OPM's Cyber Rotation Program: 634 Applied, 8 Finished
Summary
A July 16, 2026 audit from the Government Accountability Office found that OPM's Federal Rotational Cyber Workforce Program -- created by Congress in 2022 to let federal cybersecurity employees rotate between agencies and build skills -- drew 634 applications between 2023 and 2026, but only 8 employees were approved to complete a rotation. OPM stopped advertising positions after 2024, has not acted on the five recommendations its own internal review made to itself in 2024, and does not plan to revive the program before its scheduled 2027 sunset.
A skills gap, and a program built to fix it
The Federal Rotational Cyber Workforce Program lets cyber employees at any of the 24 Chief Financial Officers Act agencies -- included -- take a voluntary 6-to-12-month assignment at a different agency, then return to their home job with new skills and a period of required service. The law gave the program two goals: help individual employees develop cyber skills, and get agencies actually talking to each other about how they run cybersecurity. published its operational plan in March 2023 and the program has been running since. As prescribed by the act, it is scheduled to sunset in June 2027.
As of May 2026, 13 of the 24 eligible agencies had participated in some form -- by advertising a position, sending an employee on one, or both. Eleven agencies advertised a combined at least 106 positions over the program's life. One participant is worth naming specifically: itself, the agency running the entire program, posted at least one rotational opening but never had an employee of its own complete a rotation elsewhere -- the only agency of the 13 for which that's true in both directions at once.
View data as table
| 2023 | 75 | 10 agencies posted opportunities |
|---|---|---|
| 2024 | 31 | 7 agencies posted opportunities |
| 2025 | 0 | No agency posted a rotational opening |
| 2026 | 0 | OPM does not anticipate any agency will post one |
634 applied. Eight got through.
and agencies advertised at least 75 rotational positions in 2023 and at least 31 more in 2024 -- then nothing. Zero positions were posted in 2025; told the Open Opportunities site the program relied on had simply gone dark, with a vague plan to move advertising to a different government platform, Connect.gov. Zero were posted in 2026 either: said it never obtained a Connect.gov account, citing budget constraints, and does not intend to invest further resources in the program before its statutory sunset. 's own Fast Facts summary⧉ calls this what it is: has effectively halted a program Congress created and funded, four years before the law requires it to end.
Across the program's whole run, 634 employees submitted applications to their home agency for a chance at a rotation. Eight were approved. 's own review names four reasons: applicants who skipped the required home-agency approval step before applying, applicants who were simply underqualified, contractors who applied despite being ineligible, and home agencies that found it easier to keep cyber talent working in-house than to let it rotate out. That last reason has a structural partner: of the positions could grade, only 5 were posted at the entry-level GS-9 grade, while 104 required GS-12 or higher -- a program marketed as a skills-development opportunity was, in practice, built almost entirely for people who already had the skills.
View data as table
| GS-9 (entry-level) | 5 |
|---|---|
| GS-12 and above | 104 |
OPM diagnosed the failure, then didn't act on its own diagnosis
didn't need to tell it any of this. In October 2024, ran its own internal evaluation of the program and reached largely the same conclusions: too few qualified applicants, and too little awareness of the program among the managers and HR staff who'd need to support it. then made five recommendations to itself -- advertise lower-graded rotations, push approval authority down to field offices, match agencies' skill gaps to available rotators, write common guidance, and simply tell managers the program exists. None of it happened. told it had not taken steps to address its own recommendations because it was reassessing resource allocation and strategic focus amid shifting government-wide priorities -- the same eighteen months in which it also let the advertising platform lapse and declined to replace it.
's report carries no recommendations of its own. Not because the agency found nothing wrong -- it's the audit that documented all of the above -- but because, as its Fast Facts⧉ put it plainly: ' has effectively halted the program due to a shift in priorities, so we didn't make recommendations.' There is nothing left to recommend fixing. The program Congress built to close a cybersecurity skills gap will spend its final year on the books, before its June 2027 sunset, not advertising a single position.
- Eight employees completed a rotation out of 634 who applied -- about 1.3%, across the program's entire life. 's own Fast Facts describes those same 8 as the total who 'completed rotational assignments,' not a partial-year snapshot.
- diagnosed its own program's failure in October 2024 and made five recommendations to fix it -- then did none of them. It cited 'shifting government-wide priorities' and, in the two years since, let positions drop from 106 to zero.
- The qualification bar likely made the shortage worse, not better. Only 5 of the positions could grade were entry-level GS-9; 104 required GS-12 or above -- a program meant to build cyber skills that mostly required applicants already have them.
's Highlights/Fast Facts summary describes the 8 approved applicants as having "completed rotational assignments to other agencies"; the full report's body text describes the same 8 as "approved to serve in a rotation." This piece treats both as describing the same 8 people, per 's own usage. Separately, 's footnote 13 explains that its General Schedule grade breakdown (5 GS-9 positions, 104 GS-12-and-above, for a total of 109) counts each unique GS level within a multi-grade posting as its own position -- a slightly different counting method than the headline "at least 106 positions" figure, which defaults to the lowest count in any range. Both are 's own numbers, cited here exactly as the report presents them. This piece draws on 's full report (fetched directly from gao.gov, since neither Wayback nor Artemis's own storage yet holds a sealed copy of the PDF) rather than only the two-page Highlights, to source the year-by-year and agency-level detail cited throughout.
Sources(2) ▾
- U.S. Government Accountability Office, Cyber Workforce: Federal Agencies Did Not Widely Adopt Rotational Program -- Full Report (GAO-26-108736) (2026-07-16) — 's full 9-page report, addressed to the Senate Homeland Security and Governmental Affairs Committee and the House Oversight and Government Reform Committee, released and publicly posted July 16, 2026. Fetched directly from gao.gov and read in full. Sourced from it: the program's statutory basis and sunset date (pp.1-3); Figure 1 (required participation steps, p.4); Figure 2, the 13-agency participation table (p.5); the year-by-year advertised-positions breakdown and Figure 3's applicant/position/approval totals (pp.6-7); the GS-grade barrier footnote (p.7); 's four identified reasons for the low approval rate, its October 2024 self-evaluation and five self-directed recommendations, and its decision not to act on them (pp.6-8). Sealed by Artemis's federal-core watchlist at 2026-07-16T14:40Z under document id gao-reports-2026-07-16-cyber-workforce-agencies-did-not-widely-adopt-rotational- (the Highlights/product page only); the full PDF itself is not yet in Artemis's own storage. A Wayback Save Page Now request for this PDF returned no snapshot within the check window (archive.org's availability API showed no archived_snapshots immediately after the SPN request), consistent with the ongoing Wayback-capture gap Artemis's collection state has flagged across recent batches, so the capture link points directly at 's own PDF. gao.gov · original document
- U.S. Government Accountability Office, Cyber Workforce: Federal Agencies Did Not Widely Adopt Rotational Program -- Highlights & Product Page (GAO-26-108736) (2026-07-16) — 's product page for the audit: Fast Facts, Highlights (What Found / Why Did This Study), and contact information. Sealed by Artemis's federal-core watchlist (document id gao-reports-2026-07-16-cyber-workforce-agencies-did-not-widely-adopt-rotational-, captured 2026-07-16T14:40:02.631Z, haiku-pass1-v1 evaluated reliability A, verdict accepted). Used here for the Fast Facts framing that describes the 8 approved employees as having 'completed rotational assignments,' and 's statement that it made no recommendations in this report because has already effectively halted the program. gao.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
In 2022, Congress passed the Federal Rotational Cyber Workforce Program Act to fix a problem it and GAO⧉ had documented for years: the federal government cannot find enough skilled cybersecurity staff, and the ones it has rarely get to develop new skills by working somewhere other than their home agency. The law told the Office of Personnel Management to build a rotation program to fix that. A July 16, 2026 GAO audit -- which was itself directed by the same law to conduct -- found that over the program's entire life, 634 employees applied to participate. Eight were approved to actually go.