The Cyber PIVOTT Act aims to expand cybersecurity education and training programs by providing scholarships to students in cyber-related fields who commit to serving in government cyber roles, addressing critical workforce needs and enhancing national cybersecurity.
Mark Green
Representative
TN-7
The Cyber PIVOTT Act aims to bolster the cybersecurity workforce by expanding CISA's education and training programs to community colleges and technical schools, offering scholarships for students in cyber-related fields who commit to a service obligation in government. This act prioritizes skills-based training, internships, and industry-relevant certifications, while also establishing recruitment and resource platforms to connect graduates with federal job opportunities. The goal is to significantly increase the number of students enrolled in cybersecurity programs, addressing critical workforce gaps in the cyber sector. The Act also requires CISA to review its education and training programs and report to Congress.
Cyber PIVOTT Act Offers Full-Ride Scholarships, Locks Grads into Two-Year Government Gigs
The Cyber PIVOTT Act (Providing Individuals Various Opportunities for Technical Training to Build a Skills-Based Cyber Workforce Act of 2025) aims to build a stronger cybersecurity workforce by offering significant financial incentives for students, but with some serious strings attached. The core of the bill (SEC. 2) establishes the "PIVOTT Program" within CISA (Cybersecurity and Infrastructure Security Agency), providing full scholarships to students pursuing cyber-related associate degrees or certifications. This isn't just tuition – it covers fees, travel, stipends, and even certification testing (SEC. 2). In return, graduates must work in a cyber role for a government entity (federal, state, local, or tribal) for two years (SEC. 2).
Cash for Classrooms, But With a Catch
The program is designed to funnel talent into government cybersecurity roles. It covers pretty much every expense a student might have, from tuition and lab fees to travel and even internship costs (SEC. 2). To be eligible, institutions (community colleges, technical schools, and others offering two-year programs) need to be part of the National Centers of Academic Excellence in Cybersecurity (NCAEC) or get CISA's approval based on the NICE Cybersecurity Workforce Framework (SEC. 2). Think of it like a fast track into government cyber jobs, but with a required two-year pit stop after graduation. The bill also mandates that students complete at least four skills-based exercises, with at least one in person. (SEC. 2).
The Two-Year Turn: Service or Debt?
Here's where things get interesting – and potentially tricky. If a student doesn't fulfill that two-year service obligation, they're on the hook for repaying the entire scholarship, which can be treated as a Federal Direct Unsubsidized Stafford Loan (SEC. 2). There are some exceptions – enlisting in the Armed Forces, or genuinely trying but failing to land a government job (SEC. 2). But if you drop out, get dismissed, or simply decide government work isn't for you, get ready to pay up. This could be a significant burden, especially for students from lower-income backgrounds. The bill aims to ramp up quickly, starting with 250 students in the first year and reaching 1,000 annually, with a long-term goal of 10,000 students within ten years (SEC. 2).
Beyond the Classroom: Internships and Job Fairs
The bill also pushes for internships, prioritizing those with security clearances for students aiming for federal jobs (SEC. 2). CISA is tasked with running regional outreach, creating informational materials, and even hosting an annual federal government recruitment fair (SEC. 2). CISA also has to create a list of cyber certification programs and may fund up to three certifications per student. (SEC. 2). It's a full-court press to get people trained and into government cyber positions. However, the repayment clauses and the potential for institutions to prioritize enrollment numbers over training quality are areas to watch. Also, the definition of "cyber-relevant" roles could be broad, potentially diluting the impact, and it is important to make sure that this program is used to increase the overall amount of cybersecurity professionals, and not just steer talent towards the government. (SEC. 2).