How to entice more students studying cybersecurity to work in government.
Many federal officials are worried about closing the government’s large and growing cybersecurity talent gap—as well they should be. The good news is that a simple legislative fix could open up many more opportunities for top cyber students to eventually join the ranks of the federal civil service. Just give every federal agency the same cybersecurity scholarship authority that the Defense Department has today and then get out of their way.
It would require just a few changes to the wording of DOD’s authority, and there’s no better time to do it than now, as the fiscal 2023 National Defense Authorization Act makes its way through Congress.
Here’s what Title 10 of the U.S. Code says now:
To encourage the recruitment and retention of Department of Defense personnel who have the computer and network security skills necessary to meet the cybersecurity requirements of the Department of Defense, the Secretary of Defense may carry out programs in accordance with this chapter to provide financial support for education in disciplines relevant to those requirements at institutions of higher education [including funding for] Scholarships for pursuit of programs of education in cybersecurity disciplines at institutions of higher education.
All Congress needs to do is copy and paste this provision from Title 10 to Title 5 of the U.S. Code, strike “Department of Defense” and “Secretary of Defense” in a few places and replace it with language such as “any agency in the U.S. government” and “agency head.” This would make the provision applicable to all agencies. Everything else could remain as is, with the exercise of the authority subject to each agency’s own separate appropriations, and all other provisions—such as eligibility criteria, scholarship amounts and payback periods—still in effect.
Why Another Program?
Knowledgeable readers might ask why we should create another cybersecurity scholarship program for non-DOD agencies when the National Science Foundation already has one. The NSF Scholarship for Service program has been around for a couple of decades. That program has been effective, more or less, and while it remains limited in terms of numbers, the motives of those in the NSF who administer the program are as laudable today as they were when it was conceived. So why another one, especially one that could compete with the NSF program?
The answer is it would provide an opportunity to change the approach to scholarships. Both the NSF and DOD programs have very similar scholarship eligibility requirements. For example, a scholarship winner in either program must be a U.S. citizen and eligible for a security clearance. More importantly, both the DOD and NSF programs include a post-scholarship commitment to serve in a position with a U.S. government agency. In the case of a DOD scholarship, the posting must be with one of the department’s many subcomponents; with NSF, any agency will do. However, therein lies the biggest difference—and biggest flaw—in the NSF program.
Under NSF’s approach, federal hiring managers and personnel professionals aren’t involved in the selection of scholarship winners. Instead, the college or university—typically in the form of cybersecurity faculty members or committees—selects the scholarship winners. In many circumstances, those winners are not even introduced to the people or agencies that could end up hiring them until the students are in their final semester of school.
Individual colleges can fund summer internships with a local federal agency or sponsor local professional development activities that will expose scholarship students to the federal government’s missions. But that’s not the same as having an agency involved in their selection up front, as is required by the DOD program.
The NSF program is built by and for academics and their students. While that is exactly what one would expect from the NSF, it doesn’t take into account the real world of government’s cybersecurity missions, or more importantly, its hiring practices. This is especially true at a time when the federal government’s private sector competition can win any dollar-for-dollar contest for cyber talent.
Start the Clock Early
Separating scholarship and hiring decisions is problematic, since many government agencies centrally hire cybersecurity professionals, especially at the entry level. Their recruiters are not likely to even meet with NSF scholarship students until they’re in the final stages of their academic program. The separation is compounded by further post-graduation delays in getting those same students a secret or higher security clearance with a federal agency.
So, it’s no wonder that many of those NSF scholarship winners struggle to get a federal cyber job. Or worse, get recruited by a private sector company willing to pay off their post-graduation service commitment.
By starting the clock early, the DOD program also ensures that the scholarship student can complete one or more internships with the hiring agency, so the latter can get the measure of the student’s technical skills, work ethic and fit with the organization. And by providing an internship opportunity while a scholarship winner is still a student, DOD can sponsor that student for a Secret—or even higher—security clearance months in advance of graduation.
When I was chief human capital officer for the U.S. Intelligence Community, we convinced the DoD general counsel that similar scholarships—in that case, for students who’d been awarded funding to study a critical foreign language under the National Security Education Program—gave the department the authority to sponsor those scholarship students for security clearances while they were still students. This dramatically reduced the amount of post-graduation time those students spent awaiting a clearance. A similar principle would apply to cybersecurity scholarship winners.
All Congress needs to do to set this process in motion is amend the defense authorization bill to make DOD’s scholarship authority applicable to all federal agencies. This simple legislative fix could have a big impact on closing the government’s cyber talent gap.
Ron Sanders is the former staff director at the Florida Center for Cybersecurity at the University of South Florida and a fellow of the National Academy of Public Administration. He also served as the chair of the Federal Salary Council, associate director of national intelligence for human capital, associate director for strategic human capital policy at the Office of Personnel Management, chief human resources officer at the Internal Revenue Service, director of civilian personnel at DoD, and a vice president and fellow at Booz Allen Hamilton.
Source: https://www.nextgov.com/cybersecurity/2022/08/one-simple-fix-could-help-close-federal-cyber-talent-gap/375273/
