15 U.S.C. § 7442 — Federal Cyber Scholarship-for-Service Program

(a) In general: The Director of the National Science Foundation, working with the Office of Personnel Management and the Secretary of Homeland Security, must keep running a federal scholarship program that recruits and trains information technology professionals, industrial control system security experts, and security managers for federal, state, local, and tribal cybersecurity work. (b) Program description and components: The program must: (1) give scholarships, through qualified colleges (including community colleges), to students working toward degrees or certificates in cybersecurity or related fields like artificial intelligence, quantum computing, and aerospace; (2) give scholarship recipients summer internships or other real work experience in federal IT and cybersecurity jobs; (3) prioritize placing recipients so that (A) at least 70 percent go to work at an executive agency, (B) no more than 10 percent become cybersecurity educators at scholarship-granting colleges, and (C) no more than 20 percent go to the other kinds of jobs listed in (d)(2) through (d)(5); and (4) fund awards to improve K-12 cybersecurity education — including summer camps and teacher training in every state — to (A) build interest in cybersecurity careers, (B) teach students safe online habits and cybersecurity basics, (C) improve how teachers deliver cybersecurity content, and (D) recruit more cybersecurity teachers. (c) Scholarship amounts: Each scholarship covers the student's tuition and fees for up to three years, plus gives the student an extra stipend. (d) Post-award employment obligations: As a condition of the scholarship, each recipient must agree to work — for the same length of time as the scholarship lasted — after finishing their degree, in a cybersecurity job at: (1) an executive agency; (2) Congress or a legislative-branch agency, entity, office, or commission; (3) an interstate agency; (4) a state, local, or tribal government; (5) a state-, local-, or tribal-affiliated nonprofit that counts as critical infrastructure; or (6) a qualified college, as allowed under (b)(3)(B). (e) Hiring authority: (1) Appointment in excepted service. Normally, federal jobs go through a competitive process, but an agency must instead directly appoint a person who finished the degree program their scholarship paid for. (2) Noncompetitive conversion. Except where (4) applies, once the person finishes their service term, the agency can move them, without competition, to a regular career or career-conditional job. (3) Timing of conversion. The agency can make this move even before the person's term appointment officially ends. (4) Authority to decline conversion. The agency can refuse to make this move for cause. (f) Eligibility: To get a scholarship, a person must: (1) be a U.S. citizen or lawful permanent resident; (2) show real commitment to a career improving information technology security; (3) show a high level of relevant skill, as defined by the awareness program under section 7443; (4) be a full-time student in a qualifying degree program — except a community college student can be part-time, as long as it's at least half-time; (5) sign an agreement accepting the work obligation in (d); (6) accept the funding conditions in (g); and (7) accept all the scholarship's terms and conditions. (g) Conditions of support: (1) In general. As a condition of the scholarship, the recipient must agree to give the Office of Personnel Management and the National Science Foundation yearly proof of their post-scholarship employment and up-to-date contact information. (2) Terms. The recipient becomes liable to repay under (i) if they: (A) fail to keep an acceptable academic standing; (B) get kicked out of school for discipline reasons; (C) drop out of the degree program before finishing; (D) say they don't intend to do the required work service; (E) fail to meet the post-graduation obligations in any other way; or (F) fail to meet the reporting requirement in (1). (h) Monitoring compliance: As a condition of taking part, a qualified college must: (1) sign an agreement with the National Science Foundation to track whether its scholarship recipients meet their work obligations; and (2) give the National Science Foundation and Office of Personnel Management yearly proof of recipients' post-scholarship employment, required under (g)(1), until the work obligation is done. (i) Amount of repayment: (1) Less than 1 year of service. If a problem listed in (g)(2) happens before the recipient finishes one year of required work, they must repay the full scholarship amount — either directly, or as a loan under (j). (2) 1 or more years of service. If the problem is one of the reasons in (g)(2)(D) or (g)(2)(E), and it happens after the recipient has finished a year or more of required work, they must repay the scholarship amount reduced in proportion to how much service they already completed — again, either directly or as a loan under (j). (j) Repayments: Any loan under (i) is treated as a Federal Direct Unsubsidized Stafford Loan, and must be repaid with interest — building up from the date of the scholarship award — under rules the National Science Foundation sets, after talking with the Secretary of Education. (k) Collection of repayment: (1) In general. If a recipient owes repayment, the college that gave the scholarship must (A) figure out how much is owed and tell the recipient, the National Science Foundation, and the Office of Personnel Management, and (B) collect the money within a time the National Science Foundation sets — or else it turns into a loan under (j). (2) Returned to Treasury. Except as (3) allows, any money collected this way goes back to the U.S. Treasury. (3) Retain percentage. A college may keep a set percentage of what it collects, to cover its collection costs. The National Science Foundation sets one fixed percentage that applies to every college. (l) Exceptions: The National Science Foundation Director may partly or fully waive or pause a recipient's service or repayment obligation if meeting it is impossible, would cause the person extreme hardship, or would be unfair to enforce. (m) Public information: (1) Evaluation. The Director, with the Office of Personnel Management, must regularly check and publish — while protecting recipients' personal information — how well the program recruits and keeps people in public-sector cybersecurity jobs, including (A) placement rates, (B) where students end up working, including job titles, (C) salary ranges for students who aren't released from their obligation, (D) how long after graduation students get placed, (E) how long they stay in their first job, (F) how many students get released from their obligation, and (G) what extra training, if any, is needed. (2) Reports. At least once every two years, the Director, with the Office of Personnel Management, must send Congress a report covering (A) the results of the evaluation in (1), (B) any mismatch between what recipients and their colleges each report, and (C) recent statistics on the size, makeup, and education needs of the federal cyber workforce. (3) Resources. The Director, with the Office of Personnel Management, must provide easy-to-use online resources for prospective applicants, including — as much as practical — (A) searchable, current, accurate information about participating colleges and cybersecurity job openings, and (B) an up-to-date description of cybersecurity careers.