our students, the future workforce of our country, are equipped with
    the knowledge, skills, and abilities to defend against vulnerabilities
    in cyber space.
        CYBER.ORG recognizes this mounting challenge and has built a
    successful educational model that is critical to ensuring that teachers
    can teach cybersecurity and students have the skills necessary to meet
    future workforce needs. The recent, unprecedented cyber attacks like
    the SolarWinds and Colonial Pipeline clearly demonstrate the adverse
    effects of our National cybersecurity vulnerabilities, which can in
    part be attributed to the U.S. workforce shortage. We must increase
    resources and partnerships with real investments in our future U.S.
    workforce to ensure we are better equipped to deal with emerging
    technological threats.
        Statistics highlight the urgency of this challenge, as increasingly
    complex attacks are occurring at a time when there are more than
    464,000 unfilled cybersecurity roles in the United States. Filling
    these positions is essential to protecting both public and private
    organizations from outside threats, advancing U.S. innovation, and
    diversifying our country's cybersecurity workforce. The first step
    toward doing this is educating students on cybersecurity literacy as
    early as kindergarten.
     cyber.org approach--empower educators to prepare the next generation
                                cyber workforce
        Advancing the cybersecurity workforce is critical to protecting the
    country's National security and advancing its cybersecurity posture. K-
    12 cybersecurity education plays a fundamental role in helping students
    develop the skills needed to pursue cybersecurity careers in greater
    numbers. As such, the CETAP Program is crucial to providing the United
    States with the professional-level expertise needed to solve the cyber
    challenges of tomorrow, but more can be done to support these efforts.
    CYBER.ORG has developed a multi-pronged approach to ensuring students
    Nation-wide have the educational cybersecurity foundation and career
    awareness needed to advance the National cybersecurity workforce.
    QUALITY CURRICULUM AND EFFECTIVE PROFESSIONAL DEVELOPMENT
        Through CETAP, CYBER.ORG develops and distributes cyber and
    cybersecurity curricula to K-12 educators across the country at no cost
    to the educators. The CYBER.ORG approach supports cybersecurity
    curriculum development to provide resources for elementary and
    secondary school teachers that foster foundational cybersecurity
    awareness, cybersecurity career awareness, and technical cybersecurity
    skills. The curriculum is mapped to relevant State and National
    standards and includes resources that make up 20+ full years of
    curriculum (180+ hours). The curriculum is developed by subject-matter
    experts in K-12 education, including faculty from higher education
    institutions across the country and representatives from industry and
    Government. The CYBER.ORG team, who serve as lead developers, are all
    experienced educators, many carrying a master's and/or doctorate degree
    in curriculum and instruction, educational leadership, and educational
    technology.
        CYBER.ORG currently provides K-12 cybersecurity workforce
    development assistance to educators in all 50 States, with a cumulative
    estimated impact of over 3,000,000 students. More than 23,000 teachers
    are currently enrolled in CYBER.ORG's content platform and over 17,000
    teachers have been trained to use CYBER.ORG content for K-12
    cybersecurity education.
        CYBER.ORG, in August 2021, will publish the country's first set of
    National K-12 cybersecurity learning standards. Currently, there are
    only a few models of State-developed cybersecurity standards and no
    National standards specific to cybersecurity. The goal with the
    standards is to increased access to cybersecurity education
    opportunities for students that will prepare them to enter the
    workforce or to expand their study in college. The standards will take
    two approaches. The first is ensuring students have a foundational
    cyber understanding and knowledge to live, work, and play in cyber
    space safely. The second is ensuring students have the technical skills
    to pursue industry-based certifications such as CompTIA's IT
    Fundamentals, A+ and Security+.
    NATION-WIDE DEPLOYMENT
        Over the past 8 years, CYBER.ORG has been the lead technical
    institution for CETAP as it has developed and distributed a scalable
    program for educating the next-generation, cyber-literate workforce
    through a replicable educational solution for State departments of
    education, school districts, and individual educators from across the
    county.
        CYBER.ORG has made a significant impact in advancing K-12
    cybersecurity education in States across the country thanks to
    partnerships with Government, educators, and school districts. With
    both a top-down and bottom-up approach, CYBER.ORG has been able to not
    only align programs to relevant State standards, help States develop
    cyber-related standards and pathways, and scale programming throughout
    the country, but also has been able to provide classroom-specific
    resources to educators wishing to implement modules on ransomware, or
    other cybersecurity topics.
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

        In addition to partnering with State departments of education,
    school districts, and classroom teachers, CYBER.ORG also prides itself
    on engagement with community organizations, non-profits, and industry.
    For example, in partnership with Palo Alto Networks, CYBER.ORG worked
    with the Girl Scouts USA to develop 18 cybersecurity badges to
    introduce more young women to cybersecurity. To date, more than 200,000
    cybersecurity badges have been earned by Girl Scouts from across the
    country.
        CYBER.ORG is also working with another global cybersecurity defense
    contractor to develop a ``badging'' program to ensure K-12 students
    have skill sets and industry-based certifications to pursue 2- and 4-
    year degrees or jump straight into the cybersecurity workforce
    immediately after high school.
        In the National delivery, CYBER.ORG has seen 64 percent of the
    teachers trained over the past 3 years come from Title 1 schools, that
    is schools that service students from low socioeconomic communities.
    Additionally, the efforts around diversifying the cybersecurity
    workforce have been very deliberate. Recently, CYBER.ORG launched a K-
    12 Historically Black College and University (HBCU) and Minority
    Serving Institution (MSI) Feeder Program to further strengthen the
    talent pipeline and increase the number of minority students pursuing
    cybersecurity degrees. CYBER.ORG is in the process of developing a K-12
    feeder program for Grambling State University (GSU), a HBCU and the
    first university in Louisiana to create a cybersecurity undergraduate
    degree. In 2021-2022, CYBER.ORG will replicate this program between
    minority-serving school districts and HBCUs across the country.
        The current reach of the CYBER.ORG curriculum content has impacted
    student achievement and interest in STEM and cyber career pathways. In
    a 2021 evaluation conducted by CYBER.ORG, 66 percent of students who
    completed CYBER.ORG's Cybersecurity course wanted to explore career
    options in cybersecurity, while 48 percent of students intended to earn
    at least one cyber-related industry-based certification before
    graduating from high school.
    CONNECTING STUDENTS TO CYBERSECURITY DEGREES AND CAREERS
        Many studies show that the formative years for a student's career
    trajectory occur around the middle school level, 6th-8th grade. This
    period, and the years leading up it, is critical for policy makers,
    industry, Government, and educators to begin introducing students to
    21st-Century options--jobs that many students don't know about, and in
    some cases jobs that do not yet exist.
        CYBER.ORG, as a workforce development organization, ensures
    teachers have the resources and confidence to prepare students for the
    next level--whether that is a 2- or 4-year college/university degree,
    or whether that is direct entry from high school into a cybersecurity
    career. This confidence is gained through the no-cost professional
    development offered by the CYBER.ORG team.
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

        In addition to increasing teacher's confidence in introducing their
    students to cybersecurity careers, CYBER.ORG provides students with
    Career Profile Cards (https://cyber.org/career-exploration/cyber-
    career-profiles) that introduces them to jobs in cybersecurity. Aligned
    to the NICE cybersecurity workforce framework, each Career Profile Card
    teaches students about the job, the skills sets required, the degree
    (if any) and the certifications (if any) needed for entry into this
    career.
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

        The multi-faceted approach CYBER.ORG takes yields results. A
    regional study (https://cyber.org/sites/default/files/2020-06/
    Louisiana%20Study.pdf) found that high schools with teachers enrolled
    in CYBER.ORG curricula on average sent, in total, four times more
    students into cyber-related college of university degree programs as
    those that did not.
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                       investing in k-12 cyber education
        The solution for solving the cybersecurity workforce shortage is
    developing a capable pipeline of cybersecurity professionals who are
    entering the workforce at every level of education. CYBER.ORG is
    enabling K-12 teachers to serve as force multipliers, educating
    students to build the cybersecurity workforce of the future. The CETAP
    model and CYBER.ORG have provided a clear blueprint for bolstering the
    U.S. workforce pipeline for other areas critical to U.S. economic
    development and global technological competitiveness.
        The work being done by CYBER.ORG through the CETAP program also
    supports the recommendations made by the Cyberspace Solarium
    Commission. The Commission's report on Growing a Stronger Federal
    Cybersecurity Workforce \1\ called out the importance of the CETAP
    program in helping recruit the talent needed to support the Federal
    workforce. The Solarium Commission also identified that the CETAP
    program has ``significant room to grow.'' To grow, CETAP would need
    additional funding and resources to:
    ---------------------------------------------------------------------------
        \1\ https://www.solarium.gov/public-communications/workforce-white-
    paper.
    ---------------------------------------------------------------------------
       Increased access to curricula for educators;
       Development of pathways for immediate job entry, more direct
            connection of high schools to post-secondary workforce
            pathways, and engagements with more HBCU institutions;
       Expansion of recruiting and retaining students from military
            families for future cyber employment;
       Development of virtual curricula, resources that can be used
            by schools for student asynchronous learning, particularly in
            rural and underserved communities; and
       Launch of a virtual cyber laboratory specifically used for
            K-12 educators, providing an application-based learning
            environment for real-world cybersecurity lessons.
        Congress has recognized the importance of CETAP. With the help of
    this committee's former Chair Cedric Richmond as well as Senators Rosen
    and Cassidy, the fiscal year 2021 National Defense Authorization Act
    (NDAA) formally authorized CETAP and codified the program's mission as
    a leader in the dissemination of cybersecurity-focused K-12 education
    resources and training. The fiscal year 2021 authorization was paired
    with an appropriation of the annual base amount of $4.3 million with an
    additional discretionary funding of $1.7 million for K-12 education at
    CISA. With the additional funding, CETAP utilized the additional $1.7
    million provided in discretionary support to enable the launch of three
    K-12 initiatives focusing on Historically Black Colleges and University
    (HBCU) feeder high schools and students with disabilities.
                                recommendations
        CYBER.ORG, through CETAP, has made a tremendous impact in States
    and districts across the country, but it is time to scale. Providing
    stable, continuous funding and legislative support for CETAP will
    enable the program to reach its short- and long-term goals of expanding
    programming in all 50 States so that every student in the United States
    is cyber literate and has the skills needed to pursue cybersecurity
    careers in greater numbers and fortify the workforce needed to combat
    increasingly complex attacks. The following recommendations and actions
    are important to large-scale impact of CYBER.ORG and CETAP.
       First, we recommend increased and sustained funding for
            cybersecurity education and workforce development. It is
            critical that CISA include funding in its annual budget request
            to sustain and expand the reach of the CETAP program in
            classrooms across the country. CETAP's cost-effective approach
            will get proven successful curriculum into the hands of more
            teachers who will continue to develop a strong, equitable
            pipeline of cybersecurity talent.
       Second, CETAP should be formally recognized as the K-12
            feeder program for other, Federal cybersecurity workforce
            programs. Connecting students directly to programs such as
            Centers for Academic Excellence, Scholarship for Service,
            Federal Apprenticeship Program, and others will ensure these
            Federal efforts complement one another and provide the best
            workforce outcomes possible.
       Third, we recommend special attention be given to ``what's
            next'' after the different academic milestones (K-12, higher
            education, reskilling, etc.)--that is, addressing the need for
            connecting students to cybersecurity jobs. Importantly,
            connecting students, whether high school, college, university
            graduates, or non-traditional students to the cybersecurity
            workforce is a critical step in closing the workforce gap in
            the country.
                                   conclusion
        It has been an honor to appear before this distinguished panel of
    policy makers. Thank you, Chair Clarke, and Ranking Member Garbarino
    for your dedication to growing and advancing the cybersecurity
    workforce.
        K-12 cybersecurity education must be viewed as the vehicle in which
    we can introduce the next generation of cybersecurity professionals to
    careers in the field. Expanding K-12 cybersecurity education is
    critical to addressing the cybersecurity workforce shortage. DHS has
    created a proven, cost-efficient model to train educators in
    cybersecurity and reach more K-12 students in classrooms across the
    country with cybersecurity curriculum. The CETAP program requires
    additional investment to close the cybersecurity workforce gap and grow
    the cybersecurity skills pipeline.
        CYBER.ORG envisions a future where every student is cyber literate
    and has the option to pursue cybersecurity careers. We look forward to
    working with the committee and serving as a resource as it develops
    policies to advance K-12 cybersecurity. We also remain committed to
    working with committee Members in their States and districts to advance
    the CETAP program and expand access to K-12 cybersecurity education.
        CYBER.ORG appreciates the opportunity to join in this worthy
    discussion and is willing to serve as a resource in the development of
    any cybersecurity education legislation going forward. We are thrilled
    to participate in today's hearing and look forward to a long
    partnership where we can continue working to tackle this important
    issue.
        Thank you, and I'll be happy to answer any of your questions.

        Chairwoman Clarke. Thank you, Mr. Nolten, for your
    testimony.
        I now recognize Dr. Coulson to summarize his statement for
    5 minutes.

       STATEMENT OF TONY COULSON, PH.D., PROFESSOR AND EXECUTIVE
       DIRECTOR, CYBERSECURITY CENTER LEAD, NATIONAL CENTERS OF
             ACADEMIC EXCELLENCE IN CYBERSECURITY COMMUNITY

        Mr. Coulson. Chairwoman Clarke, Ranking Member Garbarino,
    Members of the Cybersecurity Infrastructure Protection
    Innovation Subcommittee, thanks for having me.
        I am Tony Coulson from Cal State San Bernardino. We are a
    Hispanic-serving institution location in southern California.
    We have, under the leadership of Dr. Tomas Morales, expanded to
    over 20,000 students and are ranked 7th nationally for social
    mobility. But one thing we are known for is innovation.
        Now, you might ask yourself what does a regional university
    in California have to do with cybersecurity, and it is actually
    very simple. As has already been mentioned, we have a
    cybersecurity work force shortage. We know we have a crisis. I
    just looked up the number earlier before we came on, we have
    over 500,000-person shortage--500,000. Let that number sink in.
    This came from cyberseek.org. That is an absurd number. If this
    was doctors and nurses there would be a National outcry.
        Well, the good news is Cal State San Bernardino is
    committed to solve this work force problem. Recently our
    university established and began to lead the National Centers
    of Academic Excellence Cybersecurity Community. This community
    involves 5 Federal partners, the NSA, National Security Agency,
    who runs the program, DHS and CISA, NIST, and the NICE
    Initiative, as well as the FBI and the Department of Energy.
    Those Government partners are now coupled with the CAE
    community, the Centers of Academic Excellence community that we
    lead that has 335 colleges and universities working together to
    collaborate and solve the work-force shortage.
        Now, working with these partners, and also working with all
    of these universities, we have a lot of creativity and we have
    a lot of collaboration, but we also have an interesting vantage
    point where we see gaps and we see silos and we see
    duplication. We are trying to develop solutions. As cyber.org
    and Kevin, good friends, just said, look, we know that K-12 is
    a huge opportunity. There is a lot of activity in this space
    and there is a lot of investment through a lot of agencies. But
    there are still gaps. There is a lot of work to be done here,
    such as we need to increase diversity, but also in rural and
    home school networks.
        So the Centers of Academic Excellence community just
    released a program focusing on rural and home school. We just
    helped get AP cyber onto the National curriculum. We are
    putting together extracurriculars, such as camps and cyber
    competitions. Matter of fact, the gen cyber program at Cal
    State San Bernardino that we originally partnered with
    cyber.org, the genesis of that camp at Cal State San Bernardino
    that has now affected thousand of kids, led to a national Girl
    Scout badge.
        But it is more than K-12. The United States is facing a
    deficit in cyber research. We need to home-grow research skill.
    So Cal State San Bernardino and its partners in the community
    just launched the Information Security Research Education
    Program, a unique program where we take technical directors
    from the National Labs and the National Security Agency and
    others and work with student teams around the country in a
    variety of different institutions to solve real-world technical
    problems.
        Access is also a problem, access to technology, but also
    are we getting the return on investment, are we producing work-
    force ready students? Well, Cal State San Bernardino created
    the NICE Challenge Project, a National cyber range in use by
    500 colleges and universities that provides technology and does
    work-force readiness assessment.
        These are a lot of programs and there is a lot of things. I
    will tell you this, the Centers of Academic Excellence
    Community, those 335 schools, colleges, and universities that
    are working together today are producing over 100,000 diverse
    quality students, re-skilling people, working with veterans,
    working in our communities. This is all based on one-time
    funding and most of it has come from the National Security
    Agency. What I would like to see is I would like to see the
    Department of Homeland Security move forward and support with
    sustainable funding such an important initiative.
        Thank you so much for your time today.
        [The prepared statement of Dr. Coulson follows:]
                       Prepared Statement of Tony Coulson
                                 July 29, 2021
        Chairwoman Clarke, Ranking Member Garbarino, and Members of the
    Cybersecurity, Infrastructure Protection, & Innovation Subcommittee, I
    want to thank you for providing me with the opportunity to testify
    today. My name is Professor Tony Coulson and I serve as the executive
    director of the Cybersecurity Center at California State University,
    San Bernardino (CSUSB).
        CSUSB is one of 23 campuses that make up the great California State
    University system--the largest 4-year public university system in the
    world. Under the leadership of President Tomas Morales, CSUSB is a
    Nationally-recognized university, serving more than 20,000 students,
    most of whom come from the Riverside and San Bernardino counties, an
    area in inland Southern California known as the Inland Empire. As a
    Hispanic-Serving Institution (HSI), we are recognized for our
    transformative influence in our community. More than 80 percent of
    CSUSB's students are the first in their families to earn 4-year college
    degrees, and two-thirds of our students come from economically-
    disadvantaged circumstances. We are proud that CSUSB, with campuses San
    Bernardino and Palm Desert, is ranked No. 7 among top colleges and
    universities educating economically disadvantaged students and
    graduating them into well-paying jobs. CSUSB is recognized globally for
    our Jack H. Brown College of Business and Public Administration and
    Nationally for our leadership in developing the country's cybersecurity
    workforce.
        I am here today to specifically talk about ways how to bridge the
    Nation's cybersecurity workforce gap, how CSUSB's Cybersecurity Center
    is currently leading Nation-wide initiatives in this effort, and how
    existing U.S. Government programs are working with universities like
    mine to achieve this goal. More than 12 years ago, CSUSB created its
    Cybersecurity Center (``Center''), focused on one mission--creating a
    cybersecurity talent pool and a corresponding job base within the
    Inland Empire region of California. This has always been a clear need
    as the Inland Empire has been an economically depressed region for the
    last two decades, experiencing economic challenges like so many of our
    communities across the Nation, but with one of the lowest degree
    attainment rates in the State of California combined with low high
    school graduation rates.
        To address these issues, CSUSB created a Cybersecurity Center with
    four undergraduate programs in a variety of disciplines including
    criminal justice, business and public administration, computer science,
    and information science. This led us to develop five master's degree
    programs along the same disciplines (business, computer science,
    information systems, and public administration) but with one broader
    goal, to integrate the NSA Centers of Academic Excellence in
    Cybersecurity with the Intelligence Community CAE program--creating a
    critical new program to produce intelligence analysts with cyber
    skills. This new master's program in National Cybersecurity Studies
    became a model curriculum adopted by universities around the United
    States. From 12 years ago with 10 students, CSUSB now has over 600
    students enrolled in these degree programs. While CSUSB has always been
    innovative in its approach, providing an environment that built
    curriculum based on Government and industry workforce needs, it was the
    students that provided the energy and truly showed their capabilities.
        CSUSB is on the front line training the next generation of cyber
    warriors. We are proud to say that CSUSB's student outcomes are so
    strong that one program director at the U.S. Department of Homeland
    Security (DHS) once said that CSUSB students ``are everywhere'' and
    have commended the skill sets that CSUSB students have when they
    graduate.
        The Nation has had a dearth of well-trained cybersecurity workers
    for many years; however, the problem is greatly exacerbated by the
    integration of technology into every sector of our economy, leading to
    an inevitable growth of cybersecurity attacks. These attacks have
    illustrated the need to expeditiously fill the estimated 500,000-person
    deficit in the Nation's cybersecurity workforce. As part of my
    testimony today, I want to stress the importance of partnerships across
    academia, with the Government, as well as with industry. The 2020
    Cyberspace Solarium Commission report states that `` . . . sometimes
    success in building a robust Federal workforce depends on elements
    outside of the Federal Government. In those cases, the U.S. Government
    can and should play a supporting role by providing its partners in
    workforce development the tools needed to accelerate the increase in
    cyber personnel.''
        A 2021 report on ``The Hewlett Foundation's Cyber Talent Pipeline:
    An Evolution Based on Equitable Evaluation Framework Principles''
    states ``We identified 5 Minority-Serving Institutions to be in our
    evaluation sample; each has committed cyber faculty, existing
    innovative partnerships and the opportunity to further develop
    interdisciplinary education programs . . . Cal State San Bernardino
    leads a National collaboration of more than 300 universities and
    colleges dedicated to cyber and piloting innovations, many of which are
    community colleges.'' The report also states that ``the assumption that
    elite universities are best placed to enable multidisciplinary cyber
    education is not borne out by our evidence.''
        Just as President John F. Kennedy called for a greater goal for the
    United States to land a man on the moon, so must we as a Nation think
    about the global cyber race. In his speech before a Joint Session to
    Congress on May 25, 1961, the needs that President Kennedy highlighted
    still resonate today: ``I believe we possess all the resources and
    talents necessary. But the facts of the matter are that we have never
    made the National decisions or marshaled the National resources
    required for such leadership. We have never specified long-range goals
    on an urgent time schedule, or managed our resources and our time so as
    to insure their fulfillment.''
        I am happy to be here today to discuss this important challenge,
    describe what CSUSB is doing to help address the problem, discuss key
    Federal partnerships we have and the outcomes they are producing, and
    to share best practices for how we can address this problem head-on
    together.
          i. csusb and the national centers of academic excellence in
                             cybersecurity (ncae-c)
        The National Centers of Academic Excellence in Cybersecurity (NCAE-
    C) program was created in 1999, beginning with just 7 schools, and
    through its successful partnerships, the program has grown to 335
    schools across 48 States.\1\ The NCAE-C program is the Nation's premier
    cyber workforce development initiative that leverages the unique
    capabilities of the National Security Agency (NSA) and the member
    schools to meet the Nation's needs for a specialized education program
    and unique curricula. NCAE-C is the first, and only of its kind, to
    have clearly defined academic standards, curricula, and designations
    for cyber education, holding the member colleges and universities to
    rigorous educational standards.
    ---------------------------------------------------------------------------
        \1\ See Attachment A: List of schools in the NCAE-C program.
    ---------------------------------------------------------------------------
        CSUSB's Cybersecurity Center is part of the NCAE-C system and leads
    the Centers of Academic Excellence in Cybersecurity Community. Six
    years ago, there were 100 institutions in the program, now there are
    335 NSA-Designated Centers of Academic Excellence in Cybersecurity,
    educating approximately 100,000 students in cyber-related disciplines.
        The CAE Community in Cybersecurity program allows for innovation
    with our Government partners at NSA, the Program Office, as well as
    DHS, the Cybersecurity and Infrastructure Security Agency (CISA), the
    Federal Bureau of Investigation (FBI), the National Initiative for
    Cybersecurity Education (NICE), and the National Science Foundation
    (NSF).
        These partnerships are important as each agency plays a unique role
    in the CAE program. To help increase a talent pipeline for students
    into the Federal Government, DHS serves as a strategic partner in
    promoting cybersecurity education and workforce development, as well as
    strengthening partnerships between institutions and Federal, State,
    local, and Tribal governments.
              ii. csusb and cyber corps: scholarship for service
        A strong example of the benefit of partnerships is NSF's
    CyberCorps: Scholarship for Service program. This program has
    sponsored thousands of cybersecurity students leading them into
    Government cyber careers. This unique partnership with DHS, NSF, OMB,
    and the NSA CAE Program has produced thousands of quality cybersecurity
    graduates as well as building capacity for stronger cyber research and
    programs at colleges and universities. DHS and NSF further expanded the
    CyberCorps program by creating the Community College Cybersecurity
    Pilot scholarship program focused on veterans and persons with existing
    bachelor's degrees.
                       iii. csusb focus on k-12 programs
        CSUSB has a long-standing commitment to focusing not just on
    college-age students, but also on going deeper into the educational
    pipeline to start teaching cybersecurity skills to younger students. A
    great example of this is CSUSB's involvement in the GenCyber program--a
    partnership between the NSF and the NSA. The GenCyber program provides
    K-12 students the opportunity to go to ``cybersecurity summer camp''
    for free and for teachers to participate in training camps to provide
    cyber literacy in the classroom. CSUSB's early work in this program
    involved partnerships with the Girl Scouts of San Gorgonio Council as
    well as Title I middle schools, to reach underserved communities and
    promote diversity in cybersecurity talent. This successful series of
    camps serving over 1,200 girls eventually led to a National Girl Scout
    badge in cybersecurity.
        Through recent grant programs, the greater CAE Community schools
    are working together to create K-12 learning pathways to provide cyber
    literacy programs and prepare students for cyber careers. Cybersecurity
    teachers in schools around the country are learning new skills to teach
    cybersecurity and in doing so utilizing freely available CAE materials
    and those developed by our partners. The new Regions Investing in the
    Next Generation (RING) program from Illinois' Moraine Valley Community
    College and Alabama's University of Alabama Huntsville focuses on
    teaching cybersecurity skills in rural areas and home schools and
    provide resources for diverse communities including the economically
    disadvantaged, the deaf and hard of hearing, and the neurodiverse.
    Additionally, New York's Mohawk Valley Community College and Florida's
    University of West Florida have just launched the national Enigma
    cybersecurity competition. This National competition starts with 165
    12-person teams (1,980 high school students) to attack and defend in
    unique cyber scenarios as well as interact with potential employers.
    The CAE Community now has year-round extracurricular and in-school
    activities focused on cyber in K-12.
       iv. creating cutting-edge programs:--insure (information security
                              research education)
        Federal grants have also funded future-oriented programs, meaning
    that CAE Community schools and Government partners are not just
    focusing on the cybersecurity skills of today but also are looking at
    the cybersecurity skills that are needed 5 years from now and beyond.
        Recognizing a shortage of domestic research talent, CSUSB, working
    with the NSF, NSA, and CAE Community partners, has advanced a cutting-
    edge research program. Housed at CSUSB, this program, called the
    Information Security Research Education (INSuRE) program, works with
    technical directors from industry, the U.S. Department of Energy (DOE),
    National labs, DHS, and the NSA, to partner with student teams around
    the country on real cybersecurity problems. The CAE Community is
    listening to industry and Government needs, adapting its curriculum,
    and focusing on research in artificial intelligence (AI), autonomous
    vehicles (AV), advanced networks, and critical infrastructure
    protection.
     v. csusb partnering with community colleges and the national science
                 foundation advanced technology education (ate)
        CSUSB's collaboration and partnership mission is further evident
    with the cooperation of the NSA and the NSF's Advanced Technology
    Education (ATE) program. The National Cybersecurity Training and
    Education Center, based at Whatcom Community College in Washington
    State, focuses on opportunities and the development of cybersecurity
    workforce capabilities at community colleges Nation-wide, and working
    with the CAE Community, established a National Cybersecurity Virtual
    Career Fair to match students from CAE colleges and universities with
    employers across the Nation. In 2020, this career fair saw more than
    1,400 well-qualified CAE students and 38 employers participate. This
    year, the CAE Community is seeking to double that number. Future
    collaborations include National apprenticeship initiatives partnering
    with CAE-designated schools.
             vi. csusb partnership with the nice challenge project
        Another strong example of how CSUSB's successful cybersecurity
    collaboration is the CAE Community's National cyber range, the NICE
    Challenge Project. The program is funded through grants from NSF, DHS,
    NSA, and the NICE program with a mission to create a range where
    cybersecurity participants can test their cyber workforce readiness,
    measured against the NIST Cybersecurity Workforce Framework (800-181)
    and NSA Knowledge Unit Standards. This system, free for use in higher
    education, currently serves thousands of students at 500 schools across
    the Nation. This program is exploring an expansion for helping
    veterans, and high schools, and working with CISA on Federal workforce
    training. With further funding from DHS, CISA, and NSA, this cyber
    range could be easily scaled to serve the Nation's high schools,
    providing progress toward workforce readiness. Working with CISA, CSUSB
    also sees opportunities for using the NICE Challenge as a means to
    train, develop, and validate the Federal workforce.
                               vii. looking ahead
        The Nation is grappling with a critical problem to address the
    cyber workforce challenge. Colleges and universities across the country
    are doing tremendous work to address the problem and CSUSB is doing its
    part each day to help bridge the workforce gap. As Congress grapples
    with solutions to these challenges, it must avoid creating new programs
    in the Federal Government, but rather provide steady-state funding to
    ones that are in existence and have a long history of success. The CAE
    Community has existed for 22 years and has amazing return on investment
    using Federal funds. Other programs such as those I have described at
    NSF and NIST, working with the DHS and other agencies, are successful
    programs making great strides to address the problem.
        What makes the CAE Community program unique is its willingness to
    collaborate with a wide range of entities, from both industry and
    Government, as a critical resource. DHS has a unique vantage point
    based on its mission to safeguard the Nation's homeland, and DHS should
    promote sustained funding and leverage the capabilities of the CAE
    Community in its efforts to address cybersecurity workforce challenges.
        The colleges and universities that make up the CAE in Cybersecurity
    Community have boundless energy, but what is needed from Congress is a
    concerted focus and dedicated funding for all of these programs along
    with the need to avoid creating overlapping and duplicative programs
    across all other agencies. The model created in the CAE community,
    working with DHS, FBI, NSF, and NIST have a long history of success.
    The program is also created and run by those who understand
    cybersecurity and the educational needs of our community. We need to
    sustain and encourage the non-profit, collaborative approaches that
    work and dedicated funding is critical to helping to achieve these
    goals.
        We also need to ensure the workforce of the future is diverse in
    nature as well. The CAE Community schools are engaged in many
    initiatives building out diverse workforce, including wounded warriors,
    neurodiverse, women, and minority-serving institutions. The recently-
    launched Cyber Education Diversity Initiative (CEDI) is housed at
    Fordham University in New York State. This program is focused on
    building the capacity of minority-serving institutions (MSIs) to become
    CAE-designated as well as inviting students from MSIs to join
    competitions, hosting workshops for faculty, and allowing for students
    to transfer from MSIs to colleges with a cybersecurity degree program.
        NATO Secretary General Jens Stoltenberg, speaking at the Cyber
    Defence Pledge Conference in London in 2019, stated: ``It takes just a
    `click' to send a cyber virus spreading across the globe. But it takes
    a global effort to stop it from inflicting chaos.'' He went on to say
    ``But cyber goes beyond technology. The people behind the technology
    are just as important. We need to build a strong and diverse workforce
    of future cyber defenders.''
        The efforts by CSUSB and the Centers of Academic Excellence in
    Cybersecurity Community have generated undeniable results but tackling
    a 500,000-person workforce shortage is a problem that will require
    ``all hands-on deck.'' Where there are programs that already exist with
    long-standing demonstrable results, Congress should support those with
    dedicated funding. Thank you for your time and I look forward to any
    questions.
      Attachment.--NSA Designated Centers of Academic Excellence in Cyber
                                  Institutions
        Athens State University--AL
        Auburn University--AL
        Calhoun Community College--AL
        Jacksonville State University--AL
        Snead State Community College--AL
        The University of Alabama--AL
        The University of Alabama at Birmingham--AL
        The University of Alabama in Huntsville--AL
        Tuskegee University--AL
        University of South Alabama--AL
        University of Arkansas--AR
        University of Arkansas at Little Rock--AR
        Arizona State University--AZ
        Embry-Riddle Aeronautical University, Prescott Campus--AZ
        Estrella Mountain Community College--AZ
        Glendale Community College--AZ
        Grand Canyon University--AZ
        The University of Arizona--AZ
        University of Advancing Technology--AZ
        California State Polytechnic University, Pomona--CA
        California State University, San Marcos--CA
        California State University, Sacramento--CA
        California State University, San Bernardino--CA
        City College of San Francisco--CA
        Coastline Community College--CA
        Cypress College--CA
        Long Beach City College--CA
        National University--CA
        Naval Postgraduate School--CA
        Ohlone College--CA
        Sierra College--CA
        University of California, Davis--CA
        University of California, Irvine--CA
        Arapahoe Community College--CO
        Colorado School of Mines--CO
        Colorado State University--Pueblo--CO
        Colorado Technical University--CO
        Pikes Peak Community College--CO
        Pueblo Community College--CO
        Red Rocks Community College--CO
        Regis University--CO
        United States Air Force Academy--CO
        University of Colorado, Colorado Springs--CO
        University of Denver--CO
        University of Connecticut--CT
        University of New Haven--CT
        Georgetown University--DC
        The George Washington University--DC
        University of Delaware--DE
        Wilmington University--DE
        Daytona State College--FL
        Embry-Riddle Aeronautical University--Daytona Beach Campus--FL
        Florida A&M University--FL
        Florida Atlantic University--FL
        Florida Institute of Technology--FL
        Florida International University--FL
        Florida State College at Jacksonville--FL
        Florida State University--FL
        Indian River State College--FL
        Nova Southeastern University--FL
        Saint Leo University--FL
        St. Petersburg College--FL
        University of Central Florida--FL
        University of Florida--FL
        University of North Florida--FL
        University of South Florida--FL
        University of West Florida--FL
        Valencia College--FL
        Augusta Technical College--GA
        Augusta University--GA
        Columbus State University--GA
        Georgia Institute of Technology--GA
        Georgia Southern University--Armstrong Campus--GA
        Georgia State University--GA
        Kennesaw State University--GA
        Middle Georgia State University--GA
        Middle Georgia State University--MSIT--GA
        University of Georgia--GA
        University of North Georgia--GA
        Honolulu Community College--HI
        Leeward Community College--HI
        University of Hawaii--West Oahu--HI
        University of Hawaii at Manoa--HI
        University of Hawaii Maui College--HI
        Iowa State University--IA
        Idaho State University--ID
        North Idaho College--ID
        University of Idaho--ID
        College of DuPage--IL
        DePaul University--IL
        Illinois Institute of Technology--IL
        Illinois State University--IL
        John A Logan College--IL
        Lewis University--IL
        Lincoln Land Community College--IL
        Loyola University Chicago--IL
        Moraine Valley Community College--IL
        Rock Valley College--IL
        Roosevelt University--IL
        University of Illinois at Springfield--IL
        University of Illinois, Urbana--Champaign--IL
        Indiana University--IN
        Ivy Tech Community College--IN
        Purdue University--IN
        Purdue University Northwest--IN
        Butler Community College--KS
        Fort Hays State University--KS
        Johnson County Community College--KS
        Kansas State University--KS
        University of Kansas--KS
        Wichita State University--KS
        Bluegrass Community and Technical College--KY
        Murray State University--KY
        Northern Kentucky University--KY
        Owensboro Community and Technical College--KY
        University of Louisville--Graduate Certificate of Cybersecurity--KY
        University of Louisville, Kentucky--KY
        University of the Cumberlands--KY
        Bossier Parish Community College--LA
        Louisiana Tech University--LA
        University of New Orleans--LA
        Boston University--MA
        Northeastern University--MA
        University of Massachusetts Lowell--MA
        Worcester Polytechnic Institute--MA
        Anne Arundel Community College--MD
        Bowie State University--MD
        Capitol Technology University--MD
        Cecil College--MD
        College of Southern Maryland--MD
        Hagerstown Community College--MD
        Harford Community College--MD
        Howard Community College--MD
        Morgan State University--MD
        Prince George's Community College--MD
        The Community College of Baltimore County--MD
        The Johns Hopkins University--MD
        Towson University--MD
        United States Naval Academy--MD
        University of Maryland--MD
        University of Maryland Global Campus--MD
        University of Maryland, Baltimore County--MD
        Southern Maine Community College--ME
        University of Maine at Augusta--ME
        Baker College--MI
        Davenport University--MI
        Delta College--MI
        Eastern Michigan University--MI
        Ferris State University--MI
        Grand Rapids Community College--MI
        Henry Ford College--MI
        Lansing Community College--MI
        Macomb Community College--MI
        Oakland University--MI
        University of Detroit, Mercy--MI
        Walsh College--MI
        Washtenaw Community College--MI
        Capella University--MN
        Century College--MN
        Lake Superior College--MN
        Metropolitan State University--MN
        St. Cloud State University--MN
        Walden University--MN
        Metropolitan Community College--Kansas City--MO
        Missouri University of Science and Technology--MO
        Southeast Missouri State University--MO
        St. Louis Community College--MO
        University of Missouri--Columbia--MO
        University of Missouri--St. Louis--MO
        Webster University--MO
        Mississippi State University--MS
        Great Falls College Montana State University--MT
        Missoula College--MT
        Alamance Community College--NC
        East Carolina University--NC
        Fayetteville Technical Community College--NC
        Forsyth Technical Community College--NC
        Montreat College--NC
        North Carolina A&T State University--NC
        North Carolina State University--NC
        Pitt Community College--NC
        Sampson Community College--NC
        University of North Carolina, Charlotte--NC
        University of North Carolina, Wilmington--NC
        Wake Technical Community College--NC
        Bismarck State College--ND
        North Dakota State University--ND
        Bellevue University--NE
        Metropolitan Community College--NE
        Northeast Community College--NE
        University of Nebraska, Omaha--NE
        Dartmouth College--NH
        University of New Hampshire--NH
        Brookdale Community Collge--NJ
        County College of Morris--NJ
        Fairleigh Dickinson University--NJ
        New Jersey City University--NJ
        New Jersey Institute of Technology--NJ
        Rutgers, The State University of New Jersey--NJ
        Stevens Institute of Technology--NJ
        Central New Mexico Community College--NM
        Eastern New Mexico University--Ruidoso Branch Community College--NM
        New Mexico Tech--NM
        University of New Mexico--NM
        College of Southern Nevada--NV
        University of Nevada, Las Vegas--NV
        University of Nevada, Reno--NV
        Binghamton University (SUNY at Binghamton)--NY
        Excelsior College--NY
        Fordham University--NY
        Mercy College--NY
        Mohawk Valley Community College--NY
        New York Institute of Technology--NY
        New York University--NY
        Pace University--NY
        Rochester Institute of Technology--NY
        Rockland Community College--NY
        Syracuse University--NY
        University at Albany, the State University of New York--NY
        University at Buffalo, the State University of New York--NY
        Utica College--NY
        Utica College--MS Cybersecurity--NY
        Westchester Community College--NY
        Air Force Institute of Technology--OH
        Cedarville University--OH
        Clark State Community College--OH
        Columbus State Community College--OH
        Franklin University--OH
        Sinclair Community College--OH
        Terra State Community College--OH
        The Ohio State University--OH
        University of Cincinnati--OH
        Wright State University--OH
        Oklahoma City Community College--OK
        Oklahoma State University--OK
        Rose State College--OK
        University of Tulsa--OK
        Chemeketa Community College--OR
        Mt. Hood Community College--OR
        Portland Community College--OR
        Portland State University--OR
        Bloomsburg University of Pennsylvania--PA
        Carnegie Mellon University--PA
        Drexel University--PA
        East Stroudsburg University--PA
        Indiana University of Pennsylvania--PA
        Lehigh Carbon Community College--PA
        Pennsylvania Highlands Community College--PA
        Pennsylvania State University--PA
        Pittsburgh Technical College--PA
        Robert Morris University--PA
        Saint Vincent College--PA
        University of Pittsburgh--PA
        Valley Forge Military College--PA
        West Chester University of Pennsylvania--PA
        Polytechnic University of Puerto Rico--PR
        Community College of Rhode Island--RI
        New England Institute of Technology--RI
        University of Rhode Island--RI
        Clemson University--SC
        South Carolina State University--SC
        The Citadel--SC
        Trident Technical College--SC
        University of South Carolina--SC
        Dakota State University--SD
        Jackson State Community College--TN
        LeMoyne--Owen College--TN
        Roane State Community College--TN
        Tennessee Tech University--TN
        The University of Tennessee at Chattanooga--TN
        University of Memphis--TN
        El Paso Community College--TX
        Hill College--TX
        Houston Community College--TX
        Laredo College--TX
        McLennan Community College--TX
        Our Lady of the Lake University--TX
        Sam Houston State University--TX
        San Antonio College--TX
        South Texas College--TX
        Southern Methodist University--TX
        St. Philip's College--TX
        Texas A&M University--TX
        Texas A&M University--Corpus Christi--TX
        Texas A&M University--San Antonio--TX
        Texas State Technical College in Harlingen--TX
        The University of Texas at Austin--TX
        The University of Texas at San Antonio--TX
        University of Dallas--TX
        University of Houston--TX
        University of North Texas--TX
        University of Texas at Dallas--TX
        University of Texas at El Paso--TX
        Brigham Young University--UT
        Southern Utah University--UT
        Danville Community College--VA
        ECPI University--VA
        George Mason University--VA
        Germanna Community College--VA
        Hampton University--VA
        James Madison University--VA
        Liberty University--VA
        Lord Fairfax Community College--VA
        Marymount University--VA
        Mountain Empire Community College--VA
        Norfolk State University--VA
        Northern Virginia Community College--VA
        Old Dominion University--VA
        Radford University--VA
        Regent University--VA
        Southwest Virginia Community College--VA
        Thomas Nelson Community College--VA
        Tidewater Community College--VA
        University of Virginia--VA
        Virginia Commonwealth University--VA
        Virginia Polytechnic Institute and State University--VA
        Virginia Western Community College--VA
        Champlain College--UT
        Norwich University--UT
        City University of Seattle--WA
        Columbia Basin College--WA
        Edmonds Community College--WA
        Green River College--WA
        Highline College--WA
        Spokane Falls Community College--WA
        University of Washington--WA
        Whatcom Community College--WA
        Madison College--WI
        Marquette University--WI
        University of Wisconsin--Stout--WI
        Waukesha County Technical College--WI
        American Public University System--WV
        Blue Ridge Community and Technical College--WV
        West Virginia University--WV

        Chairwoman Clarke. Thank you, Dr. Coulson.
        I now recognize Mr. Ley to summarize his statement for 5
    minutes.

       STATEMENT OF RALPH F. LEY, DEPARTMENT MANAGER, WORKFORCE
     DEVELOPMENT AND TRAINING INFRASTRUCTURE ASSURANCE & ANALYSIS
        DIVISION, NATIONAL & HOMELAND SECURITY, IDAHO NATIONAL
                               LABORATORY

        Mr. Ley. Thank you, Chairwoman Clarke, Ranking Member
    Garbarino, and Members of the committee. It is an honor and a
    privilege to be with you today.
        My name is Ralph Ley. I am the department manager for
    Workforce Development and Training within the National and
    Homeland Security Directorate at Idaho National Laboratory. I
    am grateful for the opportunity to testify on the issues
    regarding the Nation's cyber talent pipeline and ways to ensure
    our work force is ready to meet future threats.
        As you probably all know, INL's long history with nuclear
    energy from its inception to the latest and recent work with
    small modular nuclear reactors, other energy sources, our one-
    of-a-kind wireless ranges and the wireless networks that are
    continuing to expand across the United States, various
    infrastructures and their test beds helping industry. It is
    easy to understand why we have a deep understanding for
    industrial control systems, control systems in general and how
    to protect them. In fact, the Cyberspace Solarium Commission
    called out INL as the Nation's center of excellence for
    industrial control system cybersecurity issues. Well-founded.
        Our department takes great pride in having the opportunity
    and responsibility to lead, influence, and execute a broad
    portfolio of educational programs and research that address IT
    and OT cybersecurity issues and work force development needs.
    Although INL supports and has its own numerous K-12
    cybersecurity initiatives and the great work, as you can see
    already some of the witnesses have testified, fantastic work,
    my primary focus today is to talk about issues relating to the
    post-secondary education institutes and existing work force
    already in business and Government agencies. That is an area
    that needs to be addressed and very quickly.
        For over 15 years DOE and DHS have asked us to provide ICS
    cybersecurity training courses to private-sector businesses,
    utilities, and Government agencies. The desired result was for
    participants to become aware of the difference between IT and
    OT networks and systems, how they interact with each other on
    the job, the IT and OT experts on businesses, and to develop
    projects within academia and industry to better understand the
    issues surrounding the cyber education of the Nation's work
    force--what are the impediments and influences in driving the
    cyber health, if you will, of organizations. One of our latest
    projects and documents you may have seen is in collaboration
    with Idaho State University, La Trobe University, titled
    ``Building an Industrial Cybersecurity Workforce: A Manager's
    Guide''. This is just a first attempt and first product that we
    have developed to address the job roles required by ICS
    professionals and how an organization may establish a capable
    work force. NIST has recognized the value of our efforts and
    has asked us to join them in building out their NICE framework
    that focuses on IT cybersecurity and move it into and
    incorporate segments and areas and issues surrounding the OT or
    industrial control systems as well.
        To further flush out issues that need to be addressed: We
    have also established our own industrial cybersecurity
    community to practice. One hundred fifty participants from the
    universities, industries, organizations from around the Nation
    and internationally to look at the issues.
        The recurring issues that are most prominent and that need
    to be addressed are, as I have listed in the testimony,
    standardizing curriculum for cyber degrees, establishing a
    shared repository for cybersecurity curriculum so that all
    institutes, large and small, can have access to it. But our
    main focus here is to--and we recommend the focus of energy to
    help industry organizations understand what their actual cyber
    job roles are and the educational needs. We find many don't
    even understand what their organizations need in cyber job
    roles and leading to the education of those individuals, and
    also how to hire the right individuals.
        There are many other issues out there that need to be
    addressed, but those are the two areas that we need to look at.
        I appreciate the opportunity to testify and I want to thank
    you again for your attention to this very important issue of
    our Nation and I look forward to your questions on
    cybersecurity and the work force and increasing the flow of the
    cyber talent pipeline.
        [The prepared statement of Mr. Ley follows:]
                       Prepared Statement of Ralph F. Ley
                                 July 29, 2021
        Chairwoman Clarke, Ranking Member Garbarino, and Members of the
    committee, it is an honor and privilege to be with you today. My name
    is Ralph Ley, and I am the department manager for workforce development
    and training within the national and homeland security directorate at
    Idaho National Laboratory (INL). I'm grateful for the opportunity to
    testify on issues regarding the Nation's cyber talent pipeline and ways
    to ensure our workforce is ready to meet future threats.
        I want to thank this subcommittee for addressing what we believe is
    a foundational workforce development and education issue facing this
    Nation from the standpoint of a continuously changing cyber threat
    landscape requiring professionals who have career-long access to
    updated curriculum containing new tactics, techniques, and procedures
    to sufficiently protect their networks and systems.
        Our conversation today is an important step forward for
    establishing a unified team with a focused approach toward implementing
    solutions to cyber workforce issues and progress--our security will
    benefit from this unified effort, it is greatly needed and appreciated.
        INL's Nationally-recognized expertise in industrial control systems
    (ICS) or operational technology (OT) cybersecurity stems from its long
    history and primary mission to conduct research, development, and
    demonstration of solutions that assure the advancement of nuclear
    energy, clean energy, and critical infrastructure protection
    technologies. From the beginning related infrastructure were full of
    control systems to ensure their safe and efficient operations. My
    department takes great pride in having the opportunities and
    responsibilities to lead, influence, and execute a broad portfolio of
    educational programs and research which address cybersecurity issues
    and workforce development needs.
        For over a decade Department of Energy (DOE) and Department of
    Homeland Security (DHS) Cybersecurity and Infrastructure Security
    Agency (CISA) sponsored ICS cybersecurity training courses have been
    conducted at INL in immersive classroom and hands-on learning
    environments. The target audience has been primarily private-sector
    businesses and utilities who need their staff to understand the
    differences between protecting IT and OT networks and systems. Simply
    put, IT cybersecurity is based on keeping a business's information
    readily available, accurate, and dependable, whereas OT cybersecurity
    lives in a cyber-physical world manipulating businesses assets which
    can impact production and throughput/output of materials. These
    sponsored courses offered by INL are designed to bridge the knowledge
    gap by bringing together people who operate either their company's IT
    systems or OT systems and force them to work together in realistic work
    settings. The results of these courses accompanied by the significant
    increase in recent threats to OT systems has contributed heavily to
    industry's awareness, or better described--awakening--to the need for
    improved OT cybersecurity practices accompanied by established
    standards for workforce development and training.
        Processes and procedures for securing IT systems are well-
    documented in a wide variety of general overarching best practices and
    some industry-specific standards. The same guidance has been late
    coming for securing OT systems, however this guidance is now much more
    readily available than even just a few years ago. Along with
    established cybersecurity procedures or standards has been guidance on
    what education and training is required by cyber professionals to
    implement these new measures.
        The National Institute of Standards and Technology (NIST) National
    Initiative for Cybersecurity Education (NICE) workforce framework,
    often referred to as the NICE Framework, is arguably the most well-
    known cybersecurity education and training standard. It addresses the
    education and training needs of the cybersecurity workforce by
    providing common vocabulary for the field and a detailed list of
    cybersecurity Knowledge, Skills, Abilities, and Tasks (KSATs) for each
    identified cyber work role. While the NICE Framework is intended to be
    applicable to a wide range of cybersecurity workers in an organization,
    IT roles and IT KSATs are ultimately the focus of the competency
    recommendations provided. As IT and OT systems become increasingly
    connected and vulnerabilities associated with both increases, the need
    to extend the framework to incorporate ICS systems has begun.
        INL in collaboration with academic and industry partners has
    endeavored to assist in the efforts to address the lack of a similar
    framework and KSATs for OT work roles. A major first step was INL's
    collaboration with Idaho State University (ISU) and La Trobe University
    (LTU) in a two-phased project resulting in the ``Building an Industrial
    Cybersecurity Workforce: A Manager's Guide''. This non-prescriptive
    document is a first step toward identifying the unique knowledge and
    job roles required of ICS professionals and establishing a capable
    workforce. NIST has recognized the value of this effort and has
    requested INL's participation in expanding the NICE Framework to
    incorporate OT roles and OT KSATs.
        Lack of recognized OT job roles and associated KSATs has had a
    definite influence on the existing availability of OT-specific
    workforce training offerings. Years of research and development of
    education and training courses for CISA, DoD, and industry,
    collaboration with academic institutes, and interviewing students
    identified other potential influencers that appeared to be impeding the
    flow of the IT and OT cyber talent workforce pipeline. To validate
    INL's findings, we created a joint INL-ISU Industrial Cybersecurity
    Community of Practice (ICSCOP) recurring workshop and invited over 150
    representatives from universities, Government entities, and industry
    experts to participate. Participants were provided presentations on two
    known cyber workforce issues: (1) Curriculum Standards for ICS cyber-
    related degree programs, and (2) ICS workforce development factors. The
    resulting group discussion by participants validated previously
    identified influencers and established working groups to address
    solutions. Influencers span IT and OT topics and included:
       First, standardized curriculum. There needs to be standard
            curriculum requirements for cyber-related degree programs, IT-
            and OT-focused, offered by academic institutes. For example,
            the requirements to attain a degree in cybersecurity varies
            from university, to university making is hard for employers to
            know the level of competency of any individual possessing such
            a degree and seeking employment. Lack of standards also leave
            the individual unsure of their qualifications for jobs solely
            based on the degree.
       Second, employers do not understand the existing
            cybersecurity-related tasks their employees are responsible for
            in their daily jobs. This makes it impossible to know what each
            employee's cyber education and training requirements are or to
            create a roadmap for improvement. It also makes it difficult to
            identify if there is a need to hire additional staff to address
            unfilled cyber job roles. Employers require a holistic process
            that can assist with identifying the existing cyber job roles
            of their employees, identify potential personnel gaps, suggest
            individual cyber education and training roadmaps, and link the
            level of education of employees to the cyber ``health'' of the
            organization.
       Third, Human Resource (HR) departments do not possess the
            necessary tools to identify and hire the best candidate for a
            cyber-related job position. They are forced to use the same
            hiring methods as other positions within their business:
            Reviewing resumes and conducting interviews. Although academic
            institutes cannot create different degree programs tailored
            specifically for each individual business's needs, skills
            testing matched to standardized KSATs would assist employers
            with this issue and provide academic institutes a view of the
            most requested cyber skills by employers to adjust degree
            programs.
       Fourth, as mentioned previously, the pace of new
            cybersecurity emerging threats, new technology,
            vulnerabilities, etc., is faster than most of the existing
            board certification processes used by academic institutes to
            approve updated curriculum. This makes it harder for academic
            institutes to rapidly update materials and offer students
            programs with the most recent information. A central
            clearinghouse for approved new ICS cyber-related curriculum
            readily available for academic institutes to adopt if desired
            may be one solution.
       Fifth, closely aligned with the first influencer is the lack
            of availability of standardized hands-on or near-hands-on
            training apparatus for ICS cybersecurity education programs,
            especially in rural geographical areas. A shared repository of
            curriculum and capabilities provided in a hub-and-spoke
            regional model where all academic institutes benefit from a
            National repository of resources is the needed.
       Sixth, the existing workforce needs continuing education
            options from local academic institutes other than the time-
            consuming and expensive solution of employees obtaining another
            degree. The continuing education options must be trackable by
            individuals throughout their cyber careers and identify for
            employers the currency of the education the person has
            received. Academic institutes have begun establishing their own
            educational badge and/or credential systems. A recognized
            National standard for these systems is needed before employers
            will put stock in the validity of these necessary systems.
        Outcomes from the ICSCOP workshops and working group meetings are
    not limited to validation of influencers impeding the flow of the cyber
    talent pipeline. INL is working with State and local government
    entities, academic institutes at all levels of education, and business
    around the State as collaborators and sounding boards of the workforce
    development solutions explored. The thought process to this approach is
    that if solutions can work in one State, they have a high probability
    of working in others.
        An example of these activities is the Associate Lab Director for
    N&HS is a co-chairperson on a new task force led by the Idaho
    Department of Commerce. The purpose is to make Idaho the most secure
    State against cybersecurity attacks aimed at businesses, Governmental
    entities, institutions, and citizens which will substantially improve
    and protect our growing economy. Activities include coordinating,
    informing, and training Idahoans across the State as to safeguards and
    resources from the perspective of many experts and interested groups.
    Recommendations from the task force will inform the Governor,
    legislature, and other stakeholders on major cybersecurity threats and
    opportunities for Idaho. This effort can easily be replicated by other
    States desiring a collaborative approach to addressing cybersecurity
    issues.
        Other efforts include Idaho National Laboratory (INL) in
    collaboration with industry, academia, and the science and research
    communities kicked off a multi-year Idaho Cyber Research Project
    (ICRP). This project is designed to apply existing solutions to some of
    the major influencers. A small army of interns (20 to 30) from Idaho
    universities and 2-year colleges are assisting INL staff by visiting
    organizations desiring assistance with cyber ``health'' issues and
    providing potential solutions. Solutions include using tools that can
    provide a cyber workforce evaluation resulting in cyber training paths
    validated by job roles for employees, assistance implementing new
    approaches to hiring cyber candidates and current employee cyber skills
    testing, cyber job posting solutions, consideration of apprenticeship
    opportunities, creating a workforce cyber competency profile for a
    business, and collaboration opportunities with academic institutes
    desiring partnerships to improve cyber curriculum offerings to their
    sector-specific needs. Solutions that resonate with local entities and
    are validated will be briefed at future ICSCOP meetings to discuss
    options for adoption by a broader audience.
        Finally, I would like to note that there are other issues facing
    the cyber workforce talent pipeline, but the ones listed are, in our
    opinion, the most problematic and biggest hinderances to a smoothly
    flowing talent pipeline. Many entities are working separately on
    solutions to the influencers I have outlined. This approach lends
    itself to creativity and flexibility with the multiple solutions
    offered to fit various entities needs; however, this approach can also
    lead to duplicative efforts and inefficient spending of scarce funds.
    We are seeing this issue arise with Federal and DoD entities. The CISA
    office of Cybersecurity Defense Education and Training (CDET) is
    uniquely poised to implement and manage National cyber workforce R&D
    programs along with education and training courses. CDET should be
    looked to as the lead office for all CISA workforce development
    efforts. DoD should establish a similar, joint office and directly
    collaborate with CDET for efficiency.
        INL stands ready to assist as needed in this Nation's efforts to
    increase the cybersecurity posture of all citizens whether through
    workforce development and education or bringing to bear its ICS
    cybersecurity control systems experts, cyber researchers, engineers,
    and threat analysts.
        I appreciate the opportunity to testify, and I want to thank you
    again for your attention to this very important issue for our Nation. I
    look forward to your questions.

        Chairwoman Clarke. I thank you, Mr. Ley, for your
    testimony.
        Finally, I recognize Mr. Stier to summarize his statement
    for 5 minutes.

      STATEMENT OF MAX STIER, PRESIDENT AND CEO, PARTNERSHIP FOR
                             PUBLIC SERVICE

        Mr. Stier. Thank you, Chairwoman Clarke and Ranking Member
    Garbarino. It is a real pleasure to have the opportunity to
    testify before you this morning on such an important issue.
        Cybersecurity is so vital and our Federal Government is
    central to addressing this issue. My focus, as you indicated in
    the summary, of the Partnership for Public Service will be on
    the Federal work force. We are a nonpartisan, nonprofit
    organization really focused on better Government for a stronger
    democracy. We have been working on the issue of cyber for some
    time now.
        Just to give one stat that helps demonstrate how big the
    problem is, if you look at the cyber work force in the Federal
    Government right now, under 6 percent of it is under the age of
    30. So to be real clear, it is just extraordinary. There is no
    generational diversity more broadly.
        There are five reasons for this. The first is that the
    Federal Government's brand is damaged. Government shutdowns,
    hiring freezes, negative rhetoric, political interference in
    science, all these things have tarnished the brand. Second, the
    opportunities for young people to serve are hidden and scarce.
    Again, a devastating statistic. Just 4 percent--4 percent of
    new hires are drawn from Federal programs employing current
    students and recent graduates. So Government rarely gets talent
    coming in that is young, bluntly. No. 3, the hiring process is
    broken and the barriers to entry are many--could spend all 5
    minutes on this, and I am going to pass unless you want more
    detail later--100 days-plus to hire people and the assessment
    processes are broken. Very importantly and often overlooked,
    this is No. 4, we are not retaining the talent that we get. So
    if you look at those full-time employees under the age of 30
    who are leaving Government, three-quarters of them are leaving
    within 2 years. So if you do everything right on the front end
    and you don't address the retention issue, you actually don't
    solve the problem. Fifth, critically, the diversity is bad
    across the Federal work force, but it is much, much worse in
    the cyber arena.
        Now, cybersecurity has been on the GAO high-risk list since
    1997. we need to do more than admire this problem. Ranking
    Member Garbarino, I loved your point, let us have some concrete
    things to do. I am going to give you 10 of them.
        First and foremost, most important, we need to create
    higher expectations for the leadership in Government, and that
    includes, bluntly, Congress as well. We need leadership to pay
    attention and to see it as their responsibility to own getting
    the right talent into Government. By and large they don't do
    that and it is a big problem.
        No. 2, we need the leaders in Government to actually have a
    very different level of understanding around technology. I am
    not talking about obviously the CIOs and the CTOs. The general
    program leadership more broadly in the world that we live in
    today has to have a sophistication and fluency in technology
    that is often missing. They need to be upscaled or different
    people need to be brought in.
        Third, and equally important, we need more sustained
    leaders. Right now a Senate-confirmed appointee lasts only 2
    years on average. It is impossible, bluntly, to make a
    difference on these management issues like cyber without a
    longer-term tenure for leaders. So a very concrete example,
    Secretary Granholm wants to have a CESER career leader in there
    rather than a political appointee. That is very smart.
        No. 2, we need to utilize innovative talent models like our
    cyber talent initiative. Happy to describe that in greater
    detail.
        No. 3, we need to promote the Government mission. People
    will come to Government if they understand they are serving the
    American people. NASA does a great job. They have a custom-
    built career website that includes videos of what they do. We
    produce a program called a Service to America Medals. We need
    to be able to highlight the great things people can do if they
    are in Government.
        No. 4, we have got to improve the recruiting and hiring to
    begin with. We had the National Commission on Military National
    Public Service. They did a fantastic job. Lots of
    recommendations that are ready for legislation now and they
    should be done. We should have exit interviews of those in the
    cyber fields so we are understanding why we are not holding
    onto talent that we need.
        No. 5, we need to get more young people in Government. Here
    this is basic strategy. Student internships ought to be the
    primary entry hiring for Government. They are not right now.
    They need to be paid internships or else we are not going to
    get the diverse talent.
        No. 6, we need to overhaul the pay system more broadly in
    Government and certainly around cyber. Know that this pay
    system in Government was designed in 1949. It is not
    sufficiently market-sensitive. That is a real problem.
        Seven, we have got to invest in the H.R. work force or you
    won't have these people coming in. We need an enterprise
    strategy.
        Eight, we need to embrace a culture that has technology and
    innovation collaboration that is central. That is a leadership
    issue. I mentioned DEI as being critical in this work force
    strategy.
        Ten, coming back around to the leadership side, we need
    continued oversight from this committee, we need to see this as
    an annual hearing, we need to see you visiting agencies that
    are doing well, and we need you looking out for the Government
    brand.
        As fast as I can talk. Look forward to questions.
        [The prepared statement of Mr. Stier follows:]
                        Prepared Statement of Max Stier
                                 July 29, 2021
                                  introduction
        Chairwoman Clarke, Ranking Member Garbarino, and Members of the
    Subcommittee on Cybersecurity, Infrastructure Protection, and
    Innovation, thank you for the opportunity to appear before you today to
    discuss the importance of building a robust cybersecurity talent
    pipeline.
        The Partnership for Public Service is a non-partisan, non-profit
    organization dedicated to inspiring public service and increasing the
    efficiency and effectiveness of the Federal Government. The Partnership
    was founded on the premise that any organization's best asset is its
    people.
        Cybersecurity, a critical element of any organization's resilience,
    has been indispensable to the Federal Government's response to the
    COVID-19 pandemic. Early in the pandemic, security considerations moved
    to the forefront as more employees than ever before worked and accessed
    agency information networks remotely and used digital tools to continue
    operations and service delivery. As the Federal Government thinks about
    the future of work, it is clear that cybersecurity will remain at the
    forefront. And, of course, there are moments of crisis in securing the
    Nation's cyber infrastructure--the SolarWinds cyber attack in 2020 and
    the Colonial Pipeline hack in May 2021 illustrate the importance of
    having Federal cyber experts who can respond quickly to an increasingly
    sophisticated threat landscape.
        Although these cyber attacks shine a fresh spotlight on the
    country's vulnerabilities, cybersecurity has been identified as a GAO
    High-Risk List area since 1997.\1\ Despite being on the list for 24
    years, there remains a Nation-wide shortage of highly-qualified
    cybersecurity specialists, and the Federal Government has fallen behind
    in the race for this talent. Amidst the growing demand for cyber
    professionals, agencies have struggled to recruit, hire, retain, and
    train workers in the cybersecurity field. Many of the personnel issues
    confronting the cybersecurity workforce are endemic in the Federal
    system that makes recruiting and retaining the best and brightest
    talent in any career field a formidable challenge. To protect the
    country against current and future threats, Congress must focus on
    revitalizing and investing in the Federal cyber workforce.
    ---------------------------------------------------------------------------
        \1\ Senate Committee on Homeland Security and Governmental Affairs,
    ``GAO's 2021 High Risk List: Addressing Waste, Fraud, and Abuse,''
    March 2, 2021. Testimony from Eugene L. Dodaro, Comptroller General of
    U.S. Government Accountability Office. Retrieved from https://
    www.hsgac.senate.gov/gaos-2021-high-risk-list-addressing-waste-fraud-
    and-abuse.
    ---------------------------------------------------------------------------
        The Partnership offers a variety of programs that allow us to work
    with Federal employees to strengthen their leadership skills, prepare
    them to build strong teams and work across organizational boundaries.
    We also work with agencies on issues such as attracting top talent,
    engaging and supporting their workforce, and fostering innovation. For
    example, our cross-sector Cybersecurity Talent Initiative \2\ is a
    partnership with MasterCard, Microsoft, and Workday that provides
    students in cybersecurity-related fields with public and private-sector
    work experience. This program guarantees students a 2-year placement at
    a Federal agency with cybersecurity needs and provides agencies with
    capable talent to address current and emerging challenges. Through
    these initiatives, we help Federal leaders and agencies achieve better
    outcomes for the people they serve.
    ---------------------------------------------------------------------------
        \2\ Cybersecurity Talent Initiative. Retrieved from https://
    cybertalentinitiative.org/.
    ---------------------------------------------------------------------------
        For the past decade, the Partnership's research has highlighted
    strategies and opportunities for Government to build a more capable
    cyber workforce. For instance, our 2009 ``Cyber In-Security'' report
    outlines factors hampering Government's ability to build an efficient
    and effective cybersecurity workforce.\3\ Our 2015 supplementary
    report, ``Cyber In-Security II,'' outlines key findings and strategies
    to help Government build a capable cyber workforce and close the
    Federal talent gap.\4\
    ---------------------------------------------------------------------------
        \3\ Partnership for Public Service, ``Cyber In-Security,'' July
    2009. Retrieved from https://ourpublicservice.org/publications/cyber-
    in-security-strengthening-the-Federal-cybersecurity-workforce/.
        \4\ Partnership for Public Service, ``Cyber In-Security II,'' April
    2015. Retrieved from https://ourpublicservice.org/publications/cyber-
    in-security-ii-closing-the-Federal-talent-gap/.
    ---------------------------------------------------------------------------
                 challenges facing the federal cyber work force
        Unpacking the data on the Federal cybersecurity work force reveals
    different stories across the Government. There are areas of growth,
    including in Government-wide totals--the number of full-time Federal
    cyber employees increased by 7.85 percent between September 2016 and
    September 2020. Over the same period, the Federal work force overall
    increased by 3.66 percent.
        However, there are concerning trends in other areas of the cyber
    workforce. For example, some agencies saw declines in full-time
    employees--the Department of Agriculture's cyber workforce decreased
    from 3,300 employees in September 2016 to 2,700 in September 2020,
    while at the Department of Labor it decreased from 750 to 660 employees
    in the same time frame.\5\
    ---------------------------------------------------------------------------
        \5\ Statistics on Federal employees are drawn from Office of
    Personnel Management FedScope data on the Federal workforce unless
    indicated otherwise.
    ---------------------------------------------------------------------------
        Government also faces challenges in recruiting, hiring, and
    retaining a cyber workforce that looks like the American public. For
    example, 50.8 percent of the U.S. population identifies as female;\6\
    however, in September 2020, just 25.4 percent of the full-time Federal
    cyber workforce identified as female, compared to 43.2 percent
    Government-wide.
    ---------------------------------------------------------------------------
        \6\ U.S. Census Bureau. Retrieved from https://www.census.gov/
    quickfacts/fact/table/US/PST045219.
    ---------------------------------------------------------------------------
        The Federal cybersecurity workforce is also older than the U.S.
    labor force. The percent of full-time cyber employees under the age of
    30 steadily increased from 4.1 percent to 5.7 percent between September
    2014 and September 2020; however, this still lags behind the almost 20
    percent of the employed U.S. labor force in 2020 that is under age 30.
        To revitalize the cyber workforce, the administration and Congress
    must address both immediate and long-standing problems. Key data points
    from the overall Federal workforce signal the urgent need for attention
    to this vital National asset. These trends are not new but will be
    harder to fix the longer we wait:
       In the Federal IT workforce, there are 16 times more
            employees over the age of 50 than under age 30.
       Roughly one-third of full-time employees on board at the
            beginning of fiscal 2019 will be eligible to retire by the end
            of fiscal 2023.
       Use of the Federal Pathways intern program, which should be
            a main pipeline into Federal service, has plummeted. According
            to the fiscal 2020 budget request, the number of new hires of
            student interns fell from 35,000 in 2010 to 4,000 in 2018.\7\
    ---------------------------------------------------------------------------
        \7\ ``Analytical Perspectives, Budget of the U.S. Government,
    Fiscal Year 2020,'' March 18, 2019, p. 77. Retrieved from https://
    www.govinfo.gov/content/pkg/BUDGET-2020-PER/pdf/BUDGET-2020-PER.pdf.
    ---------------------------------------------------------------------------
       Of the full-time employees under 30 who voluntarily quit
            Federal service in fiscal 2019, over 73 percent did so with
            less than 2 years of Federal tenure, suggesting that many young
            people do not have a positive work experience in the Federal
            Government or lack sufficient incentives to stay in Federal
            service.
       Data also shows major diversity challenges in the Federal
            workforce, which grow even greater at the higher echelons of
            service. For example, only 35.5 percent of the career Senior
            Executive Service are female, and only 22.7 percent of the
            career SES are people of color.
       The 2020 Best Places to Work in the Federal Government \8\
            employee engagement score was 69 out of 100, lagging behind the
            private sector by more than 8 points and suggesting that more
            can be done to cultivate a highly engaged, high-performing
            Federal workforce.
    ---------------------------------------------------------------------------
        \8\ Partnership for Public Service, Best Places to Work in the
    Federal Government. Retrieved from https://bestplacestowork.org/.
    ---------------------------------------------------------------------------
       It takes the Government an average of 98 days to bring new
            talent on board--more than double the time in the private
            sector.\9\
    ---------------------------------------------------------------------------
        \9\ Office of Personnel Management, ``OPM Issues Updated Time-to-
    Hire Guidance,'' February 2020. Retrieved from https://www.opm.gov/
    news/releases/2020/02/opm-issues-updated-time-to-hire-guidance/.
    ---------------------------------------------------------------------------
       About 83 percent of major Federal departments and agencies
            struggle with staffing shortages and 63 percent report gaps in
            the knowledge and skills of their employees.\10\
    ---------------------------------------------------------------------------
        \10\ Office of Personnel Management, ``2018 Federal Workforce
    Priorities Report,'' February 2018. Retrieved from https://www.opm.gov/
    policy-data-oversight/human-capital-management/Federal-workforce-
    priorities-report/2018-Federal-workforce-priorities-report.pdf.
    ---------------------------------------------------------------------------
       According to the Survey on the Future of Government
            Service,\11\ just 32 percent of respondents say their agency
            has a strategic recruitment plan that is aligned to its
            workforce needs.
    ---------------------------------------------------------------------------
        \11\ ``Survey on the Future of Government Service,'' October 13,
    2020. The survey is a collaborative effort by the Partnership for
    Public Service, the Princeton School of Public and International
    Affairs at Princeton University, the Center for the Study of Democratic
    Institutions at Vanderbilt University and Georgetown University.
    Retrieved from https://ourpublicservice.org/publications/survey-on-the-
    future-of-government-service/.
    ---------------------------------------------------------------------------
          the importance of strengthening government's cyber workforce
        Federal jobs offer mission-driven work with opportunities to help
    solve the biggest challenges facing our Nation. Our Government needs
    cyber talent to secure our National security and economic interests,
    and help the country rise to the significant challenges of the day and
    prepare for what lies ahead. In particular, the dearth of young civil
    servants represents a lost opportunity for our Federal Government as
    well as the Nation's young professionals.
        The Federal Government not only needs to work harder to recruit and
    hire great talent, but also create an environment that retains high-
    performing employees. Fundamental reforms to the Government's
    antiquated pay and classification system--or more targeted personnel
    systems, such as the DHS cyber personnel system--would better equip the
    Government to compete for cyber talent. Even within the constraints of
    the Federal pay system, though, our Government can pursue multiple
    strategies to make the Federal Government the employer of choice not
    only for entry-level talent but also for mid- and senior-level talent.
        There are many reasons why Government is failing to recruit and
    retain talent, especially young people, and the problems are deep-
    seated:
        The Federal Government's brand is damaged.--Government shutdowns,
    hiring freezes, and negative rhetoric have hurt the image of Government
    and the people who serve. An Axios Harris poll in March 2019 examined
    the reputation of America's 99 most high-profile companies and the
    Federal Government, and the Government ranked dead last.\12\ That was
    before a pandemic further eroded public confidence in Government.
    ---------------------------------------------------------------------------
        \12\ The Harris Poll, ``Axios Harris Poll 100,'' 2019. Retrieved
    from https://theharrispoll.com/axios-harrispoll-100-2019/.
    ---------------------------------------------------------------------------
        Opportunities for young people are hidden and scarce.--Many
    students do not know about compelling career opportunities in
    Government or how to apply for them. In addition, Government hiring
    processes have historically shown a disproportionate preference for
    experienced professionals, limiting opportunities for promising young
    talent. For instance, internships are underused across the Federal
    Government and just 4 percent of new hires are drawn from Federal
    programs employing current students and recent graduates. An added
    challenge for the cyber community is that candidates often find it
    difficult to enter the Federal workforce due to poor advertisement of
    available cyber opportunities in Government. This is largely due to the
    antiquated way these jobs are classified and outdated position
    descriptions that do not accurately depict the skills and knowledge
    necessary for the role.
        Barriers to entry abound for job candidates. An unintuitive on-line
    jobs portal in USAJOBS, a 70-year-old compensation system, and a time-
    to-hire average of nearly 100 days all make it difficult for Government
    to attract top talent. Government may always struggle to match private-
    sector salaries, but it must do better on multiple human resource
    fronts in the competition for mission-critical talent.
        We are failing to adapt to the needs of a more mobile workforce.--
    Our Federal personnel system is geared to the model of the lifetime
    Federal employee. We value and need those who want to dedicate their
    whole careers to Federal service. But we also must seize opportunities
    to recruit those who want to serve for shorter durations, especially as
    younger workers increasingly want more mobility in their careers. Just
    35 percent of millennials expect to stay with their current employer
    for 5 or more years, but there were notable correlations between those
    who did plan to stay and those who believe their employers perform well
    on issues related to financial performance, community impact, talent
    development, and diversity and inclusion.\13\
    ---------------------------------------------------------------------------
        \13\ Deloitte, ``The Deloitte Global Millennial Survey 2020,'' June
    25, 2020. Retrieved from https://www2.deloitte.com/global/en/pages/
    about-deloitte/articles/millennialsurvey.html.
    ---------------------------------------------------------------------------
        Undergirding these challenges is the need for a heightened
    commitment to diversity, equity, and inclusion.--While the Federal
    Government outperforms many private-sector organizations on this front,
    there is room for improvement in Federal leadership ranks. Among career
    leaders in the Government's Senior Executive Service (SES), just 36
    percent are female and only 23 percent identify as people of color. And
    among SES leaders in STEM, just 26 percent are female and only 18
    percent identify as people of color. Federal agencies need to do more
    to provide and promote opportunities to underrepresented communities
    and ensure that our Government mirrors the people it serves.
        Altering the status quo will not be easy but it will be critical to
    the Nation's future. And this moment in time offers a rare convergence
    of opportunity: A Federal workforce which has dramatically changed the
    way it works over the past year and is primed for adaptation amid the
    staggering health, social, and economic challenges it must take the
    lead in tackling; and the rise of Generation Z, which is
    technologically adept and hungry to make a difference.
        The past year has shown the dedication, resiliency, and
    resourcefulness of the Federal workforce. At many agencies, most
    Federal employees shifted quickly to telework as the pandemic spread,
    while others bravely remained on the front lines in jobs that cannot be
    performed remotely. On all fronts, Federal workers have found
    innovative ways to serve the people during the pandemic. Thus, out of
    crisis comes opportunity. We have a once-in-a-generation moment to
    transform the workforce and the way it works, and to inspire Americans
    to enter public service.
        Both the world and the workplace are rapidly changing. In the post-
    pandemic era, we must not go back to the old ways of doing business
    when the new ways make more sense. We should seize this moment to
    modernize the ways in which Government operates, which in many
    instances are predicated on laws and practices that are decades old and
    out of sync with today's fast-paced digital economy and invest in a
    cybersecurity workforce for the future.
    solutions for building the cyber talent pipeline: what can congress do?
        Here are ten ways that Congress can accelerate this revitalization
    and transformation of the Federal cyber workforce:
    (1) Create high expectations for Federal leaders.
        A transformation of the workforce and how Federal employees do
    their jobs will not be possible without also reimagining leadership in
    the Federal Government. Good leaders motivate and advocate for their
    employees, build trust and create the conditions necessary for
    employees to perform at their best. The civilian side of Government
    should take a lesson from the military side, where people are viewed as
    an asset, not a cost, and where investments in leadership development
    are critical to the strategy for success.
        In 2019, the Partnership developed the Public Service Leadership
    Model,\14\ recognizing the unique nature of leadership in Government,
    centered on stewardship of public trust and commitment to public good.
    We believe this model should be the standard for leaders--both career
    and political--across the Federal Government. The model identifies the
    core values that leaders must prioritize and the critical competencies
    they must master to achieve their agencies' missions and desired
    impact. These include setting a vision, empowering others and being
    accountable for results. We were proud to create this model with a
    nonpartisan group of distinguished leaders from across sectors, and in
    the months to come we hope to work with Congress, the Executive branch
    and others to improve and measure overall leadership effectiveness.
    ---------------------------------------------------------------------------
        \14\ Partnership for Public Service, Public Service Leadership
    Model. Retrieved from https://ourpublicservice.org/our-work/public-
    service-leadership-model/.
    ---------------------------------------------------------------------------
        Congress also should hold political and career Federal leaders
    accountable not only for owning policy but also for the organizational
    health of their agencies. In many cases, agencies and bureaus could
    benefit from career executives at the helm--nonpartisan, professional
    leaders who can provide needed stability and deep expertise. An example
    of this is the Department of Energy's Office of Cybersecurity, Energy
    Security, and Emergency Response (CESER), which is currently helmed by
    a career civil servant. Our Government has over 4,000 politically-
    appointed positions, with roughly 1,200 of them subject to Senate
    confirmation, and the process for selecting, vetting, and appointing
    them is complex, inefficient, and time-consuming. We encourage Congress
    to consider reducing the number of political appointees and creating
    more opportunities for career experts to lead.
        In addition to taking ownership of the health of the workforce,
    political and career programmatic and policy leaders in Government
    today must also have a familiarity with technology and cybersecurity
    issues in order to focus on key priorities and make informed choices.
    That's why the Partnership created the AI Federal Leadership Program in
    2019. This 6-month, complimentary program is meant to help Federal
    leaders (specifically members of the SES) better understand the needs
    and opportunities around artificial intelligence, and prepare them to
    integrate this technology with policy and program implementation. This
    program is another cross-sector effort with technology leaders,
    including Microsoft, Google, and the Ford Foundation.
        With respect to the workforce, Congress should hold political
    appointees responsible for recruiting and retaining highly-qualified
    talent, developing future leaders, engaging employees, and holding
    subordinate managers accountable for addressing performance. Congress
    should urge agency leaders to use the annual Federal Employee Viewpoint
    Survey and the Best Places to Work in the Federal Government rankings
    to drive better results in their agencies. Employee engagement is not
    just about happy employees. Higher scores in employee engagement equate
    to better performance and higher-quality service, which in turn become
    valuable recruiting tools. For example, in a recent analysis of
    performance data from nearly 150 Department of Veterans Affairs
    hospitals across the country, the Partnership found that higher patient
    satisfaction, better call center performance and lower nurse turnover
    were all associated with a more satisfied and committed workforce.\15\
    ---------------------------------------------------------------------------
        \15\ Partnership for Public Service, ``Employee engagement is more
    than just a survey,'' March 2, 2020. Retrieved from https://
    ourpublicservice.org/blog/employee-engagement-is-more-than-just-a-
    survey/.
    ---------------------------------------------------------------------------
        Congress and the administration should also embrace the bold goal
    of closing the over 8-point gap between the Government and the private
    sector in the Best Places to Work in the Federal Government engagement
    index, and even increasing the Federal score over the private-sector
    score. The Government has a powerful asset in having a mission-driven
    workforce. This purpose-driven work, if combined with excellent
    leadership, will lead to much more engaged employees and better
    outcomes for the American public.
    (2) Utilize innovative talent models.
        To attract talent at all levels, Congress and the administration
    should work together to create new and innovative pathways--and expand
    existing ones--for diverse mission-critical talent to join public
    service through fellowships, talent exchanges, and service corps.
        In 2019, the Partnership collaborated with Mastercard, Microsoft,
    Workday, and a dozen Federal agencies to establish the Cybersecurity
    Talent Initiative, which aims to build the next generation of cyber
    leaders for our country. This innovative cross-sector opportunity
    enables recent graduates to spend 2 years working for and receiving
    training in the Federal Government in a cyber-related position. At the
    end of 2 years, they will have an opportunity to apply for a position
    with one of the corporate partners and, if hired, will be eligible to
    receive student loan assistance up to $75,000 from their private-sector
    employer. This model is the first of its kind. The inaugural class of
    eight future cybersecurity leaders brings a variety of academic and
    professional experience to five Federal agencies, and we anticipate
    placing at least 25 participants across nine Federal agencies and
    components for the second cohort.
        One benefit of these efforts is that we are educating young people
    about cyber careers across sectors and helping them learn about
    organizations and missions they may have never heard of before. Other
    Federal programs like the U.S. Digital Service, 18F, and Presidential
    Innovation Fellows allow ``technical tours of duty'' with the Federal
    Government and are unique in helping promote and respond to an
    increasing desire for the next generation to be more mobile in their
    careers. The programs provide a model for filling other ``hard-to-
    fill'' positions in Government.
    (3) Promote Government's mission.
        Both the world and the workplace are rapidly changing. Our
    Government needs a new generation of young people to serve in a data-
    and technology-driven environment, with expertise in such sectors as
    cybersecurity, technology, engineering, finance, and health care.
    Making the Federal Government an ``employer of choice'' requires
    greater awareness by the Government of what employees want in the
    workplace, coupled with improved public perception of opportunities in
    Federal service. As the Federal Government struggles to attract
    students and recent graduates, it is clear that more must be done to
    improve the Government's ``brand.'' Government shutdowns, hiring
    freezes, and negative rhetoric damage the image of Government and the
    people who serve.
        The Federal Government, because of budget constraints, will always
    have a hard time competing with the private sector on pay, but agencies
    almost always have an advantage in offering employees a sense of
    mission. Our Best Places to Work rankings regularly show that the
    match between employee skills and agency mission is a key driver of
    employee engagement, second only to effective leadership. Too often,
    though, Federal job announcements are dry, confusing, and fail to
    inspire. The Partnership has identified bright spots in marketing, such
    as NASA's custom-built career website, which supplements USAJOBS and
    showcases their mission, including through videos from current
    employees sharing their stories.\16\ NASA understood that, to attract
    professionals in STEM fields, the agency needed to set itself apart
    from other employers by focusing on its unique mission and impact.
    Other agencies, such as the Department of the Interior, leverage social
    media platforms to promote their missions and the work of their agency.
    ---------------------------------------------------------------------------
        \16\ Partnership for Public Service and Salesforce, ``Tech to Hire:
    Transforming Federal H.R. Beginning with Recruiting and Hiring,''
    October 3, 2018. Available at https://ourpublicservice.org/wp-content/
    uploads/2018/10/TechtoHire.pdf.
    ---------------------------------------------------------------------------
        The Federal Government needs to do more to showcase the incredible
    array of professional opportunities it offers and to recognize the
    accomplishments and innovation of the current workforce. Without
    compelling and shared stories of success in Government, Government will
    struggle to become an employer of choice for the tech-savvy, forward-
    looking talent that it needs to attract.
        This subcommittee can also play an important role in encouraging
    Congressional colleagues to recognize the successes of the Federal
    workforce. Federal employees are often blamed for policy failures, and
    rarely acknowledged when things go right. One way to revitalize the
    workforce is simply to change the tone and get away from the demeaning
    rhetoric that frequently characterizes discussion of the Federal
    workforce. Political leaders should celebrate outstanding
    contributions, such as the remarkable achievements of the nominees and
    winners of the annual Service to America Medals \17\ and the
    Presidential Rank Awards.
    ---------------------------------------------------------------------------
        \17\ Service to America Medals. Retrieved from https://
    servicetoamericamedals.org/.
    ---------------------------------------------------------------------------
    (4) Improve recruiting, hiring, and retention.
        Congress should start the hard process of updating the legal
    framework for the civil service, much of which dates back to laws
    passed in 1949 and 1978. The Federal Government needs cybersecurity
    experts, doctors, economists, and emergency response specialists, but
    we have a personnel system designed for phone operators. The antiquated
    system is an impediment to the Government's ability to meet the needs
    of today's interconnected, technology-driven world and prepare for the
    challenges of the future. A Government-wide initiative could help
    agencies improve the hiring process so they can more easily attract,
    assess, hire, and on-board highly-qualified applicants. This effort
    should include simplifying and demystifying the application processes,
    including the USAJOBS portal.
        As a starting point, Congress should enact the civil service
    recommendations of ``Inspired to Serve,'' the final report of the
    National Commission on Military, National, and Public Service.\18\ On a
    bipartisan and consensus basis, and after studying the Federal civil
    service for over 2 years, the Commission issued last year a bold and
    thoughtful set of recommendations for improving talent management,
    including proposals to make Federal hiring more efficient. We urge
    Congress to move forward on a bipartisan basis as quickly as possible
    to enact these proposals. Some key Commission recommendations--and
    ideas the Partnership has long supported--include:
    ---------------------------------------------------------------------------
        \18\ National Commission on Military, National and Public Service,
    ``Inspired to Serve,'' March 25, 2020. Retrieved from https://
    inspire2serve.gov/reports.
    ---------------------------------------------------------------------------
       Establishing a civilian cybersecurity reserve program, as
            proposed in the bipartisan Civilian Cyber Security Reserve Act
            (H.R. 2894).
       Allowing agencies to appoint Federal employees who have
            successfully completed reskilling programs to positions in
            their new field without the employee having to move to a lower
            grade level, as proposed by the bipartisan Facilitating Federal
            Employee Reskilling Act (S. 1330).\19\
    ---------------------------------------------------------------------------
        \19\ This legislation was included in S. 1260, the U.S. Innovation
    and Competition Act of 2020, which passed the Senate in June.
    ---------------------------------------------------------------------------
       Amending the criteria for direct hire authority to enable
            agencies to use this authority when they face a shortage of
            highly-qualified applicants.
       Expanding direct hiring authority for students and recent
            graduates.
       Modernizing the veterans' preference rules, which are
            currently confusing for both agencies and veterans alike.
       Improving the Pathways programs, which include the
            Presidential Management Fellows and intern and recent graduate
            programs.
        The Government not only needs to work harder to recruit and hire
    great talent, but also to retain it. Even within the constraints of the
    Federal pay system, the Government can pursue multiple strategies to
    make the Government the employer of choice not only for entry-level
    talent but also for mid- and senior-level talent. When people do leave
    Government, agencies should be collecting data on their reasons for
    departing or taking another job. Currently, a Government-wide exit
    survey exists only for the SES. Data on why people leave Government
    will be instrumental in helping agencies better recruit and retain the
    next generation. The surveys would be particularly useful in
    understanding why almost half of people who quit working for the
    Federal Government leave within 2 years.
    (5) Get young people in Government.
        Today's college students are interested in making a difference, but
    those considering the Federal Government as a place where they can do
    so face challenges in getting hired. Programs that Congress should
    reinvigorate include the Pathways programs, which provide younger,
    early career talent with exposure to and positive experiences working
    in Government. Needed improvements include ensuring internships are
    paid and easing agencies' ability to convert interns into full-time
    positions. In addition to lifting the caps on the expedited hiring
    authority for students and recent graduates, Congress should also
    consider an ROTC-like program for Federal service and encourage
    agencies to recruit on campuses.
        The need to improve the hiring process is especially urgent for
    cybersecurity jobs, where Government faces stiff competition for talent
    with the private sector. The Federal Government's antiquated hiring
    system is not designed to compete at the speed of private-sector
    companies who can actively recruit and quickly hire young STEM and
    cyber talent. Dr. Elizabeth Kolmstetter, NASA's Director of Talent
    Strategy and Engagement, gave an example of one Texas A&M student who
    met a SpaceX recruiter and was offered a job the same day, finalized
    the offer over the weekend and moved to California the next week to
    begin work.\20\ Kolmstetter also noted that in fiscal year 2018 about
    61 percent of NASA's engineering vacancies, 87 percent of scientist
    vacancies, and 86 percent of mathematics vacancies had fewer than three
    qualified (not most qualified)\21\ applicants. The talent is out there,
    and Government's mission remains more compelling than ever, but
    agencies are losing out because the Federal hiring system isn't nimble
    enough to compete with the private sector.
    ---------------------------------------------------------------------------
        \20\ Testimony before the National Commission on Military,
    National, and Public Service, ``Public Service Hearing: Critical Skills
    and Benefits,'' May 15, 2019. Retrieved from https://inspire2serve.gov/
    sites/default/files/2020-09/Kolmstetter%20Testimony_Public%20Service%-
    20Hearing_Critical%20Skills%20and%20Benefits.pdf.
        \21\ Qualification standards are ``a description of the minimum
    requirements necessary to perform work of a particular occupation
    successfully and safely,'' according to OPM.
    ---------------------------------------------------------------------------
    (6) Overhaul the pay and classification system.
        The Government's 1949 pay and classification system was designed
    for clerical workers, not for the highly professional, specialized
    skills that are needed in today's civil service. The lack of an
    occupation-specific, market-based compensation system is particularly
    damaging to the ability of the Federal Government to recruit and retain
    scientists, many of whom have far more lucrative opportunities in the
    private sector.
        The OPM Handbook of Occupational Groups and Families contains 407
    separate job series. The sophisticated cyber, IT, data science and STEM
    skills that the Government badly needs were barely envisioned when the
    system was created. We need broader pay-banding that allows agencies
    the flexibilities to set more market-based, occupational-specific
    salaries. Unique pay systems like that created under the authority of
    the Financial Institutions Reform, Recovery, and Enforcement Act
    (FIRREA) of 1989 are an acknowledgement that a rigid pay system does
    not work. While the Federal Government will never be able to match
    private-sector salaries for many positions, broader pay bands would
    enable agencies the flexibility to attract the most critically-needed
    talent.
        The Partnership's report, ``Building the Enterprise: A New Civil
    Service Framework,''\22\ laid out a new pay-setting process for the
    Federal workforce. The modernized pay system would establish broad pay
    bands for employees rather than rigid grades, better align salaries and
    benefits on an occupation-by-occupation basis, set salaries based on
    those comparisons and give agencies the flexibility to bring talent in
    at the appropriate salary level. While this is a long-term effort,
    allowing market-based pay for specific mission-critical occupations in
    the near term is a place to start and would help attract and retain
    needed talent. Again, the final report of the National Commission on
    Military, National, and Public Service also endorses a comprehensive
    modernization of the entire Federal talent management system.
    ---------------------------------------------------------------------------
        \22\ Partnership for Public Service, ``Building the Enterprise: A
    New Civil Service Framework,'' April 10, 2014. Retrieved from https://
    ourpublicservice.org/publications/building-the-enterprise/.
    ---------------------------------------------------------------------------
        The Partnership's recent studies reinforce the need for investment
    in the Federal human resources workforce. For example, our ``State of
    Renewal'' report lays out recommendations for improving the State
    Department's talent management life cycle over 6 to 12 months, without
    the need for any additional legislation, as well as changes that will
    take longer and require Congressional action. Our report ``Time for
    Talent: Improving Federal Recruiting and Hiring''\23\ lays out
    practical approaches that agencies can take within the existing system
    to attract mission-critical talent. And in ``Rapid Reinforcements:
    Strategies for Federal Surge Hiring,''\24\ we identified strategies
    that can help agencies when faced with circumstances that require a
    rapid growth in the workforce, such as National emergencies, large-
    scale attrition, new mission requirements, or the need for emergent
    skills.
    ---------------------------------------------------------------------------
        \23\ Partnership for Public Service, ``A Time for Talent: Improving
    Federal Recruiting and Hiring,'' August 26, 2020. Retrieved from
    https://ourpublicservice.org/publications/a-time-for-talent/.
        \24\ Partnership for Public Service, ``Rapid Replacements:
    Strategies for Federal Surge Hiring,'' October 29, 2020. Retrieved from
    https://ourpublicservice.org/publications/rapid-reinforcements-
    strategies-for-Federal-surge-hiring/.
    ---------------------------------------------------------------------------
    (7) Invest in the H.R. workforce.
        Agencies cannot move forward on these recommended strategies,
    however, unless their human resource offices have the requisite skills,
    capacity, and tools. There are outstanding and innovative H.R.
    professionals across the Government, but there are also skills gaps in
    their offices. They are often overwhelmed by responsibilities and the
    complexities of Federal human capital law. Often, H.R. specialists are
    not familiar with the authorities they have available to them, and do
    not have the technologies, data, and analytical skills that would
    better enable them to recruit and hire while also engaging in strategic
    workforce planning for the future.
        Congress should jump-start efforts to increase the skills and
    professionalism of the Federal H.R. community by requiring OPM to start
    providing technical training to H.R. specialists again, conducting a
    review of overall training needs and how those needs can be met, and
    funding IT needs of the H.R. community. Congress should also ensure
    that agencies undertake strategic workforce planning and make sure that
    Chief Human Capital Officers have a voice in the strategic and budget
    planning processes so that agency leaders will be informed of the H.R.
    needs necessary to carry out their policies and programs.
    (8) Create a workforce culture that embraces technology, innovation,
            and collaboration.
        Our recent report ``Resilient: Keeping Your Wits--Workforce,
    Innovation, Technology, Security--About You,''\25\ summarizes a survey
    of 300 Federal leaders and a series of roundtable discussions on the
    lessons of the pandemic. A key takeaway is that an agile workforce,
    cutting-edge cybersecurity, modern technologies, and continual
    innovation are all interdependent in creating resiliency in the Federal
    Government. Also, when asked what a resilient Federal Government looks
    like, more respondents linked resiliency to an agile workforce than the
    other issue areas discussed in the report.
    ---------------------------------------------------------------------------
        \25\ Partnership for Public Service, American Council for
    Technology and Industry Advisory Council, and Meritalk, ``Resilient:
    Keeping Your Wits--Workforce, Innovation, Technology, Security--About
    You,'' January 25, 2021. Retrieved from https://ourpublicservice.org/
    publications/resilientkeeping-your-wits-about-you/.
    ---------------------------------------------------------------------------
        The success of the Federal workforce depends not only on the
    quality of its talent and its leaders, but also on a culture where
    employees are encouraged to try new ideas and make smart technology
    investments. The new workplace environment must also involve more
    collaboration between Federal, State, local, and Tribal governments and
    the private and non-profit sectors.
        Recognizing that revitalizing the Government requires attention to
    leadership and stewardship, talent, innovation and technology, and
    collaboration, the Partnership's ``Roadmap for Renewing the Federal
    Government,''\26\ launched last fall, describes the challenges the
    Government faces in each of these areas, bright spots showing
    improvements, and needed solutions. The Roadmap provides a list of
    actions that the Biden administration and Congress can take to begin
    laying the groundwork for renewing the Federal Government, and the
    issue pages on the website summarize proposals that we believe should
    have the support of both Congress and the administration.
    ---------------------------------------------------------------------------
        \26\ Partnership for Public Service, ``Roadmap for Renewing the
    Federal Government. Retrieved from https://ourpublicservice.org/
    roadmap-for-renewal/.
    ---------------------------------------------------------------------------
    (9) Make diversity, equity, and inclusion a central part of workforce
            strategy.
        A commitment to diversity, equity, and inclusion must be a
    cornerstone in the transformation of how the Government recruits,
    hires, develops, and retains talent.\27\ The Partnership hears
    consistently from current and former agency leaders that it is critical
    to address this issue in the scientific and technical community. This
    commitment ultimately leads to higher organizational performance by
    ensuring the door is open for top talent and by enabling new and
    creative ways of thinking that empower better decision making. Also, a
    Government that better reflects its people also will increase public
    trust in our democratic institutions.
    ---------------------------------------------------------------------------
        \27\ For example, see Jennifer Miller, ``For young job seekers,
    diversity and inclusion in the workforce aren't a preference. They're a
    requirement,'' Washington Post, February 18, 2021. Retrieved from
    https://www.washingtonpost.com/business/2021/02/18/millennial-genz-
    workplace-diversity-equity-inclusion/.
    ---------------------------------------------------------------------------
        President Biden has issued a memorandum prioritizing diversity,
    equity, and inclusion as a National security imperative, in order to
    ensure that critical perspectives and talents are represented in the
    entire National security workforce.\28\ Congress should support these
    efforts, and should help ensure that diversity, equity, and inclusion
    are in the DNA of every department and agency in the Federal
    Government.
    ---------------------------------------------------------------------------
        \28\ President Joseph R. Biden Jr., ``Memorandum on Revitalizing
    America's Foreign Policy and National Security Workforce, Institutions,
    and Partnerships,'' February 4, 2021. Retrieved from https://
    www.whitehouse.gov/briefing-room/presidential-actions/2021/02/04/
    memorandum-revitalizing-americas-foreign-policy-and-national-security-
    workforce-institutions-and-partnerships/.
    ---------------------------------------------------------------------------
    (10) Continue oversight and get to know Federal employees.
        The subcommittee today is helping to identify challenges and
    opportunities facing the Federal cyber workforce. We encourage you to
    make this hearing an annual occurrence. The subcommittee could follow
    up by holding a hearing on agencies and subcomponents that are doing
    well with cyber recruiting, hiring, and employee engagement to help
    celebrate success and encourage replication.
        Members of Congress should also get out to visit agencies and their
    employees and hear from those on the front lines. Visiting Federal
    employees where they work, whether at headquarters or in the field, is
    one of the best ways to understand both the deep challenges facing the
    Federal workforce and the incredible work that the Federal Government
    does on behalf of the American people every day. Better yet, the vast
    majority of Federal employees are located outside of Washington, in
    every State and Congressional district, so they are also your
    constituents.
        Finally, policy makers should remember that they are stewards of
    Government's brand. How Members of Congress discuss public servants
    matters, especially when communicating with the next generation. When
    speaking to students--in formal settings like commencement speeches or
    simply in conversations with constituents--take the opportunity to
    share Government's unique, mission-focused work and the vital role of
    Federal employees.
                                   conclusion
        Congress has an opportunity right now to further drive bold
    cybersecurity reforms to keep pace with the evolution of technology and
    meet the challenges of today and tomorrow.
        For this reason, we want to commend the bipartisan effort made by
    this subcommittee to pass legislation that will strengthen the Nation's
    cybersecurity.\29\ The State and Local Cybersecurity Improvement Act
    (H.R. 3138)\30\ introduced by Chairwoman Clarke and Ranking Member
    Garbarino will provide funding to ensure State, local, Tribal, and
    territorial governments are securing their cyber environments. The
    Cybersecurity Vulnerability Remediation Act (H.R. 2980)\31\ introduced
    by Rep. Jackson Lee will allow the Department of Homeland Security to
    continue mitigating cybersecurity weaknesses that exist due to
    insufficient software or hardware. And the CISA Cyber Exercise Act
    (H.R. 3223)\32\ introduced by Rep. Slotkin will strengthen the agency's
    ability to fulfill its intended mandate by establishing a program to
    assess and review CISA's preparedness and resilience to cyber attacks.
    These measures will build upon work from the previous Congress to
    improve Government's cyber capabilities and ensure the effectiveness of
    CISA and other cyber components.
    ---------------------------------------------------------------------------
        \29\ House Committee on Homeland Security, ``House Passes Thirteen
    Bipartisan Homeland Security Bills, Including Cybersecurity Grant
    Program,'' July 1, 2021. Retrieved from https://homeland.house.gov/
    news/legislation/house-passes-thirteen-bipartisan-homeland-security-
    bills-including-cybersecurity-grant-program.
        \30\ H.R. 3138, ``State and Local Cybersecurity Improvement Act.''
    Retrieved from https://www.congress.gov/bill/117th-congress/house-bill/
    3138/text.
        \31\ H.R. 2980, ``Cybersecurity Vulnerability Remediation Act.''
    Retrieved from https://www.congress.gov/bill/117th-congress/house-bill/
    2980/text.
        \32\ H.R. 3223, ``CISA Cyber Exercise Act.'' Retrieved from https:/
    /www.congress.gov/bill/117th-congress/house-bill/3223.
    ---------------------------------------------------------------------------
        We also applaud the introduction of the Federal Rotational Cyber
    Workforce Program Act by Senators Peters, Rosen and Hoeven in the
    Senate (S. 1097)\33\ and Representatives Khanna and Mace in the House
    (H.R. 3599).\34\ These bills would help the Federal Government better
    train and retain cybersecurity professionals and provide Federal
    employees with professional development opportunities that ensure the
    Nation's future cyber needs are met.
    ---------------------------------------------------------------------------
        \33\ S. 1097, ``Federal Rotational Cyber Workforce Program Act of
    2021.'' Retrieved from https://www.congress.gov/bill/117th-congress/
    senate-bill/1097.
        \34\ H.R. 3599--117th Congress (2021-2022): ``Federal Rotational
    Cyber Workforce Program Act of 2021.'' July 2021. Retrieved from
    https://www.congress.gov/bill/117th-congress/house-bill/3599.
    ---------------------------------------------------------------------------
        Thank you again for holding this hearing. Building a robust cyber
    talent pipeline is a complex but necessary endeavor, and this testimony
    only scratches the surface of the efforts that are needed across the
    Executive and Legislative branches. We look forward to working with you
    and your staff as you move forward with your legislative and oversight
    agenda for the Federal cyber workforce in the 117th Congress.

        Chairwoman Clarke. I thank all of our witnesses for their
    testimony here today and I will remind the subcommittee that we
    will each have 5 minutes to question the panel.
        I now recognize myself for questions.
        For Mr. Ley, the cyber attacks against the Oldsmar water
    treatment facility and the Colonial Pipeline earlier this year,
    coupled with on-going reports that our adversaries are using
    cyber tools to target critical infrastructure have renewed
    conversations about how to better defend our OT networks.
        As employers gain a greater understanding of the gaps in
    their OT cybersecurity work force, it is clear that employees
    will need to be re-skilled or upskilled for these positions or
    receive additional trainings through continuing education
    programs.
        What steps are necessary to facilitate access to the
    trainings and certifications required for these positions?
        Mr. Ley. It is a great question, Chairman Clarke.
        The issues lies deeper than the access. There is a lot of
    access to a lot of academic information training courses and so
    forth. Again, what seems to be--surprised most folks--and we
    have gone to many different organizations, energy companies,
    water treatment facilities, to your point, businesses,
    manufacturing companies, even municipalities, and when we talk
    to them they really don't even really know where to start with
    identifying the education that they need, what topics. I know
    that sounds very strange, but we have developed methodology, we
    have task analysis surveys, we use the NICE framework to ask
    questions on what their folks do and where they touch cyber,
    IT, and OT. Obviously they need to know that to know where to
    send their folks and how to educate their work force and their
    organizations. Consistently--consistently, they don't have an
    idea.
        So we developed a process and a tool set, not just ours but
    in conjunction with other businesses that already have some of
    these solutions out there, that can--entities, organizations
    can utilize, even Government agencies, to sit down first and
    start with identifying what are the educational needs of their
    individuals. You can't fix a vulnerability, you can't fix or
    mitigate a threat if your folks aren't even aware what they
    should know and how to know that there is a threat even
    targeted at----
        Chairwoman Clarke. Thank you, Mr. Ley. Let me move on. We
    have a short period of time, but we--to be continued.
        Mr. Nolten, with support from additional discretionary
    funding from CISA, cyber.org recently launched a K-12 feeder
    program with Historically Black Colleges and Universities and
    Minority-Serving Institutions to encourage more minority
    students to seek cybersecurity degrees.
        Please elaborate on how this program will work and the
    goals you have for it. With additional Federal support how
    would you be able to expand your efforts to reach more students
    of color?
        Mr. Nolten. Great question, Chairwoman Clarke.
        Cyber.org's HBCU feeder program and Minority-Serving
    Institution feeder program is key to diversifying the
    cybersecurity work force. Our work is ensuring that high
    schools who are feeding into HBCU programs have the
    availability of curriculum, professional development,
    technology, and resources to stand up a cyber lab or a cyber
    classroom in order to introduce students to cybersecurity
    careers.
        K-12 education, as I mentioned in my testimony, is the
    formative years for ensuring that students have awareness of
    what they want to be when they grow up. If we ensure that our
    work is placed in Title 1 schools, in rural communities, we
    will begin diversifying the cyber work force by partnering with
    MSIs and HCBUs across the country.
        Chairwoman Clarke. Mr. Stier, a major challenge for Federal
    agencies has been retaining skilled cybersecurity
    professionals, yet agencies do not necessarily track the
    reasons behind the poor retention.
        What should agencies like DHS and CISA do to better
    understand why cybersecurity employees choose to leave and what
    steps can agencies take to improve retention?
        Mr. Stier. Great. Thank you so much for the question. I
    will give you at least three.
        The first is, I mentioned in my testimony that exit
    interviews would be very helpful in understanding, so long as
    there was real-time turnaround of that information and it went
    to leadership. If it is collected and it doesn't got to
    leadership, it is not going to make a difference.
        No. 2, we already have the Federal Employee Viewpoint
    Survey, which is how we create our places to work rankings. We
    have data on an annual basis that tells us what is really going
    on in every organization in government. Leaders should be held
    accountable for those numbers, and that would make a very big
    difference.
        The third and most important issue is that, again, leaders
    have to see that this is their job and responsibility and the
    most senior leadership in Government has to hold the people who
    work for them accountable to ensure that these numbers are
    good. If they prioritize it themselves, you will see change.
        Chairwoman Clarke. Mr. Stier, I think your screen froze.
    But I am out of time. We will circle back.
        Let me now recognize the Ranking Member of cybersecurity,
    the gentleman from New York, Mr. Garbarino, for his questions.
        Mr. Garbarino. Thank you, Chairwoman. Thank you to all the
    witnesses again for being here today.
        I want to start with Mr. Stier.
        I really do appreciate some of the things you said in your
    testimony about concrete items that we need to change. You
    pretty much took my first question away from me, which is good,
    but I want to build on something because you talked--you
    specifically mentioned how we should hire--we should get
    interns and interns should be able to come right in after
    they--college interns and they can come right in after they
    have completed their internship. That is what a lot of--that is
    what law firms do with kids in law school, that is what
    bankers--I mean it works for the private sector, so I think it
    would be great at getting young people involved. Right now I
    think it takes almost possibly--getting a job at CISA a new
    hire can wait for a year. A college student coming out of
    college can't wait a year if they have got debt.
        So, you know, what exactly--I mean is there a process there
    that you are thinking of? You know, what exactly should we do?
    How do we cut down on the year wait list?
        Mr. Stier. Yes. So you are 100 percent right. I mean and
    the most obvious example of what needs to happen is our Federal
    Government needs to approach talent management as the best
    private-sector organizations do. The most obvious thing in any
    professional organization, it starts with its strategy. As we
    do at the Partnership for Public Service, we think our student
    internship program is our primary mechanism for identifying
    talent for entry jobs. That is not happening in the Federal
    Government right now. There are some rule changes that Congress
    could institute. They could make it easier to converge interns
    into full-time employees. Right now, if you are unpaid or if
    you are hired by a third party, even one that gets diverse
    talent, that is much more difficult to actually convert in. So
    those are real rule changes that would make a difference.
        But fundamentally, I think the issue is really having
    leaders inside Government, the agency Secretaries, the
    different component heads, as well as the career leaders,
    understanding it is their responsibility and having clear
    metrics about what the expectation is. It is not working right
    now. It has gone the wrong direction. So we have seen fewer and
    fewer young people in Government today. It is not because of
    lack of interest. It is not because of lack of interest. That
    is relevant, but that is not the primary issue.
        So it would be, No. 1, hold leaders accountable. No. 2,
    make a few rule changes that would make it easier to convert
    interns into full-time employees. No. 3, make sure that there
    is real budget for this. That includes making sure that the
    interns are actually paid. Then the other issue, clearly in
    cyber in many instances, is security clearances. One of the
    things that can be done is ensuring that the security clearance
    process is completed while interns are students. There are
    different agencies that do this better. So we should be
    drafting on the approaches that the agencies that are best in
    class are using for all of Government.
        Mr. Garbarino. I appreciate that. That is a great answer.
    Does anybody--any of the other witnesses want to jump on
    anything additionally we need to do?
        Mr. Coulson. I would just like to interject. Internship is
    one process, but I think there is a huge opportunity here for
    apprenticeship. To have people earn while they learn, but also
    increases velocity because students are able to gain experience
    while they are in their job, while they are receiving their
    education. It also tightens the partnership with educational
    institutions to build the work force you need as opposed to
    well, here is somebody we graduate, I hope it worked out. It is
    a much more integrative approach.
        So I would suggest that that would be something that be
    explored and I would be glad to talk to you further about this
    as we are about to in the CAE community pilot a major
    apprenticeship program in cyber directed at Government.
        Mr. Garbarino. Now, your apprenticeship, would you--the
    apprenticeships would be with the Government or with private
    companies and the people could transfer into the--I mean how
    would--what is your--how are you doing this? What is the pilot
    program?
        Mr. Coulson. Well, it is both. Because of the interest of
    time, it is complex to describe, but let me just say that I
    think that the apprenticeship model has been incredibly
    underused and there is a lot of energy coming out of other
    parts of the Government, and I would like to see that in the
    area of National security, because it allows us to mentor and
    produce and validate talent while they are in school and while
    they are working.
        Mr. Garbarino. I appreciate it, Mr. Coulson.
        I hope we get a second round of questioning because I had a
    couple more, but I yield back.
        Thank you, Chairwoman.
        Chairwoman Clarke. Mr. Ranking Member, should time permit I
    definitely support that.
        Let me now recognize that--other Members for questions they
    may wish to ask our witnesses.
        In accordance with the guidelines laid out by the Chairman
    and Ranking Member in their February 3 colloquy, I will
    recognize Members in order of seniority, alternating between
    the Majority and the Minority. Members are also reminded to
    unmute themselves when recognized for questioning.
        Having said that, the Chair recognizes for 5 minutes the
    gentleman from Rhode Island, Mr. Langevin, for his questions at
    this time.
        Mr. Langevin. Thank you, Madam Chair. I want to thank our
    witnesses for their testimony today. Very insightful.
        I will also mention, with respect to the Ranking Members'
    line of questioning on internships and apprenticeships, I
    applaud those efforts. That is why I am also a big fan of the
    cyber core program, whereby students can apply at that program
    and if they are accepted tuition is covered for the junior and
    senior year. They will be able to--they get paid a stipend,
    about $32,000, and then they go into a cyber job at local,
    State, and Federal Government for 2 years after that.
        Let me get to another--my line of questioning.
        Mr. Ley, I am very interested in proving cybersecurity
    training among our operational technology work force. The
    Chair, Madam Chairman, had brought up this during her line of
    questioning. So that is where we are simultaneously further
    behind the curve and where most damage can be done.
        So our National cyber director, Chris Inglis, often talks
    about cybersecurity education having three tiers, the many, the
    some, and the few. So the many are the people who use
    technology in their every day lives, which is to say almost
    everyone. Mr. Nolten has done an admirable job describing
    expanding K-12 education for everyone. The few are the
    cybersecurity professionals who have cyber as part of their job
    titles. The kind of folks Dr. Coulson's programs churn out. But
    I want to focus on the ``some'', the people who in the IT world
    are the software developers or network architects.
        So these are the people who need a much more nuanced view
    of cybersecurity than most, but for whom it remains secondary
    to their main job function. In the OT space, these are the
    maintainers, the installers, the operators of industrial
    control systems.
        So I continue to be concerned that while training for these
    occupations includes an incredible emphasis on a safety
    culture, cyber risks have barely penetrated.
        So, Mr. Ley, in your view how can we better incorporate
    cybersecurity into the training for OT professionals who do not
    focus on cyber?
        Mr. Ley. Thank you, sir. Great question.
        We have a lot of the information. Obviously our training
    courses cover a lot. Unfortunately, expanding that information
    out to other platforms to offer that, businesses out there, the
    organizations, the local municipalities, can't necessarily
    afford some of the training that they actually need. Some of
    the training that we offer, working with CISA right now,
    looking at opportunities to take the curriculum we have, offer
    it to universities, colleges, other institutes, take the
    information we have, take the curriculum and let them offer the
    same curriculum and provide them support so that those
    businesses out there, the some, the nations out there, don't
    have to come here, they can go locally. Universities and
    colleges can start developing these offerings themselves. They
    know the businesses, they know the organizations, they know the
    specialties they need. A lot of academic institutes come to us
    and say we need this specialty. We can develop it and we push
    it out. That is the area we recommend really needs to be
    developed.
        We started to explore that, but that would be where I would
    ask.
        Mr. Langevin. Thank you.
        Let me get to another question for Mr. Stier. In your
    testimony you referenced the need to update pay and
    classification for the Federal work force. This is something
    that the Cyberspace Solarium Commission, on which I serve, has
    looked at closely. Madam Chair, I ask unanimous consent that
    the Solarium Commission's white paper entitled ``Growing a
    Stronger Federal Cyber Work Force'' be inserted in the record.*
    ---------------------------------------------------------------------------
        * The document has been retained in committee files and is
    available at https://www.solarium.gov/public-communications/workforce-
    white-paper.
    ---------------------------------------------------------------------------
        Mr. Stier, would you take it from the administration and
    Congress to get the--what would it take from the administration
    and Congress to get the civilian work force competitive with
    the private sector? Should the National cyber director chair
    this effort, which will necessarily involve several elements of
    the inter agency?
        Mr. Stier. So, look, I think that it does make sense to
    have a coordinated response. I will note that one of the things
    that as legislators you need to pay great attention to is you
    actually put legislation in in 2014 to give authority to DHS on
    cyber pay. It is just getting rolled out right now in
    September. That is too long. You can't wait 7 years for this
    kind of action.
        So one risk of creating the sort-of National or Federal-
    wide effort is that there will be a lot of talk and not a lot
    of action. So I would be looking to actually be setting up, you
    know, time tables about when things actually need to get done
    and clear metrics about what success looks like. But it begins
    with having an enterprise-wide, a Government-wide plan about
    what we need in the way of human capital and then what do we
    need to do to get it. A lot of it may be upskilling existing
    talent, it could be new talent. I see the clock has run, but I
    would be thinking about it in a strategic way to approach the
    problem.
        Mr. Langevin. Very good.
        My time has expired. I thank you for the insights you have
    offered.
        Madam Chair, I yield back.
        Chairwoman Clarke. The Chair now recognizes for 5 minutes
    the gentlewoman from Tennessee, Ms. Harshberger, for 5 minutes.
        Ms. Harshberger. Thank you, Madam Chair, and thank you
    witnesses for being here. This is to me a really exciting topic
    because we are so deficient in cybersecurity work force. From
    different meetings I have been in, you know, it would take a
    million people to fill some of the slots that we need, but to
    me that is unbelievably--that is ridiculous. We need people.
        You know, when I go around my district, I make sure to tell
    every entity I can, every school system, anybody who will
    listen, encourage these young people to look at this field.
        I guess one of my first questions is for Mr. Stier. You
    know, I am sure you are aware that DHS has yet to finish its
    development and roll out of the CTMS program. The main goal of
    this initiative is to cut the time it takes to hire these
    cybersecurity professionals. Really to redefine how the
    Government evaluates their skill set and their pay rates. You
    know, I was talking to someone at one of the think tanks and
    they are like, they can really ask whatever they want and we
    take them because there is such a need.
        You know, the committee is concerned about how long it
    takes DHS to implement this program, which was authorized back
    in 2014. What is your perspective on how effective a tool this
    will be for the Department?
        I guess my other question is what recommendations do you
    have for DHS so we can meet those goals? I am doing all I can
    to tell people about a field that I think would be very
    interesting for even middle schoolers going on up to high
    school, before they ever get into that arena.
        Mr. Stier. So, Congresswoman, I think you are--it is so
    important you are doing what you are doing because your voice
    really matters to encourage people too. I just see this as a
    field for themselves or something that, bluntly, should be part
    of whatever else they are doing. I think the direct answer to
    your question is that we really need more consistent long-term
    leadership on these issues.
        You are 100 percent right, this has been crazy-slow in an
    area where slow is incredibly dangerous. The risk moves so fast
    that by the time you get to where you think you need to be, you
    are already behind the curve. I have heard, you know, folks in
    Government say we work real hard to catch up to the past. That
    is not where we need to be.
        I think fundamentally the most important structural change
    that you could make is ensuring that we had consistent
    leadership on these management technology issues across
    administrations. So think of this way, the FBI director has a
    10-year term, the comptroller general at GAO has a 15-year
    term. The reality is GAO is one of the best-run organizations
    in Government because you have a leader who knows that the work
    that they do around talent will actually pay off for himself.
        I would suggest that you think about trying to ensure that
    there is cyber leadership that is consistent over the years.
    Again, I mentioned this earlier, that Secretary Granholm wants
    to see the CESER leadership actually be career. I would be
    thinking about that CISA as well. You have a really strong
    person there right now, but if the average tenure is 2 years,
    there is no way you are going to actually see significant
    progress. People inside are all going to be running toward the
    new leadership and very careful about not getting too far over
    their skis knowing that someone new is coming in and that
    becomes a real problem.
        So that to me would be my No. 1 suggestion. There are other
    things I think you can do, but I will be quiet for now.
        Ms. Harshberger. Well, you know, it is almost like when you
    hear these experts talking and they are saying people can even
    use Google and look at traffic patterns in certain countries. I
    am like, that is unbelievable. Does it take a 4-year degree?
    How are you going to get these people interested to go into
    this field because the need is so critical?
        To me, we would designate this need as critical
    infrastructure if I could, but we can't do that. If anybody
    wants to answer, do they need a 4-year degree? What kind of
    degree do they need to even enter this field?
        Mr. Coulson. I would interject, we work a lot with
    community colleges, but I think there is a mantra here.
        Career technical education especially--people have looked
    at it, well, that is vocational, that is, you know, welding and
    things. No, cyber fits there too. Often times in my work we
    have to let kids find out how smart they really are. That is
    usually education becomes a gateway drug, if you will. So if we
    can identify them and we have a program where we are looking at
    aptitude for cyber, not aptitude in terms of you can and you
    can't, but where do you fit? Then to identify them and come up
    with programs that nurture that talent all the way through. We
    could have kids coming out of high school that could work at
    the technician level. We have community colleges that are now
    even doing not only associate's degrees and certificates, but
    are also including bachelor's degrees.
        I think academia has a reputation of being glacial, but I
    would suggest that that is not necessarily a fact in the cyber
    space.
        Ms. Harshberger. Well, Mr. Coulson, you are speaking my
    language.
        My time is out and I thank you.
        I yield back, Madam Chair.
        Chairwoman Clarke. The Chair now recognizes for 5 minutes
    the gentleman from New York, Mr. Torres.
        Mr. Torres. Thank you, Madam Chair.
        Three years ago I came across a New York Times article with
    the following headline: ``The Mad Dash to Find a Cybersecurity
    Workforce''. The article was citing cybersecurity ventures,
    claims that by 2021 the cybersecurity work force would have 3.5
    million vacancies. We are in 2021.
        So I am curious to know has that projection come true? What
    is the extent of the shortages in the cybersecurity work force
    as of 2021? Anyone who has an answer to that question can feel
    free to answer.
        Mr. Coulson. OK. Everybody has a prediction on that. That
    might be a global number, but within the United States right
    now, you know, best that I could find this morning was actually
    just over 500,000. That is in the compressed hiring that we are
    in right now. But the Solarium Commission report that
    Representative Langevin worked on, says something I think is
    overall answer to that question, and it is we have had reports,
    we have had predictions, we have had things for 20 years. What
    we need is action on it, because the problem has not been
    getting better, it has been getting worse.
        Mr. Torres. In order to--and I am in favor of action, I
    just want to understand the precise nature of the problem. So
    are these vacancies--to what extent are these vacancies coming
    from the public sector and the private sector? Do we know the
    breakdown? Do we know the number of vacancies that require a
    college education?
        Mr. Stier. So I can speak--this is Max Stier at the
    Partnership--I can speak to the Federal Government. The answer
    is we really don't know what the real need is. This is my point
    about the importance of really doing a more thorough human
    capital plan for the Government in cyber and beyond. I think we
    need it in more than that.
        I can't resist also saying that the gap is not simply in
    the actual technical talent, the gap in some ways is more
    profound in the fluency around these issues, in the leadership
    more broadly. You know, people who are not actually in jobs
    that are designated as technical positions fundamentally
    actually need to understand these issues in order to do their
    work appropriately.
        I think if you are thinking about what the actual gap is,
    you ought to be examining that one as much as the actual work
    force.
        Mr. Torres. Is that a number--we need more cybersecurity
    generalists? Is that?
        Mr. Stier. It is less that--I would say, for example, that
    if you are coming in as the Secretary of an agency in the
    Federal Government, if you are running a component, if you are
    a career senior executive running a large program, you have to
    be thinking about cyber issues and understanding what the
    implications are for your programmatic choices. That includes,
    you know, the talent needs. You will need to be able to address
    those problems. That is an information gap. You don't need a
    cyber professional in those positions, but you need people who
    are fluent and aware.
        Mr. Torres. I have a question for each member of the panel.
    What is the most successful cyber work force development
    initiative that you know of and that should be scaled up?
        Mr. Nolten. I will jump in, Congressman, and mention that
    CETAP is proven to be a successful program in that we are
    introducing students to cybersecurity careers and degree
    opportunities at an early age, elementary and secondary.
        When a student asks me what do you want to--or when I ask
    my students, what do you want to be when you grow up, at that
    very moment I am providing them a gateway into the
    opportunities that exist for them post-high school as well as
    post-graduate. Not every student is going to go to college and
    so what we want to ensure is that upon graduating high school
    we have students with industry-based certifications, that they
    are skilled to go walk into an organization and be employable
    immediately. Employability is the key and we want to see that
    CETAP be grown so that high school students who are going into
    any of the 17--16-17 critical infrastructures within DHS's
    structure, that those students have the ability and the
    knowledge to----
        Mr. Torres. Can I interject? What is your placement rate?
        Mr. Nolten. I am sorry, sir?
        Mr. Torres. Your placement rate.
        Mr. Nolten. So right now we see that high school students
    who are participating in CETAP's program, four times as many
    students are going into a cyber-based degree field within a 2-
    year and/or 4-year program.
        Mr. Torres. How many students have gone through your
    program?
        Mr. Nolten. Over 3 million students have benefited from our
    program in all 50 States.
        Mr. Torres. Does the rest of the panel have any thoughts on
    what is the most successful existing cybersecurity work force
    initiative?
        Mr. Ley. I would--I am sorry.
        Mr. Coulson. Please go ahead.
        Mr. Ley. I would like to suggest there is a program that is
    not even funded and even an initiative right now, and it is to
    match. What we find in our research is that the students coming
    out of degree programs, even out of high school, and the hiring
    at these organizations, businesses, Government entities, there
    is not a defined mechanism to really place the most talented
    individuals in the jobs where they can be the most successful.
    There is nothing based on the old hiring process of resumes and
    interviews is what is taking place. We continue to hear from
    businesses, Government entities, well, we hired the most--we
    thought was the best person and it takes us 18 months to 2
    years to get them trained up to be useful. Why is that? Because
    there is not a mechanism. You identified the mechanism, but
    there is no funded program to actually implement that to say
    nice KSATs, hiring job applications has the same KSATs, we can
    see what the students have, what skills they have and match
    them to the job and the people can hire the right people the
    first time instead of the second and third time.
        That is an issue that should be out there.
        Mr. Torres. My time expired, so I am going to----
        Chairwoman Clarke. Thank you very much, Mr. Torres.
        The Chair now recognizes for 5 minutes the gentleman from
    Georgia, Mr. Clyde.
        Mr. Clyde. Thank you very much, Madam Chair. I appreciate
    this very important hearing.
        One of my concerns is the dependence that we have on the H-
    1B visa program, or the student visa program. Oftentimes we see
    our universities and businesses invest in people that we bring
    in from overseas and we teach them cyber and they take up the
    opportunities that we have in this country and they learn all
    sorts of great things and then they take their talents and they
    go back home to their home countries.
        So I see that as not being a great return on investment and
    we are losing out on the opportunity to develop Americans who
    can fill those jobs.
        So I guess my question--and I would like to start with Dr.
    Coulson--so how can we best encourage the home-grown talent so
    we don't have to depend on the H-1B talent that at some point
    is going to go back to their home country and we are going to
    lose that opportunity and what has been invested in those
    people.
        Now, I understand that those people might actually, you
    know, bring something to us as well, but still, you know, they
    are not American citizens. You know, they are not going to stay
    here. They are going to go home and take that talent and
    everything they learned with them.
        So how do we do that? How do we best encourage home-grown
    talent?
        Mr. Coulson. So two-thirds of Ph.D.s in this country are
    non-domestic. That is a crisis in itself. There is a number of
    programs that I could inform you of after, but in the interest
    of time.
        The research program that we just started is really looking
    at, all right, how do we home grow talent. It doesn't have to
    be all from our one university. Again, I will go to my mantra,
    kids sometimes don't know how smart they are.
        Mr. Clyde. Right.
        Mr. Coulson. So the program we created now with 38
    universities, working with technical directors on actual
    problems is meant to reach into the undergraduate level and
    start teaching them the science of research so that we can
    pipeline these and grow our domestic talent and also develop an
    affinity for the real challenges that Government is doing.
        In the Centers of Academic Excellence Community I think
    that is a great example of something we are doing to tackle
    that one issue, which is very significant for the future of
    technical leadership in the United States.
        Mr. Clyde. Well, thank you. I appreciate that.
        You know, as part of the Department of Homeland Security
    subcommittee, you know, one of the greatest threats we have is
    ransomware from the outside. So I think one of the greatest
    defenses we have is home-grown talent that can defend against
    that.
        So does any other of the witnesses, would you like to add
    anything, Mr. Nolten or Mr. Ley or Mr. Stier, to that?
        Mr. Ley. I would also bring back attention to what Tony
    brought up earlier about apprenticeship programs.
        Mr. Clyde. Right.
        Mr. Ley. It is a way to bring the--start the folks out in a
    company and let them learn and their actual reason--to
    understand why they are learning, because they are working for
    that business. Apprenticeship programs are huge and a key. We
    really need to focus on that. Right now there really is not--in
    the Department of Labor or Department of Commence there is
    really not a defined apprenticeship for cyber-related skills.
    There is a reason plumbers and electricians have apprenticeship
    programs, because you can't get all the hands-on training just
    sitting in a classroom. Apprenticeships bring that and they are
    huge.
        Mr. Nolten. Congressman, if I may add----
        Mr. Clyde. Thank you very much. That is an excellent
    insight. Go ahead, please, Mr. Nolten.
        Mr. Nolten. Congressman, if I may add one statement here.
    Research has shown that a child begins to form what they want
    to be when they grow up around the middle school level. That is
    sixth, seventh, and eighth grade. If we look at other countries
    around the world and see where their dollars are being
    invested, it is in K-12 education.
        So in order to begin solving this pipeline issue that we
    have, we have to focus on ensuring that we have students who
    are skilled and knowledgeable about the opportunities that
    exist in cybersecurity.
        Mr. Clyde. All right. I think that. Thank you.
        I appreciate that and unless anyone else has a comment,
    then, Madam Chair, I yield back. I think that is great
    information though.
        Chairwoman Clarke. Thank you, Congressman.
        The Chair now recognizes for 5 minutes, the gentlewoman
    from New York, Ms. Rice.
        Ms. Rice. Thank you, Madam Chair.
        I would like to continue talking a little bit more about
    community colleges. I think we all agree that they play an
    incredibly important role in connecting students with an
    affordable higher education. In my district, Nassau Community
    College, which is a Minority-Serving Institution, has a
    cybersecurity certificate program designed for students who
    intend to go onto pursue a 4-year cybersecurity degree.
        Dr. Coulson, do existing Federal programs adequately
    support programs like the one I just described at Nassau
    Community College? What if any additional resources may
    community colleges, particularly minority-serving institutions,
    need to assist them in building, growing, and diversifying the
    cybersecurity work force programs?
        Mr. Coulson. Well, the Centers of Academic Excellence
    program has over 150 community colleges. We have set up a
    National articulation database. That was with Moraine Valley
    Community College. That is some great work with the National
    Science Foundation's advanced technology education program with
    Whatcom Community College and Cal State San Bernardino were
    working through the community college network to see what is it
    that employers want, but also how can we diversify talent on so
    many ways? We have something called the Cyber Education
    Diversity Initiative, which focuses on Minority-Serving
    Institutions, but also we have program for the deaf and the
    hard of hearing, Wounded Warriors, neuro-diverse communities,
    and so on. I think the community colleges play a pivotal role.
    A lot of times it is in the area traditionally seen as re-
    skilling, but I would say that it is also upskilling.
        So I think that community colleges in general are really an
    economic engine and especially for opportunity for many people.
    The issue that we have in the Centers of Academic Excellence in
    terms of funding is everything is one-time funding, one-time
    grant related through a number of agencies. I would really like
    to see the Department of Homeland Security invest in this
    program with sustained funding so that we aren't doing hand-to
    mouth, but we could attack this problem strategically.
        Ms. Rice. That is actually a really good point and I think
    that we should take that advice about the funding. I think that
    is critical. I agree with you.
        You know, I think there is also a misconception that all
    cybersecurity jobs require an advanced degree. But cyber.org's
    website explains in the--its cyber career profiles that there
    are a number of good-paying cybersecurity careers that don't
    necessarily require a degree at all.
        Mr. Nolten, you know, we are talking about K-12 and I know
    that you have experience working with K-12 educators, what more
    can be done to increase awareness of the full range of
    cybersecurity career options that are available to young
    people? I think it is really important--I think the Federal
    Government needs to support high schools that want to implement
    career and technical education programs around cybersecurity
    that are designed to, you know, send students into the work
    force right after graduation.
        But, Mr. Nolten, if you could just talk a little bit more
    about how can we increase awareness? I think that, you know, if
    kids knew what was out there--you know, I forget who--I think
    you said that--talked about that critical time period of sixth,
    seventh, eighth grade where kids are beginning to make kind-of
    career choices. If they are not hearing about it in school and
    they don't know what the potential is, then they are missing
    that opportunity.
        Mr. Nolten. Congresswoman Rice, I mean that is a great
    question and it is a great awareness that we must take.
        One simple example, Sally has two apples at the house, she
    has five friends coming over, how many apples does Sally need
    to go out and buy. This is a simple subtraction problem that
    many of our educators are using. My encouragement to K-12
    educators is don't use apples, use gigabytes. Sally has a
    computer at the house, it has two gigabytes of memory, she has
    a really cool program she wants to run that requires five, how
    many gigabytes does Sally need to add? By changing the context
    of what we are teaching inside the classroom, we are able to
    introduce these students and place seeds of opportunity in our
    minds of our students. This very work, this very structure, we
    allow students to explore career opportunities that they have
    no idea about, their mom or dad or guardians had no experience
    in. This effort and this movement must be scaled. We must
    ensure that teachers have the confidence, the ability, and the
    resources from a funding standpoint to be able to teach
    cybersecurity and to change those apples to gigabytes.
        Ms. Rice. Well, thank you all so much. I think this has
    been a great discussion.
        Madam Chair, I yield back. Thank you.
        Chairwoman Clarke. Thank you, Congresswoman.
        The Chair recognizes for 5 minutes the gentleman from
    Kansas, Mr. LaTurner.
        Mr. LaTurner. Thank you, Madam Chairwoman.
        Mr. Stier, let me start with you. There is a seemingly
    endless supply of cyber work force related legislative
    proposals. But I am concerned that often times Congress focuses
    on the shiny new bills instead of conducting the necessary
    oversight to ensure the prior bills have been properly enacted.
        Where should the committee be focusing when it comes to
    oversight over enacted lines of effort?
        Mr. Stier. So thank you for such a wonderful question. I
    agree with you that often times we see problems Congress
    legislates and then done, move on to the next thing. The
    reality is, in my view, legislation is the starter's pistol, it
    is actually not the race. Your oversight function is profoundly
    important.
        So one of the recommendations I made in my testimony was
    that you actually make this an annual testimony, or rather an
    annual hearing. I love the example that was given earlier about
    the need for long-term money, because there is no way to plan
    on these programs if you don't have multi-year funding. It is
    the same here, if you let agencies know that this is not about
    giving them an authority and then walking away, but rather that
    you have actually a plan, you intend to be able to have
    oversight on an annual basis with a set of metrics, performance
    metrics, that you build into your thinking. That may change
    over time. I think that will change the incentives for agencies
    and the likelihood that you actually see more progress from the
    investments that you are making.
        So I would think about this, again as you suggest, not as
    a, you know, legislate and walk on, but rather what are our
    goals, you know, what is our current thinking about the tools
    we need right now. How will we know whether or not we have been
    successful. Then come back to it in a regular way with notice
    to agencies that this is about to happen. I think you would see
    in different outcomes. Not easy outcomes, because, bluntly,
    these are tough problems and they are problems that are
    changing.
        Mr. LaTurner. I appreciate that.
        This question is for all of you and it is a really broad
    one. With so much focus in recent years about expanding cyber
    educational opportunities, do we feel like we are at the point
    that we are starting to close the gap, are we making a dent?
        Mr. Ley. I will just say from my perspective, from a lab
    perspective, from testing control systems and looking at and
    providing courses to folks, I think we are making a dent. Some
    of the issues are very systemic and I think are just not known,
    even to panel members. We talk about the tools that connect the
    high school, get them excited there. There's lot of progress. I
    have 23 interns from colleges and universities around my State
    and other universities around the Nation and I ask them, if you
    are in a degree program, a cyber-related degree program, why?
    What are you going to do with it? They don't know. There really
    is not a mechanism--there are mechanisms out there, we are not
    connecting them to what jobs they need to go to.
        So as far as degrees and topics we are teaching, yes, I
    think we are making a dent, I think we are offering the right
    curriculum and I think it will ever be expanding. It is not
    going to change. But we have got to connect the students who
    have moved on and are excited, think they know what to do, they
    get to that next level and they are--where are the tools, where
    are the things I can go to look to what is next for me. They
    are not being exposed to those.
        Mr. LaTurner. I appreciate that.
        Yes, Mr. Coulson, go ahead.
        Mr. Coulson. So 6 years ago when we started the Centers of
    Academic Excellence Community, we were about 15,000 students.
    We now have over 100,000. A lot of that has to do with a long-
    term vision reaching into the K-12 space, seeing the dividends
    of programs like cyber.org, the GenCyber camp program, and
    others that are stimulating interest. We are starting to see
    that bubble up. But it is a long-haul game. I think that is a
    real message here.
        As you said earlier, shiny object funding is not going to
    solve this problem.
        Mr. LaTurner. Very good.
        Mr. Stier, I saw you have your hand up.
        Mr. Stier. So, yes. I think just to--there are a lot of
    people working really hard on these issues and we are making,
    in absolute terms, progress. But what I would say is that
    fundamentally this is about dealing with problems that are in
    the real world and against the problem set that we face, my
    view is we are losing ground not gaining it, certainly in the
    arena that I can see.
        Mr. LaTurner. Wow. I want to hear your perspective.
        Go ahead, Mr. Nolten.
        Mr. Nolten. Congressman, two quick stats. CETAP's impact is
    well over 3 million. While that may be an exciting number to
    many, the denominator there is 52 million. Our work has just
    begun.
        Mr. LaTurner. Thank you so much.
        Madam Chairwoman, my time has expired. I yield back.
        Chairwoman Clarke. Thank you, Congressman.
        For colleagues who may be interested, I am going to enter
    into a second round of questioning. There are a few questions
    that I have remaining. For anyone else on the subcommittee who
    also may have additional questions, you will have an
    opportunity at this time.
        Dr. Coulson, a major part of addressing our cyber work
    force shortage must include re-skilling workers for
    cybersecurity jobs. I think certainly in the midst of this
    pandemic where we are hearing about the great resignation,
    there may be an opportunity if we open our eyes wide enough or
    open the aperture so that we are looking at some of our
    employees who may not be returning to some of the professions
    that they were once in.
        How are universities and community colleges currently
    working to include nontraditional students already in the work
    force or in their programs? What barriers exist for
    participation and what can we do to expand access?
        Mr. Coulson. Well, that is excellent. This is something I
    am so excited that you asked me, to be quite honest. Re-
    skilling is absolutely necessary, it is absolutely important. I
    think the academic community has looked at cyber and said,
    look, we need all hands on deck. How do we get somebody with an
    existing degree or maybe had a different life before, how do we
    see where they fit in cyber, which is such a broad field.
        We ran a pilot program with the National Science Foundation
    that provided scholarships for veterans and re-skilling workers
    through the community college program to get them into the
    cyber work force. We wanted to see what was making them tick.
        But more than that, on a broader spectrum, we are seeing
    programs that are emerging in our Centers of Academic
    Excellence and we are incentivizing them not only in on-line
    learning, but in other ways that fit around schedules so that
    somebody could still actually work in their job but look toward
    a new career and make accommodations for different age groups
    and people who are differently abled.
        There are so many programs there and I would love to have a
    longer discussion on it, but we--I will say this, we are
    working in that area because it is so very important and
    universities and community colleges are expanding capacity as
    much as possible, marketing. Actually, next month we are
    running a National virtual career fair for cybersecurity
    students and trying to link them with employers, but also try
    and stimulate interest in re-skilling.
        Chairwoman Clarke. Got caught out there for a moment.
        This is to the panel. What should the Federal Government's
    role be in facilitating apprenticeship programs in the private
    sector? If you have given any consideration to that.
        Mr. Coulson. I think Mr. Stier said earlier, what are the
    standards for a cybersecurity discipline. So we actually just
    started a project with the American Council on Education to try
    and help set those standards, and we are going to work with the
    Department of Labor to see if we can get at least the first of
    what we consider many different disciplines within cyber,
    because obviously this critical infrastructure and so on.
        One of the areas that I think the Federal Government could
    really help us in, especially in the Department of Labor, is
    velocity. To get the apprenticeship programs moving is such a
    laborious technical process that many of our industry partners
    have said, I don't understand this and they are ready to walk
    away. I would really like to, you know, work or maybe put
    together subcommittee on how we could fix that problem and
    increase velocity. Because apprenticeship is very foreign in
    the United States but it is such a key--has such key potential
    to solving this problem.
        Chairwoman Clarke. Very well.
        I wanted to do a deeper dive with you, Mr. Stier, about how
    agencies can improve retention. We know that, you know, there
    is great demand for the limited talent that exists. We are
    constantly hearing of private sector poaching from the public
    sector. Could you give us a little bit more depth to what we
    can do in the retention space?
        Mr. Stier. Absolutely. It begins to have real-time data on
    what is actually happening and have leaders that are held
    accountable for that data. Otherwise, you know, there are a lot
    of things you can do, but you don't know if you are doing the
    most important things.
        You know, what we see in the work that we do is, No. 1,
    especially young talent, they want to feel like they are being
    invested in. I will note that there is a really--in my view, a
    big difference in the way by and large the uniformed services
    are treated versus the civilian services. In the military by
    and large they see their talent as an asset. Oftentimes the
    talent inside the Federal Government, the civilian talent, is
    treated as if it is a cost. We need to see I think way more
    investment in the people in the knowledge that they are
    getting, in the responsibility that they are getting, and also
    in the management that they are getting. If you did that, I am
    quite confident that you would see a lot higher retention
    numbers.
        If you look at our best places to work rankings, the No. 1
    issue for why people are actually leaving is their perceptions
    of their leadership, from the first line supervisor to the more
    senior people in the organization, and it is not good. It is,
    you know, 10+ points below what you would see in the private
    sector. They're purpose-driven, they want to be there, but if
    you give them bad management they are not going to say.
        So that to me would be the most important thing to do, is
    improve the management, hold them accountable, provide real
    investment in their growth and responsibility. The Government
    has the best value proposition around. You can make a
    difference in the world, which most young talent really care a
    lot about.
        Chairwoman Clarke. Very well. Thank you.
        My time has run out.
        I now recognize the Ranking Member of the subcommittee, the
    gentleman from New York, Mr. Garbarino, for any additional
    questions he may have.
        Mr. Garbarino. Thank you, Chairwoman. I do have at least
    one more question.
        Mr. Stier, we will start with you. The Cyber Corps
    Scholarship for Service program, run by the National Science
    Foundation, has been a great program to encourage students to
    enter public service. I understand that to date nearly 3,500
    students have taken advantage of the program.
        What more can we do to increase participation in this
    program? Or maybe not--and if not, it is not increased
    participation in this program, what is the difference--is this
    program better or could we maybe start some sort of cyber
    university, similar to one of the other--like the Naval Academy
    or the Merchant Marine Academy? You know, the Merchant Marine
    Academy was started in 1943 because of shortage in merchant
    marines. We have a shortage in people that need to go into the
    Government cyber work force.
        Is this something that we should be looking at, or should
    we just stick with training them at outside colleges and hope
    they come to work for us?
        Mr. Stier. Sure. So, Congressman, I think this is a
    fantastic question. I come back to the military model, and you
    used it, which is you can think about the academies versus the
    ROTC. In my view it is much more cost-effective to make further
    investment in an ROTC model rather than the bricks and mortars
    of a new institution. It is not simply that it is more cost-
    effective, but it is also in my view more--you will have higher
    leverage. If you leverage off of the, you know, Government-
    wide--you know, we have best in class higher education in this
    country and if you create more scholarship opportunities for
    service in Government, you will--it will be, again, a cheaper
    way of getting great talent and it will be integrated against
    the whole of society, because you also want to make sure that
    people who are coming into Government represent the entire--
    geographically, racially, gender, all those things.
        So my counsel would be to, you know, further invest in
    programs that are more likely ROTC than it is to try to create
    a new entity focused on a specific area like cyber.
        I think you will find immediate return because you don't--
    it takes a long time to create an institution and we don't have
    that time. I think you will have better pay-off.
        I will say that we can undoubtedly do better in the way we
    use that talent. The Chair's questions around retention should
    be applied here with the folks that--because, yes, they may
    have a service requirement, but you really want to have a
    program that keeps them well long after that service
    requirement has ended.
        Then there are programs like what we have, the Cyber Talent
    Initiative, where we are partnering with the private sector,
    with MasterCard and Microsoft and Workday. They are actually
    supporting bringing talent into Government knowing that talent
    might also come to them.
        So there are a lot of novel ways of trying to drive talent
    into the sector and into Government.
        Mr. Garbarino. I appreciate it, Mr. Stier.
        Any of the other witnesses want to add on or have any
    thought on the question?
        Mr. Coulson. Well, actually I am a scholarship for service
    institution. I would say that that was one of the keys that
    built capacity within my institution to create such great cyber
    talent. But there are other programs, like the Department of
    Defense Cybersecurity Scholarship Program that acts like an NFL
    draft, if you will, where the best talent gets submitted and
    they can pick and choose.
        I think Mr. Stier brings up a very important point, and
    that is if we built bricks and mortar, it takes a long time,
    but also it closes the number of dimensions. I think a cyber
    university concentrating on one skill set is great, but that is
    not what cyber is about. Cyber is so much broader and you need
    innovation from all sectors. As I like to say, innovate
    locally, deploy Nationally.
        I think that is where the scholarship for service, and like
    Mr. Stier said, like an ROTC type of approach works probably
    more effectively and gives the taxpayer more bang for the buck.
        Mr. Garbarino. I appreciate that. Thank you very much.
        Madam Chairwoman, I yield back.
        Chairwoman Clarke. Well, with that, I thank our witnesses
    for their very valuable testimony here today and my colleagues
    and Members for their questions.
        The Members of the subcommittee may have additional
    questions for the witnesses and we ask that you respond
    expeditiously in writing to those questions.
        Without objection, the committee record shall be open for
    10 days.
        Hearing no further business, the subcommittee stands
    adjourned. Thank you, everyone.
        [Whereupon, at 11:32 p.m., the subcommittee was adjourned.]

                                A P P E N D I X

                                  ----------

                        Statement of Bitwise Industries
                                 July 29, 2021
        Chairwoman Clarke, Ranking Member Garbarino, and Members of the
    subcommittee: Bitwise Industries is grateful for the opportunity to
    submit this testimony in connection with the subcommittee's exploration
    of the need for and development of cybersecurity professionals.
        Since 2013, Bitwise Industries, a female- and minority-led
    technology company headquartered in Fresno, CA, has been training
    underserved people from undervalued places for jobs in the digital
    economy. Our workforce training programs have prepared over 5,000
    student workers, more than half of whom are women and/or people of
    color, for high-growth, high-wage jobs in the technology industry. Many
    of these individuals have gone from making under $21K/year to well over
    $61K/year. Following the program, 80 percent are employed in tech jobs
    resulting in $295 million of aggregate wages. In addition to outside
    employment, the technology consulting side of our business hires many
    of these students, proving it is possible to build stellar technology
    in unexpected places with diverse, nontraditional talent.
        The key to our success is our apprenticeship model, which unlocks
    potential by coupling paid, experiential technical training with access
    and referral to essential services that address/remove barriers caused
    by poverty and bias. Our apprenticeship program is expanding to include
    a cybersecurity track for which we will seek Registered Apprenticeship
    designation. We employ a holistic and personalized approach to
    recruiting talent from underserved communities and building a nurturing
    community around them so that we can ensure that individuals have what
    they need to learn and thrive, including first and foremost, a sense of
    belonging. Their success then ignites and transforms the regional
    economies of the cities in which Bitwise Industries serves. Since
    launching in Fresno, we have built similar ecosystems in the California
    cities of Merced, Bakersfield, and Oakland, and recently announced our
    expansion into Toledo, OH. The next set of cities at the top of our
    expansion priority list includes Buffalo, NY and Birmingham, AL.
        As you consider measures that Congress can take to facilitate the
    growth of an inclusive and skilled cybersecurity workforce, we urge you
    to examine with a critical eye barriers to the employment of
    marginalized people who have been persistently underrepresented in
    critically important professions such as this. Careers in cybersecurity
    are not only essential to the future prosperity and safety of our
    Nation, but also hold promise as a means of securing economic stability
    for many. These are jobs with salaries that ripple throughout
    overlooked communities if they are available to the full range of
    people who are qualified for and desire them.
      underrepresentation in the cybersecurity and tech fields hurts the
                     quality and quantity of resulting work
        In 2021, evidence of the systemic underrepresentation and
    inequitable position of marginalized people in tech jobs requiring
    fluency in coding and networking exists anywhere one looks. According
    to Bureau of Labor Statistics data, as of 2020, just 9.1 percent of
    Americans employed in computer and mathematical occupations were Black,
    in a National workforce that is more than 12 percent Black. For Latinx
    workers just 8.4 percent are working in STEM fields, compared to 17.6
    of all workers. Moreover, Black and Latinx workers constituted smaller
    percentages of the information security workforce than of all workers,
    and women were particularly absent from the cybersecurity field,
    accounting for just 11.4 percent of its employees, but nearly 47
    percent of the entire workforce.
        The relative inclusion of Black and Latinx workers and members of
    other underrepresented groups has declined since the publication of a
    2017 report for the Center for Cyber Safety and Education, (ISC)\2\,
    and the International Consortium of Minority Cybersecurity
    Professionals (ICMCP). The report found that while minority
    representation in cybersecurity professions was roughly consistent with
    comparable representation in the National workforce, other indicators
    of inequity abounded. People of color in leadership roles tended to be
    more highly educated than their white non-Hispanic counterparts, for
    example, but employees of color were disproportionately concentrated in
    non-management positions. In addition, both men and women of color
    working in cybersecurity reported lower average salaries than white
    counterparts, and workers of color were less likely to have received
    salary increases during the most recent year than white workers.
        The effectiveness of our increasingly important efforts to secure
    information and operations that rely on connectivity are hindered by
    the disproportionate demographic characteristics of the cybersecurity
    workforce. As a recent paper from the Institute for Critical
    Infrastructure Technology observed, ``Security teams that bring
    diversity of thought and perspective to the decision-making process are
    best equipped to navigate [the] complex ecosystem of players,
    technologies, and cultures'' that must be taken into account in shaping
    cybersecurity solutions.
        Experiential studies have confirmed that characteristics including
    age, income, gender, ethnicity, and cultural affinity affect
    participants' perceptions of information security risks in consistent
    ways; similarly, in other work-oriented contexts, researchers have
    found that teams whose members come from different walks of life excel
    at innovation and problem-solving because they benefit from the
    inclusion of a wide range of viewpoints.
        The Nation's cybersecurity workforce would do its best possible
    work if it reflected our country's unique strength--the vast variety of
    cultures and experiences that shape us as individuals. Workplace
    leadership experts David Rock and Heidi Grant astutely pointed out in
    their Harvard Business Review article that collaboration across
    cultures ``challenge[s] your brain to overcome its stale ways of
    thinking and sharpen its performance.''
        Government also risks squandering an opportunity to advance equity
    in access to programming and resources by failing to take
    transformative action to ensure that talented people from underserved
    communities find their place in the tech industry and in the short-
    staffed cybersecurity field in particular. When only a homogenous group
    of people who have historically been able to enter a system are charged
    with shaping it for the future, the weaknesses of the system are
    virtually guaranteed to be replicated consciously or unconsciously.
    Thus, if the Federal Government hires only people with advanced degrees
    or other qualifications that are expensive to obtain to be its
    recruiters, build its presence on-line, and protect IT networks, their
    work will naturally serve the needs and interests of others like them,
    and will fail to democratize entry. It is unsurprising that it has
    proven to be a persistent challenge for an institution whose workforce
    largely consists of individuals who are not underserved to design
    programs to effectively reach, serve, and protect its most marginalized
    constituents, since, for example, people designing websites for the
    Emergency Broadband Benefit or rental payment assistance programs are
    likely not to have had any personal experience using these resources.
    It is imperative that the Federal Government enlist more people,
    companies, and communities, including contractors and consultants, that
    historically have been excluded and that have themselves experienced
    the challenges it seeks to address so it can develop technical
    solutions for all Americans.
            apprenticeships unleash previously untapped tech talent
        Since our inception in 2013, Bitwise Industries has been preparing
    underestimated people for success in tech careers by offering flexible
    short-term pre-apprenticeship programs, paid apprenticeships, and
    holistic support for the people in whom we invest. Our experience with
    the thousands of individuals who have entered our training programs
    over the past 8 years has affirmed our conviction that apprenticeships
    are a critical, and as-yet underutilized, pathway into the tech
    workforce for members of underrepresented communities with the
    requisite talent and commitment to thrive.
        Our apprenticeship model works for people who would not otherwise
    obtain the necessary knowledge and experience to enter this field
    because it eliminates the many practical and psychological barriers
    that reinforce systemic exclusion.
        Perhaps most important is the fact that our trainees don't need to
    take on any debt to advance their careers. Pre-apprentices who need
    financial assistance receive scholarships and are able to work jobs
    around class schedules, and our apprentices earn a living wage with
    benefits while they are learning and building portfolios of work on the
    job. For each one of these people, our staff coordinates complementary
    services--from child care, to transportation, to access to hardware and
    a broadband connection--that ensure that trainees have the time and
    mental energy to devote to developing their skills. We also value
    community and belonging, and we work hard to make sure that students
    and apprentices feel welcomed in our spaces and interact with peers
    with whom they identify when they come to a class or work team.
        Graduates of Bitwise Industries' apprenticeships do not necessarily
    have resumes that resemble those of a typical tech or cybersecurity
    work team, but they are capable and talented, and they bring the kind
    of diverse perspective to their work from which the Federal
    Government's cybersecurity efforts would greatly benefit. A typical
    student or apprentice in one of our programs has obtained a high school
    diploma or GED but has not earned any tertiary degree or professional
    certificate; many of our trainees have come to us from employment in
    restaurants, retail, manufacturing, and farming. These individuals have
    repeatedly and consistently proven that, with the right environment and
    support, they can obtain in-demand skills and thrive in information
    technology jobs. Nearly all of our apprenticeship graduates, and four-
    fifths of those who have taken classes with us, remain in tech-oriented
    jobs today, and by their third year on the job, these people have
    secured average salaries of $81,000 per year. Bitwise Industries' tech
    consulting business has hired many of those who've completed
    apprenticeships through our program, so we can attest from personal
    experience to the acumen of our trainees in designing and building
    solutions for a wide variety of clients in industries ranging from
    agriculture to entertainment to finance and banking.
        In addition to possessing requisite technical skill and
    collaborative ability, people who have trained for careers in
    information technology in Bitwise Industries' apprenticeships rather
    than through college-based academic programs are representative of the
    underestimated communities in that we serve, and comprised of people
    groups who have historically faced discrimination in the workplace and
    exclusion from the lucrative information technology field. We
    intentionally install our full ecosystem in cities whose populations
    are diverse in terms of race, ethnicity, national origin, educational
    attainment, involvement with the criminal justice system, family
    structure, and other circumstances, and we focus outreach and
    recruitment efforts in the most underserved and economically
    undervalued neighborhoods. As a result, about two-thirds of all of our
    students and apprentices have been people who identified as Black or
    Latinx. Women have easily outnumbered men in our classes and
    apprenticeship cohorts, and more than 40 percent of our people are
    LGBTQIA+ and non-binary. In addition, nearly half of our trainees have
    been undocumented individuals and people who are first-generation
    Americans, and many have belonged to groups recognized as encountering
    particular barriers to employment, such as people with criminal
    convictions.
      hiring standards and practices must evolve to achieve inclusion and
                  fill openings in the cybersecurity workforce
        As the capacity of Bitwise Industries' apprenticeship program
    expands and the success of our model inspires more providers to offer
    apprenticeship-style training for information technology fields, the
    pool of talent available to fill cybersecurity positions will grow and
    better reflect the full spectrum of Americans' characteristics and
    experiences. At the same time pathways into desirable jobs will need to
    adapt to recognize and take advantage of the ability that apprenticed
    workers possess.
        Too often, the prerequisites to access opportunities in Government
    employment are mired in obsolete tradition, and designed to exclude or
    to achieve ends that are at odds with equity.
        We urge Members of this subcommittee to push and mandate Federal
    hiring managers to reconsider credential and application requirements
    for cybersecurity and other tech jobs, and to eliminate or amend them
    wherever possible to open the door to a wider swath of the underserved
    population. For example, though degrees, certifications, and related
    job experience are typical barriers to entry into cybersecurity jobs,
    the Bureau of Labor Statistics has identified as the skills most
    critical to these roles attributes--problem-solving skills, ingenuity,
    attention to detail, and analytical skill in assessing computer systems
    and networks--that people can attain and develop just as well through
    practical training. Moreover, obtaining Federal Government employment
    usually demands not just that candidates have secured the requisite
    skill in the manner least accessible to marginalized individuals, but
    also that applicants possess the patience, networks, and background
    knowledge necessary to reconstruct their resumes and describe their
    experience in an idiosyncratic format. Instead of earning certificates
    and constructing narratives about their ability to do the work, Bitwise
    Industries' students and apprentices build portfolios of projects that
    showcase their work and allow prospective employers to see their
    skills. The Federal Government's human resources systems should allow
    for multiple methods of demonstrating technical ability to ensure that
    people of all backgrounds can, and actually do choose to, compete for
    employment.
        We note that President Biden's recent Executive Order on advancing
    diversity, equity, inclusion, and accessibility in the Federal
    Government instructs agencies to build pipelines into Government
    employment by deepening partnerships with colleges and universities
    that serve students of color and women. While these institutions are an
    important source of talent, their capacity is limited, and members of
    underserved communities continue to have less logistical and financial
    ability to pursue degrees than counterparts. To transform the face of
    the Federal workforce, the Government must look beyond its usual
    horizons and open jobs to--and direct recruitment efforts at--people
    like Bitwise Industries' students and apprentices, who have gained
    valuable knowledge and skills through nontraditional paths.
        Thank you for your consideration of this testimony and your
    commitment to leveraging American workers' ambition and creativity to
    strengthen safety on-line and protect against attacks on the electronic
    resources and services on which we rely.

                                     [all]