The Government Accountability Office has called on the Office of the National Cyber Director to take urgent steps to improve the quality, completeness and evaluation of federal cyber workforce data, citing significant gaps in information on both the size and cost of civilian and contractor personnel performing IT, cybersecurity and cyber-related functions.
According to a GAO report released Thursday, most of the 23 federal civilian departments and agencies reviewed could not fully identify their cyber workforce or its total costs. Agencies reported at least 63,934 federal employees and 4,151 contractor staff in cyber roles at a combined annual cost of about $14.6 billion, but GAO said the figures were incomplete and unreliable.
The watchdog found that 22 agencies reported partial or no contractor data, 19 lacked documented quality assurance processes and 17 did not have standardized procedures for identifying cyber employees. GAO warned that without high-quality data, the government cannot ensure informed workforce decisions, noting that such data becomes especially critical during administration transitions when incoming leaders need to assess cyber readiness.
GAO Found Agencies Lacking Effectiveness Assessments
GAO also determined that while 22 agencies reported using various initiatives to strengthen their cyber workforce through hiring, reskilling, training and retention, most did not assess the effectiveness of those measures. Nine agencies evaluated certain aspects of costs, benefits and performance, and five used assessments to expand some programs, but the majority cited a lack of visibility into data needed to support such reviews.
The report noted that the ONCD’s 2023 National Cyber Workforce and Education Strategy does not require agencies to evaluate such initiatives, limiting the ability of ONCD and agencies to prioritize those with the highest return on investment.
GAO Recommendations
GAO made four recommendations for ONCD, to be implemented in coordination with the Office of Management and Budget and other relevant entities. The ONCD is encouraged to:
- Address gaps in cyber workforce size and cost data used by agency-level chief information officers and chief human capital officers.
- Address the lack of documented quality assurance processes in cyber workforce data.
- Address variances in identifying cyber personnel in workforce data.
- Direct agencies to assess the effectiveness of cyber workforce initiatives using costs, benefits, performance and other relevant metrics.
ONCD neither agreed nor disagreed with the recommendations.
GAO’s review builds on previous work in which it made 64 recommendations since 2019 to improve cyber workforce management, 32 of which remain unimplemented.
