II
118THCONGRESS
1
STSESSION S. 903
To require the Secretary of the Army to carry out a pilot project to establish
a Civilian Cybersecurity Reserve, and for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH21, 2023
Ms. R
OSEN(for herself and Mrs. BLACKBURN) introduced the following bill;
which was read twice and referred to the Committee on Armed Services
A BILL
To require the Secretary of the Army to carry out a pilot
project to establish a Civilian Cybersecurity Reserve, and
for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘Department of Defense 4
Civilian Cybersecurity Reserve Act’’. 5
SEC. 2. CIVILIAN CYBERSECURITY RESERVE PILOT 6
PROJECT. 7
(a) D
EFINITIONS.—In this Act: 8
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 2
•S 903 IS
(1) APPROPRIATE CONGRESSIONAL COMMIT -1
TEES.—The term ‘‘appropriate congressional com-2
mittees’’ means— 3
(A) the Committee on Homeland Security 4
and Governmental Affairs of the Senate; 5
(B) the Committee on Armed Services of 6
the Senate; 7
(C) the Committee on Homeland Security 8
of the House of Representatives; and 9
(D) the Committee on Armed Services of 10
the House of Representatives. 11
(2) C
OMPETITIVE SERVICE.—The term ‘‘com-12
petitive service’’ has the meaning given the term in 13
section 2102 of title 5, United States Code. 14
(3) E
XCEPTED SERVICE.—The term ‘‘excepted 15
service’’ has the meaning given the term in section 16
2103 of title 5, United States Code. 17
(4) T
EMPORARY POSITION .—The term ‘‘tem-18
porary position’’ means a position in the competitive 19
or excepted service for a period of 180 days or less. 20
(b) P
ILOTPROJECT.— 21
(1) I
N GENERAL.—The Secretary of the Army 22
shall carry out a pilot project to establish a Civilian 23
Cybersecurity Reserve. 24
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 3
•S 903 IS
(2) PURPOSE.—The purpose of the Civilian Cy-1
bersecurity Reserve is to enable the Army to provide 2
manpower to the United States Cyber Command to 3
effectively— 4
(A) preempt, defeat, deter, or respond to 5
malicious cyber activity; 6
(B) conduct cyberspace operations; 7
(C) secure information and systems of the 8
Department of Defense against malicious cyber 9
activity; and 10
(D) assist in solving cyber workforce-re-11
lated challenges. 12
(3) A
LTERNATIVE METHODS .—Consistent with 13
section 4703 of title 5, United States Code, in car-14
rying out the pilot project required under paragraph 15
(1), the Secretary may, without further authoriza-16
tion from the Office of Personnel Management, pro-17
vide for alternative methods of— 18
(A) establishing qualifications require-19
ments for, recruitment of, and appointment to 20
positions; and 21
(B) classifying positions. 22
(4) A
PPOINTMENTS.—Under the pilot project 23
required under paragraph (1), in order to fulfill the 24
purpose under paragraph (2), the Secretary— 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 4
•S 903 IS
(A) may activate members of the Civilian 1
Cybersecurity Reserve by— 2
(i) noncompetitively appointing mem-3
bers of the Civilian Cybersecurity Reserve 4
to temporary positions in the competitive 5
service; or 6
(ii) appointing members of the Civil-7
ian Cybersecurity Reserve to temporary po-8
sitions in the excepted service; 9
(B) shall notify Congress whenever a mem-10
ber is activated under subparagraph (A); and 11
(C) may appoint not more than 50 mem-12
bers to the Civilian Cybersecurity Reserve 13
under subparagraph (A) at any time. 14
(5) S
TATUS AS EMPLOYEES .—An individual ap-15
pointed under paragraph (4) shall be considered a 16
Federal civil service employee under section 2105 of 17
title 5, United States Code. 18
(6) A
DDITIONAL EMPLOYEES .—Individuals ap-19
pointed under paragraph (4) shall be in addition to 20
any employees of the United States Cyber Command 21
who provide cybersecurity services. 22
(7) E
MPLOYMENT PROTECTIONS .—The Sec-23
retary of Labor shall prescribe such regulations as 24
necessary to ensure the reemployment, continuation 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 5
•S 903 IS
of benefits, and non-discrimination in reemployment 1
of individuals appointed under paragraph (4), pro-2
vided that such regulations shall include, at a min-3
imum, those rights and obligations set forth under 4
chapter 43 of title 38, United States Code. 5
(8) S
TATUS IN RESERVE .—During the period 6
beginning on the date on which an individual is re-7
cruited to serve in the Civilian Cybersecurity Reserve 8
and ending on the date on which the individual is 9
appointed under paragraph (4), and during any pe-10
riod in between any such appointments, the indi-11
vidual shall not be considered a Federal employee. 12
(c) E
LIGIBILITY; APPLICATION ANDSELECTION.— 13
(1) I
N GENERAL.—Under the pilot project re-14
quired under subsection (b)(1), the Secretary of the 15
Army shall establish criteria for— 16
(A) individuals to be eligible for the Civil-17
ian Cybersecurity Reserve; and 18
(B) the application and selection processes 19
for the Civilian Cybersecurity Reserve. 20
(2) R
EQUIREMENTS FOR INDIVIDUALS .—The 21
criteria established under paragraph (1)(A) with re-22
spect to an individual shall include— 23
(A) if the individual has previously served 24
as a member of the Civilian Cybersecurity Re-25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 6
•S 903 IS
serve, that the previous appointment ended not 1
less than 60 days before the individual may be 2
appointed for a subsequent temporary position 3
in the Civilian Cybersecurity Reserve; and 4
(B) cybersecurity expertise. 5
(3) P
RESCREENING.—The Secretary shall— 6
(A) conduct a prescreening of each indi-7
vidual prior to appointment under subsection 8
(b)(4) for any topic or product that would cre-9
ate a conflict of interest; and 10
(B) require each individual appointed 11
under subsection (b)(4) to notify the Secretary 12
if a potential conflict of interest arises during 13
the appointment. 14
(4) A
GREEMENT REQUIRED .—An individual 15
may become a member of the Civilian Cybersecurity 16
Reserve only if the individual enters into an agree-17
ment with the Secretary to become such a member, 18
which shall set forth the rights and obligations of 19
the individual and the Army. 20
(5) E
XCEPTION FOR CONTINUING MILITARY 21
SERVICE COMMITMENTS .—A member of the Selected 22
Reserve under section 10143 of title 10, United 23
States Code, may not be a member of the Civilian 24
Cybersecurity Reserve. 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 7
•S 903 IS
(6) PROHIBITION.—Any individual who is an 1
employee of the executive branch may not be re-2
cruited or appointed to serve in the Civilian Cyberse-3
curity Reserve. 4
(d) S
ECURITYCLEARANCES.— 5
(1) I
N GENERAL.—The Secretary of the Army 6
shall ensure that all members of the Civilian Cyber-7
security Reserve undergo the appropriate personnel 8
vetting and adjudication commensurate with the du-9
ties of the position, including a determination of eli-10
gibility for access to classified information where a 11
security clearance is necessary, according to applica-12
ble policy and authorities. 13
(2) C
OST OF SPONSORING CLEARANCES .—If a 14
member of the Civilian Cybersecurity Reserve re-15
quires a security clearance in order to carry out the 16
duties of the member, the Army shall be responsible 17
for the cost of sponsoring the security clearance of 18
the member. 19
(e) I
MPLEMENTATION PLAN.— 20
(1) I
N GENERAL.—Not later than 180 days 21
after the date on which the Secretary of Defense 22
submits to the Committee on Armed Services of the 23
Senate and the Committee on Armed Services of the 24
House of Representatives the report required under 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 8
•S 903 IS
section 1540(d)(2) of the James M. Inhofe National 1
Defense Authorization Act for Fiscal Year 2023 2
(Public Law 117–263) on the feasibility and advis-3
ability of creating and maintaining a civilian cyber-4
security reserve corps, the Secretary of the Army 5
shall— 6
(A) submit to the appropriate congres-7
sional committees an implementation plan for 8
the pilot project required under subsection 9
(b)(1); and 10
(B) provide to the appropriate congres-11
sional committees a briefing on the implementa-12
tion plan. 13
(2) P
ROHIBITION.—The Secretary of the Army 14
may not take any action to begin implementation of 15
the pilot project required under subsection (b)(1) 16
until the Secretary fulfills the requirements under 17
paragraph (1). 18
(f) P
ROJECTGUIDANCE.—Not later than two years 19
after the date of the enactment of this Act, the Secretary 20
of the Army shall, in consultation with the Office of Per-21
sonnel Management and the Office of Government Ethics, 22
issue guidance establishing and implementing the pilot 23
project required under subsection (b)(1). 24
(g) B
RIEFINGS ANDREPORT.— 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 9
•S 903 IS
(1) BRIEFINGS.—Not later than one year after 1
the date on which the guidance required under sub-2
section (f) is issued, and every year thereafter until 3
the date on which the pilot project required under 4
subsection (b)(1) terminates under subsection (i), 5
the Secretary of the Army shall provide to the ap-6
propriate congressional committees a briefing on ac-7
tivities carried out under the pilot project, includ-8
ing— 9
(A) participation in the Civilian Cybersecu-10
rity Reserve, including the number of partici-11
pants, the diversity of participants, and any 12
barriers to recruitment or retention of mem-13
bers; 14
(B) an evaluation of the ethical require-15
ments of the pilot project; 16
(C) whether the Civilian Cybersecurity Re-17
serve has been effective in providing additional 18
capacity to the Army; and 19
(D) an evaluation of the eligibility require-20
ments for the pilot project. 21
(2) R
EPORT.—Not earlier than 180 days and 22
not later than 90 days before the date on which the 23
pilot project required under subsection (b)(1) termi-24
nates under subsection (i), the Secretary shall sub-25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 10
•S 903 IS
mit to the appropriate congressional committees a 1
report and provide a briefing on recommendations 2
relating to the pilot project, including recommenda-3
tions for— 4
(A) whether the pilot project should be 5
modified, extended in duration, or established 6
as a permanent program, and if so, an appro-7
priate scope for the program; 8
(B) how to attract participants, ensure a 9
diversity of participants, and address any bar-10
riers to recruitment or retention of members of 11
the Civilian Cybersecurity Reserve; 12
(C) the ethical requirements of the pilot 13
project and the effectiveness of mitigation ef-14
forts to address any conflict of interest con-15
cerns; and 16
(D) an evaluation of the eligibility require-17
ments for the pilot project. 18
(h) E
VALUATION.—Not later than three years after 19
the pilot project required under subsection (b)(1) is estab-20
lished, the Comptroller General of the United States 21
shall— 22
(1) conduct a study evaluating the pilot project; 23
and 24
(2) submit to Congress— 25
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS 11
•S 903 IS
(A) a report on the results of the study; 1
and 2
(B) a recommendation with respect to 3
whether the pilot project should be modified. 4
(i) S
UNSET.—The pilot project required under sub-5
section (b)(1) shall terminate on the date that is four 6
years after the date on which the pilot project is estab-7
lished. 8
(j) N
OADDITIONALFUNDS.— 9
(1) I
N GENERAL.—No additional funds are au-10
thorized to be appropriated for the purpose of car-11
rying out this Act. 12
(2) E
XISTING AUTHORIZED AMOUNTS .—Funds 13
to carry out this Act may, as provided in advance in 14
appropriations Acts, only come from amounts au-15
thorized to be appropriated to the Army. 16
Æ
VerDate Sep 11 2014 01:00 Mar 31, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6301 E:\BILLS\S903.IS S903
kjohnson on DSK79L0C42PROD with BILLS