Independent Assessment of Civilian Cybersecurity Reserve for Department of Defense

Cybersecurity staffing shortages are a major concern in the government given the increasingly sophisticated cyber attacks on the nation’s critical infrastructure. Congress tasked the Pentagon in the FY2023 National Defense Authorization Act (NDAA) with finding flexible options to address staffing needs. The Pentagon commissioned the Software Engineering Institute (SEI) to conduct this independent study to assess the feasibility and advisability of creating a civilian cybersecurity reserve (CCR) that could harness cyber expertise from the private sector to mobilize a mission-ready workforce capable of operating in contested environments.

The SEI completed the study by conducting an in-depth literature review, a survey of nearly 1,600 members of the DoD cyber workforce, and interviews with more than 50 cybersecurity professionals in the government, military, and private sector. Findings show that creating a CCR as a potential solution to address staffing needs is feasible and advisable under certain conditions. Those conditions include ensuring that the CCR does not interfere or duplicate the work of other reserve components and that it applies criteria to ensure recruits meet high qualifications while avoiding conflict with other recruitment or retention efforts. The report itemizes additional recommendations born of the study including how to pilot the CCR concept.