GAO on Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements

Feb 06

***

Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify its critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department’s and the nation’s federal networks and critical infrastructure from cyber threats. The commitment of DHS’s leadership to addressing these matters is essential to helping the department fulfill the act’s requirements.

***

Recommendations for Executive Action

We are making the following six recommendations to DHS:

The Secretary of Homeland Security should develop procedures on how to identify and code vacant cybersecurity positions. (Recommendation 1)
The Secretary of Homeland Security should identify the individual in each component who is responsible for leading that component’s efforts in identifying and coding cybersecurity positions. (Recommendation 2)
The Secretary of Homeland Security should establish and implement a process to periodically review each component’s procedures for identifying component cybersecurity positions and maintaining accurate coding. (Recommendation 3)
The Secretary of Homeland Security should ensure OCHCO collects complete and accurate data from its components on all filled and vacant cybersecurity positions when it conducts its cybersecurity identification and coding efforts. (Recommendation 4)
The Secretary of Homeland Security should develop guidance to assist DHS components in identifying their cybersecurity work categories and specialty areas of critical need that align to the NICE framework. (Recommendation 5)
The Secretary of Homeland Security should develop plans with time frames to identify priority actions to report on specialty areas of critical need. (Recommendation 6)

Read Complete GAO report GAO-18-175