DoD Releases Cyber Workforce Strategy

The Department of Defense (DoD) Office of the Chief Information Officer (CIO) issued a new plan to address its cyber workforce shortfall, with guidance for how to target growth in personnel from both military and civilian populations. The Cyber Workforce Strategy targets four areas: identification, recruitment, development and retention.

Overall, the strategy aims to unify and direct the DoD’s cyber workforce management and tackle the department’s cyber workforce 25% vacancy rate, explained Mark Gorak, principal director, Resources and Analysis, and Patrick Johnson, director, Workforce Innovation Directorate; both at the DoD Office of the CIO.

The officials spoke to reporters during a March 9 media call and added that a related implementation plan to execute the cyber workforce strategy would follow soon.

“What we have been doing over the last several years is not keeping up with the pace of our current demand,” Gorak said. “In keeping with the President’s vision of the future of cybersecurity, DoD will do its part in the United States to build a digital ecosystem that is more easily and inherently defensible, resilient and aligned with the nation's values.”

Presently, the military has 225,000 people in its cyber workforce. “The scale of the workforce is larger than almost half of all other federal agencies combined,” Gorak noted. However, they aim to grow the field to bring in nontraditional cyber workers. “The cyber domain is a multifaceted domain and requires all skill sets including things like, psychologists, lawyers, acquisition specialists, linguists and many more,” he said.

The department will conduct “consistent capability assessment and analysis processes,” to identify and better manage its cyber personnel needs. “[We aim to] establish an enterprisewide talent management program to better align force capabilities with current and future requirements,” the strategy said.

While the military side of the cyber workforce is not necessarily having issues in recruiting­—the issue there is retention, the principal director noted—the DoD will especially target recruitment efforts to the civilian population.

As such, the CIO’s office is developing assessment tools as a way to gauge civilians’ cyber skills, Johnson shared. He emphasized that the goal was to provide an effective way for cyber civilians to enter the DoD workforce, “removing the paper barriers,” or certain degree or policy requirements. While a college education is “critical to many things that we are going to do at the DoD, with that ability to think creatively and problem solve,” the DoD will not be following a “one-size-fits-all” policy in pulling in cyber workers. They will tap into high schools and apprenticeships with industry, for example, to find different pools of workers.

Johnson also emphasized that the shortfall would not be solved just by “hiring to hire.” Instead, the DoD will position itself to build a cyber workforce ecosystem and “cultivate the workforce we need.”

“I think one of the major things is that all of us, we exist on the East Coast of the United States, and so our recruiting efforts have to move west of the Mississippi,” said Gen. Paul Nakasone, USA, commander, U.S. Cyber Command, and director, National Security Agency, in a recent interview with SIGNAL Media. “We have to go to states that traditionally have not been rich grounds for us to recruit from, and so as we look at that, it's not only the fact that we look at Centers of Academic Excellence that the National Security Agency maintains. That's also our academic engagement network, and over 100 universities that U.S. Cyber Command has partnered with. That's an important piece. And we're only as good as the supply that we have for the future so, we also have a vested interest with the National Science Foundation to build the K-12 population, get people interested in science, technology, engineering, mathematics, Girls that Code, these things that are allowing us to think differently about a workforce for the future."

As part of the recently released 8140 policy guide, the DoD has also taken steps to revamp its occupational service codes to identify more fields such as artificial intelligence and data to be part of the greater cyber workforce.

The officials also clarified that earlier programs, such as the Cyber Accepted Service initiative from 2017, did bring cyber warriors in to the services, but was a specific allowance from Congress to add more Cyber Mission Forces directly. It was never meant as a wide-scale effort, and did not address the civilian workforce gap.

In addition, they said the strategy will dovetail with other federal policies that address cyber workforce shortfalls, such as the National Cyber Strategy, recently released by the National Cyber Director.

“We are tied in directly with the working group at the Office of the National Cyber Director, with subject matter experts set up to define what we are doing on this side and share lessons learned,” said Gorak. "It was surprising how much of that strategy is trying to address similar problems that we're addressing. And so, we are working very closely to not only just aligned to it, but how can our strategy further support and integrate with the national strategy.”