The United States remains vulnerable to disruptive cyberattacks from well-resourced and highly capable nation-state adversaries. While the Department of War (DoW) has a large and capable cyberspace workforce, it is challenged to assemble adequate mission-ready talent able to quickly mobilize in response to major cyber incidents or exceptionally difficult problems. To address this challenge, U.S. Congress tasked DoW with investigating alternative cyberspace workforce strategies.
In 2020, the Cyberspace Solarium Commission released a report with proposed legislative actions, including the recommendation that Congress task the DoW with assessing the establishment of a military reserve. This recommendation resulted in enactment of Section 1730 of the FY21 National Defense Authorization Act (NDAA), and resulting report, Evaluation of Reserve Models Tailored to the Support of Cyberspace Operations. The question of alternative cyber reserve forces returned in Section 1540 of the FY23 NDAA, calling for an independent assessment of the feasibility and advisability of creating and maintaining a civilian cybersecurity reserve (CCR). In response, the Office of the Under Secretary of War for Policy (OUSW(P)) turned to the SEI, a federally funded research and development center with expertise in cybersecurity and cyber workforce development. This post, adapted from the report submitted to Congress, highlights SEI findings from our independent study assessing the feasibility and advisability of establishing a CCR.
Workforce Construct and Gap Areas
When considering the establishment of a CCR, it was first essential to understand the organization and staffing of the existing DoW cyberspace workforce. It was further prudent to identify where capability and/or capacity gap areas existed to evaluate if civilian talent could viably fill those shortcomings.
The report outlines manpower totals for DoW’s cyberspace operations forces (COF) and the breakup of information technology (IT) roles versus security roles. Cyber Mission Force (CMF), which is part of CoF, is responsible for planning, directing, coordinating, and executing of cyber operations. As of this writing, the CMF has an authorized strength of approximately 6,200 DOW civilians and uniformed service members, organized into 147 mission-specific teams. To compare potential alignments with private-sector cyber positions, our research team enumerated requirements and reporting structures for CMF roles and responsibilities.
Building on this compilation, a snapshot of the job market was taken to form a macro view of the cyber workforce as a whole. In the private sector, projections from U.S. Bureau of Labor Statistics as well as Cyberseek, a marketing analysis tool, note that unfilled cybersecurity jobs and a shortage of qualified workers are creating a demand into the next decade.
A 3-Phased Approach to Exploring the Feasibility and Advisability of a CCR
We drew upon three primary sources to inform the feasibility and advisability of a CCR: a literature review, interviews, and a survey.
- literature review—Sources included journal articles, congressional hearings and committee reports, media recordings, and other publications related to the CCR concept.
- interviews—We conducted more than 50 interviews with actively employed individuals serving in federal, state, and private-sector cybersecurity job roles. Most of the interviewees had served in the U.S. military.
- survey—Nearly 1,600 DoW civilian and military service members responded to an online survey.
We then collated and analyzed the data from these sources to provide responses for assessment criteria elements listed in the NDAA, and form conclusions regarding the feasibility and advisability of a CCR.
Study Finds A CCR is Both Feasible and Advisable
After analyzing the data, the team was able to demonstrate a need and strong interest in harnessing a mechanism for the government to leverage expertise from the private sector. Notwithstanding complexities such as logistical issues, conflicts of interest, and legal authorities, a CCR would be feasible and advisable if certain conditions are met.
Our report highlighted six conclusions:
- Scarcity of Talent: There is a general shortage in the cybersecurity workforce at large and an acknowledged gap within the DoW cyber workforce. Data and testimonials reinforce the scarcity of talent and the seriousness of threats to national security from cyberspace adversaries.
- Distinct mission: For a CCR to be viable, it needs missions that distinguish it from other reserve components. We proposed two types for a CCR: sustainment missions and response missions. Sustainment missions would entail support functions such as training, security assessments, and exercises. Response missions would involve support for responding to cyber incidents and could leverage the expertise and specialized knowledge that exists outside of the DoW to enhance response outcomes.
- Interest in serving: Feedback from interviews, survey responses, as well as documented participation numbers in other federal and state cyber-related auxiliary programs, proved a strong propensity to serve the interests of the country (under the right conditions). Also noteworthy, the study activities piqued curiosity. Researchers and mission partners received many inquiries about a CCR, and how to get involved.
- New supply of talent: A CCR would give the government access to industry experts who wouldn’t otherwise serve in uniform or choose a career as a DoW civilian. Moreover, this talent pool would not require a costly training investment or lengthy military indoctrination. Qualitative evidence suggests there is a mutually acceptable manner to enable interested civilians an opportunity to serve a specialized capacity.
- Strategic reserve: In time of conflict, a well-organized and prepared homeland defense capability is vital. Several senior U.S. government and DoW leaders noted the importance of having a strategic cyber reserve to call upon in case of dire events, (e.g., a disruption to critical infrastructure).
- Perceived value: Among government personnel surveyed, 82 percent agreed that there is value in establishing a CCR. Additionally, 83 percent agree that a CCR would bring skills and capabilities that are in high demand in the DoW.
Additional Recommendations
Our findings supporting feasibility and advisability of establishing a CCR were reported in response to itemized assessment criteria specified within the NDAA. We also developed additional recommendations born out of our research:
- Address cyber workforce gaps, prioritizing skill- and merit-based recruitment. New or streamlined force generation approaches or organizational models could address a number of the DoW’s cyber workforce capacity and capability gaps. A properly designed CCR could address staffing shortfalls and reduce risk. However, it is imperative that recruitment efforts prioritize expert talent. Strictly pursuing elite members helps avoid competition with other recruitment efforts, builds trust in government and stakeholders, and appeals to experts.
- Establish interagency collaboration for a whole-of-government approach to combating national security risks. Combating nation-state adversaries and other criminal elements is a strategic risk that requires a proactive, whole-of-government approach. A CCR should play a part in this national effort by bringing unique skills and insights to the DoW and interagency needs. For instance, provide forums, training, red teaming, exercise support, and specialized incident-response capabilities where they are needed.
- Create and maintain a CCR personnel database to align talent with mission requirements. A CCR personnel database is critical for surgically matching talent with specific mission requirements. The ability to easily search a rolodex to locate an individual who is vetted to have the precise skillsets needed for a mission is a desire we heard in interview discussions.
- Pilot CCR concept, evaluate, and refine. We recommend that the DoW plan and execute a small-scale pilot with a cohort of 15-to-20 individuals to evaluate the CCR concept in practice. The pilot could evaluate cost and benefit metrics and gather input such as impact on employers.
Next Step
Findings show that creating a CCR as a potential solution to address staffing needs is both feasible and advisable if it is carefully constructed to not duplicate or impede other reserve component responsibilities and recruits only elite talent.
It is important to stipulate that we arrived at this conclusion using qualitative analysis techniques. While our survey helped us assess subjective characteristics (e.g., feelings, attitudes, or perceptions), we acknowledge that the responses provided in response to various statements could be distorted by various biases. We recommend consideration of the notional CCR model outlined in the report above and further analysis to determine optimum CCR implementation courses of action.
