Guidance for Federal Cybersecurity Rotational Assignments

Memorandum For: Heads of Executive Departments and Agencies November 18, 2020 From: Michael J. Rigas Acting Director U.S. Office of Personnel Management Subject: Guidance for Federal Cybersecurity Rotational Assignments

The U.S. Office of Personnel Management (OPM) provides expertise and guidance to Federal agencies as they build, develop, and sustain a strong Federal cybersecurity workforce. The continued effort to enhance the skills of the Federal cybersecurity workforce is of national importance. This workforce protects data, systems, and operations vital to serving the American public, and defends our nation to manage cybersecurity risks that impact the Federal Government’s missions and the common good. Federal leaders have a key role in ensuring the Federal Government has highly-skilled cybersecurity practitioners to protect and defend our information technology and networks. In addition to hiring the right talent and training employees, Federal agencies should utilize rotational and developmental programs to build and continue to mature the capabilities of a pipeline of cybersecurity talent and leaders. A rotational assignment can be a temporary developmental assignment within the employee’s agency, another component of the agency, or in another Federal agency that provides the employee the opportunity to learn and grow. During rotational assignments, individuals can develop knowledge, skills, and abilities and learn to adapt in a new role. Such rotational programs can be a benefit to the employee in that they are given opportunities to learn new skills and abilities. Moreover, loaning agencies themselves benefit from the new skills and perspective the employee develops. Cybersecurity rotations support organizational objectives with cybersecurity education, training, workforce development, and retention. Furthermore, they provide an opportunity for Federal employees to be reskilled and upskilled. As required by 5 U.S.C. § 4103 and 5 CFR Part 410, Federal agencies are required to establish, operate and maintain a program for the training of its employees. As authorized by 5 U.S.C. §

4103, two or more agencies jointly may operate a training program. Pursuant to 5 CFR 410.203, training programs may include rotational/detail assignment components.1 Three Federal rotational programs that include Cybersecurity assignments are: 1) The President’s Management Council (PMC) Interagency Program is coordinated by OPM and includes a Cyber Track. The PMC Interagency Program enables emerging Federal leaders to expand their leadership competencies, broaden their organizational experiences, and foster networks they can leverage in the future. 2) The Cybersecurity Reskilling Detail Program provides detail assignments (from between 9 to 12 months depending on other training) that enable Federal employees to expand their cyber competencies, knowledge, skills and abilities; broaden their organizational experiences; and foster networks they can leverage in the future. This reskilling effort is part of the Administration’s commitment to develop a Federal workforce of the 21st Century, as outlined in the President’s Management Agenda and the recent Government Reform Plan. 3) The Federal Cybersecurity Rotation Program (FCRP) contains two different types of rotations: (1) personnel rotating to the U.S. Department of Homeland Security (DHS) to improve their expertise and (2) DHS cybersecurity practitioners or cybersecurity subject matter experts (SMEs) rotating to other agencies. The FCRP aims to increase the integration of the cybersecurity workforce across the Federal Government by giving cybersecurity practitioners on-the-job developmental experience specific to their skills gap, with continuous learning and on-the-job training. Cybersecurity practitioners at all levels, from entry level to senior executives, will benefit from Federal agencies offering more frequent opportunities for rotational assignments, both internally and externally. These developmental assignments allow cybersecurity practitioners to learn new skills through hands on experience and provides the individuals with a more comprehensive understanding of the complexity and depth of cybersecurity work across the Federal Government.

A detail is “the temporary assignment of an employee to a different position for a specified period, with the employee returning to regular duties at the end of the detail.” 64 Comp. Gen. 370, 376 (1985). Generally speaking, absent specific statutory authority, the authority for the rotational/detail assignment will depend on whether the detail assignment is within a department (see 5 U.S.C. § 3341) or between Federal agencies (see 31 U.S.C. § 1535). Detail assignments between Federal agencies are usually Economy Act transactions. The Economy Act generally requires reimbursement for the detail unless an exception applies. For example, reimbursement is not required for a detail assignment that involves a matter that is similar or related to matters ordinarily handled by the loaning agency and will aid the loaning agency in accomplishing a purpose for which its appropriations are provided. Employee training can fall within this exception. 13 Op. O.L.C. 188 (1989). Pursuant to 5 U.S.C. § 4109 and 5 CFR 410.401, agency heads have the authority to determine what constitutes a necessary training expense under section 4109, which can include the cost of the employee’s salary while on a detail/rotation to obtain necessary training. 1 Prior to developing any rotational program, agencies are encouraged to contact their Chief Human Capital Office and follow any internal agency procedures. To support agencies as they design, develop and implement rotational programs, OPM is issuing the following guidance. General Guidance for Rotational Assignments between Federal Agencies • Rotational assignments should be handled in the same manner as other interagency details or assignments. •

Rotational assignments can be reimbursable or non-reimbursable, provided all necessary criteria have been met. • Rotational assignments are typically for periods of up to 120 days and the assignments may be extended in 120-day increments. • Participants must meet all qualifications of the detail to apply. • While participating in rotational assignments, the employee’s position of record does not change. At the end of the rotational assignment, the employee returns to his or her original position at the home agency. The agency may identify ways to leverage the employee’s new skills and knowledge. Guidance on documenting Details through an SF-52 Request for Personnel Action is available in Chapter 14 of the Guide to Processing Personnel Actions. The loaning and gaining agencies should execute a Memorandum of Understanding (MOU) to document the terms of the detail assignment. See Appendix 1 for a sample MOU. • Rotational assignments for employees coming from an excepted service position into a competitive service position will require OPM approval, pursuant to 5 CFR 300.301. See Appendix 2 for a request template. •

If there is a host agency requirement for a specific type/level of security clearance, the rotational assignment agreement will typically be contingent upon the participant’s successful adjudication and receipt of the necessary security clearance. (Note: There are processes available that may enable individuals to begin working while investigations are being conducted. Reciprocity policies to support the movement of cleared individuals from one job to another are available. See Executive Order 13467, as amended, reprinted at 50 U.S.C.A. 3161 note, for exceptions and details. See also Security Executive Agent Directive 7 at https://www.odni.gov/files/NCSC/documents/Regulations/SEAD7_BI_ReciprocityU.pdf, which provides additional guidance.)

Responsibilities: The Home Agency supervisor will— 1. Provide the Host agency supervisor with a copy of the participant’s current Performance Plan and the professional growth objectives for the detail to align expectations and assignments during the rotation with the participant’s elements and standards in the employee’s annual performance plan. 2. Incorporate the rotation as part of the participant’s Individual Development Plan (IDP); actively engage with the participant during the rotation; and proactively seek performance input from the host supervisor. 3. Be clear with the participant about how his or her performance during the rotation will be factored into his or her annual evaluation (how the rotational accomplishments will be assessed in terms of the performance elements or standards in the employee’s annual performance plan). 4. Be available to participant and continue to maintain all records. Ensure that any annual training requirements are met by the participant while on detail. 5. Support the participant’s transition back to the home agency. The Host Agency supervisor will— 1. Provide the home agency with a performance assessment for the employee’s work during the rotation. 2. Work with the home agency supervisor to determine how information on performance during the rotation will be captured and communicated to the home supervisor. 3. Craft meaningful developmental assignments, tasks, and duties based on the specific developmental goals identified by the participant and the home supervisor; and evaluate progress throughout the term of the rotational assignment. 4. Engage the participant by having frequent touch-point discussions (i.e., brief but regular and meaningful communications to discuss priorities and needs). Provide coaching and development opportunities to help the participant succeed and flourish. 5. Provide valid, regular, and timely data to the participant for feedback on performance progress, including varied perspectives from multiple stakeholders where appropriate.

The Participant will— 1. Work with the home supervisor to ensure the annual performance plan includes rotation goals. 2. Work with the host supervisor to develop a plan to maintain contact with the home organization (i.e., keep home supervisor informed of progress). 3. Work with the host supervisor to understand the expectations of the rotational assignment, and how the assignment is aligned to agency goals. 4. Complete the rotation goals and/or professional growth objectives identified in the performance plan and/or IDP. 5. Alert the home agency supervisor if problems/issues occur. 6. Provide a self-assessment, if required by the home agency program, capturing experience and results attained during the rotation. Agencies are strongly encouraged to use the attached MOU (Appendix 1) which outlines the roles of the home agency, host agency, and participant. Closing/Points of Contact: Thank you for your continued effort to build and sustain a strong Federal cybersecurity workforce. If there are any questions about developing and implementing a Federal Rotational Program, please contact Alba Nunez at (202) 606-1805 or Alba.Nunez@opm.gov. Attachment: Appendix 1: Sample MOU for Federal Rotational Assignments (see 508-conformant PDF below) Appendix 2: Request to Detail between an Excepted Service Position and a Competitive Service Position (see 508-conformant PDF below)