PWS Attachment 01 - DDSB Labor Roles - v3 May 20 2025.xlsx

Title Page

Attachment 1 DDSB Labor Roles

Department of Defense Defense Health Agency

Operations and Sustainment Information Technology (IT) Services Program Executive Office Medical Systems/Chief Information Officer (J-6)

PEO MS/CIO (J-6)

Infrastructure and Operations Division (IOD) Domain and Directory Services Branch (DDSB)

Attachment 1 - DDSB Labor Roles

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

TOC

Table of Contents

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

1. Purpose - describes the purpose and use of this file

2. Labor Role Requirements - describes the Labor Role requirements, based on DoD Manual 8140.03.

Background on the Qualifications described in the Labor Role Requirements tab:

3. DCWF Overview

3.1 IT Security Designation

3.2 Proficiency Level

3.3 Microsoft Certifications

1. Purpose

1. Purpose

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

The purpose of this document is to clearly define the roles and responsibilities expected to perform the duties outlined in the PWS in accordance with the DoD Cyberspace Workforce Framework requirements.

2. Labor Role Requirements

2. Labor Role Requirements (based on DoD 8140) DCWF Qualifications, with specific requirements from the DDSB System Owner highlighted in red text are provided below.

This table supersedes the default matrices on the DoD DCWF site [https://public.cyber.mil/wid/dod8140/qualifications-matrices/].

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N https://cyber.mil/dcwf-work-role/system-administrator/https://public.cyber.mil/dcwf-work-role/research-development-specialist/https://public.cyber.mil/dcwf-work-role/security-control-assessor/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://cyber.mil/dcwf-work-role/system-administrator/https://public.cyber.mil/dcwf-work-role/systems-developer/https://public.cyber.mil/dcwf-work-role/enterprise-architect/https://cyber.mil/dcwf-work-role/system-administrator/https://public.cyber.mil/dcwf-work-role/it-program-auditor/https://public.cyber.mil/dcwf-work-role/it-program-auditor/https://public.cyber.mil/dcwf-work-role/it-program-auditor/https://public.cyber.mil/dcwf-work-role/knowledge-manager/https://public.cyber.mil/dcwf-work-role/product-support-manager/https://public.cyber.mil/dcwf-work-role/research-development-specialist/

3. DCWF Overview

3. DCWF Overview

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

DoD Cyberspace Workforce Framework The DoD Cyberspace Workforce Framework (DCWF) is the authoritative reference for the identification, tracking, and reporting of DoD cyberspace positions and the foundation for developing enterprise baseline cyberspace workforce qualifications.

The DCWF describes the work performed by the full spectrum of the cyberspace workforce. The DCWF leverages the original National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NCWF) and the DoD Joint Cyberspace Training and Certification Standards (JCT&CS). It has a hierarchical structure with seven broad categories, 33 specialty areas, and 54 work roles. Each work role contains a definition, as well as a representative list of tasks and Knowledge, Skills, and Abilities (KSAs) describing what is needed to execute key functions. Work roles vary in terms of breadth (e.g. requirements spanning multiple sets of functions) and depth (e.g. requirements focused on a related set of functions).

The DCWF will facilitate uniform identification, tracking, and reporting required by the Federal Cybersecurity Workforce Assessment Act (FCWAA) of 2015.

DoD Manual 8140.03 In accordance with the authority in DoD Directive (DoDD) 5144.02 and the policy in DoDD 8140.01, DoD Manual 8140.03 implements policy, assigns responsibilities, and prescribes procedures for the qualification of personnel identified as members of the DoD cyberspace workforce. It also identifies members of the DoD cyberspace workforce based on the cyberspace work role(s) of the position(s) assigned, as described in DoD Instruction 8140.02.

All DoD personnel assigned to positions requiring the performance of cyberspace work as identified in DoD Instruction 8140.02, in accordance with the DoD Cyberspace Workforce Framework (DCWF). This includes Service members, DoD civilian employees (including non-appropriated fund employees), personnel who provide contracted services (referred to in this issuance as “contractors”), and foreign nationals.

For the purposes of accountability, oversight, and reporting, each cyberspace workforce position is aligned to a workforce element as defined in DoDD 8140.01. A figure representing the alignment of cyberspace work roles to cyberspace workforce elements is available and maintained on the DoD Cyber Exchange site at: https://public.cyber.mil/wid/dcwf/.

DoDM 8140.03 Workforce Structures As stated in DoDM 8140.03, Paragraph 3.1. Cyberspace Workforce Structure, when the contracted support personnel whose performance work statement requires the performance of cyberspace work, the work required should be identified by DCWF work role and proficiency level for primary and additional work roles (up to 3 work role codes) as applicable.

This structure differs significantly from previous workforce structures. It covers the full spectrum of cyberspace work and is based on work roles for greater specificity in identifying and qualifying the cyberspace workforce. Each cyberspace work role will include an associated qualification matrix. The qualification matrix will identify the relevant options available to achieve qualification as described in this section and illustrated in the below figure. Additional information regarding the location and management of these matrices can be found on the DoD Cyber Exchange.

DoDM 8140.03 Cyberspace Workforce Qualification and Management Program

- Applicability, b. All DoD personnel assigned to positions requiring the performance of cyberspace work as identified in DoDI 8140.02, in accordance with the DoD Cyberspace Workforce Framework (DCWF). This includes Service members, DoD civilian employees (including non-appropriated fund employees), personnel who provide contracted services (referred to in this issuance as “contractors”), and foreign nationals.

- Policy, c. Requires contractors to be fully qualified by qualification standards and requirements in accordance with DoDD 8140.01 and this issuance.

- Procedures, b. Contracted support personnel must meet foundational qualification requirements upon commencement of cyberspace work in accordance with Paragraph 3.2. Contractors are not required to meet resident qualification requirements, unless the OSD or DoD Component requires it and the contract includes language to indicate this requirement and how it will be achieved.

- Implementation, a. General Requirements, (1) Plan for and incrementally complete these requirements: (d) Contractors must be qualified in accordance with this issuance at the commencement of work.

Key Components of 8140 Work Role:

Work Role ID:

Workforce Element:

Duties:

Qualification Matrix: URL Foundational Qualification Options:

Proficiency Level (TOP): Basic (Recommended Tier 2), Intermediate (Recommended Tier 3), Advanced (Architect/Engineer/Technical Subject Matter Expert) Education: Degree based upon proficiency level OR DoD/Military Training: Approved DoD Courses (DoD Navy, Army, Airforce) Commercial Training: (TBD) OR Foundational Qualification Alternative Personnel Certification: CompTIA S+ for example Foundational Qualification – Experience: Conditional Alternative, refer to Section 3 of the DoD 8140 Manual for more information.

Residential Qualification – On-the-Job Qualification: Always Required; individuals must demonstrate capability to perform their duties in their resident environment.

Residential Qualification – Environment-Specific Requirements: Component Discretion; individuals must demonstrate capability to perform their duties in their resident environment.

Annual Maintenance – Continuous Professional Development: Minimum of 20 hours annually or what is required to maintain certification; whichever is greater.

Figure 2 Sample Work Role Qualification Matrix

3.1 IT Security Designation

3.1 IT Security Designation

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

Designated federal employee and contractor positions that, due to the sensitive unclassified responsibilities of the positions, require suitability determinations based on personnel security investigations. Public Trust positions are designated as either Moderate-Risk or High-Risk. Public Trust position include positions designated ADP-I, ADP-II, ADP-III, IT-1, IT-2, IT-3, IT-5, IT-6, 5C and 6C.

Investigation Requirement This contract focuses on two types of Position Designation Investigations which are defined by appropriate labor categories.

Noncritical-Sensitive “High Risk” T5 requiring SF86 – ADP/IT I (1), Noncritical-Sensitive “Moderate Risk” T3 requiring SF86 – ADP/IT II (2), No national security sensitive (Non-Sensitive) “Low Risk” T1 requiring SF85 ADP-IT III (3).

Source: https://www.dcsa.mil/Personnel-Security/Background-Investigations-for-Security-HR-Professionals/Start-a-Background-Investigation/Position-Designation-Validate-Need-Correction-Requests/

Security Checklist Traditional Security Checklist Version 2 Release 5 Consideration Dated: 24 Jan 24 Group ID (Vulid): V-245775 Group Title: IA-05.02.01 Rule ID: SV-245775r944961_rule Severity: CAT II Rule Version (STIG-ID): IA-05.02.01 Rule Title: Information Assurance - System Access Control Records (DD Form 2875 or equivalent) Legacy ID: V-31011 Legacy ID: SV-41058r3_ruleFix Text

Figure 1 Traditional Security Checklist Overview Vulnerability Discussion: If accurate records of authorized users are not maintained, then unauthorized personnel could have access to the system. Failure to have user sign an agreement may preclude disciplinary actions if user does not comply with security procedures.

Fixt Text:

3. Local or service-level SAAR forms must minimally contain appropriate information for checking compliance with security requirements for privileged, routine user, Classified, and Unclassified systems access as on the DD Form 2875. Information required includes identification of the individual requesting access, signature dates, supervisory approval, ISSM and SM approval, investigation level and security clearance required, investigation and security clearance possessed, IA (AKA: ADP) position level, and date Information Assurance training was completed.

3.2 Proficiency Level

3.2 Proficiency Level Considerations

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

Proficiency Levels are mapped as following Basic to Tier (Level) 2, Intermediate to Tier 3, and Advanced to Tier 4, which includes Technical Subject Matter Experts, Technical Solution Architects, and Engineering work roles. This methodology will be adopted as a standard throughout IOD and ESA-BAD when new Capability Service Providers are rolled out and 8140 is incorporated into those requirements.

3.3 Microsoft Certifications

3.3 Microsoft Certifications

DDSB PWS Attachment 1 - DDSB Labor Roles &A

&P of &N

Microsoft’s latest certifications can meet requirements through various pathways, all of which are valid. For example, Microsoft Certified: Cyber Security Architect Expert, Microsoft Certified: Azure Solutions Architect Expert, or Microsoft Certified: Azure Administrator Associate could all be applicable for many Microsoft-centered environments. Ultimately, final disposition should be managed between the component Contract Officer Representative (COR) and the System Owner granting privileged access to the Information System (IS). Specific Microsoft certifications are listed under Residential Qualification – Environment Specific Requirements.

Beginner Levels Microsoft 365 Certified: Fundamentals: https://learn.microsoft.com/en-us/credentials/certifications/microsoft-365-fundamentals/?practice-assessment-type=certification Microsoft Certified: Azure Fundamentals: https://learn.microsoft.com/en-us/credentials/certifications/azure-fundamentals/?practice-assessment-type=certification

Intermediate Levels Recommended for the Medical Joint Active Directory (mJAD) Information System:

Microsoft Certified: Azure Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/azure-administrator/?practice-assessment-type=certification Microsoft Certified: Windows Server Hybrid Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/windows-server-hybrid-administrator/ Other certifications based upon specific environments:

Microsoft 365 Certified: Collaboration Communications Systems Engineer Associate: https://learn.microsoft.com/en-us/credentials/certifications/m365-collaboration-communications-systems-engineer/?practice-assessment-type=certification Microsoft 365 Certified: Endpoint Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/modern-desktop/?practice-assessment-type=certification Microsoft 365 Certified: Teams Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/m365-teams-administrator-associate/?practice-assessment-type=certification Microsoft Certified: Azure Virtual Desktop Specialty: https://learn.microsoft.com/en-us/credentials/certifications/azure-virtual-desktop-specialty/?practice-assessment-type=certification Microsoft Certified: Information Protection and Compliance Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/information-protection-administrator/?practice-assessment-type=certification

Advanced Levels Microsoft 365 Certified: Administrator Expert: https://learn.microsoft.com/en-us/credentials/certifications/m365-administrator-expert/ Microsoft Certified: Cybersecurity Architect Expert: https://learn.microsoft.com/en-us/credentials/certifications/cybersecurity-architect-expert/ image1.png image2.png image3.png image4.png