The Department of Defense (DoD), like most very large organizations rightly have concerns over the functionality of their Cybersecurity employees and their ability to perform core duties in a professional manner. To validate this ability, the DoD imposed a mandatory certifications policy based upon positions within the organization. The DoD concept demonstrated one possible path in an effort to reduce cybersecurity incidents over the past 13 years, but the outcome has yet to quantitatively demonstrate an increase in workforce capabilities, a reduction in risk, or a return on investment for all of the mandatory training, certifications, recertifications, continuing professional education (CPE) hours, maintenance costs, temporary duty costs, or the loss of productivity during the process.

This qualitative case study, explores eleven senior individuals to provide a single voice of workforce and first-line manager perceptions of the DoD mandate over a decade after the initial inception. The purpose of the study was not to generate theory based upon data and provide phenomenon, but to provide understanding to social environments within a large organization. The use of a single business case and open coding format allowed the research to gain granularity and lead to a better understanding in an original setting. The participants were all specifically chosen, because of their affiliation with the DoD as military members, DoD civilians, or DoD contractors. Each person was vetted to validate their legitimacy and availability for participation.

The individuals answered a series questions in relationship to the three primary questions on validity of certifications, the risk rating of the organization, and the return on investment perceived by the individual. The workforce demonstrated a belief that gained knowledge through experience was greater than the other areas, but closely followed by certifications. None of the participants showed knowledge of a discernible change in the risk rating for the organization. No one provided specific insight into the return on investment for the DoD or individual organizations that make up the DoD. This study should be expanded to include a greater number and variety of participants and should be conducted by the DoD internally as a component of FISMA reporting.