General Authority .—
The Secretary of Defense may—
establish, as positions in the excepted service, such qualified positions in the Department of Defense as the Secretary determines necessary to carry out the responsibilities of the United States Cyber Command, including—
positions held by staff of the headquarters of the United States Cyber Command;
positions held by elements of the United States Cyber Command enterprise relating to cyberspace operations, including elements assigned to the Joint Task Force-Department of Defense Information Networks;
positions held by elements of the military departments supporting the United States Cyber Command;
positions held in combatant commands, defense agencies, and field activities supporting the United States Cyber Command; and
up to 500 positions not otherwise described in clauses (i) through (iv) that the Secretary determines are hard-to-fill, highly skilled positions critical to cyberspace planning and operations in defense of, and which advance, U.S. national interests in collaboration with domestic and international partners.
appoint an individual to a qualified position (after taking into consideration the availability of preference eligibles for appointment to the position); and
subject to the requirements of subsections (b) and (c), fix the compensation of an individual for service in a qualified position.
The authority of the Secretary under this subsection applies without regard to the provisions of any other law relating to the appointment, number, classification, or compensation of employees.
Rates of Pay .—
The Secretary—
consistent with paragraph (2), shall fix the rates of basic pay for employees appointed under subsection (a)(1)(B)—
with a rate of pay provided for employees in comparable positions in the Federal Government; and
subject to the same limitations on maximum rates of pay established for such employees by statute or regulation; and
section 5312 of title 5 may prescribe a rate of basic pay for such an employee so appointed at a rate not to exceed a rate equal to 150 percent of the maximum rate of basic pay authorized for positions at level I of the Executive Schedule under .
Additional Compensation, Incentives, and Allowances .—
The Secretary may provide employees in qualified positions compensation (in addition to basic pay), including benefits, incentives, and allowances, consistent with, and not in excess of the level authorized for, comparable positions authorized by title 5.
section 5941 of title 5 An employee in a qualified position whose rate of basic pay is fixed under subsection (b)(1) shall be eligible for an allowance under on the same basis and to the same extent as if the employee was an employee covered by such section, including eligibility conditions, allowance rates, and all other terms and conditions in law or regulation.
Implementation Plan Required .—
The authority granted in subsection (a) shall become effective 30 days after the date on which the Secretary of Defense provides to the congressional defense committees a plan for implementation of such authority. The plan shall include the following:
An assessment of the current scope of the positions covered by the authority.
A plan for the use of the authority.
An assessment of the anticipated workforce needs of the United States Cyber Command across the future-years defense plan.
Other matters as appropriate.
Collective Bargaining Agreements .—
Nothing in subsection (a) may be construed to impair the continued effectiveness of a collective bargaining agreement with respect to an office, component, subcomponent, or equivalent of the Department that is a successor to an office, component, subcomponent, or equivalent of the Department covered by the agreement before the succession.
Training .—
The Secretary shall provide training to covered personnel on hiring and pay matters relating to authorities under this section.
For purposes of this subsection, covered personnel are employees of the Department who—
carry out functions relating to—
the management of human resources and the civilian workforce of the Department; or
the writing of guidance for the implementation of authorities regarding hiring and pay under this section; or
are employed in supervisory positions or have responsibilities relating to the hiring of individuals for positions in the Department and to whom the Secretary intends to delegate authority under this section.
Required Regulations .—
The Secretary, in coordination with the Director of the Office of Personnel Management, shall prescribe regulations for the administration of this section.
Annual Report .—
Not later than one year after the date of the enactment of this section and not less frequently than once each year thereafter until the date that is three years after the date of the enactment of the National Defense Authorization Act for Fiscal Year 2026, the Director of the Office of Personnel Management, in coordination with the Secretary, shall submit to the appropriate committees of Congress a detailed report on the administration of this section during the most recent one-year period.
Each report submitted under paragraph (1) shall include, for the period covered by the report, the following:
A discussion of the process used in accepting applications, assessing candidates, ensuring adherence to veterans’ preference, and selecting applicants for vacancies to be filled by an individual for a qualified position.
A description of the following:
How the Secretary plans to fulfill the critical need of the Department to recruit and retain employees in qualified positions.
The measures that will be used to measure progress.
Any actions taken during the reporting period to fulfill such critical need.
A discussion of how the planning and actions taken under subparagraph (B) are integrated into the strategic workforce planning of the Department.
The metrics on actions occurring during the reporting period, including the following:
The number of employees in qualified positions hired, disaggregated by occupation, grade, and level or pay band.
The placement of employees in qualified positions, disaggregated by military department, Defense Agency, or other component within the Department.
The total number of veterans hired.
The number of separations of employees in qualified positions, disaggregated by occupation and grade and level or pay band.
The number of retirements of employees in qualified positions, disaggregated by occupation, grade, and level or pay band.
The number and amounts of recruitment, relocation, and retention incentives paid to employees in qualified positions, disaggregated by occupation, grade, and level or pay band.
The total number of positions, the title, duties, and responsibilities of each position, and the location of each position, including the assigned department, agency, command, and cost of establishing, appointing, and paying the salary of such positions.
A description of—
how the Department has used the pay authorities in subsection (b); and
the effect of such authorities on recruitment and retention in the Cyber Excepted Service.
A description of the training provided to employees described in subsection (f)(2) on the use of authorities under this section.
Three-year Probationary Period .—
The probationary period for all employees hired under the authority established in this section shall be three years.
Incumbents of Existing Competitive Service Positions .—
An individual occupying a position on the date of the enactment of this section that is selected to be converted to a position in the excepted service under this section shall have the right to refuse such conversion.
After the date on which an individual who refuses a conversion under paragraph (1) stops serving in the position selected to be converted, the position may be converted to a position in the excepted service.
Federal Wage System Positions .—
The Secretary may—
section 5341 of title 5 consistent with , adopt such provisions of that title to provide for prevailing rate systems of basic pay; and
apply those provisions to qualified positions for employees in or under which the Department may employ individuals described by section 5342(a)(2)(A) of such title.
Definitions .—
In this section:
The term “appropriate committees of Congress” means—
the Committee on Armed Services, the Committee on Homeland Security and Governmental Affairs, and the Committee on Appropriations of the Senate; and
the Committee on Armed Services, the Committee on Oversight and Government Reform, and the Committee on Appropriations of the House of Representatives.
section 7103(a)(8) of title 5 The term “collective bargaining agreement” has the meaning given that term in .
section 2103 of title 5 The term “excepted service” has the meaning given that term in .
section 2108(3) of title 5 The term “preference eligible” has the meaning given that term in .
The term “qualified position” means a position, designated by the Secretary for the purpose of this section, in which the individual occupying such position performs, manages, or supervises functions that execute the responsibilities of the United States Cyber Command relating to cyber operations.
section 2101a of title 5 The term “Senior Executive Service” has the meaning given that term in .
Pub. L. 114–92, div. A, title XI, § 1107(a)129 Stat. 1024 Pub. L. 114–328, div. A, title XI, § 1103(a)130 Stat. 2444 Pub. L. 119–60, div. A, title XI, § 1113139 Stat. 1077 (Added , , ; amended , (b)(2), , ; , , .)
Editorial Notes
References in Text
Pub. L. 119–60The date of the enactment of the National Defense Authorization Act for Fiscal Year 2026, referred to in subsec. (h)(1), is the date of enactment of , which was approved .
Pub. L. 114–92The date of the enactment of this section, referred to in subsec. (j)(1), is the date of enactment of , which was approved .
Amendments
Pub. L. 119–60, § 1113(1)2025—Subsec. (a)(1)(A)(iv), (v). , added cls. (iv) and (v).
Pub. L. 119–60, § 1113(2)Subsec. (b). , amended subsec. (b) generally. Prior to amendment, subsec. (b) related to basic pay.
Pub. L. 119–60, § 1113(3)(A)Subsec. (h)(1). , substituted “three years after the date of the enactment of the National Defense Authorization Act for Fiscal Year 2026” for “five years after the date of the enactment of this section”.
Pub. L. 119–60, § 1113(3)(B)Subsec. (h)(2)(D)(vii), (viii). , added cls. (vii) and (viii).
lPub. L. 119–60, § 1113(4)lSubsecs. (k), (). , (5), added subsec. (k) and redesignated former subsec. (k) as ().
Pub. L. 114–328, § 1103(a)2016—Subsecs. (f), (g). , added subsec. (f) and redesignated former subsec. (f) as (g). Former subsec. (g) redesignated (h).
Pub. L. 114–328, § 1103(a)(1)Subsec. (h). , redesignated subsec. (g) as (h). Former subsec. (h) redesignated (i).
Pub. L. 114–328, § 1103(b)(2)Subsec. (h)(2)(E). , substituted “employees described in subsection (f)(2) on the use of authorities under this section” for “supervisors of employees in qualified positions at the Department on the use of the new authorities”.
Pub. L. 114–328, § 1103(a)(1)Subsecs. (i) to (k). , redesignated subsecs. (h) to (j) as (i) to (k), respectively.
Statutory Notes and Related Subsidiaries
Change of Name
Committee on Oversight and Government Reform of House of Representatives changed to Committee on Oversight and Reform of House of Representatives by House Resolution No. 6, One Hundred Sixteenth Congress, . Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, .
Department of Defense Cyber Workforce Efforts
Pub. L. 116–283, div. A, title XVII, § 1726(a)134 Stat. 4115 Pub. L. 118–31, div. A, title XV, § 1531(c)(4)137 Stat. 563
Resources for Cyber Education.—
In general .—
The Chief Information Officer of the Department of Defense, in consultation with the Director of the National Security Agency (NSA), shall examine the current policies permitting National Security Agency employees to use up to 140 hours of paid time toward NSA’s cyber education programs.
Report.—
In general .—
Not later than 90 days after the date of the enactment of this Act [], the Chief Information Officer shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] and the congressional intelligence committees a strategy for expanding the policies described in paragraph (1) to—
section 1599f of title 10 individuals who occupy positions described in , United States Code; and
any other individuals who the Chief Information Officer determines appropriate.
Implementation plan .—
Public Law 116–92133 Stat. 1758 The report required under subparagraph (A) shall detail the utilization of the policies in place at the National Security Agency, as well as an implementation plan that describes the mechanisms needed to expand the use of such policies to accommodate wider participation by individuals described in such subparagraph. Such implementation plan shall detail how such individuals would be able to connect to the instructional and participatory opportunities available through the efforts, programs, initiatives, and investments accounted for in the report required under section 1649 of the National Defense Authorization Act for Fiscal Year 2020 ( []), including the following programs:
GenCyber.
Centers for Academic Excellence – Cyber Defense.
Centers for Academic Excellence – Cyber Operations.
Deadline .—
Not later than 120 days after the submission of the report required under subparagraph (A), the Chief Information Officer of the Department of Defense shall carry out the implementation plan contained in such report.
Discharge Through Director .—
section 2192c of title 10In carrying out this section, the Chief Information Officer of the Department of Defense shall act through the Director of the office established under , United States Code.”
section 1726 of Pub. L. 116–283Pub. L. 118–31, div. A, title XV, § 1531(c)(4)137 Stat. 563 section 2224 of this title[Subsec. (b) of , set out above, was added by , , . Another subsec. (b) of section 1726 is set out as a note under .]
Zero-Based Review of Department of Defense Cyber and Information Technology Personnel
Pub. L. 116–92, div. A, title XVI, § 1652133 Stat. 1761
Review Required .—
Not later than , each head of a covered department, component, or agency shall—
complete a zero-based review of the cyber and information technology personnel of the head’s covered department, component, or agency; and
provide the Principal Cyber Advisor, the Chief Information Officer of the Department of Defense, and the Under Secretary of Defense for Personnel and Readiness the findings of the head with respect to the head’s covered department, component, or agency.
Covered Departments, Components, and Agencies .—
For purposes of this section, a covered department, component, or agency is—
an independent Department of Defense component or agency;
the Office of the Secretary of Defense;
a component of the Joint Staff;
a military department or an armed force; or
a reserve component of the Armed Forces.
Scope of Review .—
As part of a review conducted pursuant to subsection (a)(1), the head of a covered department, component, or agency shall, with respect to the covered department, component, or agency of the head—
assess military, civilian, and contractor positions and personnel performing cyber and information technology missions;
determine the roles and functions assigned by reviewing existing position descriptions and conducting interviews to quantify the current workload performed by military, civilian, and contractor workforce;
compare the Department’s manning with the manning of comparable industry organizations;
include evaluation of the utility of cyber- and information technology-focused missions, positions, and personnel within such components—
to assess the effectiveness and efficiency of current activities;
to assess the necessity of increasing, reducing, or eliminating resources; and
to guide prioritization of investment and funding;
develop recommendations and objectives for organizational, manning, and equipping change, taking into account anticipated developments in information technologies, workload projections, automation and process enhancements, and Department requirements;
develop a gap analysis, contrasting the current organization and the objectives developed pursuant to paragraph (5); and
develop roadmaps of prioritized activities and a timeline for implementing the activities to close the gaps identified pursuant to paragraph (6).
Elements .—
In carrying out a review pursuant to subsection (a)(1), the head of a covered department, component, or agency shall consider the following:
Whether position descriptions and coding designators for given cybersecurity and information technology roles are accurate indicators of the work being performed.
Whether the function of any cybersecurity or information technology position or personnel can be replaced by acquisition of cybersecurity or information technology products or automation.
Whether a given component or subcomponent is over- or under-resourced in terms of personnel, using industry standards as a benchmark where applicable.
Whether cybersecurity service provider positions and personnel fit coherently into the enterprise-wide cybersecurity architecture and with the Department’s cyber protection teams.
Whether the function of any cybersecurity or information technology position or personnel could be conducted more efficiently or effectively by enterprise-level cyber or information technology personnel.
Furnishing Data and Analysis.—
Data and analysis .—
In carrying out subsection (a)(2), each head of a covered department, component, or agency, shall furnish to the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary a description of the analysis that led to the findings submitted under such subsection and the data used in such analysis.
Certification .—
The Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary of Defense shall jointly review each submittal under subsection (a)(2) and certify whether the findings and analysis are in compliance with the requirements of this section.
Recommendations .—
After receiving findings submitted by a head of a covered department, component, or agency pursuant to paragraph (2) of subsection (a) with respect to a review conducted by the head pursuant to paragraph (1) of such subsection, the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary shall jointly provide to such head such recommendations as the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary may have for changes in manning or acquisition that proceed from such review.
Implementation .—
The Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary shall jointly oversee and assist in the implementation of the roadmaps developed pursuant to subsection (c)(7) and the recommendations developed pursuant to subsection (f).
In-progress Reviews .—
Not later than six months after the date of the enactment of this Act [] and not less frequently than once every six months thereafter until the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary give the briefing required by subsection (i), the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary shall jointly—
conduct in-progress reviews of the status of the reviews required by subsection (a)(1); and
provide the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] with a briefing on such in-progress reviews.
Final Briefing .—
After all of the reviews have been completed under paragraph (1) of subsection (a), after receiving all of the findings pursuant to paragraph (2) of such subsection, and not later than , the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary shall jointly provide to the congressional defense committees a briefing on the findings of the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary with respect to such reviews, including such recommendations as the Principal Cyber Advisor, the Chief Information Officer, and the Under Secretary may have for changes to the budget of the Department as a result of such reviews.
Definition of Zero-based Review .—
In this section, the term ‘zero-based review’ means a review in which an assessment is conducted with each item, position, or person costed anew, rather than in relation to its size or status in any previous budget.”
Actions Pending Full Implementation of Plan for Cyber Mission Force Positions
Pub. L. 114–328, div. A, title XVI, § 1643(a)130 Stat. 2602
section 1599f of title 10“Until the Secretary of Defense completes implementation of the authority in subsection (a) of , United States Code, for United States Cyber Command workforce positions in accordance with the implementation plan required by subsection (d) of such section, the Secretary shall do each of the following:“(1) “(2) “(3) “(4)
, , , provided that:
Notwithstanding sections 3309 through 3318 of title 5, United States Code, provide for and implement an interagency transfer agreement between excepted service position systems and competitive service position systems in military departments and Defense Agencies concerned to satisfy the requirements for cyber workforce positions from among a mix of employees in the excepted service and the competitive service in such military departments and Defense Agencies.
Implement in the defense civilian cyber personnel system a classification system commonly known as a ‘Rank-in-person’ classification system similar to such classification system used by the National Security Agency as of the date of the enactment of this Act [].
section 3304 of title 5 Approve direct hiring authority for cyber workforce positions up to the GG or GS–15 level in accordance with the criteria in , United States Code.
section 5333 of title 5 Notwithstanding , United States Code, authorize officials conducting hiring in the competitive service for cyber workforce positions to set starting salaries at up to a step-five level with no justification and at up to a step-ten level with justification that meets published guidelines applicable to the excepted service.”