The Pentagon on Thursday rolled out a new plan to build and develop its IT and cyber workforce — an employee population that spans across at least 150,000 military and civilian positions, but as of now, suffers from a 25% vacancy rate.

The new cyber workforce strategy extends to 2027, but officials emphasized it would continually evolve between now and then. It lays out at least some initial details on what the Defense Department thinks it needs to do to overcome four separate challenges the strategy’s authors identified: DoD components don’t have consistent criteria to identify their cyber workforce requirements, they need better ways to identify candidates who can fill those roles, they don’t have enough tools to assess current employees’ abilities, and attrition is high among the most highly-skilled portions of the workforce.

Patrick Johnson, the director of the DoD CIO’s Workforce Innovation Directorate, said the department’s path forward will emphasize an enterprise-wide talent management approach for the entirety of its cyber workforce.

“There has to be a cultural shift in the department in how we acquire talent and how we manage it,” he told reporters Thursday. “We do a very good job on the military side, but on the civilian side, we have to fundamentally change how we manage that talent and look at it from an enterprise. The foundation for that is being able to identify that workforce.”

On the identification front, one of the main tools DoD plans to use is its existing cyber workforce framework, which tries to classify employees according to the actual work they do, rather than by their job title or occupational series. Officials said the framework previously identified 54 separate work roles, but the count is now up to 72 after the recent incorporation of personnel who focus on AI, data and software-related work.

“The framework is adaptive, flexible and responsive to the workforce,” said Mark Gorak, the DoD CIO’s principal director for resources and analysis “So not only did we add those work roles, and those knowledge, skills, abilities, but we have also changed several of the ones we had to remain current. So with that framework, we have to have specific targets, and to clearly show where we have shortages. We’re also working with the Office of the National Cyber Director and their plans for how they’re doing this for the rest of the federal government.”

When it comes to recruiting, officials say most of their challenges are in the civilian portions of the workforce. In the uniformed workforce, the military services recruit talent based on aptitude and train servicemembers themselves — there, the challenge is mainly around retention.

But the civilian workforce, which makes up about a third of the total cyber workforce, faces problems with both recruiting and retention. Congress attempted to ease the civilian hiring problem in 2016, when it authorized DoD to implement the Cyber Excepted Service, a separate pay and personnel system gives the department more flexible hiring authorities and lets it pay more market-based salaries for cyber personnel.

But more than five years after its initial implementation, only 9,500 positions have been converted to the new system. That number is expected to grow to about 15,000 in the final phase of implementation once the Army adds its positions to the excepted service.

“What we’ve discovered with a lot of these things is there’s no one solution to this — it’s a multifaceted problem,” Johnson said. “Cyber Excepted Service was targeted primarily at our cyber mission force, and it has been reasonably effective at getting after that force. But to scale that, we would have to go back to Congress and say that we need to move it out to cover a wider swath of the workforce.”

The strategy strongly suggests that DoD does intend to ask Congress to expand its alternative hiring and pay authorities, but officials say they’re looking at other ways to solve the recruitment problem.

For example, the department plans to pilot a new apprenticeship program that would create standing procedures to exchange cyber talent with the private sector, and changing the ways it assesses cyber aptitude and qualifications for civilian positions.

“It’s removing what I call the paper barrier,” Johnson said. “A college education is critical to many of the things we’re going to do, but it’s not one size fits all. We want to look at opportunities to train the workforce. And similar to the way we do things on the military side of the house, how can we increase our throughput and capture someone’s interest early in the career? In an ideal world, we would be able to tap them on the shoulder right out of high school … From a policy perspective, we’ve already said we’ll take training, we’ll take certifications on the commercial side, we’ll take military training, we’ll factor in experience, and we will also use education. So we’re not limiting ourselves — we’re opening the aperture. You cannot continue to shop at the same store the same way. So if you’re not getting what you want, and expect something to change, you have to start looking elsewhere. And that’s what we’re doing.”

Officials said most of the details surrounding how they’ll implement the new strategy will be filled out in a forthcoming implementation plan that the department will release “soon.” But they said much of the implementation work will surround continuously gathering data, and using it to improve recruitment, retention and development of the cyber workforce.

“That will allow us to go back to the services and components and say, ‘This is what we’re tasking, and here are the metrics we’re going to use to measure that. And that that is critical,’” Johnson said. “Traditionally, on the civilian side of the house, we do not set a goal for retention or recruiting, but we can measure the success of our efforts in real time. So if we start offering a hiring or retention incentive and it’s not working, I should know within a quarter that I’m not moving the dial — and maybe the juice is not worth the squeeze. We’ll use the metrics to drive what we’re doing, and in areas that we’re not getting success, then it’s time to shift and try something that does work. That’s the teeth to get after this.”

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.