What This Bill Does
This bill requires the Secretary of the Army to run a pilot project that creates a Civilian Cybersecurity Reserve. This reserve would allow the Army to bring in civilian workers with cybersecurity skills to help the United States Cyber Command (a military organization focused on cyberspace operations) protect military computer systems and respond to cyber attacks.
##
Who It Affects
- The Secretary of the Army
- The United States Cyber Command
- Civilians with cybersecurity expertise who want to join the reserve
- Congress (must receive briefings and reports)
- The Secretary of Labor
- The Office of Personnel Management
- The Office of Government Ethics
##
Key Provisions
- The Secretary of the Army may hire up to 50 members of the Civilian Cybersecurity Reserve at any time to work temporary positions lasting 180 days or less. (Sec. 2(b)(4))
- Congress must be notified whenever a reserve member is activated for a position. (Sec. 2(b)(4))
- All reserve members must undergo security vetting appropriate to their job duties and may need security clearances. The Army pays for these clearances. (Sec. 2(d))
- Reserve members must have cybersecurity expertise and cannot be current federal government employees. (Sec. 2(c))
- The pilot project ends four years after it begins. (Sec. 2(i))
- The Secretary of the Army must issue guidance for the program within two years and provide yearly briefings to Congress about how the program is working. (Sec. 2(f) and 2(g))
##
What Changes
If this becomes law, the Army can create a reserve pool of civilian cybersecurity workers who can be called in temporarily to support military cyber operations. These workers will be treated as federal civil service employees during their temporary appointments and will receive employment protections similar to military reservists. The program will run as a test for four years before automatically ending.
##
Important Definitions
- **Competitive service**: A federal job classification defined by existing law (5 U.S. Code section 2102)
- **Excepted service**: Another federal job classification defined by existing law (5 U.S. Code section 2103)
- **Temporary position**: A job lasting 180 days or less
- **Appropriate congressional committees**: The Senate and House committees on Armed Services and Homeland Security
- **Malicious cyber activity**: Not explicitly defined in bill text
##
Effective Date
Not specified in bill text
II
118TH CONGRESS
1ST SESSION
S. 903
To require the Secretary of the Army to carry out a pilot project to establish
a Civilian Cybersecurity Reserve, and for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH 21, 2023
Ms. ROSEN (for herself and Mrs. BLACKBURN) introduced the following bill;
which was read twice and referred to the Committee on Armed Services
A BILL
To require the Secretary of the Army to carry out a pilot
project to establish a Civilian Cybersecurity Reserve, and
for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Department of Defense
4
Civilian Cybersecurity Reserve Act’’.
5
SEC.
2.
CIVILIAN
CYBERSECURITY
RESERVE
PILOT
6
PROJECT.
7
(a) DEFINITIONS.—In this Act:
8
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
2
•S 903 IS
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
1
TEES.—The term ‘‘appropriate congressional com-
2
mittees’’ means—
3
(A) the Committee on Homeland Security
4
and Governmental Affairs of the Senate;
5
(B) the Committee on Armed Services of
6
the Senate;
7
(C) the Committee on Homeland Security
8
of the House of Representatives; and
9
(D) the Committee on Armed Services of
10
the House of Representatives.
11
(2) COMPETITIVE SERVICE.—The term ‘‘com-
12
petitive service’’ has the meaning given the term in
13
section 2102 of title 5, United States Code.
14
(3) EXCEPTED SERVICE.—The term ‘‘excepted
15
service’’ has the meaning given the term in section
16
2103 of title 5, United States Code.
17
(4) TEMPORARY
POSITION.—The term ‘‘tem-
18
porary position’’ means a position in the competitive
19
or excepted service for a period of 180 days or less.
20
(b) PILOT PROJECT.—
21
(1) IN GENERAL.—The Secretary of the Army
22
shall carry out a pilot project to establish a Civilian
23
Cybersecurity Reserve.
24
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
3
•S 903 IS
(2) PURPOSE.—The purpose of the Civilian Cy-
1
bersecurity Reserve is to enable the Army to provide
2
manpower to the United States Cyber Command to
3
effectively—
4
(A) preempt, defeat, deter, or respond to
5
malicious cyber activity;
6
(B) conduct cyberspace operations;
7
(C) secure information and systems of the
8
Department of Defense against malicious cyber
9
activity; and
10
(D) assist in solving cyber workforce-re-
11
lated challenges.
12
(3) ALTERNATIVE METHODS.—Consistent with
13
section 4703 of title 5, United States Code, in car-
14
rying out the pilot project required under paragraph
15
(1), the Secretary may, without further authoriza-
16
tion from the Office of Personnel Management, pro-
17
vide for alternative methods of—
18
(A) establishing qualifications require-
19
ments for, recruitment of, and appointment to
20
positions; and
21
(B) classifying positions.
22
(4) APPOINTMENTS.—Under the pilot project
23
required under paragraph (1), in order to fulfill the
24
purpose under paragraph (2), the Secretary—
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
4
•S 903 IS
(A) may activate members of the Civilian
1
Cybersecurity Reserve by—
2
(i) noncompetitively appointing mem-
3
bers of the Civilian Cybersecurity Reserve
4
to temporary positions in the competitive
5
service; or
6
(ii) appointing members of the Civil-
7
ian Cybersecurity Reserve to temporary po-
8
sitions in the excepted service;
9
(B) shall notify Congress whenever a mem-
10
ber is activated under subparagraph (A); and
11
(C) may appoint not more than 50 mem-
12
bers to the Civilian Cybersecurity Reserve
13
under subparagraph (A) at any time.
14
(5) STATUS AS EMPLOYEES.—An individual ap-
15
pointed under paragraph (4) shall be considered a
16
Federal civil service employee under section 2105 of
17
title 5, United States Code.
18
(6) ADDITIONAL EMPLOYEES.—Individuals ap-
19
pointed under paragraph (4) shall be in addition to
20
any employees of the United States Cyber Command
21
who provide cybersecurity services.
22
(7) EMPLOYMENT
PROTECTIONS.—The Sec-
23
retary of Labor shall prescribe such regulations as
24
necessary to ensure the reemployment, continuation
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
5
•S 903 IS
of benefits, and non-discrimination in reemployment
1
of individuals appointed under paragraph (4), pro-
2
vided that such regulations shall include, at a min-
3
imum, those rights and obligations set forth under
4
chapter 43 of title 38, United States Code.
5
(8) STATUS IN RESERVE.—During the period
6
beginning on the date on which an individual is re-
7
cruited to serve in the Civilian Cybersecurity Reserve
8
and ending on the date on which the individual is
9
appointed under paragraph (4), and during any pe-
10
riod in between any such appointments, the indi-
11
vidual shall not be considered a Federal employee.
12
(c) ELIGIBILITY; APPLICATION AND SELECTION.—
13
(1) IN GENERAL.—Under the pilot project re-
14
quired under subsection (b)(1), the Secretary of the
15
Army shall establish criteria for—
16
(A) individuals to be eligible for the Civil-
17
ian Cybersecurity Reserve; and
18
(B) the application and selection processes
19
for the Civilian Cybersecurity Reserve.
20
(2) REQUIREMENTS
FOR
INDIVIDUALS.—The
21
criteria established under paragraph (1)(A) with re-
22
spect to an individual shall include—
23
(A) if the individual has previously served
24
as a member of the Civilian Cybersecurity Re-
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
6
•S 903 IS
serve, that the previous appointment ended not
1
less than 60 days before the individual may be
2
appointed for a subsequent temporary position
3
in the Civilian Cybersecurity Reserve; and
4
(B) cybersecurity expertise.
5
(3) PRESCREENING.—The Secretary shall—
6
(A) conduct a prescreening of each indi-
7
vidual prior to appointment under subsection
8
(b)(4) for any topic or product that would cre-
9
ate a conflict of interest; and
10
(B) require each individual appointed
11
under subsection (b)(4) to notify the Secretary
12
if a potential conflict of interest arises during
13
the appointment.
14
(4) AGREEMENT
REQUIRED.—An individual
15
may become a member of the Civilian Cybersecurity
16
Reserve only if the individual enters into an agree-
17
ment with the Secretary to become such a member,
18
which shall set forth the rights and obligations of
19
the individual and the Army.
20
(5) EXCEPTION
FOR
CONTINUING
MILITARY
21
SERVICE COMMITMENTS.—A member of the Selected
22
Reserve under section 10143 of title 10, United
23
States Code, may not be a member of the Civilian
24
Cybersecurity Reserve.
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
7
•S 903 IS
(6) PROHIBITION.—Any individual who is an
1
employee of the executive branch may not be re-
2
cruited or appointed to serve in the Civilian Cyberse-
3
curity Reserve.
4
(d) SECURITY CLEARANCES.—
5
(1) IN GENERAL.—The Secretary of the Army
6
shall ensure that all members of the Civilian Cyber-
7
security Reserve undergo the appropriate personnel
8
vetting and adjudication commensurate with the du-
9
ties of the position, including a determination of eli-
10
gibility for access to classified information where a
11
security clearance is necessary, according to applica-
12
ble policy and authorities.
13
(2) COST OF SPONSORING CLEARANCES.—If a
14
member of the Civilian Cybersecurity Reserve re-
15
quires a security clearance in order to carry out the
16
duties of the member, the Army shall be responsible
17
for the cost of sponsoring the security clearance of
18
the member.
19
(e) IMPLEMENTATION PLAN.—
20
(1) IN
GENERAL.—Not later than 180 days
21
after the date on which the Secretary of Defense
22
submits to the Committee on Armed Services of the
23
Senate and the Committee on Armed Services of the
24
House of Representatives the report required under
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
8
•S 903 IS
section 1540(d)(2) of the James M. Inhofe National
1
Defense Authorization Act for Fiscal Year 2023
2
(Public Law 117–263) on the feasibility and advis-
3
ability of creating and maintaining a civilian cyber-
4
security reserve corps, the Secretary of the Army
5
shall—
6
(A) submit to the appropriate congres-
7
sional committees an implementation plan for
8
the pilot project required under subsection
9
(b)(1); and
10
(B) provide to the appropriate congres-
11
sional committees a briefing on the implementa-
12
tion plan.
13
(2) PROHIBITION.—The Secretary of the Army
14
may not take any action to begin implementation of
15
the pilot project required under subsection (b)(1)
16
until the Secretary fulfills the requirements under
17
paragraph (1).
18
(f) PROJECT GUIDANCE.—Not later than two years
19
after the date of the enactment of this Act, the Secretary
20
of the Army shall, in consultation with the Office of Per-
21
sonnel Management and the Office of Government Ethics,
22
issue guidance establishing and implementing the pilot
23
project required under subsection (b)(1).
24
(g) BRIEFINGS AND REPORT.—
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
9
•S 903 IS
(1) BRIEFINGS.—Not later than one year after
1
the date on which the guidance required under sub-
2
section (f) is issued, and every year thereafter until
3
the date on which the pilot project required under
4
subsection (b)(1) terminates under subsection (i),
5
the Secretary of the Army shall provide to the ap-
6
propriate congressional committees a briefing on ac-
7
tivities carried out under the pilot project, includ-
8
ing—
9
(A) participation in the Civilian Cybersecu-
10
rity Reserve, including the number of partici-
11
pants, the diversity of participants, and any
12
barriers to recruitment or retention of mem-
13
bers;
14
(B) an evaluation of the ethical require-
15
ments of the pilot project;
16
(C) whether the Civilian Cybersecurity Re-
17
serve has been effective in providing additional
18
capacity to the Army; and
19
(D) an evaluation of the eligibility require-
20
ments for the pilot project.
21
(2) REPORT.—Not earlier than 180 days and
22
not later than 90 days before the date on which the
23
pilot project required under subsection (b)(1) termi-
24
nates under subsection (i), the Secretary shall sub-
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
10
•S 903 IS
mit to the appropriate congressional committees a
1
report and provide a briefing on recommendations
2
relating to the pilot project, including recommenda-
3
tions for—
4
(A) whether the pilot project should be
5
modified, extended in duration, or established
6
as a permanent program, and if so, an appro-
7
priate scope for the program;
8
(B) how to attract participants, ensure a
9
diversity of participants, and address any bar-
10
riers to recruitment or retention of members of
11
the Civilian Cybersecurity Reserve;
12
(C) the ethical requirements of the pilot
13
project and the effectiveness of mitigation ef-
14
forts to address any conflict of interest con-
15
cerns; and
16
(D) an evaluation of the eligibility require-
17
ments for the pilot project.
18
(h) EVALUATION.—Not later than three years after
19
the pilot project required under subsection (b)(1) is estab-
20
lished, the Comptroller General of the United States
21
shall—
22
(1) conduct a study evaluating the pilot project;
23
and
24
(2) submit to Congress—
25
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS
11
•S 903 IS
(A) a report on the results of the study;
1
and
2
(B) a recommendation with respect to
3
whether the pilot project should be modified.
4
(i) SUNSET.—The pilot project required under sub-
5
section (b)(1) shall terminate on the date that is four
6
years after the date on which the pilot project is estab-
7
lished.
8
(j) NO ADDITIONAL FUNDS.—
9
(1) IN GENERAL.—No additional funds are au-
10
thorized to be appropriated for the purpose of car-
11
rying out this Act.
12
(2) EXISTING AUTHORIZED AMOUNTS.—Funds
13
to carry out this Act may, as provided in advance in
14
appropriations Acts, only come from amounts au-
15
thorized to be appropriated to the Army.
16
Æ
VerDate Sep 11 2014
01:00 Mar 31, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\S903.IS
S903
kjohnson on DSK79L0C42PROD with BILLS