Attachment 18 - Cyberspace IA Workforce Matrix SSG.xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- Synthetic Signature Guidance (SSG) Trainers
- Solicitation number
- N0016722R0004
About this file
This document provides a matrix for certifying an information assurance workforce supporting a federal contract for Synthetic Signature Guidance (SSG) Trainers. The matrix lists work roles and their definitions, required certifications, operating systems, and Information Assurance categories and levels as defined in DoD 8570.01-M. Key work roles include software developer, secure software assessor, enterprise architect, security architect, research and development specialist, systems requirements planner, database administrator, data analyst, knowledge manager, technical support specialist, network operations specialist, system administrator, systems security analyst, vulnerability assessment analyst, information systems security manager, COMSEC manager, cyber workforce developer and manager, cyber policy and strategy planner, program manager, IT project manager, product support manager, IT investment/portfolio manager, and IT program auditor. The associated federal contract opportunity is a solicitation from the Naval Sea Systems Command for the Naval Surface Warfare Center, Carderock Division to provide scientific, engineering, and technical services for the design, development, fabrication, integration, test, fleet implementation and maintenance of Synthetic Signature Generation based simulation systems.
View the file
Other files
Show all 28
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Reference Directions:
1. Column A: List the task area numbers from the SOW that define what they'll be doing.
2. Column B (Column C new option]: Based on the duties and the work role descriptions on this reference page, choose the appropriate work role name and code.
3. Column D (Formerly C): Provide a brief description of the cyber duties the individual(s) will be performing.
4. Column E (Formerly D): If the position is primarily management or cybersecurity choose IAM, if it is technical choose IAT, or if it is architectural or engineering choose IASAE. Based on the access level (i.e., local, network or enclave) of cyber duty needed to fill the position, choose level I, II or III. All three proficiency levels (e.g., basic, intermediate or advanced) can be found at each access level.
5. Column F (New): Choose the appropriate Certification for the the work role
6. Column G (Formerly E): Investigations are T3, unless the individual will have an .adm, .adp or work on the network in c104.
7. Column F: If the position requires local access (i.e., closed enclave) then it is IT-2. If it requires network or enclave level, then it is an IT-1 which requires a Top Secret investigation.
8. Column H (Formerly G): If the position requires Operating System/Computing Environment (OS/CE) training (e.g., Linux or Win10) before being engaged, it should be stated here. Otherwise, they will have 6 months to get the training once they are engaged.
*The words in red on the Table are examples and are not comprehensive. Please delete and replace with info from your contract. Once complete you can save the worksheet as a PDF to be included in your SOW.
| DoD 8570.01-M Summary of IA Workforce Qualification Requirements | |||
| IAT/IAM/IASAE Level | Approved Baseline Certifications | System Environment | Recommended Experience |
| IAT I | A+ CE, CCNA-Security, CND, Network+ CE, SSCP | Computing Environment | 0-5 years |
| IAT II | CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP | Network/Advanced Computing Environment | at least 3 years |
| IAT III | CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH | Enclave/Advanced Network & Computer | at least 7 years |
| IAM I | CAP, CND, Cloud+, GSLC, Security+ CE | Computing Environment | 0-5 years |
| IAM II | CAP, CASP+ CE, CISM, CISSP (or Associate), GSLC, CCISO | Network | at least 5 years |
| IAM III | CISM, CISSP (or Associate), GSLC, CCISO | Enclave | at least 10 years |
| IASAE I | CASP+ CE, CISSP (or Associate), CSSLP | Computing Environment | 0-5 years |
| IASAE II | CASP+ CE, CISSP (or Associate), CSSLP | Network/Advanced Computing Environment | at least 5 years |
| IASAE III | CISM, CISSP (or Associate), GSLC, CCISO | Enclave | at least 10 years |
| Glossary | ||
| Core Users/Members | All contractors who provide cyber capability (including coding/software development/web development) at the network or enclave level are core Cyber IT/CSWF members and are required to have an appropriate baseline certification that cannot be education, regardless if it is a secondary duty. | |
| IAM | Information Assurance Management | 51% or more of duties are management or anyone performing cybersecurity. |
| IAT | Information Assurance Technical | 51% or more of duties are technical |
| IASAE | Information Assurance System Architect and Engineer | 51% or more of duties are architectural or engineering |
| OS/CE | Operating System/Computing Environment | Obtained within 6 months of start date unless stated otherwise. |
| Baseline Certification | As an extension of Appendix 3 to the DoD 8570.01-Manual, the above certifications have been approved as IA baseline certifications for the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their position category or specialty and level. Refer to Appendix 3 of 8570.01-M for further implementation guidance. | |
| Cyber IT/CSWF (aka IA Workforce) | Includes IAM/IAT for Cyber IT/CS Workforce | |
| CSWF | Cybersecurity Workforce (subset of Cyber Workforce) | Personnel who secure, defend, and preserve data, networks, net-centric capabilities, and other designated systems by ensuring appropriate security controls and measures are in place, and taking internal defense actions. This includes access to system controls, monitoring, administration, and integration of cybersecurity into all aspects of engineering and acquisition of cyberspace capabilities. |
| Cyber IT WF | Cyberspace Information Technology Workforce (subset of Cyber Workforce) | Personnel who design, build (e.g., software development), configure, operate, and maintain IT, networks, and capabilities. This includes actions to prioritize portfolio investments; architect, engineer, acquire, implement, evaluate, and dispose of IT as well as information resource management; and the management, storage, transmission, and display of data and information. |
| References | |||
| DoD 8570.01-M | Information Assurance Workforce Improvement Program Incorporating Change 4 | 10-Nov-15 | |
| DODD 8140.01 | Cyberspace Workforce Management | 5-Oct-20 | |
| DoD Approved 8570 Baseline Certifications (IASE Summary of IA Workforce Qualification Requirements) | https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/ | ||
| Security and Privacy for Computer Systems | DFARS clause subpart 239.71 | https://www.acq.osd.mil/dpap/dars/dfars/html/current/239_71.htm | |
| Information Assurance Contractor Training and Certification | DFARS clause subpart 239.7102-3 | https://www.acq.osd.mil/dpap/dars/dfars/html/current/239_71.htm |
| Work Roles | ||
| Code and Name | Description | Reminders: |
| (411) Technical Support Specialist | Provides technical support to customers who need assistance utilizing client level hardware and software in accordance with established or approved organizational process components. (i.e., Master Incident Management Plan, when applicable). | 1. Education does NOT count for a cyber BASELINE certification per DOD 8570.01-M. |
| (421) Database Administrator | Administers databases and/or data management systems that allow for the storage, query, and utilization of data. | 2. A T5 investigation is required for those requiring .adp or .adm or network IT privileged accounts. |
| (422) Data Analyst | Examines data from multiple disparate sources with the goal of providing new insight. Designs and implements custom algorithms, flow processes and layouts for complex, enterprise-scale data sets used for modeling, data mining, and research purposes. | 3. DOD 8570.01-M "C2.3.9. Contractor personnel supporting IA functions in Chapters 3, 4, 10, and 11 shall obtain the appropriate DoD-approved IA baseline certification prior to being engaged." Evidence of operating system and/or computing environment training must be provided within 6-months of engagement. |
| (431) Knowledge Manager | Responsible for the management and administration of processes and tools that enable the organization to identify, document, and access intellectual capital and information content. | |
| (441) Network Operations Specialist | Plans, implements, and operates network services/systems, to include hardware and virtual environments. | |
| (451) System Administrator | Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | |
| (461) Systems Security Analyst | Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | |
| (612) Security Control Assessor | Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). | |
| (621) Software Developer | Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs. | |
| (622) Secure Software Assessor | Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results. | |
| (631) Information Systems Security Developer | Designs, develops, tests, and evaluates information system security throughout the systems development lifecycle. | |
| (632) Systems Developer | Designs, develops, tests, and evaluates information systems throughout the systems development life cycle. | |
| (641) Requirements Planner | Consults with customers to evaluate functional requirements and translate functional requirements into technical solutions. | |
| (651) Enterprise Architect | Develops and maintains business, systems, and information processes to support enterprise mission needs; develops information technology (IT) rules and requirements that describe baseline and target architectures. | |
| (652) Security Architect | Designs enterprise and systems security throughout the development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into security designs and processes. | |
| (661) Research & Development Specialist | Conducts software and systems engineering and software systems research in order to develop new capabilities, ensuring cybersecurity is fully integrated. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems. | |
| (671) Testing and Evaluation Specialist | Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results. | |
| (801) Program Manager | Leads, coordinates, communicates, integrates and is accountable for the overall success of the program, ensuring alignment with critical agency priorities. | |
| (802) IT Project Manager | Directly manages information technology projects. | |
| (803) Product Support Manager | Manages the package of support functions required to field and maintain the readiness and operational capability of systems and components. | |
| (804) IT Investment/ Portfolio Manager | Manages a portfolio of IT capabilities that align with the overall needs of mission and business enterprise priorities. | |
| (805) IT Program Auditor | Conducts evaluations of an IT program or its individual components, to determine compliance with published standards. |
&"Times New Roman,Bold"&24Directions and References for Information Assurance Workforce Certification Matrix
Matrix
| SSG Follow On CSWF Matrix | ||
| Contract Task Area | Code & Cyber Work Description | |
| Project Cyber IT/CS Duties | Information Assurance Category | |
| and Level* | Background Investigation | Operating System/Computing Environment (OS/CE) Training (If Required |
Prior to Being Engaged)
| 4.6 | 461:Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | Systems maintenance, and administration support for the prototype development network and Engineering Development Model (EDM) configuration. | IAM I | T3 |
| 5.7.1, 5.7.3, 5.7.4, 5.7.6, 5.7.7 | 621: Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | Software development – |
Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs.
| Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | IASAE I or IAT I | T3 | |||
| 5.7.5 | 451: Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | Support cybersecurity for the prototype development network and Engineering Development Model (EDM) configuration which requires an Information System adminsitration account. | IAT II | T5 | |
| 5.7.5 | 441: Plans, implements, and operates network services/systems, to include hardware and virtual environments. | Support cybersecurity for the prototype development network and Engineering Development Model (EDM) configuration which requires an Information System adminstration account. | IAT II | T5 |
*For a list of DOD approved baseline certifications aligned to each category and level, see https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/
&"Palatino Linotype,Regular"&18Information Assurance Workforce Certification Matrix &K01+000ITPR/Contract Number:&KFF0000 ######, &K01+000NSWCCD Department(s): &KFF0000##
Menu Items
| Work Role Code Definition | Certification | Operating System | IAT, IAM, IASAE Level | |||
| Security Control Assessor | 612 | Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). | 612 - Security Control Assessor: Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). | Security+ CE | None | IAT I |
| Software Developer | 621 | Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs. | 621 - Software Developer : Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs. | CISSP (or Associate) | Microsoft Windows 10 | IAT II |
| Secure Software Assessor | 622 | Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results. | 622 - Secure Software Assessor: Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results. | A+ CE | Microsoft Server 2012R2 | IAT III |
| Enterprise Architect | 651 | Develops and maintains business, systems, and information processes to support enterprise mission needs; develops information technology (IT) rules and requirements that describe baseline and target architectures. | 651 - Enterprise Architect: Develops and maintains business, systems, and information processes to support enterprise mission needs; develops information technology (IT) rules and requirements that describe baseline and target architectures. | CCNA-Security | Microsoft Server 2016 | IAM I |
| Security Architect | 652 | Designs enterprise and systems security throughout the development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into security designs and processes. | 652 - Security Architect: Designs enterprise and systems security throughout the development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into security designs and processes. | CND | Microsoft Server 2019 | IAM II |
| Research & Development Specialist | 661 | Conducts software and systems engineering and software systems research in order to develop new capabilities, ensuring cybersecurity is fully integrated. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems. | 661 - Research & Development Specialist: Conducts software and systems engineering and software systems research in order to develop new capabilities, ensuring cybersecurity is fully integrated. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems. | Network+ CE | Red Hat Enterprise Linux 7 | IAM III |
| Systems Requirements Planner | 641 | Consults with customers to evaluate functional requirements and translate functional requirements into technical solutions. | 641 - Systems Requirements Planner : Consults with customers to evaluate functional requirements and translate functional requirements into technical solutions. | SSCP | Red Hat Enterprise Linux 8 | IASAE I |
| System Testing and Evaluation Specialist | 671 | Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results. | 671 - System Testing and Evaluation Specialist: Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results. | CySA+ | CentOS | IASAE II |
| Information Systems Security Developer | 631 | Designs, develops, tests, and evaluates information system security throughout the systems development lifecycle. | 631 - Information Systems Security Developer: Designs, develops, tests, and evaluates information system security throughout the systems development lifecycle. | GICSP | Debian Linux | IASAE III |
| Systems Developer | 632 | Designs, develops, tests, and evaluates information systems throughout the systems development lifecycle. | 632 - Systems Developer : Designs, develops, tests, and evaluates information systems throughout the systems development lifecycle. | GSEC | Linux | |
| Database Administrator | 421 | Administers databases and/or data management systems that allow for the storage, query, and utilization of data. | 421 - Database Administrator: Administers databases and/or data management systems that allow for the storage, query, and utilization of data. | CASP+ CE | Microsoft Windows 10, Microsoft Server 2012R2 | |
| Data Analyst | 422 | Examines data from multiple disparate sources with the goal of providing new insight. Designs and implements custom algorithms, flow processes and layouts for complex, enterprise-scale data sets used for modeling, data mining, and research purposes. | 422 - Data Analyst: Examines data from multiple disparate sources with the goal of providing new insight. Designs and implements custom algorithms, flow processes and layouts for complex, enterprise-scale data sets used for modeling, data mining, and research purposes. | CCNP Security | Microsoft Windows 10, Microsoft Server 2012R2, Microsoft Server 2016 | |
| Knowledge Manager | 431 | Responsible for the management and administration of processes and tools that enable the organization to identify, document, and access intellectual capital and information content. | 431 - Knowledge Manager: Responsible for the management and administration of processes and tools that enable the organization to identify, document, and access intellectual capital and information content. | CISA | Microsoft Windows 10, Microsoft Server 2012R2, Microsoft Server 2016, Microsoft Server 2019 | |
| Technical Support Specialist | 411 | Provides technical support to customers who need assistance utilizing client level hardware and software in accordance with established or approved organizational process components. (i.e., Master Incident Management Plan, when applicable). | 411 - Technical Support Specialist: Provides technical support to customers who need assistance utilizing client level hardware and software in accordance with established or approved organizational process components. (i.e., Master Incident Management Plan, when applicable). | GCED | Microsoft Windows 10, Red Hat Enterprise Linux 7 | |
| Network Operations Specialist | 441 | Plans, implements, and operates network services/systems, to include hardware and virtual environments. | 441 - Network Operations Specialist: Plans, implements, and operates network services/systems, to include hardware and virtual environments. | GCIH | Microsoft Windows 10, Red Hat Enterprise Linux 8 | |
| System Administrator | 451 | Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | 451 - System Administrator: Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | CAP | Microsoft Windows 10, Microsoft Server 2019 | |
| Systems Security Analyst | 461 | Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | 461 - Systems Security Analyst: Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | Cloud+ | Microsoft Windows 10, Microsoft Server 2012R2, Red Hat Enterprise Linux 7 | |
| Information Systems Security Manager | 722 | Responsible for the cybersecurity of a program, organization, system, or enclave. | 722 - Information Systems Security Manager: Responsible for the cybersecurity of a program, organization, system, or enclave. | GSLC | Microsoft Windows 10, Microsoft Server 2012R2, Microsoft Server 2016, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 | |
| COMSEC Manager | 723 | Manages the Communications Security (COMSEC) resources of an organization (CNSSI No. 4009). | 723 - COMSEC Manager : Manages the Communications Security (COMSEC) resources of an organization (CNSSI No. 4009). | CISM | Microsoft Windows 10, Microsoft Server 2012R2, Microsoft Server 2016, Microsoft Server 2019, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 | |
| Cyber Workforce Developer and Manager | 751 | Develop cyberspace workforce plans, strategies and guidance to support cyberspace workforce manpower, personnel, training and education requirements and to address changes to cyberspace policy, doctrine, materiel, force structure, and education and training requirements. | 751 - Cyber Workforce Developer and Manager: Develop cyberspace workforce plans, strategies and guidance to support cyberspace workforce manpower, personnel, training and education requirements and to address changes to cyberspace policy, doctrine, materiel, force structure, and education and training requirements. | CCISO | Cisco OS | |
| Cyber Policy and Strategy Planner | 752 | Develops cyberspace plans, strategy and policy to support and align with organizational cyberspace missions and initiatives. | 752 - Cyber Policy and Strategy Planner: Develops cyberspace plans, strategy and policy to support and align with organizational cyberspace missions and initiatives. | CSSLP | Other OS/CE | |
| Program Manager | 801 | Leads, coordinates, communicates, integrates and is accountable for the overall success of the program, ensuring alignment with critical agency priorities. | 801 - Program Manager: Leads, coordinates, communicates, integrates and is accountable for the overall success of the program, ensuring alignment with critical agency priorities. | |||
| IT Project Manager | 802 | Work that involves directly managing information technology projects to provide a unique service or product. | 802 - IT Project Manager: Work that involves directly managing information technology projects to provide a unique service or product. | |||
| Product Support Manager | 803 | Manages the package of support functions required to field and maintain the readiness and operational capability of systems and components. | 803 - Product Support Manager : Manages the package of support functions required to field and maintain the readiness and operational capability of systems and components. | |||
| IT Investment/Portfolio Manager | 804 | Manages a portfolio of IT capabilities that align with the overall needs of mission and business enterprise priorities. | 804 - IT Investment/Portfolio Manager: Manages a portfolio of IT capabilities that align with the overall needs of mission and business enterprise priorities. | |||
| IT Program Auditor | 805 | Conducts evaluations of an IT program or its individual components, to determine compliance with published standards. | 805 - IT Program Auditor: Conducts evaluations of an IT program or its individual components, to determine compliance with published standards. | |||
| Vulnerability Assessment Analyst | 541 | Performs assessments of systems and networks within the NE or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities. | 541 - Vulnerability Assessment Analyst: Performs assessments of systems and networks within the NE or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities. |
File details come from the government source that posted it. Updated .