What This Bill Does
This bill creates a test program called a Civilian Cybersecurity Reserve within the federal government's cybersecurity agency. The reserve would allow the agency to quickly hire people with cybersecurity skills during major computer system attacks or breaches that threaten national security, the economy, or public safety.
##
Who It Affects
- The Cybersecurity and Infrastructure Security Agency (the federal agency that handles computer security)
- People with cybersecurity expertise who previously worked for the federal government, military, federal contractors, or state and local governments
- Congress (which must be notified when reserve members are activated)
- The Department of Labor (which must create rules protecting reserve members' job rights)
##
Key Provisions
- The agency director can activate up to 30 reserve members at one time when a major cybersecurity incident occurs, hiring them as temporary workers for up to 6 months (Sec. 2(b)(4))
- Members must have previous work experience in the federal government, military, federal contracting, or state/local government and must have cybersecurity expertise (Sec. 2(c)(2))
- The agency must check all reserve members for conflicts of interest before and during their work (Sec. 2(c)(3))
- Congress must receive yearly briefings about how many people joined the reserve, whether it's working effectively, and any problems with recruiting or keeping members (Sec. 2(g)(1))
- The entire program ends 4 years after it starts, unless Congress votes to extend it (Sec. 2(i))
##
What Changes
If this bill becomes law, the cybersecurity agency gains the power to quickly hire experienced people from outside government during computer emergencies without going through normal hiring processes. Reserve members would become temporary federal employees with standard federal worker protections. Congress gets new oversight duties to monitor whether this program works well. The program only lasts 4 years as a test to see if the idea should become permanent.
##
Important Definitions
- **Significant incident**: A cyber attack or group of related attacks that causes or could cause clear harm to national security, foreign relations, the economy, public trust, civil freedoms, or public health and safety (Sec. 2(a)(6))
- **Temporary position**: A job lasting 6 months or less (Sec. 2(a)(7))
- **Competitive service**: Standard federal hiring where applicants compete for jobs (Sec. 2(a)(3))
- **Excepted service**: Federal hiring that doesn't require competitive processes (Sec. 2(a)(5))
##
Effective Date
Not specified in bill text
II
Calendar No. 204
118TH CONGRESS
1ST SESSION
S. 885
[Report No. 118–96]
To establish a Civilian Cybersecurity Reserve in the Department of Homeland
Security as a pilot project to address the cybersecurity needs of the
United States with respect to national security, and for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH 21, 2023
Ms. ROSEN (for herself and Mrs. BLACKBURN) introduced the following bill;
which was read twice and referred to the Committee on Homeland Secu-
rity and Governmental Affairs
SEPTEMBER 11, 2023
Reported by Mr. PETERS, with an amendment
[Strike out all after the enacting clause and insert the part printed in italic]
A BILL
To establish a Civilian Cybersecurity Reserve in the Depart-
ment of Homeland Security as a pilot project to address
the cybersecurity needs of the United States with respect
to national security, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
2
•S 885 RS
SECTION 1. SHORT TITLE.
1
This Act may be cited as the ‘‘Department of Home-
2
land Security Civilian Cybersecurity Reserve Act’’.
3
SEC.
2.
CIVILIAN
CYBERSECURITY
RESERVE
PILOT
4
PROJECT.
5
(a) DEFINITIONS.—In this section:
6
(1) AGENCY.—The term ‘‘Agency’’ means the
7
Cybersecurity and Infrastructure Security Agency.
8
(2)
APPROPRIATE
CONGRESSIONAL
COMMIT-
9
TEES.—The term ‘‘appropriate congressional com-
10
mittees’’ means—
11
(A) the Committee on Homeland Security
12
and Governmental Affairs of the Senate;
13
(B) the Committee on Appropriations of
14
the Senate;
15
(C) the Committee on Homeland Security
16
of the House of Representatives;
17
(D) the Committee on Oversight and Ac-
18
countability of the House of Representatives;
19
and
20
(E) the Committee on Appropriations of
21
the House of Representatives.
22
(3) COMPETITIVE SERVICE.—The term ‘‘com-
23
petitive service’’ has the meaning given the term in
24
section 2102 of title 5, United States Code.
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
3
•S 885 RS
(4) DIRECTOR.—The term ‘‘Director’’ means
1
the Director of the Agency.
2
(5) EXCEPTED SERVICE.—The term ‘‘excepted
3
service’’ has the meaning given the term in section
4
2103 of title 5, United States Code.
5
(6) SIGNIFICANT
INCIDENT.—The term ‘‘sig-
6
nificant incident’’—
7
(A) means an incident or a group of re-
8
lated incidents that results, or is likely to re-
9
sult, in demonstrable harm to—
10
(i) the national security interests, for-
11
eign relations, or economy of the United
12
States; or
13
(ii) the public confidence, civil lib-
14
erties, or public health and safety of the
15
people of the United States; and
16
(B) does not include an incident or a por-
17
tion of a group of related incidents that occurs
18
on—
19
(i) a national security system, as de-
20
fined in section 3552 of title 44, United
21
States Code; or
22
(ii) an information system described
23
in paragraph (2) or (3) of section 3553(e)
24
of title 44, United States Code.
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
4
•S 885 RS
(7) TEMPORARY
POSITION.—The term ‘‘tem-
1
porary position’’ means a position in the competitive
2
or excepted service for a period of 6 months or less.
3
(8) UNIFORMED
SERVICES.—The term ‘‘uni-
4
formed services’’ has the meaning given the term in
5
section 2101 of title 5, United States Code.
6
(b) PILOT PROJECT.—
7
(1) IN GENERAL.—The Director may carry out
8
a pilot project to establish a Civilian Cybersecurity
9
Reserve at the Agency.
10
(2) PURPOSE.—The purpose of a Civilian Cy-
11
bersecurity Reserve is to enable the Agency to effec-
12
tively respond to significant incidents.
13
(3) ALTERNATIVE METHODS.—Consistent with
14
section 4703 of title 5, United States Code, in car-
15
rying out a pilot project authorized under paragraph
16
(1), the Director may, without further authorization
17
from the Office of Personnel Management, provide
18
for alternative methods of—
19
(A)
establishing
qualifications
require-
20
ments for, recruitment of, and appointment to
21
positions; and
22
(B) classifying positions.
23
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
5
•S 885 RS
(4) APPOINTMENTS.—Under the pilot project
1
authorized under paragraph (1), upon occurrence of
2
a significant incident, the Director—
3
(A) may activate members of the Civilian
4
Cybersecurity Reserve by—
5
(i) noncompetitively appointing mem-
6
bers of the Civilian Cybersecurity Reserve
7
to temporary positions in the competitive
8
service; or
9
(ii) appointing members of the Civil-
10
ian Cybersecurity Reserve to temporary po-
11
sitions in the excepted service;
12
(B) shall notify Congress whenever a mem-
13
ber is activated under subparagraph (A); and
14
(C) may appoint not more than 30 mem-
15
bers
to
the
Civilian
Cybersecurity
Reserve
16
under subparagraph (A) at any time.
17
(5) STATUS AS EMPLOYEES.—An individual ap-
18
pointed under subsection (b)(4) shall be considered
19
a Federal civil service employee under section 2105
20
of title 5, United States Code.
21
(6) ADDITIONAL EMPLOYEES.—Individuals ap-
22
pointed under subsection (b)(4) shall be in addition
23
to any employees of the Agency who provide cyberse-
24
curity services.
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
6
•S 885 RS
(7)
EMPLOYMENT
PROTECTIONS.—The
Sec-
1
retary of Labor shall prescribe such regulations as
2
necessary to ensure the reemployment, continuation
3
of benefits, and non-discrimination in reemployment
4
of individuals appointed under subsection (b)(4),
5
provided that such regulations shall include, at a
6
minimum, those rights and obligations set forth
7
under chapter 43 of title 38, United States Code.
8
(8) STATUS IN RESERVE.—During the period
9
beginning on the date on which an individual is re-
10
cruited by the Agency to serve in the Civilian Cyber-
11
security Reserve and ending on the date on which
12
the individual is appointed under subsection (b)(4),
13
and during any period in between any such appoint-
14
ments, the individual shall not be considered a Fed-
15
eral employee.
16
(c) ELIGIBILITY; APPLICATION AND SELECTION.—
17
(1) IN GENERAL.—Under the pilot project au-
18
thorized under subsection (b), the Director shall es-
19
tablish criteria for—
20
(A) individuals to be eligible for the Civil-
21
ian Cybersecurity Reserve; and
22
(B) the application and selection processes
23
for the Civilian Cybersecurity Reserve.
24
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
7
•S 885 RS
(2) REQUIREMENTS
FOR
INDIVIDUALS.—The
1
criteria established under paragraph (1)(A) with re-
2
spect to an individual shall include—
3
(A) previous employment—
4
(i) by the executive branch;
5
(ii) within the uniformed services;
6
(iii) as a Federal contractor within
7
the executive branch; or
8
(iv) by a State, local, Tribal, or terri-
9
torial government;
10
(B) if the individual has previously served
11
as a member of the Civilian Cybersecurity Re-
12
serve of the Agency, that the previous appoint-
13
ment ended not less than 60 days before the in-
14
dividual may be appointed for a subsequent
15
temporary position in the Civilian Cybersecurity
16
Reserve of the Agency; and
17
(C) cybersecurity expertise.
18
(3) PRESCREENING.—The Agency shall—
19
(A) conduct a prescreening of each indi-
20
vidual prior to appointment under subsection
21
(b)(4) for any topic or product that would cre-
22
ate a conflict of interest; and
23
(B)
require
each
individual
appointed
24
under subsection (b)(4) to notify the Agency if
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
8
•S 885 RS
a potential conflict of interest arises during the
1
appointment.
2
(4)
AGREEMENT
REQUIRED.—An
individual
3
may become a member of the Civilian Cybersecurity
4
Reserve only if the individual enters into an agree-
5
ment with the Director to become such a member,
6
which shall set forth the rights and obligations of
7
the individual and the Agency.
8
(5) EXCEPTION
FOR
CONTINUING
MILITARY
9
SERVICE COMMITMENTS.—A member of the Selected
10
Reserve under section 10143 of title 10, United
11
States Code, may not be a member of the Civilian
12
Cybersecurity Reserve.
13
(6) PRIORITY.—In appointing individuals to the
14
Civilian Cybersecurity Reserve, the Agency shall
15
prioritize the appointment of individuals described in
16
clause (i) or (ii) of paragraph (2)(A) before consid-
17
ering individuals described in clause (iii) or (iv) of
18
paragraph (2)(A).
19
(7) PROHIBITION.—Any individual who is an
20
employee of the executive branch may not be re-
21
cruited or appointed to serve in the Civilian Cyberse-
22
curity Reserve.
23
(d) SECURITY CLEARANCES.—
24
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
9
•S 885 RS
(1) IN GENERAL.—The Director shall ensure
1
that all members of the Civilian Cybersecurity Re-
2
serve undergo the appropriate personnel vetting and
3
adjudication commensurate with the duties of the
4
position, including a determination of eligibility for
5
access to classified information where a security
6
clearance is necessary, according to applicable policy
7
and authorities.
8
(2) COST OF SPONSORING CLEARANCES.—If a
9
member of the Civilian Cybersecurity Reserve re-
10
quires a security clearance in order to carry out
11
their duties, the Agency shall be responsible for the
12
cost of sponsoring the security clearance of a mem-
13
ber of the Civilian Cybersecurity Reserve.
14
(e) STUDY AND IMPLEMENTATION PLAN.—
15
(1) STUDY.—Not later than 60 days after the
16
date of enactment of this Act, the Agency shall
17
begin a study on the design and implementation of
18
the pilot project authorized under subsection (b)(1)
19
at the Agency, including—
20
(A) compensation and benefits for mem-
21
bers of the Civilian Cybersecurity Reserve;
22
(B) activities that members may undertake
23
as part of their duties;
24
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
10
•S 885 RS
(C) methods for identifying and recruiting
1
members, including alternatives to traditional
2
qualifications requirements;
3
(D) methods for preventing conflicts of in-
4
terest or other ethical concerns as a result of
5
participation in the pilot project and details of
6
mitigation efforts to address any conflict of in-
7
terest concerns;
8
(E) resources, including additional fund-
9
ing, needed to carry out the pilot project;
10
(F) possible penalties for individuals who
11
do not respond to activation when called, in ac-
12
cordance with the rights and procedures set
13
forth under title 5, Code of Federal Regula-
14
tions; and
15
(G) processes and requirements for train-
16
ing and onboarding members.
17
(2) IMPLEMENTATION PLAN.—Not later than 1
18
year after beginning the study required under para-
19
graph (1), the Agency shall—
20
(A) submit to the appropriate congres-
21
sional committees an implementation plan for
22
the pilot project authorized under subsection
23
(b)(1); and
24
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
11
•S 885 RS
(B) provide to the appropriate congres-
1
sional committees a briefing on the implementa-
2
tion plan.
3
(3) PROHIBITION.—The Agency may not take
4
any action to begin implementation of the pilot
5
project authorized under subsection (b)(1) until the
6
Agency fulfills the requirements under paragraph
7
(2).
8
(f) PROJECT GUIDANCE.—Not later than 2 years
9
after the date of enactment of this Act, the Director shall,
10
in consultation with the Office of Personnel Management
11
and the Office of Government Ethics, issue guidance es-
12
tablishing and implementing the pilot project authorized
13
under subsection (b)(1) at the Agency.
14
(g) BRIEFINGS AND REPORT.—
15
(1) BRIEFINGS.—Not later than 1 year after
16
the date on which the Director issues the guidance
17
required under subsection (f), and every year there-
18
after, the Agency shall provide to the appropriate
19
congressional committees a briefing on activities car-
20
ried out under the pilot project of the Agency, in-
21
cluding—
22
(A) participation in the Civilian Cybersecu-
23
rity Reserve, including the number of partici-
24
pants, the diversity of participants, and any
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
12
•S 885 RS
barriers to recruitment or retention of mem-
1
bers;
2
(B) an evaluation of the ethical require-
3
ments of the pilot project;
4
(C) whether the Civilian Cybersecurity Re-
5
serve has been effective in providing additional
6
capacity to the Agency during significant inci-
7
dents; and
8
(D) an evaluation of the eligibility require-
9
ments for the pilot project.
10
(2) REPORT.—Not earlier than 6 months and
11
not later than 3 months before the date on which
12
the pilot project of the Agency terminates under
13
subsection (i), the Agency shall submit to the appro-
14
priate congressional committees a report and provide
15
a briefing on recommendations relating to the pilot
16
project, including recommendations for—
17
(A) whether the pilot project should be
18
modified, extended in duration, or established
19
as a permanent program, and if so, an appro-
20
priate scope for the program;
21
(B) how to attract participants, ensure a
22
diversity of participants, and address any bar-
23
riers to recruitment or retention of members of
24
the Civilian Cybersecurity Reserve;
25
VerDate Sep 11 2014
23:42 Sep 11, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6401
E:\BILLS\S885.RS
S885
pbinns on DSKJLVW7X2PROD with $$_JOB
13
•S 885 RS
(C) the ethical requirements of the pilot
1
project and the effectiveness of mitigation ef-
2
forts to address any conflict of interest con-
3
cerns; and
4
(D) an evaluation of the eligibilit
[Text truncated for display. Full text available on Congress.gov.]