MILITARY CYBER PERSONNEL Opportunities Exist to Improve Service Obligation Guidance and Data Tracking Report to Congressional Committees December 2022 GAO -23-105423 United States Government Accountability Office United States Government Accountability Office Highlights of GAO -23-105423 , a report to congressional committees December 2022 MILITARY CYBER PERSONNEL Opportunities Exist to Improve Service Obligation Guidance and Data Tracking What GAO Found The Navy and the Air Force have guidance requiring a 3-year active- duty service obligation for military personnel who receive lengthy and expensive advanced cyber training . This training prepares personnel to fill the Interactive On-N et Operator (ION) work role , identified as critical by U .S. Cyber Command (USCYBERCOM). In contrast, the Marine Corps does not have such guidance. Additionally, t he Army’s guidance does not clearly define active duty service obligations . Rather, it sets general service obligations based on the length of training. Using the Army’s guidance, GAO estimate d that active -duty officers receiving ION training may incur a service obligation of about 1.88 years. However, Army officials stated that they lacked the information needed to calculate and implement service obligations for ION training because it is not specifically listed in Army guidance. Army, Marine Corps, and USCYBERC OM officials acknowledged that guidance with clearly defined service obligations for ION training would create a better return on investment for this critical cyber work role. The Army and the Marine Corps have taken steps to clearly define service obligat ions for ION training , but officials did not know when or if the guidance would be implemented. Until the revised guidance is implemented, the Army and the Marine Corps are unnecessarily lim iting their return on investment in ION training. Years of Service Obligation Required in Military Service Guidance for Interactive On- Net Operator (ION) Training aGAO estimated these potential obligations, in part based on Army guidance, but ION training is not specifically listed in that guidance making this requirement challenging to implement, according to Army officials bAccording to Navy documentation and Marine Corps officials, only enlisted personnel in those military services are eligible to train for the ION work role. Staffing gaps —the difference between the number of personnel authorized and the number of personnel staffed—existed in some active-duty cyber career fields from fiscal years 2017 through 2021. Specifically, most of the Navy, Army, and Air Force cyber career fields were staffed at 80 percent or higher compared with the number of authorized personnel. However, four of the six Marine Corps career fields were below 80 percent of authorized levels in fiscal year 2021. While the military services track cyber personnel staffing levels by career fields, USCYBERCOM uses work role designations to assign personnel to cyber mission teams. However, the Army, Air Force, and Marine Corps do not track staffing data by work role. As a result, military service officials cannot determine if specific work roles are experiencing staffing gaps. Tracking staffing data at the work role level would enable the military services to identify and address staffing challenges in providing the right personnel to carry out key missions at USCYBERCOM. This information is also essential for increasing personnel assigned to USCYBERCOM as planned by the Department of Defense (DOD). View GAO -23-105423 . For more information, contact Brenda S. Farrell at (202) 512- 3604 or [email protected] . Why GAO Did This Study To accomplish its national security mission and defend a wide range of critical infrastructure, DOD must recruit, train, and retain a knowledgeable and skilled cyber workforce. However, DOD faces increasing competition f