Preparing the Pipeline: Examining the State of America’s Cyber Workforce

Chairman Mark Green (R-TN)SPEAKER_16

will come to order. Without objection, the chair may declare the committee in recess at any point. The purpose of this hearing is to examine the severity of America's cyber workforce gap and assess how the shortage of skilled cyber professionals leaves our homeland vulnerable to evolving global threats in cyberspace. Specifically, we'll delve into the challenges that the public and private sectors face in recruiting, training, and retaining skilled cyber talent. We will also discuss possible solutions to mitigate this shortfall. I now recognize myself for an opening statement. Good morning, everyone. Today, we're focused on the top cyber challenge we face, and that is the cyber workforce gap. This issue has been a top priority for me and other members of this committee since last Congress, and I know it is for many of you in this room as well. There isn't a city or a state in this country not affected by this cyber workforce gap. Currently, our nation lacks about 500,000 cyber professionals. That's a deficit of 1 million eyes, and this means that many of our networks and critical infrastructure are going unwatched, even while malicious nation-state actors like Volt and Salt Typhoon target them daily. At a time when we need to go on the offensive, we can barely play defense. We simply don't have enough people in the right jobs with the right skills to stay on top of the significant cyber challenges our homeland faces. We covered many of those threats in our first committee hearing two weeks ago, and you can get a glimpse of the magnitude of these threats yourself. We captured them in the committee's Cyber Threat Snapshot. You can see a little bit of that here. Whether we're dealing with China, Russia, North Korea, Iran, or criminal actors, one thing is clear: our vulnerabilities span from our heartland's hardware to our cities' software. Sometimes we're dealing with targeted attacks like ransomware, and sometimes our vulnerabilities stem from poor cyber hygiene or economic models that do not prioritize cybersecurity. But whatever the case, we need to do better, and we need to do better now. Our nation's security and prosperity depend upon a resilient cyber posture, something we can only be— that can only be assured by adequately preparing our pipeline of cyber professionals. Over the years, there've been many initiatives to address the cyber workforce gap. Our witnesses here today have been at the forefront of some of those efforts. We applaud those efforts and hope they'll continue. However, it's clear we need a new— it's clear we need a new but complementary approach, one that brings together the public and private sectors to fill gaps at all levels of government and industry, one that creates quick pathways for individuals who want to pivot in their careers without having to complete a four-year degree, one that provides hands-on experiences for cyber professionals in training and then supports them throughout their careers, one that cultivates a sense of community and service to the country like the ROTC program, one that's accessible to all Americans, and one that will finally change the decades-long narrative around the cyber workforce gap. I leave— I believe that bill is my my bill, the Cyber PIVOT Act. It directly addresses all of these issues in a meaningful way, and that's why I reintroduced my bill today alongside Representatives Guest, Gimenez, Higgins, Strong, Biggs, Evans, Molinaro, Ezell, and Rogers. We've received significant support for the bill, including the American Association of Community Colleges, and I want to thank our stakeholders and would like to submit the following statements for the record: Advocacy Blueprints, Business Software Alliance, Cyber Innovation Center and their academic initiative CYBER.ORG, Darktrace, Forescout Technologies, Foundation for Defense of Democracies, Information Technology Industry Council, the Internet Security Alliance, (ISC)², Ivanti, the McCrary Institute, Microsoft, National Rural Electric Cooperative Association, Palo Alto Networks, Peraton, the R Street Institute, SentinelOne, Special Competitive Studies, the U.S. Chamber of Commerce. Without objection, so ordered. It's time to sign the Cyber PIVOT Act into law, and I look forward to working across the aisle to ensure that we can do so in a bipartisan manner. Last year, we held a full committee hearing on the cybersecurity workforce gap with government witnesses. Today, we will examine the the perspective of the private sector. Thank you to our expert panel for joining us. Your diverse experiences in academia, critical infrastructure, cybersecurity, and nonprofits will give us a holistic understanding of the complexities we face in bolstering our cyber workforce and the strategies we must consider for reducing the workforce gap once and for all. I look forward to this very important discussion. I now recognize the gentleman from Mississippi, our ranking member, Mr. Thompson, for his opening statement.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Thank you. Thank you very much, Mr. Chairman. Good morning. I'd like to thank our witnesses for agreeing to testify today. I appreciate your expertise, and your input is valuable to the committee's work on cyber workforce policy. Just over two weeks ago, President Trump was sworn into office. Nearly every day since then, there's been a White House directive undermining the federal government's ability to serve the American people. There is confusion about which federal grant funds President Trump froze last week and whether the funds are still frozen. The administration refuses to give Americans a straight answer about that. Disaster victims recovering from hurricanes in North Carolina and Florida and wildfires in California are wondering whether FEMA will still be standing after the president made clear he'd like to shut down the agency. And now an unelected billionaire from South Carolina South Africa, Trump's co-president Elon Musk, has gotten into federal networks and is accessing Americans' sensitive personal data. God only knows what he's doing with Americans' data or what he plans— his plans are for our information. He's inside the Treasury Department's system, where he's not only accessing information, but has the ability to change it. These systems have Americans' Social Security numbers and payment information. Trump gave Musk control of our nation's checkbook, of a bank account funded by America's hard-earned tax dollars. We don't know what he's doing with any of it. His DOGE team also allegedly bought a commercial server, set it up in the Office of Personnel Management, and began accessing intimate details about Americans' personal lives, from home addresses to medical histories. Musk is demanding access to information systems across the federal government to collect even more data about millions of Americans for reasons that are yet unclear. These actions violate a host of federal laws and policies intended to ensure data privacy and security and protect federal networks, leading one security expert to describe DOGE's access to federal data as an absolute nightmare. Nevertheless, neither the White House nor my Republican colleagues in Congress have shown any inclination to force Elon Musk and his DOGE underlings to follow the law, adhere to security practices, or justify their unprecedented access to government systems and Americans' data access to government. It is not clear who is, in fact, running the country because it seems the president is either unable or unwilling to control Musk. Either way, Americans will be paying the price. To be honest, Mr. Chairman, it's also not clear why the committee would hold a hearing on cyber workforce at this time. Make no mistake, addressing cyber workforce challenges is a critical security priority, but holding a hearing on cyber workforce while letting Elon Musk root around in government systems is like worrying someone might break in through the back door of your home while swinging the front door wide open. I'm afraid the committee is failing to address this urgent security issue, and our adversaries like China, Russia, and Iran are watching the administration do nothing. Having said that, I'd be remiss if I did not point out that one of the biggest obstacles to growing a robust cyber workforce are the Trump-Musk policies. As I speak, the federal workforce is in a tailspin. All of us are hearing from federal employees not knowing should they stay, should they go. There's no policies that's been outlined as to why I'm receiving this email telling me that I'm somehow not useful or valued, and I can understand where CISA and other agencies fall in this tailspin. President Trump's nominee to head the Office of Management and Budget has said, and I quote, "We want the bureaucrats to be traumatically affected. When they wake up in the morning, we want them to not want to go to work because they are increasingly viewed as villains. We want to put them in trauma." Hiring freezes are delaying the onboarding and recruitment of top cyber talent. Secretary Noem, with little explanation, has said she wants to shrink CISA. Deferred resignations offer the administration has no authority to issue, accompanied by insults about productivity and warnings of layoffs, send a clear message that the administration does not value its workforce. It is not loyal to it and does not prioritize developing expertise within government. In short, the workforce is expendable. Moreover, the president is openly hostile to a diverse workforce that reflects the American people. In just two weeks, he's directed federal departments and agencies to strip references to diversity from their websites and blamed diversity for a national tragedy. Mr. Chairman, I appreciate your commitment to addressing the cyber workforce challenge by expanding scholarships for service for community college, but under these circumstances, who would want to commit to working for the government? Until the administration begins to treat its workforce with more respect and turn the page on its cruel and dismissive attitude toward diversity, I cannot support new efforts to tie tuition assistance to employment with the federal government or to an employer the administration must approve. Despite the president— despite what the president might think, cyber jobs are Black jobs, Asian jobs, Hispanic jobs, and jobs for women. I wish I were more hopeful that the committee will work to correct course on the Trump-Musk policies that are causing chaos and undermining security. Toward that end, today I will introduce two resolutions of inquiry to ensure that the committee has the information necessary to evaluate whether Donald Trump and Elon Musk have adequately considered the security implications of their terrible policies. The first resolution of inquiry directs the Secretary to provide the committee documents related to security assessments associated with efforts to freeze payment of critical homeland security programs that, among other things, support cyber workforce training and cybersecurity efforts at the state and local level. The second resolution of inquiry directs the Secretary to provide the committee documents related to the impact of the hiring freeze on the cyber workforce, as well as any of the security policies related to providing DOGE access to DHS information systems and data. Additionally, today, committee Democrats are sending a letter to OPM requesting information about the impact of President Trump's hiring freeze and deferred resignation offers on the cyber workforce, and a letter to OMB raising our grave concerns about Elon Musk's unfettered access to federal networks and Americans' data. This information is necessary to the committee's oversight obligation, and Democrats will not stand by while the Trump-Musk administration rips off the American people. With that, I again thank the witnesses for participating in today's hearing, and I yield back the balance of my time.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. Other members of the committee are reminded that opening statements may be submitted for the record. I am pleased to have a distinguished panel of witnesses before us today, and I ask that our witnesses please rise and raise their right hand. Do you solemnly swear that the testimony you will give before the Committee on Homeland Security of the United States House of Representatives will be the truth, the whole truth, and nothing but the truth, so help you God? Let the record reflect that the witnesses have answered in the affirmative. Thank you. You may be seated. I'd now like to formally introduce our witnesses. Dr. David Russomanno currently serves as Executive Vice President for Academic Affairs and is the Provost at the University of Memphis. Prior to his current role, he served for 13 years as Dean of the Purdue School of Engineering and Technology and as Professor of Electrical and Computer Engineering at the Collaborative Campus of Indiana University and Purdue University. Throughout his career, Dr. Russomanno has spearheaded the growth of numerous initiatives to improve the recruitment, retention, and overall success of STEM students. Mr. Robert Rashotte Mr. Robert Rashotte serves as Vice President of Global Training and Technical Field Enablement at Fortinet, where he is responsible for creating award-winning training and education programs for cybersecurity. He also previously served as the Director of Worldwide Education Services at that organization. Before joining Fortinet, he served as the Director of Global Training and Enablement at Trend Micro, Director of the Canadian Standards Association Learning Institute, and Senior Manager of Training and Certification Programs at Entrust. Mr. Chris Jones. Mr. Jones serves as the President and Chief Executive Officer of Middle Tennessee Electric, As Electric Cooperative, where he an electric cooperative where he spent the past 26 years. Mr. Jones also serves as a board member for United Communications, the Tennessee Electric Cooperative Association, and the Tennessee Chamber. He previously served as chair of the Chamber of Commerce in both Rutherford and Williamson Counties, as an advisory member of the Tennessee Nuclear Energy Advisory Council. Mr. Max Stier. Mr. Stier serves as President and Chief Executive Officer of the Partnership for Public Service. He previously worked in all three branches of government. Prior to his current role, he served as Deputy General Counsel for Litigation at the Department of Housing and Urban Development. Mr. Stier also previously served as a clerk for the U.S. Supreme Court and U.S. Court of Appeals for the Second Circuit. In addition, he previously worked as Special Litigation Counsel at the Department of Justice, and as a staff member in the office of the United States— of a United States representative. I thank the witnesses for being here today, and I now recognize Mr. Russomanno for 5 minutes to summarize his opening statement.

David J. Russomanno, PhDSPEAKER_17

Chairman Green, Ranking Member Thompson, and distinguished members of the committee, thank you for the opportunity to appear before you today. I express my gratitude to Chairman Green for your overall leadership on cybersecurity workforce and for introducing the Cyber PIVOT Act. My name is David Russomanno. I'm a computer engineer by training and have the privilege of serving as provost at the University of Memphis. The University of Memphis is a Carnegie R1 university, which is a designation meaning we are a high-performing, comprehensive research university. I have devoted a significant portion of my career as an engineering professor, department chair, and dean of engineering and technology to advance STEM education focused on initiatives to grow the student pipeline and produce successful student outcomes aligned with workforce needs. For example, I have served as principal or co-principal investigator on National Science Foundation-administered Scholarships for STEM and CyberCorps Scholarship for Service projects. Rightly so, prior testimony to this committee has focused on cyber threats to our nation presented by a variety of threat actors. A parallel threat is the loss of human intellectual capital that could be marshaled toward strengthening our cybersecurity workforce. The Cyber PIVOT Act is an important contribution toward mitigating these threats by expanding support for students, including those pursuing education and training at 2-year community colleges and technical schools. To my knowledge, these institutions are currently only eligible as subawardees of the partnering 4-year CyberCorps institutions. There are significant challenges to forming comprehensive cybersecurity readiness, including data that shows many colleges are struggling to align education with workforce needs. For example, a recent American Society for Engineering Education publication referenced a Forbes article by Perna, in which he states, quote, "Historically, institutions of higher learning have been slow to pivot their offerings to meet current workforce needs. The inertia is real," end quote. The article also cites a survey in which 85% of recent college graduate respondents state, quote, "I wish my college had better prepared me for the workplace," end quote. In high-demand areas, most notably and critically in cybersecurity, the private sector may prefer to recruit experienced employees from other companies, rather than creating entry-level positions and hiring new graduates of postsecondary institutions. Such an approach alone contributes to an unsustainable race for talent, rather than developing highly collaborative partnerships with educational institutions and the public sector to grow the talent pipeline at scale and in a sustainable manner. A race for talent scenario may also have unintended consequence of presenting significant barriers to entry to the cybersecurity profession. A service commitment proportional to student sponsorship, as incorporated into CyberCorps and the PIVOT Act, serves as an important model for the private sector. The federal government is encouraged to incentivize such a private sector service commitment, especially given the dependence of the U.S., including the U.S. military, on private sector infrastructure maintained with insufficient levels of cyber resilience, as noted by Rear Admiral Montgomery in his recent testimony to this committee. When private companies invest in collaborative education programs, they help the skills gap, easing the financial burden on taxpayers. Consideration of the Cyber PIVOT Act also highlights the urgency for 4-year institutions, including comprehensive R1 institutions, to develop and align a portion of their STEM baccalaureate degree portfolio to facilitate smooth pathways from applied technology programs. Per a report from the Education Commission of the States, 31 states have policies for transferring lower-division core courses and a statewide guaranteed transfer of an associate degree. However, in many instances, these articulations may exclude or not optimally articulate courses, knowledge, and skills acquired through applied technology programs, creating a barrier to baccalaureate degree completion, which is a focus of the polytechnic initiative at the University of Memphis and is described in my written remarks. Thank you again for the opportunity to have this conversation today.

Chairman Mark Green (R-TN)SPEAKER_16

Thank you, Dr. Russomanno. And I now recognize Mr. Rashotte. Am I pronouncing your name correctly? Perfect. For 5 minutes to summarize his opening statement.

Mr. Robert RashotteSPEAKER_06

Chairman Green, Ranking Member Thompson, and distinguished members of the committee, my name is Rob Rashotte and I serve as Vice President of Fortinet's Training Institute. I've spent my career focusing on empowering others with the skills to successfully enter and advance within the cybersecurity workforce. I appreciate the opportunity to testify before you today on the state of America's cyber workforce. Fortinet is a U.S. company that is one of the largest cybersecurity companies in the world. While we manufacture over half of the firewalls sold worldwide, our portfolio extends across nearly 60 different integrated cybersecurity and networking solutions. This reflects our commitment to innovation as cyber threats continue to evolve. In addition, to Fortinet's— in addition Fortinet operates an award-winning training institute focusing on making cybersecurity training available to everyone. We believe teamwork across the public and private sector is critical to ensure strong national cyber resilience. A robust and skilled workforce is foundational to this resilience, making today's discussion both about jobs and our national security. The demand for cybersecurity professionals continues to outpace supply, with over 500,000 unfilled positions in the U.S. We annually conduct a skills gap survey, surveying IT and cybersecurity decision-makers, with our findings compiled into an annual cybersecurity skills gap report. Our latest research found that 75% of U.S. organizations believe that the workforce gap is escalating cyber threats, and nearly 90% have experienced a breach they attribute in part to lack of cyber skills. While companies are working to recruit and retain talent, more than half struggle to find qualified professionals. The cybersecurity workforce gap has been exacerbated by several interconnected challenges, the most significant challenge being the persistent reliance on traditional four-year degrees as a primary requirement for most roles. We've observed a growing number of technical schools, colleges, and universities launching two-year degree programs that effectively prepare students for a range of cybersecurity roles. Waiting until high school or college, however, to influence career decisions is often too late. Just as kids talk to their parents about becoming doctors or firefighters, we need to ensure that cyber threat hunter, for example, becomes part of that conversation. To help create that spark, Fortinet has developed cybersecurity awareness training for K-12 schools nationwide and has made it available at no cost. The curricula introduces cybersecurity concepts as early as kindergarten. Today, the program operates in 43 states. By engaging students, teachers, and parents, we're sparking interest in cybersecurity careers early. We must also do more to attract existing, underutilized talent pools. A key example is military veterans moving into civilian roles. Many veterans possess highly relevant skills that are invaluable to cybersecurity. Our veteran partner organizations, though, often note that their members lack awareness or the confidence in how their military experience translates into cybersecurity careers. We must unlock this wealth of talent that is both capable and well-suited for the field. We must also focus on reskilling and upskilling. Cyber professionals often face high stress and burnout, and many organizations lack clear career progression paths. Strengthening training, mentorship, and career mobility will help grow a sustainable workforce. Industry, academia, and government are making progress, but we must scale our efforts. If enforced, the proposed Cyber PIVOT Act would have a positive impact across both the public and private sector with its emphasis on cybersecurity scholarships for students in partnership with technical schools, colleges, and universities, as well as developing internships and federal job opportunities for graduates. In conclusion, I'm confident that with the right tools, incentives, and partnerships, we can ensure the cyber workforce pipeline is strengthened and that today's workforce gap becomes yesterday's issue. To achieve this, we need bold, consistent action that can scale, ranging from early training of our children on cyber awareness through to technical career training and efforts like the PIVOT Act. Thank you for the opportunity to be part of today's discussion, and I look forward to your questions.

Chairman Mark Green (R-TN)SPEAKER_16

Thank you, Mr. Rashotte. I now recognize Mr. Jones for 5 minutes to summarize his opening statement.

Mr. Chris JonesSPEAKER_10

Chairman Green, Ranking Member Thompson, and distinguished members of this committee, thank you for the opportunity to testify before you today. My name is Chris Jones, and I serve as president and CEO of Middle Tennessee Electric. I am testifying to provide my perspective as an electric co-op leader, but also to represent the National Rural Electric Cooperative Association and the 900 electric cooperatives across the country. In all these respects, it is quite an honor to be before you today. MTE is the largest electric cooperative in the TVA region and the second largest in the United States, serving more than 750,000 Tennesseans. Our service territory includes 15,000 miles of distribution lines across 11 Middle Tennessee counties. NRECA is the national trade association representing 900 electric cooperatives. Electric co-ops are not-for-profit electric providers and are focused on delivering affordable, reliable, and secure electricity to more than 42 million Americans in 48 states. We are unique in the electric sector in that we operate without profit incentives and are owned and governed by the very people we serve. Electric co-ops were created with a mission to address the distinct challenges associated with providing electric service to rural communities, which typically have lower population densities, are more residential, and less affluent than the industry average. This means cooperatives are constantly asked to do more with less, and they deliver. Electric co-ops are owners and operators of some of the nation's most critical infrastructure, including providing power to more than 150 military facilities and installations in the United States. We also serve as economic drivers and lifelines for critical industries and services in our communities like hospitals, schools, emergency services, energy, and food and agricultural production. Protecting America's electric grid from cyber and physical threats is a top priority for our electric co-ops and the communities they serve. Accomplishing this important task as at-cost entities presents its own set of challenges. The same circumstances that made it difficult to invest in electrifying rural America nearly 100 years ago, including being isolated from larger customer bases and diverse talent pools available in urban areas, persist in some places today. I address these issues in more detail in my written testimony, but electric cooperatives struggle for cyber professionals against more competitive salaries and benefits offered by larger urban-based firms. It is also often difficult to attract skilled talent to rural areas because of a perceived lack of professional development or career progression opportunities. However, electric co-ops are identifying innovative ways to overcome these obstacles through partnerships and smart investments. I would be remiss if I did not take this opportunity to thank Chairman Green for his leadership with the Cyber PIVOTT Act to help tackle some of these issues. Electric cooperatives were pleased with the inclusion of language that would extend cybersecurity internship opportunities to critical infrastructure in rural communities. Creating a talent pipeline that includes pathways into rural areas will foster a local, skilled cybersecurity workforce to safeguard critical infrastructure in these regions. We have a saying that if you have met one electric co-op, then you have met exactly one electric co-op. We come in all different shapes and sizes, but many of our challenges share similar themes. MTE is fortunate to not have to wrestle with some of the more intense challenges of the rural cybersecurity workforce issue. However, with my 26 years working for the cooperative, I have seen the lengths MTE has had to go to, to tackle those issues and can share many challenges that are impacting other co-ops across the broader community. Thank you for this opportunity, and I hope to be helpful, and I look forward to responding to any questions.

Chairman Mark Green (R-TN)SPEAKER_16

Thank you, Mr. Jones, for your testimony. And Mr. Stier is now recognized for his five minutes of opening statement.

Mr Max StierSPEAKER_22

Thank you very much, Chairman Green, Ranking Member Thompson, and all the members of the committee, especially for the extraordinary way that you have operated as a committee, bipartisan, focusing on this issue over the long term and being extraordinarily thoughtful. It is, unfortunately, I think, a little unusual and deeply appreciated on such a fundamental issue. We know that it's important when we're thinking about cyber to be focused on the whole picture. That includes obviously the private sector as well as the public sector. My focus will be on the public sector. I think one important difference in today's world is that our government is no longer the market maker. It's a market participant. And so that relationship between the private sector and the public sector has changed, and it's fundamental to think about what that interrelationship actually needs to be. In the public sector, we have made progress, but the truth of the matter is the gaps remain. It's extraordinary that GAO in 1997 identified information security as an item on their high-risk list. It's still there. Human capital issues since 2001. I think this committee should be asking the question, we're making progress, but what more do we really need to do to change the circumstances? Because the incremental change we're seeing so far, frankly, isn't good enough. I'm going to offer three categories of opportunities for improvement, beginning with reforming the broader system. And we often in the federal government operate way too much in the vertical. When you're thinking about something like cyber, it should be a holistic approach. We need to be looking at, frankly, strategic human capital management across the board, looking at it as one government and integrating the efforts so we have information from all agencies. We know there's a 2,000-person gap in the cyber workforce at DHS, but frankly, we don't really know what the full picture is. So understanding it from a comprehensive view is fundamental here. Secondly, we need to focus on implementation of things you've already done, in particular, the bipartisan Chance to Compete Act. The notion that we should be focused on skills-based hiring is a fundamental one, especially in the cyber area. Getting that implemented effectively so it actually is making a real difference is going to take work, oversight, and continued follow-up from this committee. And third, very important, we need to look at the pay system. It's nuts. We have a pay system in the federal government that was designed in 1949, and that's basically how we pay federal employees. That is when the federal workforce was almost exclusively clerical, and now it's professional. The world has changed. Our government has not kept up, and frankly, we need to change that, and the pay system is a very, very prominent place in which that needs to be done. Secondly, we need to go for big swings. And partly I mentioned earlier about strategic human capital and doing that holistically. We need to see cyber more broadly managed as a government-wide asset, not agency by agency. There's enormous efficiencies that can be generated by that. We need to improve the entry pipeline. Mr. Chairman, the PIVOT Act, I think, is fundamental. You forgot one thing when you mentioned the different agencies or organizations that were endorsing your legislation: please include the Partnership for Public Service going forward. We've been supporting this notion, in essence, of an ROTC-like program for decades. It is such smart things. We shouldn't build separate institutions; we should use the institutions that already exist. And third, we need to look at development of mid-career and senior talent. And on that front, one of the things we need to think about with the public sector workforce is more exchanges between the public sector and the private sector. There's too much insulation between those. And frankly, it's not only the knowledge that needs to be shared, but they need to understand how the different entities work. And you do that by working in different entities. So having more flow of talent, I think, is going to be fundamental. The third piece that I'm going to flag here, and this is the one that I think is going to be the most challenging, and that is just bluntly, we need to stop the harm that is taking place right now. Truly, real damage being done to the federal workforce, specifically the cyber workforce. And the list is long in terms of the hiring freeze, the push for people to resign, the collection of information about probationary employees. And the best way I can capture this is to read two paragraphs of an email that I received last night from a student in the CyberCorps Scholarship Program. She writes, The CyberCorps Scholarship for Service Program provides educational funding for students in cybersecurity exchange for working in the federal government after graduation. This scholarship has been vital to my career and academic journey. Without the funding, I would have been unable to attend graduate school, and I was thrilled by the opportunity to work in public service upon graduation. It has been a goal of mine for some time to join the federal workforce, and this program seemed like the perfect opportunity. In recent weeks, I've had job offers rescinded and opportunities paused until the hiring freeze is over. The executive actions have led to significant uncertainties for me and my CyberCorps classmates, students who face tremendous pressure to find a government job or risk owing the government over $170,000. I urge you to speak with the panel about the importance of ensuring the hiring freeze national security exemptions apply to all cybersecurity jobs in the U.S. government." Getting this, I felt an obligation to share it. Thank you so much, and look forward to the conversation.

Chairman Mark Green (R-TN)SPEAKER_16

Thank you, Mr. Stier. And members will be recognized by order of seniority for their five minutes of questioning. I want to remind everyone to please keep their questioning to five minutes. An additional round of questionings may be called after all members have been recognized. I'll not— I now recognize myself for five minutes of questioning. First, I want to thank the witnesses for their support of the PIVOT Act. I do think obviously it's the right way to go about solving this issue, and having served in the military and seen how the ROTC program not only benefits the military, but then serves the nation as those individuals get a college degree and expertise, and then they leave the force and go out and serve the country working for companies and government offices elsewhere, that it it really— I think whoever created that, it's the legacy for the nation. The GI Bill is an excellent example. Men, women came home from military service and left the military and had a degree paid for and then went on to serve the country. So, thank you, all of you, for your kind words about that. Obviously, this 500,000, and I've heard numbers ranging from 500,000 to 700,000, so the— but it's a it's a really big number. It's our greatest cybersecurity threat, without a doubt. When we look at the issues that create the risk, this is our number one risk. If we don't have the right people in the right place defending our networks, we're we're going to lose. Let me ask really a question for all of the witnesses. How has this cyber workforce gap affected your organizations? And if we had a broader or more prepared workforce, how would that impact your ability to do your job? So, how has the deficit hit you, and if we didn't have this deficit, how would that hit impact you? And we'll start with you, Dr. Russomanno.

David J. Russomanno, PhDSPEAKER_17

Well, thank you, and I wish our chief information officer were here to help answer your question, but I do know that we have vulnerabilities within the university. We have very sensitive data, student records, what have you, and so, yes, we do have vulnerabilities. Many of those vulnerabilities are through, quite frankly, human behavior, so the training aspect is critically important. A basic level of cybersecurity competency regardless of your position within an organization is is critically important. A fundamental knowledge, cybersecurity for all, if you will, in terms of basic competencies would go a long way in mitigating a lot of the attacks we see today. So certainly within the university environment, we're doing all we can. I think universities by and large have fared fairly well compared to the private sector in many instances, but there are significant gaps to be addressed, and we would benefit directly from the Cyber PIVOTT Act.

Chairman Mark Green (R-TN)SPEAKER_16

Let me ask Mr. Stier to kind of comment on that question, and then I'm going to—because I only have a few minutes. But if you could say, what is the impact to you know, not not your organization, but businesses from your perspective?

Mr Max StierSPEAKER_22

Look, I think the impact is profound, and we know that there are breaches that are going on. There are national security issues that are very hard to quantify in terms of the harm we're talking about because we have enemies abroad who are collecting information about our country, and it puts us at risk in the most fundamental way. So, you know, look, the reality obviously is that we've moved away from a world in which we do everything physically to a world in which we do almost everything digitally. And we haven't kept up with that transformation of our, of our world activity with the workforce that can manage that different threat. I think the point that was just made earlier, that it isn't just the cyber workforce, it's the entire workforce that needs to be sophisticated enough to be able to— especially the leaders. I mean, this is one of the things that we see in government writ large, which is even if you have technical expertise, if the leaders aren't sufficiently literate, The reality is they don't even know what they should be asking for or how to deploy resources effectively. So investing in leadership literacy on cyber and other things, especially now AI, we think is fundamental.

Chairman Mark Green (R-TN)SPEAKER_16

Let me ask the other 2 witnesses that are here, when it comes to recruiting people to come do cyber training and be cyber, you know, experts, what is the biggest hurdle to recruitment of those students who would then come or employees who would then come and be trained on, on cyber.

Mr. Chris JonesSPEAKER_10

Mr. Chairman, I would say for electric co-ops, what we face primarily is the workforce shortage and then attracting with appropriate salary. Of course, we're talking about a 900 cooperative network, a lot of rural areas that we serve. So we have some natural limitations there relative to someone wanting to come to certain places to work. But certainly the talent pool itself is the primary, primary obstacle.

Chairman Mark Green (R-TN)SPEAKER_16

Well, clearly with a limited supply, the price is going to be high. Yes, sir. Mr. Rashotte,

Mr. Robert RashotteSPEAKER_06

I, I think being a cybersecurity vendor, we're in a different situation. The large majority of employees are cybersecurity professionals within our company, so our, our competitive nature is a little bit different. What we do see though is a lot of our customers and partners are coming to us looking to us as a source for recruitment. And I think what they're starting to see now is it's not just a recruitment issue, but a retention issue. So they're, they're not able to retain that talent through into their more senior roles. So at the top leadership roles, they're starting to become a significant gap because of the retention.

Chairman Mark Green (R-TN)SPEAKER_16

Again, it all comes back to supply and demand, doesn't it? Because that retention, that movement about the industry is because there's all these openings out there and people are paying more. So thank you for that. I yield to the ranking member for his 5 minutes of questioning.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Thank you, Mr. Chairman. I thank our witnesses for your presentation. Clearly, we accept the premise that we are short of people in this space. The chairman talked about 500,000. That is probably a good number, and the retention issue associated with it is a big challenge also. But Mr. Stier, you, you raised some questions on the government side that I think we need to burrow down on. We have for the last 2 weeks been under significant pressure as a government and our employer employees are being told that there's a hiring freeze, you gotta go home. And how does the— I guess the question would be, how does the impact on hiring freezes have on the ability of fellow agencies to do their job? I'll do that first, and now I'll go to the other part.

Mr Max StierSPEAKER_22

Congressman, I think that the answer is very clear. I read you the email from the student in the CyberCorps Scholarship program. The reality, we all have organizations that we're running. Our most important asset are our people. And creating environments that enable them to perform at their very best is essential to our jobs as leaders in our organizations. And when you create an atmosphere, frankly, of fear, you're diminishing your capacity to perform. So, whatever else one might say, it's not the way to run an organization. When we're talking about cybersecurity, which obviously has such a fundamental national security and broad impact on our society, it's dangerous. And so whether it's the hiring freeze or some of the other actions that are taking place, there's plenty of ways to improve our government. We need to actually engage in a massive reform of our government. The things we're seeing right now are taking us the wrong way.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Well, and I appreciate your comment. So even a temporary pause can be disrupted. Can you talk about that temporary pause and delay as it relates to slowing the hiring process?

Mr Max StierSPEAKER_22

Well, look, I think that the reality is many new administrations coming in actually engage in some kind of hiring freeze. So I think to me, it's the broader picture that we need to be looking at right now. We already have a hiring system in the federal government that is not just ridiculously slow, and that's a big problem, but even more important is that it doesn't often identify the best talent or really operate in a strategic fashion. So you don't actually have subject matter experts owning the hiring process. It's often the HR professionals who don't really know what they should even be looking for. So there is fundamental need to reform the hiring process. When you do a hiring freeze, you layer on top of what is already not working well and a whole nother set of problems, not only with those people who are already in the pipeline, but frankly, in your ability to attract people from the outside who are looking at the hiring freeze and saying, how can I go there? There's no opportunity for me there. So it is enormously disruptive. We do need to think about the brand of the federal government as a hiring employer, and it— that needs a lot of work. Because right now it is not presenting itself in a way that is most attractive to the talent that we need in our government to serve us better.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Right now there's one individual who's 19 years old working for DOGE who has access to all our information, employee information. Can you just tell us how do you protect, in your own company, employees' Social Security numbers and other information? We'll start, Dr. Russomanno.

David J. Russomanno, PhDSPEAKER_17

Sure. What you've described is one of the chief responsibilities of our Chief Information Officer. Of course, we have obligations around FERPA and student records, so I know that we do all we can to adopt the latest technology to ensure the the safety and security of our student records. Moreover, as a research R1 university, we do a lot of research, a lot of intellectual capital, intellectual property, and what have you. So once again, our Chief Information Officer and our IT organization, I think they do a stellar job in terms of protecting our assets, given a really very lean organization. So we have been very fortunate, quite frankly, that we have not had significant issues with respect to breaches.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Well, my time is out, but I think you've made my point is just anybody doesn't have access to that kind of information. You have a defined process that's closed and that's it. That's how you protect your employees as well as your organization. Thank you. I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

Gentleman yields. I now recognize the chairman emeritus of the committee, my friend from Texas, Mr. McCaul.

Rep. Michael McCaul (R-TX)SPEAKER_18

Thank you. Thank you, Mr. Chairman. Very important issue. I think STEM education, I know this is not in the jurisdiction of this committee, is also very important. In 2014, the ranking member and I introduced the CyberCorps Scholarship for Service Program. Since that time, we've had $600 million in funding, 5,000 scholarships, 3 to 4 year work requirements. First of all, Dr. Russomanno, I apologize, and Mr. Stier, could you touch on the success of the program and what needs to be done to enhance it? In addition, how will the PIVOT Act complement those efforts?

David J. Russomanno, PhDSPEAKER_17

Well, thank you, Congressman McCaul, for that question. As I said in my opening remarks, I've had the opportunity to be part of CyberCorps at two different universities and have seen the impact. Both universities were urban-serving, serving students from a variety of backgrounds. One of the real strengths of CyberCorps is the internship component, the career fairs. The national career fairs in DC are a wonderful opportunity for students to network, to learn more about the various federal agencies where cybersecurity is, of course, a very important aspect. And so that internship opportunity has really been important. Now, in terms of improving that, I think more distribution of those types of fairs across the nation would be critically important. If you look at urban-serving universities, many times students may be reluctant to leave their immediate geographic area. There could be family dependencies and so on on that first-generation student. So I think having opportunities distributed throughout the nation—many of those jobs are concentrated in the DC area—I believe that would be a great opportunity and maybe working additionally with the private sector with regard to incentives to provide further distribution and penetration across the US. We heard about rural-serving areas as well, so I think that could be an opportunity to further penetrate the great benefits of CyberCorps across our nation.

Rep. Michael McCaul (R-TX)SPEAKER_18

And Mr. Stier?

Mr Max StierSPEAKER_22

Well, first of all, thank you for creating the program. It's done a lot of good, and thank you for looking to how to make it better, because we obviously got to do that always. My thought would be to really think about career pathing. I think one of the real challenges is you may get entry talent coming in, but how do you retain them? Can you create something that might be an add-on to the program that provides a private sector placement so that they're getting both the private sector and the public sector experience with the expectation that they'll take that private sector experience and return to the government as a way of, again, bringing best practices from the private sector into the government? We need to see more of that flow back and forth, as I mentioned earlier, and I think if you think of this as a longer-term pathway, that will be very important. And then the last thing I would say to your back point, I think the PIVOT Act is an improvement. We need to scale. We're talking about such a huge problem. If we don't scale, it's a good thing, but it's not meeting the need.

Rep. Michael McCaul (R-TX)SPEAKER_18

Yeah, i think marking up and passing the PIVOT Act will help, I think, complement the success of the Cyber Corps program. The role of the Guard, I visited my guardsmen at Camp Mabry in Austin, and they have tech jobs in the daytime and they're weekend warriors in the Cyber Command on the weekends. I see that as a great enhancement to our both federal workforce, but also with the the state as well. My governor just created a Texas Cyber Command in San Antonio, where the Air Force has its Cyber Command. And I see that federal-state partnership, really enhancing that, I think, is very helpful when the states get engaged in this and not just relying on the federal government. Do you have any thoughts on that?

David J. Russomanno, PhDSPEAKER_17

Well, I would say once again, CyberCorps and the, and the PIVOT Act with that service component is a great model. The question is, how do other entities adopt that model? And certainly, I think there's ample opportunity at the state and local levels to look at how the CyberCorps project has been successful and in turn, then adopt those best practices in their local areas, as well as the private sector.

Rep. Michael McCaul (R-TX)SPEAKER_18

I think, Mr. Russomanno, you mentioned the role of veterans too. They have a skill set that they may not be aware the private sector or state or federal service could enhance their careers beyond the military. And I think that's an area we need to enhance and look at as well. And then finally, on the exemption issue, I just want to close by saying that it's my understanding that CISA and the DOD are exempted from the executive order. So for your student who may be worried about this, that's good for them to know. Also the national security and public safety exemption to the executive order as well. And with that, I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize Mr. Correa for his 5 minutes of questioning. Good to see

Rep. Lou Correa (D-CA)SPEAKER_23

Thank you very much. May I respectfully have 10 minutes?

Chairman Mark Green (R-TN)SPEAKER_16

Well, you know how I do this, so ask your question.

Rep. Lou Correa (D-CA)SPEAKER_23

7 minutes. You got a deal. Thank you, Mr. Chairman. I want to thank our witnesses for being here today, this most important issue that we've dealt with in Homeland Security for a number of years now. We all read about those big hacking situations, Colonial Pipeline. What we don't read about are those victims, big and small, that actually pay the ransom and continue to remain quiet. You also don't read about folks back home on Main Street, my Main Street, small businesses getting hacked, losing information, not paying the ransom, and getting hit hard: number one, by those people that hacked them, and then number two, with a lawsuit. The loss in economic value is high. Gentlemen, all of you had some great information here today, and my question would be as follows: We're losing personnel. It's hard to recruit individuals to go into the sector, not only because it's STEM, but because of the pay. The private sector will always pay more than the public sector. Yet I look at government, the FBI, the CIA, other government agencies that are active in this area in critical ways. How do they compete with the private sector? How do they recruit to get people to go into those jobs? And I think we've had this discussion here in this committee as well. I think at the end of the day, these young men and women that join the ranks of the public sector are really patriots. They want to do it because they love this country. They want to do it because they want to do the right thing. And right now, we pick up the newspapers, we have an FBI hiring freeze. We have a hunt for FBI agents that were involved in the January 6th investigation. These men were following orders. These individuals, men and women, were doing what they thought was right for this country. So, I'm looking at somebody in college who's maybe looking at going into the FBI for a career. What do they say? What's the motivation here? Just as I was walking over here, picked up a. a report that says CIA offers buyouts to workforce, similar to those proposed to other government agencies, except for those that are in sensitive areas. Well, the rookies coming into the CIA, like FBI, got to learn the business, and cyber is one of those that you don't walk in and say, Aha, I got it. I got a 4-year degree or 2-year technical degree. You have to be there for a number of years. So I'm going to ask each one of you very quickly: How does this hurt our country's recruitment when you have across-the-board federal agencies asking their workers to actually resign or take early buyout offers? Mr. Russomanno, I only have a minute and a half, so if you could be brief.

David J. Russomanno, PhDSPEAKER_17

Thank you, Congressman Correa. Um, I would say, you know, our focus really is on providing opportunities for students. And, you know, um, respect—

Rep. Lou Correa (D-CA)SPEAKER_23

Mr. Jones, how about you?

Mr. Chris JonesSPEAKER_10

Mr. Congressman, I would say that, um, when I think about electric co-ops and the, the opportunities we provide, I would say that, um, there's virtue in service, and that is an attractor that we have. And when we have people that come to work for us, maybe they're not making the most money, but You have

Rep. Lou Correa (D-CA)SPEAKER_23

a steady job,

Mr. Chris JonesSPEAKER_10

you

Rep. Lou Correa (D-CA)SPEAKER_23

know what you're doing for the public, for the community, and that's what it's about. So if you get a buyout offer saying you got to leave, how does that affect your recruiting?

Mr. Chris JonesSPEAKER_10

Well, certainly it would impact it, sir, but as far as all the particulars—

Rep. Lou Correa (D-CA)SPEAKER_23

Mr. Rashotte.

Mr. Robert RashotteSPEAKER_06

I think you're right in that the majority of people that are in cybersecurity roles are doing it because they love it, and creating an environment for those those people to thrive and providing them as much education as we can through free education.

Rep. Lou Correa (D-CA)SPEAKER_23

And uncertainty causes what, Mr. Stier?

Mr Max StierSPEAKER_22

Of course it hurts. There's— it's an obvious proposition. I think that important to focus on that this is a purpose-driven workforce. It is what enables you to recruit people even if you're not going to make as much money. We do need to change the pay scale. It's worth noting as well that a third of federal employees are veterans. And it's because they care. They serve the country in their uniform, and they want to serve their country as civil servants.

Rep. Lou Correa (D-CA)SPEAKER_23

Thank you, Mr. Chairman. I'm out of time.

Chairman Mark Green (R-TN)SPEAKER_16

Gentleman yields. I now recognize the former chairman of the Border Subcommittee, the gentleman from Louisiana, Mr. Higgins, for five minutes of questions.

Rep. Clay Higgins (R-LA)SPEAKER_03

Thank you, Mr. Question. Mr. Chairman, in the last in the last Congress, I posed a question to this committee, and we discussed the nature of the workforce is what we're here to talk about today, and the historical comparisons of workforce participation as a concerning trend, but perhaps offers us an opportunity as it relates to the cyber realm and the and our workforce requirements to to address emerging threats to our country and how can we draw upon the available workforce. We discussed how to prepare and recruit America's cyber workforce, and I remarked upon a documented phenomenon of America's so-called disconnected generation. Just a few stats: the current labor force participation rate among Gen Z, ages 20 to 24, 71%. That's roughly 4% lower than the millennial generation and 6 percentage points lower than the preceding generation when they were in the same age range. And this is to me, my perspective is this is a sweet spot that perhaps in our workforce we should focus on. And specifically, according to a recent study among Gen Z, a staggering 73% of those young Americans report feeling constantly alone. And as it relates to the to the disconnect from the labor force, perhaps there's several factors that contribute to that, but let's talk about the conceptual nature of this field, the cyber field. The cyber battlefield is vast but unseen, and the call to to man our cyber defenses, while critical, it lands differently than, say, a call to serve in uniform or on the front lines in in the traditional historical perspective, like public or military service. So how do we bridge this gap, and how do we access this this vast workforce that is available of young Americans that are not engaged? And I'd I'd like to submit for the record, Mr. Chairman, a RAND Corporation report entitled How to Analyze the Cyber Threat from Drones. I seek unanimous consent to offer, Mr. Chairman.

Chairman Mark Green (R-TN)SPEAKER_16

Without objection.

Rep. Clay Higgins (R-LA)SPEAKER_03

Thank you. This report touches on the things we're discussing and how we can connect our relevant fields, gentlemen, to this workforce. And I ask you, Mr. Russomanno and Mr. Rashotte, how are you adjusting your particular intersections with the cyber realm to make cybersecurity attractive to this generation that's available? Mr. Russomanno.

David J. Russomanno, PhDSPEAKER_17

Thank you, Congressman Higgins, for that question. With respect to Gen Z, I think it's very important to message early on, and glad to hear about these early K-12 initiatives, is how vast the cybersecurity field is. Many times folks think about computer science, engineering, these disciplines that have tremendous prerequisite chains, mathematical foundation, basic science foundation. Those are wonderful programs. Our nation needs those programs to advance the state of the art, but there's ample opportunities to apply the state of the art, and I don't believe we're articulating those opportunities broadly enough to Gen Z. So at the University of Memphis, for example, we have the Polytechnic Initiative that's really looking at expanding our cybersecurity degree portfolio to better align with community college and other training programs.

Rep. Clay Higgins (R-LA)SPEAKER_03

Are you seeing an engagement from your— from these young Americans where they appear there's some heightened awareness of the cybersecurity field and they're attracted to that? Are we recruiting these young Americans through that program?

David J. Russomanno, PhDSPEAKER_17

I believe so. The real challenge is for these students to see themselves in these careers, because oftentimes they may think of the barrier in terms of the mathematical preparation, basic sciences preparation. So really that focus on that applied practice, which I think the PIVOT bill in particular is addressing to expand the workforce to community college and technical school opportunities.

Rep. Clay Higgins (R-LA)SPEAKER_03

And my time has expired, but Mr. Chairman, could Mr. Rashotte briefly respond to the same question? Absolutely. How is he helping the workforce see their way into the cybersecurity realm?

Mr. Robert RashotteSPEAKER_06

I think the public-private partnerships are critical, and from a roles perspective, I think cybersecurity roles can sometimes be quite nebulous. So someone going into education to come in a cybersecurity career, what does that career look like? What is the actual role? So we're taking a lot of emphasis around working with organizations to try to define those roles. What is a SecOps analyst, for example? Working with organizations like NIST with the NICE career paths and trying to map— we've actually mapped our entire catalog of cybersecurity training courses to the NICE pathways to try to make that more well-defined. We're also working with hundreds of academic institutions to integrate our enterprise certifications into academic programs to make it more relevant, more hands-on.

Rep. Clay Higgins (R-LA)SPEAKER_03

Thank you, sir. Thank you, Mr. Chairman, for the indulgence. I yield.

Chairman Mark Green (R-TN)SPEAKER_16

Absolutely. The gentleman yields, and I now recognize the doctor, Congressman Thanedar from Michigan, for his 5 minutes of questioning.

Rep. Shri Thanedar (D-MI)SPEAKER_02

Thank you, Chairman Dr. Green and Ranking Member Thompson. Thank you for having this hearing, and I thank the witnesses to be here and appreciate their expertise and comments. Look, in the first week in office, President Trump illegally fired 17 inspectors general, the independent watchdogs responsible for providing critical oversight, critical oversight of federal agencies. We know that the administration is scared of anyone tracking what they are doing, and this effort is just one part of their effort to avoid any accountability. IGs play a critical role in rooting out waste, fraud, and abuse and help protect employee whistleblowers, and purging them reflects a hope in the Trump administration that nobody will check their abuse of power. Mr. Stier, why are independent inspectors general so important, and what will be the impact of this most recent purge?

Mr Max StierSPEAKER_22

So, the inspectors general are, I think, an innovation in our governance, in our system that came out in 1978 with the response to some of the choices that were made by President Nixon that looked to exceed his presidential authority. Congress acted to create the IGs as a way of making sure that there was eyes and ears inside agencies to address waste, fraud, and abuse issues, as you've described. I'm going to try to bring this back to the cyber issue, if you don't mind, and I would just say that one of the issues that they have focused on has been this question of cybersecurity in agencies. I think it's important in terms of the system that we're talking about here that IGs, while they are political appointees, they're nonpartisan political appointees. They're intended to extend beyond a single term or administration because the intent is to make sure that you have somebody who has the expertise and, frankly, the independence to ensure that you all in Congress are getting the information that you need to be able to do the oversight that is required, as well as the agency leadership as well. So it is disturbing to see wholesale firings of IGs. It's actually something that I think will diminish the capacity of our government to perform well and for you to do your jobs well.

Rep. Shri Thanedar (D-MI)SPEAKER_02

Thank you so much. I want to change the focus a little bit. I want to look at this shortage of technology people. I mean, we currently are under threat for cyberattacks. Many of our agencies, many of our organizations are under attack. While we're talking about long-range plans in terms of academic training and 4-year college programs, weekend programs, but there is this needs to be a two-pronged approach. What are we going to do today, now, to protect our institutions? And then what are we going to do in the future to be able to recruit the people that we need? Now, I ran small technology businesses. Hiring technical, skilled people is always a challenge. And we are always competing internally, not only in the private sector. So we need to be What kind of an employer federal government is, and what recent changes that have been done in terms of the cuts, what does that do to the morale of existing employees, federal employees, and those who want to be into the federal government because of patriotic reasons, because of their love for this country? What are we doing to attract people? And are we a good employer? And are we also looking at the anti-immigrant bias current with the current administration? There's a lot of cybersecurity personnel trained outside of United States, and what are we doing to make sure that we're able to hire them and attract them and compete while Canada and Australia and others are also competing for the same talent? Any thoughts? Maybe, Dr. Russomanno, if you can comment on that?

David J. Russomanno, PhDSPEAKER_17

Sure. No, your point's well taken in terms of the here and now. And, um, you know, some of the things that we're really focusing on is, uh, reaching down to the high schools, you know, creating dual enrollment curricula to provide not only the competencies around cybersecurity but exposure to the career, to get excitement, right, to help build that pipeline in the high schools and, and developing that talent that can then hopefully matriculate to the academic programs, whether they're community college, technical school, or a 4-year institution. So really developing that, that comprehensive pipeline that's not a bumpy road, but a smooth road with roadside assistance. That's what we're focused on.

Rep. Shri Thanedar (D-MI)SPEAKER_02

Thank you so much. And thank you, Chairman, for this extra 38 seconds.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize the gentleman from Texas, Mr. Luttrell, for his—

Rep. Morgan Luttrell (R-TX)SPEAKER_05

Thank you, Mr. Chairman. Mr. Rashotte, does your program— you said that you're across the continental United States. So I come from a very rural district. And there's an appetite, and they're very hungry for everything, if you will. Can you come out and give an educational course at my K through 12 schools? And K through 12 is in one building. Is that something— do I reach out to your organization? How does that work?

Mr. Robert RashotteSPEAKER_06

Yeah, thanks for the question. Absolutely. We've made our entire curriculum, our entire catalog of cybersecurity training available in multiple modes so that we can address these types of challenges. We've actually hired a team of K-12 educators within Fortinet to develop K-12 education for teachers. And

Rep. Morgan Luttrell (R-TX)SPEAKER_05

we just unload the software and—

Mr. Robert RashotteSPEAKER_06

Absolutely.

Rep. Morgan Luttrell (R-TX)SPEAKER_05

OK, that's beautiful. The bad part about it is I've been up here for 2 years and some change, and I didn't even know you guys existed. Therein lies the problem. Um, because we've chatted about we want to recruit out of the military, which I think is a fabulous idea. Uh, Mr. Jones, you're out in the rural areas. A lot of folks don't want to live out in the country like we do. And if we offer these, these, these, these job opportunities and we talk about pay, and when we— which is a challenge, it, it always is. But the hard part about bringing experienced expertise into the military, the private sector is going to come in and snatch them and pay them 3 times as much as we can federally. And so there's the problems, one of the very many problem sets, if you will. Mr. Stier, you you laid out very— job well done. I love the way you laid everything out because we need to hear that here. You all are the subject matter experts. My my first question is there's no portal, there's no enclave of information where the mass, either whether it's in the universities— Mr. Russomanno, you and I spoke about that. I have a university in my district that is eagerly trying to put together an academic profile or degree plan for cybersecurity, so those those folks downstream, whether it's at the federal or private, have or can communicate with the universities, like, Hey, here's where we are in 2025. This is the expectation that we have, and this is where we need our men and women to be once they graduate, and then we'll take it from there. That's where I need traction. I need you all, however this is going to work. So my Okay, so my question is, is there an existing department, whether or not it's CISA or federal, and if it's DOD and CISA together, where can something live that universities, private sector can go, as well as lower academics can go and and converge these two problems? Mr. Russomanno, you got something for him, sir?

David J. Russomanno, PhDSPEAKER_17

Yes. A lot of our experience is working with the National Science Foundation. That makes a—for me, it comes to mind as a facilitator to bring together institutions towards shared goals. For example, we'd love to partner and work with universities in your district. We're working on a national model. We welcome other partner institutions.

Rep. Morgan Luttrell (R-TX)SPEAKER_05

Is it actually that easy for me to tell Willis High School to reach out to the National Science Academies and say, Hey, look, there you go?

David J. Russomanno, PhDSPEAKER_17

Well, I think it starts with partnerships among like-minded institutions, working together, and then influencing potential calls for proposals from the National Science Foundation to address your goals as one approach.

Rep. Morgan Luttrell (R-TX)SPEAKER_05

Okay. Sometimes doing a lot of work is something a lot of people don't want to do. I'm trying to ease ease ease the movement, if you will. Mr. Rashotte, you got anything on that for me? What specifically, in your opinion, can, like if I if when we have CISA in here, I was like, All right. Hey, here is your role and responsibility: You're to reach out to every single K through 12 school in the continental United States and see where they are in the cyberspace, or whomever.

Mr. Robert RashotteSPEAKER_06

Uh, I mean, it's something that we've done a lot of work with at the state level with, with different, uh, where we have our K-12 program operating in, in 43 different states now, and that has primarily been an effort through state and local government. But, uh, it has been quite successful, and I think we can continue, uh, pushing, pushing that.

Rep. Morgan Luttrell (R-TX)SPEAKER_05

Okay, um, I'll ask this because I'm going to reach out to every single one of you. Just if you will. I don't care if you throw it at the wall or put it on a whiteboard. In the military, we have mission success and we work our way back to the starting line. And how do we get there? What's the most streamlined process? Who are we taking in? Where are our contingency plans at? Um, that's something that we thrive on in here because inevitably it's going to come up to either legislation or dollar bills. And again, you guys are the subject matter experts, so I'd appreciate— I appreciate that communication. Yes, sir. Mr.

Mr. Chris JonesSPEAKER_10

Jones. Congressman, I'd say reach out to your local electric cooperatives, and let us be a facilitator and part of that process. We want to be drivers with that regard. We have a national association that can help be a facilitator. So, and I'm happy to be a bridge to you as well. So, feel free to reach out to me.

Rep. Morgan Luttrell (R-TX)SPEAKER_05

Thank you, Mr. Chairman. I yield back, sir. Thank you.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize the ranking member on the Cyber Subcommittee. You're still in that role, right? Yes. Okay, excellent. I'm glad to see you staying there.

Rep. Eric Swalwell (D-CA)SPEAKER_15

Yeah,

Chairman Mark Green (R-TN)SPEAKER_16

we're going to come to your community. I think we're going to do a field hearing.

Rep. Eric Swalwell (D-CA)SPEAKER_15

That'd be great.

Chairman Mark Green (R-TN)SPEAKER_16

Yeah, in Palo Alto area for on cyber. Yeah. So I recognize the gentleman from California for his five minutes of questioning.

Rep. Eric Swalwell (D-CA)SPEAKER_15

Great. Thank you, Chairman. This committee was stood up to address threats to the homeland after September 11th, something my colleague to the right knows a lot about, being here since its inception. And today, I just want to briefly address the question as to whether we are safe today as a country, because what I'm seeing from this administration is that we are taking our eye off the ball. We had a terrorist attack in New Orleans to start the year. ISIS, al-Qaeda, other terrorist organizations want to hit us and hit us hard. We've got the Super Bowl this weekend, back in New Orleans. We have the World Cup in 2026, and we have the Olympics in 2028 in the United States. There are a lot of prime national security targets. However, what we are seeing are actions from this administration that do not make us safe. The most basic job of government is for people to feel safe. So when President Trump releases 1,600 violent criminals into our communities, people who brutally attack police officers, we should not be surprised that they're already committing crimes. One of them just last week in Indiana was pulled over by a police officer, and, shocking, didn't want to obey that officer's orders, fought the cop, tried to use his own gun on the cop, and thankfully, the cop shot and took that individual down. Others are committing acts of child pornography who have already been released. So are we safe when 1,600 violent individuals are released into the community? No, we are not safe. President Trump is seeking to fire thousands of FBI agents and has already fired many senior officials. Why? Because these individuals happen to work on cases that he was involved with, where he was accused of stealing national security secrets and leading a coup against his own government. These federal agents keep their head down and they go where they're assigned. It's not a fantasy football draft. They don't get to pick the cases that they work on. They just do their job, and they follow the evidence. But what happens when you take thousands of FBI agents out of the Hoover Building? They don't work on terrorism. They don't work on child trafficking. They don't work on public corruption. They don't work on violent crime. So are we safe when we take thousands of cops off the beat to protect us from terrorism? No, we are not safe. The president is seeking to force resignations at the Central Intelligence Agency. These are the best spies in the world who have spent years developing foreign languages, are assigned all over the world, have taken years to train to get necessary experience, and they'll be taken off the beat to find the threats that face us as a country. Are we safe when they are not on their watch? No, we are not safe. And as we speak, Elon Musk, who no one elected, no one asked for, is at the Department of Treasury with a cybergang with access to every American's tax returns and personal identifying information. So speaking of cyber vulnerabilities, are we safe when unvetted individuals have access to your most precious data, information about your employer, your health care, your Social Security number? No, we are not safe. Our job is to make the American people safer. And Mr. Stier, if we gut and take off the beat the individuals who are supposed to work at CISA and monitor international cyberattacks against our local businesses, does that make us more able to respond to a cyberattack and protect Americans' data, or less able?

Mr Max StierSPEAKER_22

Congressman, as we've covered already, workforces are not improved in terms of their capacity to do their job if they are in crisis. And we have a federal workforce that is in crisis right now. On the issue of cyber issues, it puts us certainly at greater risk, both with respect to the specific cyber talent and more generally the workforce at large. So, um, easy answer is this is, um, not enabling our government to do its job in the way that the civil servants who are there would like to do it.

Rep. Eric Swalwell (D-CA)SPEAKER_15

Great. And I'm all for getting rid of waste, fraud, and abuse. I support any efforts to do that. But when it comes to national security, you better be pretty damn careful about where we make cuts, because my promise to you is we will be hit if we take our eye off the ball. And I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize the chairman of our Counterterrorism subcommittee, the gentleman from Texas, Mr. Pfluger.

Rep. August Pfluger (R-TX)SPEAKER_19

Thank you, Mr. Chairman, and thank you for having this hearing. And I think that's a great point. We have been hit over the last four years. We have seen gaps in our security. We have been vulnerable. So, and I think you holding this hearing today is an acknowledgment of a new direction that we are going, and we're going to make sure, damn sure, that we're protected. So I thank our witnesses and our panelists, and want to start by saying I represent Angelo State University. I've mentioned this in this hearing room many times, and Dr. Russomanno, I'll start with you. What lessons—and Angelo State is a center of academic excellence in cyber defense—what lessons should Angelo State be learning and what programs should they be trying to seek to help with the shortage of cyber professionals that we have, especially those that come from places like rural Texas that want to be a part of our security and defense? Give us some of the lessons you've learned and those that I can share with an institution like that.

David J. Russomanno, PhDSPEAKER_17

I think the key is expanding the portfolio of training with respect to cybersecurity readiness. Once again, many folks think of just computer science, engineering as those pathways, but there's others. And with respect to the national security threats that have been voiced, I know with Gen Z students, they want to make a difference, right? They're looking for meaningful work. It's un- that wasn't necessarily the motivation of an 18-year-old in my generation, but Gen Z wants to make a difference. So a call to this national security threat is something that Gen Z could rise to. And I will point out the ISC2 study from last year pointed out that our cybersecurity growth is flat year over year last year. So as the threat is increasing, our workforce growth is flat. We have to broaden the academic programs, the training programs available to our students, and articulate the urgency and the opportunity for Gen Z to make a difference in this challenge our nation faces.

Rep. August Pfluger (R-TX)SPEAKER_19

Are those training programs adequately suited to address the threat, to meet the threat, or is Volt Typhoon and some of these things that we've seen recently, are they outpacing what we're learning, or is it adequate right now?

David J. Russomanno, PhDSPEAKER_17

We need more investment in applying the state of the art to our cybersecurity threats, and I think the Cyber PIVOTT Act is addressing broadening that workforce focused on applying the state of the art.

Rep. August Pfluger (R-TX)SPEAKER_19

Thank you. Mr. Jones, I'll go to you and I have two questions for you. Number one, talk about internships and kind of pick up where Dr. Russomanno left off. What do those internships look like? What's most beneficial? How do we take a center, Center of Excellence, a student that comes from rural West Texas, and put that individual into a proper internship?

Mr. Chris JonesSPEAKER_10

Yeah, Congressman, thank you. Um, so opportunity, obviously, for someone to come in and learn about cybersecurity, about the techniques that we have in place, but also to learn about an electric co-op. You know, that we're, you know, for a place like you're describing, a good place to work with a virtuous mission. So there's a good exchange there, and we hope to raise the profile of what electric co-ops do in internships, internship programs like that.

Rep. August Pfluger (R-TX)SPEAKER_19

Well, that's where I was going with the second part of the question is how Um, how worried are our cooperatives, which service communities like mine in many, many cases? How worried are we that that piece of critical infrastructure is vulnerable to an attack that would shut down the, the lights?

Mr. Chris JonesSPEAKER_10

Well, Congressman, I would relate it this way, if I may.

SPEAKER_UNKNOWN

So,

Mr. Chris JonesSPEAKER_10

um, electric co-op managers, we have a universal and always have had a universal item that keeps us up at night, and that's the safety of our team members. And we, we have a dangerous profession. But we have an accompanying worry that keeps us up at night now, and it's certainly cybersecurity. So this weighs heavy, I can assure you, on every electric co-op manager across this country. So we're taking it seriously. We're working together. We're collaborating. We appreciate this opportunity to collaborate with the federal government. We want to be the best partner we can be. But, uh, yes, it is top of mind for all of us.

Rep. August Pfluger (R-TX)SPEAKER_19

Thank you. We've got 45 seconds left. I'll leave the time to the additional—or the other two witnesses. What keeps you up at night? How will the PIVOT Act help with those threats? You've got about 20 seconds each.

Mr. Robert RashotteSPEAKER_06

Yeah, I think I'd like to emphasize again this idea of broadening our scope of cybersecurity training and the roles and so on, where today I think we typically focus on training people that just have cybersecurity in their job role or in their job title, where I think it's a broader focus than that. We need to make sure that people coming out of business schools understand cybersecurity cyber threats. We need to understand that people coming out of law school understand, uh, risk mitigation and so on. From a physical cybersecurity perspective, we don't just train people that have security in their job title, and I think we need to take the same approach here and really broaden our view of who needs that cybersecurity knowledge.

Rep. August Pfluger (R-TX)SPEAKER_19

My time is expired. I'm sorry. If you'd like to enter something for the record, please do so. I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize the gentlelady from Illinois, Ms. Ramirez, for her five minutes questioning.

Rep. Delia Ramirez (D-IL)SPEAKER_20

Thank you, Chairman. Well, let's be serious. We're here talking about preparing the pipeline. The title of this hearing is laughable. How do we prepare the type-line— the pipeline, or examine the state of America's cyber workforce when unelected, unaccountable President Musk and Trump are asking over half of the federal workforce to resign and issuing executive orders freezing hiring and funding for federal agencies? How do you prepare the pipeline under a Musk and Trump presidency? It is clear that the security of Americans' information is not a priority. I mean, let's think about this. A private civilian with no security clearance bullied his way into the Treasury. He set up private servers and stole sensitive information from an agency. Let me repeat that because I think some of my colleagues on the other side need to hear it again. A private civilian with no security clearance bullied his way into Treasury, set up private servers, and stole sensitive information from the agency. Folks, if that isn't a national security crisis, a cybersecurity crisis, I don't know what is. The true threat to our homeland security is felon Musk, Trump, and their blatant misuse of power to steal information and coerce employees to leave agencies. The billionaire boss and his puppet—I'm going to let you all decide which is which—are on a mission of privatization for their own profit. Well, my mission, and I think the mission of a number of members here, is to protect the people. And with that, I want to really turn on to questions. And look, one challenge the federal government has when it comes to cyber workforce recruitment and retention is competing with the private sector. We know the government is not going to be able to pay as much as tech companies like Google or CrowdStrike pay, but the federal government has relied on offering a strong benefit package that also includes retirement benefits. That's how you recruit, and it helps recruit and retain workers. Now, Republicans are proposing to cut federal employee benefits to pay for tax cuts for the richest man in the world and Trump's other billionaire bosses. I worry this will make it even harder for us to recruit and prepare a pipeline and keep cybersecurity professionals. So, Mr. Stier, how have federal employee benefits played an important part in recruiting and retaining employees? Let me give you the second part of that question. How could cuts to retirement benefits harm efforts to attract new cybersecurity workers and keep the cyber defenders we currently have, Mr. Stier?

Mr Max StierSPEAKER_22

Sure. So I think returning to why is it that people come into government more broadly, it's because of mission more than anything else, but mission alone, people don't work only for mission alone, so compensation is clearly quite important. I noted earlier that the pay system we have today across the government is based on a 1949 law. It was based on this notion of everyone could be paid the same at a similar level of work. In a world in which you have different occupations like cyber, that's foolishness. So, answer number one is what should be done is modernize the federal pay system so that you actually have some market sensitivity by occupation, which is something we largely don't have. With the cyber workforce, we have different systems at DOD, DHS, but there's been no analysis about what is the right system and why should that system be applied to a single agency rather against the entire cyber workforce. So if you want to address how you recruit and retain on the compensation side a better cyber workforce, modernize the pay system, treat it as a unified workforce across the entire government so you don't have agencies competing against each other, and you will create better return for the American taxpayer and a safer country.

Rep. Delia Ramirez (D-IL)SPEAKER_20

Thank you, Mr. Stier. So let me follow up on that. Upon taking office, Trump resurrected Schedule F, his attempt to bring back the Gilded Age spoils system and hire federal workers based on partisan loyalties rather than qualifications and merits. This policy could lead to mass firings of qualified cybersecurity policy experts across the federal government and would dangerously politicize civil service. So, Mr. Stier, the last question I have here in 20 seconds: Why is a nonpartisan civil service so important, and how does politicizing the federal workforce undermine national security?

Mr Max StierSPEAKER_22

We have a history in our country where we had this spoils system before in the 19th century. You wound up with corruption and incompetence. You see that globally whenever you have a system move away from merit with respect to the civil service, you see poorer performance in the government and you see corruption. So it is not the right way to move. We do need to reform our government. That's not the reform we need. And I just— a point of order, and I normally don't do this. It's Stier, just to let everybody know so we can maybe going forward.

Rep. Delia Ramirez (D-IL)SPEAKER_20

Thank you, Mr. Stier. I take that very personally. Chairman knows, too, so I apologize for

Mr Max StierSPEAKER_22

that. No problem, not at all.

Rep. Delia Ramirez (D-IL)SPEAKER_20

Thank you. With that, I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentlelady yields. I now recognize the gentleman from Arizona, one of our border states, Mr. Eli Crane, for his 5 minutes of questioning.

Rep. Elijah Crane (R-AZ)SPEAKER_08

Thank you, Mr. Chairman. I appreciate the opportunity to be here today and talk with some subject matter experts about the pipeline of our cyber force and how we're going to compete with some of the threats as we see some of our adversaries increasing cyberattacks on the country. I wanted to— I just came from an Oversight Committee, and now I'm back here, and it's really the— it's really the same nonsense going on in there. Just want to say to Elon Musk, Wow, man. You are really effective, because these guys are completely melting down. You must be doing something right. I think we might need to request some of your— some of your funds to get these guys maybe some pallets of tissues, some safe spaces, maybe a couple therapy dogs, because they're absolutely melting down. So good job, Elon. Now, I want to cover something that Mr. Swalwell said a couple seconds ago. Mr. Swalwell talks about— he talked about the responsibilities to protect the American people because this president pardoned the J6 prisoners, many who had been in prison for several years. It's just funny because I didn't hear that same concern from Mr. Swalwell or many of the Democrats on this committee when then-President Biden was allowing hundreds of thousands of illegal aliens, many of whom were criminals, rapists, and murderers and terrorists, coming into this country on a monthly basis. So my point being is, if you want to protect Americans, you can't just do it when it's politically advantageous. I want to start with you, Dr. Russomanno. As the executive vice president of academic affairs at Memphis and the former dean of engineering at Purdue University, I'm sure you were well-versed on developing the cyber workforce. My question is, how is the University of Memphis utilizing programs like CyberCorps: Scholarship for Service programs to build out the pipeline of the federal cyber warriors?

David J. Russomanno, PhDSPEAKER_17

Thank you, Congressman Crane, for your for your question. I think it's important to remind everyone what CyberCorps is all about and how it impacts students. One is covering tuition. Another is providing a stipend that enables students not to have to work while they're pursuing their degree. Another is an opportunity to build social capital through networking, through internship fairs and other opportunities to learn more about the federal government and way they can make an impact through cybersecurity. This is a tremendous enabler, if you will. We've talked about how do we get more of our youth involved in cybersecurity. Certainly helping them through their daily living is a fundamental way, so they can focus on their studies to help our nation.

Rep. Elijah Crane (R-AZ)SPEAKER_08

Thank you. Next question for Mr. Rashotte. According to the U.S.-China Economic and Security Review Commission, the cybersecurity school at the Wuhan-based National Cybersecurity Center planned to build four to six cybersecurity schools by 2027. The CCP has devoted significant resources to building their cyber force, and while the exact number of cyber warriors isn't available, it's safe to estimate that if the CCP issued a directive, it could bring a significant cyber force to bear against the US, especially given that according to the to US Cyber Command, there are only 6,200 personnel across 133 teams working on cyber threats, and CISA at DHS has roughly 3,100 employees. My question is, how can academic— academia, private industry, and the federal government partner together to ensure our cyber workforce pipeline is able to keep pace with the number of cyber warriors our adversaries can churn out?

Mr. Robert RashotteSPEAKER_06

Thank you for the question. I think that the partnerships between industry and academia are critical, and our approach has been to break down every barrier we can in terms of access to training and education. We've done that at Fortinet by making our entire catalog of training available free to anyone who needs that training, and we've challenged others to do the same.

Rep. Elijah Crane (R-AZ)SPEAKER_08

Thank you. My next question is for you, Mr. Jones. How important is it to utilize American resources within our power grid so that our adversaries aren't getting a foothold in our critical infrastructure, similar to Volt Typhoon hack? I was recently watching the Shawn Ryan Show. The topic was We're in an Invisible War with Erik Bethel. My question is, and I'm paraphrasing from the show, how can companies who have a fiduciary responsibility to their investors to gain and seek profit balance that financial responsibility with other factors like patriotism?

Mr. Chris JonesSPEAKER_10

Well, I think that the electric cooperatives in our country have a rich history of patriotism, Congressman. So I think we do take that seriously. And, um, you know, the virtues of our mission, uh, service, um, making sure that we are doing our part to provide reliable power for now almost 50 million Americans. And that's always top of mind for us.

Rep. Elijah Crane (R-AZ)SPEAKER_08

Thank you. Mr. Chairman, can I enter this into the record? I know there's been some discussion here about layoffs and buyouts. This is an article, CISA Among DHS Offices Exempted from Taking OPM's Deferred Buyout Offer.

Chairman Mark Green (R-TN)SPEAKER_16

Without objection, so ordered.

Rep. Elijah Crane (R-AZ)SPEAKER_08

Thank you. I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

Gentleman yields. I now recognize the gentlelady from New Jersey, Ms. McIver, for her— oh wait, are you— I didn't see this. I didn't see Mr. Magaziner snuck in on me. So, if we'll defer, is it okay? I'll recognize Mr. Magaziner for his 5 minutes of questioning, and my apologies.

Rep. Seth Magaziner (D-RI)SPEAKER_21

Thank you, Chairman. We're here today because we all care about cybersecurity, or at least I thought we all did. Last week, Donald Trump's Office of Management and Budget illegally cut off funding for grants across the federal government, including grants for cybersecurity. This is a memo that was sent from the Department of Homeland Security to states that outlined DHS grants that were being cut off for review, including, but not limited to, the Cybersecurity Education and Training Grant, cut off; the CISA Cybersecurity Awareness Grant, cut off; the Cyber Tipline, cut off; State and Local Cybersecurity Grant, cut off, pending review per OMB instructions. Review for what? Is cybersecurity too woke, too green? And it was only after an enormous public outrage and a federal court order that the Trump administration pulled back that OMB memo. And during those days when this funding was frozen, China was continuing to put thousands of people a day in cyber warfare against the United States, to say nothing of Russia and Iran and criminal gangs. But that's not all. The federal hiring freeze is impacting cybersecurity jobs all across the federal government. And I want people to hear this. There are federal cybersecurity jobs not just at CISA or DOD, but in every agency. And so cybersecurity jobs at the U.S. Treasury, hiring freeze; cybersecurity jobs at HHS, which manages Medicare, Social Security, CMS, cut off. Critical agencies are impacted by this hiring freeze. We heard a letter earlier from Mr. Stier from a CyberCorps participant whose job in the federal government, his cybersecurity job, was rescinded due to Trump's hiring freeze, which is still ongoing. Agencies all across the federal government are not able to make these crucial cybersecurity hires across the board almost. And so to my Republican colleagues, if you care about cybersecurity, and I'm serious about this, call the White House. Call the White House right now and tell them to lift the hiring freeze of cybersecurity roles across the federal government, not just at CISA, not just at DOD, but at every agency. And let's address the elephant in the room. This weekend, Elon Musk sent a group of unvetted 20-year-olds to take over the U.S. Treasury's payment system, responsible for tax refunds, Social Security checks, Medicare benefit payments, and more. The Treasury's payment system has the names, Social Security numbers, bank routing numbers, and tax information of every American, medical information of millions of Medicare recipients. We have no idea who these children are that Elon Musk has working for him, who now have access to the private personal data of every American. We don't know what permissions they have. Can they just read the data? Can they edit it? Can they initiate payments? Can they cut off payments at will? Can they share your personal data with people outside the federal government? The one thing we know about these this army of children that Elon Musk has poring through your data is that not one of them has been through a federal FBI background check. Other than that, we don't know very much. And oh, by the way, we just learned through public reporting that Elon Musk has put a private server in his office and has downloaded every American's personal data into that private server. So I invite any of our panelists, any of the four of you, to defend this. Are any of you comfortable with Elon Musk and this staff of untrained, unvetted, unelected, unconfirmed teenagers having access to every American's personal data with no transparency or oversight? Does anyone want to take a stab at defending that? Well, that silence I think gives us the answer that I was expecting, at least. Does any of our panelists think that the Trump administration freezing hiring of cybersecurity roles in agencies across the federal government help our national security? Of course not. So listen, if we're going to have conversations about cybersecurity, I welcome it, but it needs to start with the administration taking steps to protect the private data of Americans, to lift the hiring freeze of cybersecurity professionals, and to stop giving our adversaries win after win after win in the cyber domain as they have been over the last two weeks. And I'll yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. And I'd like to— I don't normally do this, save my comments on this one till the end, but 19-year-olds aren't children. We have Medal of Honor winners who fought and died for this bleeping country who are 19-year-olds. So if you're 19 years old out there, I don't consider you a child. I now recognize Miss Greene from Georgia for 5 minutes of questioning.

Rep. Marjorie Greene (R-GA)SPEAKER_12

Thank you, Mr. Chairman. Thank you for clearing that up. There are 19-year-olds that are serving our country and defending our nation. We believe in merit. We believe in people that can do the job. That's why America elected Donald Trump this past election. And part of his campaign was DOGE and Elon Musk. They were on the campaign trail together, as a matter of fact, the last 2 months of the campaign, and America overwhelmingly voted for this effort. I'm so happy that we're talking about cybersecurity, cyber professionals today. Mr. Stier, in your testimony, you talk about maintaining nonpartisanship as a bedrock principle of civil service. You want to talk about nonpartisanship. Meanwhile, your $24 million nonprofit dedicated to attracting talent for the federal workforce and making the government more effective is funded by some of the most progressive benefactors. This includes the Gates Foundation, the Democracy Fund, and the Ford Foundation. It also hosts galas to honor people like Lisa Monaco and other Biden officials. A goal of your entire organization is essentially de facto job placement to entrench more DEI hires into the federal workforce, the opposite of nonpartisan, apolitical, merit-based civil service. Diversity, equity, inclusion is a huge priority for the partnership, as listed on your website. Listed on the website is a framework to integrate the principles of diversity, equity, and inclusion into the partnership's programs, initiatives, and strategies. Since the nonprofit's main initiatives are helping people apply for federal roles and advancing career development in the federal workforce, your nonprofit is aimed at infusing DEI, an inherently partisan practice, into the federal workforce. I worry about this, especially with regards to cybersecurity workforce who needs high-quality, skill-based positions, such as those serving on DOGE. Cybersecurity is extremely important. It shouldn't be about race. It shouldn't be about sexuality. It shouldn't be about identity. In your testimony, you also express concerns that President Trump's administration's recent actions and that they will counter democratic principles. Yet your unwritten goal of entrenching more woke employees into the swamp is the opposite of democratic principles. The Trump administration's actions are the embodiment of democratic principles. This is what the American people want. This is what they voted for. The American people overwhelmingly voted for President Trump in a decisive landslide victory to reform how our government operates, most importantly, how the federal workforce operates. The mission of your partnership is building a better government and stronger democracy. Building a stronger democracy is allowing the will of the people to take effect, not actively working to oppose it. There have been multiple reports that you were in communication with the officials at the Biden administration prior to President Trump taking office. Is that true?

Mr Max StierSPEAKER_22

We run the Center for Presidential Transition, so we've helped the Trump campaign when they were trying to set up their transition operation in 2016. We've helped every administration get up, set up right, both Republican and Democratic. Yes, we've been in contact with the Biden administration. We've had an open door to everybody. If you would like to have the facts, I can provide those to you, but let me know. Cuz the reality is we do honor civil servants, not political appointees. The program you identified on Lisa Monaco, she was presenting an award, as smart political

Rep. Marjorie Greene (R-GA)SPEAKER_12

Thank you, Mr. Stier. I'll reclaim

Mr Max StierSPEAKER_22

my time. Let me know when you ever want me to.

Rep. Marjorie Greene (R-GA)SPEAKER_12

Did you discuss any strategies for how to prevent President Trump from firing federal workers?

Mr Max StierSPEAKER_22

I'm sorry, in what context?

Rep. Marjorie Greene (R-GA)SPEAKER_12

Did you discuss any strategies for how to prevent President Trump from firing federal workers?

Mr Max StierSPEAKER_22

In what context? I do not think that it's a good idea to offer the entire workforce non-strategically an opportunity to resign and to press them to do so, because you're going to lose cybersecurity professionals that you don't want to lose. If you want

Rep. Marjorie Greene (R-GA)SPEAKER_12

DEI professionals, are you trying to stop President Trump's administration from

Mr Max StierSPEAKER_22

firing DEI

Rep. Marjorie Greene (R-GA)SPEAKER_12

employees that you place in the federal government?

Mr Max StierSPEAKER_22

We are not engaged in trying to stop anyone from getting fired. That's not the role we play. What we do say, though, is when civil servants— let me finish the answer.

Rep. Marjorie Greene (R-GA)SPEAKER_12

Well, Mr. Stier, let me ask you one question. I have a few.

Mr Max StierSPEAKER_22

Excuse me, Mr. Chairman. If I'm asked a question, do I get to answer it? Okay, then go ahead. I'd

Rep. Marjorie Greene (R-GA)SPEAKER_12

like to reclaim my time. Thank you, Mr. Stier. Does your organization receive taxpayer dollars?

Chairman Mark Green (R-TN)SPEAKER_16

Thanks.

Mr Max StierSPEAKER_22

Do we receive taxpayer dollars? We provide services to the government, so we do receive taxpayer dollars,

Rep. Marjorie Greene (R-GA)SPEAKER_12

right? That has $3.4 million right here from the American taxpayers. They're not interested in DEI, Mr. Stier. They're interested in qualified people. Thank you, Mr. Chairman.

Rep. Andrew Ogles (R-TN)SPEAKER_14

I yield

Rep. Marjorie Greene (R-GA)SPEAKER_12

back.

Chairman Mark Green (R-TN)SPEAKER_16

gentlelady yields. I now recognize Ms. Johnson— or wait, Ms. McIver. I didn't get you before. Thank you. The gentlelady from New Jersey for 5 minutes of questioning.

Rep. LaMonica McIver (D-NJ)SPEAKER_00

That's okay. Thank you, Mr. Chairman. Thank you, Chairman. Thank you, ranking members, and thank you to the witnesses for joining us today. I was a little caught up in that last questioning, trying to bring myself back. So, as we face an evolving and increasingly sophisticated cyber threat landscape, our nation's security relies on a robust, well-trained, and diverse cybersecurity workforce. Unfortunately, the recent decisions, as mentioned multiple times here, including the harmful hiring freezes and federal grant interruptions under the Trump administration, have weakened the critical pipeline needed to safeguard our digital infrastructure. Last time I checked, the offering of folks to take a buyout wasn't just offered to folks of diversity or women or disabled; it was offered to all employees. So it's not about just laying off DEI or employees that are woke, because everyone got this offer to be able to take a buyout. These policies have stalled critical recruitment efforts, delayed hiring of qualified candidates, and created vulnerabilities that will persist. Adding to this damage are the extreme rollbacks in diversity, equity, and inclusion initiatives, which are crucial for addressing the longstanding representation gaps in this field. By limiting opportunities for women, people of color, and unrepresented communities to enter and advance in cybersecurity, we are missing out on a vast pool of talent. With that being said, Mr. Stier, I'd like to go back to you and give you some time to address some of the things you were talking about in the previous questioning, but more so to talk about how, in your opinion, these specific hiring freezes hinder the development and retention of cybersecurity expertise across all of our federal agencies? And what steps, in your opinion, can Congress take to reverse or reduce the long-term impact, because there will be, of these policies on our national security?

Mr Max StierSPEAKER_22

So, look, as we've talked all along here and as the committee, both Republican and Democrat, recognize, we're in a hole and the world is getting more scary, not less. So the reality is we need to see more investment in the capacity of our public sector to respond to the cyber challenges. When you have hiring freezes that actually encompass the cyber workforce, of course that's going to diminish capacity of the organization. That's a pure, logical proposition. The reality is that CISA is under a hiring freeze even though the offer of, you know, delayed or deferred resignation is not being presented to them. So it is harming CISA, but more importantly, it's harming every organization inside the federal government that needs cyber talent in order to protect vital interests of our country. So this is an issue that is not just about the hiring freeze. We have to be thinking about the morale more broadly of the workforce, and that is not good. And in terms of responding, I just want to say that, you know, I'm invited to testify here. I'm trying to offer the best information I possibly can to this committee. And honestly, I'd like to be treated with respect, and I don't think I was.

Rep. LaMonica McIver (D-NJ)SPEAKER_00

Thank you. Thank you for that. And I'm sorry that you were not able to experience that. I think as human beings and as just grown-ups where we're supposed to be, we should be able to treat each other with respect and be respectful and allow you the time. That's why I wanted to give you time to talk about that, and I, I'm thankful for your organization and the work that they're doing. Um, and not, you know, um, I know it's very hard being in this type of, you know, situation and addressing some of the things where people want you to be anti-people of color, anti-women, anti, you know, against people with disabilities. But at the end of the day, I commend you for everything that you're doing, um, and know that the day will be better after this hearing. So with that, I yield back my Thank you.

Chairman Mark Green (R-TN)SPEAKER_16

The gentlelady yields. I now recognize the chairman of the Subcommittee on Cyber, the gentleman from New York, Mr. Garbarino.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Thank you, Mr. Chairman. Thank you very much for having this hearing, and very excited to support the PIVOT Act. I know you read a couple names off of co-sponsors. I guess we didn't put our paperwork in, but we are going to be filing that right away. So we're going to be

Chairman Mark Green (R-TN)SPEAKER_16

glad to have you on the bill,

Chairman Andrew Garbarino (R-NY)SPEAKER_07

co-sponsor. So I'm sorry we didn't get that in soon enough. That was our fault. But thank you all to the witnesses for being here today. Mr. Rashotte? Rashotte? Which one is it? Rashotte. Rashotte. Wonderful. Thank you. I want to focus, in your testimony, you identified early educational engagement is essential not only to growing the cyber workforce, but also in making students and families aware that these careers exist to begin with. Last year, I led the DHS Cybersecurity Internship Program Act with Congresswoman Clarke, and we were very proud of that bill. How do you think we can look to improve outreach to draw students and the public at large to these opportunities in cybersecurity?

Mr. Robert RashotteSPEAKER_06

I think we need to start as young as we possibly can. I know when we started our efforts in providing K-12 education and curriculum, we didn't think we'd be able to start as young as we could. And we had teachers come to us and say that we could we could provide cybersecurity awareness training at kindergarten. That really surprised us, but it's been incredibly effective. So I think there's a long game here where we really have to focus at that young of an age so that truly when kids are coming home and talking about becoming doctors, lawyers, engineers, they're also talking about becoming cybersecurity superheroes.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

So when you talk about kindergarten, what kind of— what's happening at kindergarten to get students in

Mr. Robert RashotteSPEAKER_06

So we're providing lesson plans to teachers so that we're not adding additional lessons, but we're taking existing lessons that teachers are providing and adding cybersecurity aspects into it. So basically helping kids understand, you know, what might be a threat, just opening their eyes.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Would it be helpful, you think, if CISA validated cybersecurity curricula for K through 12?

Mr. Robert RashotteSPEAKER_06

I think our main focus right now is developing that curriculum by teachers for teachers, and that's been our approach.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

So, but does CISA have a role in helping develop that curriculum?

Mr. Robert RashotteSPEAKER_06

I think there definitely could be a role for sure, yes.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Do you know if currently under the Department of Education, if there's any cybersecurity roles that they play in helping states develop curriculum for cybersecurity?

Mr. Robert RashotteSPEAKER_06

It's not an area that I focused in. Our partnerships from within my organization, the Training Institute, have been more directly with the academic institutions and their role.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Okay, so K through 12 is big, but what about getting expanding cyber education? What else can we do with expanding

Mr. Robert RashotteSPEAKER_06

I think we can take programs that have historically been focused at colleges and universities and start to move those downstream into high schools. And there's— we're starting to see a lot of kids now coming out of high school that are essentially self-taught and are going directly into the workforce. I think if we take some of those programs that we've traditionally focused at college and university, They can definitely be applied at the high school level and, and make sure that those kids coming out and going directly into the workforce are even more prepared than what they are. We're seeing some of these self-taught, uh, kids, uh, uh, extremely capable and qualified.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

That's great. And I mentioned the chairman's PIVOT Act and how that helps with the scholarships and getting people into the workforce. But there's a half a million open cybersecurity jobs, at least now, nationwide. What can we do to get people into the—is there training programs? Is there certification programs that people can start now, that they don't have to wait to do 2 years in college? Because that's necessary, but is there something to get people in the workforce now?

Mr. Robert RashotteSPEAKER_06

Absolutely. And again, I think this is— we see this again with kids coming out of high school directly into the workforce, a lot of self-training going on. A lot of corporate entities, such as Fortinet, we're making our training and certification freely available so that kids either coming out of a degree program or coming directly out of high school can access that training with minimal barriers, and in some cases no barriers at all.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Thank you very much. Dr. Russomanno, you talked about in your testimony about the challenges colleges face in aligning education and workforce needs. Coming from higher education, how can we promote skills-based training and modernize degree

SPEAKER_UNKNOWN

Gap?

David J. Russomanno, PhDSPEAKER_17

Well, thank you for that question. As part of our polytechnic initiative at the University of Memphis, we also have benefit of having our own independent school district. We have a Pre-K through 12 independent school district associated with the university. So we're working very hard on expanding our dual enrollment, focusing on cybersecurity, applied AI, and advanced manufacturing. There's a lot of technology that goes into advanced manufacturing that many students are not aware of: the advanced robotics, the sensors, the cybersecurity, the AI. So trying to get that penetration into the high schools through dual enrollment is part of a focus for us at the Polytechnic Initiative at the University of Memphis. Hope to partner with others.

Chairman Andrew Garbarino (R-NY)SPEAKER_07

Thank you, Chairman. I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

Gentleman yields. I now recognize the gentleman from New York, our nation's—one of our really—our financial center, our greatest financial center, obviously very concerned about cyber, Mr. Goldman, for 5 minutes questioning.

Rep. Daniel Goldman (D-NY)SPEAKER_09

Yes, Mr. Chairman, thank you very much. And I agree, those in New York City and around the country are very concerned about cyber. We must be operating in la-la land here, having a hearing on preparing the pipeline, examining the state of America's cyber workforce, where we have three academics who have been brought in by the majority to talk about the education and training that we need for more cybersecurity employees, while at the same time, the president and his unelected billionaire master are gutting every single executive branch agency. What's the point of having a pipeline with education if you're taking away all of the jobs? If you're sending unvetted teenagers with no security clearance into our various executive branch agencies, allowing them to hack and slash into the government payment systems, the government portals, the government databases without any regard to cybersecurity, putting them on private servers. And quite obviously to anyone, whether you're an expert on cybersecurity or not, you understand how that jeopardizes the security of every single American's personal identification information. It provides an opportunity for China, who just executed the largest cybersecurity breach of the federal government ever a couple months ago, to have access to private servers that are so clearly easier to hack into. And we have no idea whether these people have security clearances, whether they got their security clearances because Donald Trump passed an executive order saying that he can just bestow security clearances on anyone for six months. And so maybe he did that. I mean, maybe it's the same thing as Kash Patel saying that Donald Trump thought about declassifying classified information and therefore it's declassified. And that's going to be potentially the new FBI director, who is going to oversee counterintelligence and cybersecurity for the FBI. This is a guy who supports the purges at the DOJ and the FBI, who promised the purges at the FBI and DOJ, who lied right, left, and center during his hearing, who has circumvented normal protocol and practices when he was with the National Security Council, when he was with the House Intelligence Committee, when he was with the Department of Defense, who every single former Trump administration official has said is wholly unqualified and dangerous to be in that job. And you want to talk about cybersecurity and recruiting more people? How about we not have heads of executive branch agencies who are jeopardizing our own cybersecurity, who are jeopardizing our own security? How about having some degree of protection over our personal identification information? Who on earth would ever want to join the federal government now if you are associated with a prosecution that the president of the United States does not like? You will be fired. You will be fired. What law enforcement system in a democracy allows or supports the president of the United States to order the firing of nonpartisan, highly trained law enforcement officers simply because they worked on a case that the president didn't like? That is banana republic shit, and that does not belong in this country. And what else doesn't belong in this Congress is this stupid hearing where we're talking about educating a workforce where there's no demand for that workforce anymore because Elon Musk is destroying that workforce. It's like we're in la-la land, Mr. Chairman. You're pretending as if reality is not happening down the street and we need more education for cybersecurity. This is a joke. And I hope at least, Mr. Chairman, if you're going to have hearings on cybersecurity—

Chairman Mark Green (R-TN)SPEAKER_16

gentleman's time has expired. I now recognize Mr. Ogles for 5 minutes of questioning.

Rep. Andrew Ogles (R-TN)SPEAKER_14

I want to thank you, Mr. Chairman, and thank you to the witnesses, a couple of fellow Tennesseans there. Mr. Jones, you represent Middle Tennessee Electric, who actually services part of my district. But before we get to that, I do want to piggyback on something that you said, Mr. Chairman. One of our colleagues had somewhat of a disparaging remark about 20-year-olds. And so as we look to bad actors, whether it's nation-states or criminal activity, the development of applications such as TikTok, which have a backdoor, the capability of assimilating data, new technologies such as DeepSeek, we know that there's a gap. We have half a million openings in the cyberspace. That, by the way, that's the equivalent to our standing United States Army currently. And so the future is 16, 17, 18-year-olds, the future workforce. And when I say future workforce, I'm just talking about a year or two from now. The workforce of today that we need to engage are those 18, 19, and 20-year-olds, right? That's how we fill this gap. And so, to someone to have some disparaging remarks about an age range that is literally critical to backfilling this need is really naive and reckless, I would say, Mr. Chairman. But But on point, Mr. Jones, again, and to all of you for being here, obviously recruitment is a problem. You've got the urban versus rural competitiveness, right? You've got private versus government. But the reality of the space we're in is that we have half a million jobs that need to be filled. So, Mr. Jones, what can be done to better equip and, quite frankly, leverage the workforce of today as we fill the pipeline with those 16, 17 to 20-year-olds? Mr. Jones.

Mr. Chris JonesSPEAKER_10

Congressman, thank you. So, I'll point to the PIVOT Act first. Again, I think that's that's so fundamentally important, and we're appreciative of what is happening with regard to that. So that's that's an important part of it. As far as the work with electric cooperatives, we are really good at collaborating together. And by extension, we are seeking to collaborate with educational institutions at the local level. So I think that's important too. We can provide, for example, mentorships for people. And again, the challenge is not quite the same, as you are aware, for Middle Tennessee Electric as it may be for many other electric co-ops in more rural areas with less economies of scale. So the challenge is different from place to place. But I believe that our network, our association of cooperatives stands ready to provide something like you're describing too with regard to mentorships, but particularly with regard to engagement with educational institutions in our communities.

Rep. Andrew Ogles (R-TN)SPEAKER_14

Well, and I want to focus on that for just a moment. So, your industry, your space, there's collaboration amongst the cooperatives. You're working to fill your needs in your industry. I think so there's the solution here. You know, the scariest phrase in the English language is from Reagan. He said that, I'm from the government, and I'm here to help. And so part of the solution is obviously what the chairman is bringing forward, the PIVOT Act. It's industry working together to educate, work with those educational institutions. So as we move forward, it's us working together to identify the needs. And so this is economic in nature, right, for local communities, for our greater national economy. But obviously the battlefield of the future is cyber. So, and otherwise benign industries or spaces, such as electric cooperatives, such as hospital systems, we see China and bad actors and nation-states wanting that information, wanting to see if there's a capability to weaponize that against the American people. So to play games and to talk about nonsense while this is an important topic that we have to have, as we see advances from other countries and nations as they recognize the need for this and to enhance capabilities, it's really frustrating. So I thank you for what you're doing in your space. Mr. Jones, you touched on human behavior in your testimony. So you have a dynamic scenario where you have students that can access your system, faculty, young and old—some of them may not be quite as adept, technologically speaking—part-time employees. So how do you create access whilst having compliance and security when you're looking at your systems? And of course that applies to best practices to other universities and co-ops, et cetera.

David J. Russomanno, PhDSPEAKER_17

Yes, thank you

Rep. Andrew Ogles (R-TN)SPEAKER_14

for

David J. Russomanno, PhDSPEAKER_17

your question. Even though the CIO is really primarily responsible for this area, I would say that we are doing a lot with a variety of of phishing drills and other internally generated vulnerability scenarios to try to improve internally the knowledge base of our faculty, our staff, and our students to ensure this critically important data, whether it's student data, research data, the comprehensive mission of the university, that we're doing all we can internally. With a variety of mock drills to ensure we are employing best practices.

Rep. Andrew Ogles (R-TN)SPEAKER_14

Yes, sir. Mr. Chairman, I exceeded my time. I yield back, and thank you, sir.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now, finally, get to recognize the gentlelady from Texas. Mrs. Johnson, you're recognized for 5 minutes for questions.

Rep. Julie Johnson (D-TX)SPEAKER_25

Thank you, Mr. Chairman. I just want to say it's an honor to be on the committee. We have a great panel. You're all very impressive in your comments. And what I'm hearing from you is we're in a cybersecurity crisis in this country, and that we are in a cybersecurity crisis because we have a workforce that is severely diminished. We have— we've lacked educational preparedness. We are lacking a plan to recruit, develop the best and the brightest talent from every corner—from Black kids, brown kids, women, Asian kids, diversity, equity, and inclusion. We need all the kids on this fight. Is that correct? All of them. And so, one of the things that has not been discussed about today that I'm very concerned with—well, another point that you've all highlighted is the need for a definite, more robust cyber education plan: to reach into high schools, to reach into colleges, to create internships. We have CyberCorps, which is a great program, but it needs to be enhanced. But it's an educational program. So, I am very concerned, in light of the backdrop of what we have already seen over the last two weeks, of shuttering our federal workforce, shuttering USAID, intimidating our law enforcement, intimidating cyber enforcement personnel. But we haven't even talked about what Trump plans to do with the Department of Education. The New York Times is reporting he's planning to shutter it, too. So, I assume that you all agree with me that if the federal government dismantles the Department of Education, that could have catastrophic implications to the security and the safety of this country. Do any of you disagree with that? You know, I think that is really important for the American people to realize that this is not politics, this isn't theater, this is the foundational premises of our security. And Mr. Jones, I want to ask you a question. I'm a Texas Democrat. I have a grid in our state that's messed up, that has failed. And I lived through a situation where our grid failed for 10 days, and hundreds of people died, and businesses suffered mightily, and people suffered mightily. As rural electric co-op, you provide critical infrastructure to millions of people in this country. You provide power, hopefully you'll provide broadband, and—but opportunity, which I believe is a critical infrastructure as well. But how devastating would it be to your co-ops for a cyberattack to shut down your grid?

Mr. Chris JonesSPEAKER_10

Well, it's something we think about a lot, and I recall, of course, the situation you're describing from three winters ago, I believe it was, in Texas. And of course, that was many, many things went into that, not a cybersecurity incident, but that wasn't your point. But we want to keep the lights on. That's what we're here for. Our members depend on us. And so this subject is so important for us for that reason. So we're putting in place, as best we can, resources, processes, technology to make sure that we are doing our part. But this is bigger than this is bigger than us, and that's why we're here, too. So we welcome this conversation,

Rep. Julie Johnson (D-TX)SPEAKER_25

right? And I welcome this hearing, Mr. Chairman, Mr. Chairman, because I do think that cybersecurity is one of the biggest vulnerabilities of our country. And it's the new frontier of security and threat. And it is really frightening and scary to many people out in this country, the fact that the Trump administration is doing everything it can to undermine the confidence in the cybersecurity workforce that we have in this country by dismissing employees, by shuttering and hiring freezes, by dismissing the Department of Education, by doing all of the things, by undermining the CIA, by undermining the FBI to prevent cybercrime in this country. We're in a critical mass. And Mr. Stier, I want to go back and give you an opportunity on DEI. We need everyone. DEI is about reaching kids who have who have not been adequately reached in the past and giving them opportunity to see the light. And we need to do that, right?

Mr Max StierSPEAKER_22

There's no doubt that we need to pull from talent where we can find it everywhere. And I think really quite importantly, we need to create environments in any workplace that enable people to do their best. And that's how you get better performance. So that is a basic proposition. We ought to be doing good management in government, just like we should see good management everywhere.

Rep. Julie Johnson (D-TX)SPEAKER_25

Thank you so much, Mr. Chairman. I yield my time.

Rep. Andrew Ogles (R-TN)SPEAKER_14

Gentlewoman yields back. I recognize the gentleman from Alabama, Mr. Strong.

Rep. Dale Strong (R-AL)SPEAKER_11

Thank you, Mr. Chairman. Mr. Russomanno, I recently introduced legislation, the CyberCorps Enhancement Act, to extend the existing CyberCorps Scholarship for Service program's participation period from 3 to 5 years, allowing local colleges and universities to continue to produce highly trained cybersecurity experts. As you know, local colleges and universities, including the University of Alabama in Huntsville, affectionately known as UAH in my district, leverage these programs to recruit, retain, and place highly skilled cybersecurity experts with an average ACT test score of a 28.5, where 80% of the graduates remain locally after graduation. In fact, UAH has the second-highest number of participants and graduates in the program, cementing North Alabama leadership in cybersecurity education. This will pay dividends for the FBI Cyber Threat Division that is locating in Huntsville as we speak. Mr. Russomanno, can you discuss the benefits of expanding the participation period to enable students to pursue advanced degrees?

David J. Russomanno, PhDSPEAKER_17

Yes, thank you for your question, and we've enjoyed the opportunity to partner with UAH in the past. Yes, this is a multipronged opportunity for us. In any way that we can offer opportunities to all students, I definitely agree with all students, and how we then commit ourselves to a successful student outcome. I think the expansion of eligibility in terms of number of years, also the opportunity for the delayed service commitment to provide an opportunity to either pursue a baccalaureate degree or an advanced graduate degree, I think those aspects of both the Cyber Corps and potentially the PIVOT Act are critically important. Many times, students are looking not only for that first job, but a satisfying career progression that provides opportunity for added responsibility. And I think what you cited provides an opportunity to do just that. Thank you.

Rep. Dale Strong (R-AL)SPEAKER_11

Thank you. I also want to mention we have a statewide cyber high school located in the second largest research park in the United States in Huntsville, Alabama. It's another level of starting this progression so that we can bring more to colleges and universities. As we have covered, the chairman's Cyber PIVOTT Act and my CyberCorps legislation both aim to strengthen the cybersecurity workforce pipeline. How would these programs complement each other to address the current

David J. Russomanno, PhDSPEAKER_17

In my, in my opening remarks, I talked some about some of the challenges around transfer articulation, so I think we have some opportunities to improve smooth pathways for advancement. So if you look at technical schools, community colleges, there are some challenges in getting the knowledge and skills and abilities acquired through those programs to matriculate to 4-year institutions. To 4-year universities. So that's an opportunity for improvement for us.

Rep. Dale Strong (R-AL)SPEAKER_11

Thank you. In addition to this legislation, what more can we do to ensure we recruit and train future generations of cybersecurity experts in the United States?

David J. Russomanno, PhDSPEAKER_17

Once again, I think it's the partnerships that have been talked about here today, a steadfast commitment, partnerships between the public and the private sector. I think we all ultimately have the same goal here: provide opportunities for students that make an impact to improve the safety and security of our nation.

Rep. Dale Strong (R-AL)SPEAKER_11

Thank you. Also wanted to touch on the pay differences between cybersecurity professionals in government and the private sector. In your opinion, what more can we do to recruit and incentivize the best of the best cybersecurity professionals to stay in government and to contribute to protecting our nation's security from adversaries, uh, and those who look to harm America?

David J. Russomanno, PhDSPEAKER_17

Once again, I think that opportunity for pursuing continued education while a civil servant is critically important, whether that's a baccalaureate degree, a master's degree, even a PhD. Having those opportunities within the government, I think, would be very attractive in terms of retention.

Rep. Dale Strong (R-AL)SPEAKER_11

Thank you. Mr. Jones, first, I want to commend you. I'm very familiar with your power system. We've evaluated Winchester in that area, and has been very beneficial years ago when I was the county commission chairman in Huntsville, Alabama. The energy sector has been described as an enabling function for all critical infrastructure sectors, making it one of the most vital and one of the most targeted. Knowing this, it is of no surprise that the energy sector was targeted by Volt Typhoon. Mr. Jones, given the increasing cyber threats to energy infrastructure, how can federal workforce initiatives better support the utility industry in developing skilled cybersecurity professionals, and what role should public-private partnerships play in that effort?

Mr. Chris JonesSPEAKER_10

Congressman, thank you. And so I think again that the PIVOT Act and the virtues of that deepening the talent pool—we need more, not fewer resources. So I think that's the essence of what I would suggest in the limited time. But happy to be a partner with you.

SPEAKER_UNKNOWN

Yeah,

Rep. Dale Strong (R-AL)SPEAKER_11

I want to thank each of the witnesses for being here. Chairman Green, I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize Mr. Hernandez. Is that right?

Rep. Pablo Hernandez (D-PR)SPEAKER_04

Yes.

Chairman Mark Green (R-TN)SPEAKER_16

For 5 minutes. The gentleman from Puerto Rico.

Rep. Pablo Hernandez (D-PR)SPEAKER_04

Thank you, Mr. Chairman. When we talk about DEI, we tend to focus on an ideological or a partisan perspective. But I am more concerned about the practical consequences that anti-DEI policies can have on US citizens on the US mainland and on what concerns me the most, which is Puerto Rico, the Commonwealth of Puerto Rico, which I represent here in Congress. Puerto Rico has officially two languages, but in practice, we all speak Spanish in our everyday lives. And unfortunately, in my opinion, a significant majority of Puerto Ricans do not speak English, even in government among government employees, which brings me to the following. We have a history of cyberattacks in the island against the Puerto Rico government, where we have had the collaboration of the US federal government in addressing these cyberattacks. In light of the anti-DEI agenda, Mr. Stier, how do you see the impact of this agenda in Puerto Rico, given that the government operates predominantly in Spanish?

Mr Max StierSPEAKER_22

I'm sorry that I don't think I can really speak directly to the impact on Puerto Rico with any expertise. I

Rep. Pablo Hernandez (D-PR)SPEAKER_04

would— Well, then sorry, I'll broaden the question. Having a diverse federal workforce helps the federal government collaborate. Let's assume diverse means Spanish-speaking. Or familiar with Hispanic cultures will enable them to work more effectively with a Spanish-speaking government official. Do you see that having any potential consequences in cybersecurity efforts and partnerships?

Mr Max StierSPEAKER_22

As we covered earlier, I do think that it's fundamental to draw best-in-class talent from all communities, and that requires investment to make sure that that can happen. We've heard this in terms of rural areas versus urban areas. This is true across the board. We do have an incredible gap that we're trying to close. It's getting larger, not smaller, in my view, so we need to work harder. I think fundamental to that will be intense efforts to get talent from everywhere. To that extent, the back half too is create environments that enable people to provide their best, no matter who they are, and that's part of the responsibility of good leaders and good culture.

Rep. Pablo Hernandez (D-PR)SPEAKER_04

Would you agree that beyond any ideological or partisan concern, it can just be simply practical to have a diverse workforce?

Mr Max StierSPEAKER_22

100%. Look, I think that this is the focus that I'm trying to stay on, is the practicality here. There's a lot to to be done. It has huge consequence in ensuring that you have, you know, best-in-class talent from everywhere. And again, environments that enable your people to perform no matter who they are. That is just, you know, good management and effective— in the federal context, effective use of taxpayer dollars.

Rep. Pablo Hernandez (D-PR)SPEAKER_04

Well, thank you, and I yield the remainder of my time.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize the gentlelady from South Carolina, Mrs. Biggs, for 5 minutes' questioning.

Rep. Sheri Biggs (R-SC)SPEAKER_26

Thank you, Chairman Green, for holding this important hearing today, and thank you to all of our witnesses for your testimonies. I believe that while cybersecurity vulnerabilities affect all communities, the unique challenges faced by South Carolina's 3rd District and similar rural communities around the country make us particularly vulnerable and disproportionately impacted by cyberattacks. So I've heard from electric co-ops and wastewater system operators, as recent as yesterday in my office, and other utility providers that serve hundreds of thousands of my constituents. It is evident that a key component of these challenges is the limited availability of a local, readily accessible professional cybersecurity workforce. Providers in rural areas like in my district—Greenwood, Newberry, Abbeville, Oconee, and McCormick—they frequently lack the funding necessary to implement robust cybersecurity infrastructure and training. Furthermore, they struggle to attract and to retain qualified cybersecurity professionals, who are often drawn to larger urban centers with more lucrative opportunities. So with this combination of limited resources and a shortage of skilled personnel, it leaves our rural communities particularly vulnerable to malicious actors seeking to exploit their digital weakness. So because of the heightened vulnerability of rural communities and critical infrastructure sectors to cyberattacks, I find the CYBER PIVOT Act's emphasis on placing cybersecurity interns in these areas particularly compelling. So this focus addresses a critical need, bridging the cybersecurity skills gap where it's most acutely felt. As a proud original cosponsor of this legislation, I believe that the strategic placement of these individuals represents a promising approach to strengthening our nation's cybersecurity resilience, particularly in the areas that need it most. So in addressing Mr. Jones, from your perspective, what critical hands-on skills can entry-level talent learn from interning with a utility company like those in your co-op? And the second question I'd like to tag on to that is, in return, how can interns provide value to your workforce?

Mr. Chris JonesSPEAKER_10

Congresswoman, thank you for the question, and you summarized a lot of our concerns very well. So, yes, the— so internship opportunities, I think the skills that they could glean would be real-world and and technical, certainly. But something that speaks to the latter— to your second question, I should say— in in addition to that is that we tend to be able to, when we expose people to what an electric co-op is and the virtues of service, again, we're good jobs in rural areas. If we expose them to what we do, we are able to show them about who we are, and we can often win people, especially younger people who want purpose in what they do, because we have an incredible purpose as part of our organization. So I think that those internship programs will provide well-rounded opportunities for them, but allow us to expose who we are. And we've done this for a long time. When you think about classically what a co-op student is, it's— you think of an engineering student that comes to the utility and learns more about engineering, is mentored. The same thing can happen with this and through the PIVOT Act, I believe. And so, we're excited about that.

Rep. Sheri Biggs (R-SC)SPEAKER_26

So have you found that keeping those individuals, what would be your perspective on that, retaining good quality?

Mr. Chris JonesSPEAKER_10

So in terms of trying to retain those individuals, again, I think that there's something to be said for the virtue of our mission and purpose, but, understanding what the market is demanding from the standpoint of salary and benefits, we have to do our best to get those right, and that's a challenge that we have. So we look to any suggestions that others have in that regard, but it's something that we're working very hard to do. And again, we collaborate so well within the cooperative community. These are conversations we're having routinely. Today at MTE, we're having a meeting with a number of TVA electric cooperatives and municipal systems talking about this very issue too. So it's something we're serious about, but it's a bigger issue than we are. So we're happy to have conversations and get advice from others.

Rep. Sheri Biggs (R-SC)SPEAKER_26

Thank you so much, and my time's up, so I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentlelady yields. I now recognize the gentleman from Texas, Mr. Turner. Appreciate you, and fire away. 5 minutes.

Rep. Sylvester Turner (D-TX)SPEAKER_24

Thank you, Mr. Chairman. I think we can all agree, regardless of whether we're Democrats or Republicans, that the cybersecurity threats are increasing, that we're in a major crisis that we need to address. I think we can all agree on that. I will tell you that over the last few days, I have gotten a number of calls from people in Houston—and as a former mayor of Houston—concerned about the payment system, their Social Security information, medical information, tax information. Will you agree with me that when you're sending this information from various sources that it's important to have the right checks in place to make sure that you don't make us more vulnerable to these cyberattacks? Is that important, a consideration that's taking place? And so that's what I'm hearing from people. As we talk about cybersecurity—we're talking about it today—they know it's getting worse, and they are concerned, who has my information? And Congressman Turner, is it secure? And I'm having a hard time explaining that to them. Another point that I want to ask: It is important, would you agree, that we train the existing workforce within the federal government throughout the entire federal system? That's important. And I do think it's important to do everything we can to make sure that that training occurs. But Mr. Russomanno, you made a comment that said young people need to see themselves in these fields. And then Mr. Rashotte, you said we need to break down the barriers of training. And with there being 500,000 people short in this area in the United States, we agree that we need to be very intentional in recruiting, training, bringing people into into this space. And it shouldn't be where, for example, you mentioned K through 12, colleges and universities, community colleges, technical schools, but that also includes historically Black colleges and universities as well in terms of reaching out to them and bringing them into this space. Would you agree? And I think you all also agree that you could be Black, White, or Brown, you could be from urban America or rural America, your qualifications are not diminished by who you look like or geographically where you come from, but rather, I would argue, the entire conversation of protecting us in the future is strengthened when we have people coming from all sectors of America. Any disagreement on that? So when people argue that if you're diverse— I'm an African American, and I go through the training, I go to your schools, I'm educated, I'm prepared. And if I am in this space, it doesn't mean that I'm incompetent. It doesn't mean that I'm unqualified. Quite frankly, those arguments help to discourage people from moving into these spaces. Would you agree with that? Any disagreement on that? And that's why I am concerned with this conversation about diversity, equity, and inclusion. What I have found in my lifetime is that it's important to have people coming from all walks of life, which strengthens our organization. It doesn't diminish them. It strengthens our organizations. So, Mr. Russomanno, since you made the point that it's important for people to see themselves in these fields, could you elaborate on that for me?

David J. Russomanno, PhDSPEAKER_17

Well, Congressman, thank you so much for your comments, and I agree with you. We need to embrace everyone from all walks of life, all backgrounds. At the University of Memphis, we're particularly proud of our very diverse student body, significant African American population. In some cases, I think we are looking at where we need to reframe how potential outreach is described. And if I think that we look at areas like first-generation students, students that have significant unmet financial need, we can impact many of the populations that you've been discussing. So I agree with your comments.

Rep. Sylvester Turner (D-TX)SPEAKER_24

Thank you. I yield back, Mr. Chairman.

Chairman Mark Green (R-TN)SPEAKER_16

gentleman yields. I now recognize Mr. Knott for 5 minutes, the gentleman from North Carolina, for his 5 minutes of—

Rep. Brad Knott (R-NC)SPEAKER_13

Thank you, Mr. Chairman. Um, I'll start with you, Dr. Russomanno. If you had to describe the current state of the the cybersecurity ecosystem, would you would you describe it as one that's lacking in personnel exclusively, or are those who are in the space right now here in the United States, are they lacking in a skill set? Are they lacking in advancement? Are we being outpaced on that front as well?

David J. Russomanno, PhDSPEAKER_17

Thank you for your question. I think frankly it's a combination of both, although the data, data is very compelling regarding the need to grow our workforce. I think that data is very very clear. However, if you look at certain circumstances where industry in particular is going after mid and advanced level cybersecurity professionals, that also speaks to a gap in terms of the knowledge and abilities of our workforce.

Rep. Brad Knott (R-NC)SPEAKER_13

Okay, Mr. Jones, in terms of of servicing rural communities and sort of outside the urban areas, describe how cybersecurity plays a role and and the threats that you face. And also, and secondly to that, how is the threat increased if people come here to the United States outside of the law, outside of us being aware of it, in terms that they have physical access to your facilities that you represent?

Mr. Chris JonesSPEAKER_10

Yes, sir. Uh, Congressman, thank you. So one thing I would touch on, uh, I believe to the first part of your question, um, the, the fa— the, the threats we face Something we haven't talked so much about today that I would like to if I could is that it's not just an issue of technology process and specific cybersecurity resources. It is, but it's also about a culture of cybersecurity within the organization because, and my colleagues would know better than I probably, but as far as most of the incidents we see, they're intrusions, that have resulted from an email lapse of some kind. Someone clicks on the wrong thing. So making sure that our employees— we have a culture of safety, we have to have a culture of cybersecurity awareness as well,

Rep. Brad Knott (R-NC)SPEAKER_13

right?

Mr. Chris JonesSPEAKER_10

And making sure that we're facilitating that throughout the organization is very important,

Rep. Brad Knott (R-NC)SPEAKER_13

right? But protecting your facilities physically is also important for cybersecurity as well. They're not all overseas, correct? If we, if we have cybersecurity criminals that are here illegally in this country That makes— that adds a layer of vulnerability to the systems that

Mr. Chris JonesSPEAKER_10

serve us. Yes, sir, that's right, and we're watching that as well. That's the other component to it. I would say, if I could speculate, with regard to the risks, you know, cybersecurity is one that we're keenly concerned about, we're most concerned about, but the physical pieces as well. We have to have, again, equipment, processes, people in place to safeguard against that potential as well. It's very real.

Rep. Brad Knott (R-NC)SPEAKER_13

Yep. Now, Mr. Stier—it's Stier, correct? Great. Just briefly, one thing that is upsetting in this job is the speaking with broad brushes, and that's unfortunate for our dialogue. I think specificity is is the best way forward. And as a former federal employee, I was a federal prosecutor, I'm somewhat troubled by the dialogue, and it could, obviously, it's inhibited by time, but to say that all civil servants are uniformly described as excellent in their craft, eager to better themselves while they're employed, proficient in serving the taxpayers above all else, or highly focused and patriotic in the execution of their duties, that is certainly true for some. As a prosecutor, I worked with agents at just about every agency. We had great agents, and we had some that were there that you don't know what they did all day.

Mr Max StierSPEAKER_22

Yep.

Rep. Brad Knott (R-NC)SPEAKER_13

And part of maintaining efficiency and effectiveness, I think you would admit and agree with me— not admit, I'm not trying to extract it— but

Mr Max StierSPEAKER_22

yes,

Rep. Brad Knott (R-NC)SPEAKER_13

is figuring out efficient—

Mr Max StierSPEAKER_22

I agree 100%.

Rep. Brad Knott (R-NC)SPEAKER_13

Yes. Yes. And figuring out ways to, to constructively remove those who are not motivated.

Mr Max StierSPEAKER_22

100%.

Rep. Brad Knott (R-NC)SPEAKER_13

And one of the frustrations I had in the federal workforce is when there were people who were partners or people you had to work with in other agencies, um, firing just was not an option, or removing them. And if you did cross that threshold, immediate litigation and burdensome, burdensome countersuits would have been implemented. So given the threat of cybersecurity and the need to maintain a professional, efficient, and effective workforce, how can we better extract those who are not focused?

Mr Max StierSPEAKER_22

100%. And I entirely agree with you. Like all workforces, they're better and worse. And I think that the federal government more broadly has not had effective focus on these kinds of management issues. So there are some system changes that ought to take place. It's too complicated to actually fire people. You have to decide depending on, you know, what the issue is, where you go. That could actually be streamlined in a very profound way. The thing that would change it the most would be actually to get managers better trained on doing the performance evaluation that you're describing and to have leaders that actually actually support their management to get rid of the poor performers, because right now it's easier to ignore the problem than to address the problem. So the rules can improve things, but it ultimately is a management responsibility, and that focus is by and large not there.

Rep. Brad Knott (R-NC)SPEAKER_13

Okay. All right, Mr. Chairman, I'm over. I yield

Chairman Mark Green (R-TN)SPEAKER_16

back. The gentleman's time has expired. I now recognize the ranking member for his closing statement.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

Thank you, Mr. Chairman. First let me thank our witnesses. Thank you for being here for a little while, but it's still shorter than most hearings. So there are some benefits. Mr. Chair, I ask unanimous consent for the record to be included the following documents: an article in CyberScoop entitled, "Cybersecurity, government experts are aghast at security failures at DOGE takeover"; a copy of a letter committee Democrats have sent to OPM regarding the impact of the hiring freeze on federal cyber workforce; a copy of the letter committee Democrats have sent OMB on security threats DOGE poses to federal networks;

Chairman Mark Green (R-TN)SPEAKER_16

Uh, without objection, so ordered.

Ranking Member Bennie Thompson (D-MS)SPEAKER_01

I also want to thank, again, our witnesses for coming and testifying today and sharing their expertise. I was a long years ago an instructor, and those of you who are in education, you have my heartfelt support and sympathy for the talent and challenges you have. It's indeed a challenge. I have rural electric co-ops in my district, and one of the things this government committed to was having electricity to every house in America. And it could not have been accomplished had it not been for rural electric co-ops. So I thank you for that work. And, but I also know that all of you take this topic of cybersecurity very seriously. But I'm sorry for Mr. Stier for that unjustified treatment that you received from Congressman Green. You're a witness for this committee, and we owe all our witnesses a certain amount of courtesy. You did not deserve what you received. And if not from anybody else, I apologize. We're better than that. We should not antagonize people who we invite into this great institution to offer their expertise. And so for that, I just want you to say that I appreciate all of you for being here, but I don't like people being maligned by any member of this committee. So, Mr. Chairman, the goal of building a robust cyber workforce is to improve the security of our networks, infrastructure owned by both the government and the private sector. As we sit here today, Elon Musk and his DOGE team are rifling through America's data and accessing agency networks, all while ignoring federal information security and privacy laws, and the majority is silent about it. We can't jump up and down about the cyber threats posed by China and the need to build a cyber workforce to defend against them, while at the same time allowing unchecked access to the federal networks. I urge my colleagues on the other side of the aisle to stop pretending like it's business as usual and take these threats seriously. We all appreciate the urgency of addressing the cyber workforce shortage. China and other adversaries are trying to hack our government and critical infrastructures every day, but the Trump-Musk administration war on the federal workforce is putting our national security at risk. While Trump's vague executive orders may have theoretical exceptions for national security, its application across the federal government has clearly impacted cybersecurity positions. For example, a search on the USAJOBS website shows that there's a hiring freeze in place at CISA right now. And in the administration's reckless rush to force out federal employees, they sent their resignation letter to CISA employees, only clarifying later that they were not eligible. Mr. Stier example in his opening statement of a student in the CyberCorps: Scholarship for Service demonstrates just how serious the impact these policies have had on people seeking to join the federal cyber workforce. Again, I thank the witnesses for their time, and I hope all members of the committee join together to push back on the Trump administration's dangerous policies toward the federal cyber workforce. Our nation's security depends on it. I yield back.

Chairman Mark Green (R-TN)SPEAKER_16

The gentleman yields. I now recognize myself for a closing statement. First, I'd like to mention to everybody, sort of an announcement, I guess. We just got another commendation from IBM to support the PIVOT Act, another stakeholder.

SPEAKER_UNKNOWN

I

Chairman Mark Green (R-TN)SPEAKER_16

If you look at the list of these companies that thought today's hearing and today's—the discussion about this bill was really an important thing, you'd wonder why all the people over here were so critical, and some called it even a stupid hearing. But I digress. I guess those companies are all going the wrong way. They're not, of course, and we appreciate the support, despite what the left side of this committee has said today. In closing, I want to thank our witnesses for their informative testimony. I really appreciate all of you sharing your comments. The cyber threat environment continues to evolve, and it's a huge risk to our country. The fact that Volt Typhoon, Salt Typhoon are where they are or where they've been should scare the hell out of every American. And we have a massive shortage of people. And as we looked over the past—my first term as chairman, we identified the priorities. What are the—what is the—and this is the workforce shortage is number one. And that's why this committee, last week's committee, focused on cyber, the first of this Congress and this committee's. Nation-state actors like China, Russia, Iran routinely target critical networks, businesses in both private and public sectors, and it's vital that we scale the workforce up. I am disappointed that some seem concerned about criticizing efforts to create much-needed efficiency and improvement within the federal government and the actual misallocation of massive taxpayer funds that could have gone to cybersecurity. Today's hearing and the Cyber PIVOTT Act are focused on leveraging flexible approaches to close talent gaps and improve our cyber workforce using lessons and approaches from the private sector. I think we would all agree that developing our cyber workforce should be much higher priority than spending $25 million to promote green transportation in the country of Georgia or spending taxpayer dollars teaching journalists in Sri Lanka to avoid using binary gender language, or to take another example, the federal government spending $2 million to promote Moroccan pottery classes, another $2 million to promote tourism in Lebanon, which is under a travel warning from the State Department, all discovered by the very organization that nearly every member of that side of the committee spent today's committee hearing talking about when we're here to talk about this massive cyber shortage and risk to our country.

SPEAKER_UNKNOWN

Um,

Chairman Mark Green (R-TN)SPEAKER_16

these are just the tip of the iceberg. Someone told me as I was walking in this morning, we sent $49 million to Guatemala to build a gas station that never got built. Thank God someone's figuring this out. The corruption that's happened— of course they want to jump up and down and say somebody's not supposed to be here. A guy, by the way, who builds rockets for NASA and has a top-secret security clearance. I'll just correct the record on that. When you bring efficiency to government, you invest in the core needs of government. What is a core need of government? Cybersecurity. The enemy has invaded our infrastructure and our telecommunications networks. We need every penny we've got to go toward things like the PIVOT Act. Our approach to Cyber PIVOT Act has received significant support from the cybersecurity community, trade organizations, businesses. We've talked about this. I look forward to making this bill become law this Congress, because our nation needs it. And even the witness from the other side agreed with that. And I'll make a quick comment about when you're in a committee hearing as a witness. The representative owns their time. Mr. Stier, if you were offended, I apologize, but they own their time. And in this committee room and in every committee room, I've seen this happen many times where someone shuts down the witness to say what they want to say. So we gaveled down people in this committee on my side of the aisle when they did cross the line and attack the witnesses verbally with character. I didn't see that happen today, and so we let that continue. But it is interesting how the politics of this place works and what the rules really are. But I want to catch you after this so I can talk with you in person. I want to again thank the witnesses for being here, the members for their questioning. This hearing