Progress and Opportunity in DoD’s Cyber Workforce Development Efforts.

Introduction

Since the release of the 2018 DoD Cyber Strategy, the Department of Defense has made a concerted effort to guide and grow the current professional and future cyber workforce. In March 2023, the Department released the Cyber Workforce (CWF) Strategy 2023-2027 [1] and its subsequent Implementation Plan [2] in August 2023. The CWF Strategy, like the 2023 DoD Cyber Strategy [3], is grounded in real-world experience and refined understanding of the of modern dynamics in cyberspace operations. This strategy establishes a unified direction for the advancement of DoD cyber workforce management and, as the cyber domain continues to expand, the inclusion of emerging technologies.  

The Department has also been developing and implementing the DoD Cyber Workforce Framework (DCWF) intending to describe the work performed by the full spectrum of the cyber workforce as defined in DoD Directive (DoDD) 8140.01 – personnel who build, secure, operate, defend, and protect DoD and U.S. cyberspace resources, enable future operations, and project power in cyberspace. 

In the FY2024 National Defense Authorization Act (NDAA) [4], the Department was directed to stand up a Central Program Office for Academic Engagement, leading to better coordination and reporting between academic outreach programs while continuing to optimize features of current and future efforts bolstering the talent pipeline. In this article we summarize the CWF and DCWF, the expected benefits of the Central Program Office, and highlight DoD opportunities to recruit, retain, educate, train, and certify cyber professionals. 

Cyber Workforce Strategy 2023-2027 

Needing a unified direction for cyber workforce management, the 2023-2027 Cyber Workforce (CWF) Strategy serves as a roadmap for how the cyber workforce will grow and adapt as a safeguard for our Nation’s security. The CWF Strategy, offers many avenues to enable the Department to remain ahead of workforce trends using standardized workforce analysis tools and processes, championing the use of cyber workforce related authorities in novel, non-traditional ways, and establishing strategic relationships that grow, diversify, and strengthen the cyber workforce. 

The strategy utilizes four human capital pillars— Identification, Recruitment, Development and Retention—to identify and group cyber workforce challenges. The four pillars also serve as the catalyst for targeted workforce goals, which aid the Department in unifying efforts to achieve the mission and vision of this strategy. The four workforce goals, identified in Figure 1 are: Goal 1: Execute consistent capability assessment and analysis processes to stay ahead of force needs. Goal 2: Establish an enterprise-wide talent management program to better align force capabilities with current and future requirements. Goal 3: Facilitate a cultural shift to optimize Department-wide personnel management activities. Goal 4: Foster collaboration and partnerships to enhance capability development, operational effectiveness, and career broadening experiences.

The human capital pillars were chosen to form a structure that unifies efforts to overcome these Department-wide challenges:

• The lack of common criteria regarding cyber workforce requirements (Identification).

• The need for targeted identification of candidates based upon skills to fill capability gaps (Recruitment).

• The limited availability of capability assessment and enhancement programs (Development).

• An attrition of highly skilled and experienced personnel within an already limited pipeline of talent (Retention).

Cyber Workforce Strategy Implementation Plan 2023-2027 

Each of the CWF Strategy goals are supported by several objectives. The question was, how to ensure that the strategy’s talent identification, recruitment, development, retention, and management objectives were actioned for success? The CWF Strategy Implementation Plan 2023-2027 was developed and released. By 2027, this implementation plan will have set the foundation for how the Department will successfully execute the 22 objectives and 38 initiatives aligned with the 4 overarching strategic goals. The implementation plan is strategically designed to be agile, flexible, and responsive, empowering the Department to effectively adapt and fulfill mission requirements within an ever-changing cyber domain.

DoD Cyber Workforce Framework (DCWF) [5]

The DCWF facilitates uniform identification, tracking, and reporting required by the Federal Cybersecurity Workforce Assessment Act (FCWAA) of 2015 [6]. It is used to develop qualification requirements for cyber work roles that are outlined in DoD Manual 8140. Similarly, the DCWF can support multiple other DoD-wide workforce management and planning activities. For example, the framework can facilitate supply and demand analyses, develop targeted recruitment and retention strategies, develop horizontal and vertical career paths, and standardize the development of civilian position descriptions. As such, the DCWF serves as an important building block for a capable and ready cyber workforce.

Cyberspace Role Qualifications and Management 

In February 2023, DoD issued Directive 8140-03 Cyberspace Workforce Qualification and Management Program. This directive implements policy, assigns responsibilities, and prescribes procedures for the qualification of personnel identified as members of the DCWF. Each cyberspace work role is associated with a qualification matrix. The qualification matrix identifies relevant options available to achieve qualification as described in this section and illustrated in Figure 2. Sample Work Role Qualification Matrix.

DoD Central Program Office for Academic Engagement 

The primary purposes of a cyber academic outreach central program office are to coordinate and harmonize cyber outreach activities across the DoD and to create pipelines for students from grades K-12 through post-secondary education to employment in the Department. DoD’s academic engagements extend to dedicated school-based STEM enrichment initiatives, mentoring, and participation in cyber competitions to increase awareness of Federal opportunities and inspire students to pursue service. The Department is in a unique position to assist educators and community leaders in introducing STEM and cyber topics early in students’ education, and work with educators to nurture interested students from elementary through secondary education levels and on to post-secondary education in STEM and cyber fields of study.

It was in Section 1531 of the FY24 NDAA that the Department’s Chief Information Officer (CIO) was directed to establish an office to maintain and oversee activities pertinent to the relationship between the Department and academia. This scope would include primary, secondary, and post-secondary institutions with cyber-related curriculums. This direction came on the heels of the FY22 NDAA’s requirement under Section 1532, to conduct a feasibility study assessing the potential benefit of such an endeavor, most specifically, to what extent improvements in the coherence, coordination, and management of covered, academic engagements could be expected. Members of the DoD CIO’s Workforce Innovation Directorate set out contacting representatives from more than 100 academic institutions designated as National Centers of Academic Excellence in Cybersecurity (NCAE-C). Component stakeholders involved in STEM and cyber activities were also interviewed. Understanding stakeholder perspective was critical. The consensus was favorable citing cyber as a national priority. Furthermore, as a component of STEM, outreach should include grades K-12 with curriculum lessons to spur student interest at the primary and secondary levels and inform curriculum at the college level.

In the end, the Department confirmed the need for a CPO to serve as the primary element for supporting and synchronizing cyber academic engagements and outreach activities across DoD. Planning is underway for consolidating the many scholarship and academic engagement programs currently spread across the Department. Some may be familiar, including the DoD Cyber Scholarship Program, the NCAE-C programs, and the National Security Agency’s K-12 Pathways program. Other academic engagement channels will further consolidate funding and resources under the auspices of the CPO.  

Upon hitting full operating capability, the CPO for Academic Engagement will be harmonizing Department cyber outreach activities, measuring the effectiveness of academic engagements, and offering academic institutions, recommendations to bolster the partnership through cyber research grants and other mechanisms for improving the cyber talent pipeline. It is anticipated the CPO will reach initial operating capability later in FY24.  

Recruitment and retention of cyber talent is critical for the Department to develop a sizeable STEM and digital workforce, essential to retain its competitive edge in cyber operations, research, emerging technologies, and applications. Implementing a suite of academic outreach initiatives that would result in connective pipelines requires a central program office staff with digital technical expertise, deep understanding of the Department’s STEM and cyber activities, resources, and reach sufficient to share and implement best practices.

DoD Education, Training, and Certification Opportunities for Cyber Professionals and Students

The remainder of this article lists some of the DoD’s cyber workforce exchange, education, development programs that are recommended to be aligned with the new central program office.

DoD Cyber and Information Technology Exchange Program (CITEP) 

The DoD CITEP authorizes the temporary exchange of DoD civilian employees (GS-11 and above) with private sector employees working in cybersecurity or information technology (IT). These exchanges allow participants to improve technical skills and competencies through structured experiences. The DoD CITEP provides a unique opportunity for DoD Components and private sector organizations to share leading practices, gain understanding for cross-sector IT operations and challenges and expose employees to different systems and processes [7]. 

DoD Cyber Workforce Rotational Program (CWRP)

The DoD CWRP pilot is solely dedicated to cyber-focused rotational assignments across DoD organizations for DoD civilian employees (GS-11 to GS-15, or equivalent) aligned to DCWF work roles. Since the pilot launched, CWRP’s scope has expanded to provide cyber-focused rotational opportunities across the federal government by leveraging the Federal Rotational Cyber Workforce Program’s authority [8].

The National Centers for Academic Excellence in Cybersecurity 

Launched in 1999, the National Centers for Academic Excellence in Cybersecurity (NCAE-C) Program Management Office is recognized for its long-standing DoD partnerships with academic institutions seeking to be designated as a Center of Cyber Defense, Cyber Research, or Cyber Operations. There are currently over 400 academic institutes that are part of the NCAE-C program and have earned at least one of the three designations.  The NCAE-C aims to create and manage a collaborative cybersecurity educational program that establishes standards for cybersecurity curriculum and academic excellence, includes competency development among students and faculty, and values community outreach and leadership in professional development. 

The NCAE-C program currently is managed by the National Security Agency’s (NSA) National Cryptologic School, with Federal partners including the DoD CIO, Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Institute of Standards and Technology (NIST)/National Initiative on Cybersecurity Education (NICE), the National Science Foundation (NSF), and U.S. Cyber Command (USCYBERCOM) [9]. 

The intent is to transfer the NCAE-C program into the new program of record. This new and strong collaborative partnership between the CPO and the NCAE-C will be a catalyst for enhancing existing or building new capabilities that lead to an organized set of resources that can be leveraged to nurture and support an interested student on his or her journey from K-12, to college, and to employment in the DoD and the Federal Government. The changes offer the opportunity to grow the NCAE-C program office into an interagency staff. Federal Government departments and agencies wishing to officially partner would be expected to contribute to staffing and funding under the auspices of a memorandum of understanding. This will relieve the pressure on DoD resources to support the program. 

Cyber Service Academy (CSA) 

The DoD Cyber Service Academy,  formerly the DoD Cyber Scholarship Program (CySP), is a scholarship program and grants arbiter for the DoD [10]. Moreover, and collectively, the CSA functions as the nation’s premiere capacity building tool by providing advanced educational opportunities to DoD cyber workforce professionals. The program emerged from Congress’s commitment to leverage higher education to train and develop the DoD cyber workforce in confronting threats against the Department’s critical information systems and networks.

• Recruitment Scholarships (Non-DoD Employees): As a recruitment tool, CSA sponsors non-DoD or non-government employed students who are either enrolled, or applying, to universities designated as National Centers of Academic Excellence in Cybersecurity (NCAE-Cs). Following graduation, scholarship recipients are eligible for full-time employment within various DoD components and agencies. Recipients agree to incur a DoD service commitment proportional to the years of scholarship support received.

• Retention Scholarships (DoD employees, civilian, and military): As a retention tool, CSA supports DoD civilians and military personnel pursuing Master’s or Doctoral degrees in cyber-related fields. Traditionally, these students attend a DoD institution designated as a Center of Academic Excellence (CAE). However, in certain cases, students may finish their graduate degree at a partnering university. For DoD civilian and military personnel, the service commitment proceeding graduation is determined by their sponsoring component or agency.

• Capacity Building Grants: These grants are awarded in tandem with scholarships and strengthen a university’s capacity for cyber-related research and education. The DoD CIO has established two focus areas for institutions proposing cyber-related projects:

  • DoD Partnerships: Promote cyberspace awareness to students and DoD partners by providing hands-on, real-world, opportunities that bolster existing DoD programs and projects.

  • Outreach to Technical Colleges, Community Colleges, and/or Minority Serving Institutions: Expand the pool of qualified potential candidates by building strong relationships with these organizations, supporting their cyber programs, and promoting cyber disciplines on their campuses. 

Senior Military College Cyber Institutes 

Section 1640 of the NDAA FY19 (Public Law 115-232) authorized the six Senior Miliary Colleges (SMCs) to create an integrated DoD Cyber Institute [11] in October 2020 to develop a pipeline of military and civilian cyber talent for crucial cyber work roles in the DoD.  The DoD CIO is the primary office of responsibility for the SMCs and will provide funding for the Cyber Institute.  The SMCs are further supported by partnerships with NSA, U.S.  Cyber Command, the NCAE-C, and OUSD(R&E).  In FY 2020, an NSA grant allowed the SMCs to begin implementing their strategic plan to:

• Grow and enhance staff and cyber expertise at each SMC,

• Create initiatives to educate and develop students in cyber skills that meet government-identified gaps,

• Sustain the cadet leadership program,

• Foster internships and apprenticeships at DoD organizations, and

• Establish governance process that includes Cyber Institute assessments and reporting.  

Virtual Institutes for Cyber and Electromagnetic Spectrum Research and Employ (VICEROY)

Section 1640 of the NDAA FY19 also authorized the Secretary of Defense to establish an expanded Cyber Institutes program at other institutions of higher learning, to accelerate and focus the development of foundational expertise in critical cyber operational skills for future military and civilian leaders of the Armed Forces and the DoD, including such leaders of the reserve components. This initiative known as Virtual Institutes for Cyber and Electromagnetic Spectrum Research and Employ (VICEROY) is currently governed by OUSD(R&E).  The intent is to transfer VICEROY into the new program of record. 

VICEROY’s approach is to establish Virtual Institutes (VI), which are faculty-led, multi-institution, multi-year research endeavors specifically targeting cyber/electromagnetic spectrum operations (EMSO) challenges. Each VI is required to have at least one NCAE-C institution in its membership. Rather than build entirely new academic, scholarship, and competition programs, VICEROY VIs largely leverage and align existing programs (Figure 3) to deliver a pipeline of mission-focused cyber-spectrum leaders more effectively.

The program's primary goal is to ignite early student interest in tackling complex problems relevant to the DoD and National Security by accomplishing the following: 

• Develop an enhanced K-12 pipeline through Junior Reserve Officer Training Corps (JROTC), dual high-school/college enrollment programs, and summer camps designed to recognize and retain promising STEM talent.

• Develop new or augment existing cyber coursework tailored to DoD-specific challenges, supported by high-impact, hands-on, experiential learning opportunities and research projects.

• Provide student scholarships and stipends to incentivize participation and enhance mobility.

• Inspire first-year students through paid Summer Experiential Internship at DoD research centers, which will teach critical soft skills in leadership, feedback, communication, writing, public speaking, community service, and military operations.

• Assist second-year students to obtain DoD internships.

Collaborating with the Air Force Research Laboratory [12] and the Griffiss Institute [13], VICEROY established a national collaborative network of educators (Figure 4) by creating 13 cyber consortiums known as Virtual Institutes (VI’s) encompassing 44 colleges and universities across the country.

The VIs provides mission-focused, high-impact, experiential learning opportunities, courses of study, certificates, and industry-recognized certifications to ensure students are ready to tackle DoD and national security problems on day one of employment (Figure 5). Coupled with VICEROY’s robust summer internship programs known as MAVEN and ENVOY, student interns and graduate have been demonstrably in-demand by DoD cyber and spectrum operations and research communities [14].

The VICEROY program has been successful in leveraging other student development programs such as the Scholarship for Service, Palace Acquire (PAQ), Air Force Civilian Service PCIP, and the Defense Civilian Training Corps Program to further VICEROY Scholar opportunities. In addition, VICEROY ENVOY interns are finding new opportunities for DoD employment with VICEROY partners at the 350th Spectrum Warfare Wing, Eglin AFB, FL, the 850th SWG Detachment 1 at JBSA-Lackland, TX, the Naval Undersea Warfare Center Division, Keyport, the Undergraduate Cyber Warfare Training 333d Training Squadron at Keesler AFB, MS. In 2024, VICEROY is working to expand VICEROY scholar opportunities at the Army Research Laboratory at Adelphi and Aberdeen Proving Ground, the Naval Research Laboratory in Washington, DC, and the NIWIC Pacific in San Diego, CA.

VICEROY accounts for a pipeline of 979 students nationwide with approximately 200 graduates yearly and growing. The students increasingly represent a cross section of U.S. cyber talent, with 20% from ROTC, 25% female, and 20% minorities. Nearly 80 ROTC detachments across the three Services participate in and benefit from VICEROY experiential learning, while MAVEN has been identified as an approved Army cadet officer development activity. VICEROY’s success is inviting inquiry by other academic institutions newly eager to join and further grow the cyber-spectrum talent pipeline.

The central program office will coordinate with VICEROY and the participating NCAE-C members in each VI to leverage VICEROY’s connections with industry and academia. The VIs will report their program activities and related metrics to the program office and coordinate with other programs to best align execution of resources. This partnership would expand internship opportunities and research projects available within the DoD for VICEROY students, while widening the pipeline of cyber learning and workforce development efforts that encompass K-12 through college levels.

Summary

The DoD has many academic engagement, scholarship, and workforce retention programs that are enhancing cyber talent pathways to meet current and future workforce gaps. Individually, these programs are enhancing the DoD relevance and quality of formal education programs, identifying job-relevant certifications that demonstrate desired skillsets, incentivizing workforce participation through connected merit and financial reward factors, and providing mechanisms to retain critical talent at the career point where they have the greatest value to DoD. The DoD CIO Central Program Office seeks to unify the direction and management of these existing programs to amplify their impact, using the DoD Cyber Workforce Strategy as a framework, and the Cyber Workforce Strategy Implementation Plan as an actionable and quantifiable set of objectives to measure progress. The Central Program Office for Academic Engagement will coordinate and harmonize these programs, sharing best practices and advocating for establishment of programs of record that will allow true long-term strategic planning, supported by a data-driven approach to measure impact and inform decision-making.

VICEROY is a relatively new program that leverages many existing academic development, scholarship, research, internship, and faculty-development activities. Though designed to develop future military and civilian cyber leaders, it is also bearing fruit in providing an enhanced talent pathway for the defense industrial base, a key producer of critical and commodity technologies for our DoD. VICEROY’s success to date is largely due to its demonstrated ability to focus STEM and post-secondary education activities toward national security problems that are of shared value to both our society and the DoD, instilling a sense of citizen pride and career purpose in our graduates. Further, VICEROY’s internship program closely tracks student interests and pairs them with the most suitable employer, while breaking down financial and logistic barriers that encumber both student and employer alike. The result is a cyber-spectrum workforce pathway that carefully cultivates talent, curates the student internship experience, and creates a sense of cohort and identify among its students.

References and Footnotes

[1] DoD Cyber Workforce Strategy FY 2023-2027. https://dodcio.defense.gov/Portals/0/Documents/Library/CWF-Strategy.pdf

[2] DoD Cyber Workforce Strategic Implementation Plan 2023-2027. https://media.defense.gov/2023/Aug/03/2003274088/-1/-1/1/2023-2027-DOD-CYBER-WORKFORCE-STRATEGY-IMPLEMENTATION-PLAN.PDF 

[3] DoD 2023 Cyber Strategy Summary. https://media.defense.gov/2023/Sep/12/2003299076/-1/-1/1/2023_DOD_Cyber_Strategy_Summary.PDF 

[4] FY2024 National Defense Authorization Act. https://media.defense.gov/2023/Sep/12/2003299076/-1/-1/1/2023_DOD_Cyber_Strategy_Summary.PDF 

[5] DoD Cyber Workforce Framework (DCWF). https://dodcio.defense.gov/Cyber-workforce/DCWF 

[6] Cybersecurity Workforce Assessment Act. https://www.congress.gov/113/plaws/publ246/PLAW-113publ246.pdf 

[7] For more information and how to apply, visit https://www.dodemergingtech.com/dod-programs/cyber-information-technology-exchange-program-citep/ 

[8] For more information and how to apply, visit https://www.dodemergingtech.com/cyber-workforce-rotational-program-cwrp/ 

[9] For more information about the NCAE-C Program and how to apply for certification, visit https://www.nsa.gov/Academics/Centers-of-Academic-Excellence/ 

[10] For more information about CSA, visit https://public.cyber.mil/wid/cdp/dcysp/ 

[11] The six SMCs are The Citadel (Charleston, SC), Texas A&M University (College Station, TX), University of North Georgia (Dahlonega, GA), Virginia Military Institute (Lexington City, VA), Virginia Polytechnic and State University (Blacksburg, VA), and lead institution Norwich University (Northfield, VT). 

[12] Air Force Research Laboratory, Information Directorate, Rome NY

[13] The Griffiss Institute is a 501(c)(3) non-profit and Partnership Intermediary enabling Technology Transfer

[14] For more information about VICEROY, MAVEN, and ENVOY internship opportunities, or are a DoD employer interested in hosting or recruiting students, visit https://www.viceroyscholars.org/ 

Magazine Home | About CYBER | Author Guide | Masthead | Archive Articles