Title of Regulation: 8VAC40-170. Cybersecurity Student Loan Repayment Grant Regulations (adding 8VAC40-170-10 through 8VAC40-170-60).

Statutory Authority: § 23.1-203 of the Code of Virginia; Item 141 of Chapter 2 of the 2018 Acts of Assembly, Special Session I.

Effective Date: December 10, 2018.

Agency Contact: Beverly Rebar, Senior Associate for Academic and Legislative Affairs, State Council of Higher Education for Virginia, 101 North 14th Street, 9th Floor, Monroe Building, Richmond, VA 23219, telephone (804) 371-0571, or email beverlyrebar@schev.edu.

Summary:

Pursuant to Item 141 I of Chapter 2 of the 2018 Acts of Assembly, Special Session I (Appropriation Act), the action establishes requirements to govern administration and award of grant funds under the Cybersecurity Student Loan Repayment Grant Program, including (i) recent graduate and veteran eligibility and academic or job qualifications, (ii) the application process, and (iii) identification and prioritization of qualified employers and qualified employment.

CHAPTER 170
CYBERSECURITY STUDENT LOAN REPAYMENT GRANT REGULATIONS

8VAC40-170-10. Definitions.

"Active duty service" means full-time duty in the active military service of the United States. Such service includes (i) full-time training duty, annual training duty, and attendance while in the active military service at a school designated as a service school by law or by the secretary of the military department concerned and (ii) Air Force, Army, Coast Guard, Marines, Navy, and National Guard members operating under Title 10 of the United States Code, but does not include full-time National Guard duty operating under Title 32 of the United States Code. This definition is only applicable if the applicant attempts to qualify under the "separation from active duty service" provision under 8VAC40-170-30 B 2.

"Award year" means the Commonwealth of Virginia's fiscal budget year, July 1 through June 30 of the following year.

"Contract" means the document detailing the program and employer contributions for a specific employee, including annual grant amounts and duration, in conformance with this chapter.

"Full-time employment" means an employee is assigned to nonrestricted, classified, or other salaried positions that work the equivalent of 40 hours per week for 12 months per year.

"IT" means the field of information technology.

"Private institution of higher education" means each in-state nonprofit and proprietary private institution of higher education in the Commonwealth.

"Program" means the Cybersecurity Student Loan Repayment Grant Program.

"Public institution of higher education" means the Virginia Community College System as a whole and each associate-degree granting and baccalaureate public institution of higher education in the Commonwealth.

"Qualified employment" means an employment position meeting the requirements of this chapter.

"Reside within Virginia" means an individual has secured physical housing located within the geographical boundaries of the Commonwealth of Virginia during the period of qualified employment under the contract.

"SCHEV" means employees of the State Council of Higher Education for Virginia assigned to the administration of the program.

"Student loan" means any qualified education loan obtained specifically to finance education or other school-related expenses but does not include credit card debt, a home equity loan, or revolving debt.

"Veteran" means an individual who has served on active duty in the Armed Forces of the United States and who was discharged or released from such service under conditions other than dishonorable.

8VAC40-170-20. Award details.

From such funds as are available through appropriations and subject to matching employer funds, recipients will be eligible for up to $20,000 total from a combination of program funds and employer match.

1. The employer match must be equal to or greater than the program match.

2. The actual award may be reduced based on available program funds and employer match.

3. Awards may be renewed for up to two years, for a maximum total of three years, subject to employer commitments upon initial awarding, available funds, number of applications, and prioritization of employer and position.

8VAC40-170-30. Recipient criteria.

A. A recipient shall reside within Virginia during the period of qualified employment in which the contract is in force.

B. A recipient shall begin full-time employment within one year of:

1. Graduation from a public institution of higher education or regionally accredited private institution of higher education with an undergraduate or graduate degree in computer science or another academic program recognized by the State Council of Higher Education for Virginia to prepare an individual for a career in cybersecurity; or

2. Separation from active duty service in the Armed Forces of the United States; having been discharged or released from such service under conditions other than dishonorable and having gained experience or received training in computer science during such service.

C. A recipient shall accept an offer of qualified employment from an employer located within the Commonwealth of Virginia.

1. Eligible employers include:

a. A state agency of the Commonwealth of Virginia,

b. An agency of the federal government,

c. A federal or state military or defense organization, and

d. Any private organization that contractually provides cybersecurity services for any organization listed in this subdivision 1 and such private organization.

2. Eligible positions include:

a. Positions tagged with "#COVAcyberjobs" on the website jobs.virginia.gov;

b. Positions with role titles such as "Information Technology Specialist I-IV" and "Information Technology Manager I-III";

c. Positions having a cybersecurity component or demonstrating a career-path that leads into cybersecurity responsibilities, which will be considered on a case-by-case basis; and

d. Positions whose job descriptions include the following key words or combination of words, which may be considered on a case-by-case basis:

(1) Cyber, cyber security, cyber-security, security, secure, securing, compliance, threat, detection, vulnerability, audit, compliance, protect, firewall, risk, or incident.

(2) Analyze, collect and operate, investigate, operate and maintain, oversight and development, protect and defend, or securely provision.

8VAC40-170-40. Award prioritization.

A. Once funding for an award year has been fully committed, no further applications will be considered.

B. Merit criteria may be considered for individual eligibility and may be utilized for any individual application not yet reviewed. The criteria may include:

1. Qualifying veteran status;

2. Cumulative grade point average for a degree program;

3. Cumulative grade point average within a major;

4. Amount of outstanding student loans; and

5. Prior IT experience.

C. Employment priority will be given the following order:

1. Positions explicitly supporting cybersecurity.

2. Information technology management.

3. Information technology specialist.

4. Positions with current cybersecurity responsibilities.

5. Positions whose career path leads directly into cybersecurity responsibilities.

D. Employer priority will be given the following order:

1. State agencies.

2. Private employers contracting with state agencies.

3. Military or defense organizations.

4. Federal agencies.

5. Private employers contracting with federal or military agencies.

8VAC40-170-50. Participation process.

A. Individual certification of eligibility.

1. The individual may submit an application for eligibility at any time following, but within one year of, degree completion or separation from military.

2. In the application, the individual must verify:

a. Physical residence within the Commonwealth;

b. That the individual is within one year of either:

(1) Graduation from a qualifying institution; or

(2) Separation from active duty service from the U.S. military; and

c. Amount of student loan debt.

3. Individuals meeting the requirements will be issued a certification of eligibility with an expiration date. Such certification does not convey any commitment by the individual to seek qualified employment nor assurance that grant funds will be available.

B. Employer contract submission.

1. Prior to advertisement or selection of applicants, the employer may seek confirmation that an open position is eligible under this program. Such verification does not convey any commitment by the employer to fill the position nor any assurance that grant funds will be available.

2. To submit a contract proposal, the employer must certify:

a. The eligible individual has been or will be offered a qualifying position.

b. The individual meets all federal and state employment requirements, including having secured necessary security clearances required for the performance of the position.

c. A permanent mailing address for the individual is on record.

d. A description of the position offered.

e. That the individual's education or training meet the requirements for the position being offered.

f. The amount and duration of the employer match.

g. Verification of a current valid contract with the Commonwealth of Virginia or a Virginia state agency, federal agency, or qualifying military organization including how the position relates to that contract if a private employer.

3. SCHEV verification and contract approval.

a. Using information provided, SCHEV will verify whether the individual, the employer, and the position are eligible under the program.

b. SCHEV will determine the amount and duration of the state matching commitment from the grant and that the employer match is in conformance with this chapter.

c. There is no program commitment or reservation of funds until SCHEV has confirmed individual eligibility and has signed the contract identifying the state and employer program match and duration of agreement.

8VAC40-170-60. Grant administration.

A. Funds disbursement.

1. Each six months, the employee will receive half of the annual award (half of employer match and half of the grant match) that the employer certifies that:

a. The employee remains employed full time in the approved position; and

b. Employer has verified payment of the employer matching requirement.

2. Disbursements from the grant will be made directly to the employee.

B. Grant conditions.

1. No employment service time shall be used to simultaneously satisfy the requirements of this program while satisfying requirements for:

a. Federal CyberCorp^® Scholarship for Service;

b. Virginia Cybersecurity Public Service Scholarship; or

c. Any other Commonwealth of Virginia employment incentive bonus.

2. The contract is null and void and no further grant disbursements will take place if:

a. The applicant does not accept the offer of employment, inclusive of a program contract as part of the compensation package.

b. The applicant fails to secure and maintain initial or subsequent security clearances required for the approved position.

c. The employee leaves employment or is fired for cause.

d. The employee ceases to be employed full time in a qualifying position.

e. The employer fails to fulfill the contract. In addition, the employer may be disqualified from future consideration for any contracts under this program.

f. The employee defaults on any student loan during the time of employment.

3. If the employee is subject to a layoff or other reduction in force, the employee may be considered for a pro rata award based on the length of service if the employer certifies satisfactory performance during the time of qualified employment.

C. Eligibility for multiple grants.

1. Individuals may have no more than one contract in force at one time.

2. There are two paths to eligibility: (i) degree completion or (ii) separation from military service. Therefore, it is possible for an individual to meet the initial eligibility criteria multiple times. An employee may be considered for an additional grant under this program if the employee meets the recipient criteria under 8VAC40-170-30 and

a. Is offered a qualifying position of increased responsibility level within the organization; or

b. Has been offered a qualifying position of increased responsibility at another eligible employer.

3. No employee may receive a second grant contract for the same employment position or equivalent level of employment either with the initial employer or any other eligible employer.