“(a) In General.—The head of each Federal agency shall—“(1) identify all positions within the agency that require the performance of cybersecurity or other cyber-related functions; and
“(2) assign the corresponding employment code under the National Initiative for Cybersecurity Education in accordance with subsection (b).
“(b) Employment Codes.—“(1) Procedures.—“(A) Coding structure.—Not later than 180 days after the date of the enactment of this Act [Dec. 18, 2015], the Director, in coordination with the National Institute of Standards and Technology, shall develop a coding structure under the National Initiative for Cybersecurity Education.
“(B) Identification of civilian cyber personnel.—Not later than 9 months after the date of enactment of this Act, the Director, in coordination with the Secretary of Homeland Security, the Director of the National Institute of Standards and Technology, and the Director of National Intelligence, shall establish procedures to implement the National Initiative for Cybersecurity Education coding structure to identify all Federal civilian positions that require the performance of information technology, cybersecurity, or other cyber-related functions.
“(C) Identification of noncivilian cyber personnel.—Not later than 18 months after the date of enactment of this Act, the Secretary of Defense shall establish procedures to implement the National Initiative for Cybersecurity Education’s coding structure to identify all Federal noncivilian positions that require the performance of information technology, cybersecurity, or other cyber-related functions.
“(D) Baseline assessment of existing cybersecurity workforce.—Not later than 3 months after the date on which the procedures are developed under subparagraphs (B) and (C), respectively, the head of each Federal agency shall submit to the appropriate congressional committees of jurisdiction a report that identifies—“(i) the percentage of personnel with information technology, cybersecurity, or other cyber-related job functions who currently hold the appropriate industry-recognized certifications as identified under the National Initiative for Cybersecurity Education;
“(ii) the level of preparedness of other civilian and noncivilian cyber personnel without existing credentials to take certification exams; and
“(iii) a strategy for mitigating any gaps identified in clause (i) or (ii) with the appropriate training and certification for existing personnel.
“(E) Procedures for assigning codes.—Not later than 3 months after the date on which the procedures are developed under subparagraphs (B) and (C), respectively, the head of each Federal agency shall establish procedures—“(i) to identify all encumbered and vacant positions with information technology, cybersecurity, or other cyber-related functions (as defined in the National Initiative for Cybersecurity Education’s coding structure); and
“(ii) to assign the appropriate employment code to each such position, using agreed standards and definitions.
“(2) Code assignments.—Not later than 1 year after the date after the procedures are established under paragraph (1)(E), the head of each Federal agency shall complete assignment of the appropriate employment code to each position within the agency with information technology, cybersecurity, or other cyber-related functions.
“(c) Progress Report.—Not later than 180 days after the date of enactment of this Act, the Director shall submit a progress report on the implementation of this section to the appropriate congressional committees.