SEI Report Advises Congress on Civilian Cybersecurity Reserve

January 16, 2026—In the face of increasingly sophisticated cyberattacks on the nation’s critical infrastructure, federal government networks, and defense systems, the government needs the ability to mobilize a mission-ready workforce capable of operating in contested environments. The Pentagon commissioned the Software Engineering Institute (SEI) to conduct an independent study assessing the feasibility and advisability of a civilian cybersecurity reserve (CCR). The study found that a CCR is feasible and advisable, as long as its mission is distinct from existing federal cyber forces. The report Independent Assessment of Civilian Cybersecurity Reserve for Department of Defense is now available in the SEI Digital Library.

Fulfilling a Congressional Mandate

The National Defense Authorization Act (NDAA) of 2023 required the Pentagon to obtain an independent assessment of the feasibility and advisability of a CCR. The Office of the Under Secretary of Defense for Policy (OUSD(P)) turned to the SEI, a federally funded research and development center with expertise in cybersecurity and cyber workforce development.

In 2025, SEI researchers conducted an in-depth literature review, surveyed nearly 1,600 members of the cyber workforce, and interviewed more than 50 cybersecurity professionals in the government, military, and private sector. They delivered their report to the OUSD(P), which relayed it to Congress to fulfill the NDAA requirement. This week, the report received clearance for public release.

CCRs Are Feasible, with the Right Mission

Cybersecurity forces in U.S. military services and federal agencies face well-resourced nation-state adversaries in cyberspace. The SEI report details how the government could effectively harness private-sector expertise to fill federal cyber workforce gaps.

Temporary service by non-government workers presents potential impediments, such as government system access, legal authority, logistics, and conflicts of interest. But civilian interest is not a barrier. The study found that private-sector professionals, including former military and government workers, are eager to contribute to national security.

However, the report cautions that for a CCR to be viable, its mission must be distinct from that of existing national, state, and military cyber reserves, such as the Pentagon’s Cyber Mission Force.

CCRs would be well-suited for two types of missions. Sustainment missions would include training, security assessments, and exercises to keep the defense cyber workforce up to date on the latest security technology and methods. In response missions, civilians would leverage expertise and specialized knowledge outside existing government response capabilities.

The report also advises that CCR service requirements and compensation should appeal to civilians without impeding existing reserve recruitment and retention goals.

A CCR Is Advisable

The private-sector talent pool represents a skilled cybersecurity workforce ready to serve. Study interviewees noted that the lack of a strategic cyber reserve presents unacceptable risk, and that a CCR could benefit U.S. defense in times of peace or war. An overwhelming majority of survey participants agreed that a CCR would be valuable and bring high-demand skills and capabilities to the Pentagon.

Other Findings and Recommendations

The study’s survey respondents and interviewees noted a need for collaboration among local, state, and federal agencies to secure critical infrastructure. The study’s findings also emphasized the need for a talent identification and management system to match civilian experts to cyber missions.

Finally, the SEI report recommends a pilot CCR to validate such a program’s effectiveness and necessity.

Download the SEI’s Independent Assessment of Civilian Cybersecurity Reserve for Department of Defense. Learn more about the SEI’s cyber workforce development, including exercise and competition creation, workforce assessment and evaluation, and national cybersecurity center establishment, in the SEI Digital Library. Programs interested in partnering with the SEI’s cyber workforce experts can email info@sei.cmu.edu.

Photo by Master Sgt. Rachelle Morris