Cybersecurity Talent Management System

AGENCY:

Department of Homeland Security.

ACTION:

Interim final rule; request for comments.

SUMMARY:

The U.S. Department of Homeland Security (DHS) is establishing a new talent management system to address DHS's historical and ongoing challenges recruiting and retaining individuals with skills necessary to execute DHS's dynamic cybersecurity mission. The Cybersecurity Talent Management System (CTMS) is a mission-driven, person-focused, and market-sensitive approach to talent management. CTMS represents a shift from traditional practices used to hire, compensate, and develop Federal civil service employees and is designed to adapt to changes in cybersecurity work, the cybersecurity talent market, and the Department's cybersecurity mission. CTMS will modernize and enhance DHS's capacity to recruit and retain mission-critical cybersecurity talent. With CTMS, DHS is creating a new type of Federal civil service position, called a qualified position, and the cadre of those positions and the individuals appointed to them is called the DHS Cybersecurity Service (DHS-CS). CTMS will govern talent management for the DHS-CS through specialized practices for hiring, compensation, and development. Individuals selected to join the DHS-CS will be provided with a contemporary public service career experience, which emphasizes continual learning and contributions to DHS cybersecurity mission execution. This rulemaking adds regulations to implement and govern CTMS and the DHS-CS.

DATES:

This rule is effective on November 15, 2021. Comments must be received on or before December 31, 2021.

ADDRESSES:

You may submit comments, identified by docket number DHS-2020-0042, using the Federal rulemaking portal at http://www.regulations.gov. For instructions on submitting comments, see the “Public Participation and Request for Comments” portion of the Supplementary Information section of this document.

FOR FURTHER INFORMATION CONTACT:

Technical information: Mr. Travis Hoadley, Department of Homeland Security, Office of the Chief Human Capital Officer: telephone 202-357-8700, email CTMS@hq.dhs.gov. Legal information: Ms. Esa Sferra-Bonistalli, Department of Homeland Security, Office of the General Counsel: telephone 202-357-8700, email CTMS@hq.dhs.gov.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary

A. CTMS Elements

B. Administering CTMS & Managing the DHS-CS

C. New 6 CFR Part 158

D. Costs and Benefits

II. Basis and Purpose

III. Background

A. Authority for a New Cybersecurity Talent Management System

1. Designate & Establish Qualified Positions

2. Appointment

3. Compensation

(a) Comparable Positions

(b) Basic Pay

(i) Rates of Pay and Pay Ranges

(ii) Limitations on Maximum Rates and Pay Caps

(c) Additional Compensation

(i) Consistent With

(ii) The Level Authorized

B. Need for a New Approach to Cybersecurity Talent Management

1. Ever-Evolving Nature of Cybersecurity Work Requires a Focus on the Individual

2. Outdated, Rigid Position Classification Inadequately Describes Cybersecurity Work

3. Generic, Inflexible Compensation Limits Ability To Compete for Cybersecurity Talent

IV. Discussion of the Rule

A. New Approach to Talent Management: Subparts A & B

1. Subpart A—General Provisions

(a) A New Type of Position: Qualified Positions

(b) A New Definition of “Qualifications”

(c) Other Definitions

(d) Authority & Policy Framework

2. Subpart B—DHS Cybersecurity Service

(a) Mission

(b) Qualified Positions

(c) DHS-CS Employees

(d) DHS-CS Assignments

B. CTMS and DHS-CS Leadership: Subpart C

1. Leaders

2. Principles, Priorities, and Core Values

C. Strategic Talent Planning: Subpart D

1. DHS-CS Cybersecurity Work & CTMS Qualifications Identification

2. CTMS Talent Market Analysis

3. CTMS Work Valuation & Work and Career Structures

4. Informing CTMS Administration and DHS-CS Management

D. Acquiring Talent: Subpart E

1. CTMS Talent Acquisition System

2. Strategic Recruitment

3. Qualifications-Based Assessment, Selection & Appointment

(a) CTMS Assessment Program

(b) DHS-CS Appointments

E. Compensating Talent: Subpart F

1. CTMS Compensation System

2. DHS-CS Employee Compensation

3. CTMS Salary System

(a) CTMS Salary Range

(b) CTMS Salary Structure

(c) CTMS Local Cybersecurity Talent Market Supplement

(d) CTMS Salary Administration

4. CTMS Recognition

(a) CTMS Recognition Payments

(b) CTMS Recognition Time-Off

(c) CTMS Honorary Recognition

5. Other Special Payments Under CTMS

(a) CTMS Professional Development and Training

(b) CTMS Student Loan Repayments

(c) CTMS Special Work Conditions Payments

(d) CTMS Allowances in Nonforeign Areas

6. Other Compensation Provided in Accordance With OPM Regulations

7. CTMS Aggregate Compensation Limit

F. Deploying Talent: Subpart G

1. CTMS Deployment Program

2. Designating Qualified Positions

3. Designating and Staffing Assignments

4. Official Worksite

5. Work Scheduling

6. DHS-CS Recordkeeping

7. Details and Opportunities Outside of the DHS-CS

G. Developing Talent: Subpart H

1. CTMS Performance Management Program

2. CTMS Career Development Program

H. Federal Employee Rights and Requirements & Advisory Appointments: Subparts I & J

1. Subpart I—Employee Rights, Requirements, and Input

2. Subpart J—Advisory Appointments

V. Appendix: Reference Materials

VI. Public Participation and Request for Comments

VII. Statutory and Regulatory Requirements

A. Executive Orders 12866 (Regulatory Planning and Review) and 13563 (Improving Regulation and Regulatory Review)

1. Background and Purpose

2. CTMS Costs: Designing, Establishing, and Administering CTMS

3. CTMS & DHS-CS Costs: Compensating and Retaining DHS-CS Employees

4. CTMS & DHS-CS Benefits: Enhancing the Cybersecurity of the Nation

B. Regulatory Flexibility Act

C. Congressional Review Act

D. Unfunded Mandates Reform Act

E. E.O. 13132 (Federalism)

F. E.O. 12988 (Civil Justice Reform)

G. E.O. 13175 (Consultation and Coordination With Indian Tribal Governments)

H. National Environmental Policy Act

I. National Technology Transfer and Advance Act

J. E.O. 12630 (Governmental Actions and Interference With Constitutionally Protected Property Rights)

K. E.O. 13045 (Protection of Children From Environmental Health Risks and Safety Risks)

L. E.O. 13211 (Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use)

M. Paperwork Reduction Act

Table of Abbreviations

APA—Administrative Procedure Act

CFR—Code of Federal Regulations

CISA—Cybersecurity and Infrastructure Security Agency

CRA—Congressional Review Act

CTMB—Cybersecurity Talent Management Board

CTMS—Cybersecurity Talent Management System

DHS—Department of Homeland Security

DHS-CS—DHS Cybersecurity Service

DHS OCIO—DHS Office of the Chief Information Officer

DOD—Department of Defense

DOD CES—Department of Defense's Cybersecurity Excepted Service

DOD DCIPS—Department of Defense's Civilian Intelligence Personnel System

DOD HQE—DOD Highly Qualified Experts

E.O.—Executive Order

EX—Executive Schedule

FLSA—Fair Labor Standards Act

GAO—Government Accountability Office

GS—General Schedule

HSAC—Homeland Security Advisory Council

IC—Intelligence Community

IC HQE—Intelligence Community Highly Qualified Experts

LCTMS—Local Cybersecurity Talent Market Supplement

OMB—Office of Management and Budget

OPM—Office of Personnel Management

SES—Senior Executive Service

SL/ST—Senior Level/Scientific or Professional

STRL—Scientific and Technology Reinvention Laboratories

§ —Section

U.S.C.—United States Code

I. Executive Summary

For more than a decade, the U.S. Department of Homeland Security (DHS) has encountered challenges recruiting and retaining mission-critical cybersecurity talent. To address those challenges, DHS has re-envisioned Federal civilian talent management for 21st-century cybersecurity work by designing an innovative approach to talent management: The Cybersecurity Talent Management System (CTMS). DHS is establishing CTMS under the authority in section 658 of Title 6 of the United States Code (U.S.C.), which authorizes DHS to create a new approach to talent management exempt from major portions of existing laws governing talent management for much of the Federal civil service.

CTMS is mission-driven, person-focused, and market-sensitive, and it features several interrelated elements, based on leading public and private sector talent management practices. Importantly, CTMS is also based on core Federal talent management principles related to upholding merit, prohibiting certain personnel practices, advancing equity, and providing equal employment opportunity. CTMS is designed to modernize and enhance DHS's capacity to recruit and retain individuals with the skills, called qualifications, necessary to execute the DHS cybersecurity mission. CTMS is also designed to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission, even as technology, sought-after expertise, and work arrangements change.

With CTMS, DHS is creating a new type of Federal civil service position in the excepted service, called a qualified position. Qualified positions focus on individuals and individuals' qualifications. The cadre of qualified positions and the individuals appointed to them is called the DHS Cybersecurity Service (DHS-CS). The goal of the DHS-CS is to enhance the cybersecurity of the Nation through the most effective execution of the DHS cybersecurity mission. DHS will use CTMS to hire, compensate, and develop DHS-CS employees to reinforce the values of expertise, innovation, and adaptability.

CTMS will also provide DHS-CS employees with a contemporary public service career experience, which emphasizes continual learning and contributions to DHS cybersecurity mission execution.

A. CTMS Elements

To recruit and retain DHS-CS employees, CTMS features interrelated elements that are new processes, systems, and programs that implement new talent management concepts and definitions. Each CTMS element represents a shift from the traditional methods and practices Federal agencies typically use to hire, compensate, and develop civil service talent. Collectively, the CTMS elements form a complete approach to talent management and enable new, specialized talent management practices. CTMS is driven by the DHS cybersecurity mission and informed by internal data about the state of DHS cybersecurity work and talent; it is also informed by external data about trends in the field of cybersecurity and the talent market.

The CTMS elements and their purposes are:

• Strategic talent planning process enables CTMS to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission by aggregating and using relevant information to inform CTMS administration on an ongoing basis. As part of the strategic talent planning process, DHS:

○ Identifies the set of qualifications necessary to perform the work required to execute the DHS cybersecurity mission.

○ conducts analysis of the cybersecurity talent market to identify and monitor employment trends and leading strategies for recruiting and retaining cybersecurity talent.

○ establishes and administers a work valuation system based on qualifications and DHS cybersecurity work, which DHS uses instead of the General Schedule (GS) or other traditional Federal position classification methods to facilitate systematic talent management and addresses internal equity.

• Talent acquisition system supports qualifications-based recruitment, assessment, selection, and appointment of DHS-CS employees.
• Compensation system provides sufficiently competitive, market-sensitive compensation, while encouraging and recognizing DHS-CS employee contributions, such as exceptional qualifications and mission impact.
• Deployment program guides when DHS uses CTMS to recruit and retain talent and operationalizes aspects of the work valuation, talent acquisition, and compensation systems through requirements for designating qualified positions, designating and staffing assignments, work scheduling, and recordkeeping.
• Performance management program seeks to improve the effectiveness of DHS-CS employees in executing the cybersecurity mission by ensuring individual accountability and recognizing their mission impact.
• Career development program ensures the development of the collective expertise of DHS-CS employees through continual learning, while guiding the career progression of each DHS-CS employee.

The CTMS elements rely on new talent management concepts and definitions:

• Work and career structures, are constructs, analogous to General Schedule classes and grades, that DHS establishes under the CTMS work valuation system and uses instead of classes and grades from the General Schedule or other traditional Federal position classification methods. DHS uses work and career structures to support several elements of CTMS, including the compensation system, and DHS determines applicable work and career structures for a DHS-CS employee as part of selection and appointment under the CTMS talent acquisition system.
• Mission impact is the influence an individual has on the execution of the DHS cybersecurity mission by applying qualifications to perform DHS cybersecurity work. DHS determines a DHS-CS employee's mission impact through mission impact reviews under the CTMS performance management program. Mission impact is a factor in DHS-CS employee compensation and development.
• Mission-related requirements are characteristics of an individual's expertise or characteristics of cybersecurity work, or both, that are associated with successful execution of the DHS cybersecurity mission. They are determined by officials with appropriate decision-making authority and are a factor in DHS-CS employee compensation, assignment matches, and development.
• Strategic talent priorities are priorities for CTMS and the DHS-CS set by the Secretary or the Secretary's designee. Strategic talent priorities are used in administering CTMS and managing the DHS-CS.

B. Administering CTMS & Managing the DHS-CS

The Secretary, or the Secretary's designee, leads CTMS and the DHS-CS with assistance from the Cybersecurity Talent Management Board (CTMB). The CTMB comprises DHS officials representing organizations involved in executing the DHS cybersecurity mission and DHS officials responsible for developing and administering talent management policy. Working together, these officials ensure the most efficient operation of CTMS and the most effective management of the DHS-CS. The Secretary, or the Secretary's designee, and the CTMB administer CTMS and manage the DHS-CS.

The dynamic DHS cybersecurity mission drives CTMS. On an ongoing basis, DHS identifies the functions that execute the DHS cybersecurity mission, the cybersecurity work required by those functions, and the set of qualifications necessary to perform that work. The work identified is called DHS-CS work, and the set of qualifications identified are called CTMS qualifications. Under CTMS, qualifications are individuals' cybersecurity skills, which encompass the full array of work-related characteristics and qualities that distinguish talent.

Qualifications are the core of CTMS and its elements, and on an ongoing basis, DHS updates the set of CTMS qualifications to ensure they continue to reflect the collective cybersecurity expertise DHS requires. DHS establishes work and career structures based on CTMS qualifications, and DHS creates qualified positions based on DHS-CS employees' CTMS qualifications. DHS-CS employees execute the DHS cybersecurity mission by applying their CTMS qualifications to perform DHS-CS cybersecurity work. In administering CTMS to recruit and retain DHS-CS employees, DHS emphasizes individuals' CTMS qualifications and their mission impact.

DHS uses CTMS, instead of another Federal personnel system, when a DHS organization requires talent with CTMS qualifications and DHS determines that the recruitment and retention of such talent would be enhanced by the specialized practices of CTMS.

All individuals interested in serving in the DHS-CS must apply, and DHS proactively recruits individuals at all career stages, from those just beginning a career in cybersecurity to those with years of proven experience working as a cybersecurity technical expert or organizational leader. Recruitment includes proactively communicating with prospective applicants about DHS's unique cybersecurity mission and available public service career opportunities in the DHS-CS.

DHS assesses applicants using standardized instruments and procedures intended to determine the applicants' CTMS qualifications. DHS selects an individual based on the individual's CTMS qualifications.

DHS may appoint a selected individual to a renewable appointment or continuing appointment. A renewable appointment is time-limited, may be renewed multiple times, and may be used for project-based work or other similar purposes. A continuing appointment is not time-limited. The DHS-CS can also include political appointees, called advisory appointees. Regardless of appointment type, new DHS-CS employees are matched with initial assignments based on mission needs and their CTMS qualifications upon appointment.

Compensation for DHS-CS employees includes salaries and additional compensation. DHS provides such compensation in alignment with a CTMS compensation strategy aimed at ensuring sufficiently competitive compensation to recruit and retain the cybersecurity expertise DHS requires. Under CTMS, compensation is based primarily on CTMS qualifications, and DHS has necessary flexibility to adjust aspects of compensation based on market and mission demands.

DHS provides salaries for DHS-CS employees under a market-sensitive salary structure bounded by an overall salary range. This salary range is comprised of a standard range and an extended range for use in limited circumstances. A DHS-CS employee's salary may include a local cybersecurity talent market supplement, analogous to a locality-based comparability payment, to ensure a competitive salary in certain geographic areas.

DHS provides additional compensation for DHS-CS employees mainly in the form of recognition, which includes salary increases called recognition adjustments, cash bonuses called recognition payments, paid time-off called recognition time-off, and honorary awards called honorary recognition. Such recognition is based primarily on DHS-CS employees' mission impact.

CTMS additional compensation also includes payments for special working conditions, which DHS can use to compensate a DHS-CS employee for special working conditions that are determined to be insufficiently accounted for in the employee's salary. For example, such conditions or circumstances include performing certain work involving unusual physical or mental hardship, at unexpected times, or for an uncommon duration of time. Other types of additional compensation available to DHS-CS employees are similar to or the same as existing offerings for many Federal employees: Professional development and training, student loan repayments, allowances in nonforeign areas, as well as traditional Federal employee benefits like holidays, leave, retirement, health benefits, and insurance programs.

Throughout DHS-CS employees' service, DHS considers increasing employees' compensation based primarily on their mission impact. Compensation increases occur mainly through CTMS recognition as either recognition adjustments or recognition payments. CTMS does not feature automatic salary increases or payments; moreover, longevity in position or prior Federal government service are not factors in CTMS compensation.

Each DHS-CS employee's salary is subject to salary limitations, and each DHS-CS employee's aggregate compensation, composed of the employee's salary and certain types of additional compensation, is subject to an aggregate compensation limit. These salary limitations and the aggregate compensation limit implement statutory requirements from the authority for CTMS in 6 U.S.C. 658.

Career progression in the DHS-CS is based on enhancement of CTMS qualifications and salary progression resulting from recognition adjustments. DHS guides a DHS-CS employee's career and ensures development of the collective expertise of DHS-CS employees through continual learning, which may include a range of recommended and required learning activities. Continual learning and enhancement of CTMS qualifications are integral to a DHS-CS employee's service in the DHS-CS. New assignment opportunities may be an important part of DHS-CS employees' continual learning and enhancement of CTMS qualifications. Through such assignments, DHS-CS employees are able to learn and perform different types of DHS-CS cybersecurity work and customize contemporary career experiences that maximize both their qualifications and their impact on the DHS cybersecurity mission.

C. New 6 CFR Part 158

This rulemaking adds new part 158 to Title 6 of the Code of Federal Regulations (CFR) to implement and govern CTMS and the DHS-CS. New part 158 contains several subparts setting forth the interrelated elements of CTMS that function together as a complete, and innovative, approach to talent management.

D. Costs and Benefits

From FY 2016 through FY 2020, DHS received approximately $49 million of appropriated funding to design and establish CTMS and the resulting DHS-CS. The major costs of CTMS and the DHS-CS are: (1) The cost of talent management infrastructure necessary for the Office of the Chief Human Capital Officer (OCHCO) to design, establish, and prepare to administer CTMS; and (2) the cost of compensating DHS-CS employees hired by DHS organizations using CTMS.

In FY 2021, OCHCO received approximately $13 million of appropriated funding to both finalize the design of CTMS and to establish CTMS. For FY 2022, DHS requested that funding be increased to approximately $16 million both to launch and administer CTMS and to support the management of an expanding population of DHS-CS employees.

The primary benefit of this rule is to ensure the most effective execution of the DHS cybersecurity mission by establishing CTMS to enhance DHS's capacity to recruit and retain cybersecurity talent in the new DHS-CS.

This rulemaking does not directly regulate the public.

II. Basis and Purpose

On December 18, 2014, Congress added a new section to the Homeland Security Act of 2002 entitled “Cybersecurity Recruitment and Retention.” This new section is codified at 6 U.S.C. 658 and grants the Secretary broad authority and discretion to create a new personnel or talent management system for DHS's cybersecurity workforce. The exercise of this authority and discretion is exempt from major portions of existing laws governing talent management for much of the Federal civil service. This exemption allows DHS to re-envision talent management for 21st-century cybersecurity work.

This rule implements 6 U.S.C. 658 and establishes a new talent management system designed based on DHS's dynamic cybersecurity mission. Use of the new system addresses DHS's historical and ongoing challenges recruiting and retaining mission-critical cybersecurity talent.

To implement the authority in 6 U.S.C. 658, Congress requires the Secretary “shall prescribe regulations” and to do so in coordination with the Director of the Office of Personnel Management (OPM). This rulemaking fulfills the requirement to prescribe regulations. To fulfill the requirement to coordinate with the Director of OPM, DHS engaged with OPM experts for assistance in understanding the talent management concepts invoked by the language of 6 U.S.C. 658 and to obtain feedback on DHS's design for the new talent management system.

DHS is promulgating this rule as an interim final rule because it is a matter relating to agency management or personnel that is exempt from the rulemaking requirements of the Administrative Procedure Act (APA). Rulemaking requirements of the APA include issuing a notice of proposed rulemaking, providing an opportunity for public comment, and an effective date not less than 30 days after publication of the rule. These requirements, however, do not apply to “a matter relating to agency management or personnel or to public property, loans, grants, benefits, or contracts.” The Attorney General's Manual on the Administrative Procedure Act describes this exemption as one of two “broad exceptions” to APA rulemaking requirements, and further characterizes the agency management or exemption as “self-explanatory.” Similar to the Attorney General's Manual characterization, Federal courts have interpreted the agency management exemption as applying to traditional personnel matters, such as a new personnel system, personnel manuals, and personnel policies.

Although this rulemaking is exempt from the rulemaking requirements of the APA, DHS is seeking public comments on the innovative talent management system. Interested persons are invited to participate in this rulemaking by submitting written comments as described in VI. Public Participation and Request for Comments of this document.

III. Background

Cybersecurity is a matter of homeland security and one of the core missions of DHS. For more than a decade, DHS has encountered challenges recruiting and retaining mission-critical cybersecurity talent. As cybersecurity threats facing the Nation have grown in volume and sophistication, DHS has experienced spikes in attrition and longstanding vacancies in some cybersecurity positions, as well as shortages of certain critical and emerging cybersecurity skills.

In response to DHS's historical and ongoing challenges recruiting and retaining cybersecurity talent, Congress granted the Secretary the authority in 6 U.S.C. 658 to ensure DHS improves its ability to recruit and retain mission-critical cybersecurity talent. Legislative history indicates that Congress granted the authority in 6 U.S.C. 658 in response to a report by the Secretary's Homeland Security Advisory Council (HSAC) recommending DHS receive additional talent management flexibilities similar to those used by the National Security Agency. The HSAC report linked DHS's recruitment and retention challenges to a global shortage of cybersecurity expertise and fierce competition among Federal agencies and the private sector for cybersecurity skills.

The language codified at 6 U.S.C. 658 mirrors the language in 10 U.S.C. 1601-1603, enacted in 1996 for the Department of Defense (DOD), that authorizes DOD's Defense Civilian Intelligence Personnel System (DOD DCIPS). In addition, the language codified at 6 U.S.C. 658 is similar to a separate DOD authority, enacted a year after § 658, and under which DOD has established the DOD Cybersecurity Excepted Service (DOD CES) personnel system for its United States Cyber Command workforce.

Once granted the authority to create a new cybersecurity talent management system free from existing requirements and practices governing Federal talent management, DHS formed a specialized team in early 2016 to design a new cybersecurity talent management system capable of addressing DHS's recruitment and retention challenges. Based on the authority in 6 U.S.C. 658 and DHS's understanding of both the cybersecurity talent landscape and existing Federal talent management practices, DHS concluded it could—and it must—re-envision talent management for 21st-century cybersecurity work. As outlined in required reports to Congress about DHS's plan for and progress toward execution of the authority granted in 6 U.S.C. 658, DHS is using this authority to create an innovative, 21st-century talent management system with solutions for its cybersecurity workforce recruitment and retention challenges. This rule establishes the new talent management system, which is based on leading public and private sector talent management practices and driven by the DHS cybersecurity mission.

A. Authority for a New Cybersecurity Talent Management System

The authority in 6 U.S.C. 658 allows DHS to create a new talent management system exempt from many existing laws governing Federal civilian talent management. Specifically, the Secretary may designate and establish “qualified positions” in the excepted service, appoint individuals to those positions, and compensate appointed individuals. See 6 U.S.C. 658(b)(1)(A). The Secretary may do this “without regard to the provisions of any other law relating to the appointment, number, classification, or compensation of employees.” See 6 U.S.C. 658(b)(1)(B). The “without regard to” language supersedes all other laws governing appointment, number, classification, or compensation of employees.

The language of 6 U.S.C. 658 uses terms that invoke fundamental talent management concepts. Importantly, the exemption from classification means that DHS can choose how to describe cybersecurity work, including by establishing new constructs to categorize work and new ways of defining positions performing such work, and relatedly, DHS can choose how to value cybersecurity work and positions, including through new compensation structures and practices. DHS has interpreted the authority in 6 U.S.C. 658, as necessary, to fulfill the congressional intent in the legislative history: That DHS address its cybersecurity workforce recruitment and retention challenges and improve its capacity to compete for top cybersecurity talent by exercising greater discretion in hiring and compensating cybersecurity talent.

Although DHS has authority to create a new talent management system free from existing requirements in other laws governing appointment, number, classification, and compensation of Federal employees, Congress provided a few requirements and parameters for exercising that authority. The following discussion in III.A.1 through III.A.3 of this document explains the scope of the Secretary's authority to create a new talent management system.

1. Designate & Establish Qualified Positions

Under 6 U.S.C. 658, DHS has authority to both designate and establish qualified positions. Section 658(a)(5) defines “qualified position” as “a position, designated by the Secretary for the purpose of this section, in which the incumbent performs, manages, or supervises functions that execute the responsibilities of the Department relating to cybersecurity.” Section 658(b)(1)(A)(i) gives authority to “establish” qualified positions and describes qualified positions as positions in the excepted service that the Secretary determines necessary to carry out the responsibilities of the Department relating to cybersecurity. The authority to designate qualified positions includes determining the purpose and use of such qualified positions, as the Secretary determines necessary, for executing DHS's cybersecurity responsibilities. The authority to establish qualified positions is authority to create qualified positions in the excepted service to carry out DHS's cybersecurity responsibilities.

The authority to designate and establish qualified positions applies without regard to any other provisions of law relating to the number or classification of employees. In the U.S. Code, provisions of law relating to the number of employees may limit the number of positions, or types of positions, or limit the number of employees that may be hired into such positions. Thus, DHS is not limited in the number of qualified positions the Secretary may designate and establish, except by funding constraints and requirements in appropriations for DHS.

Under the exemption relating to classification of employees, DHS is exempt from the General Schedule (GS) position classification system as well as other work valuation systems relying on traditional position classification concepts and methods. “Classification” generally is a systematic process of job or work valuation used to describe and value jobs or work and individuals within an organization. In the Federal civil service context, classification most often refers to the GS position classification system, which is the job evaluation system codified at 5 U.S.C. Chapter 51. Chapter 51 provides a definition of the term “position” that means “the work, consisting of the duties and responsibilities, assignable to an employee.” Under the GS position classification system, positions are grouped into classes and grades based on duties, responsibilities, and qualification requirements. Traditional Federal position classification systems based on Chapter 51, including the GS, provide job structures, such as classes and grades, that meaningfully group positions to facilitate systematic management of Federal civilian employees and address internal equity. With the GS or other similar position classification systems, those job structures influence many aspects of talent management, especially compensation, for positions under those systems and employees in those positions.

Under the exemption relating to classification of employees, DHS is exempt from the definition of “position” under the GS position classification system and other job or work valuation systems, and how the concept of “position” is used under those systems. Section 658 defines and describes qualified positions as positions designated and established by the Secretary as the Secretary determines necessary, and both the definition and description of qualified positions use the general, stand-alone term “position.” In the U.S. Code, that term does not have a universal meaning or a specific meaning in the excepted service; instead the U.S. Code contains multiple definitions of the term “position” for specific purposes.

The authority to designate and establish qualified positions and the exemptions from existing laws provides the Secretary broad discretion to determine how to create and use qualified positions for purposes of carrying out the responsibilities of DHS relating to cybersecurity. In particular, the exemption relating to classification of employees means DHS may determine the use of qualified positions and create such positions as new positions in the excepted service without regard to existing definitions of positions, or how the concept of position is currently used, in management of Federal employees.

As discussed subsequently in III.B of this document, main factors contributing to DHS's challenges recruiting and retaining cybersecurity talent are the focus of existing Federal talent management practices on narrowly-defined and mostly-static jobs or positions instead of individuals and their skills, as well as the inability of current Federal classification methods to effectively describe and account for individuals' cybersecurity skills. Therefore, as discussed further in IV.A.1 of this document, DHS is using the Secretary's broad authority and discretion for designating and establishing qualified positions, and the exemptions from existing laws, to create a new type of Federal civil service position based on individuals and their skills necessary for executing the DHS cybersecurity mission. To do this, DHS is designing CTMS with new processes, systems, and programs to create and use qualified positions based on the DHS cybersecurity mission and individuals' skills necessary to execute that mission. Those processes, systems, and programs are called CTMS elements and include a new work valuation system.

2. Appointment

Under 6 U.S.C. 658, DHS has authority to create new hiring processes for qualified positions without regard to existing requirements and processes for hiring Federal civilian employees. Section 658(b)(1)(A)(ii) gives the Secretary authority to appoint an individual to a qualified position and, under 6 U.S.C. 658(b)(1)(B), this appointment authority applies without regard to the provisions of any other law relating to appointment, number, or classification of employees.

The exemption relating to appointment of employees means DHS may appoint individuals to qualified positions without regard to the Title 5 hiring requirements and processes, including procedures for accepting and reviewing applications, making selections, and appointing individuals to positions. Also, the exemption regarding number of employees means there is no statutory limit on the number of qualified positions or number of appointments to such positions. As discussed previously, provisions of the U.S. Code relating to the number of employees may limit the number of positions, or types of positions, or limit the number of employees that may be hired into such positions. Although DHS is not limited in the number of appointments to qualified positions, funding constraints and requirements in DHS appropriations still apply.

The exemption relating to classification of employees, discussed previously, means DHS may also appoint individuals to qualified positions exempt from the GS position classification system and other work valuation systems relying on traditional position classification concepts and methods. In the context of appointments, Chapter 51 and implementing regulations and policy dictate elements of the hiring process for GS positions. For example, OPM classification and qualification standards, policies, and processes establish procedures used for defining, identifying, and evaluating jobs and applicants in order to select individuals for appointment to a GS position.

As discussed subsequently in III.B of this document, main factors contributing to DHS's challenges recruiting and retaining cybersecurity talent are the lack of focus of existing Federal talent management practices on individuals and their skills, as well as fierce competition for those individuals and their skills. Therefore, as discussed further in IV.C of this document, DHS is using the Secretary's appointment authority, and the exemptions from existing laws, to create new hiring processes for qualified positions to recruit and hire individuals with mission-critical skills. To do this, DHS designed strategic recruitment processes based on leading private sector practices and a new skills-based assessment program under a new DHS-specific talent acquisition system.

3. Compensation

Under 6 U.S.C. 658(b), DHS has authority to create a new administrative compensation system covering salaries and other types of compensation. Section 658(b)(1)(A)(iii) gives authority to set compensation for individuals in qualified positions. This § 658 compensation authority includes specific salary authority in § 658(b)(2)(A) to fix the rates of basic pay for qualified positions subject to limitations on maximum rates of pay. The § 658 compensation authority also includes specific additional compensation authority in § 658(b)(3)(A) to provide compensation in addition to basic pay, including benefits, incentives, and allowances.

The § 658 compensation authority applies without regard to any other provisions of law relating to the classification or compensation of employees. As explained previously, the exemption relating to classification of employees exempts the authority in 6 U.S.C. 658 from the GS position classification system and other Federal work valuation systems. In the context of compensation, the GS position classification system describes and groups Federal civil service positions to assign rates of basic pay under the related GS pay system in 5 U.S.C. Chapter 53. Thus, the § 658 compensation authority is exempt from the GS pay system as well as the GS position classification system under both the exemption relating to classification of employees and the exemption relating to compensation of employees.

In addition to laws establishing the GS pay system, the exemption relating to compensation of employees exempts the § 658 compensation authority from other provisions of law relating to compensation, which include: Provisions in 5 U.S.C. Chapter 53 establishing and governing other pay systems; premium pay provisions in 5 U.S.C. Chapter 55 and the minimum wage and overtime pay provisions of the Fair Labor Standards Act (FLSA); provisions in Title 5 regarding monetary awards, incentives, and certain differentials; the limitation on annual aggregate compensation in 5 U.S.C. 5307; and provisions in 5 U.S.C. Chapter 61 governing work schedules, which impacts compensation, especially salary and leave.

The § 658 compensation authority does provide parameters for exercising that authority specific to providing basic pay and providing additional compensation, and those parameters depend on identifying positions that are “comparable” to qualified positions designated by the Secretary. For § 658 basic pay, the Secretary must identify comparable positions in DOD and their associated rates of pay, and then fix rates of basic pay for individuals in qualified positions “in relation to” those DOD rates of pay. For § 658 additional compensation, if the Secretary provides additional compensation, the Secretary must identify comparable positions authorized by Title 5, and then provide only additional compensation that is “consistent with, and not in excess of the level authorized for,” those Title 5 positions.

The language of, and direction in, the § 658 basic pay authority and the § 658 additional compensation authority is ambiguous, including the implicit initial requirement to identify “comparable positions.” Statutory language for Federal compensation systems generally is not straight-forward nor unambiguous, and the responsibility of resolving ambiguities in the Federal compensation system context has been characterized as inherently complex.³⁷ The compensation authority language in 6 U.S.C. 658 is no exception. To implement the § 658 compensation authority, DHS has had to interpret the ambiguous statutory language of the basic pay authority and the additional compensation authority, as discussed in the following three sections of this document: III.A.3.(a) Comparable Positions, III.A.3.(b) Basic Pay, and III.A.3.(c) Additional Compensation.

(a) Comparable Positions

Section 658 does not define or identify comparable positions in DOD, comparable positions authorized by Title 5, nor what makes such positions “comparable” to qualified positions. As mentioned previously, and discussed in IV.A of this document, DHS is using the Secretary's broad authority and discretion for designating and establishing qualified positions to create qualified positions as a new type of Federal civil service position based on the DHS cybersecurity mission and individuals' skills necessary to execute that mission. As such, there are no existing positions in DOD nor existing positions authorized by Title 5 that are obvious “comparable positions” to this new type of position for the purposes of implementing the § 658 basic pay authority and the § 658 additional compensation authority. Consequently, DHS must determine which positions in DOD, and which positions authorized by Title 5, are comparable to this new type of Federal civil service position.

DHS interprets “comparable positions” to mean positions that have characteristics in common with a qualified position. A dictionary definition of the term “comparable” can mean “similar” or “capable of being compared;” however, only the “similar” definition provides guidance. Most—if not all—Federal civil service positions are “comparable” in the sense that they are capable of being be compared to one another based on some criteria or using a consistent metric. The ability or a process to compare positions does not result in identifying positions in DOD and positions authorized by Title 5 that are “comparable” for the purpose of implementing the § 658 basic pay authority and the § 658 additional compensation authority. A dictionary definition of the term “similar” is “alike in substance or essentials” or “having characteristics in common.” Thus, positions that are “comparable” are ones that are alike in substance or essentials or have characteristics in common.

The main characteristics of a qualified position can be described as a link to the DHS cybersecurity mission and an emphasis on an individual's skills necessary to execute that mission. Thus, “comparable positions” in DOD and authorized by Title 5, are those that also have (1) a link to cybersecurity responsibilities of an agency, and (2) an emphasis on an individual's skills necessary to perform cybersecurity work. Some positions in DOD and some positions authorized by Title 5 have these characteristics in common with qualified positions, and thus are “comparable” to qualified positions. Note that positions classified using traditional Federal position classification methods, including the GS position classification system, do not emphasize an individual's skills. As explained in III.B.2 of this document, traditional Federal position classification primarily focuses on the work of a position and only minimally accounts for the skills an individual brings to the work of a position and how such skills may influence the performance of work.

Positions in DOD that have or could have a link to cybersecurity responsibilities and an emphasis on an individual's skills, and thus are comparable positions in DOD for purposes of implementing the § 658 basic pay authority, include the following eleven types of positions:

• Senior Level/Scientific or Professional (SL/ST) positions under 5 U.S.C. 5376;
• Senior Executive Service (SES) positions under 5 U.S.C. Chapter 31, Subchapter II;
• Experts and consultants positions under 5 U.S.C. 3109;
• Critical pay positions under 5 U.S.C. 5377;
• DOD CES positions under 10 U.S.C. 1599f;
• DOD DCIPS positions under 10 U.S.C. 1601 et seq.;
• DOD highly qualified experts (DOD HQE) positions under 5 U.S.C. 9903;
• Intelligence Community highly qualified experts (IC HQE) under 50 U.S.C. 3024(f)(3)(A)(iii);
• Intelligence Community (IC) critical pay positions under 50 U.S.C. 3024(s);
• Scientific and Technology Reinvention Laboratories (STRL) positions under 10 U.S.C. 2358c; and
• Pilot cybersecurity professional positions under section 1110 of the National Defense Authorization Act for Fiscal Year 2018.

Positions “authorized by [T]itle 5,” while not clearly defined, at least include positions specifically authorized in Title 5 provisions. Five of the eleven types of comparable positions in DOD are also authorized in Title 5 provisions. Thus, positions authorized by Title 5 that have or could have a link to cybersecurity responsibilities and an emphasis on an individual's skills, and are therefore comparable positions authorized by Title 5 for purposes of implementing the § 658 additional compensation authority, include at least the following types of positions:

• SL/ST positions under 5 U.S.C. 5376;
• SES positions under 5 U.S.C. Chapter 31, Subchapter II;
• Experts and consultants positions under 5 U.S.C. 3109;
• Critical pay positions under 5 U.S.C. 5377; and
• DOD HQE positions under 5 U.S.C. 9903.

It is important to note that the eleven types of comparable positions are each comparable to a qualified position. As such, a qualified position is simultaneously comparable to each of these eleven types of comparable positions. This one-to-many relationship between a qualified position and the eleven types of comparable positions affects how DHS interprets and implements the § 658 basic pay authority and the § 658 additional compensation authority, as discussed in the following two sections, III.A.3.(b) Basic Pay and III.A.3.(c) Additional Compensation.

(b) Basic Pay

Section 658(b)(2)(A) provides the Secretary basic pay authority and parameters for exercising that authority by requiring the Secretary fix rates of basic pay for qualified positions “in relation to the rates of pay provided for employees in comparable positions in the Department of Defense and subject to the same limitation on maximum rates of pay established for such employees by law or regulation.” This authority to fix rates of basic pay is authority to create and administer a new salary system with a salary range and policies for setting and adjusting salaries. Under 6 U.S.C. 658(b)(1)(B), the new salary system is exempt from any other laws relating to classification or compensation of employees, including the GS position classification system and the associated GS pay system. The new salary system, however, must adhere to the two parameters in the § 658 basic pay authority regarding rates of pay and maximum rates.

(i) Rates of Pay and Pay Ranges

To ensure salaries under the new salary system are set in relation to the rates of pay provided for employees in comparable positions in DOD, the Department must interpret the ambiguous “in relation to” requirement, and apply it using the rates of pay for the eleven types of comparable positions in DOD.

Rates of pay are organized as pay ranges with a minimum rate and maximum rate. The rates of pay provided for the eleven types of comparable positions in DOD are nine different pay ranges established in statute and DOD implementing documents. Because a qualified position is simultaneously comparable to each type of comparable position in DOD, all nine pay ranges are relevant in applying the “in relation to” requirement. The nine pay ranges for the eleven types of comparable positions in DOD are as follows:

DHS interprets the “in relation to” requirement to mean that the Secretary has discretion to establish and operate a new salary system within the boundaries provided by the nine rate ranges for the eleven types of comparable positions in DOD. Congress has used a similar “in relation to” requirement in other compensation authorities, and courts have held that such a requirement provides boundaries for determining appropriate salaries under a compensation authority. The courts also concluded that such a requirement gives the agency head discretion to fill in the details within those boundaries. Legislative history indicates that 6 U.S.C. 658 grants compensation flexibilities to better recruit and retain cybersecurity talent with more competitive compensation.

DHS determines that the boundaries of the new salary system, as provided by the nine rate ranges for the eleven types of comparable positions in DOD, may be from no minimum to 150 percent of EX-I or no maximum. The nine rate ranges, presented in Table 1: Rate Ranges for Comparable Positions in DOD, have several minimum rates, which start at no minimum, and several maximum rates, which range up to 150 percent of EX-I and no maximum. As discussed subsequently in III.B of this document, the competitiveness of compensation, especially salary, is a main factor contributing to DHS's challenges recruiting and retaining cybersecurity talent. Therefore, as discussed further in IV.E.3 of this document, the Department is using the highest maximum rates for the upper boundary for the new salary system.

(ii) Limitations on Maximum Rates and Pay Caps

To ensure salaries under the new salary system are subject to the same limitations on maximum rates for employees in comparable positions in DOD established by law or regulation, DHS must identify the “limitations on maximum rates” for the eleven types of comparable positions in DOD, and then apply those same limitations to the new pay system.

Just as 6 U.S.C. 658 does not identify comparable positions in DOD, it does not prescribe or identify the “limitations on maximum rates of pay” for those comparable positions. Thus, to implement the “the same limitations on maximum rates” requirement in 6 U.S.C. 658, DHS must interpret the phrase “limitations on maximum rates” and apply it using the eleven types of comparable positions in DOD.

DHS interprets “limitations on maximum rates” to mean salary caps. Congress generally uses the term “limitation” within compensation statutes to mean a pay or salary cap. U.S. Code sections using the term “limitation” in a compensation context indicate that the term means an amount cap. When used in conjunction with the authority to fix or adjust rates of pay, the term “limitation” means a salary cap. These U.S. Code sections also indicate that the term “limitation” often specifically refers to the salary cap for administrative pay systems in 5 U.S.C. 5373 or 5306(e). The § 658 basic pay authority is authority to create a new administrative compensation system; however, under the exemption relating to the compensation of employees in § 658(b)(1)(B), the new salary system is exempt from the salary cap in 5 U.S.C. 5373 and 5306(e). The new system must instead comply with the “same limitations on maximum rates” requirement in § 658(b)(2)(A).

DHS interprets the “same limitations on maximum rates” requirement to mean that the new salary system is subject to the same salary caps applicable to the eleven types of comparable positions in DOD. A maximum rate for a rate range serves as a salary cap. As shown previously in Table 1, the pay ranges for the eleven types of comparable positions in DOD each have at least one maximum rate, except the pay range for pilot cybersecurity professional positions does not include a maximum rate. For the comparable positions in DOD that have more than one maximum rate, only the highest rate serves as a true salary cap because the lower maximum rate can be superseded under certain circumstances, whereas the higher rate serves as the absolute limit for salaries in that rate range. As such, comparable positions in DOD have six different salary caps based on their highest maximum rate. Because a qualified position is simultaneously comparable to each type of comparable position in DOD, all six salary caps are relevant in applying the “same limitations on maximum rates” requirement. The six relevant salary caps for the eleven types of comparable positions in DOD are as follows:

Because the new salary system must set salaries subject to the “same” limitations on maximum rates for employees in comparable positions in DOD, each of the six salary caps applies to the new salary system. Congress uses the plural term “limitations” in the § 658 basic pay authority, which indicates Congress contemplated, or at least accounted for, the possibility of more than one salary cap; however, Congress is silent on how multiple salary caps might apply to the new salary system.

With the Secretary's broad authority and discretion for designating and establishing qualified positions, determining comparable positions in DOD, establishing a salary system within expansive boundaries, and identifying salary caps to apply to the new salary system, it follows that the Secretary also has implicit authority and discretion for how to apply the six applicable salary caps. In exercising this authority and discretion, the Secretary must ensure the new salary system is subject to the “same” salary caps as comparable positions in DOD, and as such, DHS is applying all six salary caps to the new salary system, as discussed further under IV.E.3 of this document.

(c) Additional Compensation

Section 658(b)(3)(A) provides the Secretary discretionary additional compensation authority and parameters for exercising that authority by requiring that any discretionary additional compensation for employees in qualified positions, must be “consistent with, and not in excess of the level authorized for, comparable positions authorized by [T]itle 5, United States Code.” Section 658(b)(3)(B) also separately mandates one type of additional compensation, allowances in nonforeign areas, and also mandates that employees in qualified positions are eligible for such allowances under 5 U.S.C. 5941 on the same basis and to the same extent as if the employees were covered under section 5941.

The § 658 additional compensation authority for both discretionary additional compensation and the separate, mandatory allowances in nonforeign areas is exempt under 6 U.S.C. 658(b)(1)(B) from any other laws relating to compensation. Any discretionary additional compensation DHS provides, however, must adhere to the two parameters that such additional compensation is “consistent with” comparable positions authorized by Title 5 and not in excess of “the level authorized for” such positions.

(i) Consistent With

To provide discretionary additional compensation that is consistent with comparable positions authorized by Title 5, DHS must interpret this ambiguous “consistent with” requirement, and apply it using the five types of comparable positions authorized by Title 5. As discussed previously in III.C.3 of this document, comparable positions authorized by Title 5 include SL/ST, SES, Experts and Consultants, Critical Pay, and DOD HQE positions.

Based on Congress's choice of punctuation and syntax, it is clear that discretionary additional compensation must be consistent with comparable positions authorized by Title 5. Section 658(b)(3)(A) directs that any discretionary additional compensation be “consistent with, and not in excess of the level authorized for, comparable positions authorized by [T]itle 5.” In section 658(b)(3)(A), the phrase “and not in excess of the level authorized for” is set aside by commas and is a non-essential clause that is not necessary for reading the rest of the sentence. The sentence read without the clause states that such additional compensation must be “consistent with . . . comparable positions authorized by [T]itle 5.” Congress reads the § 658 additional compensation authority in just this manner in the legislative history when it treats the syntax and punctuation of the “consistent with” requirement as purposeful and omits the non-essential clause in describing the authority. A report accompanying a previous bill, the language of which now is codified at 6 U.S.C. 658, does not correct the syntax or punctuation of the language, nor does it directly quote the language, but uses slightly different language to describe the requirement that discretionary additional compensation must be consistent with comparable positions authorized by Title 5.

Neither 6 U.S.C. 658 nor the legislative history explain or identify how compensation can be consistent with a position. A dictionary definition of the phrase “consistent with” signals that the phrase does not require sameness. A case addressing the phrase “consistent with” in a corporate merger agreement confirms that “consistent with” does not require sameness, and also indicates that this phrase has meaning only when comparing similar things. Additional compensation and positions are not the same, or even similar things, and are not usually compared.

Moreover, most additional compensation provided under Title 5 depends not on an individual's position, but on whether the individual is an “employee,” as defined in Title 5. Under Title 5, most types of additional compensation are available to an employee, regardless of the employee's type of position.

Although the language of the “consistent with” requirement is ambiguous and confusing, the entire context of 6 U.S.C. 658 indicates that the “consistent with” requirement can be satisfied by basing additional compensation on authorities in Title 5. The heading of the subparagraph providing the discretionary additional compensation authority, and the “consistent with” requirement, is “Additional Compensation Based on Title 5 Authorities.” Therefore, Congress characterizes additional compensation that must be consistent with comparable positions authorized by Title 5 as being based on Title 5 authorities. This characterization is in contrast to the subparagraph heading mandating allowances in nonforeign areas, which is “Allowances in Nonforeign Areas” and does not further characterize this type of additional compensation.

Thus, DHS interprets the “consistent with” requirement as being satisfied by ensuring any discretionary additional compensation is based on Title 5 authorities, and those Title 5 authorities are provisions regarding any type of additional compensation. In 6 U.S.C. 658(b)(3)(A), Congress identifies three types of additional compensation: Benefits, incentives, and allowances. The terms “benefits,” “incentives,” and “allowances” are not defined in 6 U.S.C. 658, nor in Title 5, but are used in specific chapters, subchapters, and sections of Title 5, along with other terms describing additional compensation under Title 5. Even if a type of Title 5 additional compensation is not necessarily a “benefit,” “incentive,” or “allowance,” Congress gave the Secretary the ability to consider such compensation under the § 658 additional compensation authority by using the term “including,” which signals that the list of three possible examples of discretionary additional compensation is not exhaustive.

DHS understands this responsibility to base any discretionary additional compensation on Title 5 provisions as providing DHS discretion over which, if any, types of additional compensation to provide, as well as how to provide them. A base or foundation is not usually the entirety of a thing, but it is instead something on which more is built. Moreover, in contrast to the language mandating allowances in nonforeign areas that explicitly requires following all terms and conditions in Title 5 for those allowances, the language of the discretionary additional compensation authority does not require DHS use the terms and conditions of Title 5 provisions. Congress uses entirely different language for the discretionary additional compensation, which signals a different requirement for such additional compensation.

DHS must base any discretionary additional compensation on Title 5 provisions regarding types of additional compensation, and DHS may combine and streamline such provisions as long as it is clear which specific Title 5 provisions serve as the base or foundation for discretionary additional compensation. As discussed subsequently in III.B of this document, the current inability to quickly construct and nimbly adjust competitive total compensation packages is a main factor in DHS's challenges recruiting and retaining cybersecurity talent. Therefore, as discussed further in IV.E of this document, DHS is combining and streamlining several provisions of Title 5 to establish types of additional compensation specific to the new talent management system, as well as providing traditional Federal employee benefits, such as retirement, health benefits, and insurance programs.

(ii) The Level Authorized

To provide additional compensation that is not in excess of the level authorized for comparable positions authorized by Title 5, DHS must identify “the level” that applies for the five types of comparable positions authorized by Title 5. The definite article “the” in 6 U.S.C. 658(b)(3)(A) limits “level” to being a specific level authorized for those comparable positions.

The one, specific level under Title 5 that applies to Title 5 additional compensation for the five types of comparable positions authorized by Title 5 is the aggregate compensation cap in 5 U.S.C. 5307. The aggregate compensation cap limits certain cash payments if, when added to total basic pay, such a payment would cause the employee's annual total pay to exceed level I of the Executive Schedule (EX) or the salary of the Vice President. The cap amount that applies—EX-I or the salary of the Vice President—depends on position type. As discussed previously in III.A.3 of this document, comparable positions authorized by Title 5, at the very least, include SL/ST, SES, experts and consultants, critical pay, and DOD HQE positions. All individuals in such positions that qualify as an “employee” are subject to the aggregate compensation cap: The EX-I cap amount applies to experts and consultants positions and critical pay positions, and the Vice President's salary amount cap applies to SL/ST, SES, and DOD HQE positions.

Because discretionary additional compensation must not be in excess of the level authorized for comparable positions authorized by Title 5, such additional compensation when added to the salary of an employee in a qualified position may not cause that employee's aggregate compensation to exceed either EX-I or the Vice President's salary. Both annual aggregate compensation cap amounts are relevant in applying “the level” to discretionary additional compensation for qualified positions because both cap amounts apply for the five types of comparable positions authorized by Title 5, and a qualified position is simultaneously comparable to each such type of comparable position.

With the Secretary's broad authority and discretion for designating and establishing qualified positions, for determining comparable positions authorized by Title 5, for deciding whether to provide discretionary additional compensation, including what types and how to provide them, and for identifying the aggregate compensation cap as the level for such additional compensation, it follows that the Secretary also has implicit authority and discretion for how to apply the two cap amounts. In exercising this implicit authority and discretion, the Secretary must ensure that any discretionary additional compensation does not cause aggregate compensation for employees in qualified positions to exceed the applicable amount for that limit, and as such, DHS is applying both annual aggregate compensation cap amounts, as discussed further under IV.E.7 of this document.

B. Need for a New Approach to Cybersecurity Talent Management

To implement the broad authority and discretion in 6 U.S.C. 658, DHS set out to design a cybersecurity talent management system capable of solving DHS's historical and ongoing challenges recruiting and retaining cybersecurity talent. To do so, the specialized design team formed in 2016 analyzed:

• Historical DHS cybersecurity workforce data, including input from current DHS employees and leaders about talent requirements and gaps;
• notable changes to talent management at Federal agencies since the 1970s, including efforts commonly referred to as personnel demonstration projects or alternative personnel or pay systems;
• recommendations since the 1980s from non-profits, academia, and public service experts related to modernizing the Federal civil service and better supporting specialized, technical fields like cybersecurity;
• major trends and market forces affecting contemporary workers in public service and in the field of cybersecurity; and
• leading practices in both the public and private sectors for recruiting and retaining cybersecurity talent.

This analysis confirmed the main factors contributing to DHS's challenges recruiting and retaining cybersecurity talent: (1) The ever-evolving nature of cybersecurity work; (2) an outdated and rigid position classification system; and (3) a generic and inflexible compensation approach based on position classification. Constant, often unpredictable, changes in cybersecurity work require a focus on individuals and their skills instead of a focus on narrowly-defined and mostly-static jobs or positions created for predictable, stable work. Significantly, DHS organizations struggle to effectively describe cybersecurity work using outdated and rigid position classification methods designed to apply generically across government and myriad fields of expertise. DHS organizations also struggle to competitively compensate employees using generic and inflexible compensation structures that are closely linked to those classification methods.

The following discussion in III.B.1 through III.B.3 of this document explains these main factors and DHS's need for a new approach to cybersecurity talent management.

1. Ever-Evolving Nature of Cybersecurity Work Requires a Focus on the Individual

To adequately accommodate the ever-evolving nature of cybersecurity work, DHS must design and operate a new talent management system with a greater focus on individuals and individuals' skills instead of focusing on narrowly-defined and mostly-static jobs or positions. It is important to note that the term “skills,” as used in this document, encompasses a full array of knowledge, skills, abilities, behaviors, aptitudes, competencies, and other characteristics and qualities that distinguish talent.

Cybersecurity work, including the work necessary to execute the dynamic DHS cybersecurity mission, constantly changes as technologies and threats change. Cybersecurity work is knowledge work that requires individuals to apply their skills to solve problems and achieve outcomes, often in unpredictable ways. As cybersecurity work changes, both the skills necessary to perform that work and how those skills are applied to perform that work also change. With cybersecurity work, as with some other types of knowledge work, an individual, because of that individual's specific skills, can have a significant influence on how work activities and tasks are performed as well as the quantity and quality of resulting outcomes for the organization.

Additionally, cybersecurity work is intrinsically multidisciplinary, requiring individuals with a variety of skills associated with multiple academic disciplines and areas of professional specialization. Cybersecurity work is frequently performed in a team format in which individuals combine, and recombine, a variety of skills to generate effective, and potentially novel, solutions to problems. The manner in which they apply their collective skills is unique to the circumstances of each problem and cannot always be anticipated or described in advance. This collaborative work is often performed on an ad hoc or project basis.

Notably, there is no singular or standard cybersecurity career path, and work arrangements for cybersecurity talent continue to change. For some contemporary workers, a 30-year Federal career is not desirable, and it is increasingly common for individuals to have careers with multiple significant shifts between employers, fields of work, and types of jobs. A cybersecurity career may include a variety of work arrangements, including part-time work, longer-term jobs or assignments, and project-based work for limited periods of time. Also, collaborative cybersecurity work is often performed entirely through digital means by geographically dispersed individuals.

To succeed amidst such constant changes in cybersecurity work, individuals with cybersecurity skills look for career opportunities that allow them to continually learn in order to keep their expertise current and to acquire new skills. In coming years, the proliferation of machine learning, artificial intelligence, collaborative digital technology, and other advances will continue to transform cybersecurity work, further reinforcing the requirement for individuals performing cybersecurity work to maintain and acquire relevant, valuable cybersecurity skills. As cybersecurity work evolves, some cybersecurity skills can quickly become obsolete, while some new, difficult-to-obtain skills may emerge and become highly prized.

Currently, the demand for cybersecurity talent is high and the supply of cybersecurity talent is low, with studies continuing to document and project dramatic critical skills shortages in terms of hundreds of thousands of employees. With this shifting and growing skills gap, the competition for cybersecurity talent among Federal agencies and the private sector also shifts and grows. With more cybersecurity jobs nationally than qualified candidates, many individuals with sought-after cybersecurity skills are not active job seekers, having secured jobs performing work aligned to their interests. When an individual with uncommon cybersecurity skills accepts a new cybersecurity job, it is often after being pursued by several organizations interested in the individual's cybersecurity expertise.

Private sector employers have adjusted to the evolving nature of cybersecurity work, careers, and work arrangements by adopting new person- and skill-focused talent management practices that enable them to compete for critical talent. Such new practices include: Proactive recruitment to identify and seek out individuals who could be successful at cybersecurity work, even if they have never held a job in the field; eliminating traditional job requirements, like academic degrees, to avoid unnecessarily limiting applicant pools; and providing training to help employees keep skills current.

DHS can address its historical and ongoing challenges recruiting and retaining cybersecurity talent by designing a new talent management system with a focus on the individual and individuals' skills. To do so, DHS must create qualified positions based on individuals and skills. DHS must design and operate recruitment, application, and hiring processes to identify individuals with necessary skills as well as individuals likely to perform DHS cybersecurity work successfully, including those starting their careers who show promise and have an interest in public service. DHS must also design and operate a compensation system providing flexibility to adjust to cybersecurity talent market demands and recognize how employees influence and contribute to the cybersecurity mission. DHS can do this under the authority and exemptions in 6 U.S.C. 658, especially the Secretary's broad authority and discretion for designating and establishing qualified positions and the exemption relating to classification of employees.

2. Outdated, Rigid Position Classification Inadequately Describes Cybersecurity Work

Instead of using position classification methods and related talent management practices, DHS must create a new work valuation system that recognizes that cybersecurity work is constantly evolving and that the performance of cybersecurity work is highly dependent on the skills of individuals.

Traditional Federal position classification serves as the foundation for many existing Federal civilian talent management practices and provides structures that influence talent management for much of the Federal civil service across agencies. The design and operation of traditional Federal position classification methods, however, presume that mission requirements, technology, fields of work, and position duties are generally static and stable. Traditional Federal position classification is based on the core concepts that Federal work is largely predictable and can be defined and valued using the same processes regardless of mission, the nature of the work, or the individual performing the work.

Traditional Federal position classification methods are too rigid and outdated for cybersecurity talent management at DHS because they cannot effectively describe and support the ever-evolving cybersecurity work associated with DHS's dynamic cybersecurity mission. Traditional Federal position classification has been the foundation of most Federal civilian talent management practices since the GS position classification system was established in the Classification Act of 1949, which was based on the first law regarding work valuation, the Classification Act of 1923. While the core concepts and major features of the GS position classification system were established almost 100 years ago, they have remained largely unchanged. Notably, classification reform was excluded from the largest transformation of Federal talent management in the last 50 years, the Civil Service Reform Act of 1978.

Traditional Federal position classification primarily focuses on the work of a position and minimally accounts for the individual or the individual's skills, including how the individual's skills may influence the performance of work. For decades scholars and practitioners have discussed the problems with traditional Federal position classification's ability to describe knowledge work, particularly when multiple disciplines are applied by one position or individual and when work assignments change quickly. For example, the U.S. Government Accountability Office (GAO) recently highlighted that, almost since the inception of the GS position classification system in 1949, critics have raised questions about its ability to keep pace with the evolving nature of government work. GAO had previously explained: “The classification process and standard job classifications were generally developed decades ago when typical jobs were more narrowly defined and, in many cases, were clerical or administrative. However, today's knowledge-based organizations' jobs require a broader array of tasks that may cross over the narrow and rigid boundaries of job classification.” GAO emphasized that under traditional Federal position classification, “the resulting job classifications and related pay might not match the actual duties of the job. This mismatch can hamper efforts to fill the positions with the right people.”

Additionally, position classification standards, which supply the criteria for classifying positions, describe work as it existed and was performed throughout Federal agencies at the time the standards were developed. Rigid position classification standards are not—and have never been—able to adequately support the emerging field of cybersecurity or keep pace with rapid changes in how cybersecurity work is performed. For example, the first position classification standards for the digital computer occupation were published in 1958, but “rapid changes in technology” necessitated updates to those newly published standards only one year later in 1959. Decades later in 1989, the Merit System Protection Board highlighted that Federal computer-focused work was subject to more rapid change than work in other fields. Despite such findings, updates to position classification standards related to cybersecurity have remained infrequent, even as technological change has accelerated. Currently, a classification determination using outdated position classification standards dictates a cybersecurity position's salary under Title 5 and such a determination also constricts potential future salary for any individual appointed to the position. Existing position classification methods cannot accommodate or address significant changes in the cybersecurity work of such a position or easily acknowledge changes in the skills needed to perform the work.

Congress has long recognized the role traditional Federal position classification plays in hampering flexibility and innovation when addressing recruitment and retention challenges. As part of authorizing a series of human capital flexibilities for civilian intelligence organizations in DOD in the 1980s, now consolidated within the DOD DCIPS authority, Congress included an exemption from laws relating to “classification” for those DOD organizations. This classification exemption in the DCIPS predecessor authorities is the origin of the similar exemption relating to classification in 6 U.S.C. 658(b)(1)(B). Nearly 40 years ago, in the legislative history for one of the DOD DCIPS predecessor authorities, Congress recognized that the Defense Intelligence Agency “must be able to compete effectively in the job market for these skills [in foreign intelligence analysis] and offer rewarding career prospects to retain personnel.” Congress also recognized: “Intelligence personnel management systems also need to be flexible to adjust to changing intelligence interests as driven by a dynamic world environment.” In this legislative history, Congress specifically called out the classification exemption stating: “Classification authority would be granted to permit establishment of compensation based on individual capabilities and to ensure timely assignment and utilization of high quality personnel to meet changing intelligence requirements.”

The exemption relating to classification in 6 U.S.C. 658 exempts DHS from traditional Federal position classification systems and methods and allows DHS to establish a new work valuation system to serve as a new foundation for new, specialized talent management practices. A new work valuation system must have new structures to adequately describe ever-evolving DHS cybersecurity work. It must also support creating qualified positions based on cybersecurity skills and the individuals with those skills and operating new talent management practices for those positions. Importantly, a new work valuation system is necessary for a new compensation system and must enable and support new practices for providing competitive compensation.

3. Generic, Inflexible Compensation Limits Ability To Compete for Cybersecurity Talent

Instead of existing compensation practices linked to traditional Federal position classification, DHS needs a new, market-sensitive salary system and an agile approach to providing other compensation for cybersecurity talent. Current Federal civilian compensation practices under Title 5 authority are designed to apply and be administered across a range of agencies, missions, and types of work. DHS needs a different compensation approach for the same reasons that DHS needs to create a new work valuation system: To recognize that cybersecurity work is constantly evolving and to recognize that the performance of cybersecurity work is highly dependent on the skills of individuals. Changing the underlying work valuation system of a talent management system also necessitates changing the connected compensation system.

Current compensation approaches for most positions in the Federal civil service are based on the same core concepts as traditional Federal position classification: Federal work is presumed to be largely predictable and able to be described and valued using the same processes regardless of mission, the nature of the work, or the individual performing the work. Such Federal compensation approaches use traditional Federal position classification structures, including classes and grades, to facilitate systematic management of Federal employees and address internal equity among similar positions across Federal agencies. These structures ensure that positions are described and paired with salary rates in a consistent manner using generic salary structures, including the GS pay system, that apply across myriad fields of work and cannot effectively account for an individual's cybersecurity skills or the cybersecurity work an individual performs. For example, the specific requirements for salary progression under the GS pay schedule, including grade and step increases, assume that an employee becomes better at work, more qualified, and more valuable to an agency with each passing year.

As discussed previously, however, cybersecurity work is constantly changing and performance of DHS cybersecurity work depends on individuals with mission-critical skills, which also change as technology and threats change. Moreover, the cybersecurity skills that are the most valuable to DHS today might not be as valuable to DHS in five, ten, or 30 years. For example, DHS, like many cybersecurity employers, now needs individuals with skills related to mobile technology, cloud computing, the Internet of Things, embedded and cyber-physical systems, blockchain, cryptocurrency and ransomware and cyber extortion; the DHS cybersecurity mission did not require all these skills and specializations ten or even five years ago.

Additionally, there is a specific, competitive talent market for cybersecurity that comprises both cybersecurity talent, which is individuals with cybersecurity skills, and cybersecurity employers, including Federal agencies and private sector employers. As discussed previously, the current demand for cybersecurity talent is high, and the supply of cybersecurity talent is low. This relationship between demand for and supply of cybersecurity talent causes competition among employers for top cybersecurity talent, and as a result, individuals with cybersecurity skills, especially uncommon skills, have their choice of employment opportunities.

In competing for top cybersecurity talent, DHS has the advantage of its unique cybersecurity mission. DHS's cybersecurity mission offers DHS cybersecurity talent the opportunity to work across organizations and with key external partners and stakeholders to identify and mitigate national cybersecurity risks. Unfortunately, DHS cannot currently compete with compensation packages offered by many private sector employers. DHS's ability to offer competitive compensation to top cybersecurity talent, including individuals with uncommon, mission-critical skills, is limited by generic Federal salary structures, inflexible rules and practices for setting and adjusting salaries, and inflexible rules and practices for providing other compensation.

In contrast, many private sector employers can offer individuals with cybersecurity expertise competitive starting salaries as well as the possibility of more rapid raises and significant other compensation, such as automatic signing bonuses. Many private sector employers are also able to swiftly adjust their compensation packages to recruit and retain top talent, and they do so with an understanding of their major competitors and those competitors' approaches to compensation. These private sector employers have compensation strategies and techniques with built-in agility to respond to business or market changes.

In addition to salaries, compensation in the cybersecurity talent market includes types of other compensation. DHS could offer other compensation using the existing Federal compensation toolset; however, it is both cumbersome to use and ineffective for constructing market-sensitive compensation packages capable of recruiting highly-skilled cybersecurity talent. That toolset comprises a complex set of separate types of compensation for specific Federal talent management situations and are not intended to form a cohesive set. For example, there are multiple types of incentives and cash payments available, and each type applies to a different recruitment or retention situation and has different rules and requirements, including approvals, amount limitations, and administration processes. This incohesive toolset also is designed to complement generic Federal salary structures, and much like those structures, it is designed to apply and be administered across a range of agencies, missions, and fields of work, and is not intended to be market-sensitive. To construct a competitive compensation package, especially one that is responsive to the talent market, requires piecing together these separate types of compensation and attempting to do so in a timely manner.

The compensation authority in 6 U.S.C. 658, as well as the exemptions relating to classification and compensation, allows DHS to establish a new compensation system to effectively recruit and retain cybersecurity talent by offering competitive compensation. And if DHS is creating a new work valuation system, DHS must create a new compensation approach that is based on that new work valuation system. A new compensation system also must be based on cybersecurity skills, people with those skills, and the value of those skills to DHS. Such an approach to compensation must be informed both by DHS mission needs and trends affecting compensation of individuals with cybersecurity skills in the broader cybersecurity talent market. A new compensation system must provide flexibility to adjust to cybersecurity talent market demands and recognize mission impact, instead of rewarding longevity in position or Federal government service; it must also provide flexibility to consider an individual's total compensation and quickly construct and nimbly adjust a competitive total compensation package.

IV. Discussion of the Rule

To address the Department's historical and ongoing challenges recruiting and retaining cybersecurity talent, DHS is re-envisioning talent management for 21st-century cybersecurity work under the authority in 6 U.S.C. 658. The result is CTMS.

CTMS is a mission-driven, person-focused, and market-sensitive approach to talent management. CTMS relies on new concepts and definitions and features interrelated elements, which are new processes, systems, and programs, that are based on leading public and private sector talent management practices.

CTMS is designed to be responsive to the ever-evolving field of cybersecurity and the dynamic DHS cybersecurity mission. This innovative talent management approach is intended to support and remain aligned to the cybersecurity work that executes the DHS cybersecurity mission, even as technology, relevant expertise, and cybersecurity work arrangements change.

The result of this approach to talent management is the DHS-CS. The DHS-CS comprises qualified positions created under CTMS and employees serving in those positions and covered by CTMS.

The DHS-CS is a new cadre within the broader DHS cybersecurity workforce supporting execution of the DHS cybersecurity mission. The DHS-CS is not intended to replace the DHS civilian employees and United States Coast Guard Military personnel currently performing work relating to cybersecurity.

DHS will first use CTMS and hire the first DHS-CS employees in the Cybersecurity and Infrastructure Security Agency (CISA) and DHS Office of the Chief Information Officer (DHS OCIO). DHS will operate CTMS in work units consistent with its rights and obligations under the Federal Service Labor Management Relations Statute. Additionally, 6 U.S.C. 658(e) prohibits the involuntary conversion of existing DHS employees into the DHS-CS. Accordingly, current DHS employees will not be placed into qualified positions or required to join the DHS-CS. All individuals interested in supporting the DHS cybersecurity mission by serving in the DHS-CS, including current DHS employees, other Federal employees, and private citizens, must apply for employment under CTMS.

DHS is adding a new part 158 to Title 6 of the Code of Federal Regulations to implement and govern CTMS and the DHS-CS. Part 158 contains several subparts setting forth the interrelated CTMS elements that function together as a complete talent management system. The subparts and sections in part 158 contain internal cross-references indicating where one element of the system influences another element.

Subparts A and B of part 158 address the new approach to talent management, new talent management concepts and CTMS-specific definitions, and the DHS-CS. Subpart C addresses CTMS and DHS-CS leadership. Subpart D introduces the CTMS element of strategic talent planning that enables CTMS to be mission-driven, person-focused, and market-sensitive. Subparts E, F, G, and H address CTMS elements for acquiring talent, compensating talent, deploying talent, and developing talent, respectively. Subpart I addresses Federal civil service employee rights and requirements that apply under CTMS and in the DHS-CS and Subpart J addresses CTMS political appointments, known as advisory appointments.

New part 158 establishes CTMS and the DHS-CS and the policy framework for both. Part 158 sets the parameters for how DHS will administer CTMS and manage the DHS-CS. Internal DHS policy implementing part 158 will provide operational detail. Part 158 implements the Secretary's authority in 6 U.S.C. 658 and it is the Secretary or the Secretary's designee who establishes and administers CTMS and establishes and manages the DHS-CS. Part 158 also makes clear that it is the Secretary or the Secretary's designee who establishes and administers the CTMS elements, while it is the “Department” that operates the elements. As defined in § 158.104, the term “Department” means the Department of Homeland Security. In internal DHS policy implementing part 158, the Secretary will, as necessary, delegate authority and designate and delineate roles and responsibilities for specific DHS organizations and officials.

A. New Approach to Talent Management: Subparts A & B

Subpart A in new 6 CFR part 158 addresses the design, establishment, and coverage of CTMS and the DHS-CS, the authority for part 158, and new talent management concepts and CTMS-specific definitions. Subpart B in new part 158 addresses the DHS-CS and sets out the main aspects of the DHS-CS and employment in the DHS-CS.

1. Subpart A—General Provisions

Part 158, subpart A, General Provisions, contains regulations addressing the design and establishment of CTMS. CTMS encompasses the definitions and processes, systems, and programs established under part 158. As stated in § 158.101, CTMS is designed to recruit and retain individuals with the qualifications necessary to execute the DHS cybersecurity mission. CTMS is also designed to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission.

Along with CTMS, DHS is establishing the DHS-CS. See § 158.101. As defined in § 158.104, the DHS-CS comprises all qualified positions designated and established under CTMS and all employees appointed to qualified positions. DHS hires, compensates, and develops DHS-CS employees using CTMS. Section 158.103 explains that part 158 covers CTMS, the DHS-CS, all individuals interested in joining the DHS-CS, all DHS-CS employees, and all individuals involved in managing DHS-CS employees and all individuals involved in any talent management actions using CTMS.

The adaptable design of CTMS enables DHS to manage the DHS-CS with a focus on mission-critical qualifications, even as cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission change.

As discussed previously in III.A of this document, the authority in 6 U.S.C. 658, especially the authority and discretion for designating and establishing qualified positions and the exemption from laws relating to classification, enable DHS to create this new mission-driven, person-focused, and market-sensitive approach. As also discussed previously in III.B, DHS needs this new approach for 21st-century cybersecurity work and to address DHS's challenges recruiting and retaining cybersecurity talent.

(a) A New Type of Position: Qualified Positions

Under part 158, “qualified position” means CTMS qualifications and DHS-CS cybersecurity work, the combination of which is associable with an employee. See § 158.104. The purpose of this conceptual definition of qualified position is to capture the relationship between CTMS qualifications and DHS-CS cybersecurity work: An individual with those qualifications should be able to successfully and proficiently perform that range of cybersecurity work. The cybersecurity work of a qualified position represents a range of potential DHS cybersecurity work, in acknowledgement that qualifications can be applied in a variety of ways to produce a variety of work outcomes, including some that are hard to predict or describe in detail in advance. DHS also uses the term qualified position in the administration and operation of CTMS to refer to the specific qualified position established for a DHS-CS employee upon appointment. A DHS-CS employee's qualified position is the employee's assessed CTMS qualifications and the range of work that employee can successfully and proficiently perform with those qualifications. When DHS documents a DHS-CS employee's qualified position as part of recordkeeping under § 158.706, DHS is documenting that employee's CTMS qualifications and the employee's related range of work.

DHS is creating qualified positions as a new type of Federal civil service position with a focus on individuals and qualifications under the Secretary's authority and discretion for designating and establishing qualified positions and the exemption from laws relating to classification in 6 U.S.C. 658. DHS is not using existing types of positions defined under Chapter 51 position classification, or processes from Title 5 or other laws, to create qualified positions.

As explained previously in III.C.1 of this document, under the authority and exemptions in 6 U.S.C. 658, DHS may determine the use of qualified positions and create such positions as new positions in the excepted service. DHS may do so without regard to existing definitions of positions, and how the concept of position is currently used, in other Federal talent management systems. DHS designates and establishes qualified positions based on the DHS cybersecurity mission and the skills, or qualifications, individuals must possess to execute that mission.

Designating and establishing qualified positions based on the DHS cybersecurity mission and individuals' qualifications implements the statutory definition and description of qualified position. Section 658 defines a qualified position as a position, designated by the Secretary, in which the incumbent performs, manages, or supervises functions that execute the responsibilities of DHS relating to cybersecurity. The statute also describes qualified positions as positions the Secretary, in establishing those positions, determines are necessary to carry out DHS's cybersecurity responsibilities. In both instances, the statute vests substantial discretion in the Secretary to determine which positions are qualified positions under the statute. This rule retains that discretion.

Designating and establishing qualified positions as a new type of position also implements the statutory description of establishing qualified positions, which indicates they may be a type of position or a category that includes several types of positions. The statutory description of establishing qualified positions states that qualified positions may include positions “formerly identified as” SL/ST positions and SES positions. The “formerly identified as” language identifies SL/ST positions and SES positions as examples of types of positions the Secretary may designate and establish as qualified positions. Thus, qualified positions may be similar to SL/ST positions and SES positions, but these non-exhaustive examples do not limit the Secretary to creating qualified positions only as SL/ST-like positions and SES-like positions.

The Secretary or designee designates and establishes qualified positions in the excepted service as the Secretary or designee determines necessary for the most effective execution of the DHS cybersecurity mission. See § 158.203. Designating and establishing qualified positions is discussed further in IV.A.2 of this document.

(b) A New Definition of “Qualifications”

As mentioned previously, DHS is defining individuals' cybersecurity skills as “qualifications” for purposes of designating and establishing qualified positions. Individuals' cybersecurity skills encompass a full array of characteristics and qualities that distinguish talent.

Under part 158, “qualification,” means a quality of an individual that correlates with the successful and proficient performance of cybersecurity work, such as capability, experience and training, and education and certification. See § 158.104. A capability is a cluster of interrelated attributes that is measurable or observable or both. A capability under CTMS is analogous to a grouping of competencies. Interrelated attributes under CTMS include knowledge, skills, abilities, behaviors, and other characteristics.

DHS must create its own qualifications for its unique cybersecurity mission because the field of cybersecurity currently lacks formal, universal standards for cybersecurity skills on which to base CTMS qualifications. As discussed previously in III.B.1 of this document, cybersecurity skills continue to change at a staggering pace because of the ever-evolving nature of cybersecurity work. This rapid change hampers professionalization in the field of cybersecurity, including the establishment of universal standards for cybersecurity skills. Moreover, DHS's unique cybersecurity mission requires specialized skills and specific combinations of those skills. Therefore, DHS needs to identify, validate, and maintain its own set of qualifications necessary to execute the DHS cybersecurity mission, including the unique functions and responsibilities of DHS organizations.

DHS identifies CTMS qualifications as part of the strategic talent planning process. See §§ 158.401 and 158.402. On an ongoing basis, DHS identifies the functions that execute the DHS cybersecurity mission, the cybersecurity work required to perform, manage, or supervise those functions, and the qualifications necessary to perform that work. DHS comprehensively identifies DHS cybersecurity work, and identifies a set of qualifications necessary to perform that work. This comprehensive set of CTMS qualifications reflects the collective expertise necessary to execute the DHS cybersecurity mission.

With the assistance of both industrial and organizational psychologists and DHS cybersecurity experts, DHS identifies, documents, and verifies those qualifications. To ensure CTMS qualifications are appropriately work-related, DHS identifies CTMS qualifications in accordance with appropriate legal and professional guidelines, such as the Uniform Guidelines on Employee Selection Procedures and the Principles for the Validation and Use of Personnel Selection Procedures.

DHS organizes CTMS qualifications into broad categories defined primarily in terms of capabilities, such as general professional capabilities, cybersecurity technical capabilities, and leadership capabilities. Such categories of capabilities are further defined using proficiency standards or scales. Professional capabilities, such as critical analysis, customer orientation, and effective communication, are required in some capacity for all DHS cybersecurity work. Cybersecurity technical capabilities, such as cybersecurity engineering, digital forensics, and vulnerability assessment, are required in different combinations and at different proficiency levels for specific categories of cybersecurity work. For example, individuals performing entry-level cybersecurity work often require very little proficiency in technical capabilities to be successful, and those performing expert-level, highly-specialized work often require a high level of proficiency in one or more technical capabilities to be successful. Cybersecurity work related to leading people and organizations requires leadership capabilities, such as leading change, leading organizations, and resource management, and DHS cybersecurity senior leadership requires the highest levels of proficiency in such capabilities.

CTMS qualifications derived from the dynamic DHS cybersecurity mission are the core of CTMS and its elements. DHS determines which individuals to recruit and retain based on the specific CTMS qualifications they are likely to possess and have been demonstrated to possess. CTMS qualifications are a key component of the work valuation system, the talent acquisition system, the compensation system, the performance management program, and the career development program, each discussed subsequently in this document.

DHS is using qualifications as the core of CTMS and may do so under the Secretary's authority and discretion for designating and establishing qualified positions and the exemption from laws relating to classification in 6 U.S.C. 658.

(c) Other Definitions

In subpart A, § 158.104 defines terms used throughout part 158, several of which incorporate new concepts and are specific to CTMS, like qualified positions and qualifications, discussed previously. Other new terms and definitions in § 158.104 include the following:

• “Assignment” means a description of a specific subset of DHS cybersecurity work and a specific subset of CTMS qualifications necessary to perform that work, the combination of which is associable with a qualified position. This conceptual definition of assignment connects the performance of particular work to broader qualifications and cybersecurity work of a qualified position. DHS also uses the term assignment in the administration and operation of CTMS to refer to and document the details of a DHS-CS employee's current role related to the cybersecurity mission. A DHS-CS employee's assignment is a description of a specific subset of DHS-CS cybersecurity work, a specific subset of the employee's CTMS qualifications, and how the employee is expected to apply those qualifications to perform that work. Assignments are discussed further in IV.A.2 of this document.
• “CTMB” means the Cybersecurity Talent Management Board that assists the Secretary, or the Secretary's designee, in administering CTMS and managing the DHS-CS. The Secretary or the Secretary's designee appoints officials to serve on the CTMB and designates the CTMB's Co-Chairs.
• “Cybersecurity work” means activity involving mental or physical effort, or both, to achieve results relating to cybersecurity.
• “DHS-CS cybersecurity work” means the cybersecurity work identified based on the DHS cybersecurity mission.
• “DHS cybersecurity mission” encompasses all responsibilities of DHS relating to cybersecurity and is fully described in § 158.201.
• “Mission impact” means a DHS-CS employee's influence on execution of the DHS cybersecurity mission through application of the employee's CTMS qualifications to successfully and proficiently perform DHS-CS cybersecurity work. Mission impact is a factor in DHS-CS employee compensation, performance management, and development. Mission impact is discussed further as part of the compensation system, the performance management program, and the career development program in IV.E and IV.G, of this document respectively.
• “Anticipated mission impact” means the influence DHS anticipates an individual to have on execution of the DHS cybersecurity mission based on the individual's CTMS qualifications and application of those qualifications to successfully and proficiently perform DHS-CS cybersecurity work. Anticipated mission impact of an individual selected for appointment to a qualified position can be a factor in providing compensation for that individual, including initial salary and any recognition payment or recognition time-off offered as a signing bonus. Anticipated mission impact is discussed further as part of the compensation system in IV.E of this document.
• “Mission-related requirements” means characteristics of an individual's expertise or characteristics of cybersecurity work, or both (including cybersecurity talent market-related information), that are (1) associated with successful execution of the DHS cybersecurity mission, and that are (2) determined by officials with appropriate decision-making authority. Mission-related requirements are relevant for addressing emerging or urgent mission circumstances that are not yet reflected in the set of CTMS qualifications, or that may be temporary in nature, but need to be addressed nonetheless. Mission-related requirements are a factor in salary setting and DHS-CS employee recognition under the compensation system, matching DHS-CS employees with assignments under the deployment program, and guiding DHS-CS employee career progression under the career development program, all discussed subsequently.
• “Strategic talent priorities” means the priorities for CTMS and the DHS-CS set by the Secretary or the Secretary's designee on an ongoing basis under § 158.304. The Secretary or the Secretary's designee uses strategic talent priorities for administering CTMS and managing the DHS-CS. Strategic talent priorities inform strategic recruiting under the talent acquisition system, salary setting and DHS-CS employee recognition under the compensation system, matching DHS-CS employees with assignments under the deployment program, and guiding DHS-CS employee career progression under the career development program, all discussed subsequently.

Other terms used throughout part 158 that are not necessarily new, but are defined in § 158.104 specific to CTMS include the following:

• “Additional compensation” is several types of CTMS-specific compensation and is described in § 158.603(c) as recognition, other special pay, and other types of compensation such as leave and benefits. Note that benefits for Federal employees provided under Title 5, such as leave and retirement, are usually treated as separate from Federal pay or compensation, but under 6 U.S.C. 658 benefits are explicitly considered compensation.

• Appointment types under CTMS are: “renewable appointment,” “continuing appointment,” and “advisory appointment.” Each type of appointment is analogous to a type of appointment under Title 5 and is discussed further in IV.C.3. of this document.
• “Cybersecurity talent market” means the availability, in terms of supply and demand, of talent relating to cybersecurity and employment relating to cybersecurity, including at other Federal agencies such as DOD. DHS analyzes the cybersecurity talent market to identify and monitor employment trends and to identify leading strategies for recruiting and retaining cybersecurity talent. That analysis is part of the strategic talent planning process and informs the compensation system, discussed subsequently.
• “Salary” means an annual rate of pay under CTMS and is basic pay for purposes under Title 5. Note that instead of the term basic pay, the term salary is used to describe a DHS-CS employee's annual rate of pay.
• “Talent management” means a systematic approach to linking employees to mission and organizational goals through intentional strategies and practices for hiring, compensating, and developing employees. DHS purposefully uses the term talent management for CTMS because of its focus on people and its association with integrated, strategic approaches to recruitment and retention of talent in alignment with organizational goals. This contrasts with traditional Federal terms, such as human resources and personnel management, which are often characterized by tactical execution of administrative processes and compliance activities. Note, however, that a “talent management action” under CTMS has the same meaning as “personnel action” under Title 5.
• “Work level” means a grouping of CTMS qualifications and DHS-CS cybersecurity work with sufficiently similar characteristics to warrant similar treatment in talent management under CTMS. For example, similar characteristics may include level or type of technical expertise or a level or type of leadership responsibility. Work level is one of the work and career structures established by the new work valuation system, and is discussed further in IV.C.3 of this document.
• “Work valuation” means a methodology through which an organization defines and evaluates the value of work and the value of individuals capable of performing that work. Under CTMS, DHS uses the new person-focused work valuation system instead of the GS or another traditional Federal position classification system based on 5 U.S.C. Chapter 51.

Other terms used throughout part 158 with definitions set forth in § 158.104 include “DHS-CS employee,” and “DHS-CS advisory appointee,” and other terms already defined in law, such as “cybersecurity risk,” “cybersecurity threat,” and “functions,” which are defined in Title 6 of the U.S. Code. An additional term defined in § 158.104 is “CTMS policy,” which is internal DHS policy, and means DHS's decisions implementing and operationalizing the regulations in part 158, and includes directives, instructions, and operating guidance and procedures for DHS employees.

(d) Authority & Policy Framework

In subpart A, § 158.102 states that 6 U.S.C. 658 is the authority for part 158 and CTMS and explains the scope of that authority. As discussed in III.C of this document, DHS has broad authority to design and establish CTMS as a new approach to talent management and establish the resulting DHS-CS. By statute, the Secretary's authority “applies without regard to the provisions of any other law relating to the appointment, number, classification, or compensation of employees.” See 6 U.S.C. 658(b)(1)(B). Consistent with this authority, § 158.102 explains that part 158 supersedes all other provisions of law and policy relating to appointment, number, classification, or compensation of employees that conflict with 6 U.S.C. 658, the regulations in part 158, or CTMS policy implementing part 158. Also, subparts C, D, E, and F each contain a section that lists specific provisions of other laws that, under the exemption in 6 U.S.C. 658 regarding appointment, number, classification, and compensation of employees, are inapplicable under CTMS. See §§ 158.405, 158.502, 158.605, and 158.709.

Section 158.102 also explains that some compensation under CTMS is provided in accordance with other provisions of law, including OPM regulations, but that CTMS compensation is only authorized under part 158. Additionally, § 158.102 explains that when some CTMS compensation is provided in accordance with relevant provisions of other laws, including OPM regulations, DHS follows those other provisions to the extent compatible with talent management under CTMS. To maintain the integrity of CTMS, DHS may need to modify application of relevant provisions of other laws regarding compensation for the DHS-CS. This is because some of the terms, or concepts, used in those other relevant provisions are not used under CTMS, and DHS may have to extrapolate between those terms and concepts and CTMS terms and concepts to apply those other provisions.

The regulations in part 158 set up the policy framework for CTMS and the DHS-CS, and DHS administers CTMS and manages the DHS-CS under part 158 and CTMS policy implementing part 158, which is internal DHS policy. See § 158.101. If DHS determines additional provisions of other laws or policy concerning Federal employment apply under CTMS, DHS will implement those other laws or policy in CTMS policy. When any talent management situation or emerging issue regarding the DHS-CS needs clarification, DHS will do so in CTMS policy.

Section 158.102 also includes a preservation of authority clause to ensure it is clear that nothing in part 158 shall be deemed or construed to limit the authority under 6 U.S.C. 658 and any further implementation or interpretation of that authority. If DHS determines any such implementation or interpretation necessitates a change in part 158, DHS will issue an amendment to this rule.

2. Subpart B—DHS Cybersecurity Service

Subpart B, DHS Cybersecurity Service, contains regulations addressing the DHS cybersecurity mission and the DHS-CS. Regulations in subpart B also explain the main aspects of employment for DHS-CS employees, including assignments in the DHS-CS. This subpart provides an overview of CTMS from an applicant or DHS-CS employee perspective and provides references to other rule sections for more information. This subpart explains generally the mission-driven, person-focused, market-sensitive approach that DHS is establishing under the authority and exemptions in 6 U.S.C. 658.

(a) Mission

The DHS cybersecurity mission drives talent management under CTMS and § 158.201 describes the DHS cybersecurity mission for purposes of CTMS. This mission encompasses all responsibilities of DHS relating to cybersecurity. It is dynamic to keep pace with the evolving cybersecurity risks and cybersecurity threats facing the Nation and to adapt to any changes in DHS's cybersecurity responsibilities.

As part of establishing CTMS, DHS is also establishing the DHS-CS, the purpose of which is to enhance the cybersecurity of the Nation through the most effective execution of the DHS cybersecurity mission. See § 158.202. The DHS-CS comprises all qualified positions designated and established under CTMS and all employees serving in qualified positions.

(b) Qualified Positions

DHS designates qualified positions under the deployment program, described in § 158.701. See § 158.203. Designating qualified positions is part of determining whether DHS needs to use CTMS to recruit and retain individuals possessing CTMS qualifications. The process of designating qualified positions is set out in § 158.702. This process, and the deployment program generally, are discussed further in IV.F of this document.

DHS establishes qualified positions under the talent acquisition system, described in § 158.501, by appointing an individual to a previously designated qualified position. See § 158.203. DHS establishes and fills qualified positions concurrently. The talent acquisition system, and the processes for assessing, selecting, and appointing an individual, are discussed further in IV.D of this document.

(c) DHS-CS Employees

All employees serving in qualified positions are DHS-CS employees and all DHS-CS employees are in the excepted service. DHS hires, compensates, and develops DHS-CS employees using CTMS. See § 158.204. DHS manages the DHS-CS based on DHS-CS core values of expertise, innovation, and adaptability, set out in § 158.305 and discussed subsequently.

DHS-CS employees execute the DHS-CS cybersecurity mission by applying their CTMS qualifications to perform the DHS-CS cybersecurity work of their assignments. See § 158.204. Successful and proficient performance of that work results in mission impact, which is defined in § 158.104 as the employee's influence on the DHS cybersecurity mission. DHS reviews and recognizes a DHS-CS employee based on the employee's mission impact. See §§ 158.204, 158.630, and 158.805.

DHS provides compensation to DHS-CS employees in alignment with the CTMS compensation strategy, and compensation under CTMS includes both salary and additional compensation. See §§ 158.204, 158.601, and 158.603. Also, DHS strategically and proactively recruits individuals for employment in the DHS-CS, and DHS guides the development and career progression of DHS-CS employees. See §§ 158.204, 158.510, and 158.803.

(d) DHS-CS Assignments

As explained in § 158.205, each DHS-CS employee has one or more assignments during the employee's service in the DHS-CS.

Each DHS-CS employee receive an initial assignment upon appointment to a qualified position. See §§ 158.205 and 158.703. A DHS-CS employee may later receive a subsequent assignment, but a DHS-CS employee may only have one assignment at a time.

DHS designates and staffs assignments under the deployment program. See §§ 158.205 and 158.703. The deployment program, and the processes for designating and staffing assignments, is discussed further in IV.F of this document.

B. CTMS and DHS-CS Leadership: Subpart C

Subpart C, Leadership, sets up the leadership structure for administering CTMS, including the Cybersecurity Talent Management Board (CTMB). Subpart C also contains regulations addressing the influence of the merit system principles on CTMS and the DHS-CS, and establishing strategic talent priorities and DHS-CS core values.

1. Leaders

As stated in § 158.301, the Secretary, or the Secretary's designee, is responsible for administering CTMS and managing the DHS-CS. This includes establishing and maintaining CTMS policy implementing part 158.

The Cybersecurity Talent Management Board (CTMB) assists the Secretary, or the Secretary's designee, in administering CTMS and managing the DHS-CS. See § 158.301. The CTMB comprises officials representing DHS organizations involved in executing the DHS cybersecurity mission and officials responsible for developing and administering talent management policy. See § 158.302. The Secretary or the Secretary's designee appoints officials to serve on the CTMB and designates the CTMB's Co-Chairs.

The CTMB shapes and monitors CTMS and the DHS-CS. The CTMB periodically evaluates whether CTMS is recruiting and retaining individuals with the qualifications necessary to execute the DHS cybersecurity mission. See § 158.302. The CTMB may use information from this evaluation to recommend, or make, adjustments to CTMS, which may include improvements to the administration or operation of CTMS elements and practices. The CTMB may designate an independent evaluator to conduct an evaluation, as necessary.

2. Principles, Priorities, and Core Values

The Secretary or Secretary's designee, with assistance from the CTMB, administers CTMS and manages the DHS-CS based on: Talent management principles that address merit system principles, advancing equity, and equal employment opportunity; strategic talent priorities for CTMS and the DHS-CS; and DHS-CS core values. These principles, priorities, and core values are set out in §§ 158.303 through 158.305.

As stated in § 158.303, CTMS is designed and administered based on the core Federal talent management principles of merit and fairness embodied by the merit system principles in 5 U.S.C. 2301(b). While CTMS is an innovative approach to talent management, featuring new, specialized practices not present in many Federal civilian personnel systems, CTMS remains a merit system in which Federal employment is based on merit and individual competence instead of political affiliation, personal relationships, or other non-merit factors. CTMS features elements and practices for acknowledging individuals' qualifications and ensuring individuals are treated equitably based on merit and for ensuring DHS-CS employees are managed in the public interest. Additionally, the prohibited personnel practices in 5 U.S.C. 2302(b) apply to CTMS and the individuals covered by CTMS.

In addition to the influence of the merit system principles and application of prohibited personnel practices, CTMS is designed, and administered, and DHS manages the DHS-CS, in accordance with applicable anti-discrimination laws and policies. See § 158.303. Talent management actions under CTMS that materially affect a term or condition of employment must be free from discrimination. See § 158.303. Through such commitment to anti-discrimination, DHS aims to reinforce the design of CTMS as a merit system, in which all individuals, including those belonging to underserved communities that have been denied consistent and systematic fair, just, and impartial treatment in cybersecurity and Federal employment historically, are treated equitably and without discrimination. In alignment with Executive Order 13985, underserved communities for which DHS seeks to ensure equal employment opportunity include Black, Latino, and Indigenous and Native American persons, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities; persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality.

Under § 158.304, the Secretary or Secretary's designee, with assistance from the CTMB, sets strategic talent priorities for CTMS and the DHS-CS on an ongoing basis using a variety of information. Importantly, information from strategic talent planning is used to set strategic talent management priorities. As discussed subsequently, this is information that is generated by the strategic talent planning process and its underlying processes, as well as information from administering CTMS. Setting strategic talent priorities based on the types of information aggregated in strategic talent planning ensures that such priorities reflect the latest strategic information about the DHS cybersecurity mission, cybersecurity work, and the cybersecurity talent market. Other information used in setting strategic talent priorities is information from DHS financial planning and strategic planning, and DHS priorities outside of CTMS and the DHS-CS. Strategic talent priorities are reviewed and updated to ensure that CTMS is administered and the DHS-CS is managed in a manner that addresses the latest DHS priorities, which may include making adjustments based on new mission or market demands.

Under part 158, strategic talent priorities inform overall administration of CTMS and management of the DHS-CS, as well as specifically influence strategic recruiting under the CTMS talent acquisition system, DHS-CS employee recognition under the CTMS compensation system, matching DHS-CS employees with assignments under the CTMS deployment program, and guiding DHS-CS employee career progression under the CTMS career development program.

The Secretary or Secretary's designee, with assistance from the CTMB, also administers CTMS and manages the DHS-CS using DHS-CS core values. As set out in § 158.305, those values are expertise, innovation, and adaptability. These core values reinforce the design and purpose of CTMS: Adapting to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission. DHS-CS employees require expertise, innovation, and adaptability to keep pace with the ever-evolving nature of cybersecurity work and DHS's dynamic cybersecurity mission, as well as to remain competitive in the talent market. These core values, and managing the DHS-CS using them, also underscores the expectation of continual learning for DHS-CS employees. DHS-CS core values influence the CTMS performance management program and CTMS career development program, and are embedded in the CTMS compensation strategy, all discussed subsequently.

C. Strategic Talent Planning: Subpart D

Subpart D, Strategic Talent Planning, contains regulations addressing how DHS establishes and administers a strategic talent planning process to enable CTMS to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission. The strategic talent planning process comprises several processes and systems by which DHS identifies CTMS qualifications and DHS-CS cybersecurity work, analyzes the cybersecurity talent market, and describes and values DHS-CS cybersecurity work, while also aggregating information to inform the overall administration of CTMS and management of the DHS-CS. See § 158.401.

The design of CTMS, especially the strategic talent planning process, implements the Secretary's broad discretion to determine how to create and use qualified positions, discussed previously in III.A.1 of this document.

1. DHS-CS Cybersecurity Work & CTMS Qualifications Identification

As discussed previously, CTMS qualifications are the core of CTMS, and CTMS qualifications are derived from the DHS cybersecurity mission. DHS identifies CTMS qualifications as part of the strategic talent planning process. As part of the strategic talent planning process, DHS identifies the functions that execute the DHS cybersecurity mission, as well as the cybersecurity work required to perform, manage, or supervise those functions, and the set of qualifications necessary to perform that work. See § 158.301. On an ongoing basis, DHS updates this comprehensive set of CTMS qualifications to ensure it reflects the dynamic DHS cybersecurity mission and the collective expertise necessary to execute that mission.

Also, as discussed previously, DHS identifies CTMS qualifications in accordance with applicable legal and professional guidelines governing the assessment and selection of individuals. Doing so ensures the qualifications identified are appropriately work-related and do not disproportionately or improperly impact protected individuals or groups.

2. CTMS Talent Market Analysis

As part of the strategic talent planning process, DHS conducts analysis of the cybersecurity talent market on an ongoing basis. See § 158.403. The analysis includes reviewing data on cybersecurity talent across the Nation such as aggregated salary and total compensation data in compensation surveys. As part of market analysis, DHS makes compensation comparisons and considers salaries as well as types of additional compensation, including bonuses and benefits. By examining total compensation or total rewards, which may also include non-monetary, work-life balance benefits, DHS is better able to more accurately compare features of the CTMS compensation system with features of the total compensation or total rewards programs of other cybersecurity employers, including private sector organizations.

DHS conducts analysis of the cybersecurity talent market using generally recognized compensation principles and practices. See § 158.403. Such principles and practices include fundamental concepts and analytical methods often integrated into formal courses of study for compensation practitioners. Such principles and practices are also outlined in publications, intended to support compensation practitioners when establishing a compensation philosophy, conducting competitive compensation analysis, and developing compensation structures and processes. Using these compensation principles and practices ensures the design and administration of compensation addresses DHS organizational goals and complies with legal requirements, including those prohibiting discrimination in compensation.

DHS uses analysis of the cybersecurity talent market to identify and monitor trends in both employment for and availability of talent related to cybersecurity, including variations in the cost of talent or the cost of living in local cybersecurity talent markets, or both. Local cybersecurity talent markets are described in § 158.612 as the cybersecurity talent markets in geographic areas defined by DHS and are discussed further in IV.D. of this document. DHS analyzes average cost of talent because such cost can vary significantly in different local cybersecurity talent markets. Similarly, variations in cost of living can significantly influence how organizations compensate cybersecurity employees in specific locations. DHS also uses analysis of the cybersecurity talent market to identify leading strategies for recruiting and retaining talent related to cybersecurity.

3. CTMS Work Valuation & Work and Career Structures

As part of the strategic talent planning process, DHS uses a new, DHS-specific work valuation system to define and value DHS-CS cybersecurity work, with a focus on qualifications necessary to perform that work. See § 158.404. As discussed previously in III.A.1 of this document, under the authority in 6 U.S.C. 658 DHS may create a new person-focused work valuation system. Although DHS is exempt from traditional Federal position classification under 6 U.S.C. 658, including the GS position classification system, DHS is choosing to use a work valuation system to establish structures to facilitate systematic management of DHS-CS employees and address internal equity. Like traditional Federal position classification that influences many aspects of talent management, especially compensation, the CTMS work valuation system also influences many aspects of talent management under CTMS.

Like traditional Federal position classification, the CTMS work valuation system is a method of work valuation, but features different core concepts and different practices. The GS position classification system is a system of “job evaluation” that describes work by delineating it into jobs defined in terms of duties, responsibilities, and qualification requirements of a position. As explained previously in III.B.2 of this document, the GS position classification system accounts only minimally for the individual or the individual's skills, including how the individual's skills may influence the performance of work. Although GS position classification is based on duties, responsibilities, and qualification requirements of positions, “the framers of the [GS] job evaluation system meant the qualifications requirements inherent in the work—an abstract concept—not the qualifications of specific individuals.”

The CTMS work valuation system is a system of “work evaluation” that describes cybersecurity work in more flexible, holistic terms with a focus on the qualifications of individuals necessary to perform DHS cybersecurity work. Creating a new system of work valuation, instead of “job evaluation,” recognizes that “jobs have become more flexible, dependent upon the job incumbent,” and that work evaluation or valuation “is a more encompassing concept than job evaluation and better captures contributions of the job, person, or team.”

The CTMS work valuation system is a person-focused work valuation system that DHS uses to determine the value or worth of a DHS-CS employee to DHS based on the employee's qualifications. This is in contrast to traditional Federal position classification or work valuation methods that determine the value or worth of positions based on the duties and responsibilities of the positions, regardless of the person in the position. The design of the CTMS work valuation system reflects that the DHS cybersecurity mission is dynamic, cybersecurity work is constantly evolving, and that individuals and their qualifications significantly influence how cybersecurity work is performed. Especially for cybersecurity work, an individual can dramatically alter how work is performed, including the tactics, techniques, and procedures brought to bear and the quality and quantity of outcomes produced.

The CTMS work valuation system is based on the set of CTMS qualifications and the DHS-CS cybersecurity work identified in the strategic talent planning process. See § 158.404. The work valuation system recognizes that critical qualifications come and go with individuals, not positions, and that individuals and the qualifications they possess significantly influence how cybersecurity work is performed. Individuals, through their respective and collective qualifications, influence how problems are tackled, how long initiatives take, and how effective new solutions are.

DHS uses the work valuation system to establish work and career structures, such as work levels, titles, ranks, and specializations. See § 158.404. DHS establishes such work and career structures by grouping and valuing qualifications and categories of qualifications based on criticality to the DHS cybersecurity mission. DHS uses these CTMS work and career structures instead of GS classes and grades and other traditional Federal position classification job structures. Much like the classes and grades established by the GS position classification system, the work and career structures support a variety of aspects of systematic talent management under CTMS.

DHS uses the work and career structures to organize other elements of CTMS and to ensure those other elements maintain a consistent focus on qualifications. DHS uses such work and career structures to describe and categorize DHS-CS employees, qualified positions, assignments, and cybersecurity work. For example, the description of an individual's qualified position includes a work level, such as early-career or executive, and a title, such as Cybersecurity Specialist or Cybersecurity Executive.

Importantly, DHS uses the work and career structures as part of the CTMS compensation system, discussed subsequently, in determining compensation for individuals in qualified positions with a focus on CTMS qualifications. For example, in setting an individual's initial salary, DHS considers applicable work and career structures, including the individual's work level. See § 158.620.

DHS may also use the work and career structures for budget and fiscal purposes related to administering CTMS and managing the DHS-CS. See § 158.404. This is analogous to how agencies use GS grades and occupations to inform resource planning processes.

As discussed in III.A.1 of this document, the authority in 6 U.S.C. 658 to create a new talent management system is exempt from the GS position classification system, and other work valuation systems relying on position classification based on 5 U.S.C. Chapter 51. As such, § 158.405 states that Chapter 51 and related laws do not apply under CTMS or to the DHS-CS or to talent management under CTMS.

4. Informing CTMS Administration and DHS-CS Management

DHS aggregates information generated in the processes and systems that are part of the strategic talent planning process in order to inform all other CTMS elements. See § 158.401. Incorporating this information from the strategic talent planning process into the other CTMS elements ensures that those elements reflect a strategic understanding of internal issues affecting employees in the DHS-CS as well as external issues affecting cybersecurity employment generally in the cybersecurity talent market.

For example, information about CTMS qualifications from the strategic talent planning process ensures that the talent acquisition system remains focused on the qualifications most critical for the DHS cybersecurity mission, including newly-identified qualifications that DHS had not recruited and assessed talent for previously. Also, information from analysis of the cybersecurity talent market ensures other elements of CTMS reflect an understanding of the cybersecurity talent market and serve to enable DHS to better recruit and retain top cybersecurity talent for employment in the DHS-CS.

As part of strategic talent planning, DHS also aggregates information from administering CTMS under the other CTMS elements and uses that information to inform CTMS elements. See § 158.401. Using information from administering CTMS in this manner ensures that the interrelated elements of CTMS function together as a complete talent management system. A common, comprehensive set of information about the current state of the administration of CTMS informs each respective element of CTMS, resulting in coherent, intentional practices for hiring, compensating, and developing DHS-CS employees. For example, information from the CTMS deployment program might indicate that the set of CTMS qualifications does not effectively capture the expertise required for some DHS cybersecurity work, and DHS needs to update the set of qualification under the strategic talent planning process. Similarly, information from the deployment program, such as assignments that are difficult to staff, can assist DHS in measuring the effectiveness of the talent acquisition system.

D. Acquiring Talent: Subpart E

Subpart E, Acquiring Talent, contains regulations establishing the CTMS talent acquisition system, which involves strategic and proactive recruitment, qualifications assessment, and selection and appointment. The talent acquisition system aligns with DHS's design for creating and using qualified positions under CTMS and implements the appointment authority in 6 U.S.C. 658, discussed previously in III.A.2 of this document. Under that authority, and the exemptions from laws relating to appointment, number, and classification, DHS is creating a new talent acquisition system with a focus on CTMS qualifications, finding individuals who likely possess those qualifications, and hiring those who demonstrate that they do.

1. CTMS Talent Acquisition System

The CTMS talent acquisition system provides DHS with an enhanced ability to identify and hire individuals with CTMS qualifications. The talent acquisition system comprises strategies, programs, and processes for strategically recruiting individuals, assessing qualifications of individuals, and considering and selecting individuals for employment in the DHS-CS and appointment to qualified positions. See § 158.501. The talent acquisition system reflects an emphasis on seeking out individuals likely to possess CTMS qualifications and then verifying individuals' qualifications before matching those individuals with DHS-CS cybersecurity work and finalizing selections.

DHS establishes and administers the talent acquisition system in accordance with applicable legal and professional guidelines governing the assessment and selection of individuals. See § 158.501. Those guidelines are the same guidelines DHS uses for ensuring qualifications identified as part of the strategic talent planning process are work-related, as discussed previously. Legal and professional guidelines used for the talent acquisition system also include the Standards for Educational and Psychological Testing. Such guidelines provide frameworks for proper design and use of selection procedures based on established scientific findings and generally recognized professional practices. Such guidelines also contain principles to assist employers in complying with Federal laws prohibiting discriminatory employment practices.

Recruiting, assessing, selecting, and appointing talent under the talent acquisition system represents a shift from existing Federal hiring practices for other Federal civil service positions. As discussed previously in III.A.2 of this document, the authority in 6 U.S.C. 658 to create a new talent acquisition system is exempt from any other provision of law relating to appointment of employees, including veterans' preference requirements, as well as other provisions of law relating to number or classification of employees. As such, § 158.502 lists existing laws relating to the process of appointing an individual that do not apply under CTMS, to the DHS-CS, or to talent management under CTMS.

2. Strategic Recruitment

Under the CTMS talent acquisition system, DHS strategically and proactively recruits individuals likely to possess CTMS qualifications. See §§ 158.510 and 158.511. DHS develops strategies for publicly communicating about the DHS cybersecurity mission and the DHS-CS, and for recruiting individuals for employment in the DHS-CS.

DHS develops and updates CTMS recruitment strategies based on CTMS qualifications, DHS-CS cybersecurity work, and strategic talent priorities. Developing and updating recruitment strategies in this manner ensures CTMS recruitment efforts remain effective in supporting execution of the dynamic DHS cybersecurity mission and furthering DHS goals, such as the advancement of diversity and inclusion in DHS's cybersecurity workforce.

In developing and implementing CTMS recruitment strategies, DHS may collaborate with other organizations and groups, including other Federal agencies, institutions of higher education, and national organizations such as veterans service organizations. DHS recognizes that such partnerships can be critical to identifying individuals with desired qualifications and encouraging those individuals to apply. As part of diversity and inclusion recruitment efforts, DHS anticipates collaborating with professional associations and institutions of higher education, including historically Black colleges and universities and other minority-serving institutions, including Hispanic-serving institutions, Tribal colleges and universities, and Asian American and Native American Pacific Islander-serving institutions. Through such collaboration, DHS aims to (1) reinforce the design of CTMS as a merit system, which provides equitable treatment; and (2) advance the hiring of people from all backgrounds and representing a diverse set of perspectives, including individuals belonging to traditionally underrepresented or underserved groups. In alignment with Executive Order 13985, CTMS recruitment strategies focus on reaching underrepresented and underserved groups, including Black, Latino, and Indigenous and Native American persons, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities; persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality.

Additionally, collaborating with DOD, the Department of Veterans Affairs, and groups such as veteran service organizations helps DHS to consider the availability of preference eligibles for appointment to qualified positions as required by 6 U.S.C. 658. As discussed previously DHS may create new hiring processes for appointing individuals to qualified positions; however under 6 U.S.C. 658(b)(1)(B), DHS may only appoint an individual to a qualified position after taking into consideration the availability of preference eligibles for appointment to the position. As used in 6 U.S.C. 658, the term “preference eligible” has the same meaning as that term is defined under Title 5.

The requirement in 6 U.S.C. 658 to consider the availability of preference eligibles for appointment is different from veteran preference requirements in the Title 5 that mandates specific priorities, procedures, and rules for preference eligibles in hiring. The term “preference eligible” for Title 5 purposes, is associated with the concept of “veterans' preference,” which gives advantage to certain veterans and related individuals for appointments to Federal civilian positions in order to recognize the sacrifice and economic loss suffered by a citizen who has served the Nation in uniform and prevent such citizens from being penalized for their time in military service when seeking Federal employment. Congress defines “veterans' preference requirement” in 5 U.S.C. 2302(e) clarifying that the concept of veterans' preference applies to hiring as well as to other aspects of civil service staffing, such as retention. Congress, however, does not use the term “veterans' preference” in the § 658 appointment authority. Moreover, the § 658 appointment authority is exempt from other provisions of law relating to appointment of employees, which includes Title 5 hiring processes and related veterans' preference requirements.

Although the § 658 appointment authority is exempt from veterans' preference requirements, the Secretary must consider the availability of preference eligibles for appointment, and DHS intends to honor the public policy purposes of veterans' preference. DHS recognizes that many preference eligibles and veterans likely possess the qualifications needed to support the DHS cybersecurity mission, especially those that received cybersecurity-focused active duty training and experience.

DHS considers the availability of preference eligibles for appointment to qualified positions, and provides such individuals advantage in the CTMS talent acquisition system, through strategic recruitment. See § 158.510. The new talent acquisition system includes strategic recruitment strategies aimed specifically at recruiting and hiring preference eligibles and other veterans, including individuals with military service experience who might not meet the statutory definition of preference eligibles. Strategic recruitment of preference eligibles and veterans includes identifying preference eligibles and members of the larger veteran community, proactively communicating to them about the DHS-CS, and encouraging their applications. DHS may tailor and refine CTMS recruitment strategies targeting preference eligibles and veterans to ensure such strategies further DHS's existing commitment to veteran recruitment, hiring, and representation within the DHS workforce. As a result of CTMS strategic recruitment efforts, DHS anticipates preference eligibles and veterans to be well represented in the population of individuals ready to be selected and appointed to qualified positions, and matched with assignments in the DHS-CS. Note that because veterans' preference requirements do not apply under CTMS, it is unnecessary to examine prohibited personnel practices relating to veteran preference requirements under the CTMS talent acquisition system.

In addition to developing and implementing CTMS recruitment strategies and collaborating with other organizations and groups, DHS uses a variety of other sources to identify individuals or groups of individuals for recruitment. See § 158.511. CTMS policy implementing CTMS outreach and sourcing will address communication of opportunities for employment in the DHS-CS, communication of application processes to individuals being recruited or applying for employment; and acceptance and treatment of applications for employment in the DHS-CS, including minimum application requirements established under this subpart. Outreach and sourcing under CTMS is likely use a variety of sources of information and communication channels, such as social media tools and key industry conferences, to connect with individuals and share information.

Under § 158.512, DHS may provide payment or reimbursement to prospective DHS-CS employees for travel to and from pre-employment interviews, which may include participating in an assessment process under the CTMS assessment program. Reimbursement for any such interview expenses are in accordance with existing laws, 5 U.S.C. 5706b and the Federal Travel Regulations at 41 CFR chapters 301-304, governing such reimbursement.

3. Qualifications-Based Assessment, Selection & Appointment

Under the CTMS talent acquisition system, DHS determines individuals' qualifications under the CTMS assessment program and make selections for, and appointments to, qualified positions based on individuals' demonstrated CTMS qualifications. See § 158.520. Any individual interested in employment in the DHS-CS must participate in the CTMS assessment program and meet applicable rating or scoring thresholds in the assessment processes in which that individual participates. To be eligible for selection and appointment, an individual must also meet Federal employment eligibility requirements and satisfy applicable employment-related criteria. See § 158.521.

(a) CTMS Assessment Program

The CTMS assessment program is designed to efficiently and accurately determine individuals' qualifications. See § 158.520. The assessment program includes one or more assessment processes based on CTMS qualifications. Each assessment process compares the qualifications of an individual to CTMS qualifications. The assessment program is designed to measure qualifications for individuals at all career stages, from those just beginning a career in cybersecurity to those with years of proven experience working as a cybersecurity technical expert or organizational leader. The assessment program is also designed to reduce reliance on subjective decision-making and avoid potential bias through systematic approaches to assessing qualifications with objectivity and fairness.

The assessment program focuses on requiring applicants to demonstrate their qualifications at a particular work level. Applicants choose the work level for which they wish to be considered. For applicants who are experienced cybersecurity professionals, this includes choosing the cybersecurity technical areas in which they are interested and for which they wish to be assessed.

CTMS assessment processes are formal and multi-part, which means an applicant may need to participate in one or more standardized instruments and procedures intended to measure the applicant's qualifications and proficiency in those qualifications. Such standardized instruments and procedures include a variety of tools. Examples of such standardized instruments and procedures include written knowledge tests, computer adaptive tests, work simulations, and structured interviews.

As part of a CTMS assessment process, DHS also may use demonstrations of qualifications, such as rewards earned from a cybersecurity competition, publication of peer-reviewed cybersecurity research, or a patented cybersecurity invention or discovery. The use of such demonstrations provides additional options for DHS to assess individuals who possess expertise beyond that expected of most applicants and enables rapid assessment of such individuals' qualifications.

DHS develops and administers each assessment process, including those that use standardized instruments and procedures, in accordance with applicable legal and professional guidelines governing the assessment and selection of individuals. Such legal and professional guidelines are the same guidelines mentioned previously that DHS uses to establish and administer the CTMS acquisition system.

In order to maintain the objectivity and integrity of the CTMS assessment program, DHS does not release assessment program materials except as otherwise required by law. See § 158.520. Circumstances required by law under which DHS would release assessment materials include providing individuals with their own testing results. While DHS maintains control and security over assessment materials, DHS makes available information to assist individuals in understanding the purpose of and preparing for participating in the assessment program.

In addition to participating in the CTMS assessment program, any individual interested in employment in the DHS-CS must meet employment eligibility requirements and satisfy certain employment-related criteria. See § 158.521. Employment eligibility criteria are U.S. citizenship requirements and Selective Service System requirements. Employment-related criteria includes fitness standards for Federal employment and related security requirements, geographic mobility requirements, and other criteria related to any aspect of appointment to or employment in the DHS-CS. See § 158.521. DHS provides written notice of any applicable employment-related criteria as part of an offer of appointment to a qualified position, and an individual must accept and satisfy those criteria to be appointed. DHS-CS employees must continue to satisfy and maintain applicable employment-related criteria. Employment-related criteria may change over time and DHS-CS employees may be required to accept any changes in that criteria to maintain employment in the DHS-CS. Also, DHS may disqualify an individual from consideration or appointment to the DHS-CS for providing false information to the Department, and other conduct described in § 158.521.

(b) DHS-CS Appointments

DHS selects an individual for employment in the DHS-CS based on the individual's qualifications as determined under the CTMS assessment program. See § 158.522. Through an individual's participation in the assessment program, DHS determines both an individual's CTMS qualifications and the DHS-CS cybersecurity work the individual should be able to perform successfully and proficiently.

In addition to the providing preference eligibles advantage in the CTMS talent acquisition system through specific strategic recruitment strategies, as previously discussed, DHS again considers the availability of preference eligibles for appointment to qualified positions when selecting an individual for employment in the DHS-CS. See § 158.522. Through individuals' participation in the assessment program, DHS may encounter cases where more than one individual who have met applicable rating or scoring thresholds are undergoing final consideration based on their demonstrated CTMS qualifications. When a selection is imminent and final consideration includes both preference eligibles and non-preference eligibles, the Department carefully reviews the demonstrated CTMS qualifications of such individuals, weighs any applicable strategic talent priorities, and regards an individual's status as a preference eligible as a positive factor in accordance with CTMS policy.

DHS appoints a selected individual to a qualified position under the authority in 6 U.S.C. 658. All such appointments are in the excepted service and an individual who accepts an appointment to a qualified position voluntarily accepts an appointment in the excepted service. No qualified position may be established through the non-competitive conversion of a current Federal employee from an appointment made outside the authority in 6 U.S.C 658. See § 158.522.

An appointment under CTMS to the DHS-CS is one of three types: A renewable appointment, a continuing appointment, or an advisory appointment. See §§ 158.104, 158.522 and 158.523. A renewable appointment is a time-limited appointment to a qualified position for up to three years. A renewable appointment is analogous to a time-limited appointment under Title 5, except a renewable appointment may be renewed more than once for time periods up to three years, subject to any limitation in CTMS policy regarding the number of renewals. A continuing appointment is an appointment to a qualified position without a specific time limit and is analogous to a permanent appointment under Title 5. An advisory appointment is a political appointment to a qualified position governed by part 158, subpart J, which addresses advisory appointments and DHS-CS advisory appointees generally. An advisory appointment is treated like a Schedule C appointment under Title 5, except regarding appointment and compensation, which are done under CTMS talent acquisition and compensation systems. See §§ 158.1001-158.1003. DHS may change an unexpired renewable appointment to a continuing appointment for a DHS-CS employee receiving a salary in the standard range, subject to any additional limitation in CTMS policy. As discussed subsequently, a DHS-CS employee receiving a salary in the extended range must be and must remain serving in a renewable appointment while receiving a salary in the extended range.

DHS may use CTMS renewable appointments to appoint reemployed annuitants and individuals providing uncompensated service, which is gratuitous service. See § 158.523. Individuals appointed in this manner serve at the will of the Secretary. DHS may only appoint individuals to provide uncompensated service if the individual would otherwise be eligible to receive a salary under CTMS that is equivalent to or higher than EX-IV because such uncompensated service is solely for the purpose of experts providing DHS senior leaders with specialized advising. As such, the Secretary or designee must approve the appointment of each individual providing uncompensated service by name and the individual must be appointed to a renewable appointment only.

DHS may also use CTMS appointments to appoint DHS-CS employees being restored to duty. See § 158.523. In accordance with 5 CFR part 353, which addresses restoration to duty from uniformed service or compensable injury, DHS restores to duty a DHS-CS employee who is a covered person described in 5 CFR 353.103.

A DHS-CS employee serves in the same qualified position for the duration of employment in the DHS-CS. See § 158.522. In this manner, CTMS, as a person-focused approach to talent management, allows for a DHS-CS employee's qualified position to evolve over time as the employee's career progresses. CTMS does not require a DHS-CS employee to change positions in order for DHS to acknowledge enhancements to the employee's CTMS qualifications or to recognize the employee with greater levels of compensation. A DHS-CS employee may also have the opportunity to perform different DHS-CS cybersecurity work or a different assignment, including an expanded subset of related work, without needing to change positions. DHS-CS employees do not progress through their careers at DHS based on longevity in a qualified position or through promotions. Career progression under CTMS is based on enhancement of CTMS qualifications and salary progression resulting from recognition adjustments. See § 158.803.

As discussed previously in III.B.1 of this document, there is no singular or standard career path for individuals with cybersecurity skills, and the CTMS talent acquisition system specifically accounts for this by ensuring former DHS-CS employees can easily return to the DHS-CS. The design of CTMS recognizes the possibility that talent might leave the DHS-CS and desire to return to the DHS-CS at a later point in time. To facilitate future service in the DHS-CS by former DHS-CS employees, under § 158.525 DHS aims to maintain communication with former DHS-CS employees and to provide opportunities for former DHS-CS employees to be considered for appointment again to qualified positions. DHS also aims to acknowledge any enhancements to former DHS-CS employees' qualifications while outside of the DHS-CS, which might affect salaries for such former employees upon return to the DHS-CS.

Under § 158.525, a former DHS-CS employee must participate again in the CTMS assessment program unless DHS determines otherwise based on relevant factors. DHS must assess that former DHS-CS employee's qualifications again, unless relevant factors indicate that an assessment is unnecessary. Such assessment ensures that DHS has the latest information about the individual's qualifications, which can influence salary and other aspects of talent management under CTMS. Factors which might make assessment unnecessary include time elapsed since last appointment and similarity of cybersecurity work performed since leaving the DHS-CS. For example, a new assessment would likely be unnecessary if only a few months have passed since the former DHS-CS employee's last appointment to a qualified position.

Appointment to a renewable or continuing appointment of a former DHS-CS advisory appointee, or other political appointee as defined by OPM, may be subject to additional requirements, including coordination with OPM under laws governing conversion of political appointees to non-political excepted service positions. Appointment of a former DHS-CS employee to an advisory appointment is governed by part 158, subpart J.

As required in 6 U.S.C. 658(d), all individuals appointed under CTMS serves an initial service period that constitutes a probationary period of three years beginning on the date of appointment. See § 158.524. Service in the DHS-CS counts toward completion of a current initial service period, but service in an appointment outside of the DHS-CS does not count. Because of the new approach to talent management under CTMS, including the new person-focused work valuation system and the new talent acquisition system, service in other Federal appointments are not be deemed equivalent or automatically credited as such. Also, service as a DHS-CS advisory appointee, as a reemployed annuitant in a qualified position, or providing uncompensated service in the DHS-CS do not count towards completion of an initial service period for any subsequent service in the DHS-CS. See § 158.524. Service as a DHS-CS advisory appointee, as a reemployed annuitant, or providing uncompensated service is qualitatively different than other service in the DHS-CS, either due to its policy-making nature or specialized advising status or the Federal retiree status of the individual. DHS addresses computations of initial service periods in CTMS policy, including accounting for less than full-time work schedules and certain absences that may affect computation of a DHS-CS employee's initial service period.

E. Compensating Talent: Subpart F

Subpart F, Compensating Talent, contains regulations addressing the CTMS compensation system, including the CTMS salary system and CTMS additional compensation. The compensation system implements the compensation authority in 6 U.S.C. 658, discussed previously in III.A.3 of this document. Under that authority in 6 U.S.C. 658 and the exemption from laws relating to classification and compensation, DHS is creating a new compensation system with a focus on CTMS qualifications, individuals with those qualifications, and the value of those qualifications to DHS.

1. CTMS Compensation System

The CTMS compensation system provides DHS with an enhanced ability to establish and adjust overall compensation for the DHS-CS based on the individual's qualifications, national and local cybersecurity talent market trends, and DHS-CS employees' mission impact. The compensation system includes the CTMS salary system and CTMS additional compensation, both discussed subsequently. See §§ 158.601 and 158.602.

DHS establishes and administers the compensation system based on a compensation strategy. See §§ 158.601 and 158.602. The CTMS compensation strategy establishes four goals for the compensation system. See § 158.601. Those goals provide a framework for ongoing, methodical review and maintenance of the compensation system. These goals also guide use of the compensation system for recruitment and retention purposes.

The first goal is to ensure the compensation of DHS-CS employees is sufficiently competitive to recruit and retain individuals possessing CTMS qualifications See § 158.601. As discussed previously in III.B of this document, the competitiveness of compensation is a main factor contributing to DHS's challenges recruiting and retaining cybersecurity talent. To further this compensation strategy goal, DHS determines whether compensation is sufficiently competitive by conducting cybersecurity talent market analysis to understand if it needs to adjust aspects of compensation, such as salary ranges, to account for trends in the cybersecurity talent market. In addition, DHS aims to maintain sufficiently competitive compensation by analyzing data regarding the effectiveness of CTMS in recruiting and retaining DHS-CS employees, including the degree to which application abandonment, appointment offer rejection, and employee attrition rates can be attributed to individuals' dissatisfaction with compensation.

The second goal under the CTMS compensation strategy is to value, encourage, and recognize exceptional qualifications and mission impact; excellence and innovation in the performance of cybersecurity work; and continual learning to adapt to evolving cybersecurity risks and cybersecurity threats. See § 158.601. As discussed previously in III.B of this document, main factors contributing to DHS's challenges recruiting and retaining cybersecurity talent are the lack of focus of existing Federal talent management practices on individuals and their skills, as well as fierce competition for those individuals and their skills. This compensation strategy goal aligns to the DHS-CS core values of expertise, innovation, and adaptability, described in § 158.305, and focuses the compensation system on individuals' qualifications and competing for those qualifications. The DHS-CS best fulfills its purpose of enhancing the cybersecurity of the Nation when DHS-CS employees are focused on: Enhancing qualifications and impacting the DHS cybersecurity mission; producing quality work products and developing new methods to perform cybersecurity work; and continually learning to counter emerging or novel risks and threats. Compensating employees to support and foster such outcomes helps to ensure the DHS-CS fulfills its purpose and ensure that compensation under CTMS reinforces the core values of the DHS-CS.

The third goal under the CTMS compensation strategy is to acknowledge the unpredictable nature of cybersecurity work and the expectation that all DHS-CS employees occasionally work unusual hours and extended hours, as needed, to execute the DHS cybersecurity mission, especially in response to exigent circumstances and emergencies. See § 158.601. As discussed previously in III.B of this document, cybersecurity work is knowledge work that requires individuals to apply their skills to solve problems and achieve outcomes, often in unpredictable ways. Toward this compensation strategy goal, DHS-CS employees are salaried and are not considered hourly employees. Accordingly, under the compensation system, each DHS-CS employee receives a salary. Such a salary accounts for the unpredictable nature of cybersecurity work and the expectation that DHS-CS employees occasionally work unusual and extended hours, and DHS-CS employees are expected to successfully and proficiently perform cybersecurity work in exchange for the compensation provided in their salaries and are not entitled to more compensation for occasionally working unusual and extended hours in order to perform that work. Under CTMS, Title 5 premium pay provisions, overtime pay provisions of the FLSA, and most Title 5 compensatory time-off provisions do not apply. See § 158.605. Instead, CTMS utilizes the CTMS salary system and types of additional compensation intended to ensure DHS-CS employees are compensated appropriately for their qualifications and impact on the DHS cybersecurity mission. Under the CTMS, DHS monitors hours worked by DHS-CS employees using the CTMS work scheduling system described in § 158.705, and hours worked is important for administering salary and is a factor in providing some types of additional compensation. DHS can address employees' mission impact through recognition payments under § 158.632, and DHS can address special working conditions, including circumstances that exceed the expectation of occasional unusual and extended hours, under the CTMS special working conditions payment program described in § 158.642.

The fourth goal under the CTMS compensation strategy is to reflect an understanding of the cybersecurity talent market, including leading compensation practices and trends and current work expectations and arrangements, an understanding of the concepts of internal and external equity, and an understanding of the concepts of total compensation and total rewards. See § 158.601. As discussed previously in III.B of this document, there is a specific, competitive talent market for cybersecurity that comprises cybersecurity employers, including Federal agencies and private sector employers, and cybersecurity talent, which is individuals with cybersecurity expertise. In a field as dynamic as cybersecurity, DHS cannot establish a static approach to compensation and assume it will remain competitive enough over time to recruit and retain individuals with the qualifications necessary to execute the DHS cybersecurity mission. DHS must maintain an understanding of compensation in the cybersecurity talent market, and in designing and adjusting aspects of CTMS compensation, DHS must attempt to make like comparisons between the total compensation packages offered by employers in the cybersecurity talent market and DHS-CS employees' salaries and additional compensation, including the complete set of traditional Federal employee benefits. DHS must also ensure its approach to compensation remains informed by changes in how individuals might expect and prefer to perform cybersecurity work, as well as work opportunities commonly available at employers in the cybersecurity talent market. Therefore, DHS may need to consider how it offers work arrangements, such as part-time work schedules and project-based and remote work, and DHS may need to customize CTMS compensation and compensation administration to such arrangements.

DHS also establishes and administers the compensation system based on information from strategic talent planning, generally recognized compensation principles and practices, and strategic talent priorities. § 158.602. The CTMS compensation strategy, together with the talent market analysis from strategic talent planning, ensures that the compensation system provides a market-sensitive approach to compensation, enabling DHS to better compete for top cybersecurity talent. The generally recognized principles and practices are the same principles and practices, discussed previously, that DHS uses for conducting talent market analysis. Using these principles and practices for the compensation system ensures the design and administration of CTMS compensation addresses DHS organizational goals and complies with legal requirements, including those prohibiting discrimination in compensation.

Compensating DHS-CS employees using a new market-sensitive compensation system guided by a compensation strategy intended to keep DHS competitive when recruiting and retaining cybersecurity talent represents a shift from existing Federal compensation practices for other Federal civil service positions. As discussed previously in III.A.3 of this document, the authority in 6 U.S.C. 658 to create a new compensation system is exempt from any other provision of law relating to compensation of employees, as well as from other provisions of law relating to classification. As such, § 158.605 lists existing laws relating to compensation that do not apply under CTMS, to the DHS-CS, or to talent management under CTMS. The laws listed in § 158.605 include provisions in 5 U.S.C Chapter 53 establishing and governing other pay systems; premium pay provisions in 5 U.S.C. Chapter 55 and the minimum wage and overtime pay provisions of the FLSA; provisions in Title 5 regarding monetary awards, incentives, and certain differentials; the limitation on annual aggregate compensation in 5 U.S.C. 5307; and provisions in 5 U.S.C. Chapter 61 governing work schedules.

2. DHS-CS Employee Compensation

Compensation for DHS-CS employees is salary and additional compensation. See § 158.603. As defined in § 158.104, salary means an annual rate of pay under CTMS. Compensation for DHS-CS advisory appointees also is salary and additional compensation under CTMS, subject to additional requirements and restrictions. Subpart J, discussed subsequently, addresses compensation for DHS-CS advisory appointees.

A DHS-CS employee receives a salary under the CTMS salary system. See § 158.603. A DHS-CS employee providing uncompensated service, however, does not receive a salary. A DHS-CS employee's salary may include a local cybersecurity talent market supplement, which, as discussed subsequently, is similar to locality-based comparability payments under Title 5.

In addition to salary, DHS-CS employees, except those providing uncompensated service, may receive additional compensation. As defined in § 158.104, additional compensation is several types of compensation described in § 158.603(c). CTMS additional compensation includes: CTMS recognition, such as recognition payments; other special payments under CTMS; and other compensation provided in accordance with relevant provisions of laws, including leave and benefits. The types of additional compensation are set out in separate sections in subpart F.

CTMS additional compensation implements the discretionary additional compensation authority in 6 U.S.C. 658(b)(3)(a). As previously discussed in III.A.3 of this document, DHS interprets this additional compensation authority as requiring DHS to base any discretionary CTMS additional compensation on Title 5 provisions regarding types of additional compensation, and DHS may combine and streamline such provisions as long as it is clear which specific Title 5 provisions serve as the base or foundation for CTMS additional compensation. As discussed previously in III.B of this document, the current inability to quickly construct and nimbly adjust competitive total compensation packages is a main factor in DHS's challenges recruiting and retaining cybersecurity talent. Therefore, DHS is combining and streamlining several provisions of Title 5 to establish types of additional compensation specific to the new talent management system, as well as providing traditional Federal employee benefits, such as retirement, health benefits, and insurance programs.

For CTMS additional compensation, DHS is creating a new toolset based on Title 5 authorities for additional compensation. The CTMS toolset provides a cohesive set of tools tailored to the mission-driven, person-focused, market-sensitive design of CTMS.

The new toolset has three categories: CTMS recognition, other special pay under CTMS, and other CTMS compensation provided in accordance with relevant provisions of other laws. CTMS recognition, described in §§ 158.630-158.634, comprises three types of additional compensation, which are recognition payments, recognition time-off, and honorary recognition. CTMS recognition is based on Title 5 authorities for cash awards and incentives, performance-based awards, time-off awards, and honorary awards.

The category of other special pay under CTMS comprises four types of additional compensation: CTMS professional development and training, described in § 158.640, based on Title 5 authorities for training and professional development; CTMS student loan repayments, described in § 158.641, based on Title 5 authorities for student loan repayments; CTMS special working conditions payments, described in § 158.642, based on Title 5 authorities for certain payments; and CTMS allowances in nonforeign areas, described in § 158.643, as mandated in 6 U.S.C 658(b)(3)(B).

The category of other CTMS compensation provided in accordance with relevant provisions of other laws includes other traditional types of additional compensation authorized in Title 5, such as holidays, leave, and benefits, described in §§ 158.650-158.655, that DHS is authorizing under 6 U.S.C. 658.

DHS provides additional compensation in alignment with the CTMS compensation strategy and under the separate sections in subpart E that govern each type of additional compensation. Those separate sections, each discussed subsequently, set out the requirements and eligibility for each type of additional compensation, as well as the provisions of Title 5 on which each type of CTMS additional compensation is based.

A DHS-CS employee, except one providing uncompensated service, may receive any type of additional compensation in combination with any other type of additional compensation, subject to the requirements and eligibility criteria in the separate sections governing each type of additional compensation and the CTMS aggregate compensation limit, discussed subsequently.

3. CTMS Salary System

The CTMS compensation system includes a salary system, which comprises at least one salary structure, a process for providing local cybersecurity talent market supplements, and a framework for administering salary under CTMS. See § 158.610. DHS establishes and administers the CTMS salary system with the goals of maintaining sufficiently competitive salaries for DHS-CS employees for recruitment and retention purposes and equitable salaries among DHS-CS employees. These goals align with the compensation strategy in § 158.601 and with the talent management principles of merit and fairness in § 158.303. With the salary system, DHS addresses external equity between the DHS-CS and the cybersecurity talent market so that DHS can compete for cybersecurity talent, and DHS does so through the CTMS compensation strategy that ensures consideration of the cybersecurity talent market. With the salary system, DHS also addresses internal equity within the DHS-CS through the work valuation system. Internal equity for salaries among DHS-CS employees is one outcome of the work and career structures established under the work valuation system; DHS aims to maintain equitable salaries for DHS-CS employees in the same work level and with similar qualifications and mission impact.

In addition to the goals of external and internal equity, DHS also establishes and operates the salary system within the boundaries provided by the CTMS salary range.

(a) CTMS Salary Range

The CTMS salary range comprises a standard range, which has an upper limit of the Vice President's salary ($255,800 in 2021), and an extended range for use in limited circumstances, which has an upper limit of 150 percent of EX-I ($332,100 in 2021). See § 158.613.

The salary range implements the basic pay authority in 6 U.S.C. 658(b)(2)(a) regarding rates of pay. As discussed previously in III.A.3 of this document, DHS interprets this basic pay authority to mean that the boundaries of the new salary system, as provided by the nine rate ranges for the eleven types of comparable positions in DOD, may be from no minimum to 150 percent of EX-I or no maximum. As discussed previously in II.B of this document, the competitiveness of compensation, especially salary, is a main factor contributing to DHS's challenges recruiting and retaining cybersecurity talent. Therefore, the Department is using the highest maximum rates for the upper boundary for the new salary system

DHS is setting the upper boundary for the salary system at the Vice President's salary ($255,800 in 2021), with an additional upper boundary of 150 percent of EX-I. As discussed previously in III.A.3 of this document, the rate range for one comparable position in DOD does not provide a maximum rate and DHS could apply this to mean that there is no upper boundary for the CTMS salary system. Instead, to ensure some certainty in establishing the range for the salary system and assist in standardizing and controlling employee costs, DHS is applying a specific maximum rate as the upper boundary for the CTMS salary range. The highest maximum rate provided for a comparable position in DOD is 150 percent of EX-I; however, to provide consistency across the CTMS compensation system, DHS is applying the maximum rate of the Vice President's salary as the standard boundary for the CTMS salary range. Applying the Vice President's salary as the standard boundary provides one limit amount that applies across CTMS compensation: The Vice President's salary is also the highest CTMS aggregate compensation limit, which restricts some types of additional compensation, as discussed subsequently. Additionally, because types of CTMS additional compensation, such as CTMS recognition payments, are subject to the aggregate compensation cap, any DHS-CS employee receiving a salary higher than the Vice President's salary, could not receive such additional compensation. DHS uses the higher salary limit of 150 percent of EX-I or the extended range, but only for only limited circumstances.

Because the CTMS salary range implements the boundaries for the CTMS salary system provided by rate ranges for comparable positions in DOD, if the rate ranges for comparable positions in DOD change, DHS adjusts the CTMS salary range as necessary.

The standard range applies unless the Secretary or designee invokes the extended range for specific DHS-CS employees serving in renewable appointments. See § 158.613. The extended range encompasses all salary amounts above the standard range's upper limit of the Vice President's salary ($255,800 in 2021) and up to 150 percent of EX-I ($332,100 in 2021). Because the extended range contains such high salary amounts, DHS is limiting its use to ensure DHS only relies on these salary amounts as necessary and in a way that incorporates a time-limit to ensure the need for such salaries is reassessed. Because a renewable appointment is a time-limited appointment to a qualified position that may be renewed, requiring that any DHS-CS employee receiving a salary in the extended range must be in a renewable appointment ensures that the use of the extended range is similarly time-limited, but also similarly renewable.

To invoke the extended range for specific DHS-CS employees, the Secretary must determine based on the CTMS compensation strategy, that the employee's qualifications, the employee's mission impact, and mission-related requirements warrant adjusting the employee's salary beyond the standard range. See § 158.613. Also, the Secretary or designee must approve a salary in the extended range for each such DHS-CS employee by name. To receive a salary in the extended range, the employee must either already be in a renewable appointment, or the employee must accept a renewable appointment. While any DHS-CS employee is receiving a salary in an amount in the extended range, DHS may not change that employee's appointment to a continuing appointment. To invoke the extended range for new DHS-CS employees, the Secretary or designee must make a similar determination for that individual and approve the appointment of the individual by name. See § 158.513. That individual must be appointed to a renewable appointment only and while that individual is receiving a salary in an amount in the extended range, DHS may not change that individual's appointment to a continuing appointment at any time.

(b) CTMS Salary Structure

DHS provides salaries to DHS-CS employees under a CTMS salary structure. DHS establishes and administers at least one CTMS salary structure based on the compensation strategy and the same information, principles and practices, and priorities on which the CTMS compensation system is based. See § 158.611.

A salary structure is bounded by the CTMS salary range and includes subranges. See § 158.611. The subranges are associated with work levels, which are one of the work and career structures established by the work valuation system. Each subrange is associated with at least one work level. For example, one salary subrange might be associated with a work level for entry-level employees in the DHS-CS, but another subrange might be associated with a work level for certain senior expert employees and executive employees in the DHS-CS.

A salary structure also incorporates CTMS salary limitations and may incorporate other salary and cost control strategies. See § 158.614. CTMS salary limitations set the maximum salary for the subranges. Other salary and cost control strategies, such as control points, assist with standardization and prediction of employee costs.

The CTMS salary limitations implement the basic pay authority in 6 U.S.C. 658(b)(2)(a) regarding limitations on maximum rates of pay. As discussed previously in III.A.3 of this document, DHS interprets this basic pay authority to mean that the CTMS salary system is subject to the same salary caps applicable to the eleven types of comparable positions in DOD. Also as discussed previously in III.A.3, the applicable salary caps are six caps ranging from GS-15, step 10 to 150 percent of EX-I, and DHS has discretion for how to apply those six caps to the salary system. The highest salary cap, 150 percent of EX-I, is also the upper boundary for the extended range, and as such is the cap for the entire CTMS salary system. DHS is applying the five remaining salary caps as CTMS salary limitations for the subranges. The CTMS salary limitations are: GS-15, step 10 (excluding locality pay or any other additional pay), EX-IV, EX-II, EX-I, and the Vice President's salary. See § 158.614. DHS incorporates the CTMS salary limitations into a salary structure by assigning the limitations, in ascending order, to the subranges of the salary structure. The result is that each subrange receives a salary limitation that is greater than or equal to the salary maximum of that subrange. See § 158.611. If the salary caps for comparable positions in DOD change in the future, DHS will adjust the CTMS salary limitations as necessary. DHS may also establish other limitations on maximum rates of salary, in addition to these CTMS salary limitations. See § 158.514.

DHS may adjust a CTMS salary structure based on the compensation strategy and the same information, principles and practices, and priorities with which DHS establishes and administers the salary structure. See § 158.611. The purpose of considering adjustments to a salary structure, including its subranges, is to determine whether the salaries provided under that salary structure remain sufficiently competitive in alignment with the compensation strategy and the goals of the salary system. DHS might find, for example, that one salary subrange is lagging behind the cybersecurity talent market based on a trend of rising salaries for specific qualifications, and therefore, DHS might make adjustments to that subrange, such as increasing the salary minimum for that subrange. DHS may review and adjust a CTMS salary structure annually, and may also do so sooner than annually as the Secretary or designee determines necessary.

(c) CTMS Local Cybersecurity Talent Market Supplement

As part of the CTMS salary system, DHS is establishing a process for providing a local cybersecurity talent market supplement (LCTMS). See § 158.612. DHS may provide a LCTMS to a DHS-CS employee in a specific geographic location to ensure the employee receives a sufficiently competitive salary, which is the purpose of a LCTMS and a goal of the compensation strategy and salary system. Much like locality-based comparability payments under 5 U.S.C. 5304, a LCTMS is intended to address geographic compensation disparities and a LCTMS does so through local cybersecurity talent market supplement percentages.

A local cybersecurity talent market is the cybersecurity talent market in a geographic area that DHS defines based on analysis of the cybersecurity talent market, and that may incorporate the definitions of localities under 5 U.S.C. 5304. See § 158.612. For defining such geographic areas, DHS may rely on localities established or modified under 5 U.S.C. 5304 but may need to adjust the boundaries of such localities to match specific cybersecurity talent markets. DHS may also define geographic areas for local cybersecurity talent markets separate from the localities covered by 5 U.S.C. 5304, especially if such localities do not align to the cybersecurity talent markets in which DHS competes for cybersecurity talent.

A local cybersecurity talent market supplement percentage is a percentage DHS assigns to a local cybersecurity talent market to increase the amount of salaries for DHS-CS employees provided under a salary structure in that local cybersecurity talent market. See § 158.612. This percentage increases the amount of a salary to account for the difference between the salary as determined under a CTMS salary structure and what DHS determines to be a sufficiently competitive salary for that local cybersecurity talent market.

DHS determines whether a LCTMS is necessary in a local cybersecurity talent market based on the compensation strategy and the same information, principles and practices, and priorities on which the CTMS compensation system is based and that DHS uses to establish and adjust a CTMS salary structure. See § 158.612. Based on that strategy and same information, principles and practices, and priorities, DHS may establish and periodically adjust any local cybersecurity talent markets and local cybersecurity talent market supplement percentages. An adjustment to a local cybersecurity talent market supplement percentage may include termination when DHS determines it is no longer necessary for the purpose of a LCTMS.

DHS determines eligibility for a LCTMS under § 158.612 and CTMS policy implementing that section. Under § 158.612, a DHS-CS employee is eligible for a LCTMS if the employee's official worksite is located in a local cybersecurity talent market with an assigned local cybersecurity talent market supplement percentage for the salary structure under which the employee's salary is provided. Thus, a DHS-CS employee's official worksite location and the salary structure for the employee's salary are both factors in eligibility for a LTCMS. DHS may have more than one salary structure, but a LCTMS may not be required for all salary structures to ensure sufficiently competitive salaries. Any LCTMS a DHS-CS employee receives terminates when the employee's official worksite is no longer in a local cybersecurity talent market with an assigned local cybersecurity talent market supplement percentage, or the salary structure under which the employee's salary is provided no longer has an assigned local cybersecurity labor market supplement, or both.

A LCTMS is limited by applicable CTMS salary limitations. A DHS-CS employee may not receive any portion of a LCTMS that would cause that employee's salary to exceed applicable CTMS salary limitations, but may receive the portion of the LCTMS up to the applicable limitations. A DHS-CS employee also cannot receive a LCTMS that would cause the employee's salary to be in the CTMS extended range unless the Secretary invokes the extended range for that employee.

Any LCTMS a DHS-CS employee receives is part of the employee's salary and as such a LCTMS is basic pay for purposes under Title 5, such as civil service retirement. A LCTMS, however, is not basic pay for purposes of determining pay under Title 5 provisions addressing a reduction in pay as an adverse action, and a reduction in salary for a DHS-CS employee because of a change in any LCTMS, including a change in amount or termination of a LCTMS, for that employee is not an adverse action under 5 U.S.C. 7512. See §§ 158.612. Decisions regarding such supplements are based on geographic location and calculations for providing such a supplement. This is similar to changes in locality-based comparability payments under Title 5 because under Title 5 a change in an employee's official worksite to a different locality pay area may serve to reduce that employee's basic pay, but is not a reduction in basic pay for the purposes of 5 U.S.C. 7512 because locality-based comparability payments are not considered basic pay for those purposes.

(d) CTMS Salary Administration

The CTMS salary system includes a framework for salary administration that addresses setting salaries and adjusting salaries under CTMS, and administering CTMS salaries under relevant provisions of other laws. See §§ 158.620-158.622. Although the CTMS salary system is exempt from other laws relating to compensation of employees, under the authority and exemptions in 6 U.S.C. 658, DHS is setting up a new compensation system and salary system, and the new systems must integrate with existing pay administration procedures and infrastructure, such as information technology support systems, used by Federal agencies to process and ensure employees receive their earned compensation.

DHS sets the salary for an individual accepting an appointment to a qualified position within a subrange of a CTMS salary structure as part of selection and appointment of the individual. DHS sets an individual's initial salary based on: The individual's CTMS qualifications; applicable work and career structures, including the individual's initial work level; the individual's anticipated mission impact; mission-related requirements; and strategic talent priorities set by CTMS leadership. See § 158.620.

As discussed previously, CTMS qualifications are the core of CTMS, and setting salary based on qualifications ensures a focus on the value of those qualifications to DHS. Work and career structures group and value qualifications, and work level is one such grouping for purposes of similar treatment in talent management and which addresses internal equity among DHS-CS employees' salaries. DHS determines an individual's CTMS qualifications under the CTMS assessment program and determines applicable work and career structures as part of selection and appointment of the individual.

A goal of the DHS-CS is the most effective execution of the DHS cybersecurity mission, and therefore a DHS-CS employee's mission impact is an important part of the employee's value or worth to DHS. As such the employee's anticipated mission impact is a factor in setting initial salary. DHS determines individuals' anticipated mission impact using information from the application and assessment processes.

Mission-related requirements are relevant for addressing emerging or urgent mission circumstances, and for setting salaries with information about mission-related requirements, such as a need for talent that understands a novel technology related to an urgent cybersecurity threat. Mission-related requirements, as defined in § 158.104, are characteristics of an individual's expertise or characteristics of cybersecurity work, or both, including highly-specialized expertise and cybersecurity talent market-related information, that are associated with successful execution of the DHS cybersecurity mission, and that are determined by officials with appropriate decision-making authority. Strategic talent priorities are part of the design and administration of CTMS and the CTMS compensation system, and setting initial salaries based on such priorities ensures salaries also reflect DHS and CTMS leadership priorities and goals for the DHS-CS.

DHS may set the salary for an incoming DHS-CS employee without regard to any prior salaries of the individual, including any basic pay while serving in a previous Federal appointment and any previous salary as a DHS-CS employee for a returning, former DHS-CS employee. See § 158.620. This emphasizes that DHS uses the CTMS compensation system to set DHS-CS employee salaries based on individuals' value or worth in relationship to the DHS cybersecurity mission. This also serves to reduce reliance on salary history information that may reflect systematic bias and historical salary discrimination.

Under CTMS, DHS adjusts a DHS-CS employee's salary by providing a LCTMS or a recognition adjustment, or both. See § 158.621. A recognition adjustment is an adjustment to a DHS-CS employee's salary and is based primarily on the employee's mission impact. See §§ 158.630 and 158.631. DHS determines the mission impact of a DHS-CS employee, individually or as part of group of DHS-CS employees or both, using mission impact reviews, which are part of the CTMS performance management program described in § 158.802 and discussed subsequently. In providing a recognition adjustment, DHS may also consider mission-related requirements and strategic talent priorities for the same reasons DHS considers them for setting salaries. A recognition adjustment does not alter any LCTMS for that employee. While a LCTMS is part of a receiving DHS-CS employee's salary, a recognition adjustment does not alter the percentage of a LCTMS.

A DHS-CS employee may not receive a recognition adjustment that would cause the employee's salary to exceed the CTMS salary range or a CTMS salary limitation applicable to the subrange for that employee's salary. See § 158.631. A DHS-CS employee may not receive a recognition adjustment that would cause the employee's salary to be in the extended range, unless the Secretary or designee invokes the extended range for that employee, as discussed previously.

DHS does not provide DHS-CS employees with any automatic salary increases or any salary increases based on length of service in the DHS-CS or service in any position outside the DHS-CS. CTMS is not a longevity-based approach to talent management, and career progression in the DHS-CS is not based on length of service in the DHS-CS or the Federal government. Providing a recognition adjustment or a LCTMS is the only means for adjusting a DHS-CS employee's salary.

If, however, DHS adjusts a salary structure that results in an increase to the salary minimum for one or more subranges of the salary structure, DHS adjusts the salary for any affected DHS-CS employee. See 158.621. For a DHS-CS employee receiving a salary in an affected subrange at the affected salary minimum, DHS adjusts the employee's salary to reflect the adjustment to the salary structure and the new salary minimum for the affected subrange. Such a salary adjustment is not considered a recognition adjustment.

Under CTMS, a recognition adjustment is not a promotion for any purpose under Title 5. See § 158.631. Salary progression resulting from recognition adjustments is only one part of a DHS-CS employee's career progression. Career progression in the DHS-CS is based on both enhancement of CTMS qualifications and salary progression. See § 158.803. Enhancement of CTMS qualifications is one component of career progression in the DHS-CS in alignment with the DHS core values of expertise, innovation, and adaptability and in alignment with the compensation strategy. DHS expects DHS-CS employees to strive to enhance individual expertise through continual learning and anticipate and adapt to emergent and future cybersecurity risks. Additionally, as part of the compensation strategy, DHS values, encourages, and recognizes exceptional qualifications and mission impact, and DHS adjusts DHS-CS employees' salaries in recognition of their mission impact.

In order to integrate CTMS salary administration with existing pay administration procedures and infrastructure used by Federal agencies, DHS administers salaries of DHS-CS employees in accordance with relevant provisions of other laws governing pay administration for Federal civil service employees. DHS administers salaries under CTMS in accordance with the 5 CFR part 550 generally and U.S. Code sections enumerated in § 158.622. Because 5 CFR part 550 addresses administration of other types of compensation and not just salary administration, § 158.622 also lists the provisions of 5 CFR part 550 that do not apply to CTMS. Those provisions of 5 CFR part 550 address types of premium pay and compensatory time-off for travel, which as discussed previously, do not apply under CTMS.

DHS also administers DHS-CS employee salaries based on consideration of each employee's work schedule under the CTMS work scheduling system, described in § 158.705 and discussed subsequently, and may convert a DHS-CS employee's salary into an hourly rate, biweekly rate, or other rate as necessary to ensure accurate operation of existing pay administration procedures and infrastructure. See § 158.622. In converting salaries to an hourly, biweekly, or other rate, DHS may need to consider the hours worked and any leave taken by an employee to ensure proper payment of salary.

4. CTMS Recognition

The CTMS compensation system comprises the CTMS salary system and CTMS additional compensation, and CTMS recognition is a main aspect of both. With CTMS recognition, DHS recognizes and rewards DHS-CS employees, in alignment with the CTMS compensation strategy and CTMS performance management program, based primarily on mission impact.

CTMS recognition includes four types of recognition: Recognition adjustments, recognition payments, recognition time-off, and honorary recognition. See §§ 158.631-158.634. As discussed previously, DHS adjusts DHS-CS employees' salaries through recognition adjustments. The other three types of CTMS recognition—payments, time-off, and honorary—are additional compensation.

Like recognition adjustments, DHS provides recognition payments, recognition time-off, and honorary recognition, based primarily on a DHS-CS employee's mission impact. See §§ 158.630 and 158.632-158.634. DHS determines the mission impact of a DHS-CS employee, individually or as part of group of DHS-CS employees or both, using mission impact reviews, which are part of the CTMS performance management program described in § 158.802 and discussed subsequently. In providing recognition payments, recognition time-off, and honorary recognition, DHS may also consider mission-related requirements and strategic talent priorities for the same reasons DHS may consider these in providing a recognition adjustment and for setting initial salaries.

DHS may also use CTMS recognition, in the form of recognition payments and recognition time-off, as part of recruiting new DHS-CS employees. DHS may need to offer a recognition payment as a signing bonus to ensure that an individual's compensation package is sufficiently competitive and to incentivize the individual to serve in the DHS-CS. DHS provides recognition to an incoming DHS-CS employee based on the incoming employee's CTMS qualifications, the incoming employee's anticipated mission impact, mission-related requirements, and strategic talent priorities. See § 158.630. DHS bases recognition for an incoming DHS-CS employee on these for the same reasons DHS considers them for setting initial salaries.

DHS determines eligibility for CTMS recognition under §§ 158.630-158.634 and CTMS policy. As stated in § 158.630, a DHS-CS employee is ineligible to receive CTMS recognition if DHS determines the employee's performance is unacceptable, as defined in 5 U.S.C. 4301(3) or the employee receives an unacceptable rating of record under CTMS performance management, or DHS determines the employee has engaged in misconduct. A DHS-CS employee should only be recognized if the employee's performance is acceptable. Similarly, a DHS-CS employee should not be recognized if engaging in misconduct. For these same reasons, DHS may defer providing recognition if DHS is in the process of determining whether a DHS-CS employee's performance is unacceptable or whether the employee has engaged in misconduct. See § 158.630. CTMS policy will address other eligibility criteria for CTMS recognition.

In addition to eligibility criteria, CTMS policy will also address requirements for documenting the reason and basis for providing CTMS recognition, appropriate levels of review and approval, and any limitations on recognitions, among other matters necessary for administering CTMS recognition.

CTMS recognition payments, recognition time-off, and honorary recognition are based on Title 5 authorities. As discussed previously in III.A.3 of this document, under the § 658 additional compensation authority DHS may combine and streamline provisions of Title 5 regarding types of additional compensation, as long as it is clear on which specific Title 5 provisions CTMS additional compensation is based. Sections 158.632 through 158.634 list the Title 5 authorities on which CTMS recognition payments, recognition time-off, and honorary recognition are based. Each of these types of recognition is discussed subsequently.

(a) CTMS Recognition Payments

A CTMS recognition payment is a lump-sum payment, an installment payment, or recurring payments of up to a percentage of the receiving DHS-CS employee's salary: Up to 20 percent, or up to 50 percent with approval of the Secretary or designee. See § 158.632. DHS may offer a recognition payment to an incoming DHS-CS employee as part of an offer for employment in the DHS-CS. A recognition payment for an incoming DHS-CS employee is up to 20 percent of the incoming employee's initial salary and is provided upon appointment. See § 158.632.

CTMS recognition payments are based on Title 5 authorities providing seven types of cash awards and incentives: 5 U.S.C. 4502 providing cash awards for a suggestion, invention, superior accomplishment or other meritorious effort, 5 U.S.C. 4503 providing agency awards for special acts, 5 U.S.C. 4505a and 5384 providing performance-based cash awards, 5 U.S.C. 4507 and 4507a providing presidential rank awards, and 5 U.S.C. 5753 and 5754 providing recruitment incentives, relocation incentives, and recruitment incentives. These Title 5 authorities provide cash awards and incentives in recognition of employee efforts and performance, and can help with employee recruitment and retention. CTMS recognition payments serve the same purposes, but under the overall approach to talent management and compensation under CTMS. DHS uses recognition payments to recognize and reward DHS-CS employees, especially for their mission impact. The Title 5 authorities on which CTMS recognition is based provide some of the existing Federal compensation tools, which as discussed previously in III.B of this document, are cumbersome to use, ineffective for constructing market-sensitive compensation packages, and are not intended to form a cohesive toolset. CTMS recognition payments combines and streamlines these existing tools to align with the CTMS design and to allow for greater flexibility and agility in providing competitive total compensation packages.

For recognition payments, DHS is establishing a maximum amount as a percentage of a DHS-CS employee's salary because most of the Title 5 authorities, on which recognition payments are based, provide a limit for cash payments as a percentage of annual basic pay. Performance-based cash awards range from a minimum of 5 percent under 5 U.S.C. 5382 to a maximum of 20 percent under 5 U.S.C 4505a and 5382. Presidential rank awards are either 20 percent or 35 percent, and recruitment, relocation, and retention incentives have no minimum but have a maximum of 25 percent without special approval. The maximum percentage amount for these Title 5 awards and incentives, ranges from 20 percent to 50 percent, so DHS is establishing the percentage amounts for recognition payments as up to 20 percent without special approval, and up to 50 percent with approval from the Secretary or the Secretary's designee. Also, because recognition payments have budget implications, requiring special approval for amounts exceeding 20 percent of a DHS-CS employee's salary helps to ensure proper oversight of such additional compensation.

DHS requires a service agreement as part of providing a recognition payment for an incoming DHS-CS employee and may require a service agreement as part of providing a recognition payment to a current DHS-CS employee. See § 158.632. Service agreements can help ensure DHS gets, for a minimum amount of time, the benefit of the reasons DHS is providing the recognition payment.

Also, acceptance of a recognition payment constitutes agreement for Federal government use of any idea, method, device, or similar that is the basis of the payment. See § 158.632. This mirrors the requirement in 5 U.S.C. 4502(c) that acceptance of a Title 5 cash award constitutes an agreement that the use by the government of an idea, method, or device for which the award is made does not form the basis of a future claim of any nature against the government by the employee or the employee's heirs or estate. As necessary, DHS may provide a recognition payment to a former DHS-CS employee or to the legal heirs or estate of a DHS-CS former employee in accordance with 5 U.S.C. 4505, which provides for paying a Title 5 cash award to a former employee, or the former employee's heirs or estate.

A recognition payment is not salary under CTMS nor basic pay for purposes under Title 5, see § 158.632, even if paid in an amount that would have been salary but for an applicable salary limitation as incorporated in a salary structure. Under 6 U.S.C. 658, compensation is either salary or additional compensation, and CTMS recognition payments are additional compensation. In cases where a DHS-CS employee's salary is limited because of a CTMS salary limitation, DHS may determine that the employee should instead receive a recognition payment as part of an effort to ensure the individual's compensation is sufficiently competitive for the individual's expertise and mission impact. Any such payment, made in part to address a truncated salary, would be a recognition payment, not salary, and therefore, not basic pay under Title 5.

For DHS-CS employees, recognition payments are in lieu of the seven types of Title 5 cash awards and incentives on which recognition payments are based. See § 158.632. DHS-CS employees and incoming DHS-CS employees are ineligible for those seven types of cash awards and incentives because recognition payments replace those types of Title 5 awards and incentives for DHS-CS employees.

(b) CTMS Recognition Time-Off

CTMS recognition time-off is time-off from duty without charge to leave or loss of compensation for use by the recipient within a designated timeframe. See § 158.633. CTMS recognition time-off is based on Title 5 authorities providing time-off awards, which provide paid time-off in recognition of employee efforts or accomplishments. CTMS recognition time-off serves a similar purpose, but under the overall approach to talent management and compensation under CTMS. DHS uses recognition time-off to recognize and reward DHS-CS employees, especially for their mission impact. CTMS recognition time-off is similar to Title 5 time-off but is specific to CTMS and can be an important part of a total compensation package for both recruiting and retention.

As part of providing a DHS-CS employee recognition time-off, DHS designates the timeframe for use of the time-off award. The designated timeframe for recognition time-off may not exceed the equivalent of 26 biweekly pay periods, and all recognition time-off must also be recorded in a timekeeping system to ensure accurate operation of existing salary and leave administration procedures. See § 158.633. These requirements mirror procedures for use of Title 5 time-off awards under 5 U.S.C. 4502(e). Twenty-six biweekly pay periods is one calendar year for pay and leave administration purposes for Federal employees.

Also, as part of an offer for employment in the DHS-CS, DHS may offer an incoming DHS-CS employee up to 40 hours of recognition time-off for that new employee to use within the employee's first year of employment in the DHS-CS. See § 158.633. As part of recruiting new DHS-CS employees, DHS may need to offer recognition time-off to ensure that an individual's compensation package is sufficiently competitive and to incentivize the individual to serve in the DHS-CS. DHS may require a service agreement as part of providing recognition time-off for an incoming DHS-CS employee.

Recognition time-off may not be converted to a cash payment or any other type of time-off or leave with pay. See § 158.633. This requirement mirrors the same requirement for Title 5 time-off awards in 5 CFR 451.104(f) because an important feature of a time-off award is that providing such awards does not require additional funding or cash disbursement similar to a cash award.

A recognition time-off award is in lieu of time-off awards under Title 5 on which recognition time-off is based. See § 158.633. DHS-CS employees and incoming DHS-CS employees are ineligible for those Title 5 time-off awards because CTMS recognition time-off replaces Title 5 time-off awards for DHS-CS employees.

(c) CTMS Honorary Recognition

As part of CTMS recognition, DHS may establish one or more honorary recognition programs to provide honorary recognition to DHS-CS employees. See 158.634. CTMS honorary recognition is based on honorary recognition provided under the provisions of 5 U.S.C. 4503, which describes how the head of an agency may incur necessary expense for the honorary recognition of an employee for certain acts and contributions. CTMS honorary recognition serves a similar purpose for DHS-CS employees, but under the overall approach to talent management and compensation under CTMS. DHS uses CTMS honorary recognition to recognize and reward DHS-CS employees, especially for their mission impact. CTMS honorary recognition is similar to Title 5 honorary recognition but is specific to CTMS.

Unlike other CTMS recognition, a DHS-CS employee may be eligible to receive both CTMS honorary recognition and any honorary recognition under 5 U.S.C. 4503 and 5 CFR part 451. Some honorary recognition programs developed under Title 5 authority are designed to recognize employees hired and compensated using a variety of statutory authorities. Thus, all eligible DHS employees, including DHS-CS employees, covered by those Title 5 honorary recognition programs may receive recognition under such programs. As with honorary recognition under 5 U.S.C. 4503, DHS may incur necessary expenses for CTMS honorary recognition. See § 158.634.

5. Other Special Payments Under CTMS

Under the CTMS compensation system, DHS provides other types of additional compensation in the form of professional development and training, student loan repayments, payments for special working conditions, and allowances in nonforeign areas. Offering allowances in nonforeign areas is mandated by 6 U.S.C. 658 as a type of additional compensation. Such allowances are not specific to CTMS and are provided to DHS-CS employees under 5 U.S.C. 5941. The other types of additional compensation are also not salary under CTMS nor basic pay for purposes under Title 5. Under 6 U.S.C. 658, compensation is either salary or additional compensation, and CTMS professional development and training, CTMS student loan repayments, and CTMS special working conditions, as well as allowances in nonforeign areas, are all additional compensation.

These types of CTMS additional compensation, except allowances in nonforeign areas, are specific to CTMS and are based on Title 5 authorities. As discussed previously in III.A.3 of this document, under the § 658 additional compensation authority DHS may combine and streamline provisions of Title 5 regarding types of additional compensation, as long as it is clear on which specific Title 5 provisions CTMS additional compensation is based. Sections 158.640-158.642 lists the Title 5 authorities on which CTMS professional development and training, student loan repayments, and payments for special working conditions are based. Each of these other special payments under CTMS is discussed subsequently.

(a) CTMS Professional Development and Training

Under CTMS, DHS provides DHS-CS employees with opportunities, payments, and reimbursements for professional development and training. See § 158.640. CTMS professional development and training is based on Title 5 provisions providing training and professional development opportunities, payments, and reimbursements: 5 U.S.C. 3396 providing sabbaticals, 5 U.S.C. 4107 providing academic degree training, 5 U.S.C. 4109 providing expenses of training, 5 U.S.C. 4110 providing expenses of attendance at meetings, and 5 U.S.C. 5757 providing payment of expenses to obtain professional credentials. Like these provisions of Title 5, CTMS professional development and training provide professional development and training opportunities, payments, and reimbursements for DHS-CS employees, but under the overall approach to talent management and compensation under CTMS. CTMS professional development and training is similar to the training and professional development opportunities, payments, and reimbursements under Title 5, but is specific to CTMS and tailored to CTMS design. This type of compensation can be an important piece of a total compensation package, especially for cybersecurity talent looking to keep their expertise current and to acquire new skills.

DHS provides CTMS professional development and training opportunities, payments, and reimbursements in alignment with the CTMS career development program described in § 158.802 and discussed subsequently. With the career development program, DHS guides the career progression of DHS-CS employees, which includes enhancement of qualifications, and ensures development of the collective expertise of DHS-CS employees through continual learning. CTMS professional development and training is one means of enhancing qualifications and providing opportunities for continual learning.

DHS also provides CTMS professional development and training in alignment with CTMS compensation strategy. CTMS professional development and training is considered part of a total compensation package for a DHS-CS employee, reflecting an understanding of the concepts of total compensation and total rewards in alignment with the CTMS compensation strategy. Professional development and training, even those opportunities not assigned a specific monetary value, can be a valuable part of an employment opportunity with the DHS-CS and a DHS-CS employee's career progression.

CTMS policy will address eligibility criteria and requirements for documenting the reason and basis for providing professional development and training opportunities, payments, and reimbursements, among other matters necessary for administering CTMS professional development and training.

In addition to CTMS professional development and training, a DHS-CS employee may receive training and professional development under the provisions of Title 5 on which CTMS professional development and training is based, if the employee is eligible under those provisions. Many programs and courses developed under Title 5 authority are intended for employees hired and compensated under several different statutory authorities. Thus, all eligible DHS employees, including DHS-CS employees, covered by such programs and courses may participate in them.

(b) CTMS Student Loan Repayments

Under CTMS and in alignment with the CTMS compensation strategy, DHS may provide a student loan repayment to a DHS-CS employee up to $16,500 per employee per calendar year and a total of $90,000 per employee. See § 158.641. CTMS student loan repayments are based on 5 U.S.C. 5379, which provides student loan repayments to certain Federal employees. CTMS student loan repayments serve the same purpose, but under the overall approach to talent management and compensation under CTMS. CTMS student loan repayments are similar to student loan repayments under Title 5, but are specific to CTMS and tailored to CTMS design.

While DHS offers CTMS student loan repayments under the authority in 6 U.S.C 658, DHS provides CTMS student loan repayments in accordance with 5 U.S.C. 5379 and 5 CFR part 537, with some exceptions. DHS applies different maximum payment and cap amounts, different minimum service period lengths, and expanded eligibility criteria from those under 5 U.S.C. 5379 and 5 CFR part 537. The Title 5 student loan repayment program is a useful tool in recruiting and retaining employees, but the program must align with the approach to talent management under CTMS and the CTMS compensation system, which aims to address factors in DHS's challenges recruiting and retaining cybersecurity talent. As discussed previously in III.B of this document, the competitiveness of compensation, including total compensation packages, is a main factor in DHS's challenges recruiting and retaining cybersecurity talent. Therefore, DHS is including student loan repayments under CTMS as a recruitment and retention tool and is increasing the payment amount and cap amounts for CTMS student loan repayments.

For CTMS student loan repayments, DHS is setting the maximum payment amounts to reflect the increased costs of higher education since Congress last amended the maximum rates under 5 U.S.C. 5379. Student loan repayments under 5 U.S.C. 5379 are capped at $10,000 per employee per year and $60,000 total per employee. This statutory authority was originally enacted in 1990 and was originally capped at $6,000 per employee per year and $40,000 total per employee. In 2003, Congress increased the payment caps to $10,000 per employee per year and $60,000 total per employee in a stand-alone Act for the sole purpose of increasing the cap. In increasing the annual cap by 67 percent and the aggregate cap by 50 percent (effective January 2004), Congress stated that the purpose of the 2003 cap increase was to “reflect[ ] an increase in annual college tuition costs since the enactment of the original statute in 1991.” Congress has not updated the cap amount since 2003, and Congress also did not provide specific data for the increase in annual college tuition costs in 2003.

Under § 158.641, the annual cap for CTMS student loan repayments is $16,500 and the aggregate cap is $90,000, in alignment with Congress' last cap increase in 2003. Based on the U.S. Bureau of Labor Statistics Consumer Price Indexes for Tuition and Fees, college tuition and fixed fees increased 129 percent from 1990, when the authority for student loan repayments was originally enacted, to 2003, when Congress increased the payment caps. Therefore, Congress increased the annual payment cap 67 percent and the aggregate payment cap 50 percent when costs of higher education had increased 129 percent (from 1990 to 2003). From 2003 to 2020, college tuition and fixed fees increased 125 percent. It follows that because such costs have increased another 120 percent (from 2003 to 2020), the caps could similarly be increased again another 67 percent and 50 percent, respectively. As such, the CTMS student loan repayment amount per employee per year may be up to $16,500 (a 65 percent increase to have a dollar amount rounded to the nearest 500 for the cap amount) and the CTMS student loan repayment amount total per employee may be up to $90,000 (a 50 percent increase). See § 158.641.

Each DHS-CS employee receiving a CTMS student loan repayment must have a service agreement with a minimum service period, but unlike under Title 5 there is no standard length of minimum service period. See § 158.641. Instead the length of minimum service periods will be determined under CTMS policy and based on the amount of the repayment to provide flexibility to match the service period to the loan repayment amount. Currently, an employee receiving a student loan repayment under 5 U.S.C. 5379 must have a service agreement and that service agreement must be a minimum of three years, regardless of the amount of repayment.

Because CTMS is a different approach to talent management and the CTMS compensation system is a wholly different approach to compensating employees, DHS expects to use CTMS student loan repayments differently, and expects to need more flexibility regarding minimum service periods when considering the total compensation packages of individuals. This includes adjusting the minimum service period in relationship to the amount of student loan repayment provided. As such, under § 158.641, DHS may set minimum service periods for CTMS student loan repayments commensurate with the repayment amount.

All DHS-CS employees, except those providing uncompensated service and DHS advisory appointees, may be eligible to receive a CTMS student loan repayment. See § 158.641. This includes DHS-CS employees serving in a renewable appointment, which as discussed previously is a time-limited appointment to a qualified position. Under 5 CFR 537.104(a), only some employees serving in time-limited appointments can be eligible for Title 5 student loan repayments, and the duration of appointment is a factor. Because appointment under CTMS differ from appointments under Title 5 in types, purposes, and durations, a CTMS student loan repayment is available to eligible DHS-CS employees in renewable appointments. Note, however, that DHS ensures that a service agreement minimum service period does not exceed a DHS-CS employee's appointment duration.

Other eligibility for a student loan repayment under § 158.641 aligns with eligibly criteria under 5 U.S.C. 5379 and 5 CFR part 537. As such, a DHS-CS employee is ineligible to receive a CTMS student loan repayment if DHS determines the employee's performance is unacceptable, as defined in 5 U.S.C. 4301(3), or the employee receives an unacceptable rating of record, or DHS determines the employee has engaged in misconduct. See § 158.641. CTMS policy will address other eligibility criteria for CTMS loan repayments.

CTMS policy will also address requirements for documenting the reason and basis for providing a CTMS student loan repayment, appropriate levels of review and approval, among other matters necessary for administering CTMS student loan repayments.

(c) CTMS Special Working Conditions Payments

Under CTMS, another type of additional compensation that is available to DHS-CS employees is a payment for special working conditions. A payment for special working conditions is a payment of up to 25 percent of the receiving DHS-CS employee's salary as computed for a designated work period or series of work periods. See § 158.642. A CTMS payment for special working conditions is based on Title 5 authorities providing several types of payments: 5 U.S.C. 5545 providing night, standby and hazardous duty differentials, 5 U.S.C. 5546 providing pay for Sunday and holiday work, and 5 U.S.C. 5757 providing extended assignment incentives. See § 158.642. These Title 5 authorities compensate Federal employees for work performed at night, on Sundays and holidays, for standby duty requiring employees to remain at or within the confines of employees' duty stations, for the performance of hazardous duty or duty involving physical hardship, and for extended assignments in atypical locations. These Title 5 authorities provide compensation for special or nonregular working conditions, and CTMS special working conditions payments serve that same purpose for the DHS-CS, but under the overall approach to talent management and compensation under CTMS. DHS uses special working conditions payments to address special working conditions that are specific to cybersecurity work. The Title 5 authorities on which CTMS recognition is based provide some of the existing Federal compensation tools, which as discussed previously in III.B of this document, are cumbersome to use, ineffective for constructing market-sensitive compensation packages, and are not intended to form a cohesive toolset. Additionally, these Title 5 authorities do not effectively account for the unpredictable nature of cybersecurity work, including specific conditions DHS-CS employees may encounter. CTMS special working conditions payments combine and streamline these existing tools to align with the CTMS design, including the CTMS compensation and salary systems. CTMS special working conditions payments allow for greater flexibility and agility than the Title 5 tools in providing competitive compensation, especially for conditions specific to cybersecurity work that are insufficiently accounted for in a DHS-CS employee's salary.

DHS provides any special working conditions payments under a special working conditions payment program. See § 158.642. A special working conditions program addresses special working conditions or circumstances that are otherwise unaccounted for or the Department determines are accounted for insufficiently in DHS-CS employees' other types of additional compensation and salary. DHS aims to provide DHS-CS employees with sufficiently competitive compensation, and DHS anticipates that working conditions may emerge that DHS may not have sufficiently accounted for in DHS-CS employees' compensation, especially their salaries. A special working conditions payments program enables DHS to adjust the additional compensation of DHS-CS employees to specifically address working conditions that DHS had not previously anticipated and accounted for, or DHS determines have been insufficiently accounted for, in DHS-CS employees' salaries.

Special working conditions under § 158.642 include when a supervisor or other appropriate official requires a DHS-CS employee to perform cybersecurity work determined to involve unusual physical or mental hardship, or performing work at atypical locations, at unexpected times, or for an uncommon duration of time exceeding the expectation that all DHS-CS employees occasionally work unusual hours and extended hours, as needed, to execute DHS's cybersecurity mission. See § 158.642. For example, several DHS-CS employees with expertise in cybersecurity incident response might be required to work a substantial amount of time, including at night and beyond their minimum hours of work, in response to a cybersecurity incident affecting critical infrastructure. DHS might establish a special working conditions payment program to cover such conditions and provide payments to acknowledge the special conditions as well as the mission impact of employees required to perform work under such conditions. Special working conditions may also involve both unusual physical or mental hardship and performing work such that it exceeds the expectation of occasionally working unusual and extended hours.

DHS establishes any special working conditions program in alignment with the CTMS compensation strategy and determines whether to establish, adjust, or cancel a special working conditions payment program based on information from the CTMS work scheduling system and strategic talent planning. See § 158.642. Using information from the work scheduling system ensures that a determination about a special working conditions program is made with an understanding of hours worked by DHS-CS employees and potential divergence from expected schedules. The CTMS compensation strategy, together with the talent market analysis from strategic talent planning, ensures that a special working conditions payment program reflects information about current compensation practices of other cybersecurity employers. See § 158.642. Given the ever-evolving nature of cybersecurity work, fierce competition for cybersecurity talent, and variety of compensation practices used by private sector cybersecurity employers, discussed previously in II.B of this document, DHS needs the flexibility to analyze the working conditions of DHS-CS employees as they arise, and if necessary, address them by providing additional compensation.

For special working conditions payments, DHS is establishing a maximum amount as a percentage of a DHS-CS employee's salary computed for a work period or series of work periods because the Title 5 authorities, on which special working conditions payments are based, all provide a limit for cash payments as a percentage of annual basic pay computed as an hourly rate. The percentage of basic pay under these Title 5 authorities is: 10 percent for nightwork; up to 25 percent for standby duty and for performance of hazardous duty or duty involving physical hardship; 25 percent for Sunday work; 25 percent for extended assignments; and 100 percent for holiday work. These percentages range from 10 percent to 100 percent, with most maximum percentages as 25 percent or up to 25 percent, so DHS is establishing the percent amount for a special working conditions payment as up to 25 percent. Additionally, DHS applies the 25 percent maximum for a special working conditions payment based on computing the receiving DHS-CS employee's salary for a work period, which as defined in § 158.705 is the equivalent of a biweekly pay period. DHS applies the payment maximum in this manner because administration of payments under the Title 5 authorities, on which special working conditions payments are based, involves computation of the receiving employees' basic pay for a specific time-period, usually on an hourly basis.

DHS determines eligibility for a payment for special working conditions under § 158.642 and CTMS policy. Under § 158.642, if a DHS-CS employee receives a payment for special working conditions, the employee is not automatically eligible or entitled to receive any additional such payments. Also, a DHS-CS employee receiving a salary equal to or greater than EX-IV is ineligible to receive a payment under this section. This ineligibility reflects that such additional payments are not necessary for DHS-CS employee receiving high salaries, and it also mirrors restrictions in Title 5 that make Federal employees receiving salaries under Title 5 greater than EX-IV ineligible for certain types of Title 5 additional compensation. CTMS policy will address other eligibility criteria for CTMS special working conditions payment.

In addition to eligibility criteria, CTMS policy implementing the special working conditions payment program will address requirements for documenting the reason and basis for providing a special working conditions payment, and appropriate approval authorities, among other matters necessary for establishing and operating the program. See § 158.642.

A special working conditions payment is in lieu of the types of Title 5 payments on which it is based. See § 158.642. DHS-CS employees are ineligible for those types of Title 5 payments because special working conditions payments replace those types of Title 5 payments for DHS-CS employees. Additionally, some of those types of Title 5 payments are considered premium pay and, as discussed previously, Title 5 premium pay generally does not apply under CTMS.

(d) CTMS Allowances in Nonforeign Areas

Another type of additional compensation available to DHS-CS employees is an allowance in nonforeign areas under 5 U.S.C. 5941. See § 158.643. Section 5941 provides a cost of living allowance for certain Federal employees stationed outside of the continental United States or in Alaska and such an allowance can be up to 25 percent of the receiving employee's basic pay. As discussed previously in III.C.3 of this document, 6 U.S.C. 658(b)(3)(B) mandates this type of additional compensation, and also mandates that employees in qualified positions are eligible for such allowances under 5 U.S.C. 5941 on the same basis and to the same extent as if the employees were covered under section 5941, including eligibility conditions, allowance rates, and all other terms and condition in law or regulation. CTMS does just that in § 158.643, which states a DHS-CS employee is eligible for and may receive an allowance under 5 U.S.C. 5941 and implementing regulations in 5 CFR part 591, subpart B on the same basis and to the same extent as if the employee is an employee covered by those authorities.

6. Other Compensation Provided in Accordance With OPM Regulations

Under the CTMS compensation system, DHS is providing DHS-CS employees other types of additional compensation, including leave and other benefits. While DHS offers these other types of additional compensation under the authority in 6 U.S.C 658, DHS provides them in accordance with relevant provisions of other laws that apply to most Federal civil service employees. Many of these other types of additional compensation were established for Federal civilian employees decades ago for purposes still relevant to the talent management approach under CTMS, and these other types of additional compensation are administered using well-established processes DHS does not need to adjust for CTMS. As such, in §§ 158.650, 158.652, and 158.653, DHS provides DHS-CS employees holidays, compensatory time-off for religious purposes, and traditional Federal employee benefits, including retirement, health benefits, and insurance programs, as well as transportation subsidies, in accordance with relevant provisions in Title 5.

In § 158.651, for leave under CTMS, DHS provides DHS-CS employees all the types of leave available to other Federal employees, including annual leave, sick leave, family and medical leave, and other paid leave, in accordance with 5 U.S.C. Chapter 63 and 5 CFR part 630. Although DHS provides leave for DHS-CS employees in accordance with these provisions of law, DHS modifies application of those laws regarding annual leave accumulation to maintain the integrity of CTMS and consistency of the approach to talent management under this part.

For annual leave accumulation under CTMS, DHS will determine DHS-CS employees accumulation amounts under 5 U.S.C. 6304, which permits most Federal employees to accumulate 30 days of annual leave in one year and certain Federal government senior employees, including employees in SL/ST and SES positions, to accumulate 90 days of annual leave in one year. Under this Title 5 annual leave accumulation structure, the 90-day annual leave accumulation amount is reserved for certain employees, including employees in SL/ST and SES positions, with salary rates that exceed 120 percent of GS-15.

Under CTMS, DHS may apply a 90-day accumulation amount to DHS-CS employees receiving a salary that exceeds 120 percent of GS-15. See § 158.651. As discussed previously in III.A.3 of this document, a qualified position is comparable to SL/ST and SES positions, and as such DHS could apply a 90-day accumulation amount to all DHS-CS employees. DHS is not doing this, however, because a higher accumulation amount has potential implications for paying out leave when an employee separates from Federal service. Instead, DHS is mirroring the Title 5 accumulation structure by reserving the 90-day accumulation amount for DHS-CS employees receiving a salary at or above the minimum salary for SL/ST and SES positions.

DHS administers leave under CTMS in accordance with relevant provisions of other laws referenced in §§ 158.651 and 158.655 and in CTMS policy implementing leave for DHS-CS employees. As such, in accordance with 5 U.S.C. 6308, annual leave and sick leave accrued to the credit of a current Federal employee who is appointed to a qualified position without a break in service of more than three calendar days will be transferred to the employee's credit, and any leave balance for a DHS-CS employee departing the DHS-CS will be addressed in accordance with 5 CFR 630.209 and 630.501. See § 158.651.

In § 158.654, DHS is providing DHS-CS employees other types of payments, including severance pay, lump-sum leave pay outs, voluntary separation incentive payments, reservist differentials, and other similar allowances, differentials, and incentives, in accordance with relevant provisions of other laws governing those types of payments. To ensure DHS can offer any other type of additional compensation that becomes available to Federal civil service employees in the future, § 158.654 states that DHS will also provide other payments similar to those listed in § 155.654 and described in CTMS policy as being authorized under this part and provided in accordance with relevant provisions of other laws.

Although DHS provides the types of payments listed in § 158.654 in accordance with relevant provisions of other laws under the authority in 6 U.S.C. 658, DHS may need to modify application of those relevant provisions of law to maintain the integrity of CTMS and consistency of the approach to talent management under this part. This is because some of the terms used in the relevant provisions of law are not used under CTMS, or a different term is used, and DHS may have to extrapolate between the terms in the relevant provision of law and CTMS concepts. For example, CTMS includes a “part-time schedule” and “contingent schedule,” but Title 5 does not use such terms.

Section 158.655 lists several clarifications for how CTMS terms and concepts relate to relevant provisions of other laws. For example, § 158.655 explains a “part-time schedule” and “contingent schedule” are treated as “part-time career employment” and “intermittent employment,” respectively, as defined in Title 5. Section 158.655 also explains that for purposes of compensation administration authorized under §§ 158.650-158.654, DHS may convert the salary of a DHS-CS employee into an hourly rate, biweekly rate, or other rate and administer compensation based on consideration of the DHS-CS employee's work schedule. To ensure accurate administration of compensation, including leave, for DHS-CS employees in accordance with relevant provisions of Title 5, DHS may need to account for and record leave and other compensation earned and charged on an hourly basis.

Also, § 158.655 clarifies that if, in administering compensation under §§ 158.650-158.654, DHS determines it is necessary to clarify the relationship between those sections and the relevant provisions of law referenced in those sections and any other relevant provisions of other laws, DHS will address the issue in new or revised CTMS policy. Thus, if DHS needs to modify application of those relevant provisions of law relating to compensation for the DHS-CS to maintain the integrity of CTMS and consistency of the approach to talent management under this part, DHS will capture any such modified application in CTMS policy.

7. CTMS Aggregate Compensation Limit

The CTMS compensation system includes the CTMS aggregate compensation limit, which restricts certain additional compensation a DHS-CS employee may receive in a calendar year. See § 158.604. Under CTMS, a DHS-CS employee's aggregate compensation is the employee's salary plus certain types of CTMS additional compensation. The aggregate compensation limit prohibits a DHS-CS employee from receiving any portion of a payment for certain types of CTMS additional compensation if that portion would cause the employee's aggregate compensation to exceed the limit.

The CTMS aggregate compensation limit implements the additional compensation authority in 6 U.S.C. 658(b)(3) regarding the level authorized for such compensation. As discussed previously in III.A.3 of this document, DHS interprets this additional compensation authority to mean that CTMS additional compensation is subject to the aggregate compensation cap in 5 U.S.C. 5307. As also discussed in III.A.3 of this document, this Title 5 aggregate compensation cap has two cap amounts, and the Secretary has discretion for how to apply the two cap amounts to CTMS additional compensation. DHS is applying both cap amounts as the CTMS annual aggregate compensation limit.

The CTMS aggregate compensation limit is one of the two amounts referenced in 5 U.S.C. 5307(d)(1): EX-I ($221,400 in 2021) or the Vice President's salary amount ($255,800 in 2021). See § 158.604. CTMS additional compensation when added to salary of a DHS-CS employee may not cause that employee's aggregate compensation to exceed either EX-I or the Vice President's salary, whichever is applicable to that employee.

The applicable CTMS aggregate compensation limit amount for a DHS-CS employee depends on the salary subrange for that individual's salary and the aggregate compensation amount assigned to that subrange. DHS will apply the CTMS aggregate compensation limit amounts in ascending order to the subranges in a CTMS salary structure. DHS will assign one of the two limit amounts to each subrange in a CTMS salary structure such that each subrange has an aggregate compensation limit that is greater than or equal to the salary maximum of that subrange. For example, a hypothetical subrange with a salary maximum of $225,000 is assigned the aggregate compensation limit of the Vice President's salary ($255,800 in 2021). A DHS-CS employee is not permitted to receive payment of certain types of additional compensation if that payment would cause the employee's aggregate compensation to exceed the applicable limit amount for that employee.

Application of the CTMS aggregate compensation limit to DHS-CS employee compensation is based on the Title 5 aggregate compensation cap in 5 U.S.C. 5307 but is tailored to the CTMS compensation system. Under 5 U.S.C. 5307, an employee's aggregate compensation includes the employee's salary, plus any locality-based comparability payments, and certain types of additional compensation under Title 5. A DHS-CS employee's aggregate compensation is the employee's salary, including any LCTMS, and certain types of additional compensation. See § 158.604. Like locality-based comparability payments under 5 U.S.C. 5304, which are subject to the Title 5 aggregate compensation cap, a LCTMS is considered part of a DHS-CS employee's salary for purposes of applying the CTMS aggregate compensation limit.

The types of CTMS additional compensation subject to the CTMS aggregate compensation limit are similar to or are the same types of compensation covered by the Title 5 aggregate compensation cap. The types of CTMS additional compensation considered part of a DHS-CS employee's aggregate compensation, and subject to the applicable aggregate compensation cap, are: Recognition payments, payments for special working conditions, payments for certain allowances and differentials under CTMS, and other similar payments described in CTMS policy. See § 158.604.

Recognition payments, which are based on awards and incentives under Title 5, are subject to the CTMS aggregate compensation limit, and this mirrors how Title 5 treats those awards and incentives under the Title 5 annual aggregate compensation cap. A recognition payment for a DHS-CS employee may be truncated if it would cause the employee's aggregate compensation to exceed the CTMS aggregate compensation limit applicable to that employee. In such a scenario, the DHS-CS employee forfeits any portion of a payment causing the employee's aggregate compensation to exceed that limit. See § 158.604.

Special working conditions payments are also subject to and may be limited by the CTMS aggregate compensation limit. See § 158.542. As discussed previously, special working conditions payments are based on Title 5 authorities providing several types of payments, which are subject to the Title 5 aggregate compensation cap. Some of the types of payments listed in § 158.654, which are provided in accordance with OPM regulations, are also subject to and may be limited by the CTMS aggregate compensation limit, which aligns with how these other payments are treated under the Title 5 aggregate compensation cap.

Aggregate compensation under CTMS excludes all other CTMS additional compensation, which mirrors application of the Title 5 aggregate compensation cap. CTMS professional development and training opportunities, payments, and reimbursements are excluded from the CTMS aggregate compensation limit, which mirrors how Title 5 training and professional development is treated under the Title 5 aggregate compensation cap. CTMS student loan repayments are also excluded from the CTMS aggregate compensation limit because student loan repayments under Title 5 are not part of aggregate compensation under Title 5. Also, CTMS allowances in nonforeign areas, which will be provided on the same basis as the same allowance under Title 5, are not subject to the CTMS aggregate compensation limit because Title 5 allowances in nonforeign areas are excluded from the Title 5 aggregate compensation limit.

The main difference between the CTMS aggregate compensation limit and the Title 5 aggregate compensation cap, other than the necessary differences to tailor it to the CTMS compensation system, is that the CTMS aggregate compensation limit is a true limit. Once a DHS-CS employee's aggregate compensation reaches the applicable limit amount for that employee, any unpaid amounts of those types of additional compensation subject to the aggregate compensation limit do not roll over into the next calendar year. Under the Title 5 aggregate compensation cap, amounts of similar additional compensation under Title 5 that would cause the employee's aggregate compensation to exceed the cap are unpayable in that calendar year but become payable in the next calendar year. Under the CTMS aggregate compensation cap, a DHS-CS employee may not receive any portion of a payment for additional compensation subject to the applicable aggregate compensation limit that would cause the employee's aggregate compensation in any calendar year to exceed that limit amount, and the DHS-CS employee forfeits any such portion of a payment. See § 158.604.

If DHS underestimates or overestimates a DHS-CS employee's aggregate compensation in a calendar year, DHS may make a corrective action. See § 158.604. Such a corrective action would be necessary if an applicable limit amount changed, resulting in a DHS-CS employee receiving some additional compensation in excess of the applicable limit amount for that employee. A corrective action would also be necessary if DHS limited or prohibited an employee's aggregate compensation incorrectly. Corrective actions may include the Secretary or designee waiving a debt to the Federal government for a DHS-CS employee under 5 U.S.C. 5584, if warranted, or making appropriate corrective payments to a DHS-CS employee.

F. Deploying Talent: Subpart G

Subpart G Deploying Talent, includes regulations addressing the CTMS deployment program. Under the deployment program, DHS determines whether DHS needs to use CTMS to recruit and retain individuals possessing CTMS qualifications. See § 158.701. The process of designating qualified positions involves determining both when DHS organizations need individuals with CTMS qualifications and when using CTMS would likely enhance recruiting and retaining those individuals.

Under the deployment program, DHS also operationalizes aspects of other CTMS elements. See § 158.701. The deployment program operationalizes aspects of the work valuation system by documenting applicable work and career structures for qualified positions and assignments.

The deployment program operationalizes aspects of the talent acquisition system by providing requirements for documenting qualified positions established under the talent acquisition system and for matching newly hired DHS-CS employees with initial assignments. Under the deployment program, DHS also determines operational aspects of a newly appointed DHS-CS employee's appointment and assignment, such as the new employee's work schedule and duration of the assignment.

The deployment program operationalizes aspects of the compensation system by providing requirements for determining a DHS-CS employee's official worksite and work schedule, both of which relate to and affect compensation for DHS-CS employees. Whether a DHS-CS employee is eligible for a local cybersecurity market supplement as part of the employee's salary depends on the employee's official worksite location, as does a DHS-CS employee's eligibility for a CTMS allowance in nonforeign areas. Additionally, DHS considers a DHS-CS employee's work schedule when reviewing work conditions or circumstances that may warrant providing a payment under the CTMS special working conditions payment program. Administration of a DHS-CS employee's salary and leave is also connected to the employee's work schedule and hours worked.

Because the deployment program operationalizes aspects of the work valuation system, talent acquisition system, and compensation system, § 158.709 states that the provisions of law relating to classification, appointment, and compensation listed in §§ 158.405, 158.502 and 158.605 do not apply under CTMS, to the DHS-CS, or to talent management under CTMS, including the CTMS deployment program.

1. CTMS Deployment Program

Under the CTMS deployment program, DHS sets out the procedures for collaboration across DHS organizations to designate qualified positions and designate and staff assignments, as well as procedures to determine and document DHS-CS employees' official worksites, administer a work scheduling system, and perform necessary recordkeeping. See § 158.701.

Under the deployment program, DHS: Establishes procedures for designating qualified positions in DHS organizations; designates and staffs assignments; determines and documents a DHS-CS employee's official worksite; administers a work scheduling system; and performs necessary recordkeeping, including documenting qualified positions and assignments. See § 158.701. Each of these aspects of the deployment program are discussed subsequently.

2. Designating Qualified Positions

Under the CTMS deployment program, DHS designates qualified positions when one or more DHS organizations requires individuals with CTMS qualifications to ensure the most effective execution of the DHS cybersecurity mission and the recruitment and retention of such individuals would be enhanced through use of CTMS. See § 158.702. DHS organizations have a range of existing talent management practices they can use to hire, compensate, and develop talent under other statutory authorities and Federal personnel systems. CTMS is specifically designed to recruit and retain talent with CTMS qualifications, so determining that such qualifications are needed by a DHS organization is one factor indicating that using CTMS might benefit the organization. In addition, CTMS features new talent management practices specifically designed to address DHS's challenges recruiting and retaining cybersecurity talent. For circumstances in which a DHS organization is effectively recruiting and retaining certain cybersecurity talent without CTMS, a shift to CTMS's new talent management practices may not be necessary or efficient.

The process of designating qualified positions involves DHS organizations requesting use of CTMS, following requirements for using CTMS, and ensuring availability of information necessary to designate qualified positions. See § 158.702. DHS organizations considering using CTMS must ensure they understand the specialized design of CTMS, including differences from existing talent management practices; identify how they anticipate using CTMS to address their unique recruitment and retention challenges or goals; and consider their organizational readiness to use CTMS to hire, compensate, and develop DHS-CS employees. When first using CTMS, DHS organizations have to address a variety of operational requirements, including determining key officials for approval of talent management actions. CTMS policy will address procedures for requesting use of CTMS, requirements for DHS organizations using CTMS, and the necessary information for designating qualified positions.

Designating qualified positions may result in establishing one or more new qualified positions or identifying and staffing one or more assignments, or both. See § 158.702. As part of designating qualified positions, DHS considers the collective expertise of DHS-CS employees and the possibility of hiring new talent under the talent acquisition system. DHS might identify one or more existing DHS-CS employees with the CTMS qualifications needed for a new assignment or assignments and who are available to match to the assignment or assignments. Alternatively, DHS might decide to hire new talent with the needed CTMS qualifications. In the process of hiring new talent, DHS determines the number of new DHS-CS employees and the corresponding work levels or combination of work levels necessary to satisfy the talent need. For example, DHS might decide a particular talent need could be addressed only by a new DHS-CS employee at the expert level. DHS might determine that another talent need could be addressed either by one new DHS-CS employee at the expert level or several new DHS-CS employees at the entry level.

Because designating qualified positions may result in establishing a new qualified position, designating qualified positions also involves budget and fiscal considerations. See § 158.702.

3. Designating and Staffing Assignments

The CTMS deployment program also establishes procedures for designating and staffing DHS-CS assignments. See § 158.703. DHS designates assignments by defining combinations of DHS-CS cybersecurity work and CTMS qualifications that can be associated with one or more qualified positions. See § 158.703. Designating assignments may result from designating qualified positions, as discussed previously in this document. CTMS policy will address procedures for DHS organizations to designate assignments.

DHS staffs DHS-CS assignments by matching DHS-CS employees with assignments, either as an initial assignment for an incoming DHS-CS employee or a subsequent assignment for a current DHS-CS employee. See § 158.703. DHS matches a DHS-CS employee with an assignment based on alignment of the employee's CTMS qualifications with the specific subset of CTMS qualifications of an assignment. See § 158.703.

For initial assignments, DHS matches an individual with an assignment upon appointment to a qualified position based on such alignment. When matching an individual with an initial assignment, DHS may also consider input from the individual, input from DHS organizations, mission-related requirements determined by DHS officials with appropriate decision-making authority, and strategic talent priorities set by CTMS leadership. Considering this other input and information, in addition to CTMS qualifications, ensures the match reflects the best fit for the individual and ensure DHS strategically staffs assignments in alignment with priorities and goals for the DHS-CS.

When matching a DHS-CS employee with a subsequent assignment, DHS may also consider input from the employee; input from DHS organizations, especially the primary DHS organization of the employee's current assignment; information about the employee from the CTMS performance management program and the CTMS career development program; mission-related requirements; and strategic talent priorities. See § 158.703. Considering this other information and input in matching DHS-CS employees with subsequent assignments ensures the match reflects the best fit for the DHS-CS employee and the best use of the DHS-CS employee's expertise to support the DHS cybersecurity mission.

DHS develops and continually updates strategies for communicating with DHS-CS employees about subsequent assignment opportunities, in alignment with the career development program and based on information from development reviews. See § 158.601. These strategies ensure that DHS-CS employees have opportunities to express interest in different cybersecurity work and DHS-CS assignments, including those that may assist them in enhancing their qualifications, and helps to foster a culture of continual learning within DHS-CS.

A DHS-CS employee may have multiple assignments throughout the employee's service in a qualified position but only has one assignment at a time. Under CTMS, DHS-CS employees may continue assignments for years or shift assignments periodically to gain exposure to new work or apply their qualifications in different mission areas. The number and variety of assignments an employee has while in the DHS-CS will vary based on that employee's interests, strategic talent priorities, and how the employee's qualifications change over time.

A DHS-CS employee's subsequent assignments may have a different primary DHS organization and worksite than the employee's initial assignment. For example, a DHS-CS employee may have an initial assignment in DHS OCIO, but later have a subsequent assignment in CISA. While that DHS-CS employee's assignment and primary DHS organization changes, the employee is still part of the DHS-CS and still has the same qualified position.

Occasionally, if necessary, DHS may direct a subsequent assignment for a DHS-CS employee. See § 158.708. Certain directed subsequent assignments expected to last six months or more require appropriate notice and consultation with the affected DHS-CS employee. Directed subsequent assignments expected to last less than six months is considered temporary, and as such do not require the same formal notice procedures.

For directed subsequent assignments expected to last six months or more with an official worksite in the DHS-CS employee's current commuting area, DHS provides the employee at least 30 calendar days written notice. See § 158.708. This timeframe is intended to provide the DHS-CS employee with sufficient notice of the anticipated change to consider and plan for associated adjustments to the employee's commute and other work-related routines.

For directed subsequent assignments expected to last six months or more with an official worksite outside of the DHS-CS employee's current commuting area, DHS consults with that employee on the reasons for the assignment and the employee's preferences regarding the proposed change in assignment. See § 158.708. DHS also provides that employee written notice at least 90 calendar days before the effective date of the directed subsequent assignment. This timeframe, modeled after similar reassignments in the SES, is intended to provide the DHS-CS employee with sufficient notice of the anticipated change to consider and plan for significant associated adjustments, including potential changes of residence and development of a new commute and other work-related routines. The written notice requirements for directed subsequent assignments can only be waived by the DHS-CS employee matched to the assignment. For directed subsequent assignments, DHS also pays or reimburses appropriate expenses under and in accordance the Federal Travel Regulations at 41 CFR Chapter 301-302.

4. Official Worksite

The CTMS deployment program includes the procedures for determining and documenting official worksites for DHS-CS employees. See § 158.704. Those procedures are modeled after 5 CFR 531.605, which governs determining the official worksite for GS employees in geographic areas defined for purposes of GS locality payments. Because 5 CFR 531.605 does not apply to DHS-CS employees, DHS is creating the procedures in § 158.704 through which DHS determines a DHS-CS employee's official worksite for purposes of administering compensation. A DHS-CS employee's official worksite is especially important for determining eligibility for CTMS local cybersecurity talent market supplements and CTMS allowances in nonforeign areas.

Under CTMS, a DHS-CS employee's official worksite is the geographic location where the employee regularly performs cybersecurity work or where the employee's cybersecurity work is based. In determining a DHS-CS employee's official worksite, DHS considers telework, variation in location where the employee performs cybersecurity work, or other temporary situations affecting the location where the employee performs cybersecurity work. Given the variety of work arrangements possible for DHS-CS employees as they perform the work of their assignments, there may be situations in which the location where a DHS-CS employee performs work varies or is not consistent. In such cases, DHS may need to review a DHS-CS employee's specific work arrangement to determine the employee's official worksite.

DHS documents a DHS-CS employee's official worksite as part of documenting the employee's appointment and updates that documentation to reflect changes in the employee's official worksite, as necessary. DHS documents changes in a DHS-CS employee's official worksite only when such changes are expected to last, or do last, for six months or more. Such changes expected to last less than six months are considered temporary in alignment with the Federal Travel Regulations at 41 CFR chapter 301. DHS addresses temporary changes, as necessary, using the Federal Travel Regulations.

5. Work Scheduling

Under the CTMS deployment program, DHS is establishing and administering a work scheduling system for DHS-CS employees. The CTMS work scheduling system accounts for the unpredictable nature of cybersecurity work. The work scheduling system also allows DHS to ensure that the performance of cybersecurity work is not constrained or impeded by rigid scheduling rules and structures designed for more predictable types of work or for administration of types of compensation, such as Title 5 premium pay and overtime pay under the FLSA, that are not part of the CTMS compensation system.

The work scheduling system ensures agility for DHS in scheduling cybersecurity work and the availability of DHS-CS employees to perform the cybersecurity work associated with their assignments. See § 158.705. The work scheduling system, including associated work schedule types and requirements, enables scheduling the work of DHS-CS employees with enough flexibility to address a variety of mission circumstances, while also ensuring that DHS-CS employees are available to perform work at required times. The work scheduling system also ensures clear expectations for DHS-CS employees about when they are expected to perform work and flexibility for DHS-CS employees in scheduling and performing such work. See § 158.705. Such flexibility for DHS-CS employees allows DHS to offer a variety of work arrangements that may appeal to cybersecurity talent. The work scheduling system provides DHS organizations, DHS-CS employees, and their supervisors with options for scheduling and performing work throughout a work period. These options includes different types of schedules, procedures for determining and updating a DHS-CS employee's work schedule, and requirements for communicating about anticipated work hours to ensure DHS-CS employees and their supervisors maintain a shared understanding of work schedules and how employees' intend to meet work schedule requirements. Additionally, the work scheduling system ensures accurate recording of, accounting for, and monitoring of hours worked by DHS-CS employees as required by applicable Federal personnel and payroll recordkeeping standards. See § 158.705.

CTMS includes new definitions specific to the CTMS work scheduling system. For example, “work period” means a two-week period of 14 consecutive days that begins on a Sunday and ends on a Saturday, and is the equivalent of a biweekly pay period. See § 158.705. Increasingly, existing Federal civilian compensation administration has become linked to the biweekly pay periods and the CTMS work scheduling system acknowledges this linkage between how DHS-CS employees perform work and how they are compensated. Another example of a new definition specific to the CTMS work scheduling system is “minimum hours of work,” which means the minimum number of hours that a DHS-CS employee is required to work, or account for with time-off, during a work period, and is the equivalent to the term “basic work requirement” defined in 5 U.S.C. 6121. See § 158.705. A DHS-CS employee's minimum hours of work determines the employee's biweekly salary payment for the applicable work period. A DHS-CS employee's minimum hours of work depends on the employee's schedule.

The CTMS work scheduling system features three main types of schedules: Full-time, part-time, and contingent. See § 158.705. A full-time schedule, which is 80 hours per work period, is most similar to a full-time schedule under Title 5. A part-time schedule, which is a specified number of hours less than 80 hours per work period, is most similar to part-time career employment under Title 5. A contingent schedule is an irregular number of hours up to 80 hours per work period and is intended for cases when cybersecurity work is sporadic and cannot be regularly scheduled in advance. A DHS-CS employee on a contingent schedule does not have a minimum hours of work requirement, but has a maximum number of 80 hours per work period and a maximum number of total hours throughout the employee's appointment that is determined at the time of appointment. A contingent schedule is most similar to an intermittent schedule under Title 5. For DHS-CS employees with both part-time and contingent schedules, DHS closely monitors hours worked over time and considers, with input from the employee and the employee's supervisor, whether changes to another schedule type are necessary and appropriate.

A DHS-CS employee's work schedule, and any minimum hours of work, is determined at the time of appointment and recorded as part of documenting the employee's qualified position. See § 158.705. A DHS-CS employee's work schedule and minimum hours of work may change during the employee's service in the DHS-CS and DHS records any such updates in the documentation associated with the employee's qualified position.

All DHS-CS employees are expected to perform DHS-CS cybersecurity work associated with their assignments, especially in response to exigent circumstances and emergencies, including cybersecurity incidents. See § 158.705. This may require cybersecurity work to be performed at unexpected times or for more hours than the minimum number of hours associated with the employees' schedules. Hours worked by a DHS-CS employee that exceed that employee's minimum hours of work do not affect the employee's salary nor result in any automatic eligibility for or entitlement to compensation, including any type of additional compensation. See § 158.705.

DHS monitors the hours worked and reported by DHS-CS employees for purposes of managing the DHS-CS, including considering any changes to DHS-CS employees' schedules, and administering compensation, including assisting in consideration of any payment under a CTMS special working conditions program. See § 158.705. As mentioned previously, DHS considers a DHS-CS employee's work schedule when reviewing work conditions or circumstances that may warrant providing a payment under a special working conditions payment program.

DHS-CS employees with full-time and part-time schedules are expected to work at least their minimum hours of work. See § 158.705. If the hours actually worked by the employee are less than the employee's minimum hours of work, the employee must use time-off or must be placed in an appropriate non-pay status to account for the difference between hours actually worked by the employee and the employee's minimum hours of work.

A DHS-CS employee's hours worked directly impacts the employee's compensation. A DHS-CS employee's hours worked is important for salary administration generally and is a factor in providing CTMS special working conditions payments, holidays, leave, and compensatory time-off for religious purposes. See § 158.705. In alignment with the CTMS compensation strategy, the CTMS work scheduling system acknowledges the unpredictable nature of cybersecurity work and the expectation that DHS-CS employees occasionally work unusual hours and extended hours, as needed, to execute the DHS cybersecurity mission, especially in response to exigent circumstances and emergencies. The work scheduling system also reflects an understanding of the cybersecurity talent market, especially current work expectations and arrangements used by other employers. Through the CTMS work scheduling system, DHS is able to accurately administer DHS-CS employees' salaries, including based on DHS-CS employees' hours worked, to ensure that DHS employees receive sufficiently competitive compensation designed for their recruitment and retention.

DHS will implement the work scheduling system in CTMS policy and may establish other work scheduling requirements for DHS-CS employees, including designated days, hours, core hours, or limits on the number of work hours per day. The flexibility to establish other work scheduling requirements allows DHS to adjust to and effectively manage changes linked to the unpredictable nature of cybersecurity work, and respond to work arrangements used by other cybersecurity employers.

6. DHS-CS Recordkeeping

Under the CTMS deployment program, DHS creates records of a DHS-CS employee's employment in the DHS-CS. See § 158.706. DHS documents qualified positions and assignments, as well as other necessary recordkeeping, and updates those documents and records as necessary.

DHS documents a qualified position by documenting an individual's appointment to a qualified position. See § 158.076. Documentation of an individual's qualified position includes a description of the individual's CTMS qualifications and DHS-CS cybersecurity work that can be performed through application of those qualifications. Such documentation also includes applicable work and career structures, such as the individual's work level. Documentation of an individual's qualified positions also includes the individual's salary, current assignment, official worksite, and work schedule.

As discussed previously and stated in § 158.522, a DHS-CS employee serves in the same qualified position for the duration of employment in the DHS-CS, regardless of any changes to the employee's assignments, including primary DHS organizations or official worksite. DHS updates the documentation associated with a DHS-CS employee's qualified position to reflect changes affecting the employee's qualified position, such as enhancements to CTMS qualifications, any subsequent assignment, changes to applicable work and career structures, and changes to official worksite or work schedule. Such a change in documentation does not change the DHS-CS employee's qualified position or indicate that DHS has appointed the employee to a different qualified position.

Recordkeeping under CTMS also includes documenting assignments. Documentation of an assignment includes specific assignment information that describes the DHS-CS cybersecurity work activities of the assignment. See § 158.706. DHS also documents the timeframe of the assignment, the DHS organization to which the DHS-CS employee is assigned for the duration of the assignment, personnel security requirements for the assignment, location of the assignment, requirements and information related to work schedule, and information related to the performance management program (e.g., information relevant for appraisal reviews, mission impact reviews, and development reviews such as goals and standards for evaluating performance). CTMS assignment information is similar to information contained in a series of artifacts commonly produced under Title 5, including a position description, performance plan, and individual development plan.

Updates to the documentation associated with a DHS-CS employee's qualified position also are not a promotion, transfer, or reassignment for any other purpose under 5 U.S.C. or 5 CFR, except as necessary for recordkeeping purposes only. See § 158.706. CTMS does not contain promotions, transfers, or reassignments as defined in Title 5 because they are actions defined based on talent management concepts that are inapplicable and not compatible with CTMS.

While CTMS does not include certain Title 5 concepts, DHS may need to use certain Title 5 terms for recordkeeping purposes to ensure talent management actions for DHS-CS employees are administered and documented properly. DHS uses existing Federal personnel recordkeeping processes, standards, requirements, and systems of record, which use Title 5 terms, for personnel records related to employees in the DHS-CS. To accommodate the new approach to talent management under CTMS, DHS may need to use those Federal personnel recordkeeping processes, standards, requirements, and systems of record differently from how DHS uses them to support other existing personnel systems. For example, although a change in a DHS-CS assignment does not constitute a reassignment for purposes of Title 5, DHS may process a change in assignment for a DHS-CS employee as a “reassignment” and generate associated records, even though existing Federal personnel recordkeeping guidance defines “reassignment” as a change from one position to another position. CTMS policy will address the integration of CTMS talent management actions with existing Federal personnel recordkeeping process, standards, requirements, and systems of record. See § 158.706

7. Details and Opportunities Outside of the DHS-CS

DHS may detail DHS-CS employees outside of DHS. See § 158.707. Detailing a DHS-CS employee outside of DHS under the CTMS deployment system may result in enhanced qualifications of the employee upon return to DHS. Additionally, detailing a DHS-CS employee may contribute to executing the DHS cybersecurity mission. For example, DHS is responsible for the security of the .gov domain and detailing a DHS-CS employee to another agency to support that agency with its .gov security would contribute to carrying out DHS's responsibilities.

DHS may approve a variety of details and external opportunities for DHS-CS employees under existing provisions of Title 5 and other laws governing details outside of DHS. See § 158.707. When detailing a DHS-CS employee under those other laws, DHS will abide by all terms and conditions of those laws. As such, only DHS-CS employees in continuing appointments may be assigned under the Intergovernmental Personnel Act because such appointments are analogous to the types of appointments eligible for assignment under that Act. Given the unique CTMS work valuation system and talent acquisition system, individuals in other Federal personnel systems or from outside of the Federal government may not be detailed to a qualified position in the DHS-CS. See § 158.707.

G. Developing Talent: Subpart H

Subpart H, Developing Talent, includes regulations addressing performance management and development of DHS-CS employees and establishes two elements of CTMS: The performance management program and the career development program. DHS uses the CTMS performance management program to: Establish and maintain individual accountability among DHS-CS employees; manage, recognize, and develop performance of DHS-CS employees; and improve effectiveness in executing the DHS cybersecurity mission. See § 158.802. DHS uses the CTMS career development program to guide career progression of DHS-CS employees, ensure development of the collective expertise of DHS-CS employees, and ensure continued alignment between DHS-CS employee qualifications and the set of CTMS qualifications. See § 158.803. The authority in 6 U.S.C 658 does not impact existing laws regarding performance management and career development, and DHS is establishing the CTMS performance management program under 5 U.S.C. Chapter 43 and 5 CFR part 430. DHS is establishing the CTMS career development program under 5 U.S.C. Chapter 41 and 5 CFR 410 and 430.

DHS is establishing the CTMS performance management program and the CTMS career development program in alignment with the DHS-CS's core values and the goals of the CTMS compensation strategy. This alignment reinforces the core values of expertise, innovation, and adaptability, and underscores the expectation of continual learning for DHS-CS employee performance and development. DHS-CS employees must ensure that their CTMS qualifications remain fresh as technology and threats as well as cybersecurity techniques and tactics change.

Alignment with the goals of the CTMS compensation strategy ensures that DHS manages DHS-CS employee performance with a focus on those goals of exceptional CTMS qualifications and mission impact, excellence and innovation in the performance of DHS-CS cybersecurity work, and continual learning. This focus aligns with opportunities for additional compensation, such as CTMS recognition, which is based primarily on mission impact, as discussed previously.

Alignment with the CTMS compensation strategy goal of continual learning is particularly important for performance management and career development. Such alignment reinforces that DHS-CS employees are expected to enhance their CTMS qualifications, which ultimately contributes to mission impact as DHS-CS employees apply those enhanced qualifications to perform DHS-CS cybersecurity work. The goal of continual learning also supports career progression, which is based on enhancements to CTMS qualifications and salary progression as discussed subsequently.

1. CTMS Performance Management Program

Performance management under 5 U.S.C. Chapter 43 and 5 CFR part 430 is the systematic process by which an agency involves its employees, as individuals and members of a group, in improving organizational effectiveness in the accomplishment of agency mission and goals. Under 5 CFR 430.102, improving organizational effectiveness in the accomplishment of an agency's missions and goals should be integrated with other agency processes including individual accountability, recognition and development. To emphasize the linkage between individual accountability, recognition, and development in improving organizational effectiveness, the CTMS performance management program implements the systematic process of performance management for DHS-CS employees with three ongoing reviews: Appraisal reviews, development reviews, and mission impact reviews. See §§ 158.802, 158.804-158.806.

Collectively, the three ongoing reviews are designed to foster and encourage the improvement of organizational effectiveness in the accomplishment of agency mission and goals through individual accountability, contributions to the mission, and employee development, all of which are fundamental to performance management under 5 CFR part 430. CTMS appraisal reviews target individual accountability. CTMS development reviews focus on continual learning, and mission impact reviews serve as a critical intersection point for the other two reviews. As part of CTMS mission impact reviews, DHS analyzes and describes a DHS-CS employee's influence on the execution of the DHS cybersecurity mission through the application of the DHS-CS employee's CTMS qualifications to perform DHS-CS cybersecurity work. In turn, DHS uses the results of mission impact reviews to support decisions relating to the type and amount of CTMS recognition a DHS-CS employee may receive.

To complete the three reviews under the CTMS performance management program, DHS may collect information and input on a periodic or ongoing basis from the DHS-CS employee being reviewed, other DHS-CS employees, the employee's supervisor, and other appropriate officials. See § 158.802. Periodic or ongoing gathering of information and input from such individuals ensures that DHS has sufficient information from individuals familiar with a DHS-CS employee's CTMS qualifications and performance of DHS-CS work through one or more assignments. Such information and input enable DHS to make informed determinations and take appropriate talent management actions related to all three types of reviews under the CTMS performance management program.

DHS conducts CTMS appraisal reviews using a performance appraisal program, established specifically for DHS-CS employees, that fulfills the specific requirements for appraisal reviews under 5 CFR 430. DHS uses the CTMS appraisal program to review and evaluate the performance of DHS-CS employees, and to ensure DHS-CS employees' individual accountability. See § 158.804. The appraisal program for DHS-CS employees includes one or more progress reviews, as defined in 5 CFR 430.203, and an appraisal that results in a rating of record, as defined in 5 CFR 430.203. DHS addresses unacceptable performance, as defined in 5 U.S.C. 4301(3), under the provisions of 5 CFR part 432 or part 752.

As mentioned previously, a DHS-CS employee is ineligible to receive CTMS recognition if DHS determines a DHS-CS employee's performance is unacceptable or the employee receives an unacceptable rating of record. See §§ 158.630 and 158.804. For the same reasons, a DHS-CS employee may also be excluded from mission impact reviews. See 158.804. Mission impact reviews serve as a basis for decisions about CTMS recognition, and a DHS-CS employee should not be recognized if the employee's performance is unacceptable.

CTMS mission impact reviews are used to evaluate a DHS-CS employee's mission impact throughout the employee's service in a qualified position and to generate a mission impact summary at least annually. See § 158.805. Mission impact reviews capture DHS-CS employee mission impact on an ongoing basis. Application of a DHS-CS employee's CTMS qualifications to successfully and proficiently perform DHS-CS cybersecurity work results in mission impact attributable to that employee. In reviewing a DHS-CS employee's mission impact, individually or as part of a group or both, DHS considers a variety of factors such as: Superior application of qualifications to perform DHS-CS cybersecurity work; significant enhancements to qualifications; special contributions to cybersecurity technologies, techniques, tactics, or procedures; and notable improvements to execution of the DHS cybersecurity mission.

Mission impact reviews are closely connected to CTMS compensation. Capturing, encouraging, and recognizing DHS-CS employee mission impact is part of how DHS manages the DHS-CS based on the DHS-CS's core values and in alignment with the goals of the compensation strategy as previously discussed. As a result of mission impact reviews, DHS makes distinctions among DHS-CS employees to support decisions related to CTMS recognition.

CTMS development reviews are used to review a DHS-CS employee's career progression throughout the employee's service in the DHS-CS. See § 158.806. As described under § 158.803, career progression in the DHS-CS is based on enhancement of CTMS qualifications and salary progression resulting from recognition. DHS uses development reviews to generate a development summary at least annually for each DHS-CS employee, and development summaries may include plans for the learning and career progression of a DHS-CS employee or group of DHS-CS employees. DHS may conduct development reviews concurrently with mission impact reviews.

As part of development reviews, DHS may compare, categorize, and rank DHS-CS employees to support decisions related to professional development and training, as well as subsequent assignments. See § 158.806. Information from development reviews can help DHS determine which types of trainings would benefit DHS-CS employees the most. Such information is also useful in tailoring professional development offerings for DHS-CS employees. DHS may also use information from development reviews in matching DHS-CS employees to subsequent assignments. Certain subsequent assignments may assist DHS-CS employees in maintaining and enhancing their CTMS qualifications, including through exposure to specific types of cybersecurity work. As mentioned previously, under the deployment program, DHS communicates with DHS-CS employees about such subsequent assignment opportunities.

Development reviews connect the CTMS performance management program and the CTMS career development program. Development reviews are the primary means by which DHS determines the extent to which DHS-CS employees have enhanced their CTMS qualifications and thus assist DHS in guiding career progression for DHS-CS employees under the career development program.

2. CTMS Career Development Program

DHS is establishing and administering the CTMS career development program to guide DHS-CS employee career progression, ensure development of the collective expertise of DHS-CS employees through continual learning, and ensure the continued alignment between the qualifications of DHS-CS employees and the set of CTMS qualifications. See § 158.803. The career development program is closely linked to the CTMS performance management program and DHS will use development reviews from the performance management program as part of the career development program.

Career progression in the DHS-CS is based on enhancement of CTMS qualifications and salary progression resulting from recognition adjustments. See § 158.803. Enhancement of CTMS qualifications is one component of career progression in the DHS-CS. DHS needs the collective expertise of the DHS-CS to keep pace with the continual evolution of cybersecurity work. Salary progression is another component of career progression in the DHS-CS. As DHS-CS employees progress through their careers, DHS recognizes DHS-CS employees' advances through recognition adjustments. As mentioned previously, CTMS is not a longevity-based personnel system, and career progression in the DHS-CS is not based on length of service in the DHS-CS or the Federal government.

Under the CTMS career development program, DHS guides career progression of DHS-CS employees using development strategies based on information from development reviews, mission-related requirements, and strategic talent priorities. See § 158.803. DHS aims to guide the career progression of DHS-CS employees to ensure that DHS-CS employees are prepared to execute the DHS cybersecurity mission, including into the future.

Reviewing and encouraging DHS-CS employee career progression is part of how DHS manages the DHS-CS based on the DHS-CS's core values and in alignment with the goals of the compensation strategy as previously discussed. Reviewing and encouraging excellence, innovation, and continual learning through professional development and training opportunities and certain subsequent assignments ensures DHS-CS employees are recognized for such progression. DHS needs the collective expertise of the DHS-CS to keep pace with the ever-evolving nature of cybersecurity work, cybersecurity risks, and cybersecurity threats, and development reviews help foster and encourage a DHS-CS with similarly evolving expertise.

The career development program emphasizes continual learning. DHS needs the collective expertise of the DHS-CS to keep pace with the evolution of cybersecurity work and the dynamic DHS cybersecurity mission. DHS also needs to ensure the DHS-CS collective expertise reflects the set of CTMS qualifications. The career development program, and its emphasis on continual learning, assists DHS in accomplishing this.

DHS establishes, maintains, and communicates criteria for continual learning for DHS-CS employees. Such criteria include recommended and required learning activities, such as: Completion of a specific course of study; completion of mission-related training defined in 5 CFR 410.101; performance of certain cybersecurity work as part of DHS-CS assignments; and participation in opportunities for CTMS professional development and training. See § 158.803. DHS aims to utilize all available opportunities for DHS-CS employee development, including opportunities under CTMS and under Title 5. Such opportunities may include subsequent assignments, details outside of DHS, and training and professional development under Title 5, such as academic degree training under 5 U.S.C. 4107.

DHS verifies a DHS-CS employee's enhancement of CTMS qualifications, which may include review by the CTMB or assessment using standardized instruments and procedures designed to measure the extent to which a DHS-CS employee has enhanced the employee's qualifications. DHS-CS employees may also participate in a formal assessment process for DHS to verify enhancement of CTMS qualifications.

H. Federal Employee Rights and Requirements & Advisory Appointments: Subparts I & J

Subpart I contain regulations addressing Federal civil service employee rights and requirements that apply under CTMS and in the DHS-CS. Subpart J addresses CTMS political appointments, known as advisory appointments. These subparts clarify application to DHS-CS employees of certain protections and requirements for Federal employees and describe employment in the DHS-CS for DHS-CS advisory appointees.

1. Subpart I—Employee Rights, Requirements, and Input

Subpart I, Employee Rights, Requirements, and Input, contains regulations establishing a program for addressing DHS-CS employee input specific to the DHS-CS and a DHS-CS employee's employment. Subpart I also clarifies that certain requirements and protections for Federal employees apply for DHS-CS employees.

DHS-CS employees retain rights and access to processes that may be relevant to employment in the DHS-CS. The provisions of 5 U.S.C. Chapter 75 and 5 U.S.C. 4303 regarding adverse actions and 5 U.S.C. Chapter 35, Subchapter I regarding reductions in force apply to talent management actions under CTMS. See § 158.901. Also, DHS-CS employees retain rights, as provided by law, to seek review of employment-related actions before third parties, such as the Equal Employment Opportunity Commission, Merit Systems Protection Board, Office of Special Counsel and Department of Labor. See § 158.901. Additionally, back pay remains available under 5 U.S.C. 5596 for unjustified or unwarranted talent management actions, and such actions have the same meaning as personnel actions in 5 U.S.C. 2302(a)(2). See § 158.901.

Like other Federal officers and employees, DHS-CS employees are employees covered by the Ethics in Government Act section 101(f)(3), and are subject to the criminal conflict of interest rules as well as government ethics requirements. See § 158.902. These include: criminal conflict of interest provisions in 18 U.S.C. 201-209; Ethics in Government Act, as amended, and implementing regulations in 5 CFR, Chapter XVI, Subchapter B; Supplemental Standards of Conduct for Employees of the Department of Homeland Security in 5 CFR part 4601; and DHS policy. See § 158.902. Under these ethics requirements, DHS-CS employees must seek approval for certain outside activities, comply with ethics program requirements, and other applicable laws, including post-government employment restrictions. See § 158.902.

In addition to the rights and access to processes outside of CTMS, DHS-CS employees also have access to an employee input program under CTMS. DHS is establishing a program for DHS-CS employees to express employment-related concerns and recommendations for enhancing CTMS administration and DHS-CS management. See § 158.903. The CTMS employee input program provides a process for DHS-CS employees to request review of certain talent management actions. DHS will implement this program in CTMS policy, and that policy will address the talent management actions covered by the program and the process for expressing input.

One purpose of the employee input program is to establish opportunities for DHS-CS employees to raise, and have addressed, employment-related concerns without formal litigation. The program, however, does not replace opportunities for redress with relevant third parties, mentioned previously. CTMS policy implementing the employee input program will describe how the program interacts with these other third-party redress avenues.

Another purpose of the employee input program is to provide a process for DHS-CS employees to provide feedback on CTMS and the DHS-CS. This feedback will help the CTMB evaluate whether the CTMS is fulfilling the purpose of its design to recruit and retain individuals with the qualifications necessary to execute the DHS cybersecurity mission. As discussed previously, CTMS has several interrelated elements that function together. Feedback from DHS-CS employees is critical, and the employee input program provides an opportunity for DHS-CS employees to be heard and share their thoughts about the operation of CTMS, including hiring, compensation, and development practices that could be improved. The CTMB may use information from the employee input program for its periodic review of CTMS administration and operation.

2. Subpart J—Advisory Appointments

Subpart J, Advisory Appointments, addresses political appointees under CTMS who serve in advisory appointments. An advisory appointment is an appointment to a qualified position that: The Secretary determines is of a policy-determining, policy-making, or policy advocating character or involves a close or confidential working relationship with the Secretary or other key appointed officials; does not have a salary set by statute; and is not required to be filled by an appointment by the President. See § 158.1001. DHS-CS advisory appointees are treated similar to other political appointees except regarding appointment and compensation. See §§ 158.1001-158.1003. DHS-CS advisory appointees are appointed to a qualified position through an advisory appointment, instead of a Schedule C position or non-career SES position. Compensation for DHS-CS advisory appointees are set under the CTMS compensation system, instead of under the GS, the SES, or other Federal pay system.

An advisory appointment may not be used for an appointment for which salary is set by statute; DHS sets salaries for all advisory appointees under the CTMS compensation system. DHS leadership positions that are established in statute and have a salary in the Executive Schedule set by statute are not covered by advisory appointments. DHS positions required to be filled by appointment by the President also are not covered by advisory appointments.

To treat advisory appointees like other political appointees for talent management purposes other than appointment and compensation, an advisory appointment is treated as an appointment to a Schedule C position under 5 CFR 213.3301. See § 158.1001. The provisions of OPM regulations governing talent management for Schedule C positions apply to advisory appointments, except appointment and compensation is governed by subpart J. DHS also tracks and coordinates advisory appointments with the Executive Office of the President and OPM, as is done with other political appointments. Employment restrictions that apply to other political appointees also apply to advisory appointees as if the advisory appointee was in a Schedule C position. For example, Executive Order 13989 requiring an ethics pledge from political appointees will apply to advisory appointees.

Appointment to an advisory appointment includes the individual participating in the CTMS assessment program. See § 158.1002. As discussed previously in this document, DHS determines individuals' qualifications under the CTMS assessment program, and CTMS qualifications are organized into broad categories defined primarily in terms of capabilities, such as general professional capabilities, cybersecurity technical capabilities, and leadership capabilities. DHS anticipates that the assessment processes for advisory appointments address all such categories, with a focus on both the technical and policy advisory roles of advisory appointees.

The Secretary or designee must approve the appointment of an individual to an advisory appointment by name, and all advisory appointees serve at the will of the Secretary. See § 158.1002. Like other political appointments, an advisory appointment terminates no later than the end of the term of the U.S. President under which the advisory appointee was appointed, and a DHS-CS advisory appointee may be removed at any time. The provisions of 5 U.S.C. Chapter 75 regarding adverse actions do not apply to talent management actions taken under this part for a DHS-CS advisory appointee because of the confidential, policy-determining, policy-making, or policy-advocating character of an advisory appointment.

Advisory appointments to qualified positions are limited and capped at a total number established by the Secretary or the Secretary's designee under § 158.1002. This cap reflects that noncareer appointments to SES positions are generally limited to 25 percent of the agency's number of total SES positions, and Schedule C positions are limited in total number under OPM direction. Like Schedule C positions under 5 CFR 213.3301, DHS may not use an advisory appointment solely or primarily for the purpose of detailing any individual to the White House. See § 158.1002.

Once appointed, an advisory appointee in the DHS-CS is treated like other political appointees for all talent management purposes, except compensation. Like other DHS-CS employees, an advisory appointee receives a salary under the CTMS salary system, unless the appointee is providing uncompensated service. See § 158.1003. An advisory appointee may receive a salary in the standard range only because, as discussed previously, DHS uses the extended range for limited circumstances only. Like other political appointees, compensation for an advisory appointee is subject to guidance from the Administration on compensation for political appointees.

Like political appointees in Schedule C positions who may receive a promotion and GS grade increase, and political appointees in non-career SES positions who may receive a performance-based pay adjustment, an advisory appointee may receive salary adjustments in the form of recognition adjustments. Like a political appointee in a Schedule C position who may receive locality pay under the GS, an advisory appointee may receive a local cybersecurity talent market supplement. Like other DHS-CS employees, DHS administers salary and other compensation, including leave, for an advisory appointee based on consideration of the advisory appointee's work schedule under the CTMS work scheduling system. DHS also may convert an advisory appointee's salary into an hourly, biweekly, or other rate as necessary to ensure accurate operation of existing pay administration procedures and infrastructure, as mentioned previously.

An advisory appointee, unless providing uncompensated service, may also receive CTMS additional compensation, but only as provided in subpart J. Like other DHS-CS employees, additional compensation for advisory appointees is subject to and may be limited by the CTMS aggregate compensation cap. Additional compensation for advisory appointees is also subject to and may be limited by prohibitions, guidance, and other provision of law governing awards to political appointees, including 5 U.S.C. 4508 prohibiting awards to political appointees during a Presidential election period, and other restrictions and requirements in CTMS policy. Restrictions on additional compensation for advisory appointees aligns with general restrictions on certain types of compensation for political appointees across the Federal government, such as OPM guidance to agencies restricting discretionary awards, bonuses, and similar payments for Federal employees serving under political appointments.

Like other types of political appointees who may receive monetary and other awards, advisory appointees may receive CTMS recognition payments, CTMS recognition time-off, and CTMS honorary recognition, subject to prohibitions, guidance, and other provision of law governing compensation for political appointees. An individual being appointed to an advisory appointment, however, may not receive any recognition as part of an offer of employment because other political appointees are prohibited from receiving recruitment incentives.

An advisory appointee may receive CTMS professional development and training; however, unlike other DHS-CS employees, an advisory appointee may not receive any payment or reimbursement for costs of academic degree training or expenses to obtain professional credentials, including examinations to obtain such credentials. As discussed previously, CTMS professional development and training is based, in part, on payment of expenses to obtain professional credentials under 5 U.S.C. 5757, which prohibits such payments for any employee occupying or seeking to qualify for appointment to any position that is excepted from the competitive service because of the confidential, policy-determining, policy-making, or policy-advocating character of the position. Similarly, an advisory appointee is ineligible for CTMS student loan repayments, which as discussed previously are based on student loan repayment provisions of Title 5, and political appointees are ineligible to receive Title 5 student loan repayments.

Like other political appointees in non-career SES positions and Schedule C positions, advisory appointees may receive types of compensation, including leave and benefits, authorized under CTMS and provided in accordance with provisions of Title 5. An advisory appointee, however, may not receive a CTMS special working conditions payment under a special working conditions payment program because of the nature of an advisory appointment: A political appointment, especially one with a close and confidential working relationship with the Secretary or other key appointed officials, involves different expectations about working conditions than the appointment of other DHS-CS employees.

An advisory appointee may receive CTMS allowances in nonforeign areas under 5 U.S.C. 5941 like other DHS-CS employees because under 6 U.S.C. 658(b)(3)(B) mandates that all employees in qualified positions “shall be eligible” for such allowances on the same basis and to the same extent as if the employee in the qualified positions was covered by 5 U.S.C. 5941. A CTMS allowance in nonforeign areas for an advisory appointee, however, is subject to prohibitions, guidance, and other provision of law governing compensation for political appointees.

V. Appendix: Reference Materials

The following are the most relevant reference materials reviewed by a specialized DHS team as part of designing CTMS to solve DHS's historical and ongoing challenges recruiting and retaining cybersecurity talent:

• William Crumpler & James A. Lewis, The Cybersecurity Workforce Gap, Center for Strategic & International Studies, (Jan. 2019) available at https://www.csis.org/analysis/cybersecurity-workforce-gap (last visited May 25, 2021).
• Peter F. Drucker, Knowledge Worker Productivity: The Biggest Challenge, 41 California Management Review 79 (Winter 1999).
• Robert L. Heneman, Ph.D., Work Evaluation: Strategic Issues and Alternative Methods, prepared for the U.S. Office of Personnel Management, FR-00-20 (July 2000, Revised Feb. 2002).
• Homeland Security Advisory Council, U.S. Department of Homeland Security, CyberSkills Task Force Report (Fall 2012).
• Joseph W. Howe, History of the General Schedule Classification System, prepared for the U.S. Office of Personnel Management, FR-02-25 (Mar. 2002).
• (ISC)²,

○ Hiring and Retaining Top Cybersecurity Talent: What Employers Need to Know About Cybersecurity Jobseekers (2018), available at https://www.isc2.org/Research/Hiring-Top-Cybersecurity-Talent (last visited May 25, 2021).

○ Strategies for Building and Growing Strong Cybersecurity Teams, (ISC)² Cybersecurity Workforce Study (2019), available at https://www.isc2.org/Research/2019-Cybersecurity-Workforce-Study (last visited May 25, 2021).

Martin C. Libicki et al, H4CKER5 WANTED: An Examination of the Cybersecurity Labor Market, National Security Research Division, RAND Corporation (2014) available at https://www.rand.org/content/dam/rand/pubs/research_reports/RR400/RR430/RAND_RR430.pdf (last visited May 25, 2021) .

• Bernard Marr, The Future of Work: 5 Important Ways Jobs Will Change the 4th Industrial Revolution, Forbes, July 15, 2019, available at https://www.forbes.com/sites/bernardmarr/2019/07/15/the-future-of-work-5-important-ways-jobs-will-change-in-the-4th-industrial-revolution/#3ffd62b754c7 (last visited May 25, 2021).
• Susan Milligan, HR 2025: 7 Critical Strategies to Prepare for the Future of HR, HR Magazine, Oct. 29, 2018 available at https://www.shrm.org/hr-today/news/hr-magazine/1118/Pages/7-critical-strategies-to-prepare-for-the-future-of-hr.aspx (last visited May 25, 2021).
• National Academy of Public Administration,

○ Revitalizing Federal Management: Managers and Their Overburdened Systems (Nov. 1983).

○ Modernizing Federal Classification: An Opportunity for Excellence (July 1991).

○ The Transforming Power of Information Technology: Making the Federal Government an Employer of Choice for IT Employees, Summary Report (Aug. 2001).

○ Recommending Performance-Based Federal Pay. A Report by the Human Resources Management Panel (May 2004).

○ Transforming the Public Service: Progress Made and the Work Ahead (Dec. 2004).

○ Building a 21st Century Senior Executive Service (Mar. 2017).

○ No Time to Wait: Building a Public Service for the 21st Century (July 2017).

○ No Time to Wait, Part 2: Building a Public Service for the 21st Century (Sep. 2018).

• National Commission on Military, National, and Public Service, Inspired to Serve, (Mar. 2020).
• National Research Council, Professionalizing the Nation's Cybersecurity Workforce?: Criteria for Decision-Making, The National Academies Press (2013) available at https://doi.org/10.17226/18446 (last visited May 25, 2021).
• Partnership for Public Service,

○ Cyber In-Security: Strengthening the Federal Cybersecurity Workforce (July 2009).

○ Cyber In-Security II: Closing the Federal Talent Gap (Apr. 2015).

• Emil Sayegh, As the End of 2020 Approaches, The Cybersecurity Talent Drought Gets Worse, Forbes, Sep. 22, 2020, available at https://www.forbes.com/sites/emilsayegh/2020/09/22/as-the-end-of-2020-approaches-the-cybersecurity-talent-drought-gets-worse/?sh=104825545f86 (last visited May 25, 2021).
• Society for Human Resource Management, The New Talent Landscape: Recruiting Difficulty and Skills Shortages (June 2016), available at https://www.shrm.org/hr-today/trends-and-forecasting/research-and-surveys/Pages/Talent-Landscape.aspx (last visited May 25, 2021).
• Harry J. Thie et al, Future Career Management Systems for U.S. Military Officers, Santa Monica, CA: RAND Corporation, MR-470-OSD, prepared for the Office of the Secretary of Defense (1994) available at https://www.rand.org/pubs/monograph_reports/MR470.html (last visited May 25, 2021).
• U.S. Cyberspace Solarium Commission,

○ U.S. Cyberspace Solarium Commission Report (Mar. 2020).

○ Growing a Stronger Federal Cyber Workforce, CSC White Paper #3 (Sep. 2020).

• U.S. Department of Homeland Security, DHS Cybersecurity Workforce Strategy: Fiscal Years 2019-2023.
• U.S. Government Accountability Office,

○ Description of Selected Systems for Classifying Federal Civilian Positions and Personnel, GGD-84-90 (July 1984).

○ Human Capital: Opportunities to Improve Executive Agencies' Hiring Process, GAO-03-450 (May 2003).

○ Human Capital: Implementing Pay for Performance at Selected Personnel Demonstration Projects, GAO-04-83, (Jan. 2004).

○ Human Capital: Federal Workforce Challenges in the 21st Century, GAO-07-556T (Mar. 2007).

○ Human Capital: OPM Needs to Improve the Design, Management, and Oversight of the Federal Classification System, GAO-14-677 (July 2014).

○ Federal Workforce: Sustained Attention to Human Capital Leading Practices Can Help Improve Agency Performance, GAO-17-627T, (May 2017).

○ Federal Workforce: Key Talent Management Strategies for Agencies to Better Meet Their Missions, GAO-19-181 (Mar. 2019).

○ Priority Open Recommendations: Office of Personnel Management, GAO-19-322SP (April 2019).

○ Federal Workforce: Talent Management Strategies to Help Agencies Better Compete in a Tight Labor Market, GAO-19-723T (Sep. 2019).

• U.S. Office of Personnel Management,

○ A Fresh Start for Federal Pay: The Case for Modernization, (April 2002).

○ Alternative Personnel Systems in the Federal Government: A Status Report on Demonstration Projects and Other Performance-Based Pay Systems, (Dec. 2007).

○ Introduction to the Position Classification Standards (2009).

• U.S. Merit Systems Protection Board,

○ Attracting the Next Generation: A Look at Federal Entry-Level New Hires (Jan. 2008).

○ In Search of Highly Skilled Workers: A Study on the Hiring of Upper Level Employees From Outside the Federal Government (Feb. 2008).

○ Job Simulations: Trying Out for a Federal Job (Sep. 2009).

• Sheldon Whitehouse et al, From Awareness to Action: A Cybersecurity Agenda for the 45th President, Report of the CSIS Cyber Policy Task Force, Center for Strategic & International Studies (Jan. 2017), available at https://www.csis.org/analysis/awareness-action (last visited May 25, 2021).

VI. Public Participation and Request for Comments

Interested persons are invited to participate in this rulemaking by submitting written comments on this interim final rule. Comments that will provide the most assistance to DHS will reference a specific portion of the interim final rule, explain the reason for any suggestion or recommended change, and include data, information, or authority that supports such suggestion or recommended change. DHS will review all comments received on this interim final rule, but may choose not to post off-topic, inappropriate, or duplicative comments. To submit a comment:

• Go to http://www.regulations.gov and follow the instructions for submitting comments for docket number DHS-2020-0042. If your material cannot be submitted using http://www.regulations.gov,, contact the persons listed in the For Further Information Contact section of this document for alternative instructions.
• All submissions received must include the agency name and docket number for this rulemaking.
• Comments posted to http://www.regulations.gov are posted without change and will include any personal information provided. For more information about privacy and submissions in response to this document, see DHS's eRulemaking System of Records notice (85 FR 14226, March 11, 2020).

VII. Statutory and Regulatory Requirements

DHS developed this rule after considering numerous statutes and Executive Orders (E.O.s) related to rulemaking. Below is a summary of the analysis based on these statutes or E.O.s.

A. Executive Orders 12866 (Regulatory Planning and Review) and 13563 (Improving Regulation and Regulatory Review)

Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule is one of agency management and personnel. While such rules are not considered rules subject to review by OMB under E.O. 12866, OMB has reviewed it consistent with the principles of that Order. This rule does not impose costs or burdens on the private sector. The additional government expense to operate and maintain CTMS in the future is projected to be $12 to $17 million, annually.

An assessment of potential costs and benefits follows.

1. Background and Purpose

CTMS is a new mission-driven, person-focused, and market-sensitive approach to talent management featuring several interrelated elements. Each of the CTMS elements (strategic talent planning process, talent acquisition system, compensation system, deployment program, performance management program, and career development program) represent a shift from the talent management methods and practices Federal agencies traditionally use to manage Federal civil service talent. CTMS is designed to recruit and retain individuals with the skills, called qualifications, necessary to execute the DHS cybersecurity mission. CTMS is also designed to adapt to changes in cybersecurity work, the cybersecurity talent market, and the DHS cybersecurity mission over time. With CTMS, DHS is creating a new type of Federal civilian position, called a qualified position, and the cadre of those positions and the individuals appointed to them is called the DHS-CS. DHS organizations will use CTMS when they need to recruit and retain talent with CTMS qualifications and DHS determines the recruitment and retention of such talent would be enhanced by specialized CTMS practices for hiring, compensation, and development.

The DHS organizations using CTMS will provide for the compensation of new DHS-CS employees they hire, and OCHCO, which contains the specialized team responsible for designing CTMS, will assist those DHS organizations as they hire, compensate, and develop those new DHS-CS employees. The Cybersecurity and Infrastructure Security Agency (CISA) and the DHS Office of the Chief Information Officer (DHS OCIO) will be the first to use CTMS and hire new DHS-CS employees. In early FY 2022, CISA and DHS OCIO plan to use CTMS for approximately 150 priority hires.

2. CTMS Costs: Designing, Establishing, and Administering CTMS

To design CTMS and prepare for its establishment and administration, OCHCO needed the talent management infrastructure necessary to conceive of and plan for DHS to use a new approach to Federal civilian talent management. Most importantly, OCHCO needed individuals with a variety of highly specialized talent management expertise in areas ranging from industrial and organizational (I/O) psychology and compensation design to Federal talent management policy and employment law. Such expertise was necessary to design each of the interrelated elements of CTMS as well as prepare for their respective administration. All CTMS elements, especially those reflecting the greatest shifts from existing Federal talent management methods and practices, required effort to envision, including a variety of research and planning activities to translate ideas into specialized hiring, compensation, and development practices DHS could begin to use. This preparation required DHS to review existing talent management business processes in use across DHS organizations and formulate adjustments to ensure the effective administration of CTMS and its elements. Notable adjustments involved reviewing approval and recordkeeping procedures for talent management actions as well as operation of existing information technology support systems, such as the DHS personnel and payroll system.

In fiscal year (FY) 2016, Congress began providing OCHCO with funding to design and establish CTMS. The table below summarizes the funding Congress provided OCHCO for CTMS from FY 2016 through FY 2021; it also outlines how OCHCO used the funding to design and prepare to administer each CTMS element.

As shown in Table 3, OCHCO used approximately 37 percent of the funding received from FY 2016 through FY 2021 for the talent acquisition system, which required extensive industrial and organizational (I/O) psychology research to develop, validate, and test assessment processes, including simulations of DHS-CS cybersecurity work intended to test CTMS qualifications. OCHCO also used a total of approximately 25 percent of the FY 2016 through FY 2021 funding on parts of the strategic talent planning process, each of which are critical to the administration of several CTMS elements. Each of the remaining elements was associated with less than 11 percent of the funding received from FY 2016 through FY 2021.

For FY 2022, DHS has requested a budget increase of approximately $2.3 million above FY 2021 funding to cover expected enhancements to the talent acquisition and compensation systems. Additional spending, to be split evenly between these two elements, is intended to ensure that DHS can effectively use CTMS to source and assess more applicants, hire more DHS-CS employees, and monitor and adjust the compensation of those employees. Currently, DHS is planning with DHS organizations for a second phase of hiring to begin in FY 2022 and to include at least 350 new DHS-CS employees.

Notably, OCHCO used 74 percent and 26 percent of the FY 2016 through FY 2021 funding on contract support and OCHCO Federal team salaries and benefits, respectively. Much of the design of CTMS and its elements required temporary, start-up expertise, which was most efficiently secured via contract. In FY 2022, DHS anticipates initial start-up investments required to establish CTMS will be complete. DHS anticipates annual costs of operating CTMS in future years to range from approximately $12 million to $17 million, depending on the number of DHS organizations using CTMS, the growth of the population of DHS-CS employees, and the magnitude of adjustments to CTMS required as a result of changes in the cybersecurity talent market and the DHS cybersecurity mission. Simultaneously, DHS expects a larger proportion of annual CTMS administration costs to be dedicated to the salaries and benefits of Federal employees responsible for administering CTMS and supporting both DHS organizations using CTMS and the DHS-CS employees hired by them.

3. CTMS & DHS-CS Costs: Compensating and Retaining DHS-CS Employees

The costs of compensating DHS-CS employees with salaries and additional compensation are not accounted for in the funding OCHCO has received for CTMS. DHS organizations will cover the costs of compensating DHS-CS employees and any related expenses incurred after the selection of those employees. Costs for compensating DHS-CS employees will be constrained by the amount budgeted for DHS's compensation expenditures, as is the case for existing Federal civilian employees in positions established and managed under other existing Federal personnel systems.

OCHCO will work closely with DHS organizations to establish qualified positions in the DHS-CS and support the hiring, compensation, and development their DHS-CS employees. In addition, DHS organizations will commit to funding new qualified positions and DHS-CS employees prior to hiring. Such funding commitments will be based on hiring plans, including cost estimates, established by DHS organizations with assistance from OCHCO. In planning for the cost of qualified positions and DHS-CS employees, DHS will use a consistent cost estimating methodology, much like DHS uses to describe and estimate employee costs under other existing Federal personnel systems. In alignment with the new CTMS compensation system, the new cost estimating methodology will account for four new cost factors: Salary, salary adjustments (called recognition adjustments), cash bonuses (called recognition payments), and training.

Under CTMS, DHS sets salaries based on assessment of an individual's CTMS qualifications. Salaries for DHS-CS employees may include a local cybersecurity talent market supplement, intended to account for differences in the cost of talent in specific local cybersecurity talent markets, which are geographic areas defined by DHS. Salary adjustments under CTMS are based primarily on a DHS-CS employee's mission impact, and DHS makes such adjustments based on an understanding of current compensation practices in the broader cybersecurity talent market, including the salary rates of other employers.

CTMS additional compensation includes recognition payments based primarily on DHS-CS employees' mission impact, and DHS also provides such payments based on an understanding of current compensation practices in the broader cybersecurity talent market. Under CTMS, continuous learning is a critical aspect of DHS-CS employees' career progression, so the new cost estimating methodology includes training costs to ensure DHS organizations have requisite funding allocated to invest in the development of their DHS-CS employees. Remaining position costs, such as benefits, General Services Administration rent, and equipment, have been incorporated into the cost estimating methodology based on established rates DHS uses to estimate employee costs under other existing Federal personnel systems.

This rulemaking may have future distributional effects on the DHS budget regarding funding for positions and employees. At the launch of CTMS, a DHS organization establishing a new qualified position in the DHS-CS will cover the cost of that qualified position using existing funding. DHS organizations will need to review available funding and position vacancies when creating qualified positions in the DHS-CS to account for cost differences between qualified positions and positions previously defined using other Federal personnel systems. Because CTMS reflects shifts from existing talent management practices and methods, including those for compensation, DHS anticipates that the costs of qualified positions will vary from the costs a DHS organization previously projected for vacant positions based on the talent management practices of other existing personnel systems. These cost differences may require DHS organizations to adjust strategies for filling vacancies. In some cases, certain vacancies may need to remain unfilled to ensure sufficient funding for one or more DHS-CS qualified positions reflecting higher total costs than previously estimated. In other cases, a DHS organization may realize cost savings as it is able to hire highly-skilled DHS-CS employees with lower compensation and total costs than the organization previously projected using other existing Federal personnel systems. For example, a DHS organization might have planned to hire an experienced cybersecurity expert given previous recruiting challenges, but with CTMS, the organization may be able to hire, competitively compensate, and quickly develop a DHS-CS employee just beginning a career in cybersecurity.

4. CTMS & DHS-CS Benefits: Enhancing the Cybersecurity of the Nation

Cybersecurity is a matter of homeland security and one of the core missions of DHS. For more than a decade, DHS has encountered challenges recruiting and retaining mission-critical cybersecurity talent. During that time, as cybersecurity threats facing the Nation have grown in volume and sophistication, DHS has experienced spikes in attrition and longstanding vacancies in some cybersecurity positions. To address the DHS's ongoing challenges recruiting and retaining cybersecurity talent, DHS is establishing CTMS under the authority in 6 U.S.C. 658.

The main benefit of this rulemaking is enhancing the Nation's cybersecurity by enhancing DHS's capacity to recruit and retain top cybersecurity talent to execute the DHS cybersecurity mission. The DHS-CS employees hired, compensated, and developed using CTMS are expected to impact execution of the DHS cybersecurity mission, including by applying their CTMS qualifications to successfully and proficiently perform DHS-CS cybersecurity work. Given the ever-evolving nature of cybersecurity threats and risks, future costs of CTMS and the DHS-CS cannot be projected with certainty, and similarly, the benefits of CTMS and the DHS-CS cannot be estimated with certainty. While difficult for DHS to quantify in advance, the cybersecurity work performed by DHS-CS employees is anticipated to result in efficiencies in DHS cybersecurity mission execution. In the course of DHS-CS employees performing their work, DHS also anticipates that they will make contributions to cybersecurity technologies, techniques, tactics, or procedures, which will benefit both DHS and the Nation more broadly.

B. Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et. seq.), as amended by the Small Business Regulatory Enforcement and Fairness Act of 1996, requires an agency to prepare and make available to the public a regulatory flexibility analysis that describes the effect of a proposed rule on small entities (i.e., small businesses, small organizations, and small governmental jurisdictions) when the agency is required to publish a general notice of proposed rulemaking for a rule. Since a general notice of proposed rulemaking is not necessary for this rule, DHS is not required to prepare a regulatory flexibility analysis for this rule.

C. Congressional Review Act

This rule is not covered by the Congressional Review Act (CRA), codified at 5 U.S.C. 801-808, because it is excluded from the definition of a “rule” under that Act. Under the CRA, certain rules are subject to requirements concerning congressional review of those rules. A “rule” for purposes of the CRA, however, does not include “any rule relating to agency management or personnel.” 5 U.S.C. 804(3)(B). As discussed in II. Basis and Purpose, this rule implementing a new talent management system for a subset of DHS's cybersecurity workforce is a matter relating to agency management or personnel. As such, this rule is excluded from the definition of “rule” under the CRA and is thus not subject to the CRA's requirements.

D. Unfunded Mandates Reform Act

The Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1531-1538, requires each Federal agency to prepare a written statement assessing the effects of any Federal mandate in a proposed or final agency rule that may result in a $100 million or more expenditure (adjusted annually for inflation) in any one year by State, local, and Tribal governments, in the aggregate, or by the private sector. Because this rule does not impose any Federal mandates on State, local, or Tribal governments, in the aggregate, or the private sector, and because this rule is exempt from written statement requirements under 2 U.S.C. 1532(a), this rule does not contain such a written statement.

E. E.O. 13132 (Federalism)

A rule has implications for federalism under E.O. 13132 if it has a substantial direct effect on States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. Because this rule implements a new talent management system and only addresses DHS personnel matters, DHS determined in accordance with E.O. 13132 that this rule does not have federalism implications warranting the preparation of a federalism summary impact statement.

F. E.O. 12988 (Civil Justice Reform)

This rule meets applicable standards in sections 3(a) and 3(b)(2) of E.O. 12988 to minimize litigation, eliminate ambiguity, and reduce burden.

G. E.O. 13175 (Consultation and Coordination With Indian Tribal Governments)

This rule does not have tribal implications under E.O. 13175, because it would not have a substantial direct effect on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes.

H. National Environmental Policy Act

DHS analyzed this rule under Department of Homeland Security Management Directive 023-01 Rev. 01 and Instruction Manual 023-01-001-01 Rev. 01 (Instruction Manual), which establishes the procedures DHS uses to comply with the National Environmental Policy Act of 1969 (NEPA), 42 U.S.C. 4321 et seq., and the Council on Environmental Quality (CEQ) regulations implementing NEPA codified at 40 CFR parts 1500-1508. The CEQ regulations allow Federal agencies to establish categories of actions (“categorical exclusions”) which experience has shown do not individually or cumulatively have a significant effect on the human environment and, therefore, do not require an Environmental Assessment or Environmental Impact Statement. 40 CFR 1507.3(e)(2)(ii), 1501.4. Categorical exclusions established by DHS are set forth in Appendix A of the Instruction Manual. For an action to be categorically excluded, it must satisfy each of the following three conditions: (1) The entire action clearly fits within one or more of the categorical exclusions; (2) the action is not a piece of a larger action; and (3) no extraordinary circumstances exist that create the potential for a significant environmental effect. Instruction Manual section V.B(2)(a)-(c). Instruction Manual section V.B(2)(a)-(c).

This rule implements a new talent management system with specialized practices for hiring, compensating, and developing cybersecurity talent to support the Department's cybersecurity mission. Because this rule is limited to agency management and personnel matters, it clearly falls within the scope of DHS categorical exclusions A1 (Personnel, fiscal, management, and administrative activities, such as recruiting, processing, paying, recordkeeping, resource management, budgeting, personnel actions, and travel) and A3(a) (Promulgation of rules of a strictly administrative or procedural nature), set forth in Appendix A of the Instruction Manual. This rule also is not part of a larger action and presents no extraordinary circumstances creating the potential for significant environmental effects. Therefore, this action is categorically excluded and no further NEPA analysis is required.

I. National Technology Transfer and Advance Act

The National Technology Transfer and Advancement Act, codified at 15 U.S.C. 272 note, directs agencies to use voluntary consensus standards in their regulatory activities unless the agency provides Congress, through OMB, with an explanation of why using these standards would be inconsistent with applicable law or otherwise impractical. Voluntary consensus standards are technical standards (e.g., specifications of materials, performance, design, or operation; test methods; sampling procedures; and related management systems practices) that are developed or adopted by voluntary consensus standards bodies. This rule does not use technical standards. Therefore, DHS did not consider the use of voluntary consensus standards.

J. E.O. 12630 (Governmental Actions and Interference With Constitutionally Protected Property Rights)

This rule will not cause a taking of private property or otherwise have taking implications under E.O. 12630.

K. E.O. 13045 (Protection of Children From Environmental Health Risks and Safety Risks)

Executive Order 13045 requires agencies to consider the impacts of environmental health risk or safety risk that may disproportionately affect children. DHS has analyzed this rule under E.O. 13045 and determined it is not a covered regulatory action. This rule is not an economically significant rule and would not create an environmental risk to health or risk to safety that might disproportionately affect children.

L. E.O. 13211 (Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use)

DHS has analyzed this rule under E.O. 13211 and has determined that it is not a “significant energy action” under that order because although it is a “significant regulatory action” under E.O. 12866, it is not likely to have a significant adverse effect on the supply, distribution, or use of energy, and the Administrator of OMB's Office of Information and Regulatory Affairs has not designated it as a significant energy action.

M. Paperwork Reduction Act

This rule would call for no new collection of information under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501-3520. Any collection of information under this rule will be under existing collections of information concerning Federal hiring and Federal employment.

List of Subjects in 6 CFR Part 158

• Administrative practice and procedure
• Employment
• Government employees
• Reporting and recordkeeping requirements, and Wages

For the reasons discussed in the preamble, DHS adds 6 CFR part 158 as follows:

PART 158—CYBERSECURITY TALENT MANAGEMENT SYSTEM (CTMS)

Authority : 6 U.S.C. 658.

Subpart H also issued under 5 U.S.C. Chapters 41 and 43; 5 CFR parts 410 and 430.

Subpart A—General Provisions

Subpart B—DHS Cybersecurity Service

Subpart C—Leadership

Subpart D—Strategic Talent Planning

Subpart E—Acquiring Talent

Talent Acquisition System

Subpart F—Compensating Talent

Compensation System

Subpart G—Deploying Talent

Subpart H—Developing Talent

Authority: 5 U.S.C. Chapters 41 and 43; 5 CFR parts 410 and 430.

Subpart I—Employee Rights, Requirements, and Input

Subpart J—Advisory Appointments