634 Applications, Eight Completed Rotations: Why the Federal Cyber Exchange Stalled

The federal government built a program to move cybersecurity employees temporarily to agencies that needed their skills. The workers would keep their jobs and salaries, assignments would last six months to a year, and host agencies would gain experienced help without waiting for an external hire.

Federal employees responded. Agencies received 634 applications over the program's life. But only eight employees completed a rotation before the governmentwide effort stopped.

Those numbers, published in July by the Government Accountability Office, are not a conventional applicant funnel. The 634 were opportunity-specific application submissions to employees' home agencies, not 634 confirmed unique people. An employee had to file separately for each opening, so repeat applicants are possible. Eight counts completed rotations. GAO did not report how many applicants won home-agency approval, were referred, matched, started a rotation or began but failed to finish.

The missing stages are part of the story. A program intended to share scarce talent placed the agencies that could least afford to release an employee in control of whether that employee could leave. It offered no governmentwide backfill fund, kept salary costs with the home agency and allowed that agency to end a detail for mission needs. Host agencies then advertised predominantly senior work and screened out applicants they considered unqualified. By 2025, the central marketplace had no openings.

The result was not weak employee interest. It was a mobility program whose operating rules made institutional consent more important than demand.

The approval problem

Congress enacted the Federal Rotational Cyber Workforce Program Act on June 21, 2022. It authorized agencies to detail cyber-coded employees to another agency for 180 days to one year, with a possible 60-day extension. Employees would return to their home organizations and generally owe a period of continued federal service. The authority sunsets on June 21, 2027.

The law used permissive language: agency heads *may* designate employees. A worker needed approval from the home agency, and that agency could terminate a detail early when its needs required. Details were nonreimbursable, meaning the home organization continued paying salary and benefits. Agencies could create exchange partnerships, but the statute did not require one-for-one trades.

OPM's March 2023 guidance turned that structure into a multistep process. Applicants needed supervisory endorsement and agency-head or designee approval. They had to be rated fully successful, satisfy clearance requirements and complete a three-party memorandum among the employee, home agency and host. The guidance required evaluations, service agreements, records and agency reporting.

GAO found that many applicants applied before obtaining required home-agency approval. Others did not meet host qualifications. Contractors applied even though the statute covers federal employees. Some agencies found it easier to run internal rotations than to complete the interagency process.

The design exposed a basic asymmetry. The employee and host received the most visible benefits: development for one, temporary expertise for the other. The home agency kept the salary cost and absorbed the vacancy. It could hope that the employee returned with broader skills, but the immediate operational loss was its own.

An opportunity list built for senior employees

Eleven agencies advertised at least 106 governmentwide positions: at least 75 in 2023 and 31 in 2024. The total is a lower bound because GAO counted ranges and listings with multiple possible participants at their minimum.

The openings leaned toward experienced employees. OPM's October 2024 evaluation identified five positions at GS-9 and 104 at GS-12 or above. Those grade counts can exceed the lower-bound position count because some opportunities covered multiple grades. Managers and human-resources staff were not always aware of the program or willing to support participation, and applicants struggled with qualification requirements.

Thirteen agencies participated in some way. GAO's agency chart identifies Agriculture, Defense, Education, Health and Human Services, Social Security and Veterans Affairs as both advertisers and home agencies of a participant who served. The Federal Deposit Insurance Corporation and Treasury did not advertise but were home agencies of a participant. Because GAO reported eight completions and marked eight home agencies as having an employee serve, the chart is consistent with one completion associated with each marked home agency. That is a deduction, not an agency-level completion table published by GAO.

In 2025, agencies advertised no positions. OPM's Open Opportunities platform was inactive by December. OPM planned to move the program to Connect.gov but told GAO that budget constraints prevented it from obtaining an account. It anticipated no 2026 positions and said it would not invest further resources because of competing priorities. OPM had identified the problems in 2024 but took no corrective steps. GAO made no recommendations because implementation had halted.

Actual cost is unknown. A Congressional Budget Office estimate said regulations, training and the required GAO report would cost less than $500,000 over 2022 through 2026, subject to appropriations. That was a prospective estimate for specified implementation work, not an accounting of salaries, administration, travel, backfill or opportunity costs. It cannot support a cost-per-completion calculation.

Defense's separate 2026 channel

The governmentwide marketplace was not the only activity carrying the statutory program's name. Defense separately advertised a 2025-2026 cohort through its own cyber workforce rotational-program pages and paired the federal program with its Cyber Information Technology Exchange Program.

FederalHiringData parsed Defense's 98-page opportunity catalog. It contained 47 descriptions: 36 for the federal rotational program and 11 for the public-private exchange. Thirty-five federal-program descriptions specified a numeric range totaling 64 to 72 advertised participant slots; one did not give a number. Thirty-five explicitly required at least Secret eligibility, and 22 named Top Secret. Thirty-three listed July 27, 2026, as the planned start.

Defense also set four component quotas of five participants and five opportunities across the two programs. Applicants needed supervisor approval, and the home organization was responsible for approved temporary-duty costs for assignments beyond 50 miles.

These are listings and plans, not results. As of Aug. 20, the public pages did not verify selections, starts or completions. They also still described an application window ending April 24 as open, indicating that their status text had not been kept current.

The public record leaves a reporting gap. Defense posted its catalog before GAO reported that OPM anticipated no 2026 offerings. The most defensible reading is that the central OPM marketplace halted while Defense operated a separate agency-run channel. Defense slots should not be added to GAO's lifetime results, and they do not establish that the planned cohort began.

The workforce was contracting

The stalled program sits inside a larger federal technology workforce reversal.

FederalHiringData analyzed OPM FedScope records for the broad GS-2210 Information Technology Management series and its predecessor, GS-0334. The observed lineage grew from 55,567 employees in September 1998 to 102,085 in December 2024. By May 2026, the latest comparable snapshot, it had fallen to 84,355: 17,730 below the peak and 17.4 percent lower.

This is not a count of all cybersecurity employees, nor is every 2210 employee a cyber worker. Cyber roles also appear in engineering, computer science and other occupations and are more precisely identified through work-role codes that are not consistently available across the long series. The 2210 data are best read as the largest durable measure of the government's IT-management workforce.

The 2025 personnel-action files contain 2,472 accessions and 18,142 separations for 2210 employees. Voluntary retirements accounted for 7,300 actions, quits for 6,536 and early-out retirements for 1,968. These action counts do not mechanically equal snapshot changes because transfers, coding, reorganizations and source coverage differ. They do establish that the year combined weak entry with unusually high recorded exits.

The remaining workforce was senior. In May 2026, 49.8 percent of observed 2210 employees were at least 50 years old, while 10.4 percent were younger than 35. Among records with a General Schedule grade, 96.2 percent were GS-11 through GS-15 and 3.8 percent were GS-5 through GS-9.

From January 2025 to May 2026, observed 2210 headcount fell 11.9 percent at Defense, 26.3 percent at Treasury, 17.6 percent at Veterans Affairs, 13.2 percent at Homeland Security, 23.9 percent at HHS and 6.9 percent at Justice. CISA, shown as a Homeland Security subelement, fell from 1,392 to 973, a 30.1 percent decline. These broad occupation counts do not prove cyber-specific losses or explain a particular rotation decision. They show the staffing environment in which supervisors were asked to lend people.

External recruiting also shrank

The rotation program was supposed to develop and move employees already inside government. External recruiting weakened at the same time.

The FederalHiringData historical USAJOBS archive contains 15,029 announcement records for series 2210 in 2024 and 3,971 in 2025, a 73.6 percent decline. A stricter title filter for “cyber,” “information security” or “infosec” fell from 3,452 to 1,095. Announcement records are not vacancies, applicants or hires, and the title filter is not an official cyber classification.

Through Aug. 14, 2026, the archive contained 3,036 series-2210 records, including 848 with strict cyber or information-security titles. Among the 515 strict-title records with a usable GS starting grade, 430, or 83.5 percent, began at GS-12 or above. Only 22 began at GS-9 or below. A named clearance level appeared in 517 records. None was marked fully remote; 202 mentioned telework. The median posting stayed open eight calendar days.

That profile resembles the rotation program's imbalance: agencies sought experienced, often cleared talent while offering relatively few lower-grade entry points. Internal mobility could have broadened experience without waiting for an external hire, but only if home agencies had enough capacity to release people.

Fourteen days after GAO published its findings, OPM issued FY2027 annual staffing-plan guidance directing agencies to reserve positions and budget for AI, cybersecurity, data, software and digital talent. It called for hiring, reskilling and restructuring; governmentwide pooled certificates; at least one-third early-career hiring; and validated assessments for covered hires. Those are targets, not results. The memo did not revive the governmentwide rotation marketplace.

What a working mobility program would need

A successor would have to solve the home agency's problem directly. That could mean funded backfill, travel support, preapproved release capacity or an enforceable exchange in which agencies both send and receive talent. Openings would need grade and qualification structures that develop employees instead of concentrating almost entirely on workers who are already senior. Supervisor approval would have to occur before an application enters a central count, so reported demand is not inflated by submissions that were never eligible to proceed.

It would also need a basic performance record: unique applicants, approved applicants, referrals, matches, starts, early terminations, completions, costs and post-rotation retention. Without those stages, even the program's final arithmetic can be mistaken for a conversion rate it does not measure.

The eight completions do not show that employees saw no value in moving. They show that the government asked agencies with scarce talent to bear the immediate cost of sharing it, then failed to maintain the common machinery and evidence needed to make exchange routine. Hiring more cyber workers may be necessary. Hiring targets alone will not create a workforce the government can move, develop and use across agency lines.

Readers can browse current federal jobs, compare broader federal workforce statistics and follow additional FederalHiringData investigations.

Methodology and limitations

FederalHiringData used Public Law 117-149, OPM guidance, Defense program records and GAO-26-108736 to reconstruct the program through Aug. 20, 2026. The 634 count is opportunity-specific application submissions, not unique applicants; eight is completions. GAO did not publish the intermediate stages needed for a completion rate. The advertised-position total is a lower bound. Defense's 2026 catalog is analyzed separately because its selections, starts and completions were not public.

Workforce calculations use the local OPM FedScope corpus. The long series bridges GS-0334 and GS-2210, which OPM's classification history identifies as predecessor and successor. GS-2210 is broad IT, not a cyber-only count. June 2026 is excluded because at least 19 Defense subelements disappeared from the snapshot while recorded monthly actions implied net growth. Pay is not used in the body because May coverage was only 47.9 percent and excluded all Defense records plus parts of DHS and Justice.

USAJOBS calculations use the FederalHiringData historical USAJOBS archive. Counts are announcement records, not vacancies, applicants, offers or hires. The title filter is a recruiting signal rather than an official cyber code. Archive coverage begins in March 2017; the chart starts with the first full year, 2018, and labels 2026 as partial through Aug. 14. Hiring paths can overlap, and remote, telework and clearance fields are current-schema analysis only.

Actual program cost remains unknown. CBO's estimate covered specified implementation activities rather than total spending, salaries, travel, backfill or opportunity costs. No cost-per-completion figure is supportable. The official hero depicts a Defense cyber workforce strategy briefing, not a participant in this rotation program.