---
kind: "diff"
citation: "H.R. 3107"
bill: "113-hr-3107"
heading: "Homeland Security Cybersecurity Boots-on-the-Ground Act"
from: "ih"
from_label: "Introduced in House"
to: "rh"
to_label: "Reported in House"
sections_amended: 2
sections_added: 1
sections_removed: 0
url: "https://uscodex.org/bills/113/hr/3107/changes/rh"
---

# H.R. 3107 — what changed

H.R. 3107, Homeland Security Cybersecurity Boots-on-the-Ground Act — 2 sections amended and 1 added between Introduced in House and Reported in House.

Edits are marked `<del>struck</del>` and `<ins>inserted</ins>`.

## Sec. 2 Cybersecurity occupation classifications, workforce assessment, and strategy

- (a) Cybersecurity occupation classifications—
  - (1) In general— Not later than 90 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop and issue comprehensive occupation classifications for individuals performing activities in furtherance of the cybersecurity mission of the Department of Homeland Security.
  - (2) Applicability— The Secretary of Homeland Security shall ensure that the comprehensive occupation classifications issued under <del>subsection (a) may be </del><ins>paragraph (1) are </ins>used throughout the Department of Homeland Security and are made available to other Federal agencies.
- (b) Cybersecurity workforce assessment—
  - (1) In general— Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Chief Human Capital Officer and Chief Information Officer of the Department of Homeland Security, shall assess the readiness and capacity of the Department to meet its cybersecurity mission.
  - (2) Contents— The assessment required under paragraph (1) shall, at a minimum, include the following:
    - (A) Information where cybersecurity positions are located within the Department of Homeland Security, specified in accordance with the cybersecurity occupation classifications issued under subsection (a).
    - (B) Information on which cybersecurity positions are—
      - (i) performed by—
        - (I) permanent full time departmental <del>employees;</del><ins>employees, together with demographic information about such employees’ race, ethnicity, gender, disability status, and veterans status;</ins>
        - (II) individuals employed by independent contractors; and
        - (III) individuals employed by other Federal agencies, including the National Security Agency; and
      - (ii) vacant.
    - (C) The number of individuals hired by the Department pursuant to the authority granted to the Secretary of Homeland Security in 2009 to permit the Secretary to fill 1,000 cybersecurity positions across the Department over a <del>three-year </del><ins>three year </ins>period, and information on what challenges, if any, were encountered with respect to the implementation of such authority.
    - (D) Information on vacancies within the Department’s cybersecurity supervisory workforce, from first line supervisory positions through senior departmental cybersecurity positions.
    - (E) Information on the percentage of individuals within each cybersecurity occupation classification who received essential training to perform their jobs, and in cases in which such training is not received, information on what challenges, if any, were encountered with respect to the provision of such training.
    - (F) <ins>Information on recruiting costs incurred with respect to efforts to fill cybersecurity positions across the Department in a manner that allows for tracking of overall recruiting and identifying areas for better coordination and leveraging of resources within the Department.</ins>
- (c) Workforce strategy—
  - (1) In general— Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of the cybersecurity workforce of the Department of Homeland Security.
  - (2) Contents— The comprehensive workforce strategy developed under paragraph (1) shall include—
    - (A) a multiphased recruitment <del>plan; and</del><ins>plan, including relating to experienced professionals, members of disadvantaged or underserved communities, the unemployed, and veterans;</ins>
    - (B) <ins>a 5-year implementation plan; and</ins>
    - (C) [was (4)(3)(4)] a 10-year projection of Federal workforce needs.
- (d) Information security training— Not later than 270 days after the date of the enactment of this Act, the Secretary of Homeland Security shall establish and maintain a process to verify on an ongoing basis that individuals employed by independent contractors who serve in cybersecurity positions at the Department of Homeland Security receive initial and recurrent information security training comprised of general security awareness training necessary to perform their job functions, and role-based security training that is commensurate with assigned responsibilities. The Secretary shall <del>monitor and </del>maintain documentation to ensure that training provided to an individual under this subsection meets or exceeds requirements for such individual’s job function.
- (e) Updates— Together with the submission to Congress of annual budget requests, the Secretary of Homeland Security shall provide updates regarding the cybersecurity workforce assessment required under subsection (b), information on the progress of carrying out the comprehensive workforce strategy developed under subsection (c), and information on the status of the implementation of the information security training required under subsection (d).
- (f) <ins>GAO study—</ins> <ins>The Secretary of Homeland Security shall provide the Comptroller General of the United States with information on the cybersecurity workforce assessment required under subsection (a) and progress on carrying out the comprehensive workforce strategy developed under subsection (c). The Comptroller General shall submit to the Secretary, the Committee on Homeland Security of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate a study on such assessment and strategy.</ins>

## Sec. 3 Cybersecurity Fellowship Program

- <del>In </del><ins>Not later than 120 days after the date of the enactment of </ins>this Act, the <del>term cybersecurity mission means activities that encompass </del><ins>Secretary of Homeland Security shall submit to </ins>the <del>full range </del><ins>Committee on Homeland Security </ins>of <del>threat reduction, vulnerability reduction, deterrence, incident response, resiliency, </del><ins>the House of Representatives </ins>and <del>recovery activities to foster </del>the <del>security </del><ins>Committee on Homeland Security </ins>and <del>stability </del><ins>Governmental Affairs </ins>of <del>cyberspace.</del><ins>the Senate a report on the feasibility of establishing a Cybersecurity Fellowship Program to offer a tuition payment plan for undergraduate and doctoral candidates who agree to work for the Department of Homeland Security for an agreed-upon period of time.</ins>

## Sec. 4 Definition — added

- <ins>In this Act, the term “cybersecurity mission” means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.</ins>