SSG DRAFT CWF_Matrix.xlsx
XLSX spreadsheet 34 KB Posted
- Solicitation number
- N00167-26-SSG
About this file
The file is a Cyberspace Workforce (CWF) Certification Matrix spreadsheet detailing contractor training and certification requirements for various cybersecurity and information technology work roles. The matrix aligns with Department of Defense guidelines (DFARS clause 252.239.7001) and specifies certification levels for different technical positions such as Systems Security Analyst, Software Developer, System Administrator, and Network Operations Specialist. Each work role is mapped to specific Information Assurance Technical (IAT) or Information Assurance Management (IAM) levels, with corresponding background investigation requirements and approved baseline certifications.
The matrix provides detailed certification paths for cybersecurity workforce personnel, including recommended experience levels ranging from Apprentice (0-5 years) to Master (7-10 years). Certification requirements vary by role, with examples including CompTIA Security+, CCNA Security, CySA+, and CISSP. The document notes a transition period related to DoD Manual 8140.03 replacing DoD Manual 8570.01, and emphasizes that contractors must obtain appropriate certifications within specified timeframes, with most positions requiring proof of certification within 6 months of starting work. The matrix is specifically referenced for a Naval Sea Systems Command (NAVSEA) software IT contract for Department 80.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SSG Draft Non-Key Personnel Qualifications.docx | DOCX document | |
| SSG Draft SOW.docx | DOCX document | |
| SSG Draft Key Personnel Qualifications.docx | DOCX document | |
| Market Research Questionnaire.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table 1
Cyberspace Workforce (CWF) Certification Matrix (aligned with DoDM 8570.01) This matrix identifies contractor training requirements per DFARS clause 252.239.7001, Information Assurance Contractor Training and Certification (JAN 2008) Note: DoD Manual 8140.03 has replaced DoD Manual 8570.01 as of 15 February 2023. The DoD is in a transition period for 24/36 months depending on the DCWF workforce element data release and DFARS PGI.
| SOW Task Area | Primary Work Role | |||
| Code & Name | IT/CS Duties | Background Investigation | IAM/IAT Level* | Approved Baseline Certifications |
Note: Higher level certifications meet each lower level in the category
| 4.1.6 | (461) Systems Security Analyst | Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | T3 | IAM I | CAP, CND, Cloud+, GSLC, Security+ CE |
| 4.3.1, 4.3.3, 4.3.4, 4.3.6, 4.3.7 | (621) Software Developer | Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs. | T3 | IAT I | A+ CE, CCNA-Security, CND, Network+ CE, SSCP |
| 4.3.5 | (451) System Administrator | Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | T5 | IAT II | CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP |
| 4.3.5 | (441) Network Operations Specialist | Plans, implements, and operates network services/systems, to include hardware and virtual environments. | T5 | IAT II | CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP |
| *NOTE: Acceptable baseline certifications at listed at: |
https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/
All Contractor personnel performing functions under this TO and require privileged access, as defined in DoD 8570.01-M, must complete a Privileged Access Agreement (PAA) form and complete training (or obtain a certification) for each OS and/or CE for which they identified within their approved PAA form.
Contract permitting, proof of certification must be provide within 6 months of the date of the approved signed PAA form. CWF certification is only required for the personnel performing CWF duties within a task area, and one person may perform multiple CWF duties.
The Contractor shall determine how to allocate the identified CWF duties among its Key and Non-Key personnel.
| Proficiency Level | Approved Baseline Certifications | |
| Note: higher level certifications may be used to fill lower level requirements | IAT/IAM Level |
| Basic | A+ CE, CCNA-Security, CND, Network+ CE, SSCP | IAT I |
| Intermediate | CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP | IAT II |
| Advanced | CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH | IAT III |
| Basic | CAP, CND, Cloud+, GSLC, Security+ CE | IAM I |
| Intermediate | CAP, CASP+ CE, CISM, CISSP (or Associate), GSLC, CCISO | IAM II |
| Advanced | CISM, CISSP (or Associate), GSLC, CCISO | IAM III |
| Background Investigation | Background |
| Note: Most commonly used is SECRET, but this will increase based on the level of access | |
| Not used at NSWCCD | T1 |
| Most commonly used | T2 |
| Required for adminstrative access to networks - contact CWF-PM or c1043 for assistance if needed. | T3 |
&"Palatino Linotype,Regular"&18Cyberspace Information Technology/Cybersecurity Workforce Certification Matrix &K000000(N0016723RXXXX) Software IT Contract - Dept 80
Reference
| Summary of IA Workforce Qualification Requirements | |||
| IAT/IAM Level | Recommended Experience | Approved Baseline Certifications | |
| IAT I | Apprentice | 0-5 years | A+ CE, CCNA-Security, CND, Network+ CE, SSCP |
| IAT II | Journeyman | at least 3 years | CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP |
| IAT III | Master | at least 7 years | CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH |
| IAM I | Apprentice | 0-5 years | CAP, CND, Cloud+, GSLC, Security+ CE |
| IAM II | Journeyman | at least 5 years | CAP, CASP+ CE, CISM, CISSP (or Associate), GSLC, CCISO |
| IAM III | Master | at least 10 years | CISM, CISSP (or Associate), GSLC, CCISO |
| Glossary | ||
| IAM | Information Assurance Management | 51% or more of duties is management |
| IAT | Information Assurance Technical | 51% or more of duties is technical |
| OS/CE | Operating System/Computing Environment | Can be obtained within 6 months of start date |
| Baseline Certification | As an extension of Appendix 3 to the DoD 8570.01-Manual, the above certifications have been approved as IA baseline certifications for the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their position category or specialty and level. Refer to Appendix 3 of 8570.01-M for further implementation guidance. | |
| Cyber IT/CSWF | Includes IAM/IAT for Cyber IT/CS Workforce. | |
| CWF | Cybersecurity workforce | Personnel who secure, defend, and preserve data, networks, net-centric capabilities, and other designated systems by ensuring appropriate security controls and measures are in place, and taking internal defense actions. This includes access to system controls, monitoring, administration, and integration of cybersecurity into all aspects of engineering and acquisition of cyberspace capabilities. |
| Cyber IT | Cyberspace Information Technology workforce | Personnel who design, build, configure, operate, and maintain IT, networks, and capabilities. This includes actions to prioritize portfolio investments; architect, engineer, acquire, implement, evaluate, and dispose of IT as well as information resource management; and the management, storage, transmission, and display of data and information. |
| References | |||
| DoD 8570.01-M | Information Assurance Workforce Improvement Program Incorporating Change 4 | 10-Nov-15 | |
| DODD 8140.01 | Cyberspace Workforce Management | 31-Jul-17 | |
| DoD Approved 8570 Baseline Certifications (IASE Summary of IA Workforce Qualification Requirements) | https://cyber.mil/wid/dod8140/dod-8570-baseline-certifications/. | ||
| Security and Privacy for Computer Systems | DFARS clause subpart 239.71 | https://www.acq.osd.mil/dpap/dars/dfars/html/current/239_71.htm | |
| Information Assurance Contractor Training and Certification | DFARS clause subpart 239.7102-3 | https://www.acq.osd.mil/dpap/dars/dfars/html/current/239_71.htm | |
| Work Roles | |||
| Code and Name | Description | ||
| (211) Cyber Defense Forensics Analyst | Analyzes digital evidence and investigates computer security incidents to derive useful information in support of system/network vulnerability mitigation. | ||
| (411) Technical Support Specialist | Provides technical support to customers who need assistance utilizing client level hardware and software in accordance with established or approved organizational process components. (i.e., Master Incident Management Plan, when applicable). | ||
| (421) Database Administrator | Administers databases and/or data management systems that allow for the storage, query, and utilization of data. | ||
| (422) Data Analyst | Examines data from multiple disparate sources with the goal of providing new insight. Designs and implements custom algorithms, flow processes and layouts for complex, enterprise-scale data sets used for modeling, data mining, and research purposes. | ||
| (431) Knowledge Manager | Responsible for the management and administration of processes and tools that enable the organization to identify, document, and access intellectual capital and information content. | ||
| (441) Network Operations Specialist | Plans, implements, and operates network services/systems, to include hardware and virtual environments. | ||
| (451) System Administrator | Installs, configures, troubleshoots, and maintains hardware, software, and administers system accounts. | ||
| (461) Systems Security Analyst | Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. | ||
| (632) Systems Developer | Designs, develops, tests, and evaluates information systems throughout the systems development life cycle. | ||
| (612) Security Control Assessor | Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). | ||
| (621) Software Developer | Develops, creates, maintains, and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs. | ||
| (622) Secure Software Assessor | Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results. | ||
| (631) Information Systems Security Developer | Designs, develops, tests, and evaluates information system security throughout the systems development lifecycle. | ||
| (641) Requirements Planner | Consults with customers to evaluate functional requirements and translate functional requirements into technical solutions. | ||
| (651) Enterprise Architect | Develops and maintains business, systems, and information processes to support enterprise mission needs; develops information technology (IT) rules and requirements that describe baseline and target architectures. | ||
| (652) Security Architect | Designs enterprise and systems security throughout the development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into security designs and processes. | ||
| (661) Research & Development Specialist | Conducts software and systems engineering and software systems research in order to develop new capabilities, ensuring cybersecurity is fully integrated. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems. | ||
| (671) Testing and Evaluation Specialist | Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results. | ||
| (722) Information Systems Security Manager | Responsible for the cybersecurity of a program, organization, system, or enclave. (Can only be a civilian in code 1043. 461 would work for ISSOs and others who do similar duties.) | ||
| (723) COMSEC Manager | Manages the Communications Security (COMSEC) resources of an organization (CNSSI No. 4009). | ||
| (731) Legal Advisor | Provides legal advice and recommendations on relevant topics related to cyber law. | ||
| (751) Cyberspace Workforce Developer and Manager | Develop cyberspace workforce plans, strategies and guidance to support cyberspace workforce manpower, personnel, training and education requirements and to address changes to cyberspace policy, doctrine, materiel, force structure, and education and training requirements. | ||
| (752) Cyberspace Policy and Strategy Planner | Develops cyberspace plans, strategy and policy to support and align with organizational cyberspace missions and initiatives. | ||
| (801) Program Manager | Leads, coordinates, communicates, integrates and is accountable for the overall success of the program, ensuring alignment with critical agency priorities. | ||
| (802) IT Project Manager | Directly manages information technology projects. | ||
| (803) Product Support Manager | Manages the package of support functions required to field and maintain the readiness and operational capability of systems and components. | ||
| (804) IT Investment/ Portfolio Manager | Manages a portfolio of IT capabilities that align with the overall needs of mission and business enterprise priorities. | ||
| (805) IT Program Auditor | Conducts evaluations of an IT program or its individual components, to determine compliance with published standards. |
&"Palatino Linotype,Regular"&22References for Cyber IT/CSWF Certification Matrix https://cyber.mil/wid/dod8140/dod-8570-baseline-certifications/ Sheet1
File details come from the government source that posted it. Updated .