Expanding Cybersecurity Workforce Act of 2025
- Sponsor
- Rep. Brown, Shontel M. [D-OH-11]
- Committees
- Homeland Security Committee (primary)
- Last action
- Dec 5, 2025
Bottom line
The bill aims to expand the cybersecurity workforce by actively recruiting and training individuals from underrepresented and disadvantaged communities through a CISA-led program.
What it actually does
This bill establishes a new program within the Cybersecurity and Infrastructure Security Agency (CISA) to promote the cybersecurity field to various disadvantaged communities. It mandates outreach efforts to diverse institutions and requires the program to be tailored to regional and sectoral needs. The bill also authorizes $20 million annually for the program from fiscal year 2026 through 2031.
Proponents argue
Supporters argue that this bill is crucial for addressing the significant cybersecurity workforce shortage by tapping into diverse talent pools that have historically been overlooked. They contend that by focusing on disadvantaged communities, including veterans, individuals with disabilities, and those from nontraditional educational paths, the bill will enhance national security and economic competitiveness while promoting equity and opportunity.
Opponents contend
Critics might argue that while the goal is laudable, establishing a new program within CISA could lead to bureaucratic inefficiencies or overlap with existing initiatives. Some may also raise concerns about the effectiveness of federal agencies in direct workforce development, suggesting that such efforts might be better handled by educational institutions or private sector partnerships with federal oversight rather than direct program implementation.
The bill is very short and clear, making it highly accessible for a reader to understand its provisions and implications quickly.
Section 2(a)
Establishment of Cybersecurity Promotion Program
This provision directs the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to establish a new program within 180 days of enactment. This program will specifically promote careers in the cybersecurity field to various disadvantaged communities, including older individuals, racial and ethnic minorities, people with intellectual or developmental disabilities, geographically and socioeconomically diverse communities, women, veterans, individuals from nontraditional educational paths, and formerly incarcerated individuals.
Supporters argue
Proponents argue this provision is essential for diversifying the cybersecurity workforce and addressing critical skill gaps by intentionally reaching out to underrepresented populations. They believe it will foster a more robust and resilient national cybersecurity posture.
Critics contend
Opponents might express concern that while well-intentioned, the broad scope of 'disadvantaged communities' could dilute focus or lead to administrative challenges in tailoring effective outreach to such a wide array of groups. No specific organized opposition is typically raised against the general principle of workforce development.
Tradeoffs
The provision balances the need for a broad, inclusive approach to workforce development with the potential administrative complexity of effectively serving many distinct disadvantaged groups.
Section 2(b) and (c)
Outreach and Program Tailoring Requirements
These subsections mandate that CISA conduct extensive outreach to various institutions, such as educators, unions, chambers of commerce, and community colleges, to raise awareness of the cybersecurity workforce and the new program. Furthermore, CISA is required to tailor the program to meet the unique needs of different regions and sectors across the United States, ensuring its relevance and effectiveness in diverse local contexts.
Section 2(e)
Authorization of Appropriations
This provision authorizes an appropriation of $20,000,000 to CISA for fiscal year 2026 and for each subsequent fiscal year through 2031. This funding is specifically designated to support the establishment and operation of the new program aimed at promoting the cybersecurity field to disadvantaged communities.
The bill provides a detailed definition of 'nontraditional educational path,' which includes graduates of two-year degree programs, trade schools, community colleges, Historically Black Colleges and Universities (HBCUs), Hispanic-serving institutions, Tribal Colleges or Universities, Alaska Native-serving institutions, Native Hawaiian-serving institutions, Predominantly Black Institutions, Native American-serving, nontribal institutions, and Asian-American and Native American Pacific Islander-serving institutions.
Section 2(f)(3)
Why it matters:This is standard legislative practice for defining terms used throughout the bill, ensuring clarity and legal precision rather than being evasive.
Case for: Supporters argue that this comprehensive definition is crucial for ensuring the program genuinely targets a wide array of institutions that serve diverse student populations, thereby maximizing the bill's intended inclusive impact on workforce development.
Case against: No specific case against this detailed definition is typically raised, as it clarifies the scope of the program's beneficiaries. Some might argue that such a specific list could inadvertently exclude other valuable educational pathways, but the intent is clearly inclusive.
Estimated impact: Significantly broadens the scope of educational institutions and pathways eligible for the program's outreach and benefits, impacting a large number of potential participants.
The term 'disability' is specifically defined as an 'intellectual or developmental disability' for the purposes of this Act.
Section 2(f)(1)
Why it matters:This is standard legislative practice for providing precise definitions, ensuring the program's focus is clear. It is not necessarily evasive but narrows the scope from a general understanding of 'disability'.
Case for: Proponents might argue that this specific definition allows the program to focus resources and tailor interventions more effectively for individuals with intellectual or developmental disabilities, who may face unique barriers to entering the cybersecurity field.
Case against: Critics might argue that by limiting the definition of 'disability' to only intellectual or developmental disabilities, the bill excludes individuals with other significant disabilities (e.g., physical, sensory) who could also benefit from and contribute to the cybersecurity workforce. This narrow definition could be seen as missing an opportunity for broader inclusivity.
Estimated impact: Narrows the scope of individuals with disabilities eligible for the program's specific outreach and benefits, focusing on a particular subset of the disabled community.