What the White House cyber summit’s training pledges left for agencies to fix

The week

On August 25, 2021, President Biden sat down at the White House with a room full of chief executives. They came from technology, finance, insurance, energy and education companies, along with leaders from educational institutions. The subject was cybersecurity: the work of keeping computer systems, networks and the data inside them safe from criminals and hostile governments.

The months before the meeting

The timing was not accidental. Cybersecurity had moved from the IT department to the front page, and the meeting was meant to show that government and industry would act together. The SolarWinds compromise, disclosed in December 2020, had reached federal agencies through a trusted software update. In May 2021, a ransomware attack led Colonial Pipeline to shut down a fuel pipeline that supplies much of the East Coast for several days. Days later, the President signed Executive Order 14028 on improving the nation’s cybersecurity. In early July, criminals used remote management software from the vendor Kaseya to push ransomware to managed service providers and, through them, to their customers.

The administration had also been building its own machinery. The Senate confirmed the first National Cyber Director in June. On July 28, a national security memorandum formalized an initiative to improve the security of the control systems that run critical infrastructure. On August 10, two weeks before the summit, the Senate passed the infrastructure bill that would later create a State and Local Cybersecurity Grant Program worth about $1 billion over four years. The money had not reached anyone yet, and the bill was not yet law.

What was pledged

The way to show joint action was with commitments, and participants announced several.

Microsoft said it would invest $20 billion over five years in security. It also said it would make $150 million in technical services available to federal, state and local governments, along with expanded partnerships with community colleges and nonprofits for training. Google said it would invest $10 billion over five years in areas including zero trust and software supply chain security. Zero trust is a design approach in which no user or device is trusted automatically just because it is inside the office network; every request has to prove who it is. Software supply chain security is about making sure the code a company buys or borrows from others has not been tampered with along the way. Google also said it would help 100,000 Americans earn industry-recognized digital skills certificates.

IBM said it would train 150,000 people in cybersecurity skills over three years and work with more than 20 historically Black colleges and universities to set up cybersecurity leadership centers. Amazon said it would make its employee security awareness training available to the public at no charge and give its cloud account holders a multi-factor authentication device at no extra cost. Apple announced a program to improve security across its supply chain.

Education groups made their own pledges. Code.org said it would teach cybersecurity concepts to more than 3 million students over three years. Girls Who Code announced a micro-credential program for groups historically excluded from technology. The University of Texas System said it would expand short-term cyber credentials. Whatcom Community College in Washington State was named the National Science Foundation’s new national cybersecurity center for technical education, with a remit to train faculty and move students faster from college to career.

Two cyber insurers made commitments that pointed somewhere else. Resilience said it would require policyholders to meet a threshold of security practices to get coverage. Coalition said it would offer its risk assessment and continuous monitoring platform free to any organization.

What the government added

The administration added two pieces of its own. It said NIST, the National Institute of Standards and Technology, the federal agency that writes widely used technical standards and guidance, would work with industry on a framework for technology supply chain security. And it said its initiative on industrial control systems would expand from electric utilities to natural gas pipelines. Industrial control systems are the computers that run physical equipment: the pumps at a water plant, the switches on a power grid, the signals on a transit line.

What the pledges did not touch

For anyone running a public agency, the headline numbers were striking. The training pledges in particular spoke to a problem that every state, county and city security chief already knew well: there were not enough skilled people to go around. The fact sheet said nothing about civil service rules, public pay scales or how long it takes a county to make an offer. Nor did it say how a graduate of a new program in Texas or Washington State would find, and accept, a vacancy in a particular county or city. What the summit could not answer was whether more trained people nationally would translate into more filled seats in a particular agency’s security team.

Take the chief information security officer of a mid-sized state agency in the fall of 2021. She has read the summit coverage. Hundreds of thousands of people are going to be trained. And yet she has had a senior security engineer post open for nine months. Two analysts are covering every alert between them, and her best incident responder has just told her that a contractor has offered him a great deal more money.

The training pledges were real, and some were large. They answered a widely acknowledged shortage of cybersecurity workers. For a state agency, a county or a city, though, the shortage was never one problem. It had three parts, each with different owners and different fixes: supply, whether enough people with the right skills exist; access, whether the agency can hire them; and retention, whether it can keep them once hired. Corporate pledges worked on the first. The second and third were where most agencies lost candidates, and both sat inside government.

The argument below starts with what a security team does, because the shortage is uneven across its jobs. It then takes supply, access and retention in turn. It closes with what a thin team costs and how to assign each kind of failure to the office that can fix it.

What a security team actually does

“Cybersecurity” covers a surprising range of jobs, and the shortage is not spread evenly across them.

The work falls into a few families of jobs:

• Security engineers design and configure defenses. Increasingly that means securing cloud tenants: the agency’s rented space inside a provider such as Microsoft or Amazon, where settings chosen by the agency decide who can see what.
• Analysts in a security operations center, or SOC, watch alerts generated by monitoring tools and decide which are real. Most are harmless; the skill lies in spotting the few that are not.
• Incident responders take over when an attack is confirmed, for example when ransomware, malicious software that scrambles files and demands payment to unscramble them, starts spreading.
• Identity specialists manage who has which accounts and permissions, which is where many attacks begin, since stealing a password is often easier than breaking a lock.
• Control systems specialists understand the industrial equipment in water, power and transit agencies, where a mistake can affect physical safety rather than just data.
• Governance and compliance staff translate rules and audits into practice and keep the evidence that the controls work.

These roles are not interchangeable. A newly certified analyst can begin triaging alerts with supervision. He cannot redesign a cloud environment or lead the response to a ransomware attack on day one. When people talk about “the shortage,” they usually mean experienced people in the harder roles, and that matters a great deal for what training can and cannot fix.

A shared vocabulary already existed

Agencies did not have to invent these categories. NIST’s NICE Workforce Framework for Cybersecurity, revised in November 2020, describes security work as a set of work roles, each with tasks, knowledge and skills. It gives a human resources office and a security chief a common language. A classification analyst who does not know what an identity engineer does can read the framework’s description and compare it with the agency’s job titles.

Mapping each current position to a framework role is a modest exercise, often a few days of work. It shows which roles the agency has, which it lacks, and which are buried inside general IT jobs. It also makes job postings legible to candidates who trained against the same framework.

How the mix differs by kind of agency

The mix of roles depends on what the agency runs. A state department of revenue handles federal tax information and needs governance staff who know the IRS safeguards rules in Publication 1075. A county sheriff’s office handles criminal justice information under the FBI’s CJIS Security Policy, which sets its own requirements for personnel and access. A water or transit authority needs control systems expertise that most IT security staff do not have. A public university runs open networks for thousands of students and needs analysts comfortable with that noise. A federal agency has its own hiring authorities and pay systems, which differ from all of these.

The shortage feels different in each. A city of 50,000 may need one generalist who can do a little of everything. A large state agency can specialize. The smaller the team, the more each departure removes a whole capability, not a share of one.

Supply: training fills the pipeline, slowly

Expanding the pool of people with security skills is necessary. Certificates, apprenticeships, community college programs and university partnerships all add to it, and the summit commitments joined many state and university programs launched around the same time.

The limits are timing and level. Training produces entry-level candidates. What most agencies lacked in 2021 were experienced people: engineers who could secure cloud tenants, incident responders, identity specialists, and people who understood the control systems in water and transit agencies. Those roles take years of practice on top of any course. Supply programs pay off over a decade. They do not fill a senior vacancy this budget year.

If a hospital is short of experienced surgeons, opening more places in medical school is the right long-term move, but it does nothing for next month’s operating schedule. The new graduates still need residency and years of supervised practice. Security works the same way. A certificate shows someone has learned the vocabulary and the basics; judgment comes from handling real incidents alongside people who have handled many before.

The experience gap in the middle

A training pipeline also creates a problem of its own. Many security job postings, public and private, ask for several years of experience even at junior levels. A graduate with a new certificate and no experience may find few roles open to her. The pipeline then fills at the entry end while the middle stays empty, because nobody is turning beginners into practitioners.

Closing that gap is work that only employers can do. It takes entry-level roles designed to be learned on the job, and senior people with time set aside to supervise. That supervision is the hidden cost. An agency with four security staff that takes on two trainees has, for the first six months, less capacity rather than more. Leaders who expect apprentices to relieve workload immediately will be disappointed and may end the program before it pays off.

Building a local pipeline

Agencies can still shape supply locally. Paid internships with the state university help. So do apprenticeship slots that rotate through the security team and partnerships with community colleges in the agency’s own region. Together they build a pipeline of people who already know public sector systems and are more likely to stay nearby. The measure that matters is the number of qualified applicants per posting, tracked over time, not the number of people trained nationally.

Formal structures help. A registered apprenticeship, approved through the US Department of Labor or a state apprenticeship agency, sets out a schedule of on-the-job learning, related classroom instruction and a wage that rises as skills grow. It gives the apprentice a recognized credential at the end. It also gives the agency a documented program that a civil service system can recognize as a route into a permanent position, which ad hoc internships often lack.

Say a county runs a water utility, a jail, a property tax office and a sheriff’s department, all on a shared network looked after by a security team of four. Rather than waiting for national programs to produce candidates, the county agrees with the local community college to take two paid apprentices a year. Each apprentice spends six months watching alerts under supervision, six months with the network team and some time at the water plant learning how its control systems work. After two years the county has people who know its systems, its rules and its community. Not every apprentice stays, but the county now sees more qualified applicants for each opening than it did before, and that is the number its leaders watch.

The pool already on the payroll

The most overlooked source of supply is the agency’s own IT staff. A network administrator, a systems engineer or a help desk lead already knows the agency’s systems, has passed its background checks and has chosen public service. Many have picked up security skills on the job. Moving one of them into a security role takes training and a backfill for the old job, but it avoids the recruiting market entirely.

Internal moves need structure to work. The agency has to post a development path, fund training, and accept that the old role will be vacant for a while. Human resources may need a classification that allows a trainee grade within the security series. Done well, internal mobility also improves retention elsewhere in IT, because staff can see a route upward without leaving. The trade-off is that it moves the vacancy rather than removing it, so it works best when the role left behind is easier to fill than the security one.

Using regional and state capacity

Small jurisdictions cannot each run a training program. A state can. Some states run shared security operations centers, cyber ranges where staff practice against simulated attacks, or rotational programs that place trainees in several agencies. A regional council of governments or a state association of counties can pool apprentices across members. The infrastructure bill’s grant program, once funded, required states to set up planning committees with local representation, which gave counties and cities a forum to ask for shared workforce help. Each of these spreads the supervision cost across more employers.

Access: hiring rules written for another labor market

The second part is whether an agency can hire people who are available. This is where many public employers lose the candidates they already have, often without noticing.

Public hiring processes often take months. Job classifications in many civil service systems predate cloud security and identity engineering, so agencies squeeze those roles into general IT titles whose pay bands do not match the market. Minimum qualifications often require a specific degree or years in a narrowly defined role, which screens out strong candidates from the military, help desks or self-taught backgrounds. Positions needing background checks or clearances add more months, during which candidates take other offers.

A job classification, for readers outside government, is the official definition of a role: its title, duties, minimum qualifications and pay range. Civil service systems use classifications to keep hiring fair and consistent, which is a worthy goal. The trouble is that classifications are slow to change, and a system written when “IT” meant mainframes and desktop support may have no natural home for someone who secures cloud identity systems. So the agency posts the job under a generic title, at a generic salary, with qualifications that do not describe the work. Good candidates either do not apply or do not get through the first screen.

How a hiring process loses people

The delays have identifiable sources. A requisition needs budget approval before posting. The posting stays open for a fixed period. Human resources screens applications against the minimum qualifications, often on paper credentials alone. In some merit systems, the hiring manager may interview only the top-ranked candidates from a certified list, with veterans’ preference points applied. Interviews must be scheduled with a panel. The offer goes through compensation review. Then the background check begins.

Each step exists for a reason: fairness, budget control, merit, public trust. Together they can take longer than a strong candidate is willing to wait. Private employers in the same market often move from first interview to offer in a few weeks. The candidate who applied to both rarely waits for the slower one.

Background checks that apply by rule

Some delays are required by rules outside the agency’s control, and agencies should know which. Staff with unescorted access to unencrypted criminal justice information must pass a fingerprint-based record check under the CJIS Security Policy. Agencies that receive federal tax information must run background investigations under IRS Publication 1075 for staff with access to it. Federal positions may need a security clearance, which can take many months. A county security engineer who administers the network for both the sheriff and the treasurer may fall under both of the first two.

The requirement cannot be skipped, but its timing can be managed. A conditional offer can start the check on the first day. Duties that do not touch the protected data can begin while it runs, where the rules allow. Candidates can be told the expected timeline at the first interview, so the wait is not a surprise.

How the rules differ by employer

Access problems are not uniform across government. Federal agencies work under federal personnel law and had tools that most states lacked, including direct-hire authorities for some IT security roles that let them skip parts of the usual ranking process. DHS’s new talent system, launched that November, went further for its own positions. Even so, federal hiring was widely described as slow.

State agencies usually work within a statewide civil service system, so one agency cannot change its own classifications. A change for security roles has to be made centrally and then applies to every department. The change is slower to start but helps every department once made. Counties and cities may have their own merit systems, set by charter or ordinance, or may follow state rules. Special districts and public authorities, such as transit, port and water authorities, often have more flexibility in pay and hiring. Public universities may hire some technical staff outside the classified service altogether.

The practical consequence is that the first step differs. A state agency’s security chief needs to engage the central personnel office. A transit authority’s may be able to act within its own board’s policies. Knowing which body sets the rule is half of getting it changed.

Fixes that cost little money

Fixes exist and cost little money, but they sit outside the IT department. Skills-based qualifications and practical assessments replace degree requirements. Security-specific job classifications with their own pay ranges replace borrowed IT titles. Pre-approved pay flexibilities, such as hiring above the band minimum for hard-to-fill roles, shorten negotiation. Conditional offers that start onboarding while a background check runs keep candidates warm.

A skills-based assessment means testing what someone can do rather than what credentials they hold. Instead of requiring a computer science degree, the agency might ask candidates to review a set of real-looking alerts and explain which ones matter and why. Another test asks them to find the weaknesses in a sample network design. A former Army signals specialist or a help-desk technician who has taught herself security at night may outperform a graduate on that test, and under a degree rule she would never have been seen.

Assessments carry obligations of their own. A test used to screen public employees must be job-related and applied consistently, and the agency should be able to show that it measures the work. Designing one well takes time from the security team and review from human resources. Once built, it can be reused across many postings and shared with neighboring jurisdictions.

The federal government moved in this direction when the Department of Homeland Security launched a new Cybersecurity Talent Management System in November 2021, with competency-based screening and competitive pay for its own hiring. Most state and local agencies had nothing comparable.

Why the levers sit elsewhere

A new classification usually requires a study by the human resources department, a comparison with market pay, approval by a civil service board or commission, and money in the next budget. Where staff are unionized, the change may also need bargaining, since classifications and pay ranges are often part of the contract. A raise for security staff can create pay compression with other IT staff who see their colleagues paid more for similar-looking titles. Each of these steps is legitimate, and each needs an owner outside IT.

Because these levers belong to civil service commissions, human resources departments and budget offices, the chief information security officer needs a sponsor there. The useful measures are time from posting to accepted offer, offer acceptance rate, and the share of candidates screened out by formal qualifications rather than skills.

Retention: keeping people the market wants

The third part is retention. Agencies offer mission, stability, pensions and often better hours. They usually cannot match private pay for experienced security staff, and people trained by agencies are attractive to contractors and private employers, sometimes the agency’s own vendors.

There is an uncomfortable dynamic here. The better an agency is at developing people, the more attractive those people become to everyone else. An analyst who has spent three years learning the agency’s systems and handling its incidents is exactly the person a contractor wants to bid back to the same agency at a higher rate.

Pay is only one driver. People leave security teams that are too small for the work, where two analysts carry every alert, every audit response and every night of on-call. They leave when tools are outdated and when there is no path upward without moving into management. Agencies can address these directly. Automating routine work, such as patch reporting and alert triage, frees time for engineering. Retention bonuses or certification pay tied to service commitments help at the margin. A technical career ladder lets an engineer advance without supervising anyone. Hybrid or remote work, where security rules allow it, widens the area from which an agency can recruit and keep staff.

A technical career ladder deserves a word of explanation, because it is one of the cheapest and most overlooked fixes. In many public pay structures, the only way to earn more is to manage more people. That forces a choice on the best engineers: stop doing the work they are good at, or leave. A technical ladder creates senior and principal engineer grades that pay like management roles but keep the person hands-on. Many private employers have used this model for years.

The terms of the job, beyond salary

Several smaller terms shape whether security staff stay. On-call work is one. Whether an analyst is paid for nights on call depends on how the role is classified under federal wage-and-hour rules and on the agency’s own policies. An exempt employee covering every other weekend without extra pay is a likely departure. A rotation large enough to spread the load, or a contracted overnight service, changes that.

Training budgets are another. Security skills age quickly, and staff who cannot attend courses or sit certification exams fall behind and know it. Some employers pair paid training with a repayment agreement if the employee leaves within a set period. Whether such agreements are enforceable for public employees varies by state, so agencies should check with counsel first.

Pensions cut both ways. A defined benefit pension rewards long service and holds people who are already vested. It does little to attract a mid-career engineer who expects to stay five years, and it can be a reason for such a person to choose a private employer with higher current pay. Residency rules, where a jurisdiction still requires staff to live within its boundaries, narrow the pool further.

Partners and the in-house core

Partners extend small teams without replacing them. Shared services from the state, regional security operations centers and contracted around-the-clock monitoring take the most draining work off a small in-house team. That model works only if the agency keeps enough in-house expertise to direct providers, read their reports critically and decide what to do. Retention of that core group is what keeps outsourcing safe.

Remote work and its limits

Remote and hybrid work became the norm for many technical staff during the pandemic and remained a major factor in job choice. For a public employer that cannot match private pay, flexibility is one of the few benefits it can offer at no cost. It also lets a rural county hire from a wider area.

Security rules set limits. Access to criminal justice information from outside a secure location must meet the CJIS Security Policy’s requirements for remote access. Work on control systems may need someone on site. Some agencies also have rules on where staff may live or work. A clear policy that says which roles can work remotely, under what controls, is better than case-by-case exceptions that staff see as unfair.

Contracts can support retention too. A managed service contract can state which work the provider does and which decisions stay with agency staff. It can require the provider to share runbooks and lessons learned so in-house staff keep learning. It can also address whether the provider may recruit agency staff during the contract, though counsel should review any such clause.

Exit interviews, read by someone outside the security team, show which of these drivers matter in a given agency. A turnover rate tracked for security roles separately from IT as a whole shows whether the fixes are working.

What a thin security team costs

For a board, a city council or an agency head, the security team’s size and experience have direct consequences. They shape how quickly an agency notices an attack, how long its services are down, and how much citizen data is exposed.

The costs show up in places leaders do care about. A ransomware attack that takes a county’s systems offline can stop property tax payments, delay court hearings and force staff back to paper. Investigations, outside help and rebuilding all cost money that was not in the budget. Residents whose data is stolen lose trust, and regulators, auditors and legislators ask hard questions about what the agency knew and when. Each of those outcomes is more likely when two exhausted analysts are covering everything and the experienced engineer left last spring.

There is also a money question in the hiring process itself. Every month a senior role stays empty, the agency usually pays a contractor more to cover the gap, or simply goes without. The cost of slow hiring rarely appears as a line item, but it is real.

Where the cost becomes visible

Several outside parties now see a thin team before an attack does. Cyber insurers, including the risk pools many local governments use, began asking detailed questions about controls such as multi-factor authentication and backups around this time. One insurer at the summit said it would make coverage depend on meeting a baseline. Answers to those questionnaires depend on staff who can implement and evidence the controls. A team without that capacity pays in premiums, exclusions or declined coverage.

State auditors and federal grant programs ask for evidence too. An audit finding that access reviews were not performed, or that backups were never tested, is often a staffing finding written in control language. Reading audit findings with that in mind tells leaders where the team is stretched.

Measures leaders can follow

A small set of operational measures links staffing to risk. Three are enough to start. One is the time the team takes to detect and contain incidents. The others are the number of critical patches past their deadline and the number of alerts left unreviewed each week. These are not perfect, but they move when the team is short, and they move back when it is staffed. Reported quarterly next to the three workforce measures, they show a council or board what a vacancy is doing.

Matching each failure to its owner

An agency that handles this well tends to share a few traits. It measures the three parts separately. It has a named sponsor in human resources or the civil service commission who owns the access problem alongside the security chief. It has security-specific job titles, skills-based screening and a technical career ladder. It uses partners for round-the-clock monitoring and keeps a small, well-paid core team that can direct them. And it has a local pipeline, however modest, that brings in people who already know the region.

Who owns which part

Ownership can be written down simply. The security chief owns the definition of roles, the design of skills assessments, workload and the in-house core. Human resources owns classifications, screening rules and time to hire. The budget office owns pay ranges and the money for retention measures. The agency head owns the decision to make the case to the legislature, council or board when changes need their approval. Partners in education and at the state own parts of supply. Each owner reports its own measure.

The strongest objections

Three objections deserve an answer. The first holds that outsourcing solves the problem: hire a managed security provider and let it worry about staff. Providers recruit from the same labor market and face the same shortages. Outsourcing moves the hiring problem; it does not remove it. The agency still needs the in-house core described above.

The second holds that pay is the only real lever and everything else is a distraction. Pay matters, and targeted pay for scarce roles is often the right fix. But public budgets move slowly and pay changes ripple across other staff. Faster hiring, skills-based screening and better workload cost far less and can start this year.

The third holds that national training will close the gap given time. It will help at the entry level. Without employers willing to turn beginners into practitioners, it can also produce graduates who cannot find a first job, while senior roles stay open.

Agencies that struggle tend to repeat the same errors:

• Counting only vacancies. The three parts need separate measures because they fail separately. An agency tracking only total vacancies cannot tell whether it lacks applicants, loses them in hiring, or loses them after two years. Each answer points to a different office and a different fix.
• Treating national training as a local solution. A large national program may never send a single graduate to a particular county.
• Leaving hiring rules to IT. The security chief rarely controls classifications, pay bands or qualification rules, so pushing from inside IT alone tends to stall.
• Outsourcing the thinking. Contracted monitoring is valuable, but an agency with nobody left who can challenge a provider’s report is exposed in a new way.
• Ignoring workload. Bonuses do not hold people who are on call every other night.
• Taking on trainees without supervisors. Apprentices without senior time to teach them leave or stall, and the program gets the blame.

Measured separately, the three parts point to different owners. Suppose a regional transit agency finds that its security postings attract a healthy number of applicants, so supply is not its main problem. But its time from posting to accepted offer runs past five months, and nearly half of its offers are declined. That is an access problem, and it belongs with human resources and the background-check process. Meanwhile, a neighboring city fills roles quickly but loses most of its new hires within two years. That is retention, and the answers lie in workload, career paths and pay.

Supply, access or retention: finding an agency’s real gap

Asking these takes no technical knowledge, and the answers show where the problem lies:

1. How many qualified applicants do we get per security posting, and is that number rising or falling?
2. How long, on average, from posting a security job to an accepted offer? Where in that process do we lose the most time?
3. What is turnover for security staff, measured separately from IT as a whole? Who reads the exit interviews?
4. Can a strong engineer get promoted here without becoming a manager?
5. Who in human resources or the civil service commission owns fixing the hiring rules, and when did we last meet with them?

The summit made the national shortage visible, and the training pledges were a welcome contribution. For an individual agency, though, the work that makes a difference sits much closer to home, in its own hiring rules, pay structures and the daily experience of the people it already has.

With hindsight

The summit’s training pledges turned out to be useful but small against the problem. Many programs launched and some reached large numbers of learners, yet demand for experienced security staff kept outrunning supply. That outcome follows directly from the timing problem described above: training adds people at the entry level, while the hardest gaps were, and remain, at the experienced end.

The experience gap in the middle also showed up as predicted. In the years after 2021, discussion in the security field turned increasingly to how hard it was for newly certified candidates to find a first job. That happened even as employers kept describing senior roles as hard to fill. Both things were true at once, because the training pipeline had grown faster than the supply of entry-level positions with supervision attached.

Money for states and localities arrived, with conditions

The infrastructure bill the Senate passed two weeks before the summit became law in November 2021. Its State and Local Cybersecurity Grant Program was run by CISA and FEMA. It required each state to form a planning committee with local representation and to write a cybersecurity plan before spending most of its money. Most of the funds had to be passed through to local governments. For many counties and cities, that was the first federal money aimed directly at their security programs. It came with a four-year authorization. Grant money is temporary by nature, so it suited projects and shared services better than permanent positions, which eased some workload without solving retention.

The access levers moved

DHS launched its Cybersecurity Talent Management System in November 2021, as planned. It gave the department its own pay and screening rules for cyber roles. Comparable flexibility at the state and local level remained rare.

Several states removed degree requirements from large numbers of state jobs. Maryland did so in March 2022, and Pennsylvania followed in January 2023, with others after them. In July 2023 the White House published a National Cyber Workforce and Education Strategy that emphasized skills-based hiring, and many federal and state employers have since removed degree requirements for technical roles. The access and retention levers did move in places, most visibly through skills-based hiring. That is encouraging, because it shows those levers were movable all along. They needed human resources departments and policymakers to take ownership, not more training money.

Removing a degree requirement was the easy step. Replacing it with a good practical assessment, and with classifications and pay that matched the work, took longer and happened less often. Agencies that dropped the degree rule without changing anything else found that the applicant pool widened but the screening, pay and speed problems remained.

Federal support contracted

In 2025 the federal workforce was cut sharply. Public reporting described large staff losses at CISA, the federal Cybersecurity and Infrastructure Security Agency, reducing the support available to state and local agencies just as many were relying on it. Federal funding for the Multi-State Information Sharing and Analysis Center, a free resource that many local governments used for threat information and monitoring, was also reduced that year. For a county or city that had come to lean on federal help for threat information, assessments or incident support, that change shifted more of the burden back onto its own staff.

That has made the in-house core described above more important. Some agencies kept a small group of experienced people able to direct partners, read reports critically and make decisions. They are better placed than those that outsourced their judgment and assumed outside help would always be there.

What held up

The three-part split has held up better than the pledges. Agencies that measured supply, access and retention separately have been better able to see where their own losses occurred. Some found their problem was mostly speed of hiring; others found it was mostly departures after two or three years. Each answer led to a different office and a different budget request.

National programs and federal support are worth using, but they rise and fall with budgets and politics. An agency controls its own hiring rules, career paths, workload and the core team it chooses to keep. Those are the parts most worth investing in, because they remain when outside help changes.