While some Federal government agencies have generated improvements in their cybersecurity workforce development efforts, many still lack effective management programs and strategies to grow their security workforces, a new Government Accountability Office (GAO) report says.
Published on Jan. 16, the Federal watchdog’s audit of five agencies with large cybersecurity workforces – including the Departments of Commerce, Homeland Security (DHS), Health and Human Services (HHS), Treasury, and Veterans Affairs (VA) – found that while DHS implemented 14 of 15 steps for workforce planning laid out by the Office of Personnel Management (OPM) and GAO, other agencies fell short of consistently implementing recommended practices.
Approaching cybersecurity workforce management at the agency component level – instead of at the department level – was a primary challenge that agencies faced, according to GAO, which said that the decentralized implementation led to inconsistent workforce planning efforts.
Other challenges agencies face included not having governance processes that maintained top-level engagement in developing and implementing a workforce plan; only partially conducting workforce analyses; not fully developing workforce action plans; and failing to implement and monitor the workforce action plans that were in place.
Unless issues in management are addressed, agencies could be more vulnerable to cyber threats, the watchdog warned.
“Until the departments implement these practices, they will likely be challenged in having a cybersecurity workforce with the necessary skills to protect federal IT systems and enable the government’s day-to-day functions,” said GAO.
None of the agencies fully implemented all revision and evaluation practices, with DHS and the VA implementing only some of the practices. The Departments of Commerce, Treasury, and HHS didn’t implement any of the steps which assessed the effectiveness and efficiency of their cybersecurity workforce action plans by tracking progress along targets, outcomes, and performance measures.
Top officials at agencies audited cited inadequate funding, recruitment difficulties, and retention challenges as causes of the management shortfalls.
“To mitigate these challenges, department officials described actions, both underway and planned,” said GAO. “However, none of the departments evaluated their actions to determine whether they were effective in addressing their cybersecurity workforce management challenges.”
GAO made a total of 23 recommendations aimed at improving the agencies’ workforce planning by: fully implementing and monitoring applicable practices for planning; determining the effectiveness of mitigation actions related to cybersecurity workforce challenges; conducting in-depth workforce analyses; and evaluating and revising plans to meet evolving challenges. Notably, HHS was asked to determine a clear strategic direction for its cybersecurity workforce.
Commerce, DHS, and HHS all agreed with GAO’s recommendations, while VA agreed with two and partially agreed with three. The Treasury Department didn’t disagree or agree with the recommendations it received.
