The bill adds a new section to the Homeland Security Act directing the Cybersecurity and Infrastructure Security Agency (CISA) to establish the PIVOTT Program: a nationwide partnership with community colleges, technical schools, and similar two-year institutions to deliver tuition-funded cyber and cyber-relevant training, hands-on exercises, and internship pathways into government and critical infrastructure work.
The program ties full scholarships and certification support to a 2-year service obligation in Federal, State, local, Tribal, or territorial cyber roles (with narrow exceptions for military service and deferred service while pursuing a 4-year degree). It also sets specific implementation timelines, enrollment growth targets, and mechanisms for post-completion benefits and repayment where obligations aren’t met—shaping how the federal government sources entry-level cyber talent from 2-year programs and technical certifications.
At a Glance
What It Does
Directs CISA to stand up the PIVOTT Program to partner with eligible two-year institutions, provide full scholarships covering tuition, fees, travel and certification costs, require completion of hands-on skills exercises and internships, and create a student database and certification vouchers for graduates.
Who It Affects
Community colleges, technical schools and their cyber students; CISA and other Federal agencies recruiting junior cyber talent; critical infrastructure owners in rural or high-risk sectors that host interns; and participating institutions that must monitor post-award service compliance.
Why It Matters
It shifts federal workforce development toward short, skills-first training tied to service commitments, leverages the NICE Framework for role alignment, and creates a scalable pipeline from 2-year programs into public-sector cyber jobs—but it also creates repayment and administrative enforcement responsibilities.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The PIVOTT Act tasks the Director of CISA with creating a program that specifically targets students in 2-year associate’s degree cyber programs, technical certifications, and comparable pathways at community colleges and technical schools. CISA must form partnerships with eligible institutions (such as National Centers of Academic Excellence or those that map coursework to NICE career pathways) and provide full scholarships that cover tuition, fees, travel, stipends, certification testing, and other participation costs identified by the Director.
Student eligibility is broad: incoming students, those in their first semester, entry-level career-changers with a high school diploma or equivalent, and shorter technical certifications that align with NICE tasks. In exchange for scholarships, participants owe a 2-year service obligation in cyber or cyber-relevant roles for an Executive agency or State/local/Tribal/territorial government.
The statute carves out exceptions for completed or ongoing military service and allows students who pursue a 4-year degree after the program to delay fulfillment until after that degree.The bill emphasizes experiential training. Students must complete at least four “skills-based exercises” (laboratory work, capture-the-flag competitions, tabletop exercises, virtual programming, industry workshops, etc.), with at least one completed in person and CISA required to offer at least one in-person exercise to participants every two years.
Internships are a core requirement; CISA and institutions will place students with government entities, rural or high-risk critical infrastructure owners/operators, or Federal agencies. Students who indicate they intend to pursue Federal employment may be prioritized for clearance-required internships, and CISA must begin clearance actions at least one year before an eligible student completes the program.On completion, CISA will maintain an online resource database mapped to NICE job roles, publish an annually updated list of private- and academic-run certifications, and provide vouchers (up to three per student) for certification costs within ten years of program completion.
The statute sets repayment rules: scholarship recipients who fail to meet academic, disciplinary, participation, or service requirements may owe repayment, and in certain cases the Department will treat the award as a Federal Direct Unsubsidized Stafford Loan subject to interest and standard repayment rules. CISA and partner institutions must monitor compliance, and participating schools may collect a fixed administrative percentage of repayments they handle.
The Five Things You Need to Know
CISA must establish the PIVOTT Program within 1 year of enactment and enroll at least 250 students in the first full academic year, with a mandated growth schedule that doubles enrollment year-over-year until reaching 1,000 and a 10-year planning goal of 10,000 students per year.
Scholarships cover full tuition plus academic and lab fees, travel, lodging, per diem, stipends, internship costs, virtual participation expenses, and certification testing fees; CISA may also fund up to 3 certification vouchers per graduate within 10 years of completion.
Each scholarship recipient incurs a 2-year service obligation in a cyber or cyber-relevant role for an Executive agency or State/local/Tribal/territorial government, but the obligation is waived for equivalent prior or current Armed Forces service and may be delayed if the student immediately pursues a 4-year degree.
Program participants must finish at least four skills-based exercises (labs, hackathons/CFTs, tabletop exercises, etc.), complete at least one exercise in person, and CISA must offer at least one in-person skills exercise to participants every two years.
If repayment is required, the statute allows the Department to treat the scholarship as a Federal Direct Unsubsidized Stafford Loan with interest accruing from the scholarship award date, and participating institutions may retain a single fixed percentage of repayments they collect to cover administrative costs.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Establish PIVOTT Program and partner with 2‑year institutions
This provision directs CISA to create the PIVOTT Program and to seek partnerships with community colleges, technical schools, and other two-year institutions. Practically, CISA must formalize agreements that enable scholarship delivery, curriculum alignment with the NICE Framework, and coordination of internships and post-graduation Federal hiring paths. The one-year establishment deadline forces CISA to build administrative and partnership capacity quickly.
Eligibility, scholarship scope, and service obligation
The statute defines eligible students (incoming, first-semester, entry-level career-changers, and shorter certifications mapping to NICE tasks) and requires full scholarships covering a broad suite of costs. In return, scholarship recipients agree to a two-year service obligation in government cyber roles; the bill describes narrow exceptions for military service and allows deferred service for those who immediately pursue four-year degrees. The provision also sets completion timelines, a hardship waiver process, and triggers repayment liabilities for specific failures.
Hands-on components, internships, outreach, and advisory inputs
CISA must coordinate at least four skills-based exercises per student (labs, competitions, tabletop exercises, etc.), ensure at least one is in person, and provide in-person exercises to participants biannually. Internships are built into the program as a core requirement, prioritized for placements with government entities, rural/high-risk infrastructure owners, or Federal agencies—Federal placement can be prioritized for students seeking clearance paths. Outreach duties require regional engagement and an industry-informed annual report; the bill authorizes an advisory committee but expressly exempts it from FACA, which streamlines input but limits formal transparency obligations.
Post-completion benefits, certification vouchers, repayment and loan treatment
After program completion, CISA will maintain an online resources database mapped to NICE roles and publish an annual list of recommended certifications. The Director can issue vouchers funding up to three certifications per student. If participants breach academic, disciplinary, or service requirements, the Department will seek repayment; the bill permits treating awards as Federal Direct Unsubsidized Stafford Loans subject to interest and Education Department rules, and it authorizes institutions to retain a fixed percentage of collected repayments to offset administrative costs.
Enrollment targets, planning, and required reviews/reports
The statute prescribes explicit enrollment targets—250 students the first year, doubling each year until 1,000—and directs CISA and partners to draft a plan for scaling to 10,000 annual enrollments within 10 years; CISA must brief congressional committees on the plan. Separately, within 90 days of enactment CISA must deliver a review of its existing education and training programs, and DHS must report on support for CyberCorps Scholarship for Service, providing legislative committees data to assess overlap and funding opportunities.
This bill is one of many.
Codify tracks hundreds of bills on Technology across all five countries.
Explore Technology in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Community college and technical school students: receive full scholarships, stipends, covered certification costs, hands-on experience, and prioritized internship and Federal hiring pathways—lowering financial and credentialing barriers into cyber roles.
- Community colleges and technical schools: gain funding streams, formal partnerships with CISA and Federal agencies, and placement pathways that can boost enrollment and program relevance for short-term credentialing.
- Federal agencies and State/local/Tribal governments: obtain a steady pipeline of entry-level cyber-trained candidates, with internship and service commitments that can reduce recruiting lead time and onboarding costs.
- Rural and high-risk critical infrastructure owners/operators: access subsidized intern placements intended to increase cyber capacity in under-resourced or high-value sectors.
- Cybersecurity clinics and non‑profit trainers: expanded opportunities to co-deliver exercises and receive recognition through CISA coordination and the agency’s resource database.
Who Bears the Cost
- CISA and DHS: must build program administration, regional outreach, internship placement workflows, clearance coordination, databases, and monitoring systems—requiring appropriations and staff capacity.
- Participating institutions: assume administrative burdens for monitoring compliance, hosting activities, and potentially collecting repayments (retaining only a fixed percentage), which may strain small schools without additional funding.
- Students who do not complete program requirements: face repayment obligations or loan conversion with interest accruing from award date, creating financial risk for dropouts or disciplinary dismissals.
- Federal agencies and local internship hosts: incur onboarding and supervision costs for interns (though placements are core program elements, the statute does not fully fund host-side costs).
- Oversight and Congress: committees will need to review scaling plans and program reports, imposing time and analytic burdens to assess whether enrollments and workforce outcomes meet targets.
Key Issues
The Core Tension
The central tension is between rapidly scaling a skills-based cyber workforce with meaningful federal investment and maintaining safeguards for participants: the law must balance effective service commitments and repayment enforcement against generating undue financial risk, administrative complexity, or placement delays that could discourage the very students the program seeks to attract.
The bill ties generous, up-front scholarship support to enforceable post-award obligations and loan-like repayment machinery. That creates a strong incentive structure for government hiring, but it also converts academic failure, disciplinary removal, or voluntary withdrawal into potential debt with interest.
The statute routes repayment through the Department and permits participating institutions to collect repayments for a fixed administrative cut—raising collection, data-sharing, and privacy questions between schools and a security agency. Treating failed awards as Federal Direct Unsubsidized Stafford Loans imposes interest from the scholarship award date, which may deter risk-averse students or disadvantage those with unstable life circumstances.
Operationally, the act stacks demanding deliverables on CISA and small colleges: rapid program launch, scaled enrollment growth, recurring in-person exercises, internship placement (including clearance pathways), and a public-facing database and certification voucher program. All of these depend on sustained appropriations and cross-agency coordination (DOD, FBI, NSA, National Cyber Director) for clearances and placements.
The FACA exemption for the advisory committee speeds industry input but reduces formal transparency and public records protections for the committee’s composition and deliberations. Finally, prioritizing students for security-cleared internships may accelerate Federal placement for some but can also introduce long delays or denials due to background investigation timelines, undermining the program’s near-term placement objectives.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.