Cybersecurity Opportunity Act — Report, Senate, 117th Congress, 2d Session 117–59 (Calendar No. 256)
Summary
This is Senate Report 117-59 of the 117th Congress, 2d Session, titled Cybersecurity Opportunity Act, from the Committee on Homeland Security and Governmental Affairs, ordered to be printed January 20, 2022. Mr. Peters reports on S. 2305, which the Committee reports favorably with an amendment in the nature of a substitute and recommends that the bill, as amended, do pass. The report states that the bill authorizes the Department of Homeland Security to award grants to establish or expand cybersecurity programs at institutions of higher education that serve a high proportion of Pell Grant-receiving students, Historically Black Colleges and Universities, and other minority-serving institutions. The background section cites a Homeland Security and Commerce Departments finding that reliable, quantitative information about the cybersecurity workforce is lacking.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Congressional materials
Cite this document
“Cybersecurity Opportunity Act — Report, Senate, 117th Congress, 2d Session 117–59 (Calendar No. 256).”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/crpt-crpt-117srpt59-crpt-117srpt59/
, SHA-256 98778da22ad81d28d5c46015504e7fa85cce088ea981dcd8d9b0046609a633e0.Full text
1
Calendar No. 256
117TH CONGRESS REPORT
" SENATE !
2d Session 117–59
CYBERSECURITY OPPORTUNITY ACT
R E P O R T
OF THE
COMMITTEE ON HOMELAND SECURITY AND
GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
TO ACCOMPANY
S. 2305
TO ENHANCE CYBERSECURITY EDUCATION
JANUARY 20, 2022.—Ordered to be printed
ctelli on DSK11ZRN23PROD with REPORTS
U.S. GOVERNMENT PUBLISHING OFFICE
29–010 WASHINGTON : 2022
congress.#13
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00001 Fmt 4012 Sfmt 4012 E:\HR\OC\SR059.XXX SR059
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
GARY C. PETERS, Michigan, Chairman
THOMAS R. CARPER, Delaware ROB PORTMAN, Ohio
MAGGIE HASSAN, New Hampshire RON JOHNSON, Wisconsin
KYRSTEN SINEMA, Arizona RAND PAUL, Kentucky
JACKY ROSEN, Nevada JAMES LANKFORD, Oklahoma
ALEX PADILLA, California MITT ROMNEY, Utah
JON OSSOFF, Georgia RICK SCOTT, Florida
JOSH HAWLEY, Missouri
DAVID M. WEINBERG, Staff Director
ZACHARY I. SCHRAM, Chief Counsel
MICHAEL A. GARCIA, Professional Staff Member
PAMELA THIESSEN, Minority Staff Director
ANDREW C. DOCKHAM, Minority Chief Counsel and Deputy Staff Director
CARA G. MUMFORD, Minority Professional Staff Member
LAURA W. KILBRIDE, Chief Clerk
ctelli on DSK11ZRN23PROD with REPORTS
(II)
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00002 Fmt 5904 Sfmt 5904 E:\HR\OC\SR059.XXX SR059
Calendar No. 256
117TH CONGRESS REPORT
" SENATE !
2d Session 117–59
CYBERSECURITY OPPORTUNITY ACT
JANUARY 20, 2022.—Ordered to be printed
Mr. PETERS, from the Committee on Homeland Security and
Governmental Affairs, submitted the following
R E P O R T
[To accompany S. 2305]
[Including cost estimate of the Congressional Budget Office]
The Committee on Homeland Security and Governmental Affairs,
to which was referred the bill (S. 2305) to enhance cybersecurity
education, having considered the same, reports favorably with an
amendment (in the nature of a substitue) and recommends that the
bill, as amended, do pass.
CONTENTS
Page
I. Purpose and Summary .................................................................................. 1
II. Background and Need for the Legislation ................................................... 2
III. Legislative History ......................................................................................... 3
IV. Section-by-Section Analysis of the Bill, as Reported .................................. 4
V. Evaluation of Regulatory Impact .................................................................. 5
VI. Congressional Budget Office Cost Estimate ................................................ 5
VII. Changes in Existing Law Made by the Bill, as Reported ........................... 6
I. PURPOSE AND SUMMARY
S. 2305, the Cybersecurity Opportunity Act, authorizes the De-
partment of Homeland Security (DHS) to enhance the nation’s cy-
bersecurity workforce by awarding grants to establish or expand
cybersecurity programs at institutions of higher education that
serve a high proportion of Pell Grant-receiving students, Histori-
cally Black Colleges and Universities (HBCUs), and other minority-
serving institutions. Eligible applicants can use these grants to
build and improve institutional capacity to support new or existing
cybersecurity programs, provide hands-on cybersecurity research
and training experiences, and strengthen public-private partner-
ships to further cybersecurity research, training, and educational
ctelli on DSK11ZRN23PROD with REPORTS
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00003 Fmt 6659 Sfmt 6602 E:\HR\OC\SR059.XXX SR059
2
opportunities. These grants will also help institutions qualify to be
designated a National Center of Academic Excellence in Cybersecu-
rity.
II. BACKGROUND AND NEED FOR THE LEGISLATION
Some estimates put the nation at having roughly half-a-million
vacant cybersecurity jobs.1 However, the Homeland Security and
Commerce Departments found that it is difficult to place an accu-
rate number on the amount of vacant cybersecurity positions as
‘‘reliable, quantitative information about the cybersecurity work-
force is lacking.’’ 2 Yet, despite the lack of a concrete figure, DHS
and the Commerce Department concluded that ‘‘there is a real need
for improvement in the U.S. cybersecurity workforce’s development
and that today’s situation warrants both immediate and sustained
attention.’’ 3
The lack of cybersecurity professionals is a challenge that per-
vades federal, local, and private organizations, which harms their
cybersecurity posture. While government and private organizations
have initiated programs to educate, train, and recruit personnel,
individuals from underrepresented groups—such as women, people
of color, and other minorities—continue to comprise a small portion
of the cybersecurity workforce.4 Although public data is limited re-
garding the diversity of the cybersecurity workforce, broader fed-
eral workforce demographics show that minority groups and
women remain underrepresented.5 For instance, Black and Latin
employees make up less than 20 percent of the Federal Bureau of
Investigation’s (FBI) workforce, and women comprise only a third
of the DHS workforce.6 The lack of a diverse, equitable, and inclu-
sive workforce could be detrimental to organizations as ‘‘diverse
workforces produce better outcomes and more informed decision-
making.’’ 7
DHS and the Department of Commerce identified the task of cre-
ating a diverse, equitable, and inclusive workforce as a key priority
in their joint report on Supporting the Growth and Sustainment of
the Nation’s Cybersecurity Workforce.8 They found that ‘‘a success-
ful cybersecurity workforce strategy for the Nation should include
an enhanced focus upon the value of diversity and inclusion and
convert it into a potent resource that can be used to great advan-
tage. Fostering and sustaining a diverse workforce will support the
ability to find new talent to carry out this effort and to uncover
novel ways to solve problems.’’ 9 They recommend that the federal
1 See Cyber Seek, Home Page (https://www.cyberseek.org/index.html#aboutit) (accessed Dec. 9,
2021).
2 See National Institute of Standards and Technology, A Report to the President on Supporting
the Growth and Sustainment of the Nation’s Cybersecurity Workforce: Building the Foundation
for a More Secure American Future, at 23 (Jul. 24, 2018) (https://www.nist.gov/system/files/docu-
ments/2018/07/24/eo_wf_report_to_potus.pdf) (hereinafter ‘‘NIST’’).
3 See Id. at 24.
4 See Id. at 29.
5 NIST did, however, find that ‘‘In comparison to the national workforce, minorities and
women are underrepresented among those working in cybersecurity.’’ See Id. at 26.
6 See Federal Bureau of Investigation, Diversity at the FBI (https://www.fbijobs.gov/working-
at-FBI/diversity) (accessed Dec. 9, 2021); and US Department of Homeland Security, EEO Diver-
sity Management (https://www.dhs.gov/dhs-diversity-planning) (accessed Dec. 9, 2021).
7 See Third Way, A Roadmap to Strengthen US Cyber Enforcement: Where Do We Go From
Here? (Nov. 12, 2020) (https://www.thirdway.org/report/a-roadmap-to-strengthen-us-cyber-en-
forcement-where-do-we-go-from-here).
ctelli on DSK11ZRN23PROD with REPORTS
8 See NIST, supra note 2.
9 See Id. at 4.
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00004 Fmt 6659 Sfmt 6602 E:\HR\OC\SR059.XXX SR059
3
government recruit cybersecurity workers from ‘‘large and diverse
pools of candidates who are underutilized or underrepresented in
the cybersecurity workforce.’’ 10
DHS is uniquely situated to identify the nation’s cybersecurity
needs and to bolster its cybersecurity workforce. The Cybersecurity
and Infrastructure Security Agency (CISA), a component of the De-
partment, is the lead federal civilian agency responsible for pro-
tecting the homeland against cyber threats, and Congress has rec-
ognized CISA’s critical role in cybersecurity education by author-
izing the agency to build and strengthen a national cybersecurity
workforce pipeline through the Cybersecurity and Education and
Training Assistance Program.11
S. 2305 allows DHS to award grants to HBCUs, institutions of
higher education that have an enrollment of ‘‘needy students’’’, and
other minority-serving institutions.12 Grant recipients can use
these funds to support new or existing cybersecurity programs, in-
cluding cybersecurity partnerships with public and private entities,
to train qualified cybersecurity professionals, and establish Na-
tional Centers of Academic Excellence (NCAEs) in Cybersecurity.
The purpose of the NCAE program is to create standard cybersecu-
rity curriculum and establish a workforce pipeline from NCAE in-
stitutions to select federal agencies.13 S. 2305 ensures that NCAEs
are established in higher educational institutions that serve under-
represented communities, which will enhance the number of di-
verse cybersecurity personnel in the federal government.
This legislation continues to strengthen DHS’s leadership role in
cybersecurity workforce education, while recognizing that appro-
priate coordination with other government agencies is important to
developing a comprehensive approach to cybersecurity education.
III. LEGISLATIVE HISTORY
Senator Jon Ossoff (D–GA) introduced S. 2305, the Cybersecurity
Opportunity Act, on June 24, 2021. Cosponsors who joined the bill
after introduction include: Senators Thom Tillis (R–NC), Tim Scott
(R–SC), Angus S. King (I–ME), John Cornyn (R–TX), Catherine
Cortez Masto (D–NV), Mark Kelly (D–AZ), Mike Rounds (R–SD),
and John Boozman (R–AR),
The bill was referred to the Senate Committee on Homeland Se-
curity and Governmental Affairs on June 24, 2021, and the Com-
mittee considered S. 2305 at a business meeting on August 4, 2021.
During the business meeting, Senator Ossoff offered a modified
substitute amendment which would do the following: allow private,
non-profit schools that serve the specified target student popu-
lations to participate; reserve no less than 50 percent of grant
funds specifically for HBCUs and minority-serving institutions; re-
move a five-year sunset provision; add student outreach and re-
cruitment as an authorized activity; add reporting requirements;
and authorize an appropriation of $50 million per fiscal year. The
modification to the amendment would remove the authorization for
10 See Id. at 36.
11 William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Pub.
L. No. 116–283, Sec. 1719 (2020).
12 ‘‘Needy students’’ is defined the Higher Education Act of 1965, Pub. L. 89–329, Sec. 312(d).
ctelli on DSK11ZRN23PROD with REPORTS
13 See National Security Agency and Central Security Service, Home Page (https://
www.nsa.gov/Academics/Centers-of-Academic-Excellence/) (accessed Dec. 9, 2021).
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00005 Fmt 6659 Sfmt 6602 E:\HR\OC\SR059.XXX SR059
4
appropriations, require DHS to develop performance metrics to
evaluate the grants, and include a 5-year sunset clause. The Ossoff
substitute amendment, as modified, was adopted by unanimous
consent.
Senator Johnson offered an amendment, as modified, that would
strike the authorization of appropriations designated for grants to
assist higher education institutions that have higher numbers of
enrollment of needy students, HBCUs, and other minority-serving
institutions, and instead require the use of unobligated funds from
the American Rescue Plan to implement the bill. The amendment,
as modified, was not adopted by voice vote with Senators Peters,
Carper, Hassan, Sinema, Rosen, Padilla, Ossoff, Portman, Johnson,
Lankford, Romney, Scott, and Hawley present.
The Committee ordered the bill, as amended by the modified sub-
stitute amendment, reported favorably by voice vote with Senators
Peters, Carper, Hassan, Sinema, Rosen, Padilla, Ossoff, Portman,
Johnson, Lankford, Romney, Scott, and Hawley present.
IV. SECTION-BY-SECTION ANALYSIS OF THE BILL, AS REPORTED
Section 1. Short title
This section designates the name of the bill as the ‘‘Cybersecurity
Opportunity Act.’’
Section 2. Dr. David Satcher Cybersecurity Education Grant Pro-
gram
Subsection (a) defines the terms ‘‘enrollment of needy students,’’
‘‘historically Black college or university,’’ ‘‘institution of higher edu-
cation,’’ ‘‘minority-serving institution,’’ and ‘‘Secretary.’’
Subsection (b) authorizes the DHS Secretary to award grants to
assist institutions of higher education that have an enrollment of
needy students, HBCUs, and minority-serving institutions, to: es-
tablish or expand cybersecurity programs; build and upgrade insti-
tutional capacity to better support new or existing cybersecurity
programs, including cybersecurity partnerships with public and pri-
vate entities; support the training of qualified cyber workforce can-
didates; and be designated as a National Center of Academic Excel-
lence in Cybersecurity. This subsection allows the Secretary to
award grants to the aforementioned entities to expand cybersecu-
rity education opportunities, technology and programs, research,
and partnerships with public and private entities. In awarding the
grants, 50 percent of the funds shall be made available for HBCUs
and minority-serving institutions, and the Secretary is required to
coordinate with the National Initiative for Cybersecurity Edu-
cation. The Secretary’s authority to award grants expires five years
after the Secretary awards the first grant.
Subsection (c) requires an eligible institution seeking a grant to
submit an application to the Secretary, including a statement of
how the institution will use the funds awarded by the grant to ex-
pand cybersecurity education opportunities at the eligible institu-
tion.
Subsection (d) specifies how an eligible institution can use grants
for increasing research, education, technical, partnership, and inno-
ctelli on DSK11ZRN23PROD with REPORTS
vation capacity.
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00006 Fmt 6659 Sfmt 6602 E:\HR\OC\SR059.XXX SR059
5
Subsection (e) requires the Secretary to submit to Congress a re-
port on the status and progress of implementation of the grant pro-
gram.
Subsection (f) requires the Secretary to establish performance
metrics for grants awarded under this section.
V. EVALUATION OF REGULATORY IMPACT
Pursuant to the requirements of paragraph 11(b) of rule XXVI of
the Standing Rules of the Senate, the Committee has considered
the regulatory impact of this bill and determined that the bill will
have no regulatory impact within the meaning of the rules. The
Committee agrees with the Congressional Budget Office’s state-
ment that the bill contains no intergovernmental or private-sector
mandates as defined in the Unfunded Mandates Reform Act
(UMRA) and would impose no costs on state, local, or tribal govern-
ments.
VI. CONGRESSIONAL BUDGET OFFICE COST ESTIMATE
CONGRESSIONAL BUDGET OFFICE,
U.S. CONGRESS,
Washington, DC, September 24, 2021.
Hon. GARY C. PETERS,
Chairman, Committee on Homeland Security and Governmental Af-
fairs, U.S. Senate, Washington, DC.
DEAR MR. CHAIRMAN: The Congressional Budget Office has pre-
pared the enclosed cost estimate for S. 2305, the Cybersecurity Op-
portunity Act.
If you wish further details on this estimate, we will be pleased
to provide them. The CBO staff contact is Aldo Prosperi.
Sincerely,
PHILLIP L. SWAGEL,
Director.
Enclosure.
By Fiscal Year, Millions of Dollars 2021 2021-2026 2021-2031
Direct Spending (Outlays) 0 0 0
Revenues 0 0 0
Increase or Decrease (-)
in the Deficit 0 0 0
0 16 not esttmated
S. 2305 would require the Department of Homeland Security
ctelli on DSK11ZRN23PROD with REPORTS
(DHS) to distribute grants to colleges and universities to expand
Insert offset folio 10 here SR59.001
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00007 Fmt 6659 Sfmt 6602 E:\HR\OC\SR059.XXX SR059
6
their cybersecurity research programs and class offerings. Under
the bill, DHS would award at least half of the grant funding to His-
torically Black Colleges and Universities and other minority-serv-
ing institutions. The bill also would require DHS to report to the
Congress annually on the effectiveness of the new grant program.
Based on funding for similar grant programs, CBO estimates
that implementing S. 2305 would cost $16 million over the 2021–
2026 period (detailed in Table 1). That estimate includes $12 mil-
lion for grants and $4 million for salaries and expenses over the
2021–2026 period for the administrative costs of reviewing grant
applications and reporting on the program’s implementation. Such
spending would be subject to the availability of appropriations. For
this estimate, CBO assumes that the bill will be enacted in fiscal
year 2022.
TABLE 1.—ESTIMATED INCREASES IN SPENDING SUBJECT TO APPROPRIATION UNDER S. 2305
By fiscal year, millions of dollars—
2021–
2021 2022 2023 2024 2025 2026 2026
Cybersecurity Grants:
Estimated Authorization .................................................. 0 4 4 4 4 4 20
Estimated Outlays ........................................................... 0 * 1 3 4 4 12
Administrative Costs:
Estimated Authorization .................................................. 0 * 1 1 1 1 4
Estimated Outlays ........................................................... 0 * 1 1 1 1 4
Total Changes:
Estimated Authorization .................................................. 0 4 5 5 5 5 24
Estimated Outlays ........................................................... 0 * 2 4 5 5 16
* = between zero and $500,000.
The CBO staff contact for this estimate is Aldo Prosperi. The es-
timate was reviewed by Leo Lex, Deputy Director of Budget Anal-
ysis.
VII. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED
This legislation would make no change in existing law, within
the meaning of clauses (a) and (b) of subparagraph 12 of rule XXVI
of the Standing Rules of the Senate, because this legislation would
not repeal or amend any provision of current law.
Æ
ctelli on DSK11ZRN23PROD with REPORTS
VerDate Sep 11 2014 01:33 Jan 25, 2022 Jkt 029010 PO 00000 Frm 00008 Fmt 6659 Sfmt 6611 E:\HR\OC\SR059.XXX SR059
File and source
- File
- CRPT_crpt-117srpt59_crpt-117srpt59.pdf
- Size
- 372,047 bytes
- SHA-256
- 98778da22ad81d28d5c46015504e7fa85cce088ea981dcd8d9b0046609a633e0
- Original
- www.govinfo.gov