Civilian Cybersecurity Reserve Act

117TH CONGRESS 2D SESSION S. 1324 AN ACT To establish a Civilian Cyber Security Reserve as a pilot project to address the cyber security needs of the United States with respect to national security, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 2 † S 1324 ES SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Civilian Cybersecurity 2 Reserve Act’’. 3 SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 4 PROJECT. 5 (a) DEFINITIONS.—In this section: 6 (1) AGENCY.—The term ‘‘Agency’’ means the 7 Cybersecurity and Infrastructure Security Agency. 8 (2) APPROPRIATE CONGRESSIONAL COMMIT- 9 TEES.—The term ‘‘appropriate congressional com- 10 mittees’’ means— 11 (A) the Committee on Homeland Security 12 and Governmental Affairs of the Senate; 13 (B) the Committee on Appropriations of 14 the Senate; 15 (C) the Committee on Homeland Security 16 of the House of Representatives; 17 (D) the Committee on Oversight and Re- 18 form of the House of Representatives; and 19 (E) the Committee on Appropriations of 20 the House of Representatives. 21 (3) COMPETITIVE SERVICE.—The term ‘‘com- 22 petitive service’’ has the meaning given the term in 23 section 2102 of title 5, United States Code. 24 (4) DIRECTOR.—The term ‘‘Director’’ means 25 the Director of the Agency. 26 3 † S 1324 ES (5) EXCEPTED SERVICE.—The term ‘‘excepted 1 service’’ has the meaning given the term in section 2 2103 of title 5, United States Code. 3 (6) SIGNIFICANT INCIDENT.—The term ‘‘sig- 4 nificant incident’’— 5 (A) means an incident or a group of re- 6 lated incidents that results, or is likely to re- 7 sult, in demonstrable harm to— 8 (i) the national security interests, for- 9 eign relations, or economy of the United 10 States; or 11 (ii) the public confidence, civil lib- 12 erties, or public health and safety of the 13 people of the United States; and 14 (B) does not include an incident or a por- 15 tion of a group of related incidents that occurs 16 on— 17 (i) a national security system, as de- 18 fined in section 3552 of title 44, United 19 States Code; or 20 (ii) an information system described 21 in paragraph (2) or (3) of section 3553(e) 22 of title 44, United States Code. 23 4 † S 1324 ES (7) TEMPORARY POSITION.—The term ‘‘tem- 1 porary position’’ means a position in the competitive 2 or excepted service for a period of 6 months or less. 3 (8) UNIFORMED SERVICES.—The term ‘‘uni- 4 formed services’’ has the meaning given the term in 5 section 2101 of title 5, United States Code. 6 (b) PILOT PROJECT.— 7 (1) IN GENERAL.—The Director may carry out 8 a pilot project to establish a Civilian Cybersecurity 9 Reserve at the Agency. 10 (2) PURPOSE.—The purpose of a Civilian Cy- 11 bersecurity Reserve is to enable the Agency to effec- 12 tively respond to significant incidents. 13 (3) ALTERNATIVE METHODS.—Consistent with 14 section 4703 of title 5, United States Code, in car- 15 rying out a pilot project authorized under paragraph 16 (1), the Director may, without further authorization 17 from the Office of Personnel Management, provide 18 for alternative methods of— 19 (A) establishing qualifications require- 20 ments for, recruitment of, and appointment to 21 positions; and 22 (B) classifying positions. 23 5 † S 1324 ES (4) APPOINTMENTS.—Under the pilot project 1 authorized under paragraph (1), upon occurrence of 2 a significant incident, the Director— 3 (A) may activate members of the Civilian 4 Cybersecurity Reserve by— 5 (i) noncompetitively appointing mem- 6 bers of the Civilian Cybersecurity Reserve 7 to temporary positions in the competitive 8 service; or 9 (ii) appointing members of the Civil- 10 ian Cybersecurity Reserve to temporary po- 11 sitions in the excepted service; 12 (B) shall notify Congress whenever a mem- 13 ber is activated under subparagraph (A); and 14 (C) may appoint not more than 30 mem- 15 bers to the Civilian Cybersecurity Reserve 16 under subparagraph (A) at any time. 17 (5) STATUS AS EMPLOYEES.—An individual ap- 18 pointed under subsection (b)(4) shall be considered 19 a Federal civil service employee under section 2105 20 of title 5, United States Code. 21 (6) ADDITIONAL EMPLOYEES.—Individuals ap- 22 pointed under subsection (b)(4) shall be in addition 23 to any employees of the Agency who provide cyberse- 24 curity services. 25 6 † S 1324 ES (7) EMPLOYMENT PROTECTIONS.—The Sec- 1 retary of Labor shall prescribe such regulations as 2 necessary to ensure the reemployment, continuation 3 of benefits, and non-discrimination in reemployment 4 of individuals appointed under subsection (b)(4), 5 provided that such regulations shall include, at a 6 minimum, those rights and obligations set forth 7 under chapter 43 of title 38, United States Code. 8 (8) STATUS IN RESERVE.—During the period 9 beginning on the date on which an individual is re- 10 cruited by the Agency to serve in the Civilian Cyber- 11 security Reserve and ending on the date on which 12 the individual is appointed under subsection (b)(4), 13 and during any period in between any such appoint- 14 ments, the individual shall not be considered a Fed- 15 eral employee. 16 (c) ELIGIBILITY; APPLICATION AND SELECTION.— 17 (1) IN GENERAL.—Under the pilot project au- 18 thorized under subsection (b), the Director shall es- 19 tablish criteria for— 20 (A) individuals to be eligible for the Civil- 21 ian Cybersecurity Reserve; and 22 (B) the application and selection processes 23 for the Civilian Cybersecurity Reserve. 24 7 † S 1324 ES (2) REQUIREMENTS FOR INDIVIDUALS.—The 1 criteria established under paragraph (1)(A) with re- 2 spect to an individual shall include— 3 (A) previous employment— 4 (i) by the executive branch; 5 (ii) within the uniformed services; 6 (iii) as a Federal contractor within 7 the executive branch; or 8 (iv) by a State, local, Tribal, or terri- 9 torial government; 10 (B) if the individual has previously served 11 as a member of the Civilian Cybersecurity Re- 12 serve of the Agency, that the previous appoint- 13 ment ended not less than 60 days before the in- 14 dividual may be appointed for a subsequent 15 temporary position in the Civilian Cybersecurity 16 Reserve of the Agency; and 17 (C) cybersecurity expertise. 18 (3) PRESCREENING.—The Agency shall— 19 (A) conduct a prescreening of each indi- 20 vidual prior to appointment under subsection 21 (b)(4) for any topic or product that would cre- 22 ate a conflict of interest; and 23 (B) require each individual appointed 24 under subsection (b)(4) to notify the Agency if 25 8 † S 1324 ES a potential conflict of interest arises during the 1 appointment. 2 (4) AGREEMENT REQUIRED.—An individual 3 may become a member of the Civilian Cybersecurity 4 Reserve only if the individual enters into an agree- 5 ment with the Director to become such a member, 6 which shall set forth the rights and obligations of 7 the individual and the Agency. 8 (5) EXCEPTION FOR CONTINUING MILITARY 9 SERVICE COMMITMENTS.—A member of the Selected 10 Reserve under section 10143 of title 10, United 11 States Code, may not be a member of the Civilian 12 Cybersecurity Reserve. 13 (6) PRIORITY.—In appointing individuals to the 14 Civilian Cybersecurity Reserve, the Agency shall 15 prioritize the appointment of individuals described in 16 clause (i) or (ii) of paragraph (2)(A) before consid- 17 ering individuals described in clause (iii) or (iv) of 18 paragraph (2)(A). 19 (7) PROHIBITION.—Any individual who is an 20 employee of the executive branch may not be re- 21 cruited or appointed to serve in the Civilian Cyberse- 22 curity Reserve. 23 (d) SECURITY CLEARANCES.— 24 9 † S 1324 ES (1) IN GENERAL.—The Director shall ensure 1 that all members of the Civilian Cybersecurity Re- 2 serve undergo the appropriate personnel vetting and 3 adjudication commensurate with the duties of the 4 position, including a determination of eligibility for 5 access to classified information where a security 6 clearance is necessary, according to applicable policy 7 and authorities. 8 (2) COST OF SPONSORING CLEARANCES.—If a 9 member of the Civilian Cybersecurity Reserve re- 10 quires a security clearance in order to carry out 11 their duties, the Agency shall be responsible for the 12 cost of sponsoring the security clearance of a mem- 13 ber of the Civilian Cybersecurity Reserve. 14 (e) STUDY AND IMPLEMENTATION PLAN.— 15 (1) STUDY.—Not later than 60 days after the 16 date of enactment of this Act, the Agency shall 17 begin a study on the design and implementation of 18 the pilot project authorized under subsection (b)(1) 19 at the Agency, including— 20 (A) compensation and benefits for mem- 21 bers of the Civilian Cybersecurity Reserve; 22 (B) activities that members may undertake 23 as part of their duties; 24 10 † S 1324 ES (C) methods for identifying and recruiting 1 members, including alternatives to traditional 2 qualifications requirements; 3 (D) methods for preventing conflicts of in- 4 terest or other ethical concerns as a result of 5 participation in the pilot project and details of 6 mitigation efforts to address any conflict of in- 7 terest concerns; 8 (E) resources, including additional fund- 9 ing, needed to carry out the pilot project; 10 (F) possible penalties for individuals who 11 do not respond to activation when called, in ac- 12 cordance with the rights and procedures set 13 forth under title 5, Code of Federal Regula- 14 tions; and 15 (G) processes and requirements for train- 16 ing and onboarding members. 17 (2) IMPLEMENTATION PLAN.—Not later than 1 18 year after beginning the study required under para- 19 graph (1), the Agency shall— 20 (A) submit to the appropriate congres- 21 sional committees an implementation plan for 22 the pilot project authorized under subsection 23 (b)(1); and 24 11 † S 1324 ES (B) provide to the appropriate congres- 1 sional committees a briefing on the implementa- 2 tion plan. 3 (3) PROHIBITION.—The Agency may not take 4 any action to begin implementation of the pilot 5 project authorized under subsection (b)(1) until the 6 Agency fulfills the requirements under paragraph 7 (2). 8 (f) PROJECT GUIDANCE.—Not later than 2 years 9 after the date of enactment of this Act, the Director shall, 10 in consultation with the Office of Personnel Management 11 and the Office of Government Ethics, issue guidance es- 12 tablishing and implementing the pilot project authorized 13 under subsection (b)(1) at the Agency. 14 (g) BRIEFINGS AND REPORT.— 15 (1) BRIEFINGS.—Not later than 1 year after 16 the date of enactment of this Act, and every year 17 thereafter, the Agency shall provide to the appro- 18 priate congressional committees a briefing on activi- 19 ties carried out under the pilot project of the Agen- 20 cy, including— 21 (A) participation in the Civilian Cybersecu- 22 rity Reserve, including the number of partici- 23 pants, the diversity of participants, and any 24 12 † S 1324 ES barriers to recruitment or retention of mem- 1 bers; 2 (B) an evaluation of the ethical require- 3 ments of the pilot project; 4 (C) whether the Civilian Cybersecurity Re- 5 serve has been effective in providing additional 6 capacity to the Agency during significant inci- 7 dents; and 8 (D) an evaluation of the eligibility require- 9 ments for the pilot project. 10 (2) REPORT.—Not earlier than 6 months and 11 not later than 3 months before the date on which 12 the pilot project of the Agency terminates under 13 subsection (i), the Agency shall submit to the appro- 14 priate congressional committees a report and provide 15 a briefing on recommendations relating to the pilot 16 project, including recommendations for— 17 (A) whether the pilot project should be 18 modified, extended in duration, or established 19 as a permanent program, and if so, an appro- 20 priate scope for the program; 21 (B) how to attract participants, ensure a 22 diversity of participants, and address any bar- 23 riers to recruitment or retention of members of 24 the Civilian Cybersecurity Reserve; 25 13 † S 1324 ES (C) the ethical requirements of the pilot 1 project and the effectiveness of mitigation ef- 2 forts to address any conflict of interest con- 3 cerns; and 4 (D) an evaluation of the eligibility require- 5 ments for the pilot project. 6 (h) EVALUATION.—Not later than 3 years after the 7 pilot project authorized under subsection (b) is established 8 in the Agency, the Comptroller General of the United 9 States shall— 10 (1) conduct a study evaluating the pilot project 11 at the Agency; and 12 (2) submit to Congress— 13 (A) a report on the results of the study; 14 and 15 (B) a recommendation with respect to 16 whether the pilot project should be modified, 17 extended in duration, or established as a per- 18 manent program. 19 (i) SUNSET.—The pilot project authorized under this 20 section shall terminate on the date that is 4 years after 21 the date on which the pilot project is established. 22 (j) NO ADDITIONAL FUNDS.— 23 14 † S 1324 ES (1) IN GENERAL.—No additional funds are au- 1 thorized to be appropriated for the purpose of car- 2 rying out this Act. 3 (2) EXISTING AUTHORIZED AMOUNTS.—Funds 4 to carry out this Act may, as provided in advance in 5 appropriations Acts, only come from amounts au- 6 thorized to be appropriated to the Agency. 7 Passed the Senate December 20, 2022. Attest: Secretary. 117TH CONGRESS 2D SESSION S. 1324 AN ACT To establish a Civilian Cyber Security Reserve as a pilot project to address the cyber security needs of the United States with respect to national se- curity, and for other purposes.