Building the Cybersecurity Workforce America Needs

As the world becomes increasingly digital, cybersecurity poses one of the most urgent challenges of the 21st century. We need robust cybersecurity protections in place to safeguard public and private sector networks, data, and critical infrastructure such as electric grids, health care networks, and financial institutions. Our national security and economic stability depend on our ability to keep our systems safe from those who wish us harm.

Recent cyberattacks during the past two years—the Russian hacking of U.S. government agency systems via tainted SolarWinds software, the Colonial Pipeline ransomware attack, and the breach of the Microsoft Exchange Server software by China’s main intelligence service—highlight the significant vulnerability of the nation’s critical infrastructure and computer systems underpinning the American economy and society.

There are many actions needed to meet today’s cybersecurity challenges. Some include technical solutions, like designing software and systems to be more resistant to cyberattacks or applying artificial intelligence capabilities to detect and protect our assets. Others involve educating our industries and citizens about basic cyber hygiene.

But almost none are more important than having a highly skilled cybersecurity workforce that can protect the public and private sector systems that our lives and economy depend on. Yet it is estimated that half a million cybersecurity positions across the public and private sectors remain unfilled, and that gap is only expected to grow. To compound these shortages, public and private sector cybersecurity needs are constantly changing as technology and practices evolve.

Developing an effective cyber workforce requires a comprehensive and strategic national approach—a large and integrated multi-sector effort to clearly identify issues, validate possible solutions, scale efforts, manage costs and consistently evaluate impact. This effort also requires flexibility as circumstances change in a dynamic environment.

To move this effort forward, Congress directed the Department of Homeland Security to engage the National Academy of Public Administration to review its strategies and programs related to building a national cybersecurity workforce.

As the co-chairs of the panel of Academy fellows assembled to guide this review, we determined that an effective assessment of DHS’ Cybersecurity and Infrastructure Security Agency cybersecurity workforce strategy and programs would entail looking more broadly at federal government efforts to help develop the nation’s cybersecurity workforce. Our final report to CISA includes a number of important findings, with recommendations to address them.

The Panel found that the government has made good progress on individual programs, including foundational strategic and operational work led by the National Initiative on Cybersecurity Education at the National Institute of Standards and Technology. Beyond these efforts, no government-wide strategy for developing a national cybersecurity workforce exists to set priorities and focus attention and resources.

A lack of coordination has created the potential for unnecessary duplication and lost opportunities for leverage and integration across agencies. Moreover, lack of clarity about federal agency roles and responsibilities has hindered the federal government’s ability to tap the capabilities and resources in the private sector, academia and other levels of government. 

The panel believes the recent establishment of the Office of the National Cyber Director in the White House presents an important opportunity to create a governmentwide strategy for developing the national cybersecurity workforce. ONCD should lead efforts to build that strategy in consultation with CISA; NIST; the National Security Agency, which operates the National Centers of Academic Excellence in Cybersecurity program; the National Science Foundation, which operates the CyberCorps Scholarship for Service program; and leaders of other relevant federal agencies and programs.

That strategy should build on existing strategic planning priorities and include four key elements, with actions to achieve results: encouraging more people to choose a career in the cybersecurity field through outreach and education; enabling education and training to build needed competencies and alternative pathways to cybersecurity careers; overcoming barriers to recruiting talent and matching people to jobs; and assessing performance and promoting innovation in workforce development practice.

Developing and implementing a national strategy will depend on close collaboration across government and in partnership with industry and academia. For example, ONCD can establish a high-level governance structure with key federal agencies, while Congress can clarify ONCD authorities to include budget, assessment of how well programs perform and how best to scale or adjust investments.

The panel found that CISA has generally done well in planning, designing and executing its cybersecurity national workforce development programs, given the constraints of time, authorities and resources. In addition, in order for CISA to fulfill its legislated role in national workforce development, it should be given authorities to partner effectively with educational and training institutions and the staff needed to manage programs at scale.

Cybersecurity touches every aspect of life. Building the national cybersecurity workforce that America needs is a complex and daunting task, one that can be achieved with a focused and coordinated strategy at the highest levels of government. The Panel report represents an urgent call to action for leaders—there is no time to lose.

Daniel Chenok is executive director of the IBM Center for the Business of Government and former chief of the Information Policy and Technology Branch at the U.S. Office of Management and Budget. Karen Evans is managing director of the Cyber Readiness Institute and former chief information officer at the U.S. Department of Homeland Security. They are both fellows of the National Academy of Public Administration.