This bill changes how the federal government hires cybersecurity experts by making it easier for people without traditional college degrees to get these jobs. Right now, many government agencies require applicants to have a specific level of education—like a bachelor's degree—even if someone has real-world cybersecurity skills and experience that prove they can do the job.

Under this new law, federal agencies can no longer set their own education requirements for cybersecurity positions unless a state or local law specifically requires it. Instead, they have to focus on whether an applicant actually has the skills and knowledge needed for the specific job, regardless of how they got that knowledge. This means someone who learned cybersecurity through work experience, certifications, or bootcamps could compete for federal cybersecurity jobs on equal footing with someone who has a college degree.

The bill affects federal jobs in IT management and any position officially labeled as a cybersecurity role. To keep track of how this change works out, the government's Office of Personnel Management has to publish yearly reports showing what education requirements exist for these jobs and what education level people actually have when they're hired. The goal is to help the government find the best cybersecurity talent available, rather than automatically screening out qualified people just because they didn't follow the traditional college route.

Modernizing the Acquisition of Cybersecurity Experts Act of 2023

Mace, Nancy

Modernizing the Acquisition of Cybersecurity Experts Act This bill modifies educational requirements for cybersecurity positions in the federal government. Specifically, the bill prohibits federal agencies from establishing minimum educational requirements for cybersecurity positions unless such requirements are mandated by law for the position in the state or locality in which the work is to be performed. Agencies may also only consider an applicant's education in conjunction with other minimum qualifications for a position if the applicant's education directly reflects the required competencies for the position. The bill applies to positions in the competitive service that are classified under the Information Technology Management Series or any other position that is designated as a cybersecurity position under the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. The Office of Personnel Management must annually publish on its website (1) any changes to minimum qualifications relating to education for these positions, and (2) data on the level of education of those occupying these positions.