OPM, NICE work to define cybersecurity workforce problems

The Office of Personnel Management and those involved with the National Initiative for Cybersecurity Education say a shortage of talent and resource constraints are affecting agencies' cybersecurity workforce. OPM is currently trying to assess the size and severity of the problem.

"We have high unemployment, so we may be lulled into a false sense of security, in thinking that our workforce is OK," said Maureen Higgins, assistant director, agency support and technical assistance at OPM said while speaking during an August 11 panel hosted by the National Institute of Standards and Technology in Gaithersburg, Md.

"But we know that can turn around soon, so we really need to be thinking ahead," Higgins added.

Getting a feel for the number of federal, cybersecurity workers is difficult because it involves many different types of work, which are classified differently at each agency. An IT worker, an engineer and an acquisition manager could all be part of the cybersecurity workforce, but not every engineer is working exclusively on cybersecurity issues, explained Higgins.

OPM will soon launch a survey to assess the competencies of these workers in order to build models that will help OPM better guide agencies and identify areas of need in federal cybersecurity, Higgins said.

The lack of an occupational definition, with well-understood qualifications and requirements is one factor working against agencies trying to ramp-up cybersecurity workers. One frequently referenced labor code, DoD 8570, provides guidance for certification requirements for different jobs, but it primarily focuses on written exams, not practical exams.

"We're already working on revising 8570," said John Mills, OSD/NII special assistant for the National Cybersecurity Initiative. "We want to do something that reflects a workforce that is trained and qualified with actual capabilities and competencies and not just a rote exam."

One reason for the focus on practical exams is the growing confusion around professional certifications.

"There's a dilution of certifications going on. There are many entities cropping up that have new certifications," said panelist Patty Edfors, principal, Banrion Consulting. "And it gets to be one of these: ‘Which one do I choose?' And it all comes down to: ‘Which one will bring me the biggest salary?' So, the alignment of the resources and qualifications of the workforce are critical components."

Mills said that agencies in need of cybersecurity workers are being encouraged to transfer more IT skill from the contractor workforce to the government workforce. But, Mills added, agencies are also facing a hiring freeze, so he's not sure how that will be possible.

Higgins said OPM's investigation may lead to revised classification standards, new classification standards, legislative changes or policy changes.

Related Articles:
Cybersecurity panel: Federal CISOs must focus on worker training
NICE maps cybersecurity goals for federal agencies, general public
NIST drafts cybersecurity guidance
Mulvenon: U.S.-China relations will not weather cyberwarfare
OMB gives DHS new powers under revised FISMA guidance
Cybersecurity budget cuts could slow progress, says representative