A federal program meant to spread cybersecurity expertise across agencies received 634 employee applications but approved eight people to serve rotations, according to a Government Accountability Office review.
The Office of Personnel Management effectively suspended the Federal Rotational Cyber Workforce Program after limited agency participation. It advertised no positions in 2025, and officials told GAO that the agency did not intend to post positions in 2026 because of resource constraints and shifting priorities.
Congress created the program in 2022 to let federal cyber employees take voluntary six- to 12-month assignments at other agencies. The idea was practical: employees could learn a different system or mission and bring those skills back to their home office.
As of May 2026, 13 agencies had participated and at least 106 positions had been advertised. The headline application number does not mean 634 qualified people were rejected from otherwise available jobs. OPM found that some applicants were ineligible, including contractors who were not covered by the employee program.
Management support created another bottleneck. Employees needed their home agencies to release them temporarily, and OPM reported that managers did not always approve participation. A rotation can create a short-term staffing gap even if it produces a more experienced employee later.
OPM documented those problems in an October 2024 lessons-learned report. Its proposed fixes included encouraging agency leaders to support participation and advertising positions with lower qualification thresholds. GAO found that OPM did not take steps to implement the recommendations before the program halted.
The result is especially notable because the federal government continues to identify shortages of cybersecurity and information-technology professionals. A rotation program cannot by itself create more workers, but it can broaden experience across systems and agencies—if managers make positions available and approve employees to participate.
GAO made no recommendations because the program was already effectively halted. Statutory authority is scheduled to sunset in June 2027, leaving limited time for a restart unless Congress or the executive branch changes course.
The program’s small number of approvals also shows why applicant counts need context. Demand existed, but eligibility rules, managerial release decisions, matching and program administration reduced that demand to a handful of placements.
Any successor should publish a clearer funnel: applicants, eligible candidates, manager approvals, matches, completed rotations and retention afterward. Without that sequence, agencies cannot tell whether the constraint is worker interest, job design, agency cooperation or the administrative system connecting them.